@arnilo/prism 0.0.16 → 0.0.18

package/dist/redaction.js

@@ -1,4 +1,7 @@
 const REDACTED = "[REDACTED]";
+// Depth bound matching agent-run-state.ts; hostile deep structures yield a placeholder
+// instead of a stack overflow.
+const MAX_REDACT_DEPTH = 32;
 export function createSecretRedactor(secrets) {
     return { redact: (value) => redactSecrets(value, secrets) };
 }
@@ -43,11 +46,13 @@ export function redactSecrets(value, secrets) {
     // ponytail: active-path WeakSet marks only ancestor cycles as [Circular]; shared
     // references (diamonds) are visited again on separate branches. Map/Set normalize
     // to JSON-shaped output; string keys are redacted like values.
-    const redact = (input, active = new WeakSet()) => {
+    const redact = (input, active = new WeakSet(), depth = 0) => {
         if (typeof input === "string")
             return redactString(input);
         if (input === null || typeof input !== "object")
             return input;
+        if (depth >= MAX_REDACT_DEPTH)
+            return "[MaxDepth]";
         if (input instanceof Date || input instanceof RegExp)
             return input;
         if (ArrayBuffer.isView(input) || input instanceof ArrayBuffer)
@@ -57,18 +62,18 @@ export function redactSecrets(value, secrets) {
         active.add(input);
         try {
             if (Array.isArray(input))
-                return input.map((item) => redact(item, active));
+                return input.map((item) => redact(item, active, depth + 1));
             if (input instanceof Map) {
                 const out = {};
                 for (const [key, item] of input)
-                    assignKey(out, redactKey(key), redact(item, active));
+                    assignKey(out, redactKey(key), redact(item, active, depth + 1));
                 return out;
             }
             if (input instanceof Set)
-                return [...input].map((item) => redact(item, active));
+                return [...input].map((item) => redact(item, active, depth + 1));
             const out = {};
             for (const [key, item] of Object.entries(input))
-                assignKey(out, redactKey(key), redact(item, active));
+                assignKey(out, redactKey(key), redact(item, active, depth + 1));
             return out;
         }
         finally {
@@ -79,18 +84,21 @@ export function redactSecrets(value, secrets) {
 }
 export function errorToErrorInfo(error, secrets = []) {
     const code = readErrorCode(error);
+    const retry = readRetryAfterMs(error);
+    const retryAfter = retry !== undefined ? { retryAfterMs: retry } : {};
     if (error instanceof Error) {
         return {
             name: error.name,
             message: redactSecrets(error.message, secrets),
             code,
+            ...retryAfter,
             cause: error.cause ? redactSecrets(String(error.cause), secrets) : undefined,
         };
     }
     if (error && typeof error === "object" && "message" in error) {
-        return { message: redactSecrets(String(error.message), secrets), code };
+        return { message: redactSecrets(String(error.message), secrets), code, ...retryAfter };
     }
-    return { message: redactSecrets(String(error), secrets), code };
+    return { message: redactSecrets(String(error), secrets), code, ...retryAfter };
 }
 function readErrorCode(error) {
     if (!error || typeof error !== "object" || !("code" in error))
@@ -98,4 +106,10 @@ function readErrorCode(error) {
     const code = error.code;
     return typeof code === "string" || typeof code === "number" ? code : undefined;
 }
+function readRetryAfterMs(error) {
+    if (!error || typeof error !== "object" || !("retryAfterMs" in error))
+        return undefined;
+    const value = error.retryAfterMs;
+    return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : undefined;
+}
 //# sourceMappingURL=redaction.js.map

package/dist/retry.d.ts

@@ -5,6 +5,11 @@ export interface DefaultRetryPolicyOptions {
     readonly baseDelayMs?: number;
     readonly maxDelayMs?: number;
     readonly transientCodes?: readonly (string | number)[];
+    /** Symmetric jitter fraction applied to computed delays (default 0.25 → ±25%).
+     *  Prevents thundering-herd retries under a shared outage. Set 0 to disable. */
+    readonly jitter?: number;
+    /** Random source for jitter (tests); defaults to Math.random. */
+    readonly random?: () => number;
 }
 export declare function createDefaultRetryPolicy(options?: DefaultRetryPolicyOptions): RetryPolicy;
 export declare function isTransientErrorInfo(error: ErrorInfo, transientCodes?: ReadonlySet<string | number>): boolean;

package/dist/retry.js

@@ -22,13 +22,20 @@ export function createDefaultRetryPolicy(options = {}) {
     const maxAttempts = Math.max(1, options.maxAttempts ?? 3);
     const baseDelayMs = Math.max(0, options.baseDelayMs ?? 100);
     const maxDelayMs = Math.max(baseDelayMs, options.maxDelayMs ?? 1000);
+    const jitter = Math.min(1, Math.max(0, options.jitter ?? 0.25));
+    const random = options.random ?? Math.random;
     const transientCodes = new Set([...TRANSIENT_CODES, ...(options.transientCodes ?? [])]);
     return {
         name: options.name ?? "default-retry",
         decide(context) {
             if (context.signal?.aborted || context.attempt >= maxAttempts || !isTransientErrorInfo(context.error, transientCodes))
                 return { retry: false };
-            return { retry: true, delayMs: Math.min(maxDelayMs, baseDelayMs * 2 ** Math.max(0, context.attempt - 1)) };
+            // Provider backpressure hint (Retry-After) wins over computed backoff, always
+            // capped at maxDelayMs so a hostile/huge hint cannot pin a run.
+            const hint = context.error.retryAfterMs;
+            const base = Math.min(hint !== undefined && Number.isFinite(hint) && hint >= 0 ? hint : baseDelayMs * 2 ** Math.max(0, context.attempt - 1), maxDelayMs);
+            const delayMs = jitter > 0 ? Math.round(base * (1 - jitter + random() * 2 * jitter)) : base;
+            return { retry: true, delayMs };
         },
     };
 }

package/dist/run-ledger.d.ts

@@ -6,9 +6,15 @@ export declare const HARD_LEDGER_BATCH_BYTES: number;
 export declare const DEFAULT_LEDGER_BATCH_DELAY_MS = 25;
 export declare const HARD_LEDGER_BATCH_DELAY_MS = 60000;
 export interface BatchedRunLedgerOptions {
+    /** Flush triggers, not write grouping: a pending flush fires once the buffer reaches
+     *  this many entries. Writes still go to the target one at a time (RunLedger has no
+     *  batch append); these bounds shape flush *timing*, not per-write coalescing. */
     readonly maxBatchEntries?: number;
+    /** Flush trigger: pending flush fires once buffered bytes reach this bound. */
     readonly maxBatchBytes?: number;
+    /** Backpressure bound: enqueue flushes synchronously before exceeding this. */
     readonly maxBufferedEntries?: number;
+    /** Backpressure bound (bytes): enqueue flushes synchronously before exceeding this. */
     readonly maxBufferedBytes?: number;
     readonly maxDelayMs?: number;
     readonly durability?: RunLedgerDurability;

