@arnilo/prism 0.0.96 → 0.1.1

package/CHANGELOG.md

@@ -1,18 +1,306 @@
 # Changelog
 
+## [0.1.1] - 2026-08-10
+
+### Changed
+- **Release 0.1.1 (plan 013)** is the post-release hardening patch on the frozen 0.1.x line, five scoped fixes and no new public packages/exports (freeze manifest `scripts/phase13-freeze-manifest.json`): (1) **build single-flight** — `npm run clean` removed from `npm run build` (standalone `npm run clean`; concurrent tsc is idempotent, the destructive `rm -rf` race is gone); (2) **deterministic MCP SSE relay test** — `relayStatelessBody` extracted as an internal export in `@arnilo/prism-mcp` with unit + E2E coverage (`packages/mcp/src/__tests__/sse-relay.test.ts`), closing the plan 011 relay compromise for the stateless path; (3) **combined coverage summary** — `scripts/coverage-summary.mjs` runs the core gate + 41 workspace suites and prints one labeled table (appended to `test:coverage`); (4) **canonical manifest-count narrative** — 49 publishable manifests = root + 48 workspace (14 provider + 9 `prism-*` + 25 capability), one statement in [docs/release-and-install.md](docs/release-and-install.md) with a tripwire; (5) **ACP modes/config ownership-scoped persistence guidance** — the agent never persists `modeId`/`configValues`; host stores MUST key by `sessions.ownership` (cross-tenant restore rejects `ERR_PRISM_ACP_INPUT`), asserted in `acp-modes-config.test.ts`. Store compatibility with 0.1.0: **compatible, no migration**; declaration surface additive-only vs the frozen 0.1.x contract (see [docs/migration.md](docs/migration.md) `0.1.0 → 0.1.1`).
+
+## [0.1.0] - 2026-08-09
+
+### Changed
+- **Release 0.1.0 (Phase 12, plan 012)** is the release-candidate hardening cut of the 0.0.28 graph: no new packages, public exports, schema migrations, or runtime dependencies (frozen in `scripts/phase12-freeze-manifest.json`; deviations require a recorded plan 012 Task 0 entry). Store compatibility with 0.0.28: **compatible, no migration**; the `0.0.17 → 0.1.0` upgrade matrix in [docs/migration.md](docs/migration.md) documents every intermediate line (compatible / tested migration / tested refusal).
+- **Compatibility matrix machine-checked** (plan 012 Task 1): [docs/release-and-install.md](docs/release-and-install.md) publishes the supported/measured matrix (Node 20+24, PostgreSQL 16, linux-x64, five protocol SDK pins, security-support boundary); release.yml CI legs match it, asserted by tripwires.
+- **Upgrade/migration + release-integrity repair** (Task 2): per-release store-compatibility sections for 0.0.18–0.1.0; release-evidence matrix with tag presence + evidence pointers for every release (0.0.21 and 0.0.28 are the documented untagged lines); persistence schema contract reconciled to version 7 (7 checksummed migrations) across freeze manifest, docs, and tests; postgres upgrade-chain/refusal tests.
+- **Packed-install e2e journeys** (Task 3): `scripts/e2e-enterprise-journey.test.mjs` + `scripts/e2e-coding-journey.test.mjs` install the exact packed manifest graph into fresh consumers (never workspace paths) and run the enterprise journey (OIDC → OPA ledger → durable events → batched approval → OpenAPI idempotent side effect → artifact signed delivery) and coding journey (ACP editor session → bounded coding tools → sandboxed process session → forge handoff) against public exports only.
+- **Protected restart-recovery evidence** (Task 4): `scripts/phase12-restart-recovery.test.mjs` (in `npm run test:postgres`) proves multi-replica kill/resume with no event gap/duplicate, tool-effect unknown-outcome fail-closed replay, database-restart-during-streaming catch-up, and reconnect/contention p95 against frozen ceilings; missing `PRISM_TEST_POSTGRES_URL` is a named blocked gate.
+- **Capacity envelopes frozen** (Task 5): `scripts/benchmark-0.1.0.mjs` composes the six phase benchmark scripts into one envelope report (`scripts/benchmark-0.1.0.json` — 24 network-free + 16 protected rows) gated on every `npm test` against the freeze-manifest ceilings; [docs/performance.md](docs/performance.md) publishes the full table with methodology and pass/fail thresholds. Budget baselines regenerated once via freeze deviation dev-001 (evidence scripts added ~35 kB to the root tarball; tolerance unchanged).
+- **Security policy hardened** (Task 6): `npm audit --audit-level=moderate` enforced in `security.yml` and `release.yml` (0 vulnerabilities at every severity for the 0.1.0 tree, 317 locked deps); named threat-suites leg `npm run security:threat-suites` (Phase 8–11 conformance, 28/28); supply-chain negative fixtures (unexpected file types/credential material in tarballs, suppressed-provenance detection in dry-run args); live-canary blocked-gate semantics documented.
+- **Docs freeze + version bump** (Task 7): `docs/0.1.0-readiness.md` current-line table at 0.1.0 with per-gate 0.1.0-tree evidence and the explicit remaining operator list for 1.0; `docs/public-contracts.md` publishes the frozen 0.1.x contract (declaration/exports surface, events, protocol payloads, migration checksums, additive-only patch promise); every public page, package README, and changelog verified consistent with 0.1.0 behavior (docs tripwires green); all 48 manifests + lockfile at exact 0.1.0 via scripted bump; publish dry-run verified deterministic (49/49 twice, byte-identical); signed-tag + npm OIDC publication documented as explicit operator steps with rollback notes ([docs/release-and-install.md](docs/release-and-install.md) `0.1.0 publish handoff`).
+
+## [0.0.28] - 2026-08-08
+
+### Added
+- Phase 11 enterprise adapter seams (plan 011), all optional and fail-closed; hosts that wire none keep exact prior behavior.
