@arnilo/prism 0.0.25 → 0.0.27

package/docs/process-sessions.md

@@ -0,0 +1,147 @@
+# Process sessions
+
+## What it does
+
+`createProcessSessions` is an optional host-activated registry in `@arnilo/prism-coding-agent` for **long-running** child processes: start, cursor-paged output, input, wait, signal/kill, and release (detach). Sessions have bounded lifetime (sweep on registry access — no import-time timers), ownership/identity attribution, durable metadata (command fingerprint without env/secrets), and typed `CodingProcessEvent`s via a host callback. Reuses `ExecutionPolicy`, `killProcessTree`, and `OutputAccumulator` (including spill + `readRaw` cursor paging). Optional duck-typed `sandbox` backend uses `startProcess` when present; one-shot adapters fail closed. Nothing spawns on import or construction.
+
+| Export | Purpose |
+| --- | --- |
+| `createProcessSessions(options)` | Build a `ProcessSessions` registry bound to one workspace `cwd`. |
+| `ProcessSessions` | `start`, `get`, `cancelOwned`, `markUnknown`, `reconcile`, `dispose`. |
+| `ProcessSession` | Handle: `output` / `input` / `wait` / `signal` / `kill` / `release` / `metadata`. |
+| `ProcessSessionState` | `starting` \| `running` \| `exited` \| `killed` \| `released` \| `expired` \| `unknown`. |
+| `ProcessSandboxBackend` | Duck-typed optional sandbox (`startProcess?`, `status?`); mirrors coding-security `SandboxProcessHandle`. |
+| `CodingProcessEvent` | Host-sink events (`process_started` / `_exited` / `_killed` / `_released` / `_expired` / `_unknown`). |
+| `ProcessSessionError` | Typed fail-closed errors (`ERR_PRISM_PROCESS_*`). |
+| `resolveProcessSessionLimits` / `DEFAULT_MAX_PROCESS_*` / `HARD_MAX_PROCESS_*` | Session count, input bytes, lifetime, chunk/total output caps. |
+
+## When to use it
+
+Use when a host needs attachable long-running processes (watch modes, language servers, interactive CLIs) that one-shot `shell` cannot model. Do not use as a job-control language or PTY emulator — `pty: true` fails closed with `ERR_PRISM_PROCESS_PTY_UNSUPPORTED` until a platform capability is wired. Pass a sandbox with `startProcess` for contained long-running work; omit `sandbox` for native spawn.
+
+```ts
+import { createProcessSessions } from "@arnilo/prism-coding-agent";
+
+const sessions = createProcessSessions({ cwd: workspaceRoot, policy, sandbox, onEvent });
+const p = await sessions.start({ command: "npm", args: ["test", "--", "--watch"] });
+const out = await p.output({ cursor: 0, maxBytes: 8192 });
+await p.input("q\n");
+await p.wait({ timeoutMs: 5000 });
+await sessions.dispose();
+```
+
+## Inputs / request
+
+`createProcessSessions` options:
+
+| Field | Type | Purpose |
+| --- | --- | --- |
+| `cwd` | `string` | Workspace root; session `cwd` must stay inside. |
+| `policy?` | `ExecutionPolicy` | Gated before spawn and rechecked on input/signal/kill. |
+| `limits?` | `ProcessSessionLimits` | Optional overrides; invalid values fail instead of clamping. |
+| `onEvent?` | `(CodingProcessEvent) => void` | Host-owned sink (core `AgentEvent` unchanged); audit owner + terminal/unknown. |
+| `ownership?` | `OwnershipScope` | Default owner key for sessions. |
+| `identity?` | `AgentIdentity` | When ownership omitted, owner key projects from identity. |
+| `sandbox?` | `ProcessSandboxBackend` | When set: require `startProcess` or fail closed; `status` loss → all running → `unknown`. |
+
+`ProcessStartRequest`:
+
+| Field | Purpose |
+| --- | --- |
+| `command` / `args?` | Executable + argv (not a shell string). |
+| `cwd?` | Relative/absolute path contained under registry `cwd`. |
+| `env?` | Extra env merged onto `process.env` (never in fingerprint). |
+| `pty?` | Default false; unsupported → `ERR_PRISM_PROCESS_PTY_UNSUPPORTED`. |
+| `lifetimeMs?` | Bounded by `maxLifetimeMs`. |
+| `owner?` | Override owner string. |
