@arnilo/prism 0.0.96 → 0.1.1

package/docs/model-routing.md

@@ -0,0 +1,111 @@
+# Model routing
+
+## What it does
+
+`@arnilo/prism-model-router` is an optional governance facade over an existing `ProviderResolver`. It enforces allow-lists, residency, token/cost budgets, rate limits, circuit breaking, and bounded fallbacks before provider selection, and emits redacted selection diagnostics. It does not implement a second provider runtime.
+
+## When to use it
+
+Use it for enterprise hosts that must deny models/regions before any provider call and attribute selection for audit. Skip it when a plain `createProviderResolver` allow-list is enough.
+
+Do not put secrets, prompts, or raw OpenRouter keys into diagnostics. Do not honor `compat.openRouterRouting` unless `allowOpenRouterRouting: true`.
+
+## Inputs / request
+
+| API / field | Meaning |
+| --- | --- |
+| `createModelRouter({ resolver, stateStore?, ... })` | Wraps host `ProviderResolver`; omit `stateStore` for in-process memory state or pass durable async state. |
+| `allowList.providers` / `allowList.models` | Exact provider id / model id or `provider/model` |
+| `allowedResidencies` | Request residency must match when configured |
+| `budgets` / per-call `maxTokens` / `maxCostUsd` | Finite non-negative ceilings; `recordUsage` charges |
+| `rateLimit` | Per identity+model key window |
+| `circuit` | Failure threshold + cooldown; keys capped |
+| `fallbacks` | Ordered candidates after primary; total attempts capped |
+| `allowOpenRouterRouting` | Default `false`; when false, routing metadata is stripped |
+| `onDiagnostics` | Optional redacted hook (e.g. policy ledger evidence ref) |
+| `router.resolve({ model, identity?, residency?, ... })` | Rich async selection |
+| `router.providerSource` | Sync facade only for memory state; with `stateStore` it throws `ERR_PRISM_MODEL_ROUTER_ASYNC_STATE` rather than bypass durable checks. |
+
+Frozen caps (default / hard): attempts `3 / 8`, circuit keys `1,024 / 16,384`, diagnostics `8 KiB / 64 KiB`.
+
+## Outputs / response / events
+
+- `ModelRouterResolveResult` — selected `provider` + possibly stripped `model`, `diagnostics`, and `providerRequestPolicy`.
+- Deny throws `ModelRouterError` with code + redacted `diagnostics` (allow-list/residency/budget fail closed without calling resolver).
+- `await recordOutcome({ identity, success, circuitProbeToken? })` opens/closes circuits; `await recordUsage({ identity, ... })` advances budgets. Pass the probe token returned by `resolve` for a half-open outcome.
+
+## Request/response example
+
+```json
+{
+  "outcome": "allow",
+  "selectedProvider": "openrouter",
+  "selectedModel": "auto",
+  "attempts": [
+    { "provider": "openai", "model": "gpt-4o", "outcome": "circuit_open", "reason": "circuit_open" },
+    { "provider": "openrouter", "model": "auto", "outcome": "selected" }
+  ],
+  "identityRefs": { "tenantId": "t1", "principalId": "a1", "principalKind": "agent" },
+  "openRouterRoutingHonored": false,
+  "residency": "eu"
+}
+```
+
+## Implementation example
+
+```ts
+import { createAgent, createProviderResolver } from "@arnilo/prism";
+import { createModelRouter } from "@arnilo/prism-model-router";
+import { createPostgresEnterpriseState } from "@arnilo/prism-enterprise-postgres";
+
+const enterprise = await createPostgresEnterpriseState({ pool, schema: "prism" });
+const router = createModelRouter({
+  resolver: createProviderResolver(providers),
+  stateStore: enterprise.modelRouter,
+  allowList: { providers: ["openai", "openrouter"] },
+  allowedResidencies: ["eu"],
+  fallbacks: [{ provider: "openrouter", model: "auto" }],
+  allowOpenRouterRouting: false,
+});
+
+const { provider, model, providerRequestPolicy } = await router.resolve({
+  model: sessionModel,
+  identity,
+  residency: "eu",
+  maxCostUsd: 0.25,
+});
+
+const agent = createAgent({
+  model,
+  provider,
+  providerRequestPolicies: [providerRequestPolicy],
+});
+await router.recordUsage({ identity, provider: provider.id, model: model.model, tokens: 500 });
+await router.recordOutcome({ identity, provider: provider.id, model: model.model, success: true });
+await enterprise.close();
+
+// `router.providerSource` is unavailable with durable state; resolve before provider I/O.
+```
+
+## Extension and configuration notes
+
+Router is optional. Chain returned `providerRequestPolicy` with other `ProviderRequestPolicy` values. Wire `onDiagnostics` to `@arnilo/prism-policy` when audit export is required. OpenRouter package behavior is unchanged; routing metadata participates only when this gate allows it.
+
+## Security and performance notes
+
+- Allow-list and residency denies never call the underlying resolver.
+- Without `stateStore`, budget/rate/circuit state is process-local, memory-capped, and oldest keys evict. It is not a cross-replica production path.
+- With `stateStore: createPostgresEnterpriseState(...).modelRouter`, rate/budget updates and circuit probes are atomic across replicas, use database time, and are owner/principal/provider/model scoped. Router calls become asynchronous and require verified identity.
+- Diagnostics carry identity refs and attempt outcomes only — no prompts/secrets. Durable state stores at most bounded numeric/timestamp/token material, never prompts or credentials.
+- Selection is O(attempts × state operations); no provider network I/O happens inside state updates. Recorded 0.0.23 PostgreSQL p95 point operations stayed under 50 ms and cursor/cleanup pages under 100 ms on the documented fixture.
+- Raising hard caps requires a reviewed release update with tests and docs.
+
+## Related APIs
+
+- [Provider layer](provider-layer.md)
+- [Provider request policies](provider-request-policies.md)
+- [OpenRouter](providers/openrouter.md)
+- [Policy and audit](policy-and-audit.md)
+- [Agent identity](agent-identity.md)
+- [Enterprise PostgreSQL state](enterprise-postgres-state.md): durable router state, migration, cleanup, and ownership requirements.
+- Package README: [`@arnilo/prism-model-router`](../packages/model-router/README.md)