package/dist/run-ledger.js

@@ -58,20 +58,14 @@ export function createBatchedRunLedger(target, options = {}) {
     const flush = () => {
         cancelTimer();
         const operation = flushChain.then(async () => {
-            let entries = 0;
-            let bytes = 0;
+            // One write per record — RunLedger has no batch append API. maxBatchEntries/
+            // maxBatchBytes only decide when a flush fires (see enqueue), never how writes group.
             while (queue.length) {
                 const item = queue[0];
-                if (entries && (entries >= maxBatchEntries || bytes + item.bytes > maxBatchBytes)) {
-                    entries = 0;
-                    bytes = 0;
-                }
-                await write(item);
+                await write(item); // shifts only after success — a failed write stays buffered for retry
                 queue.shift();
                 bufferedBytes -= item.bytes;
                 flushed += 1;
-                entries += 1;
-                bytes += item.bytes;
             }
             return status();
         });

package/dist/session-stores.js

@@ -31,8 +31,7 @@ async function readBranchFromReader(reader, query) {
     // indexEntries + the parentId walk order it and still reject missing parents / dupes.
     return getSessionBranchEntriesCore(items, { leafId: query.leafId });
 }
-function getSessionBranchEntriesCore(entries, options = {}) {
-    const index = indexEntries(entries);
+function getSessionBranchEntriesCore(entries, options = {}, index = indexEntries(entries)) {
     const leafId = options.leafId ?? entries.at(-1)?.id;
     if (!leafId)
         return [];
@@ -52,7 +51,7 @@ export function listSessionBranches(entries) {
     const index = indexEntries(entries);
     return entries
         .filter((entry) => !index.parentIds.has(entry.id))
-        .map((entry) => ({ leafId: entry.id, entries: getSessionBranchEntries(entries, { leafId: entry.id }) }));
+        .map((entry) => ({ leafId: entry.id, entries: getSessionBranchEntriesCore(entries, { leafId: entry.id }, index) }));
 }
 export function rebuildSessionContext(input, options = {}) {
     if (typeof input === "function") {
@@ -133,17 +132,22 @@ export function createMemorySessionStore(initialEntries = [], options = {}) {
         if (dedupKey !== undefined && idempotencySeen.has(dedupKey)) {
             throw new SessionAppendConflictError({ code: SESSION_APPEND_CONFLICT_CODE, idempotencyDuplicate: true });
         }
-        // expectedParentId is existence validation (the parent must already be in the
-        // store or be undefined for a root). Tip-CAS is intentionally NOT used: prism
+        // expectedParentId is same-session existence validation (the parent must already
+        // be in the store for THIS session, or be undefined for a root). A parent from
+        // another session is rejected: the write would be unreadable, since every branch
+        // walk is per-session. Tip-CAS is intentionally NOT used: prism
         // allows branching from any existing leaf (checkout + append), so a stale-but-
         // existing parent is a valid branch, not a conflict. DB adapters may layer
         // stricter tip-CAS via unique constraints for linear-only sessions.
-        if (options?.expectedParentId !== undefined && !byId.has(options.expectedParentId)) {
-            throw new SessionAppendConflictError({
-                code: SESSION_APPEND_CONFLICT_CODE,
-                expectedParentId: options.expectedParentId,
-                currentLeafId: leafBySession.get(entry.sessionId),
-            });
+        if (options?.expectedParentId !== undefined) {
+            const parent = byId.get(options.expectedParentId);
+            if (!parent || parent.sessionId !== entry.sessionId) {
+                throw new SessionAppendConflictError({
+                    code: SESSION_APPEND_CONFLICT_CODE,
+                    expectedParentId: options.expectedParentId,
+                    currentLeafId: leafBySession.get(entry.sessionId),
+                });
+            }
         }
         if (byId.has(entry.id))
             throw new Error(`Duplicate session entry id: ${entry.id}`);

package/docs/0.1.0-readiness.md

@@ -1,30 +1,41 @@
 # 0.1.0 / 1.0 Readiness Gates
 
-Status: **0.0.16 is a 1.0 readiness review, not an automatic 1.0 release.**
-This page distills the Phase 11 (0.0.16) gates into one command-per-gate table
-so readiness is checkable, not prose. Every gate below is a runnable command
-with last evidence captured on 2026-07-26 (release 0.0.16, Node v24.18.0,
-Linux x86_64). The decision to cut 1.0 stays with the operator after the
-operator-gated legs run in a protected environment and the Phase 12 demand
-evidence exists.
+Status: **0.0.18** is the current release line (Phase 1 restore integrity); **1.0** readiness remains operator-gated, not automatic.
+
+This page distills runnable readiness gates into one command-per-gate table. The
+**Last evidence** column records the 2026-07-26 **0.0.16** baseline snapshot
+(Phase 11, Node v24.18.0, Linux x86_64). Treat it as historical floor evidence,
+not the current release tag. Re-run each gate on the target release tree before
+cutting 0.0.18 / 1.0. The decision to cut 1.0 stays with the operator after
+operator-gated legs run in a protected environment and Phase 12 demand evidence
+exists.
 
 Evidence trail: [`docs/review-coverage-2026-07-26-phase-11.md`](./review-coverage-2026-07-26-phase-11.md)
 (addenda 0–9), [`docs/release-and-install.md`](./release-and-install.md),
 [`docs/migration.md`](./migration.md), [`docs/performance.md`](./performance.md).
 
+## Current line (0.0.18)
+
+| Item | Status |
+|---|---|
+| Published graph | **44** publishable manifests at **0.0.18** (`docs/release-and-install.md`) |
+| Phase 1 integrity | `repo_search` literal-only, atomic write/edit, `cache_aware` default layout, oldest-first history eviction, MCP SDK 1.30.0, README/readiness alignment |
+| Docs tripwires | `node --test dist/__tests__/docs.test.js` — migration section `0.0.17 → 0.0.18` documents intentional breaks |
+| Readiness table below | **0.0.16 measured values** — refresh evidence columns when 1.0 RC gates are recorded |
+
 ## Gate table
 
