@arnilo/prism 0.0.15 → 0.0.17

package/docs/review-coverage-2026-07-20-phase-4.md

@@ -1,175 +0,0 @@
-# Review coverage — 2026-07-20 Phase 4
-
-Working evidence for Plan 072 Task 0. This page freezes revised Phase 4 scope, source/external revisions, primitive ownership, finite-limit targets, threats, tests, docs, and release gates before implementation.
-
-**Evidence frozen:** 2026-07-20. **Prism source:** `0d109989b4892e3fe4378ab782044ceadc460277` (`Release 0.0.8`). **Release target:** 0.0.9. **Default test rule:** local fakes and fixtures only; Docker/Playwright execution is a separate protected gate.
-
-## Revised product decision
-
-0.0.9 contains production coding and browser execution only. Office document execution is host-selected skill/instruction work outside Prism packaging. Prism will not ship `@arnilo/prism-work-tools/officecli`, an OfficeCLI binary/SDK/wrapper, Office-specific runtime contracts, generic Office MCP/CLI passthrough, Office tests/docs, or an Office release gate. This is a removed product criterion, not deferred 0.0.9 implementation.
-
-Cloud Microsoft 365 and Google Workspace connectors remain a separate later roadmap decision. They cannot depend on or imply local OfficeCLI execution.
-
-## Status legend
-
-| Status | Meaning |
-| --- | --- |
-| `existing` | Current public contract covers the requirement. |
-| `extend` | Owning task extends an existing optional package/contract. |
-| `new-package` | New optional package; core remains dependency-free. |
-| `compose` | Existing public primitives are sufficient; only example/docs or package-local glue may be needed. |
-| `removed` | Deliberately outside Prism product/release scope. |
-
-## Frozen external revisions
-
-| Surface | Frozen reference | Compatibility decision |
-| --- | --- | --- |
-| Prism | [`0d109989b4892e3fe4378ab782044ceadc460277`](../plans/072-release-0-0-9-production-coding-and-browser-execution.md) | All primitive/caller claims below were checked against the 0.0.8 release tree. |
-| Node.js | Local reference `v24.18.0`; Prism release support remains Node 20 and current | Use `node:child_process`, `node:fs`, streams, `AbortSignal`, `URL`, crypto hashes, and path APIs only. Node 20/current tests own compatibility. |
-| Playwright | [`playwright-core@1.61.0`](https://github.com/microsoft/playwright/tree/v1.61.0), npm integrity `sha512-caX7TrY3Ml6egyDX0WUcTHDxodl/b51y5wJOdCEA36QviK/s2g081hvmGs8eaE3DWb6NYZQ6BjO/QkNRPenoPA==` | Task 5 tests this exact compatibility line. Browser binary remains host supplied; package install performs no browser download. Only documented Browser/BrowserContext/Page/Locator/Download APIs are allowed. |
-| Playwright context/locator/snapshot/network docs | [BrowserContext](https://playwright.dev/docs/api/class-browsercontext), [Locator](https://playwright.dev/docs/api/class-locator), [locators](https://playwright.dev/docs/locators), [ARIA snapshots](https://playwright.dev/docs/aria-snapshots), [network](https://playwright.dev/docs/network), retrieved 2026-07-20 | Non-persistent contexts; role/label/test-id and snapshot refs before CSS; `ariaSnapshot({ mode: "ai" })`; service workers blocked when routing must observe requests. Request routing is defense in depth, not DNS containment. |
-| Docker CLI/Engine | Local reference client/server `29.6.1`; [container run](https://docs.docker.com/reference/cli/docker/container/run/), [resource constraints](https://docs.docker.com/engine/containers/run/), [default seccomp](https://docs.docker.com/engine/security/seccomp/), retrieved 2026-07-20 | Task 1 uses an absolute host-selected Docker executable, digest-pinned preloaded image, `--pull=never`, typed arguments, read-only root/source, finite tmpfs workspace, non-root user, dropped capabilities, default seccomp, no-new-privileges, and network none. Exact supported-version floor follows tested flag preflight; 29.6.1 is reference evidence. |
-| Git | Local reference `git version 2.55.0`; [official manuals](https://git-scm.com/docs), retrieved 2026-07-20 | Task 3 uses porcelain/plumbing argument arrays: `status --porcelain=v2 -z`, `diff --no-ext-diff --no-textconv`, `check-ref-format`, `worktree`, `apply --check`, `commit`, and `bundle`. Exact supported-version floor follows fixture/live conformance; 2.55.0 is reference evidence. |
-
-No Office executable, SDK, repository, schema, or version is pinned because Office execution is outside the release boundary.
-
-## Capability traceability matrix
-
-| Revised roadmap criterion | Current surface | Minimum 0.0.9 gap | Status / owner | Required proof | Docs | Release gate |
-| --- | --- | --- | --- | --- | --- | --- |
-| Disposable read-only-base sandbox; writable bounded workspace; deny-default network; CPU/memory/PID/disk/time/secret/termination controls | `SandboxAdapter.exec(command)` maps only shell operations; coding tools have local operation seams | Typed process/lifecycle/import/export Docker reference with real limits and cleanup | `extend` / Task 1 | fake CLI matrix plus protected filesystem/network/process/resource escape tests | `coding-security.md`, `host-security.md`, `performance.md` | protected Docker gate + offline adapter tests |
-| Native bounded repository list/search | `createReadOnlyTools()` contains only `read`; read already has path, byte, line, image, abort bounds | Streaming stdlib list/search and sandbox operation wiring | `extend` / Task 2 | traversal/search ordering, symlink, binary, regex, byte/time/abort tests | `coding-agent-tools.md`, `performance.md` | offline coding conformance |
-| Structured Git status/diff/branch/worktree/patch/commit | Shell can invoke Git but has coarse operation policy | Typed arguments, bounded parsers/results, safe repo config, rollback, artifacts | `extend` / Task 3 | hostile path/ref/config/hook, dirty-tree, rollback, worktree tests | `coding-agent-tools.md`, `coding-security.md` | offline Git conformance + protected sandbox |
-| Named test/lint/typecheck/security commands and diagnostics | Shell operation backend, output accumulator, execution policy, progress events | Host-declared name → fixed executable/args map; bounded summaries/artifacts | `extend` / Task 3 | unknown name, fixed args/env, timeout/output/secret tests | `coding-agent-tools.md`, `performance.md` | offline command conformance |
-| Durable plans/todos/checkpoints/approvals/background branches/restart | Workspace files; `CheckpointStore`; workflow state/suspend/resume/coordinator/leases/events | Reference composition and immutable workspace artifact metadata; no second runtime | `compose` / Task 4 | restart/revision/owner/hash/lease/cancel/stale-worker matrix | `workflows.md`, `coding-agent-tools.md` | offline durable workflow journey |
-| Host-owned PR creation | No repository host API; workflow results can return bounded data | PR handoff metadata + patch/bundle reference only | `extend` / Task 3, composed by Task 4 | deterministic bounded handoff; prove no push/network/credential use | `coding-agent-tools.md`, `workflows.md` | offline handoff conformance |
-| Four Playwright browser tools with one run-owned isolated context and ordered actions | Core tool dispatch/exclusive flag, execution policy, guardrails, run identity; no browser package | Optional package and finite context/page/snapshot/action manager | `new-package` / Task 5 | fake API lifecycle, isolation, stale-ref, ordered-action, cleanup tests | `browser-automation.md`, `tools.md` | package/pack/install + protected Playwright |
-| Browser egress/side-effect/artifact policy | Execution/permission policy, guardrails, path containment, `ImageContent`, redaction | Context routing + host firewall/proxy requirement; upload/download/screenshot quarantine | `new-package` / Task 6 | redirects/private/DNS/service-worker, approval, artifact, secret tests | `browser-automation.md`, `host-security.md` | protected egress/browser gate |
-| Adversarial coding/browser evals and reproducible benchmarks | `@arnilo/prism-evals`, network-free fixtures, current benchmark/live workflow patterns | Package datasets, one 0.0.9 benchmark, protected real gate | `extend` / Task 7 | deterministic score thresholds and benchmark schema/cleanup | `evaluations.md`, `performance.md` | default eval gate + protected live gate |