+- `@arnilo/prism-credentials-node/oidc`: `createOidcIdentityVerifier` — OIDC/JWKS identity verification over native WebCrypto (RS256/ES256), host-pinned SSRF-checked JWKS URL with bounded single-flight cache and exactly one refetch on unknown `kid`, bounded clock skew/claims, host revocation callback; fail-closed `IdentityError` reasons `ERR_PRISM_OIDC_*`.
+- `@arnilo/prism-policy/opa`: `createOpaPolicyEvaluator` — OPA REST decision adapter for the durable Phase 6 policy ledger; default deny on timeout/transport failure (`onFailure`), bounded input/response/retries, redacted mapped reasons/evidence, optional bundle-revision pin (`requirePolicyVersion`); frozen codes `ERR_PRISM_OPA_*`.
+- MCP OAuth (0.0.28) in `@arnilo/prism-mcp`: `createMcpOAuthTransport`/`createMcpOAuthFetch`/`createMcpClientAuth` reusing `@modelcontextprotocol/sdk` auth helpers — RFC 9728/8414 discovery with bounded SSRF-checked zero-redirect fetch, PKCE interactive flow, RFC 8707 resource-bound audience validation (confused-deputy defense), RFC 7009 revocation, host-owned `McpClientAuthState` persistence; server side gains `protectedResource` metadata route + `WWW-Authenticate` challenges. Frozen codes `ERR_PRISM_MCP_OAUTH_*`.
+- New package `@arnilo/prism-openapi-tools`: `createOpenApiTools` compiles host-listed OpenAPI 3.1 `operationId`s at setup into bounded `ToolDefinition`s — pinned origin (drift fails closed), resolved/bounded schemas, mutation operations get `external_mutation` + `idempotency: required` (approval/idempotency via the core run loop), bounded body/response/retries/pagination, host credential resolver, untrusted redacted output. Frozen codes `ERR_PRISM_OPENAPI_*`.
+- Artifact body contract + reference adapter: core `ArtifactBodyStore`/`ArtifactBodyRef`/`ArtifactBodyStoreError` (storage-free types, frozen `ERR_PRISM_ARTIFACT_BODY_*`), optional `size` on `ArtifactRevision`, `createArtifactService` `bodies` option with presigned `url` on delivery links (fail closed without recorded size); `@arnilo/prism-server/artifact-bodies` ships `createS3ArtifactBodyStore` — hand-rolled SigV4 over native fetch/WebCrypto, verified hash/size/mime on put/get, legal-hold-aware delete, bounded presign TTL, optional host KMS callback (`ERR_PRISM_S3_*`).
+- Phase 11 evidence: network-free `scripts/phase11-conformance.test.mjs` (in `npm test`: composed OIDC → OPA ledger → MCP OAuth tool → OpenAPI side effect → artifact body + signed delivery; adapter-absent baseline; hostile origins and limit ladder; redaction sweep), `scripts/benchmark-0.0.28.mjs` + `scripts/benchmark-0.0.28.json` evidence, `scripts/budgets.json` `phase11` gate, `scripts/phase11-freeze-manifest.json` schema-gated by `scripts/phase11-freeze.test.mjs`.
+- Docs: new [docs/openapi-tools.md](docs/openapi-tools.md); OIDC verifier section in [docs/agent-identity.md](docs/agent-identity.md); OPA section in [docs/policy-and-audit.md](docs/policy-and-audit.md); MCP OAuth section in [docs/mcp-tools.md](docs/mcp-tools.md); artifact body store section in [docs/work-artifacts-and-review.md](docs/work-artifacts-and-review.md); migration `0.0.27 → 0.0.28`; Phase 11 p95 evidence in [docs/performance.md](docs/performance.md); protected live-canary slot recorded as a blocked release gate in [docs/0.1.0-readiness.md](docs/0.1.0-readiness.md).
+
+### Changed
+- `createPrismMcpWebHandler` accepts `McpServer | (() => McpServer | Promise<McpServer>)`; stateless operation now requires a factory (a shared stateless transport threw on the second request). SSE (`text/event-stream`) responses are relayed instead of buffered, so streaming responses no longer stall the handler.
+- Publishable graph stays **48** manifests (includes the new `@arnilo/prism-openapi-tools`); core remains dependency-free and every new seam is opt-in.
+- Version bumped to exact `0.0.28` across the root, all workspace manifests, and the lockfile; compatibility baselines refreshed (additive surfaces only).
+
+## [0.0.27] - 2026-08-07
+
+### Added
+- ACP coding-host interop (`@arnilo/prism-ag-ui/acp`, stable ACP v1 over `@agentclientprotocol/sdk@1.3.0`): capability advertisement is a pure function of host seams (`loadSession`/`sessionCapabilities.*`/`promptCapabilities.*`/`mcpCapabilities.*`; `close` always; UNSTABLE cells never advertised), session persistence (`session/load|resume|list|delete`, bounded registry), session modes and config options as host overlays (`set_mode`, `set_config_option`, `current_mode_update`, `config_option_update`), client fs/terminal adapters (`AcpClientFilesystem`/`AcpClientTerminals`), MCP servers only behind host `select`, rich prompt content (`projectAcpPrompt`: media + embedded resources under live policy), tool-call locations/diffs via projection allow-lists, `CodingLifecycleEvent` → ACP update mapping, four-outcome approvals with elicitation (`elicitation/create` when advertised), and `AcpError` codes `ERR_PRISM_ACP_INPUT/LIMIT/POLICY/CAPABILITY/MCP`. Frozen caps in `resolveAgUiLimits` (`caps.acp`/`caps.lifecycle` groups).
+- Phase 10 evidence: network-free `scripts/phase10-conformance.test.mjs` (in `npm test`), operator-gated real-transport smoke (`scripts/acp-client-smoke.mjs` + fixture), `examples/acp-coding-host.ts`, `scripts/benchmark-0.0.27.mjs` + `scripts/benchmark-0.0.27.json` evidence, `scripts/budgets.json` `phase10` gate.
+- Docs: new [docs/acp.md](docs/acp.md) ACP reference; migration `0.0.26 → 0.0.27`; `docs/ag-ui.md` ACP summary + link; ACP pointers across agent-events/coding-agent-tools/coding-security/mcp-tools/host-security; package README.
+
+### Changed
+- `@arnilo/prism-ag-ui` depends on `@arnilo/prism-coding-agent` (workspace) for Phase 9 output-chunk caps and lifecycle types; publishable graph stays **48** manifests.
+- SBOM license policy allows `Unlicense` (tweetnacl via `@nats-io/nkeys`); readiness SBOM evidence refreshed (227 packages / 12 licenses).