-| Gate | Command | Last evidence (2026-07-26) | Owner |
+| Gate | Command | Last evidence (2026-07-26 baseline @ 0.0.16) | Owner |
 |---|---|---|---|
 | Full quality gate | `npm run sdk:ready` | RC=0: typecheck (+examples), lint 0, format clean, full test, coverage, pack, release:gate | CI |
-| Exact version graph | `node scripts/release.mjs check --version <v>` | 0.0.16 pass: exact versions/ranges/lockfile/access + registry-collision check, 44 manifests | CI + operator |
-| Frozen public API surface + compat gate | `node scripts/release.mjs gate` | 0 breaks / 0 errors vs 44 checked-in baselines (`scripts/compat-baseline/`); only additive delta is `resolveRedactor` | CI |
-| Migration coverage 0.0.5→0.0.16 | `node --test dist/__tests__/docs.test.js` | 112/112; `docs/migration.md` has one section per release 0.0.5→0.0.16, each tripwired | Maintainer |
+| Exact version graph | `node scripts/release.mjs check --version <v>` | pass at 0.0.16: exact versions/ranges/lockfile/access + registry-collision check, 44 manifests | CI + operator |
+| Frozen public API surface + compat gate | `node scripts/release.mjs gate` | 0 breaks / 0 errors vs checked-in baselines (`scripts/compat-baseline/`); only additive delta at 0.0.16 was `resolveRedactor` | CI |
+| Migration coverage + docs tripwires | `node --test dist/__tests__/docs.test.js` | 112/112 at 0.0.16; `docs/migration.md` sections tripwired per release | Maintainer |
 | Deterministic artifact budget | `node --test dist/__tests__/budget-gate.test.mjs` | root 579.2 kB / 2.1 MB / 270 files within +5% of baseline; startup 38 ms < 250 ms ceiling | CI (in `npm test`) |
 | Performance benchmark medians | `node scripts/benchmark-0.0.16.mjs` | 6 network-free scenarios within ±25%; 0 backpressure / 0 resource-limit signals | On-demand release evidence |
 | Secret scan | `node scripts/scan-secrets.mjs` | 3095 files / 0 findings | CI |
 | License / SBOM | `node scripts/verify-sbom.mjs` | 188 packages / 8 licenses, all allow-listed | CI |
-| Dependency audit | `npm audit --audit-level=high` | rc=0 (2 moderate, 0 high) | CI |
+| Dependency audit | `npm audit --audit-level=high` | rc=0 (2 moderate, 0 high) at 0.0.16 | CI |
 | Whitespace hygiene | `git diff --check` | clean | CI |
 | Publish order + tarball validation | `node scripts/release.mjs publish --version <v> --dry-run --allow-dirty --allow-untagged` | 44/44 packages `dry-run`, deterministic dependency order, no failures | Operator (dry-run), CI |
 | Node 20 compatibility | CI `node20-compat` (build + public-import smoke) | all 21 root exports import cleanly on Node 20.20.2 | CI |
@@ -48,12 +59,13 @@ Regenerate only after review with `node scripts/release.mjs gate --update-baseli
 having first confirmed zero removed exports (the gate's order-sensitive
 signatures can drift on a TypeScript bump without any real API change).
 
-## Migration coverage 0.0.5 → 0.0.16
+## Migration coverage
 
-`docs/migration.md` carries one section per release from 0.0.5 through 0.0.16;
-`docs.test.ts` tripwires each section heading and key phrase, so a missing or
-gutted migration section fails the suite. 0.0.16's only user-facing change is
-the additive `resolveRedactor` export (no breaking changes).
+`docs/migration.md` carries release migration sections tripwired by
+`docs.test.ts` (headings and key phrases). A missing or gutted section fails
+the suite. **0.0.18** adds intentional pre-1.0 breaks (`repo_search` literal-only,
+`cache_aware` default layout, oldest-first history eviction, atomic write/edit
+durability, MCP SDK bump) — see `0.0.17 → 0.0.18 restore integrity`.
 
 ## Budget table
 
@@ -95,13 +107,13 @@ protected environment, never faked.
 
 ## Security matrix
 
-| Control | Command / source | 0.0.16 status |
+| Control | Command / source | 0.0.16 baseline |
 |---|---|---|
 | Secret scan | `node scripts/scan-secrets.mjs` | 3095 files / 0 findings |
 | License / SBOM | `node scripts/verify-sbom.mjs` | 188 packages / 8 licenses, allow-listed |
 | Dependency audit | `npm audit --audit-level=high` | 0 high (2 moderate) |
 | SAST | GitHub CodeQL workflow | CI-gated |
-| Sandbox / protocol / tenant threat suites | `npm test` (coding-security, MCP, policy, guardrail suites) | green |
+| Sandbox / protocol / tenant threat suites | `npm test` (coding-security, MCP, policy, guardrail suites) | green at 0.0.16 |
 | Signed deterministic publication | `release.mjs publish` on clean tagged tree | operator-gated |
 
 ## Remaining for 1.0 (operator / protected environment)
@@ -121,6 +133,8 @@ Exact prerequisites that must be satisfied before cutting 1.0:
    checked-in baseline.
 7. **Phase 12 demand evidence** (below) recorded for any capability that 1.0
    is expected to anchor.
+8. **0.0.18+ integrity gates green** on the release candidate (docs suite,
+   MCP SDK advisory cleared, coding-tool durability fixes, layout/eviction defaults).
 
 ## Phase 12 demand-evidence entry criteria
 
@@ -135,5 +149,5 @@ alone. Each candidate must present, before it becomes a numbered plan:
 - then the pipeline: demand evidence → primitive review → threat model →
   optional package/service → conformance → release gate.
 
-The 0.0.16 readiness gates above are the stable API/compat/budget/security
-floor that Phase 12 capabilities must consume and must not regress.
+The readiness gates above are the stable API/compat/budget/security floor that
+Phase 12 capabilities must consume and must not regress.

package/docs/agent-events.md

@@ -44,7 +44,7 @@ The `AgentEvent` union (grouped by concern):
 | Assistant messages | `message_started`, `message_delta`, `message_finished` |
 | Tool execution | `tool_execution_started`, `tool_execution_progress`, `tool_execution_finished`, `tool_execution_error`, `tool_execution_blocked` |
 | Guardrails | `guardrail_decision` |
-| Queue/subscribers | `queue_updated`, `event_subscriber_overflow` |
+| Queue/subscribers | `queue_updated`, `event_subscriber_overflow`, `steer_rejected` |
 | Compaction | `compaction_started`, `compaction_finished` |
 | Retry | `retry_scheduled` |
 | Artifacts | `artifact_validation_started`, `artifact_validation_finished`, `artifact_revision_started`, `artifact_finished`, `artifact_failed` |
@@ -92,6 +92,7 @@ Queue / subscriber / compaction / retry / provider events:
 | Variant | Fields |
 | --- | --- |
 | `queue_updated` | `sessionId`, `runId`, `size: number` |
+| `steer_rejected` | `sessionId`, `runId`, `message: Message` (redacted), `record: GuardrailRecord` — a steered message dropped by a terminal input guardrail; the run continues without it |
 | `event_subscriber_overflow` | `sessionId`, `droppedEvents: number`, `maxQueuedEvents: number`, `overflow: "close" \| "drop_oldest" \| "drop_newest"` |
 | `compaction_started` | `sessionId`, `runId?` |
 | `compaction_finished` | `sessionId`, `runId?`, `summary: string` |

package/docs/agent-session-runtime.md

@@ -49,7 +49,7 @@ string | Message | readonly Message[]
 
 `AgentConfig.limits` sets run ceilings; `RunOptions.limits` may only narrow configured agent values. Limits cover turns, provider attempts, tool rounds/calls, wall time, request/response bytes, tokens, and optional single-currency cost. A breach emits one `run_limit_exceeded` event and throws `AgentRunError` with `result.limit`; see [Runs and usage ledger](runs-and-usage.md#run-limits).
 