-| 0.0.9 package/docs/release evidence | 31-package 0.0.8 graph and deterministic release pipeline | Add at most browser package; version/docs/pack/install/audit evidence | `extend` / Task 8 | `sdk:ready`, Node 20/current, pack/install, supply chain, release dry-run | `release-and-install.md`, `migration.md` | complete 0.0.9 release gate |
-| OfficeCLI/Office package/runtime/tests/docs/release criterion | Roadmap-only proposal; no current package | None | `removed` / product decision | docs assertion: absent from Phase 4/package graph/release checklist | this page, `roadmap.md` | explicit absence check |
-
-## Primitive and caller inventory
-
-| Primitive | Existing contract/callers at frozen revision | Phase 4 disposition |
-| --- | --- | --- |
-| `ToolDefinition` / tool dispatch | `src/contracts.ts` defines name/schema/static `exclusive`/execute; `src/tools.ts` applies registry filter, trust, permission, validation, `beforeExecute`, guardrails, run-limit charge, events, ledger, and redaction. Coding, web, MCP, workflows, providers, examples, and tests consume it. | Reuse for list/search/Git/check/browser tools. Browser tools set static `exclusive: true` and also queue per run. No browser-specific dispatch runtime. |
-| `ExecutionPolicy` | String-extensible `ExecutionAction.kind`, operation/paths/command/risk/metadata and allow/modify/deny check in `src/execution-policy.ts`; coding tools enforce immediately before operations; workflow tool nodes can define actions and durable approval. | Reuse. Add package-local `git`, `check`, and `browser` action kinds/metadata; no core enum or approval engine. Policy is authorization, not containment. |
-| `PermissionPolicy` / trust | `src/security.ts`; `dispatchToolCall` and resource loading check host policies before execution/load. MCP/supervisor/extensions also consume permission/trust contracts. | Reuse at dispatch/resource boundaries. Do not duplicate permission logic in sandbox/browser managers. |
-| Guardrails / redaction | `src/tools.ts` runs tool-input/output guardrails and redacts results/events/ledger; `src/agents.ts` handles agent/provider stages. | Reuse for untrusted repository/browser content. Secrets remain host-known redactor inputs; sandbox/browser internals must redact before errors/artifact metadata too. |
-| `RunLimits` / `RunLimitTracker` | Defaults/hard caps in `src/run-limits.ts`; runtime charges turns, provider attempts, tool rounds/calls, wall time, request/response bytes, tokens, cost. MCP/workflow types accept limits. | Reuse for total agent work. Package-local external-resource limits below charge before work/retention; no expansion of `RunLimits` until another domain needs identical counters. |
-| `CheckpointStore` / leases | Generic owner-scoped versioned CAS/fencing contract; memory, SQLite, PostgreSQL, agent lifecycle/state, workflows, and schedules consume it. | Reuse for durable workflow metadata. Store artifact URI/hash/bytes and summaries, never repository/browser state blobs or credentials. |
-| Workflow state/suspend/coordinator | Workflow revision hash, bounded state/history/checkpoints, tool approval suspension, background enqueue, lease renewal/fencing/cancel, finite coordinator concurrency/pages. | Compose coding plan/todo files and branch artifact references. No `CodingRun`, todo DB, scheduler, or second workflow engine. |
-| Coding operation backends | `ReadOperations`, `WriteOperations`, `EditOperations`, `BashOperations`; local defaults; `SandboxAdapter` currently maps shell only. | Task 1 extends coding-security with typed `execFile`/lifecycle; Task 2 wires bounded repository operations. Preserve current custom/local contracts unless tests prove one shared addition is required. |
-| `withFileMutationQueue` | Process-wide map keyed by resolved realpath; used by write/edit; serializes same real path and releases on error. | Reuse for local same-path mutation. Git disposable worktree/patch transaction owns multi-file rollback; do not turn queue into transaction manager. |
-| `ResourceLoader` | Optional load/list with abort, trust, permission; bounded binary helper exists; inputs/contributions/extensions consume it. | May rehydrate a host-owned immutable artifact reference. It is not an artifact store, workspace transport, browser downloader, or network-containment bypass. Task 1/3 use narrow host callbacks for export. |
-| `ImageContent` / media bounds | Core content contract; coding read returns bounded images and can require host transform. | Reuse for bounded screenshots. Browser package enforces pixel/encoded-byte caps before returning content; no new image type. |
-| Agent/workflow events | Tool progress/start/finish/error/block, guardrail/limit events, workflow ordered events and finite buffers. | Reuse for diagnostics/progress/cleanup evidence. No coding/browser event bus or hook registry. |
-| `@arnilo/prism-evals` | Immutable datasets, bounded experiments/concurrency, function scorers, trace/judge/comparison/report limits. | Extend with package-local coding/browser datasets/scorers only; no mandatory model/network/service. |
-| `SandboxAdapter` | One `exec({ command, cwd, env, onData, signal, timeout })` contract and `createSandboxBashOperations`; no lifecycle, typed arguments, transfer, status, or containment implementation. | Extend in coding-security Task 1. Generic core sandbox contract is not authorized. |
-
-### Primitive decision
-
-No new core primitive is authorized by Task 0.
-
-Authorized package-local work:
-
-1. `@arnilo/prism-coding-security`: minimal typed executable, disposable lifecycle, import/export, status, and cleanup contracts implemented by the real Docker reference. Preserve current `SandboxAdapter.exec` compatibility.
-2. `@arnilo/prism-coding-agent`: repository/Git/check/artifact types and operation overrides only where local and sandbox implementations both consume them.
-3. `@arnilo/prism-browser`: run/context/action/artifact manager and Playwright types stay entirely optional-package local.
-
-A shared primitive can be promoted later only with two concrete non-test consumers and migration/conformance evidence. One-consumer interfaces, artifact databases, browser planners, Git libraries, proxy/firewall implementations, Office types, and remote worker/control-plane contracts are rejected.
-
-## Frozen capability boundary
-
-| Surface | Supported in 0.0.9 | Explicitly unsupported |
-| --- | --- | --- |
-| Sandbox | Host-invoked Docker CLI reference; digest-pinned preloaded image; disposable container; finite tmpfs workspace; typed execution; bounded import/export; deterministic cleanup; default network none | Docker daemon provisioning, image build/pull/update, Kubernetes/remote scheduler, bundled image/proxy, host Docker-socket exposure, claim that command policy equals containment |
-| Coding | Native list/literal-or-bounded-regex search; structured Git/status/diff/branch/worktree/patch/commit; named fixed checks; workspace plan/todos; rollback/discard; background workflow composition; PR handoff | Language server/index/watch service, arbitrary model-created commands, implicit repo hook execution, GitHub/GitLab authentication/push/PR client, second coding runtime |
-| Browser | Four model tools; host-supplied Playwright 1.61-compatible browser; non-persistent context; ARIA snapshot/refs and user-facing locators; bounded screenshots/uploads/downloads/popups/dialogs | `evaluate`, arbitrary JavaScript/CSS/XPath, CDP/devtools, extensions, persistent/local profiles, browser binary download, generic MCP proxy, visual/coordinate planner |
-| Network | Network none by default; real browsing only behind host-contained proxy/firewall plus Playwright route checks | DNS rebinding protection by URL regex/routing alone; in-package firewall/proxy; public-network default tests |
-| Artifacts | Bounded host callbacks/references/hashes; download quarantine; screenshot `ImageContent`; patch/bundle/PR handoff | Artifact SaaS/database, unrestricted host paths, checkpointing credentials/storage state/full workspace, automatic upload/push |
-| Office | Host-selected skills/instructions may guide external user-owned work | Any Prism Office executable, SDK, wrapper, package, protocol, tool, test, doc page, binary, or release gate |
-
-## Frozen finite limits and charging points
-
-Values are target defaults / hard caps for Tasks 1–7, not active 0.0.8 APIs. Existing stricter limits remain authoritative. Validate host configuration before starting work; charge count/declared bytes before each operation and stream-count actual bytes before retention/export.