package/docs/multimodal-content.md

@@ -49,11 +49,13 @@ Known `ModelCapabilities.input` tags are exported as `MODEL_INPUT_CAPABILITIES`:
 
 | Tag | Block type | First-party mapping (declared capability required) |
 | --- | --- | --- |
-| `text` | `text` (default) | All providers |
-| `image` | `image` | OpenAI Responses, OpenRouter, OpenCode Go Anthropic route, Kimi, NeuralWatt |
-| `audio` | `audio` | OpenAI Responses (`input_audio`) |
-| `file` | `file` | OpenAI Responses (`input_file`); Anthropic routes map PDF only |
-| `document` | `document` | OpenAI Responses (`input_file`); OpenCode Go Anthropic route; Kimi |
+| `text` | `text` (default) | All first-party providers; Azure/Bedrock/Vertex use their host-selected OpenAI-compatible endpoint/model. |
+| `image` | `image` | OpenAI Responses; Anthropic; Google; Kimi; Z.AI; OpenRouter; OpenCode Go OpenAI route; Alibaba; Ollama; NeuralWatt. Enterprise OpenAI-compatible packages require the host model/endpoint to declare and accept image input. |
+| `audio` | `audio` | OpenAI Responses (`input_audio`) and Google `generateContent` inline data. OpenAI Realtime instead receives `RealtimeSession.sendAudio()` chunks, not an `audio` `ContentBlock`. |
+| `file` | `file` | OpenAI Responses (`input_file`); Anthropic/Kimi/OpenCode Go Anthropic route accept PDF file/document forms; Google maps inline file data. |
+| `document` | `document` | OpenAI Responses (`input_file`); Anthropic/Kimi/OpenCode Go Anthropic route map PDF; Google maps inline document data. |
+
+The AI SDK adapter maps declared user text/image/audio/file/document blocks (and assistant text/image/file/document) to AI SDK file parts; `resourceUri` remains host-resolved before `doStream`. Its output `file`, `reasoning-file`, and `source` parts are deliberately rejected as `unsupported_mapping`, not converted to trusted Prism content. Provider capability metadata is the gate—this matrix never upgrades a model that does not declare the matching input tag.
 