+| `releaseOnCancel?` | If true, `cancelOwned` releases instead of killing. |
+
+## Outputs / response / events
+
+| Method | Result |
+| --- | --- |
+| `start` | `ProcessSession` in `running`; emits `process_started`. |
+| `output({ cursor, maxBytes })` | `{ data, cursor, eof }` UTF-8 page from byte cursor. |
+| `input` | Writes stdin; capped by `maxInputBytes`; fails if not running / stdin closed. |
+| `wait` | `{ exitCode, state }` — `exitCode` is `null` for killed/released/expired/unknown. |
+| `signal` / `kill` / `release` | Soft signal, hard kill, or detach (no re-attach). |
+| `cancelOwned(owner)` | Kill (default) or release owned running sessions. |
+| `markUnknown` | Backend-loss terminal state; never fabricates `exitCode`. |
+| `reconcile()` | Host resume: mark every running/starting session `unknown` (O(sessions)). |
+
+Events: `process_started`, `process_exited`, `process_killed`, `process_released`, `process_expired`, `process_unknown`.
+
+Errors: `ERR_PRISM_PROCESS_POLICY`, `ERR_PRISM_PROCESS_OWNERSHIP`, `ERR_PRISM_PROCESS_STATE`, `ERR_PRISM_PROCESS_LIMIT`, `ERR_PRISM_PROCESS_PTY_UNSUPPORTED`, `ERR_PRISM_PROCESS_UNSUPPORTED`.
+
+## Request/response example
+
+```json
+{
+  "command": "npm",
+  "args": ["test", "--", "--watch"],
+  "lifetimeMs": 14400000,
+  "releaseOnCancel": false
+}
+```
+
+## Implementation example
+
+```ts
+const sessions = createProcessSessions({
+  cwd: workspaceRoot,
+  ownership: { tenantId: "t1", userId: "u1" },
+  sandbox, // DisposableSandbox with startProcess, or omit for native
+  limits: { maxSessions: 8 },
+  onEvent: (e) => audit.write(e),
+  policy: hostExecutionPolicy,
+});
+
+const p = await sessions.start({
+  command: process.execPath,
+  args: ["server.js"],
+  lifetimeMs: 3_600_000,
+});
+
+let cursor = 0;
+for (;;) {
+  const chunk = await p.output({ cursor, maxBytes: 50_000 });
+  cursor = chunk.cursor;
+  if (chunk.eof) break;
+}
+
+await sessions.cancelOwned(p.owner); // run cancellation
+await sessions.dispose();
+```
+
+## Extension and configuration notes
+
+- Native when `sandbox` omitted; with `sandbox`, capability is `typeof startProcess === "function"` (never assumed).
+- One-shot sandbox (no `startProcess`) → `ERR_PRISM_PROCESS_UNSUPPORTED` (no native fallback).
+- Sandbox `status` not `running` (or throws) → all live sessions → `unknown`; further `start` fails closed.
+- Host restart: call `reconcile()` on a new registry for in-memory orphans, or listen for `process_unknown` and wire Phase 7 `ToolEffectStore.markUnknown` in the host.
+- Expiry sweep runs on registry/handle access — no timers at import.
+- Command fingerprint is SHA-256 of `[command, ...args]` only (no env).
+- Docker reference adapter does not implement `startProcess` yet — fail closed until a capable runtime is wired.
+
+## Security and performance notes
+
+| Cap | Default | Hard |
+| --- | ---: | ---: |
+| Sessions per registry | 8 | 32 |
+| Input write bytes | 64 KiB | 1 MiB |
+| Session lifetime | 4 h | 24 h |
+| Output chunk | 50 KiB | 1 MiB |
+| Total output / session | 64 MiB | 1 GiB |
+
+- Wrong-owner `get(id, owner)` → `ERR_PRISM_PROCESS_OWNERSHIP`.
+- Released sessions reject all further handle ops.
+- `cwd` outside workspace → `ERR_PRISM_PROCESS_POLICY`.
+- Policy denial before spawn / on mutate → `ERR_PRISM_PROCESS_POLICY`.
+- Unknown outcome never invents an exit code.
+
+## Related APIs
+
+- [Coding agent tools](coding-agent-tools.md): one-shot `shell` vs long-running sessions.
+- [Language intelligence](language-intelligence.md): LSP servers may later register as managed sessions.
+- [Coding security](coding-security.md): `SandboxProcessHandle` / optional `DisposableSandbox.startProcess`.
+- [Tool effects](tool-effects.md): unknown-outcome vocabulary mirrored by `markUnknown` / `process_unknown` / `reconcile`.