-`RunOptions.model` can override the request model for a run. Model overrides append a `model_change` entry. `AgentConfig.inputLayout` selects the default input assembly layout (`"legacy"` by default, or opt-in `"cache_aware"`); `RunOptions.inputLayout` wins for one run. `AgentConfig.providerOptions`/`RunOptions.providerOptions` supply generic provider request options; `timeoutMs`, `maxRetries`, and `maxRetryDelayMs` are deprecated inert provider-level hints in first-party providers. Use `RunOptions.signal`/host abort controllers for timeouts and `AgentConfig.retry`/`RunOptions.retry` for retry. `AgentConfig.providerRequestPolicies`/`RunOptions.providerRequestPolicies` run before `AIProvider.generate()` and before `provider_request` middleware. `AgentConfig.systemPrompt` and `RunOptions.systemPrompt` add explicit layered system prompt contributions; `RunOptions.systemPrompt: false` disables configured prompt layers for that run while keeping `AgentConfig.instructions` as the base path. `RunOptions.compaction` can enable auto-compaction for that run or use `false` to disable configured auto-compaction. `RunOptions.retry` can enable provider-turn retry for that run or use `false` to disable configured retry. `RunOptions.metadata` is merged with agent/session metadata for assembly, provider requests, and tool contexts. Deprecated `RunOptions.maxToolRounds` narrows `limits.maxToolRounds`. `RunOptions.signal` is bridged into the per-run abort signal passed to assembly, providers, tools, auto-compaction, and retry backoff.
+`RunOptions.model` can override the request model for a run. Model overrides append a `model_change` entry. `AgentConfig.inputLayout` selects the default input assembly layout (`"cache_aware"` by default, or opt-in `"legacy"`); `RunOptions.inputLayout` wins for one run. `AgentConfig.providerOptions`/`RunOptions.providerOptions` supply generic provider request options; `timeoutMs`, `maxRetries`, and `maxRetryDelayMs` are deprecated inert provider-level hints in first-party providers. Use `RunOptions.signal`/host abort controllers for timeouts and `AgentConfig.retry`/`RunOptions.retry` for retry. `AgentConfig.providerRequestPolicies`/`RunOptions.providerRequestPolicies` run before `AIProvider.generate()` and before `provider_request` middleware. `AgentConfig.systemPrompt` and `RunOptions.systemPrompt` add explicit layered system prompt contributions; `RunOptions.systemPrompt: false` disables configured prompt layers for that run while keeping `AgentConfig.instructions` as the base path. `RunOptions.compaction` can enable auto-compaction for that run or use `false` to disable configured auto-compaction. `RunOptions.retry` can enable provider-turn retry for that run or use `false` to disable configured retry. `RunOptions.metadata` is merged with agent/session metadata for assembly, provider requests, and tool contexts. Deprecated `RunOptions.maxToolRounds` narrows `limits.maxToolRounds`. `RunOptions.signal` is bridged into the per-run abort signal passed to assembly, providers, tools, auto-compaction, and retry backoff.
 
 ## Outputs / response / events
 
@@ -85,7 +85,7 @@ Only one `run()` may be active per session. Concurrent `run()` / `prompt` / `fol
 
 ### Mid-run steer (0.0.11)
 
-`session.steer(input, options?)` enqueues user text into the **same** active run (fail closed when no run). Default: inject at the next turn boundary (after tool rounds / before next provider assemble). `options.softInterrupt: true` aborts only the current provider stream, then continues the same `runId` with steered text. Pending queue caps: **8** messages / **64 KiB** UTF-8 total (`DEFAULT_MAX_PENDING_STEERS` / `DEFAULT_MAX_PENDING_STEER_BYTES`); overflow throws. Steered messages pass input guardrails + normal session append/redaction. Loops drain via optional `LoopContext.hasPendingSteers` / `applyPendingSteers`.
+`session.steer(input, options?)` enqueues user text into the **same** active run (fail closed when no run). Default: inject at the next turn boundary (after tool rounds / before next provider assemble). `options.softInterrupt: true` aborts only the current provider stream, then continues the same `runId` with steered text. Pending queue caps: **8** messages / **64 KiB** UTF-8 total (`DEFAULT_MAX_PENDING_STEERS` / `DEFAULT_MAX_PENDING_STEER_BYTES`); overflow throws. Steered messages pass input guardrails + normal session append/redaction. A `block`/`tripwire` on a steered message drops just that message: Prism emits `guardrail_decision` plus a `steer_rejected` event (redacted message + `GuardrailRecord`) and the run continues; the message never enters history or the session store. Run-start input blocking still fails the run. `interrupt` on a steered message fails closed (durable suspension is only for run-start input). Loops drain via optional `LoopContext.hasPendingSteers` / `applyPendingSteers`.
 
 `session.abort(reason)` aborts the active run. The abort signal is passed to input assembly, provider requests, and tool execution; if a tool/provider path aborts after a tool call, Prism does not start another provider turn.
 