-
-### Sandbox and workspace
-
-| Resource | Default / hard cap | Charge/check point | Failure and cleanup owner |
-| --- | --- | --- | --- |
-| Startup / run wall / idle | 30 s / 120 s; 20 min / 30 min; 5 min / 15 min | Before create; absolute deadline starts before Docker invocation; idle resets only on accepted operation | Task 1 stops, then kills and removes recorded container |
-| CPU / memory+swap / PIDs | 2 / 8 CPUs; 2 GiB / 16 GiB; swap equal to memory; 256 / 1,024 PIDs | Validated before `docker run`; enforced by container/cgroup flags | Task 1 aborts run on limit exit and cleans container |
-| File descriptors | 1,024 / 8,192 | Validated before `docker run`; `nofile` ulimit | Task 1 |
-| Workspace / temp / download tmpfs | 1 GiB / 8 GiB; 256 MiB / 2 GiB; 64 MiB / 512 MiB | Size option validated before create; kernel tmpfs cap enforces writes | Task 1/6 discard on overflow |
-| Commands / concurrent exec | 100 / 256; 1 / 8 | Before queue/start; total also remains under run tool-call/wall limits | Task 1 rejects/aborts; close drains finite queue then kills |
-| Command output | existing 64 MiB / 1 GiB total; model result spill remains separately bounded | Stream byte count before append/write | Coding output accumulator + Task 1 termination |
-| Environment/secrets | 64 names / 256; 64 KiB / 256 KiB aggregate values | Validate exact host allow-list before create/exec; inherit none | Task 1 redacts errors and never exports environment |
-| Import/export | 50,000 / 250,000 entries; 256 MiB / 2 GiB bytes; 16 / 64 retained artifacts | Count headers/entries and stream bytes before write/retain; verify real path/type/hash | Task 1 aborts export, removes partial host artifact, source remains unchanged |
-| Stop grace / forced cleanup | 5 s / 30 s; one stop then one kill; cleanup deadline 30 s / 120 s | Terminal/abort/timeout/lease loss/browser crash | Task 1 records unresolved cleanup as release-blocking error |
-
-### Repository, Git, checks, and durable work
-
-| Resource | Default / hard cap | Charge/check point | Owner |
-| --- | --- | --- | --- |
-| Repository depth / entries / files | 32 / 128; 10,000 / 100,000; 10,000 / 100,000 | Before descending/retaining next entry/file | Task 2 |
-| Search scan/file/matches | 64 MiB / 1 GiB aggregate; 8 MiB / 64 MiB per file; 1,000 / 10,000 matches | Prefix/binary check then stream bytes; check aggregate before next file/match | Task 2 |
-| Search pattern/line/context/time | 512 / 4,096 UTF-8 bytes; 50 KiB / 1 MiB line; 5 / 20 context lines; 30 s / 300 s | Before regex compile; before line/context retention; absolute deadline | Task 2 |
-| Repository concurrency | 8 / 32 open/read workers | Before opening next directory/file | Task 2 |
-| Git paths/refs/message | 1,000 / 10,000 paths; 1 KiB / 4 KiB ref; 64 KiB / 256 KiB commit message | Validate before process/temp-file creation | Task 3 |
-| Git output/diff/patch | 4 MiB / 64 MiB inline output; 10,000 / 100,000 diff lines; 1,000 / 10,000 changed files; 16 MiB / 64 MiB patch input | Stream before retain; spill only through bounded artifact callback | Task 3 |
-| Worktrees/background runs | 4 / 16 per parent run; coordinator default remains 4 and hard cap 256 | Before create/lease claim; exact branch/root ownership recorded | Task 3/4 |
-| Named checks | 8 / 32 names per host config; 1 / 4 concurrent; 10 min / 60 min each; 2,000 / 100,000 diagnostic lines; 4 MiB / 64 MiB inline output | Validate config at construction; charge before start/line retention | Task 3 |
-| Workflow state/checkpoint/history | Existing 64 KiB / 512 KiB state; 1 MiB / 8 MiB checkpoint; 32 / 128 history revisions | Existing workflow adapter checks before save | Task 4 |
-| Workspace checkpoint artifacts | 16 / 64 references; 256 MiB / 2 GiB each, also sandbox export aggregate | Hash/size verify before checkpoint metadata/import | Task 4 with host artifact owner |
-| Plan/todo and PR handoff | 256 KiB / 1 MiB plan; 1,000 / 10,000 todos; 256 KiB / 1 MiB handoff JSON | Before write/checkpoint/result exposure | Task 4 / Task 3 handoff |
-
-### Browser
-
-| Resource | Default / hard cap | Charge/check point | Owner |
-| --- | --- | --- | --- |
-| Contexts/pages/actions/queued actions | exactly 1 context per run; 4 / 16 pages; 100 / 256 actions; 16 / 64 queued | Before context/page/action/queue creation; invalidate refs on mutation | Task 5 |
-| Snapshot refs/depth/bytes | 2,000 / 10,000 refs; depth 30 / 100; 256 KiB / 2 MiB encoded YAML | Before retaining each ref/node and before result exposure | Task 5 |
-| Navigation/action/wait/run time | 30 s / 120 s navigation; 10 s / 60 s action; 30 s / 120 s explicit wait; sandbox 20 min / 30 min run | Absolute deadline before Playwright call; no timeout retries unless action budget charged | Task 5 |
-| Popups/dialogs/listeners | 4 / 16 popups; 16 / 64 dialogs; 64 / 256 registered listeners | Before accepting/retaining; deterministic deny/dismiss after cap | Task 5/6 |
-| Network requests/redirects/WebSockets | 1,000 / 10,000 requests; 10 / 32 redirects/request; 8 / 32 WebSockets | Before route continuation/redirect/socket acceptance | Task 6; host firewall/proxy owns actual egress |
-| Screenshots | 16 / 64 megapixels; existing 10 MB / 32 MiB encoded image cap; 16 / 64 per run | Validate clip/viewport before capture and bytes before result/artifact | Task 6 |
-| Uploads | 8 / 32 files; 16 MiB / 64 MiB each; 64 MiB / 256 MiB aggregate | Realpath/type/size/approval before Playwright receives path | Task 6 |
-| Downloads | 8 / 32 files; 32 MiB / 256 MiB each; 64 MiB / 512 MiB aggregate | Stream to quarantine with count/hash; approval before export | Task 6 |
-| Browser cleanup | 5 s / 30 s close grace, then sandbox kill; 0 retained context/storage-state objects | Abort, terminal run, explicit close, browser crash, lease loss | Task 5 manager and Task 1 sandbox |
-
-## Threat and authority matrix
-
-| Boundary | Trusted authority | Untrusted input | Mandatory control | Default/unsupported behavior |
-| --- | --- | --- | --- | --- |
-| Docker daemon/executable/image | Host operator supplies absolute CLI, daemon, digest, non-root image UID and policy | Model/repository/container output | Typed args; preflight; `--pull=never`; no socket/device/privileged/host namespaces; labels/recorded IDs | Missing/mutable/untrusted input fails before create; daemon compromise is outside Prism containment |
-| Source/workspace import/export | Host selects source and artifact callback | Paths, links, repository entries, archive headers/content | Read-only source; finite tmpfs; realpath/type checks; no devices; stream bounds; hash; atomic partial cleanup | No direct write-back; failed run discards workspace |
-| Process/environment/secrets | Host declares named checks and exact env allow-list | Model command text, repo scripts/config/hooks, process output | Typed exec for first-party tools; shell explicit; inherited env empty; noninteractive Git; redaction; limits | Unknown command/check/env denied; no implicit hooks/credentials |
-| Network/DNS | Host firewall/proxy/network policy | URLs, redirects, DNS, page scripts/service workers/WebSockets | Network none default; isolated proxy/firewall for browse; route validation and service-worker block in depth | No proxy attestation means no external browser network; private/local/file/devtools denied |
-| Playwright/browser endpoint | Host owns pinned browser launch/control endpoint | Pages, DOM/a11y text, refs, popups, downloads | One non-persistent context/run; short-lived host-only endpoint; ordered actions; no evaluate/CDP/profile | Endpoint/browser mismatch fails construction; import is inert |
-| Side effects/approval | Host `PermissionPolicy`, `ExecutionPolicy`, workflow approval | Model/page instructions and action metadata | Dispatch permission/guardrails then immediate operation policy; high-impact durable approval | Page text cannot authorize; denial produces bounded stable result |
-| Browser storage/secrets | Host injects at context/request edge | Cookies/storage state/page content/errors | Never return/persist/log storage state; redact known secret canaries; close context | No local profile; no checkpointed browser internals |
-| Upload/download/screenshot | Host roots, artifact callback, approval | Filenames, MIME, bytes, page pixels, symlinks | Realpath containment; quarantine; stream/pixel/byte caps; hashes; explicit release | Overflow/unknown type stays quarantined then deleted |
-| Durable checkpoint/resume | Host-owned checkpoint/lease/artifact stores and ownership scope | Persisted metadata, stale workers, artifact URI/content | CAS/fencing; workflow revision; image/tool/policy fingerprints; artifact hash/size; current approval | Wrong owner/revision/hash/fence fails before import/action |
-| Office work | User/host-selected external skill/tool | Office files/commands | Outside Prism runtime | No package, executable, schema, docs, test, or release claim |
-
-## Validation matrix for Task 0
-
-| Check | Frozen assertion |
-| --- | --- |
-| Traceability | Every retained Phase 4 criterion above has one primary owner Task 1–8; cross-task composition is explicit. Removed Office criterion has product-decision owner and no implementation task. |
-| Primitive reuse | No new core primitive. Package-local additions have concrete local+sandbox or coding+browser consumers where shared; otherwise remain in owning package. |
-| Finite resources | Every external start/read/write/retain/queue/export path above has default/hard caps, pre-charge point, abort behavior, and cleanup owner. |
-| Security claims | Sandbox containment is Docker/host policy, not regex; browser DNS containment is host proxy/firewall, not Playwright routing; daemon, image, credentials, network, artifacts, and approvals stay host-owned. |
-| Scope absence | Revised roadmap Phase 4, package ledger, persona outcomes, and release checklist contain no OfficeCLI/Office runtime/package gate. |
-
-## Documentation and release ownership
-
-- Task 1: `docs/coding-security.md`, `docs/host-security.md`, `docs/performance.md`, protected Docker gate.