+- `@arnilo/prism-ag-ui/renderer` now exports the DOM-free A2UI core values (`A2UiSurfaceState`, `reduceA2UiOps`, `readA2UiBatch`, `resolvePointer`, `A2UI_VERSION`) — Synapta FR, hosts can drive the surface state machine without mounting; `createA2UiRenderer` behavior and frozen A2UI caps unchanged.
+
+### Breaking (advertise/surface for ACP hosts only)
+- `initialize` advertisement now reflects wired seams (previously minimal close-session); new session methods are registered only with their seams; `session/resume` of a live session rejects; `agentInfo.version` now comes from the package.json. Core, AG-UI, and coding-agent behavior unchanged. See [migration guide](docs/migration.md) `0.0.26 → 0.0.27`.
+
+## [0.0.26] - 2026-08-06
+
+### Added
+- Git-aware repository enumeration (`createGitAwareRepositoryOperations`): fixed `git ls-files` with native fallback, host-only `includeIgnored`, frozen ls-files output caps.
+- Language intelligence (`createLanguageIntelligence`): host-selected LSP 3.17 client over bounded JSON-RPC — symbols/definitions/references/diagnostics/hover/rename; lazy spawn; policy-gated atomic rename; `ERR_PRISM_LSP_*` codes.
+- Managed process sessions (`createProcessSessions`): start/output/input/wait/signal/kill/release, ownership + expiry sweep, optional sandbox `startProcess` backend with sandbox-loss → `unknown` reconciliation; `OutputAccumulator.readRaw` cursor paging.
+- Reference GitHub forge adapter (`createGitHubForge`): issue context, authenticated push (`GIT_CONFIG_*` credential injection, never argv), PR create/update, review comments, checks/status, bounded `reconcileHandoff`; `ToolEffectStore` idempotency (retry never duplicates); host-injectable `fetch` option.
+- Allow-list egress (`@arnilo/prism-coding-security`): deny-all `createEgressPolicy` with frozen presets, `createAllowListEgressProxy` (CONNECT tunnel, pinned-DNS rebinding defense, private/metadata IP denial, redirect re-validation, byte/time caps, audit records), `composeEgressSandboxNetwork` attestation labels.
+- Network-free Phase 9 conformance + `benchmark-0.0.26.json` evidence; composed example `phase9-coding-intelligence.ts`.
+- AG-UI reasoning encrypted-value helper (`createReasoningEncryptedValue`, FR-3) and MCP Apps UI-initiated mutation retry through `ToolEffectStore` (`reconcileAppEffect`, FR-4).
+- Durable `AgentEventSource` root export in `@arnilo/prism-session-store-postgres` (FR-6) and new NATS JetStream sibling adapter `@arnilo/prism-session-store-nats` (FR-5): per-run subjects, per-subject replay, durable pull consumers with explicit acks (at-least-once), idempotent append, resumable cursors, ownership-scoped page/subscribe/cleanup.
+- A2A server-side exposure (Task 13): `createAgUiA2AServer` in `@arnilo/prism-ag-ui` fronts a local AG-UI agent as an A2A 1.0 server over supervisor's `createA2AHandler` — remote clients run and stream the agent through the AG-UI input allow-list and event mapper, with a bounded live task registry and optional durable replay.
+- Reference frontend renderer (Task 14): new `@arnilo/prism-ag-ui/renderer` subpath export — `createA2UiRenderer` consumes an AG-UI event stream and renders A2UI v0.9 surfaces into DOM from a host component catalog; DOM-free core with the server-side A2UI caps enforced client-side, fail-closed drops, explicit placeholders for unknown components, and no remote HTML execution.
+- Async `AgUiProjection` hooks (Task 15): all hook returns are `Awaitable<T>`; the AG-UI and ACP mappers await hooks in event order with per-event fail-closed, so projectors can call `session.entries()` directly — `createMessagesFromSessionProjection` now accepts an async `getMessages` transcript source. Sync-only hosts keep exact prior behavior.
+
+### Changed
+- Publishable graph grows to **48** manifests at **0.0.26** (new `@arnilo/prism-session-store-nats`).
+
+### Breaking (none)
+- All Phase 9 additions are opt-in factories; no existing export, event, or persisted shape changed. See [migration guide](docs/migration.md) `0.0.25 → 0.0.26`.
+
+## [0.0.25] - 2026-08-06
+
+### Added
+- Durable custom `AgentLoopStrategy` hooks: optional `revision` / `snapshot` / `restore`; `AgentLoopStateError` fail-closed codes; fingerprint includes loop `{name,revision}`.
+- Shared pending-decision model: parallel approvals, batch CAS `decisions`, sticky allow/reject for run, modified arguments, elicitation; nested supervisor attribution.
+- Protocol mappings: AG-UI/ACP/server batch resume, MCP elicitation helpers, coding `ask_user_decision` elicitation hook.
+- Opt-in A2UI painting middleware + standard AG-UI projectors (`messages`/`state`/`activity`).
+- Network-free Phase 8 conformance + `benchmark-0.0.25.json` evidence; examples `durable-loops-and-approvals.ts`, `ag-ui-a2ui.ts`.
+
+### Changed
+- Publishable graph remains **47** manifests at **0.0.25**.
+- Fingerprint loop entry shape `string` → `{name,revision}` (0.0.24 persisted durable runs fail closed on resume).
+
+### Breaking (minor, pre-1.0)
+- Custom loops on durable runs need snapshot/restore hooks or `ERR_PRISM_LOOP_NOT_DURABLE`.
+- Resume prefers `decisions: RunDecision[]`; legacy binary `decision` remains but is exclusive with the batch path.
+- ACP permission offers four outcomes; `reject_once` is blocked-continue (cancelled stays terminal deny).
+
+See [docs/migration.md](docs/migration.md) for the 0.0.24 → 0.0.25 guide.
+
+## [0.0.24] - 2026-08-04
+
+### Added
+- Durable `AgentEventSource` with append/page/subscribe/resume and PostgreSQL LISTEN/NOTIFY wakeups (schema v6 streams + v7 retention index).
+- Recoverable `ToolEffectStore` claim/CAS lifecycle; enterprise PostgreSQL `toolEffects`; coding/browser/work/MCP/supervisor effect classification.
+- AG-UI 0.0.57 full input/event/interrupt compatibility plus MCP Apps and remote A2A adapters.