@@ -187,7 +187,7 @@ if (result.status === "suspended") {
 }
 ```
 
-Resume requires exact checkpoint ownership, version, agent fingerprint, and revision. Prism CAS-claims approval before work, rechecks normal guardrail/permission/validation/limit paths, and marks a pending tool dispatched before its side effect. `createAgentRunLifecycle()` wraps the same core path for server/MCP hosts: adapters pass only authorized ownership, status returns only `{ state, version }`, and `resolveAgent()` supplies current agent/revision. `resumeStream()` uses that same claim path and bounded subscriber, so adapters do not poll or duplicate resume logic. Remote restart requires both checkpoint and session stores to be durable. A crash after that mark is ambiguous and is never replayed automatically; use host tool idempotency keyed by `runId`/`toolCallId` or resolve it manually. Checkpoints contain bounded redacted state plus session/leaf references, never provider objects, callbacks, signals, credentials, or raw secrets. Only built-in loop options are durable; custom `AgentLoopStrategy` rejects before provider work.
+Resume requires exact checkpoint ownership, version, agent fingerprint, and revision. The fingerprint hashes the agent id/name, `definitionRevision`, model, instructions, system-prompt contributions, skills (name/instructions/tool names), tool definitions (name/parameters/exclusive), guardrail definitions (name/stage/revision), and loop strategy — changing any of them without bumping `definitionRevision` fails resume closed instead of silently continuing with different agent semantics. Prism CAS-claims approval before work, rechecks normal guardrail/permission/validation/limit paths, and marks a pending tool dispatched before its side effect. `createAgentRunLifecycle()` wraps the same core path for server/MCP hosts: adapters pass only authorized ownership, status returns only `{ state, version }`, and `resolveAgent()` supplies current agent/revision. `resumeStream()` uses that same claim path and bounded subscriber, so adapters do not poll or duplicate resume logic. Remote restart requires both checkpoint and session stores to be durable. A crash after that mark is ambiguous and is never replayed automatically; use host tool idempotency keyed by `runId`/`toolCallId` or resolve it manually. Checkpoints contain bounded redacted state plus session/leaf references, never provider objects, callbacks, signals, credentials, or raw secrets. State is bounded at save by `runState.maxStateBytes` (default 256 KB, at most the 1 MB hard cap); load bounds against the 1 MB hard cap only, so state saved with a raised limit stays resumable while oversized records are still rejected. Only built-in loop options are durable; custom `AgentLoopStrategy` rejects before provider work.
 
 ## Secure composition
 

package/docs/cli-rpc.md

@@ -45,10 +45,6 @@ Default generation installs only `@arnilo/prism` (mock provider). Selecting a re
 | `--provider <name>` | Explicit provider id. The built-in `mock` id is only a smoke-test provider. |
 | `--model <name>` | Explicit model name. |
 | `--session <id>` | Session id. |
-| `--config <path>` | Explicit config path recorded by the adapter; not auto-loaded. |
-| `--resource <uri>` | Explicit resource URI recorded by the adapter; not auto-loaded. |
-| `--extension <name>` | Explicit extension name recorded by the adapter; not auto-loaded/imported. |
-| `--tool <name>` | Explicit tool name recorded by the adapter; not auto-enabled. |
 | `--system <text>` | System instructions. |
 | `--context <text>` | Context text reserved for host adapters. |
 | `--compact <entries>` | Auto-compaction threshold for the run. |
@@ -202,6 +198,6 @@ Suspended workflow resume parameters are `{ workflowId, runId, decision: "approv
 - [Observational memory compaction package](compaction-observational-memory.md): optional `om:status` and `om:view` command factories for explicitly wired hosts.
 - [Workflows](workflows.md): optional `createWorkflowCommands()` for direct/background/replay/status/cancel/resume and selected schedule control over the same RPC `command` seam.
 
-The CLI records flags but does not auto-load project-local resources, extensions, tools, or config. The two system/project prompt files are the exception: in print/json modes the CLI auto-loads `<workspaceRoot>/AGENTS.md` (trust-gated) and an app-supplied `SYSTEM.md` layer as `AgentConfig.systemPrompt` layers composed with `--system` (base); `--no-agents-md` / `--no-system-md` skip them and `--agents-md-file` / `--system-md-file` override the paths. The CLI does not default `globalRoot` to the user's home directory — pass it from a host adapter or use `--agents-config <path>` for the app-config bundle layout. RPC mode does not auto-read these files (the host owns the session factory). Hosts must make explicit trust and permission decisions before wiring any other local loading.
+The CLI records flags but does not auto-load project-local resources, extensions, tools, or config. `--config`, `--resource`, `--extension`, and `--tool` were parsed-and-recorded in earlier builds without any effect; they are now rejected loudly (`<flag> is not supported in this build`) until a CLI-harness plan wires them. The two system/project prompt files are the exception: in print/json modes the CLI auto-loads `<workspaceRoot>/AGENTS.md` (trust-gated) and an app-supplied `SYSTEM.md` layer as `AgentConfig.systemPrompt` layers composed with `--system` (base); `--no-agents-md` / `--no-system-md` skip them and `--agents-md-file` / `--system-md-file` override the paths. The CLI does not default `globalRoot` to the user's home directory — pass it from a host adapter or use `--agents-config <path>` for the app-config bundle layout. RPC mode does not auto-read these files (the host owns the session factory). Hosts must make explicit trust and permission decisions before wiring any other local loading.
 
 For app-controlled agent bundles under `<configRoot>/agents/<name>/AGENT.md` (including the three-layer `SYSTEM.md` → `AGENT.md` body → repo `AGENTS.md` prompt append and the union skill/tool scopes), see [Agent definitions](agent-definitions.md).

package/docs/coding-agent-tools.md

@@ -11,7 +11,7 @@
 | `createWriteTool(cwd, options?)` | `write` tool: create or overwrite a file, creating parent directories. |
 | `createEditTool(cwd, options?)` | `edit` tool: precise exact-then-fuzzy text replacement in an existing file. |
 | `createRepoListTool(cwd, options?)` | `repo_list` tool: bounded deterministic repository listing. |
-| `createRepoSearchTool(cwd, options?)` | `repo_search` tool: bounded literal/regex text search. |
+| `createRepoSearchTool(cwd, options?)` | `repo_search` tool: bounded literal text search. |
 | `createCodingTools(cwd, options?)` | Default six tools (`shell`, `read`, `write`, `edit`, `repo_list`, `repo_search`). |
 | `createReadOnlyTools(cwd, options?)` | Read-only subset: `read`, `repo_list`, `repo_search`. |
 | `createAllTools(cwd, options?)` | Identical to `createCodingTools` (Git tools remain opt-in via `createGitTools`). |
@@ -152,6 +152,8 @@ Create or overwrite a file, creating parent directories as needed.
 
 **Outputs:** a `TextContent` confirmation naming the **absolute path** with UTF-8 byte and line counts (e.g. `Successfully wrote 42 bytes (3 lines) to /abs/path.txt`). `maxInputBytes` defaults to 8 MiB (64 MiB hard cap); oversized UTF-8 input fails before policy evaluation, directory creation, or write. Write failures and abort are error results. Empty `content` is valid.
 
+Default local `writeFile` uses same-directory temp + `rename` so a crash mid-write cannot truncate the target; custom `WriteOperations` should provide equivalent durability.