-- Tasks 2–4: `docs/coding-agent-tools.md`, `docs/workflows.md`, `docs/evaluations.md`, offline coding/Git/durable-workflow gates.
-- Tasks 5–6: new `docs/browser-automation.md`, plus tools/guardrails/security/performance docs, package/install and protected Playwright gate.
-- Task 7: eval, benchmark, and protected-gate evidence — completed network-free coding/browser adversarial fixtures (`eval-fixtures.test.ts`), `scripts/benchmark-0.0.9.mjs` (+ schema test), protected Playwright live matrix, expanded Docker protected matrix, and `.github/workflows/sandbox-browser.yml`.
-- Task 8: migration/release docs, package graph, Node/pack/install/supply-chain/release dry-run evidence — completed 32-package exact `0.0.9` graph (`@arnilo/prism-browser` in `prism-all` only), finalized docs/changelogs/migration/release handoff, dated `benchmark-0.0.9` evidence, and release-candidate gates recorded in Plan 072.
-
-No public implementation API changed in Task 0. This page and `roadmap.md` are the authoritative pre-implementation boundary; later tasks may tighten defaults but cannot raise hard caps or broaden authority without updating tests, docs, and this evidence.

package/docs/review-coverage-2026-07-21-phase-5.md

@@ -1,172 +0,0 @@
-# Review coverage — 2026-07-21 Phase 5
-
-Working evidence for Plan 073 Task 0. Freezes Phase 5 / Release **0.0.10** scope, workspace-mode contract, primitive ownership, reused finite limits, threats, tests, docs, and release gates before implementation.
-
-**Evidence frozen:** 2026-07-21. **Prism source:** `5fc05437224f347b00fb6124d1783eb2cd3a9b25` (Task 0 freeze). **Release target:** 0.0.10 (Task 7 retargeted graph from post-ship `0.0.96` → exact `0.0.10`). **Default test rule:** network-free fakes/fixtures; real Docker remains `PRISM_TEST_DOCKER_SANDBOX=1` protected gate.
-
-## Status legend
-
-| Status | Meaning |
-| --- | --- |
-| `existing` | Current public contract covers the requirement. |
-| `extend` | Owning task extends an existing optional package/contract. |
-| `compose` | Existing public primitives suffice; package-local glue / docs / examples only. |
-| `out-of-scope` | Coding-harness P1/P2 or later release; must not land in 0.0.10 tasks. |
-
-## Frozen product decision
-
-0.0.10 closes **coding-harness P0 correctness** only: one explicit workspace mode so disposable sandbox shell and filesystem tools share one tree, fail-closed mixed wiring, tree-identity metadata on import/export/resume, docs that forbid treating host mode as containment.
-
-**Not in 0.0.10** (owned by later phases — do not implement here):
-
-| Deferred item | Owner phase |
-| --- | --- |
-| Session search/index | 0.0.11 Phase 6 |
-| Token/context budgeting + omission reporting | 0.0.11 Phase 6 |
-| Native Anthropic provider | 0.0.11 Phase 6 |
-| Native Google provider | 0.0.11 Phase 6 |
-| Goal→verify coding loop helper/example | 0.0.11 Phase 6 |
-| Additional subscription OAuth adapters | 0.0.12 Phase 7 |
-| AG-UI/ACP-facing event adapter | 0.0.12 Phase 7 |
-| Coding-aware compaction preset | 0.0.12 Phase 7 |
-| Enterprise identity / work connectors | 0.0.13+ |
-| New sandbox runtime, K8s/remote scheduler, automatic image pull, writable bind-mount as a third named mode | never in 0.0.10 |
-
-## Frozen external revisions
-
-| Surface | Frozen reference | Compatibility decision |
-| --- | --- | --- |
-| Prism | [`5fc05437224f347b00fb6124d1783eb2cd3a9b25`](../plans/073-release-0-0-10-coding-harness-unified-workspace.md) | Caller/limit claims below checked against post-0.0.9 tree. |
-| Node.js | Local reference `v24.18.0`; release support remains Node 20 and current | FS/exec backends use `node:child_process` argument arrays, streams, `AbortSignal`, path, crypto hashes only. |
-| Docker CLI/Engine | Local reference client/server `29.6.1`; same Phase 4 docs | Reuse `createDockerSandbox` flags/limits; no new daemon features required for FS backends. |
-| Git | Local reference `git version 2.55.0` | Reuse `createGitTools` + `execFile` binder; same cwd/tree as sandbox mode. |
-
-## Frozen workspace-mode contract
-
-| Decision | Frozen choice |
-| --- | --- |
-| Modes in 0.0.10 | Exactly `"host" \| "sandbox"`. No `"shared_mount"` / future aliases until a later release updates this page. |
-| `workspaceMode` default | **Required.** Missing/undefined throws at construction. No soft-default to host (would preserve the footgun for Docker users). |
-| Escape hatch | `allowMixedWorkspaceWiring: true` (name frozen). Without it, sandbox shell + host-mutating FS/list/search backends throw. With it, composition records explicit warnings; containment claim is false. |
-| Sandbox auto-wire prerequisite | Auto FS/repo backends (Task 2) require `DisposableSandbox` (`execFile`). Bare `SandboxAdapter` (exec-only) may be used in sandbox mode **only** when the host supplies agreeing custom `read`/`write`/`edit`/`repository.operations`. |
-| Host mode shell | May still use `options.sandbox` for shell only when FS backends are local host ops — that is **mixed wiring** and needs the escape hatch, **or** host mode with **no** sandbox (local shell + local FS). Preferred host mode: no sandbox adapter. |
-| Same-tree bind-mount | Host responsibility under escape hatch; Prism does **not** claim disposable containment for that wiring in 0.0.10. |
-| Construction API | Package-local `createSandboxCodingComposition(cwd, options) → { tools, composition }` is the authoritative path. `createSandboxCodingTools` / `createSandboxReadOnlyTools` remain thin wrappers returning `tools` only (compat). |
-| Composition metadata | `ToolDefinition` has **no** metadata field. Warnings/mode/containment live on `SandboxCodingComposition` (`workspaceMode`, `containmentClaim: boolean`, `mixedWiringAllowed: boolean`, `warnings: readonly string[]`, `workspaceRoot`, optional `treeIdentity`). Do not add core `ToolDefinition.metadata`. |
-| Containment claim | `containmentClaim === true` only when `workspaceMode === "sandbox"`, mixed wiring is denied, and FS/repo backends target the disposable tree. Host mode and escape-hatch mixed wiring always `false`. |
-
-## Capability traceability matrix
-
-| Phase 5 roadmap criterion | Current 0.0.9 surface | Minimum 0.0.10 gap | Status / owner | Required proof | Docs | Release gate |
-| --- | --- | --- | --- | --- | --- | --- |
-| Explicit workspace mode; default sandboxed composition no longer silently pairs container shell with host FS mutations | `createSandboxCodingTools` wires shell via `createSandboxBashOperations`; read/write/edit/list/search keep host `cwd` (documented split) | Required `workspaceMode`; sandbox mode auto-wires FS/repo or fails closed | `extend` / Task 1 (+ Task 2 backends) | construction matrix: missing mode throws; sandbox without capable backends throws | `coding-security.md`, `migration.md` | offline coding-security tests |
-| Sandbox mode: shell + read/write/edit/repo_list/repo_search share one tree | Pluggable `*Operations` exist; no sandbox FS/repo defaults | Exec-backed (or host-supplied) FS + repository ops rooted at sandbox workspace | `extend` / Task 2 | write↔shell byte agreement; list/search agree with shell on same tree | `coding-security.md`, `coding-agent-tools.md` | fake sandbox + opt-in Docker |
-| Host mode: all tools on host workspace; no containment claim | `createCodingTools` local defaults; sandbox helper still claims “sandbox” by name while FS is host | Host mode local ops + `containmentClaim: false` | `extend` / Task 1 | host mutations land on host cwd; composition metadata non-isolating | `coding-security.md`, `host-security.md` | offline tests |
-| Import/export/close/resume preserve tree identity | `SandboxExportMetadata` `{ sha256, entryCount, byteCount, format }`; export two-pass; import tar summarize; no import hash retained on session; composition cannot refuse unbound FS | Retain/import identity on disposable session/status; composition refuses containment claim when backends unbound | `extend` / Task 4 | import→mutate→export hash change; export continuity; unbound backends fail closed | `coding-security.md`, `host-security.md` | fake CLI + protected Docker |