+- Protected Phase 7 process conformance and `benchmark-0.0.24.json` evidence.
+- Example `examples/distributed-events-and-tool-effects.ts`; docs `docs/tool-effects.md`.
+
+### Changed
+- Work mutations require core-derived idempotency keys; ambiguous outcomes stay `unknown` (not exactly-once).
+- Publishable graph remains **47** manifests at **0.0.24**.
+
+### Breaking (minor, pre-1.0)
+- Hosts using approved work mutations must supply `effectStore` / core `idempotencyKey` (model keys ignored).
+- Durable event reconnect uses `AgentEventSource` cursors / `Last-Event-ID`; sticky sessions are optional only.
+
+See [docs/migration.md](docs/migration.md) for the 0.0.23 → 0.0.24 guide.
+
+## [0.0.23] - 2026-08-03
+
+### Added
+- `@arnilo/prism-enterprise-postgres`: optional PostgreSQL composition for policy decisions, evaluation records, work-mutation idempotency, and model-router state.
+- Checked enterprise PostgreSQL conformance/restart/contention, cleanup/index/storage performance evidence, and protected `PRISM_TEST_POSTGRES_URL` gate.
+
+### Changed
+- `@arnilo/prism-work-tools` idempotency uses claim/CAS lifecycle states; ambiguous connector outcomes are `unknown` and require reconciliation.
+- `@arnilo/prism-model-router` accepts durable async state; `recordUsage`/`recordOutcome` are awaited and `providerSource` cannot bypass a supplied state store.
+- Publishable graph: **47** manifests (was 46); `@arnilo/prism-all` includes enterprise PostgreSQL state.
+
+### Breaking (minor, pre-1.0)
+- Hosts implementing `IdempotencyStore` must migrate from `get`/`put` to `begin`/transition methods.
+- Hosts using durable router state must await router methods with verified identity; synchronous `providerSource` is memory-state only.
+
+See [docs/migration.md](docs/migration.md) for the 0.0.22 → 0.0.23 guide.
+
+## [0.0.22] - 2026-07-31
+
+### Added
+- `@arnilo/prism-caveman` and `@arnilo/prism-ponytail`: optional third-party behavior integrations (Phase 5).
+- Example `examples/caveman-ponytail.ts`.
+
+### Changed
+- Publishable manifest count: **46** (was 44).
+
+See [docs/migration.md](docs/migration.md) for the full 0.0.21 → 0.0.22 notes.
+
+## [0.0.21] - 2026-07-31
+
+### Added
+- `@arnilo/prism-coding-agent`: `repo_search` `outputMode`, bounded `glob`, optional `requireReadBeforeWrite`/`ReadPathSet`, bounded `delete`/`move`.
+- Example `examples/coding-tools-capability-gaps.ts`.
+
+### Changed
+- Default coding aggregator: 9 tools (`createCodingTools`); read-only aggregator: 4 (includes `glob`).
+- `@arnilo/prism-coding-security`: approval + sandbox wiring for `delete`/`move`.
+
+### Breaking (minor, pre-1.0)
+- Hosts asserting exact `createCodingTools().length === 6` or readonly length `3` must update (now 9 / 4).
+- Custom sandbox `RepositoryOperations` must implement `glob`; full sandbox custom ops must supply `delete`/`move`.
+
+See [docs/migration.md](docs/migration.md) for the full 0.0.20 → 0.0.21 notes.
+
+## [0.0.20] - 2026-07-31
+
+### Added
+- Progressive skill disclosure: `skillsDisclosure` (`"progressive"` default, `"eager"` opt-in), session `LoadedSkillSet`, `createLoadSkillTool` / `resolveSkillLoad` (`load_skill`), catalog/body byte caps.
+- Runtime `activateAllSkills` migration opt-in when `AgentConfig.skills` is a `SkillRegistry` without per-run activation.
+- Context budget: `ContextBlock.priority` ordering; skill body demotion (`skill_body` omission) before full drop.
+- Optional `toolResultFold` host-gated projection for aged large tool results (session store untouched).
+
+### Changed
+- Default runtime `SkillRegistry` activation is **empty** when neither `RunOptions.activeSkills` nor `RunOptions.skills` is set (was `SkillRegistry.list()`).
+- Default skill prompt assembly is catalog-only (`name` + `description`); full `instructions` require eager mode or successful `load_skill`.
+
+### Breaking (minor, pre-1.0)
+- Hosts relying on implicit activate-all registry behavior must pass `activateAllSkills: true` or set `activeSkills` / `skills` explicitly.
+- Hosts expecting full skill bodies every turn must set `skillsDisclosure: "eager"` or register and use `load_skill`.
+
+See [docs/migration.md](docs/migration.md) for the full 0.0.19 → 0.0.20 notes.
+
+## [0.0.19] - 2026-07-30
+
+### Added
+- `@arnilo/prism-compaction-observational-memory`: `createObservationalMemory()` + `attach()` lifecycle, four-layer provider context (recent exact messages, observation log, reflections, raw-source retrieval), `recallObservationalMemoryBranchPage()`, `wrapResumeRun` / `wrapResumeStream`, nested settings with legacy flat-key mapping.
+
+### Changed
+- Observational memory: separate observer/reflector/dropper workers, domain-neutral observer default, dual coverage/eligibility fixes, full-ledger reflection recall, hard fold/render byte caps, post-run `compactAfterTokens` compaction when attached.
+
+See [docs/migration.md](docs/migration.md) for the full 0.0.18 → 0.0.19 observational memory notes.
+
+## [0.0.18] - 2026-07-30
+
+### Changed
+- Default `inputLayout` is `cache_aware` (unset `AgentConfig` / `RunOptions` use cache-stable message order); set `inputLayout: "legacy"` to restore prior ordering.
+- `applyContextBudget` evicts oldest history messages first under pressure (was newest-first).
+- `@arnilo/prism-mcp` pins `@modelcontextprotocol/sdk` **1.30.0** (clears moderate `@hono/node-server` path-traversal advisory on the MCP HTTP stack).
+
+### Breaking (minor, pre-1.0)
+- `@arnilo/prism-coding-agent` `repo_search` is literal-only: `mode: "regex"` removed; `compileSearchPattern` drops the `mode` argument (ReDoS mitigation).
+- Default local `write` / `edit` operations use same-directory temp + `rename` for crash-safe replacement.
+