+
 `write` result `metadata`: `{ bytes, lines, path }` (absolute path). Concurrent writes to the same path serialize through `withFileMutationQueue`; writes to different paths run in parallel.
 
 ### `edit`
@@ -165,7 +167,7 @@ Precise text replacement in an existing file via exact-then-fuzzy matching.
 | `path` | `string` | Path to the file to edit. Required. |
 | `edits` | `Array<{ oldText: string, newText: string }>` | Targeted replacements, each matched against the **original** file (not incrementally). No overlapping/nested edits. Required, non-empty. |
 
-Each `edits[].oldText` must match a unique, non-overlapping region of the original file. Matching is exact first, then fuzzy (unicode normalization / whitespace collapse). A BOM is stripped before matching and re-prepended on write; original line endings are restored. Defaults reject targets over 8 MiB, aggregate old/new UTF-8 input over 2 MiB, or more than 100 edits (hard caps: 64 MiB, 16 MiB, and 1,000). Stat and bounded read checks run before matching or mutation.
+Each `edits[].oldText` must match a unique, non-overlapping region of the original file. Matching is exact first, then fuzzy (unicode normalization / whitespace collapse). **Fuzzy matching can apply a wrong region when `oldText` is slightly off** — tradeoff for imprecise models; prefer exact `oldText` when possible. A BOM is stripped before matching and re-prepended on write; original line endings are restored. Defaults reject targets over 8 MiB, aggregate old/new UTF-8 input over 2 MiB, or more than 100 edits (hard caps: 64 MiB, 16 MiB, and 1,000). Stat and bounded read checks run before matching or mutation. Default local `writeFile` uses same-directory temp + `rename` (crash-safe replace).
 
 **Outputs:** a `TextContent` confirmation (`Successfully replaced N block(s) in {path}.`) plus `metadata`. Any failure — missing/unreadable file, no match, duplicate (non-unique) match, overlap, empty `oldText`, no-op edit, or abort — is an error result, and the file is left **unchanged** (the match runs before the write).
 
@@ -189,15 +191,15 @@ List repository entries with deterministic relative paths. Uses Node `opendir`/`
 
 ### `repo_search`
 
-Search text files under the workspace. Default mode is literal substring match; `mode: "regex"` enables length-bounded regular expressions. Binary files (NUL in a bounded prefix) and oversize files are skipped. Aggregate scanned bytes, matches, line bytes, pattern bytes, and wall time are finite.
+Search text files under the workspace using literal substring match. Binary files (NUL in a bounded prefix) and oversize files are skipped. Aggregate scanned bytes, matches, line bytes, pattern bytes, and wall time are finite.
 
 **Inputs:**
 
 | Field | Type | Purpose |
 | --- | --- | --- |
-| `query` | `string` | Literal or regex pattern (required). |
+| `query` | `string` | Literal substring (required). |
 | `path` | `string` | Workspace-relative start path. |
-| `mode` | `"literal" \| "regex"` | Default `literal`. |
+| `mode` | `"literal"` | Literal only (default). `regex` removed in 0.0.18. |
 | `caseSensitive` | `boolean` | Default false. |
 | `includeHidden` | `boolean` | Default false. |
 | `context` | `number` | Context lines before/after each match (default 5, hard 20). |
@@ -367,6 +369,8 @@ const shell = createShellTool("/repo", {
   maxLines: 500,
   timeout: 600,
   maxTotalOutputBytes: 64 * 1024 * 1024,
+  // Optional: scrub the environment the spawn hook and child process see (default: full process.env clone).
+  envAllowlist: ["PATH", "HOME", "LANG"],
 });
 
 const remoteWrite = createWriteTool("/repo", {
@@ -408,7 +412,7 @@ const remoteWrite = createWriteTool("/repo", {
 | Shell total stdout+stderr | 64 MiB | 1 GiB | process-tree kill; spill removal |
 | Repo depth / entries / files / page | 32 / 10,000 / 10,000 / 1,000 | 128 / 100,000 / 100,000 / 10,000 | before descending/retaining next entry |
 | Search scan / file / matches | 64 MiB / 8 MiB / 1,000 | 1 GiB / 64 MiB / 10,000 | before next file/match retention |
-| Search pattern / line / context / time | 512 B / 50 KiB / 5 / 30 s | 4 KiB / 1 MiB / 20 / 300 s | before regex compile / line retain / deadline |
+| Search pattern / line / context / time | 512 B / 50 KiB / 5 / 30 s | 4 KiB / 1 MiB / 20 / 300 s | before pattern compile / line retain / deadline |
 | Git paths / refs / message | 1,000 / 1 KiB / 64 KiB | 10,000 / 4 KiB / 256 KiB | before process/temp-file creation |
 | Git output / diff lines / changed files / patch | 4 MiB / 10,000 / 1,000 / 16 MiB | 64 MiB / 100,000 / 10,000 / 64 MiB | stream before retain; artifact spill optional |
 | Worktrees | 4 | 16 | before add |

package/docs/compaction-and-retry.md

@@ -68,10 +68,12 @@ createDefaultRetryPolicy(options?: DefaultRetryPolicyOptions): RetryPolicy
 | `maxAttempts` | Total provider-turn attempts; defaults to `3`. |
 | `baseDelayMs` | First retry delay; defaults to `100`. |
 | `maxDelayMs` | Backoff cap; defaults to `1000`. |
+| `jitter` | Symmetric jitter fraction on computed delays; defaults to `0.25` (±25%). Set `0` for exact delays. |
+| `random` | Random source for jitter (tests); defaults to `Math.random`. |
 | `secrets` | Exact known secret strings to redact from retry errors/events. |
 | `metadata` | Explicit host metadata for retry policy context. |
 
-`RunOptions.retry: false` disables configured retry for that run. Default classification retries generic transient codes/messages such as `ETIMEDOUT`, `ECONNRESET`, `429`, `500`, `502`, `503`, `504`, `timeout`, `rate_limit`, and `temporarily_unavailable`; aborts and non-transient errors fail closed.
+`RunOptions.retry: false` disables configured retry for that run. Default classification retries generic transient codes/messages such as `ETIMEDOUT`, `ECONNRESET`, `429`, `500`, `502`, `503`, `504`, `timeout`, `rate_limit`, and `temporarily_unavailable`; aborts and non-transient errors fail closed. Delays are exponential (`baseDelayMs * 2^(attempt-1)`, capped at `maxDelayMs`) with symmetric jitter, so concurrent sessions do not retry in lockstep during a shared outage. When `ErrorInfo.retryAfterMs` is set — first-party HTTP providers populate it from the `Retry-After` response header via `httpStatusError()` — the hint wins over computed backoff, jitter still applies, and the result is always capped at `maxDelayMs` so a hostile or huge hint cannot pin a run.
 
 `CompactionEntryData` is stored in `SessionEntry.data` for compaction entries:
 

package/docs/contribution-registries.md

@@ -27,6 +27,7 @@ createContributionRegistries(options?: { duplicate?: "replace" | "error" }): Con
 | Method | Input | Result |
 | --- | --- | --- |
 | `register(key, contribution)` | string key and contribution | Stores/replaces the contribution for that key; throws `Duplicate <label>: <key>` when `duplicate: "error"`. |
+| `unregister(key)` | string key | Removes the contribution; returns `false` when the key was not registered. `providers.unregister(id)` and `models.unregister(provider, model)` mirror this on the specialized registries. |
 | `get(key)` | string key | Returns the contribution or `undefined`. |
 | `resolve(key)` | string key | Returns the contribution or throws `Unknown <label>: <key>`. |
 | `list()` | none | Returns contributions in insertion order. |

package/docs/credentials-and-redaction.md

@@ -132,4 +132,4 @@ A future provider-local OAuth adapter needs published permission for third-party