-| Reject unsafe mixed wiring unless escape hatch + surfaced metadata | Split composition is the silent default; no guard | Fail-closed check + `allowMixedWorkspaceWiring` + `composition.warnings` | `extend` / Task 1 | throw without hatch; warn with hatch | `coding-security.md`, `migration.md` | offline tests |
-| Performance: no unbounded host↔container sync; reuse entry/byte/time caps; host vs sandbox benchmarks | Existing sandbox/repo/coding hard caps; `scripts/benchmark-0.0.9.mjs` | Reuse caps for FS backends; forbid sync loops; `benchmark-0.0.10` both modes | `extend` / Task 5 | schema/bounds + consistency under caps; concurrent exec still enforced | `performance.md` | benchmark schema test + offline suite |
-| One construction path; pluggable backends; no second coding runtime | Aggregators + `*Operations` seams | Composition helper only; no new agent/runtime | `compose` / Tasks 1–3 | package stays optional; core dependency-free | `coding-security.md` | pack/install |
-| Git/check runners same tree/cwd in sandbox mode | `createGitTools({ execFile: sandbox.execFile })` documented; not auto-bundled | Documented/binder wiring + consistency test | `compose` / Task 3 | write then git status/diff sees file in sandbox | `coding-agent-tools.md`, `coding-security.md` | offline + fake execFile |
-| Security: path containment, policy, digest-pinned non-root Docker remain mandatory for advertised sandbox mode; forbid host-as-contained | Phase 4 Docker reference + approval policy | Docs + `containmentClaim` enforcement; host mode language | `extend` / Tasks 1, 6 | escape/path tests; docs assert host ≠ contained | `host-security.md`, `coding-security.md` | offline + protected Docker |
-| Docs/migration: 0.0.9 split superseded | Docs describe split as current | Replace guidance; migration note | `extend` / Task 6 | docs.test / migration assertions | `migration.md`, index summaries | docs tests |
-| Version/release 0.0.10 evidence | 32-package `0.0.9` (working tree may show `0.0.10`) | Bump graph, changelogs, `sdk:ready`, release dry-run | `extend` / Task 7 | full release gate | `release-and-install.md` | `sdk:ready` + dry-run |
-
-## Primitive and caller inventory
-
-Frozen at `5fc05437224f347b00fb6124d1783eb2cd3a9b25` (+ this evidence page).
-
-| Primitive / symbol | Existing contract / callers | Phase 5 disposition |
-| --- | --- | --- |
-| `createSandboxCodingTools` / `createSandboxReadOnlyTools` | Defined `packages/coding-security/src/sandbox-coding-operations.ts`; exported from package index; **callers:** package tests only (no examples/src production caller yet) | Extend with required `workspaceMode`, mixed-wiring guard, sandbox auto-wire; wrappers over composition helper |
-| `createSandboxBashOperations` | `sandbox.ts`; used by composition, approval tests, sandbox-coding tests | Reuse for shell wiring; unchanged contract |
-| `SandboxAdapter` / `DisposableSandbox` / `createDockerSandbox` | `sandbox.ts`, `docker-sandbox.ts`; Docker tests | Reuse. Sandbox-mode auto FS requires `DisposableSandbox.execFile`. No new core sandbox type |
-| `SandboxExportMetadata` | `{ sha256, entryCount, byteCount, format: "tar" }` on close export | Reuse shape for tree identity; Task 4 may expose import/last-export on status/composition |
-| `ReadOperations` / `WriteOperations` / `EditOperations` | `packages/coding-agent/src/{read,write,edit}.ts`; local defaults; custom ops optional | Reuse contracts. Task 2 implements sandbox-backed adapters in **coding-security** only |
-| `RepositoryOperations` / `createLocalRepositoryOperations` | `repository.ts`; list/search tools | Reuse. Task 2 adds sandbox-backed repo ops in coding-security |
-| `BashOperations` / `createLocalBashOperations` | `shell.ts` | Reuse |
-| `createGitTools` / `resolveGitRunner` / `execFile` option | `git-tools.ts`, `git-exec.ts`; coding-agent git tests | Reuse. Task 3 documents/binds same workspace root; optional thin coding-security binder only if ≥2 non-test call sites |
-| `ExecutionPolicy` / path containment / approval | coding-security + coding-agent | Reuse; mandatory for advertised sandbox mode |
-| `ToolDefinition` | Core `src/contracts.ts` — name/description/parameters/exclusive/execute only | **No** new metadata field. Composition descriptor stays package-local |
-| Core agent/session/workflow runtimes | Unchanged | **No** second coding runtime; no core primitive promotion |
-
-### Primitive decision
-
-**No new core primitive authorized.**
-
-Authorized package-local work (`@arnilo/prism-coding-security` unless noted):
-
-1. `workspaceMode` + `allowMixedWorkspaceWiring` + `SandboxCodingComposition` + `createSandboxCodingComposition`.
-2. `createSandboxFilesystemOperations` / `createSandboxRepositoryOperations` (names may shorten in impl; stay package-local).
-3. Optional `bindSandboxGitOptions` only if examples + package tests both need identical wiring (else docs-only).
-4. Minimal `DisposableSandbox` status/identity fields for import/export continuity (Task 4) — still coding-security local.
-
-Promote to core only with ≥2 non-test consumers outside coding-security **and** migration/conformance evidence. One-consumer interfaces, sync daemons, Merkle indexes, and third workspace modes are rejected for 0.0.10.
-
-## Frozen capability boundary
-
-| Surface | Supported in 0.0.10 | Explicitly unsupported |
-| --- | --- | --- |
-| Workspace modes | `host`, `sandbox`; required option; fail-closed mixed wiring; escape hatch with warnings | Soft-default mode; silent split-brain; named `shared_mount` mode; claiming containment for host/escape-hatch |
-| Sandbox FS | ExecFile-backed read/write/edit/list/search against disposable tree; host-supplied custom ops | Unbounded bidirectional sync loops; new transport protocol; automatic host write-back |
-| Docker reference | Existing digest-pinned, non-root, network-none, finite tmpfs, import/export | Image pull/build, daemon provisioning, K8s, Docker socket exposure |
-| Git/checks | Same-tree via `execFile` + cwd; optional binder | Auto-include Git in default coding tool set; push/PR/network |
-| Artifacts / identity | Existing export metadata + retained import/export hashes for resume checks | Full workspace in checkpoints; secret-bearing identity blobs |
-
-## Frozen finite limits and charging points
-
-**Rule:** Reuse Phase 4 / shipped coding-security and coding-agent defaults and hard caps. Task 2–5 **must not** raise hard caps or add unbounded sync. Charge before each sandbox FS/repo/exec operation against the same counters.
-
-### Sandbox and workspace (reuse `sandbox-limits.ts`)
-
-| Resource | Default / hard cap | Charge/check point | Failure/cleanup owner |
-| --- | --- | --- | --- |
-| Startup / wall / idle | 30 s / 120 s; 20 min / 30 min; 5 min / 15 min | Existing create/exec | Task 4/Docker session |
-| CPU / memory / PIDs / FDs | 2 / 8; 2 GiB / 16 GiB; 256 / 1,024; 1,024 / 8,192 | Before `docker run` | existing |
-| Workspace / tmp / download tmpfs | 1 GiB / 8 GiB; 256 MiB / 2 GiB; 64 MiB / 512 MiB | Before create / write overflow | existing |
-| Commands / concurrent execs | 100 / 256; 1 / 8 | Before each exec **including FS-backend execFile** | Task 2 must share queue |
-| Command/FS output | 64 MiB / 1 GiB | Stream before retain | Task 2 + output accumulator |
-| Import/export entries/bytes / retained artifacts | 50,000 / 250,000; 256 MiB / 2 GiB; 16 / 64 | Before retain; two-pass hash verify | Task 4 |
-| Stop grace / cleanup | 5 s / 30 s; 30 s / 120 s cleanup | Terminal paths | existing |
-
-**Forbidden:** background host↔container watchers, periodic full-tree sync, unbounded `docker cp` retry loops, retaining more than `maxExport*` without export API.