+See [docs/migration.md](docs/migration.md) for the full 0.0.17 → 0.0.18 notes.
+
+## [0.0.17] - 2026-07-29
+
+### Added
+- Extension lifecycle: `ExtensionKernel.load()` returns `LoadedExtension[]` dispose handles; contribution/provider/model registries gain `unregister(...)`; a failed `setup` unwinds its partial registrations.
+- `MemoryCredentialStoreOptions.allowProviderFallback` for strict provider-scoped credential resolution; `createMemoryCheckpointStore` `maxRecords`/`maxValueBytes` bounds; `ShellToolOptions.envAllowlist` (coding-agent); `ErrorInfo.retryAfterMs` plus `retryAfterMs`-aware `createDefaultRetryPolicy` with `jitter`/`random` options; guardrail `steer_rejected` event; `httpStatusError` provider transport helper wired into anthropic, google, kimi, openai, opencode-go, and the shared OpenAI-compatible transport.
+
+### Changed
+- Durable runs: run-state load now bounds against the 1 MiB hard cap (states saved with a raised `maxStateBytes` resume correctly); agent fingerprint also covers instructions, system-prompt contributions, and skills; resume-after-interrupt is explicit implicit-approval.
+- Retry/backpressure: HTTP provider errors carry numeric codes and `Retry-After` hints; default retry policy applies ±25% jitter.
+- `input_assembly` middleware runs unconditionally (both plain and context-budget paths, any `InputBuilder`); memory session store rejects cross-session `expectedParentId`; context-budget eviction is O(n) instead of O(n²).
+- Guardrails: `interrupt` errors name the stage; `guardrail_failed` records carry the underlying error message in `metadata.error`; steer `block`/`tripwire` drops the message and emits `steer_rejected` instead of failing the run.
+- Default prompt builder omits the `Available tools:` text for tool-capable models (`capabilities.tools === true`).
+- Middleware registry throws on double `next()` and diagnoses conflicting `next(v)` + return; event multiplexer keeps sorted delivery while a consumer is parked; batched run-ledger dead counters removed.
+
+### Breaking (minor, pre-1.0)
+- CLI: `--config`, `--resource`, `--extension`, `--tool` are rejected (`<flag> is not supported in this build`); the dead `CliOptions.config/resources/extensions/tools` fields are removed.
+- `ExtensionKernel.load()` resolves to `LoadedExtension[]` instead of `void`.
+
+See [docs/migration.md](docs/migration.md) for the full 0.0.16 → 0.0.17 notes.
+
+## [0.0.16] - 2026-07-26
+
+### Added
+- Phase 11 simplification/readiness: new public export `resolveRedactor` from `@arnilo/prism` (single survivor of four private copies across evals/memory/rag/workflows) and a new internal `@arnilo/prism-session-store-codecs` package (shared SQLite/Postgres row codecs, not enrolled in any profile family), bringing the exact graph to **44 publishable manifests**.
+- Offline pre-publish release gates: `npm run release:gate` (API-surface `.d.ts` diff vs `scripts/compat-baseline/`, tarball deny-list, exact version ranges), wired into `npm run sdk:ready`.
+- Performance budgets in `scripts/budgets.json`, enforced by `scripts/budget-gate.test.mjs` (in `npm test`) and `scripts/benchmark-0.0.16.mjs`.
+
+### Changed
+- Dropped historical `docs/review-coverage-*.md` from the root tarball (11 files, ~283 KB): packed size 659,478 → ≈575,680 bytes, 281 → 270 files.
+- All six profiles (`prism-all`, `prism-base`, `prism-code`, `prism-compaction`, `prism-providers`, `prism-sdk`) retained on adoption evidence; zero retirements. No runtime behavior changes.
+
+## [0.0.15] - 2026-07-26
+
+### Added
+
+- Phase 10 provider, memory, and RAG parity: OpenAI hosted-tool attribution, bounded Responses continuation and Realtime seam; exact AI SDK V4 mapping; bounded RAG source lifecycle, document adapters, reranking, citation provenance, content trust, and ingestion status; memory export/rebuild with production-store conformance.
+
+### Changed
+
+- Versioned all **43** publishable manifests, exact internal ranges, and lockfile entries to `0.0.15`; no package was added.
+- Added network-free Phase 10 evidence: `scripts/benchmark-0.0.15.mjs`.
+
+## [0.0.14] - 2026-07-26
+
+### Added
+
+- Phase 9 personal/work-agent surfaces: durable conversation service (`createConversationService`), durable artifact service with review/approval/authorized delivery (`createArtifactService`), memory consent + lifecycle (`setConsent`/`correct`/`forget`/`applyRetention`), AG-UI co-work events (`mapCoWork` + ACP parity), scoped M365/GWS OAuth connectors (`revokeOAuthCredential`, `createOAuthWorkTokenProvider`), a browser verified-state checkpoint ledger, and a deny-by-default device adapter contract (`resolveDevicePolicy`/`assertDeviceAdmit`).
+- New optional provider packages `@arnilo/prism-provider-alibaba` (Model Studio / DashScope + Coding Plan) and `@arnilo/prism-provider-ollama` (cloud/local), both with dynamic model discovery; enrolled via `@arnilo/prism-providers`.
+
+### Changed
+
+- Versioned all **43** first-party manifests and exact internal ranges to `0.0.14` (41 → 43; only the two provider packages are new).
+- Network-free Phase 9 evidence: `scripts/benchmark-0.0.14.mjs`.
+
+## [0.0.13] - 2026-07-24
+
+### Added
+
+- Enterprise identity (`Principal` / `AgentIdentity`), optional `@arnilo/prism-policy`, `@arnilo/prism-model-router`, enterprise cloud providers (Azure/Bedrock/Vertex), server deployment seams, persistence schema v5 lifecycle hooks, and `@arnilo/prism-work-tools` (M365 + GWS).
+
+### Changed
+
+- Versioned all **41** first-party manifests and exact internal ranges to `0.0.13`; Phase 8 optional packages enroll in `@arnilo/prism-all` only.
+- Network-free enterprise evidence: `scripts/benchmark-0.0.13.mjs`.
+
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 All notable changes to this project will be documented in this file.
 