 - [LLM compaction package](compaction-llm.md): resolves optional summary-provider credentials per compaction call and redacts exact known values.
 - [OpenAI-compatible provider](providers/openai-compatible.md): resolves API keys per request and redacts known values from adapter errors.
 
-Phase 10 added `createMemoryCredentialStore()`, `createChainedCredentialResolver()`, and `createSecretRedactor()` for opt-in in-memory auth and runtime redaction. Phase 11 adds OAuth/API-key contracts plus explicit resolver order helpers. Core still has no persistent secret store and does not read environment variables or files for credentials. For durable storage, use [`@arnilo/prism-credentials-node`](credential-storage.md) encrypted-file or keychain backends. See [Security/auth/trust](settings-auth-trust-security.md).
+Phase 10 added `createMemoryCredentialStore()`, `createChainedCredentialResolver()`, and `createSecretRedactor()` for opt-in in-memory auth and runtime redaction. By default the memory store serves a providerless record for a provider-scoped request of the same name — that record is then shared across every provider; pass `{ allowProviderFallback: false }` for exact-match-only resolution (strict provider scoping). Phase 11 adds OAuth/API-key contracts plus explicit resolver order helpers. Core still has no persistent secret store and does not read environment variables or files for credentials. For durable storage, use [`@arnilo/prism-credentials-node`](credential-storage.md) encrypted-file or keychain backends. See [Security/auth/trust](settings-auth-trust-security.md).

package/docs/extensions.md

@@ -37,7 +37,7 @@ createExtensionEventBus(options?: { errorPolicy?: "event" | "throw"; secrets?: r
 
 ## Outputs / response / events
 
-- `kernel.load(extensions)` calls each extension's `setup(api)` in host-provided order.
+- `kernel.load(extensions)` calls each extension's `setup(api)` in host-provided order and resolves to `LoadedExtension[]` (`{ name, dispose() }`). A failed `setup` unwinds that extension's partial registrations (no orphaned half-loads). `dispose()` removes the extension's registry contributions and middleware/event subscriptions via each registry's `unregister(key)` — best-effort, idempotent, and limited to registries/subscriptions: side effects outside the registries (files, network, spawned work) are not unwound, and load-order/dependency graphs between extensions are out of scope.
 - `kernel.registries` exposes the explicit contribution registry bundle.
 - `kernel.events.on(type, handler)` registers ordered event handlers and returns an unsubscribe function.
 - `kernel.events.emit(event)` calls matching handlers in registration order.

package/docs/guardrails.md

@@ -26,11 +26,22 @@ const guardrails: Guardrails = { input: [pii], maxConcurrency: 1 };
 
 Set `AgentConfig.guardrails` for every session run or `RunOptions.guardrails` to append checks for one run. `DispatchToolCallOptions.guardrails`, workflow `RunWorkflowOptions.guardrails`, and MCP server `CreatePrismMcpServerOptions.guardrails` apply tool stages to direct calls. A stage has `Guardrail<"input" | "output" | "tool_input" | "tool_output">`, a name, optional revision, and `evaluate(context)` result.
 
-Decisions are `allow`, `block`, `tripwire`, or `interrupt`. Evaluation defaults to declaration-order sequential. `maxConcurrency` may be 1–16; records are emitted in declaration order. Thrown or malformed decisions become a fail-closed tripwire. Decision reasons are capped at 4 KiB and metadata at 16 KiB after JSON normalization and optional redaction.
+Decisions are `allow`, `block`, `tripwire`, or `interrupt`. Evaluation defaults to declaration-order sequential. `maxConcurrency` may be 1–16; records are emitted in declaration order. Thrown or malformed decisions become a fail-closed tripwire. A throwing guardrail produces a `guardrail_failed` record whose `metadata.error` carries the underlying error message — redacted and bounded to 4 KiB — so failures stay diagnosable without leaking internals. Decision reasons are capped at 4 KiB and metadata at 16 KiB after JSON normalization and optional redaction.
 
 ## Outputs / response / events
 
-Every evaluated guard produces a redacted `guardrail_decision` `AgentEvent` with a bounded `GuardrailRecord`. Optional OpenTelemetry instrumentation records only controlled stage/action on a short run-child span; guardrail name, reason, and metadata are excluded. An input or output terminal decision rejects the run with `GuardrailError`; `tripwire` stops remaining evaluation. A tool-input or tool-output `block` returns a redacted blocked `ToolResult`; a `tripwire` rejects the enclosing run. `interrupt` is reserved for durable runs and currently fails closed with `ERR_PRISM_GUARDRAIL_INTERRUPT_UNAVAILABLE`.
+Every evaluated guard produces a redacted `guardrail_decision` `AgentEvent` with a bounded `GuardrailRecord`. Optional OpenTelemetry instrumentation records only controlled stage/action on a short run-child span; guardrail name, reason, and metadata are excluded. An input or output terminal decision rejects the run with `GuardrailError`; `tripwire` stops remaining evaluation. A tool-input or tool-output `block` returns a redacted blocked `ToolResult`; a `tripwire` rejects the enclosing run. `interrupt` is reserved for durable runs: at the input stage of a fresh durable run it suspends the run for approval (persisted `input_guardrail` interruption); anywhere else it currently fails closed with `ERR_PRISM_GUARDRAIL_INTERRUPT_UNAVAILABLE`. Resuming a suspended durable run re-evaluates input guardrails on the stored input, and the resume decision itself counts as the approval: a repeated input-stage `interrupt` does not re-suspend or fail the resumed run, while `block`/`tripwire` still reject it.
+
+Action outcome by stage:
+
+| Stage | `block` | `tripwire` | `interrupt` |
+| --- | --- | --- | --- |
+| `input` | run rejected (`GuardrailError`); steered message: dropped + `steer_rejected`, run continues | run rejected; steered message: dropped + `steer_rejected`, run continues | fresh durable run: suspends for approval; otherwise fails closed |
+| `output` | run rejected | run rejected | fails closed (`ERR_PRISM_GUARDRAIL_INTERRUPT_UNAVAILABLE`) |
+| `tool_input` | blocked `ToolResult`, run continues | run rejected | fails closed |
+| `tool_output` | blocked `ToolResult`, run continues | run rejected | fails closed |
+
+The `GuardrailError` message names the stage so unsupported `interrupt` placements are diagnosable without reading core source.
 
 Ordering is fixed:
 

package/docs/index.md

@@ -50,11 +50,11 @@ Prism is a TypeScript/Node.js agent harness. Host apps and extension packages ow
   - Phase 12 package workspaces: [`@arnilo/prism-provider-openai`](providers/openai.md) (Responses hosted-tool attribution, bounded continuation, Realtime session seam), [`@arnilo/prism-provider-anthropic`](providers/anthropic.md) (native Messages, `cache_control`, thinking, caller-gated `listAnthropicModels`), [`@arnilo/prism-provider-google`](providers/google.md) (native Gemini `generateContent` SSE, caller-gated `listGoogleModels`), [`@arnilo/prism-provider-opencode-go`](providers/opencode-go.md) (official Go open models, dual-route Anthropic/OpenAI, caller-gated `listOpenCodeGoModels`, `reasoning_content`/thinking preserve), [`@arnilo/prism-provider-openrouter`](providers/openrouter.md) (app-controlled catalog, caller-gated `listOpenRouterModels`, `reasoning` merge/preserve, `cache_control` + sticky `session_id`), [`@arnilo/prism-provider-zai`](providers/zai.md) (official `thinking`/`reasoning_effort`/`tool_stream`, implicit cache, caller-gated `listZaiModels`), [`@arnilo/prism-provider-kimi`](providers/kimi.md), [`@arnilo/prism-provider-alibaba`](providers/alibaba.md) (Alibaba Cloud Model Studio / DashScope + Coding Plan, OpenAI-compatible, caller-gated `listAlibabaModels`, implicit + explicit `cache_control` caching, Qwen `enable_thinking`), [`@arnilo/prism-provider-ollama`](providers/ollama.md) (Ollama Cloud + local, OpenAI-compatible, caller-gated `listOllamaModels`, implicit-only caching, `reasoning_effort`), and [`@arnilo/prism-provider-neuralwatt`](providers/neuralwatt.md) with implicit vLLM prefix caching, reasoning controls (`reasoning_effort`/`thinking_token_budget`/`enable_thinking`/`preserve_thinking`/`clear_thinking`), reasoning preservation, OpenAI-style tool-call loop, quota, telemetry, and retry classification helpers.