-
-### Repository / read / write / edit (reuse `packages/coding-agent/src/limits.ts`)
-
-| Resource | Default / hard cap | Owner for sandbox backends |
-| --- | --- | --- |
-| Repo depth / entries / files / results / concurrency | 32 / 128; 10k / 100k; 10k / 100k; 1k / 10k; 8 / 32 | Task 2 |
-| Search scan/file/matches/pattern/line/context/time | 64 MiB / 1 GiB; 8 MiB / 64 MiB; 1k / 10k; 512 / 4,096 B; 50 KiB / 1 MiB; 5 / 20; 30 s / 300 s | Task 2 |
-| Read text/image; write; edit file/input/edits | existing coding-agent ceilings | Task 2 |
-| Git paths/refs/message/output | existing git ceilings | Task 3 |
-
-## Threat and authority matrix
-
-| Boundary | Trusted authority | Untrusted input | Mandatory control | Default / unsupported |
-| --- | --- | --- | --- | --- |
-| Workspace mode selection | Host sets `workspaceMode` explicitly | Model/tool args cannot change mode | Construction throws if missing; mixed wiring throws without hatch | Silent split-brain unsupported |
-| Sandbox containment claim | Host + composition when backends agree on disposable tree | Model claims, host cwd edits under sandbox advertising | `containmentClaim` only when mode=sandbox and backends bound; path containment + Docker policy | Host mode / escape hatch never claim containment |
-| Sandbox FS backends | Host-supplied `DisposableSandbox` or custom ops | Paths, symlink targets, archive/exec output | Workspace-root realpath/containment; byte/entry/time caps; share concurrent exec limits | Escape outside `/workspace` denied |
-| Mixed wiring escape hatch | Host sets `allowMixedWorkspaceWiring` | Accidental omitted ops | Explicit option + `composition.warnings` | Undocumented mixed wiring unsupported |
-| Import/export identity | Host artifact callback + hash verify | Tar headers/content | Existing type checks + two-pass hash; resume compares hashes | Advertise sandboxed coding on unbound host root unsupported |
-| Docker/image/secrets | Host digest/CLI/allow-list | Model env/commands | Phase 4 Docker controls unchanged | Pull/build/socket unsupported |
-| Git in sandbox | Host `commitIdentity` + `execFile` | Refs/pathspecs/hooks | Existing safe git config; same workspace root | Push/PR/credentials unsupported |
-
-## Validation matrix for Task 0
-
-| Check | Frozen assertion |
-| --- | --- |
-| Traceability | Every Phase 5 roadmap criterion maps to exactly one primary owner among Tasks 1–7; 0.0.11+ items listed only under out-of-scope. |
-| Primitive reuse | No new core primitive. FS/repo helpers stay coding-security-local unless a second non-test consumer appears. |
-| Finite resources | Sandbox FS/repo paths reuse existing defaults/hard caps; concurrent exec shared; no sync loops. |
-| Security claims | Containment is Docker/host policy + bound backends, not regex; host mode and escape hatch are non-containing by contract. |
-| Mode API | `workspaceMode` required; modes `{host,sandbox}` only; escape hatch name `allowMixedWorkspaceWiring`; metadata on `SandboxCodingComposition`, not `ToolDefinition`. |
-
-## Documentation and release ownership
-
-- Task 0 (this page): scope freeze, index link, docs.test evidence assertions.
-- Tasks 1–4: implementation; API docs deferred to Task 6 except in-code JSDoc.
-- Task 5: adversarial tests, `scripts/benchmark-0.0.10.mjs`, protected Docker extensions.
-- Task 6: `docs/coding-security.md`, `docs/coding-agent-tools.md`, `docs/migration.md`, `docs/host-security.md`, `docs/performance.md`, package READMEs/changelogs, index summary tweaks.
-- Task 7: version `0.0.10`, `sdk:ready`, pack/install/supply-chain, release dry-run — **done** (1,963 tests / 1,934 pass / 29 skip; 32/32 dry-run; no tag/publish).
-
-No public implementation API changes in Task 0. This page, `roadmap.md` Phase 5, and Plan 073 are the authoritative pre-implementation boundary; later tasks may tighten defaults but cannot raise hard caps, add sync loops, introduce a third mode, or claim host-mode containment without updating tests, docs, and this evidence.

package/docs/review-coverage-2026-07-22-phase-6.md

@@ -1,209 +0,0 @@
-# Review coverage — 2026-07-22 Phase 6
-
-Working evidence for Plan 074 Task 0. Freezes Phase 6 / Release **0.0.11** scope, primitive ownership, finite limits, threats, tests, docs, and release gates before implementation.
-
-**Evidence frozen:** 2026-07-22. **Prism source:** `a677113a409b1b60a3361a76c980e7411013916a` (post-0.0.10 / Task 0 freeze). **Release target:** 0.0.11. **Default test rule:** network-free fakes/fixtures; provider live canaries remain gated (`PRISM_LIVE_PROVIDER_TESTS=1` + host keys).
-
-## Status legend
-
-| Status | Meaning |
-| --- | --- |
-| `existing` | Current public contract covers the requirement. |
-| `extend` | Owning task extends an existing core/package contract. |
-| `new-package` | New optional workspace package behind existing provider-package seams. |
-| `compose` | Existing public primitives suffice; package-local glue / docs / examples only. |
-| `out-of-scope` | Coding-harness P2+ or later release; must not land in 0.0.11 tasks. |
-
-## Frozen product decision
-
-0.0.11 closes **coding-harness P1 fundamentals** only: bounded session search/index, assembler-time context budgets with omission reports, native Anthropic then Google provider packages, and a thin goal→verify coding helper/example.
-
-**Not in 0.0.11** (owned by later phases — do not implement here):
-
-| Deferred item | Owner phase |
-| --- | --- |
-| Additional subscription OAuth adapters | 0.0.12 Phase 7 |
-| AG-UI/ACP-facing event adapter | 0.0.12 Phase 7 |
-| Coding-aware compaction preset | 0.0.12 Phase 7 |
-| Enterprise identity / Azure·Bedrock·Vertex / work connectors | 0.0.13+ |
-| Always-on FTS reindex workers / indexer daemons | never in 0.0.11 |
-| Goal database / second agent or workflow runtime | never in 0.0.11 |
-| Shared core Anthropic Messages serializer extraction | defer until ≥2 byte-identical non-test consumers |
-| Soft-raising hard caps; unbounded full-store scans as default search | never in 0.0.11 |
-
-## Frozen external revisions
-
-| Surface | Frozen reference | Compatibility decision |
-| --- | --- | --- |
-| Prism | [`a677113a409b1b60a3361a76c980e7411013916a`](../plans/074-release-0-0-11-coding-harness-fundamentals.md) | Caller/limit claims checked against shipped 0.0.10 tree. |
-| Node.js | Local reference `v24.18.0`; release support remains Node 20 and current | Providers use `fetch` + existing `@arnilo/prism/providers/transport` SSE helpers; no vendor SDKs. |
-| Anthropic Messages | ctx7 `/anthropics/anthropic-sdk-typescript` + official Messages docs at impl time | Stream SSE, tools, `cache_control` ephemeral `5m`/`1h`, thinking blocks, usage; package-local wire (OpenCode Go route is pattern only). |
-| Google Gemini | ctx7 `/websites/ai_google_dev_gemini-api` + Gemini `generateContent` / stream docs at impl time | Tools/function calling, multimodal `inlineData`, usage metadata; Vertex enterprise identity stays 0.0.13. |
-| SQLite FTS5 / PostgreSQL FTS | Adapter docs at impl time | Dialect-local FTS; metadata filters shared shape. |
-
-## Frozen API and mode contract
-
-| Decision | Frozen choice |
-| --- | --- |
-| Search interface | `SessionIndex` with `search(query: SessionSearchQuery): Promise<PersistencePage<SessionSearchHit>>`. Optional on stores via `searchSessions?` **or** returned companion index — adapters implement one authoritative path; hosts must not need both. |
-| Query / hit types | `SessionSearchQuery`, `SessionSearchHit` in core (next to session/persistence contracts). |
-| Hit fields | Required: `sessionId`. Optional: `leafId` (branch tip for `checkout`), `updatedAt`, `label`, `summary`, `snippet`, safe display metadata. **Never** credentials, raw message bodies wholesale, or secret-looking payloads. |
-| Workspace filter | Host-written `metadata.workspaceRoot` (string path/key). No first-class `prism_sessions.workspace` column in 0.0.11. Query field name: `workspaceRoot`. |
-| Text / filters | Optional `query` (FTS/message+summary); `provider` / `model`; `label`/`summary` substring or FTS per adapter; `fromUpdatedAt`/`toUpdatedAt`; `OwnershipScope` (`tenantId`/`accountId`/`userId`). |