+## [0.0.12] - 2026-07-22
+
+### Added
+
+- Optional `@arnilo/prism-ag-ui` package with bounded AG-UI mapper/authorized handler/replay and stable `./acp` sibling, built over shared durable resume streams.
+- `createCodingCompactionStrategy()` preset for bounded coding-session handoff.
+
+### Changed
+
+- Versioned all 35 first-party manifests and exact internal ranges to `0.0.12`; `@arnilo/prism-all` includes AG-UI while `@arnilo/prism-code` and `@arnilo/prism-sdk` remain free of UI protocol dependencies.
+- Added network-free interoperability/compaction evidence: `scripts/benchmark-0.0.12.mjs`.
+
+## [0.0.11] - 2026-07-22
+
+### Added
+
+- Coding harness fundamentals for 0.0.11 (Plan 074): bounded `SessionIndex`/`searchSessions` (SQLite/Postgres FTS migration 004; memory linear|unsupported; JSONL unsupported), assembler `contextBudget` + omission reports, `@arnilo/prism-provider-anthropic` + `@arnilo/prism-provider-google`, mid-run `AgentSession.steer` / RPC steer, coding-agent `runCodingGoalVerify` and opt-in `ask_user_decision` (multi/free-text/durable suspend glue).
+- Opt-in `structuredOutputTiming: "final-turn-only"` on `generate-validate-revise` (default `"every-turn"`): tool-eligible turns omit native schema so models can call tools; artifact/revision turns attach schema and withdraw tools.
+
+### Changed
+
+- Versioned all 34 first-party manifests and exact internal ranges to `0.0.11` (adds `@arnilo/prism-provider-anthropic` + `@arnilo/prism-provider-google` to the publishable graph and `@arnilo/prism-providers` umbrella).
+- Network-free search/budget evidence: `scripts/benchmark-0.0.11.mjs`.
+
+## [0.0.10] - 2026-07-21
+
+### Changed
+
+- Coding harness workspace modes (Phase 5): required `workspaceMode` on `@arnilo/prism-coding-security` composition; sandbox mode unifies shell/FS on one disposable tree; host mode never claims containment; fail-closed mixed wiring + `allowMixedWorkspaceWiring` escape hatch; import/export tree identity; `scripts/benchmark-0.0.10.mjs` evidence.
+- Versioned all 32 first-party manifests and exact internal ranges from the post-ship `0.0.96` graph to `0.0.10` for the roadmap Phase 5 release line.
+
 ## [0.0.96] - 2026-07-21
 