   - Phase 8 enterprise cloud (workload identity; separate from consumer Anthropic/Google): [`@arnilo/prism-provider-azure`](providers/azure.md) (Entra / Foundry), [`@arnilo/prism-provider-bedrock`](providers/bedrock.md) (IAM/IRSA + region/PrivateLink), [`@arnilo/prism-provider-vertex`](providers/vertex.md) (ADC / Vertex OpenAPI).
   - Optional AI SDK adapter: [`@arnilo/prism-provider-ai-sdk`](providers/ai-sdk.md) maps host-owned pinned `LanguageModelV4` models onto Prism `AIProvider` streams (offline-tested `@ai-sdk/provider` version matrix; no Prism catalog; maps metadata/tool authority/`finish.usage` cache tokens; reasoning is host-model-owned).
-- [OpenAI-compatible provider](providers/openai-compatible.md): optional provider subpath using native or injected `fetch` for Chat Completions streaming (`chatCompletionsUrl` / `authStyle` overrides for enterprise adapters).
+- [OpenAI-compatible provider](providers/openai-compatible.md): optional provider subpath using native or injected `fetch` for Chat Completions streaming (`chatCompletionsUrl` / `authStyle` overrides for enterprise adapters; `buildBodyExtra` / `mapMessages` / `mapUsage` / `extraHeaders` hooks for vendor variants).
 
 ## Input, prompt, and context assembly
 - [SDK customization guide](customization.md): map provider resolution, middleware, context, builders, injectors, loops, compaction, retry, stores, and skills to explicit host-wired APIs.
-- [Input and prompt assembly](input-and-prompt-assembly.md): render tiny prompt templates and turn common host input, history, attachments, explicit resources, summaries, and tool results into messages with replaceable builders, provider-input assembly, legacy default order, opt-in cache-aware ordering, and optional `contextBudget` eviction + omission reports. Audio/file/document `ContentBlock` types and capability checks are documented there.
+- [Input and prompt assembly](input-and-prompt-assembly.md): render tiny prompt templates and turn common host input, history, attachments, explicit resources, summaries, and tool results into messages with replaceable builders, provider-input assembly, cache-aware default order, opt-in legacy ordering, and optional `contextBudget` eviction + omission reports. Audio/file/document `ContentBlock` types and capability checks are documented there.
 - [Multimodal content](multimodal-content.md): complete-request media resolution and aggregate bounds, DNS-classified/address-pinned URLs, SSRF/MIME policy, `ModelCapabilities.input` tags, and first-party content-type mapping.
 - [System prompts](system-prompts.md): compose explicit user/package/app/run system prompt layers, auto-load the standard `AGENTS.md` (workspace) / `SYSTEM.md` prompt files via the Node `loadSystemPromptFiles` loader (trust-gated for `AGENTS.md`), and append `SYSTEM.md` → per-agent `AGENT.md` body → repo `AGENTS.md` layers from a discovered agent bundle via `resolveAgentBundle`.
 - [Instruction injection](instruction-injection.md): register package injectors that layer redacted instructions/context blocks without granting tools, permissions, or resource escapes.
@@ -117,8 +117,8 @@ Prism is a TypeScript/Node.js agent harness. Host apps and extension packages ow
 - `examples/`: compile-checked typed examples and runnable mock demos (SDK basics, provider registration, auth, tools, [`examples/ag-ui-server.ts`](../examples/ag-ui-server.ts), [`examples/enterprise-identity.ts`](../examples/enterprise-identity.ts), [`examples/enterprise-policy-audit.ts`](../examples/enterprise-policy-audit.ts), [`examples/enterprise-work-connectors.ts`](../examples/enterprise-work-connectors.ts), [`examples/conversation-durable-replay.ts`](../examples/conversation-durable-replay.ts), [`examples/artifact-review-delivery.ts`](../examples/artifact-review-delivery.ts), [`examples/server-deployment-seams.ts`](../examples/server-deployment-seams.ts), cache-aware prompt assembly, NeuralWatt agent run ([`examples/neuralwatt-agent-run.ts`](../examples/neuralwatt-agent-run.ts)), [`examples/coding-compaction.ts`](../examples/coding-compaction.ts), stores/branching, structured-output/artifact-loop, CLI, RPC, workflow orchestration).
 
 ## Release and install
-- [Release and install](release-and-install.md): current **0.0.16** 44-package graph (Phase 11 simplification/readiness; one internal codec package, no retirement), exact-peer/install/tarball rules, deterministic resumable publication and publish dry-run, pinned supply-chain gates, offline tests, the 0.0.15 provider/AI-SDK/RAG/memory protected live-canary matrix (still standing for 0.0.16), and sandbox-browser Docker/Playwright gates.
-- [0.1.0 / 1.0 readiness gates](0.1.0-readiness.md): command-per-gate 1.0 readiness table — frozen API surface + compat gate, migration coverage 0.0.5→0.0.16, budget table, live-suite matrix, security matrix, the signed-publication/live-canary prerequisites remaining for 1.0, and the Phase 12 demand-evidence entry criteria.
+- [Release and install](release-and-install.md): current **0.0.18** 44-package graph (Phase 1 restore integrity; plan 001), exact-peer/install/tarball rules, deterministic resumable publication and publish dry-run, pinned supply-chain gates, offline tests, the 0.0.15 provider/AI-SDK/RAG/memory protected live-canary matrix, and sandbox-browser Docker/Playwright gates.
+- [0.1.0 / 1.0 readiness gates](0.1.0-readiness.md): command-per-gate 1.0 readiness table — frozen API surface + compat gate, migration/docs tripwires, budget table, live-suite matrix, security matrix, current-line status (**0.0.18** published target), signed-publication/live-canary prerequisites for 1.0, and Phase 12 demand-evidence entry criteria.
 - [Review coverage (2026-07-26 Phase 11)](review-coverage-2026-07-26-phase-11.md): Plan 079 evidence freeze — baseline size/startup/benchmark budgets, hotspot domain extraction table, confirmed duplication survivors (redactor/cleanJson/row-codecs/checkpoints/exec-runner/approval/ownership), profile adoption recommendations, and tarball artifact-diet findings for 0.0.16.
 - [Review coverage (2026-07-26 Phase 10)](review-coverage-2026-07-26-phase-10.md): Plan 078 evidence freeze — OpenAI hosted tools/continuation/realtime, AI SDK version matrix, remaining provider metadata parity, RAG replaceSource/loaders/parsers/reranker/provenance/ingestion-status, memory export/rebuild/conformance, and 0.0.15 (43 → 43 manifests; no new package) release gates.
 - [Review coverage (2026-07-25 Phase 9)](review-coverage-2026-07-25-phase-9.md): Plan 077 evidence freeze — conversation service, memory consent/lifecycle, artifact co-work review, AG-UI co-work events, scoped M365/GWS OAuth, browser checkpoint composition, and deny-by-default device contracts for 0.0.14 (41 → 43 manifests; only the two provider packages are new).