 ## Outputs / response / events
 
@@ -136,6 +138,7 @@ try {
 - Local filesystem paths should use trust policies such as `createPathTrustPolicy()` before exposing URIs to loaders.
 - Provider upload/create/delete lifecycles are provider-package-local. `@arnilo/prism-provider-openai` inlines files under 4 MiB as `data:<mediaType>;base64,...` `file_data`, otherwise uses a bounded per-run upload cache and best-effort `DELETE /v1/files` cleanup after each stream.
 - Shared wire helpers live in `@arnilo/prism/providers/media` (`resolveProviderMediaMessages`, `serializeOpenAIResponsesInputFile`, `serializePdfDocumentWireBlock`, `createBoundedUploadCache`). OpenAI Responses, Kimi, and OpenCode Go Anthropic routes resolve their complete media collection once before serialization or upload.
+- OpenAI Realtime audio is a bidirectional `RealtimeSession` stream, not a `ContentBlock`: provide host-captured `Uint8Array` chunks with `sendAudio()` and consume untrusted `audio_delta` / transcript events. It has a fixed 256 events/s, 1 MiB/s, and 600 s default ceiling.
 
 ## Security and performance notes
 

package/docs/node-jsonl-session-store.md

@@ -2,7 +2,7 @@
 
 ## What it does
 
-The optional `@arnilo/prism/node/session-store-jsonl` subpath stores `SessionEntry` records in a caller-named JSONL file: one JSON object per line.
+The optional `@arnilo/prism/node/session-store-jsonl` subpath stores `SessionEntry` records in a caller-named JSONL file: one JSON object per line. `searchSessions` is unsupported and throws `SessionSearchUnsupportedError` (use memory linear mode or a DB adapter for search).
 
 APIs:
 

package/docs/observability.md

@@ -167,12 +167,14 @@ console.log(traceId, memory.spans.map((span) => span.name));
 ## Security and performance notes
 
 - Default events are metadata-only — no prompts, streamed deltas, tool arguments, or credentials.
+- Use `identityTelemetryAttributes(identity)` when attaching enterprise identity to run metadata or OTel attributes; it emits `prism.identity.*` refs only (tenant/principal/scope counts), never credential secrets or raw tokens.
 - Opt-in content in other event types (`message_delta`, tool `result`) is still subject to `redactAgentEvent`.
 - Metric labels stay low-cardinality (`gen_ai.operation.name`, `gen_ai.provider.name`, token type, controlled outcome/status, feedback rating bucket/link presence); never use session/run/request/call IDs, model output, comments, tag values, scorer/evaluation IDs, or arbitrary metadata as labels. Token usage is recorded once at provider operation scope.
 - Target overhead when enabled is under 5% excluding exporter I/O; disabled hooks allocate no spans.
 - Provider transport limits and redaction order are documented in [Provider primitives](provider-primitives.md).
 
 ## Related APIs
+- [Agent identity](agent-identity.md): redacted identity attribute helper for telemetry.
 - [Evaluations](evaluations.md): optional scorers can link scores to run/session/trace IDs from agent events.
 
 - [Agent events](agent-events.md): full `AgentEvent` union and subscriber semantics.