 ### Changed
 
 - Package graph and runtime version pins bumped from 0.0.9 to 0.0.96 for a clean publish tag after the mistaken `v0.0.95` tag and TypeScript 7 / workspace-order CI fixes.
 
-## Unreleased
-
 ## [0.0.9] - 2026-07-21
 
 ### Added

package/README.md

@@ -17,7 +17,7 @@ packages. Prism defines contracts, not apps.
   OpenAI/OpenRouter use best-effort explicit cache hints, NeuralWatt uses
   best-effort implicit prefix caching, and other providers have route/model-specific
   or no cache-control support; see [docs/provider-caching.md](docs/provider-caching.md).
-- **First-party packages**: six provider adapters, two compaction strategies,
+- **First-party packages**: fourteen provider adapters, two compaction strategies,
   coding tools/security, JSON Schema validation, MCP, workflows, OpenTelemetry,
   encrypted credentials, SQLite/PostgreSQL persistence, and manifest-only install profiles.
 - **Tools, context, skills**: host-owned tool registry with allow/deny filtering
@@ -34,6 +34,11 @@ packages. Prism defines contracts, not apps.
 - **Config, settings, security**: layered config merge, settings providers,
   credential resolvers, trust/permission policies, and secret redaction.
 - **CLI/RPC/server**: `prism --mode print|json|rpc`, `prism init`, optional framework-free authorized Web agent/workflow routes, and explicit MCP server exposure.
+- **Ecosystem parity (0.0.15)**: OpenAI hosted-tool attribution, bounded Responses
+  continuation/Realtime, exact AI SDK V4 mapping, bounded RAG lifecycle/reranking/trust,
+  and consent-bound memory export/rebuild; provider, RAG, and memory packages remain optional.
+- **Co-work contracts (0.0.14)**: conversation/artifact review types, deny-by-default device
+  contracts, and OAuth refresh/revoke helpers; services stay in optional packages.
 