-| Pagination | Reuse `PersistencePage` + `limit`/`cursor`/`order`. |
-| Memory search | `createMemorySessionStore(entries?, options?)` with `sessionSearchMode: "linear" \| "unsupported"`; **default `"linear"`**. `"unsupported"` throws typed error (not empty success). JSONL: document unsupported unless a thin linear path is trivial — prefer explicit unsupported. |
-| Context budget | `contextBudget` on `AssembleProviderInputOptions` (and forward from `AgentConfig`/`RunOptions` only if needed). Shape: `{ maxInputTokens?: number; maxInputBytes?: number; reportOmissions?: boolean }`. At least one max required when budget object present. |
-| Eviction priority | Keep first: **system/AGENTS instructions → skills → context blocks → history/tool results** (drop from the end of that priority stack). Current user `input` and mandatory system prefix fail closed if they cannot fit. |
-| Omission report | Prefer non-breaking: `ProviderRequest.metadata.contextBudgetReport` + typed helper `getContextBudgetReport(request)`. Report ids/kinds/sizes/tokenEstimates — not secret values. Raw session store entries untouched. |
-| Token estimate | Finite heuristic: **UTF-16 code units / 4** (chars÷4) unless model supplies a cheaper local estimator later. Document as estimate, not billing. |
-| Anthropic package | `@arnilo/prism-provider-anthropic`; exports `createAnthropicProviderPackage`, `createAnthropicMessagesProvider`, `listAnthropicModels` (caller-gated). |
-| Google package | `@arnilo/prism-provider-google`; exports `createGoogleProviderPackage`, Gemini provider factory, `listGoogleModels` (caller-gated). |
-| Goal/verify | `runCodingGoalVerify` exported from `@arnilo/prism-coding-agent`; example `examples/coding-goal-verify.ts`. No Goal table. |
-| Package count | 0.0.10 graph **32** publishable packages → **34** after anthropic + google (**confirmed** at Task 13). |
-
-## Capability traceability matrix
-
-| Phase 6 roadmap criterion | Current 0.0.10 surface | Minimum 0.0.11 gap | Status / owner | Required proof | Docs | Release gate |
-| --- | --- | --- | --- | --- | --- | --- |
-| Bounded `SessionIndex` lists/filters by workspace, time, model/provider, label/summary, optional message FTS; hits return `sessionId` + optional `leafId` | `ProductionPersistenceStore.querySessions` metadata-only (`SessionQuery`); no text/FTS/workspace filters; `SessionStore` has no search | Core `SessionIndex` + query/hit types + optional store seam | `extend` / Task 1 | type/export smoke; invalid limit/query rejected; conformance empty/pagination/ownership | `public-contracts.md`, `session-stores.md` | offline + conformance |
-| SQLite + PostgreSQL implement search with finite pages | DDL has `metadata`, entry `label`/`summary`; no FTS objects | Migrations + adapter `search`; metadata filters + optional FTS | `extend` / Task 2 | pagination, label/summary/FTS hits, ownership isolation, resume via `leafId`, migration drift | `sqlite-persistence.md`, `postgres-persistence.md` | offline adapter tests |
-| Memory: linear fallback **or** explicit unsupported | `createMemorySessionStore(entries)` only; no options | Both modes; default linear; unsupported throws typed | `extend` / Task 3 | hit/miss/cap; unsupported ≠ empty | `session-stores.md` | offline |
-| Token/context budget + omission report; no raw history delete | `assembleProviderInput` / message groups; no budget | `contextBudget` + deterministic eviction + report | `extend` / Task 4 | eviction order; omission completeness; zero-budget fail; cache-aware prefix when under budget | `input-and-prompt-assembly.md` | offline |
-| Native Anthropic Messages package | OpenCode Go Anthropic **route** only; AI SDK escape hatch | New `@arnilo/prism-provider-anthropic` | `new-package` / Task 5 | offline conformance matrix + gated live | `providers/anthropic.md` | offline + opt-in live |
-| Native Google Gemini package | No first-party Google package | New `@arnilo/prism-provider-google` after Anthropic | `new-package` / Task 6 | same conformance bar; Vertex out of scope | `providers/google.md` | offline + opt-in live |
-| Thin goal→verify helper + example; no Goal DB / second runtime | `createCodingPlanMarkdown`, checks, `git_pr_handoff`, `suspend`/`resumeWorkflow`, `examples/durable-coding-workflow.ts` | `runCodingGoalVerify` + `examples/coding-goal-verify.ts` | `compose` / Task 7 | fail→suspend→approve→resume; bounded handoff; no secrets in plan state | `coding-agent-tools.md`, `agent-loops.md`, `workflows.md` | offline + example |
-| Performance: finite search/budget; network-free benches | `querySessions` default `limit ?? 100`; no search/budget benches | Caps below; `scripts/benchmark-0.0.11.mjs` | `extend` / Tasks 1–4, 9 | schema/bounds; search+budget benches | `performance.md` | benchmark + `sdk:ready` |
-| Code quality: optional seams; optional provider pkgs; helper composition | Provider package pattern; optional `readBranchPath` | Same pattern for search/budget; no core Anthropic extract | `compose` / Tasks 1–7 | ≥2-consumer rule for shared extract; package-local first | provider/session docs | pack/install |
-| Security: ownership on search; no creds in hits/omissions; late-bound provider creds | `OwnershipScope` on persistence queries; provider redaction | Enforce on search; redact snippets/reports | `extend` / Tasks 1–6 | ownership empty/forbidden; secret scan fixtures | session + provider docs | offline + audit |
-| Docs/migration 0.0.10 → 0.0.11 | Phase 5 docs | Update functional pages + two provider pages | `extend` / Task 8 | docs.test assertions | `migration.md`, index | docs tests |
-| Version/release 0.0.11 | Graph at `0.0.10` | Bump to `0.0.11`; umbrella deps; dry-run | `extend` / Task 9 (renumbered Task 13) **done** | `sdk:ready` + release dry-run | `release-and-install.md` | Task 9/13 gates |
-
-## Primitive and caller inventory
-
-Frozen at `a677113a409b1b60a3361a76c980e7411013916a` (+ this evidence page).
-
-| Primitive / symbol | Existing contract / callers | Phase 6 disposition |
-| --- | --- | --- |
-| `SessionStore` / `readBranchPath?` | Core; memory/JSONL omit path; sqlite/postgres implement | **Extend optional** with search seam (`searchSessions?` or companion `SessionIndex`). Do not require FTS on memory/JSONL. |
-| `ProductionPersistenceStore.querySessions` | Metadata listing; sqlite/postgres | **Keep** for admin listing. Search is separate (`SessionIndex.search`); do not overload `SessionQuery` as sole FTS surface. |
-| `SessionQuery` / `SessionRecord` / `OwnershipScope` / `PersistencePage` | Core contracts | Reuse ownership + page shape; add parallel search types. |
-| `prism_sessions.metadata`, entry `label`/`summary` | sqlite/postgres DDL | Reuse for workspace/label/summary filters; FTS tables adapter-local. |
-| `assembleProviderInput` / `createDefaultInputBuilder` / groups / `legacy`\|`cache_aware` | `src/input.ts` | **Extend** with `contextBudget` after groups built / before final request; no parallel assembler. |
-| `ProviderRequest.metadata` | Core | Host omission report via frozen metadata key + helper. |
-| Provider package setup (`defineProviderPackage`, conformance, transport SSE, media SSRF) | openai/kimi/opencode-go/… | Reuse. New anthropic/google packages follow same layout. |
-| `packages/provider-opencode-go/src/anthropic-messages.ts` | Vendor OpenCode route | **Pattern only.** No shared core extract in 0.0.11. |
-| Kimi Anthropic-compatible route | package-local | Unchanged; not a consumer of new anthropic package serializer. |
-| `createCodingPlanMarkdown` / checks / `git_pr_handoff` / coding-checkpoint limits | coding-agent | Reuse inside `runCodingGoalVerify`. |
-| `suspend` / `resumeWorkflow` | `@arnilo/prism-workflows` | Reuse; helper does not fork workflow engine. |
-| `examples/durable-coding-workflow.ts` | Example pattern | Pattern for `examples/coding-goal-verify.ts`. |
-| AI SDK provider package | Escape hatch | Remains escape hatch; not primary Anthropic/Google path. |
-
-### Primitive decision
-
-**Authorized new/extended core seams (minimal):**
-
-1. `SessionIndex` / `SessionSearchQuery` / `SessionSearchHit` + finite search-cap constants.