package/docs/openapi-tools.md

@@ -0,0 +1,56 @@
+# OpenAPI tools adapter (`@arnilo/prism-openapi-tools`)
+
+Optional `createOpenApiTools` compiles host-selected OpenAPI 3.1 operations into bounded Prism `ToolDefinition`s. Zero dependencies (native fetch + WebCrypto-free); the compile step is pure and separated from the runtime executor.
+
+## When to use it
+
+Hosts that already expose a JSON API with an OpenAPI 3.1 document and want the agent to call a **fixed, host-chosen subset** of it — never model-driven discovery, never a raw method/path passthrough. For vendor web search/extraction use `@arnilo/prism-web-tools`; for M365/GWS use `@arnilo/prism-work-tools`; this adapter is for arbitrary host APIs.
+
+## Usage
+
+```ts
+import { createOpenApiTools } from "@arnilo/prism-openapi-tools";
+
+const tools = createOpenApiTools({
+  document, // OpenAPI 3.1 document (JSON string or parsed object)
+  operations: ["getCustomer", "createCase"], // only these operationIds compile
+  server: "https://api.example.com/v1", // pinned base URL
+  credentials: async ({ operationId }) => ({
+    headers: { authorization: `Bearer ${await hostToken(operationId)}` },
+  }),
+  policy: ({ operationId, args }, context) => {
+    if (operationId === "createCase" && !context.identity) throw new Error("identity required");
+  },
+  redactor, // applied to response text before it enters the tool result
+  pagination: { pageParam: "page", pageSizeParam: "limit", pageSize: 50, nextPath: "next", itemsPath: "items" },
+  idempotencyKeyHeader: true, // forward the core Idempotency-Key on mutating requests
+});
+```
+
+Register the returned tools with `createToolRegistry` (or pass them to the MCP bridge); validate arguments with `createJsonSchemaToolArgumentValidator` as usual.
+
+## Compile-time guarantees
+
+- **Allow-list only**: operations not listed never compile; unknown ids throw `ERR_PRISM_OPENAPI_OPERATION_UNKNOWN`. No generic arbitrary-request escape hatch.
+- **Origin pinned**: the `server` option is the only authority. Every document/path/operation `servers` entry must resolve to the pinned origin (relative URLs resolve against it), else `ERR_PRISM_OPENAPI_SERVER_DRIFT`. https only; http allowed only for loopback hosts.
+- **Bounded schemas**: internal `$ref`s resolve into self-contained argument schemas (path + query + header + body in one object, `additionalProperties: false`). Cycles, depth (`maxSchemaDepth`), ref count (`maxRefs`), external refs, cookie parameters, non-JSON request bodies, and duplicate argument names all fail closed (`ERR_PRISM_OPENAPI_SCHEMA_BOUNDS`).
+- **Effects**: GET/HEAD/OPTIONS/TRACE compile as `{ kind: "none", idempotency: "none" }`; POST/PUT/PATCH/DELETE as `{ kind: "external_mutation", idempotency: "required" }` — the core run loop gates approval ("Tool side effect requires approval") and deduplicates via the `ToolEffectStore` (mutating tools require a verified identity and an effect store at dispatch; retries never re-execute a completed effect). Optional `idempotencyKeyHeader: true` also forwards the core key as `Idempotency-Key` for APIs that honor it.
+
+## Runtime guarantees
+
+- Request body and response bounded (`maxBodyBytes`, `maxResponseBytes`); oversized responses fail closed (`ERR_PRISM_OPENAPI_RESPONSE_BOUNDS`).
+- Retries only on transport errors and 5xx, bounded by `maxRetries` (default 0, hard 3); transport failures after exhaustion throw `ERR_PRISM_OPENAPI_RETRY_EXHAUSTED`; 4xx never retried.
+- Optional cursor pagination applies only to operations whose compiled query parameters include `pageParam`; bounded by `maxPages` and `maxPaginationItems`.
+- Credentials come only from the host `credentials` resolver (headers/query merged per call), never from the document or options; the optional `redactor` runs over response text before the result is built, so echoed secrets are stripped.
+- Responses are untrusted data: results carry an "UNTRUSTED EXTERNAL API CONTENT" marker and `metadata.trust: "untrusted_external"`; redirects are never followed (`redirect: "manual"`); caller aborts propagate without retry.
+
+## Limits
+
+Defaults and hard caps (frozen in `scripts/phase11-freeze-manifest.json`): `maxDocumentBytes` 2 MiB/16 MiB, `maxOperations` 256/1024, `maxSchemaDepth` 32/128, `maxRefs` 1024/8192, `maxBodyBytes` 1 MiB/16 MiB, `maxResponseBytes` 1 MiB/16 MiB, `maxPages` 20/100, `maxPaginationItems` 1000/10000, `maxRetries` 0/3. Invalid limits throw `ERR_PRISM_OPENAPI_DOCUMENT_BOUNDS`.
+
+## Related
+
+- [Tools](tools.md): registry, dispatch, validation
+- [Recoverable tool effects](tool-effects.md): approval + idempotency contracts
+- [Host security guide](host-security.md): permission, trust, validation checklist
+- Package README: [`@arnilo/prism-openapi-tools`](../packages/prism-openapi-tools/README.md)

package/docs/performance.md

@@ -6,6 +6,267 @@ Evaluation defaults are finite: 100 trace rows × 20 pages and 4 MiB aggregate t
 