package/docs/release-and-install.md

@@ -2,11 +2,11 @@
 
 ## What it does
 
-Prism is published as one core package, forty first-party capability packages, and six pure-manifest family/profile packages (**47** publishable manifests total). This page describes how they are packed, what each tarball contains, how to install them, the required `@arnilo/prism` peer dependency, the release workflow, and the offline test budget. The measurable 1.0 readiness gates (command-per-gate) live in [`0.1.0-readiness.md`](./0.1.0-readiness.md).
+Prism is published as one core package, forty-one first-party capability packages, and six pure-manifest family/profile packages (**48** publishable manifests total). This page describes how they are packed, what each tarball contains, how to install them, the required `@arnilo/prism` peer dependency, the release workflow, and the offline test budget. The measurable 1.0 readiness gates (command-per-gate) live in [`0.1.0-readiness.md`](./0.1.0-readiness.md).
 
-Core `@arnilo/prism` ships runtime, CLI, templates, and docs. Every code package has a required `@arnilo/prism@0.0.25` peer; profiles are pure manifests. Installation activates no provider, listener, database, browser, credential, or tool capability.
+Core `@arnilo/prism` ships runtime, CLI, templates, and docs. Every code package has a required `@arnilo/prism@0.0.27` peer; profiles are pure manifests. Installation activates no provider, listener, database, browser, credential, or tool capability.
 
-Current **47** publishable manifests:
+Current **48** publishable manifests:
 
 `@arnilo/prism`, `@arnilo/prism-ag-ui`, `@arnilo/prism-browser`, `@arnilo/prism-coding-agent`, `@arnilo/prism-coding-security`, `@arnilo/prism-compaction-llm`
 `@arnilo/prism-compaction-observational-memory`, `@arnilo/prism-credentials-node`, `@arnilo/prism-enterprise-postgres`, `@arnilo/prism-evals`, `@arnilo/prism-mcp`, `@arnilo/prism-memory`
@@ -14,7 +14,7 @@ Current **47** publishable manifests:
 `@arnilo/prism-code`, `@arnilo/prism-compaction`, `@arnilo/prism-ponytail`, `@arnilo/prism-providers`, `@arnilo/prism-sdk`, `@arnilo/prism-provider-ai-sdk`
 `@arnilo/prism-provider-alibaba`, `@arnilo/prism-provider-anthropic`, `@arnilo/prism-provider-azure`, `@arnilo/prism-provider-bedrock`, `@arnilo/prism-provider-google`, `@arnilo/prism-provider-kimi`
 `@arnilo/prism-provider-neuralwatt`, `@arnilo/prism-provider-ollama`, `@arnilo/prism-provider-openai`, `@arnilo/prism-provider-opencode-go`, `@arnilo/prism-provider-openrouter`, `@arnilo/prism-provider-vertex`
-`@arnilo/prism-provider-zai`, `@arnilo/prism-rag`, `@arnilo/prism-server`, `@arnilo/prism-session-store-codecs`, `@arnilo/prism-session-store-postgres`, `@arnilo/prism-session-store-sqlite`
+`@arnilo/prism-provider-zai`, `@arnilo/prism-rag`, `@arnilo/prism-server`, `@arnilo/prism-session-store-codecs`, `@arnilo/prism-session-store-nats`, `@arnilo/prism-session-store-postgres`, `@arnilo/prism-session-store-sqlite`
 `@arnilo/prism-supervisor`, `@arnilo/prism-tool-validator-json-schema`, `@arnilo/prism-web-tools`, `@arnilo/prism-work-tools`, `@arnilo/prism-workflows`
 