-2. Optional `SessionStore` search hook (or documented companion index from adapter factories).
-3. `contextBudget` on assemble options + `getContextBudgetReport` (+ estimate/apply helpers; may live in `src/context-budget.ts` re-exported).
-4. Memory store options: `sessionSearchMode`.
-
-**Authorized new packages:** `@arnilo/prism-provider-anthropic`, `@arnilo/prism-provider-google`.
-
-**Authorized package-local compose:** `runCodingGoalVerify` in coding-agent + example.
-
-**Rejected for 0.0.11:** Goal DB; second runtime; always-on indexer; `ToolDefinition.metadata`; core Anthropic shared serializer; Vertex/Bedrock/Azure enterprise adapters; raising hard caps; default unbounded full-store scan.
-
-Promote additional shared helpers to core only with ≥2 non-test consumers **and** migration/conformance evidence.
-
-## Frozen capability boundary
-
-| Surface | Supported in 0.0.11 | Explicitly unsupported |
-| --- | --- | --- |
-| Session search | Metadata filters + optional FTS; finite pages; memory linear (capped) or unsupported throw | Daemon indexer; silent empty on unsupported; credential fields on hits; first-class workspace column |
-| Context budget | Assembler eviction + omission report; heuristic estimate | Compaction/summarization as budget (0.0.12 preset); deleting store history; provider round-trip for count |
-| Anthropic | Native Messages HTTP package; tools/cache/thinking/media/usage/discovery | Subscription OAuth (0.0.12); official SDK dependency; env scan at import |
-| Google | Native Gemini HTTP package for coding-host semantics | Vertex enterprise identity (0.0.13); `@google/genai` runtime dep unless fetch proven impossible at impl (prefer fetch) |
-| Goal/verify | Thin coding-agent helper + network-free example | Goal table; second workflow/agent engine; auto-push/PR network |
-
-## Frozen finite limits and charging points
-
-**Rule:** Search and budget paths must validate caps in O(1) before scan/query. No always-on watchers. Do not raise hard caps in Tasks 1–9 without updating this page + tests + docs.
-
-### Session search (new — freeze defaults)
-
-| Resource | Default / hard cap | Charge/check point | Failure/cleanup owner |
-| --- | --- | --- | --- |
-| Page `limit` | 20 / 100 | Before query/scan | Task 1 validation; Task 2–3 adapters |
-| Query string bytes | 4 KiB / 16 KiB | Before parse/FTS | Task 1 |
-| Snippet bytes per hit | 512 / 4 KiB | Before hit assembly | Task 2–3 |
-| Cursor bytes | 1 KiB / 4 KiB | Before decode | Task 1–2 |
-| Memory linear: sessions scanned | 1,000 / 5,000 | During scan; abort on signal | Task 3 |
-| Memory linear: entries scanned | 10,000 / 50,000 | During scan | Task 3 |
-| Memory linear: bytes scanned | 8 MiB / 64 MiB | During scan (serialized entry text) | Task 3 |
-| DB FTS match candidates before page trim | adapter-local ≤ 1,000 / 5,000 | Before materializing snippets | Task 2 |
-
-**Forbidden:** default path that scans entire store with no limit; background reindex workers; retaining unbounded snippet corpora.
-
-Existing `querySessions` default `limit ?? 100` stays for admin listing; search defaults are tighter (20).
-
-### Context budget (new — freeze defaults)
-
-| Resource | Default / hard cap | Charge/check point | Owner |
-| --- | --- | --- | --- |
-| `maxInputTokens` when set | caller-required; hard max 2_000_000 | Before eviction | Task 4 |
-| `maxInputBytes` when set | caller-required; hard max 32 MiB | Before eviction | Task 4 |
-| Estimate cost | O(assembled messages); no network | During estimate | Task 4 |
-| Omission report entries | 256 / 1,024 | When `reportOmissions` | Task 4 |
-
-**Forbidden:** provider call for budgeting; mutating/deleting `SessionStore` entries from budget path.
-
-### Providers / coding helper (reuse existing)
-
-| Resource | Disposition |
-| --- | --- |
-| Stream/SSE/media/run limits | Reuse existing provider transport + run-limit ceilings (Tasks 5–6) |
-| Coding checkpoint / check / PR handoff bytes | Reuse `packages/coding-agent` `DEFAULT_*` / `HARD_*` (Task 7) |
-| Workflow suspend/resume | Existing workflow limits unchanged |
-
-## Threat and authority matrix
-
-| Boundary | Trusted authority | Untrusted input | Mandatory control | Default / unsupported |
-| --- | --- | --- | --- | --- |
-| Search ownership | Host passes `OwnershipScope` | Model-supplied tenant ids | Adapters filter tenant/account/user when present; mismatch → empty or typed forbidden per existing persistence norms | Cross-tenant search unsupported |
-| Search snippets | Adapter redaction-safe projection | Message/tool payloads | Snippet caps; never copy credential fields; prefer label/summary/FTS fragment | Raw full transcript as hit unsupported |
-| Budget omissions | Assembler metadata helper | Dropped block contents | Report kinds/ids/sizes only; redactor still applies to provider messages | Secret values in omission report unsupported |
-| Provider credentials | Host `CredentialValueSource` late-bound | Env/process ambient keys | No import/setup network or keychain scan; redact errors | Env auto-discovery unsupported |
-| Goal/verify approval | Host approval policy | Model “approved” claims | Fail closed without approval; suspend/resume via workflows | Implicit approve unsupported |
-| Provider headers | Provider-owned required headers win | Host override attempts on reserved names | Existing header-ownership rules | Host overwrite of provider auth headers unsupported |
-
-## Validation matrix for Task 0
-
-| Check | Frozen assertion |
-| --- | --- |
-| Traceability | Every Phase 6 roadmap criterion maps to exactly one primary owner among Tasks 1–9; 0.0.12+ items listed only under out-of-scope. |
-| Primitive reuse | Only authorized core seams above; Anthropic/Google are new optional packages; goal/verify is compose-only. Shared Anthropic extract deferred (≥2-consumer rule). |
-| Finite resources | Search/budget caps table enforced; no indexer daemons; no unbounded default scans. |
-| Security claims | Ownership on search; hits/omissions credential-free; provider creds late-bound/redacted. |
-| API names | `SessionIndex` / `SessionSearchQuery` / `SessionSearchHit`; `contextBudget` + `getContextBudgetReport`; `sessionSearchMode`; `createAnthropicProviderPackage` / `createGoogleProviderPackage`; `runCodingGoalVerify`; workspace key `metadata.workspaceRoot`. |
-| Eviction order | system/AGENTS → skills → context → history/tool results. |
-
-## Post-freeze extensions (Tasks 8–11)
-
-Plan 074 inserted mid-run steer + ask_user_decision multi/free-text/suspend before docs/release (renumbered Tasks 12–13). Still inside 0.0.11; no Goal DB / no new `AgentRunInterruption` kinds.
-
-| Extension | Frozen choice | Docs | Proof |
-| --- | --- | --- | --- |
-| Mid-run `steer` | Queue ≤8 / ≤64 KiB; softInterrupt aborts provider stream only; same `runId`; fail closed with no active run | `agent-session-runtime.md`, `cli-rpc.md`, `agent-loops.md` | agent + RPC tests |
-| ask_user multi | `selectionMode: "multiple"` → `selectedIds` | `coding-agent-tools.md` | coding-agent tests |
-| ask_user free-text | `allowCustom` + XOR `customText` | `coding-agent-tools.md` | coding-agent tests |
-| ask_user suspend glue | `suspendAskUserDecision` + resume validators; agent adapter only | `coding-agent-tools.md`, `workflows.md` | workflow suspend→approve test |
-
-## Documentation and release ownership
-
-- Task 0 (this page): scope freeze, index link, docs.test evidence assertions.
-- Tasks 1–7: original Phase 6 implementation owners (search/budget/providers/goal-verify).
-- Tasks 8–11: steer + ask_user_decision multi/free-text/suspend glue.
-- Task 12: session/input/provider/coding/workflows/migration/performance docs, READMEs/CHANGELOGs, index summaries.
-- Task 13: version `0.0.11`, benchmarks, `sdk:ready`, pack/install/supply-chain, release dry-run — **done** (2,047 tests / 2,014 pass / 33 skip; 34/34 dry-run; no tag/publish).
-
-No public implementation API changes in Task 0. This page, `roadmap.md` Phase 6, and Plan 074 are the authoritative pre-implementation boundary; later tasks may tighten defaults but cannot raise hard caps, add daemons/Goal DB/second runtime, or pull 0.0.12+ items without updating tests, docs, and this evidence.