 ## Install
 
@@ -150,6 +155,15 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 | `@arnilo/prism-provider-zai` | ZAI GLM provider |
 | `@arnilo/prism-provider-kimi` | Kimi For Coding provider |
 | `@arnilo/prism-provider-neuralwatt` | NeuralWatt provider with implicit vLLM prefix caching |
+| `@arnilo/prism-provider-alibaba` | Alibaba Cloud (Model Studio / DashScope + Coding Plan) provider with dynamic discovery and explicit/implicit caching |
+| `@arnilo/prism-provider-ollama` | Ollama Cloud / local provider with dynamic discovery and implicit-only caching |
+| `@arnilo/prism-provider-anthropic` | Anthropic Messages provider |
+| `@arnilo/prism-provider-google` | Google Gemini provider |
+| `@arnilo/prism-provider-azure` | Azure OpenAI provider |
+| `@arnilo/prism-provider-bedrock` | AWS Bedrock provider |
+| `@arnilo/prism-provider-vertex` | Google Vertex provider |
+| `@arnilo/prism-provider-ai-sdk` | AI SDK interoperability adapter |
+| `@arnilo/prism-browser` | optional host-wired Playwright browser automation (not core; not auto-activated) |
 | `@arnilo/prism-compaction-llm` | provider-backed compaction strategy |
 | `@arnilo/prism-compaction-observational-memory` | source-backed memory + recall tool |
 | `@arnilo/prism-coding-agent` | bounded shell/read/write/edit tools |
@@ -163,7 +177,7 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 | `@arnilo/prism-credentials-node` | encrypted-file and keychain credentials |
 | `@arnilo/prism-session-store-sqlite` | SQLite persistence/checkpoints/leases/owned run feedback |
 | `@arnilo/prism-session-store-postgres` | PostgreSQL persistence/checkpoints/leases/owned run feedback |
-| `@arnilo/prism-providers` | family: all 7 provider adapters, including AI SDK interoperability |
+| `@arnilo/prism-providers` | family: all 14 first-party provider adapters, including AI SDK interoperability |
 | `@arnilo/prism-compaction` | family: both compaction strategies |
 | `@arnilo/prism-base` | profile: core + compaction + JSON Schema validation |
 | `@arnilo/prism-code` | profile: base + coding tools/security + MCP |
@@ -182,6 +196,6 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 ## Non-goals (v1)
 
 - Privileged tools, MCP servers, telemetry, credentials, or databases activated by install — hosts explicitly configure and register every capability.
-- Browser automation or interactive terminal UI — CLI/RPC and workflow control APIs only.
+- Browser automation or interactive terminal UI in core — hosts may opt into `@arnilo/prism-browser` with their own Playwright lifecycle; Prism does not auto-start browsers or ship a TUI.
 - Provider, credential, extension, or package auto-discovery.
 - Core-owned database drivers, secret persistence, sandbox, or application policy — optional packages implement adapters over host-owned boundaries.

package/dist/agent-definitions.js

@@ -1,5 +1,5 @@
 import { createAgent } from "./agents.js";
-import { resolveActiveSkills, createSkillRegistry } from "./skills.js";
+import { createSkillRegistry, resolveActiveSkills } from "./skills.js";
 import { createToolRegistry } from "./tools.js";
 /** Resolve an {@link AgentDefinition} into a runnable {@link Agent}.
  *
@@ -96,8 +96,7 @@ function hasList(value) {
     return typeof value === "object" && value !== null && "list" in value && typeof value.list === "function";
 }
 function resolveSkills(names, tools, context) {
-    const registry = context.skillsRegistry ??
-        (context.registries?.skills ? createSkillRegistry(context.registries.skills.list()) : undefined);
+    const registry = context.skillsRegistry ?? (context.registries?.skills ? createSkillRegistry(context.registries.skills.list()) : undefined);
     if (!names && !context.activateAllCapabilities)
         return undefined;
     if (!registry) {

package/dist/agent-event-source.d.ts

@@ -0,0 +1,11 @@
+import type { AgentEventSource, AgentEventSourceOptions } from "./contracts.js";
+export type AgentEventSourceErrorCode = "ERR_PRISM_AGENT_EVENT_SOURCE_INPUT" | "ERR_PRISM_AGENT_EVENT_SOURCE_CURSOR" | "ERR_PRISM_AGENT_EVENT_SOURCE_RETENTION" | "ERR_PRISM_AGENT_EVENT_SOURCE_OVERFLOW" | "ERR_PRISM_AGENT_EVENT_SOURCE_CLOSED";
+export declare class AgentEventSourceError extends Error {
+    readonly code: AgentEventSourceErrorCode;
+    constructor(code: AgentEventSourceErrorCode, message: string);
+}
+/**
+ * In-process, non-production reference implementation. It has no cross-process
+ * wakeup or persistence; use a database-backed source for distributed delivery.
+ */
+export declare function createMemoryAgentEventSource(options?: AgentEventSourceOptions): AgentEventSource;