 Core ships `dist`, docs, templates, and `CHANGELOG.md`; code packages ship compiled output, README, license, and changelog. Family/profile packages ship manifest, README, and changelog. `@arnilo/prism-providers` includes all eleven `@arnilo/prism-provider-*` packages.
@@ -45,9 +45,9 @@ Consumers install the core package for the runtime and add first-party packages
 | Run the default (network-free) test suite | `npm test` |
 | Dry-run pack core + every package | `npm run pack:dry-run` |
 | Local mirror of the release verify gate | `npm run release:dry-run` |
-| Validate clean tag/version/ranges and reject registry collisions | `npm run release:check -- --version 0.0.25` |
-| Preview deterministic publish order | `npm run release:publish -- --version 0.0.25 --dry-run --allow-dirty --allow-untagged` |
-| Resume interrupted tagged publication | `npm run release:publish -- --version 0.0.25 --resume --report release-artifacts/publish-report.json` |
+| Validate clean tag/version/ranges and reject registry collisions | `npm run release:check -- --version 0.0.27` |
+| Preview deterministic publish order | `npm run release:publish -- --version 0.0.27 --dry-run --allow-dirty --allow-untagged` |
+| Resume interrupted tagged publication | `npm run release:publish -- --version 0.0.27 --resume --report release-artifacts/publish-report.json` |
 | Protected PostgreSQL enterprise suite | `PRISM_TEST_POSTGRES_URL="$DATABASE_URL" npm run test:postgres` |
 | Full SDK readiness gate (typecheck + offline tests + pack) | `npm run sdk:ready` |
 
@@ -87,7 +87,7 @@ A packed tarball contains only public compiled output and release files:
 - Code packages ship `README.md`, `LICENSE`, and `CHANGELOG.md`; family/profile packages ship `README.md` and `CHANGELOG.md`.
 - The core tarball additionally ships the full `docs/` directory (the docs hub) and `templates/init/` used by `prism init`.
 - `dist/cli.js` and the `bin` link in core.
-- **Tarball filenames.** npm strips the `@scope/` prefix, so the core package `@arnilo/prism` produces a tarball named `arnilo-prism-0.0.25.tgz`; first-party packages produce `arnilo-prism-provider-<name>-0.0.25.tgz` / `arnilo-prism-compaction-<name>-0.0.25.tgz` / `arnilo-prism-coding-agent-0.0.25.tgz`; family/profile packages produce `arnilo-prism-{providers,compaction,base,code,sdk,all}-0.0.25.tgz`. The CLI bin name `prism` is unaffected by the package name (`npx prism` still works; npm allows the bin field to differ from the package name).
+- **Tarball filenames.** npm strips the `@scope/` prefix, so the core package `@arnilo/prism` produces a tarball named `arnilo-prism-0.0.27.tgz`; first-party packages produce `arnilo-prism-provider-<name>-0.0.27.tgz` / `arnilo-prism-compaction-<name>-0.0.27.tgz` / `arnilo-prism-coding-agent-0.0.27.tgz`; family/profile packages produce `arnilo-prism-{providers,compaction,base,code,sdk,all}-0.0.27.tgz`. The CLI bin name `prism` is unaffected by the package name (`npx prism` still works; npm allows the bin field to differ from the package name).
 
 Excluded from every tarball by `files` negation:
 
@@ -106,9 +106,9 @@ Excluded from every tarball by `files` negation:
   "name": "host-app",
   "type": "module",
   "dependencies": {
-    "@arnilo/prism": "0.0.25",
-    "@arnilo/prism-enterprise-postgres": "0.0.25",
-    "@arnilo/prism-provider-openai": "0.0.25"
+    "@arnilo/prism": "0.0.27",
+    "@arnilo/prism-enterprise-postgres": "0.0.27",
+    "@arnilo/prism-provider-openai": "0.0.27"
   }
 }
 ```
@@ -151,11 +151,11 @@ For SDK readiness, run the same one-command gate directly. It composes existing
 npm run sdk:ready
 ```
 
-Release publication derives all **47** manifests from the workspace once, validates exact `0.0.25` manifest/lockfile/internal ranges, then uses deterministic dependency order. `release:check` requires a clean commit tagged `v0.0.25` and rejects any existing registry version. `release:publish --resume` skips only registry versions whose internal dependency fingerprint matches the local manifest; conflicting versions fail closed. Each attempted package is written immediately to the JSON report, so a failed job can rerun safely. `--dry-run` performs registry availability checks and invokes `npm publish --dry-run` with explicit public access, provenance, and `latest` tag, but does not publish.
+Release publication derives all **48** manifests from the workspace once, validates exact `0.0.27` manifest/lockfile/internal ranges, then uses deterministic dependency order. `release:check` requires a clean commit tagged `v0.0.27` and rejects any existing registry version. `release:publish --resume` skips only registry versions whose internal dependency fingerprint matches the local manifest; conflicting versions fail closed. Each attempted package is written immediately to the JSON report, so a failed job can rerun safely. `--dry-run` performs registry availability checks and invokes `npm publish --dry-run` with explicit public access, provenance, and `latest` tag, but does not publish.
 
 ```bash
-npm run release:check -- --version 0.0.25
-npm run release:publish -- --version 0.0.25 --dry-run --allow-dirty --allow-untagged
+npm run release:check -- --version 0.0.27
+npm run release:publish -- --version 0.0.27 --dry-run --allow-dirty --allow-untagged
 ```
 
 `--allow-dirty` and `--allow-untagged` exist only for local preview; real publication and CI never pass them. npm registry calls occur only in these release preflight/publication commands, never build/test/package discovery.
@@ -166,25 +166,29 @@ Optional live smoke tests stay separate from SDK readiness because they require
 PRISM_LIVE_PROVIDER_TESTS=1 npm run test --workspaces --if-present
 ```
 
-### 0.0.25 publish handoff
+### GitHub Actions pipeline (0.0.27+)
 
-**Decision: GO after protected operator prerequisites below.** Release **0.0.25** (Phase 8, plan 008) ships durable custom-loop snapshot/restore, shared pending-decision / sticky HITL, nested supervisor attributions, protocol batch resume, opt-in A2UI painting, and standard AG-UI projectors. Publishable graph stays **47** manifests. See [migration](migration.md) `0.0.24 → 0.0.25`, [agent loops](agent-loops.md), and [AG-UI](ag-ui.md).
+`.github/workflows/release.yml` is the single pipeline: **push to `main`** runs CI (`verify` = `npm run sdk:ready`, `node20-compat`, `postgres-integration`, `supply-chain`), **push of a `v*` tag** additionally runs `codeql-release` and the `publish` job (deterministic `release:publish` in dependency order with provenance attestation). `security.yml` adds CodeQL/dependency-review/SBOM on push and PR; `live-canaries.yml` and `sandbox-browser.yml` are scheduled. All actions are SHA-pinned (2026-08-06 fix: CodeQL pins were invalid 404 refs and `workflow_dispatch` was missing — re-verified every pin against its upstream repo). Prerequisites outside the repo: Actions enabled in repository settings, and the `NPM_TOKEN` secret (with `id-token: write` for provenance). To re-cut a tag after a fix commit, delete and recreate it (`git push origin :v0.0.27 && git push origin v0.0.27`) so the tag creation event fires.
+
+### 0.0.27 publish handoff
+
+**Decision: GO after protected operator prerequisites below.** Release **0.0.27** (Phase 10, plan 010) ships complete ACP coding-host interop in `@arnilo/prism-ag-ui/acp`: seam-based capability advertisement, session persistence, modes/config overlays, client fs/terminal adapters, MCP select gate, `CodingLifecycleEvent` → ACP update mapping, four-outcome approvals with elicitation, and frozen caps. Publishable graph stays **48** manifests. See [migration](migration.md) `0.0.26 → 0.0.27` and [ACP coding-host interop](acp.md).
 
 ```bash
 git diff --check
 npm ci
 npm run sdk:ready
-node --test scripts/phase8-conformance.test.mjs
-node scripts/benchmark-0.0.25.mjs > scripts/benchmark-0.0.25.json
+node --test scripts/phase10-conformance.test.mjs
+node scripts/benchmark-0.0.27.mjs > scripts/benchmark-0.0.27.json
 node --test scripts/budget-gate.test.mjs scripts/tooling-gate.test.mjs
 node scripts/scan-secrets.mjs && node scripts/verify-sbom.mjs
 npm audit --audit-level=moderate
-npm run release:gate -- --version 0.0.25 --allow-break --allow-dirty --allow-untagged
-npm run release:check -- --version 0.0.25 --allow-dirty --allow-untagged --report /tmp/prism-0.0.25-preflight.json
-npm run release:publish -- --version 0.0.25 --dry-run --allow-dirty --allow-untagged --report /tmp/prism-0.0.25-dry-run.json
-git tag -s v0.0.25 -m "Prism 0.0.25"
-git verify-tag v0.0.25
-git push origin v0.0.25
+npm run release:gate -- --version 0.0.27 --allow-break --allow-dirty --allow-untagged
+npm run release:check -- --version 0.0.27 --allow-dirty --allow-untagged --report /tmp/prism-0.0.27-preflight.json
+npm run release:publish -- --version 0.0.27 --dry-run --allow-dirty --allow-untagged --report /tmp/prism-0.0.27-dry-run.json
+git tag -s v0.0.27 -m "Prism 0.0.27"
+git verify-tag v0.0.27
+git push origin v0.0.27
 ```
 
 ### 0.0.24 publish handoff
@@ -284,8 +288,8 @@ Older 0.0.10–0.0.15 handoffs are summarized in [migration](migration.md); hist
 
 ## Extension and configuration notes
 
-- **Required `@arnilo/prism` peer.** Every first-party code package declares a non-optional `@arnilo/prism@0.0.25` peer (`peerDependenciesMeta` must not mark `@arnilo/prism` optional; other peers such as `playwright-core` may be optional). The range stays pinned to `0.0.25` for the current 0.x release and will widen to `^1.0.0` at the 1.x stable release. Inside the workspace each package also declares `"@arnilo/prism": "file:../.."` in `devDependencies` so `npm install` resolves the peer locally; that devDependency is stripped from consumer installs and is not a runtime dependency.
-- **Public access.** All 47 manifests (41 code packages + 6 family/profile packages) declare `"publishConfig": { "access": "public" }`; the publisher also passes `--access public` explicitly because scoped packages otherwise default to restricted on first publish.
+- **Required `@arnilo/prism` peer.** Every first-party code package declares a non-optional `@arnilo/prism@0.0.27` peer (`peerDependenciesMeta` must not mark `@arnilo/prism` optional; other peers such as `playwright-core` may be optional). The range stays pinned to `0.0.27` for the current 0.x release and will widen to `^1.0.0` at the 1.x stable release. Inside the workspace each package also declares `"@arnilo/prism": "file:../.."` in `devDependencies` so `npm install` resolves the peer locally; that devDependency is stripped from consumer installs and is not a runtime dependency.
+- **Public access.** All 48 manifests (42 code packages + 6 family/profile packages) declare `"publishConfig": { "access": "public" }`; the publisher also passes `--access public` explicitly because scoped packages otherwise default to restricted on first publish.
 - **Map retention knob.** Source maps are emitted locally but stripped from tarballs by `!dist/**/*.map`. Removing that `files` negation ships maps in releases (larger tarballs, better consumer stack traces).
 - **Release workflow.** `.github/workflows/release.yml` has six jobs. `verify` runs network-free SDK readiness on Node 24; `node20-compat` builds/imports every public root `exports` default target on Node 20 for declared `engines.node >=20` (docs examples need Node >=22.6 native TypeScript stripping); `postgres-integration` uses `pgvector/pgvector:pg16`; `supply-chain` runs high-severity audit, SPDX/license policy, and tracked-source secret scanning; and tag-only `codeql-release` runs SAST. Tag-only `publish` needs all five gates, preserves clean exact-tag/version/topological publication, and alone receives `NPM_TOKEN`, `id-token: write`, and `attestations: write`. Before npm publish it packs all current tarballs, generates checksums plus SPDX, scans unpacked public artifacts, creates GitHub attestations for tarballs and SBOM, then retains artifacts for 30 days. Registry state remains the resumable journal. Local `npm run release:dry-run` remains network-free SDK readiness; local PostgreSQL coverage is `PRISM_TEST_POSTGRES_URL=... npm run test:postgres`.
 - **Adding a package.** New workspace packages are picked up automatically by `npm run build --workspaces`, `npm test --workspaces`, `npm run pack:dry-run`, the packaging guard (`src/__tests__/packaging.test.ts`), and the install-smoke test (`src/__tests__/install-smoke.test.ts`) via the workspace glob; add the package to both tests' config arrays for explicit per-package assertions.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arnilo/prism",
-  "version": "0.0.25",
+  "version": "0.0.27",
   "description": "Agent harness for AI providers, agents, sessions, and tools.",
   "type": "module",
   "main": "./dist/index.js",
@@ -141,8 +141,8 @@
     "clean": "rm -rf dist packages/*/dist",
     "build": "npm run clean && npm run build:core && npm run build --workspaces --if-present",
     "typecheck": "npm run build && npm run typecheck --workspaces --if-present && tsc -p examples --noEmit",
-    "test": "npm run build && node --test dist/__tests__/*.test.js && node --test scripts/release-gate.test.mjs scripts/tooling-gate.test.mjs scripts/budget-gate.test.mjs scripts/phase8-conformance.test.mjs && npm run test --workspaces --if-present",
-    "test:coverage": "node --test --experimental-test-coverage --test-coverage-lines=60 --test-coverage-functions=70 --test-coverage-branches=75 --test-coverage-exclude='**/__tests__/**' --test-coverage-exclude='**/node_modules/**' --test-coverage-exclude='**/scripts/**' dist/__tests__/*.test.js",
+    "test": "npm run build && node --test dist/__tests__/*.test.js && node --test scripts/release-gate.test.mjs scripts/tooling-gate.test.mjs scripts/budget-gate.test.mjs scripts/phase8-conformance.test.mjs scripts/phase9-conformance.test.mjs scripts/phase10-conformance.test.mjs && npm run test --workspaces --if-present",
+    "test:coverage": "node --test --experimental-test-coverage --test-coverage-lines=60 --test-coverage-functions=70 --test-coverage-branches=75 --test-coverage-exclude='**/__tests__/**' --test-coverage-exclude='**/node_modules/**' --test-coverage-exclude='**/scripts/**' --test-coverage-exclude='**/packages/**' --test-coverage-exclude='**/examples/**' dist/__tests__/*.test.js",
     "lint": "biome lint .",
     "format": "biome format --write .",
     "format:check": "biome format .",