 This page states Prism runtime limits that keep slow consumers and long sessions from becoming unbounded memory or latency problems.
 
+## Release 0.1.0 capacity envelopes (frozen performance contract)
+
+`scripts/benchmark-0.1.0.mjs` composes the six phase benchmark scripts
+(0.0.23–0.0.28) into one 0.1.0 capacity envelope; the merged evidence is
+checked in as `scripts/benchmark-0.1.0.json` and re-gated on every `npm test`
+by `scripts/benchmark-0.1.0.test.mjs` against the Task 0 freeze-manifest
+capacity contract (`scripts/phase12-freeze-manifest.json`): a row that drifts
+above its frozen p95 ceiling, a startup import above 250 ms, or a root pack
+row beyond its ±5% diet tolerance fails the gate.
+
+**Methodology.** Each leg is the same fixture as the phase benchmark that
+introduced it (warmups and measured operations per leg are recorded in the
+JSON `legs` array): in-process fakes and loopback fixture servers for the
+network-free legs, disposable PostgreSQL 16 schema for the protected legs.
+Measured on Node v24.18.0 / Linux x64 (local hardware; values are environment
+evidence, not universal SLOs). Regenerate with:
+
+```bash
+node scripts/benchmark-0.1.0.mjs --out scripts/benchmark-0.1.0.json
+PRISM_TEST_POSTGRES_URL="postgresql://…" node scripts/benchmark-0.1.0.mjs --out scripts/benchmark-0.1.0.json  # adds protected legs
+```
+
+**Pass/fail thresholds.** Network-free rows fail above the frozen ceiling in
+the table below; protected PostgreSQL rows fail above their per-phase
+budgets.json ceilings (50/100 ms per the approved budget contract); startup
+import fails above `startupImportMsCeiling` (250 ms); root packed bytes and
+file count fail above baseline × 1.05. Labels: **network-free** = runs in
+`npm test` evidence, no network; **protected** = requires live PostgreSQL.
+
+| Envelope | Recorded p95 ms | Ceiling ms | Source leg | Label |
+| --- | ---: | ---: | --- | --- |
+| oidcVerifyCacheHitMs | 0.151 | 5 | enterprise adapters (0.0.28) | network-free |
+| oidcVerifyCacheMissMs | 0.351 | 100 | enterprise adapters (0.0.28) | network-free |
+| policyDecisionMs | 0.052 | 100 | enterprise adapters (0.0.28) | network-free |
+| mcpDiscoveryRoundTripMs | 1.563 | 250 | enterprise adapters (0.0.28) | network-free |
+| mcpAuthHandshakeMs | 6.909 | 2,000 | enterprise adapters (0.0.28) | network-free |
+| openapiToolCallMs | 0.011 | 1,000 | enterprise adapters (0.0.28) | network-free |
+| artifactPut1MiBMs | 9.337 | 2,000 | enterprise adapters (0.0.28) | network-free |
+| artifactPresignMs | 0.381 | 100 | enterprise adapters (0.0.28) | network-free |
+| decisionApply | 4.484 | 5 | durable loops/HITL (0.0.25) | network-free |
+| stickyMatch | 0.343 | 5 | durable loops/HITL (0.0.25) | network-free |
+| snapshotCaptureRestore | 7.814 | 20 | durable loops/HITL (0.0.25) | network-free |
+| a2uiPaint | 0.330 | 10 | durable loops/HITL (0.0.25) | network-free |
+| enumerationList | 363.610 | 2,000 | coding/process/forge/egress (0.0.26) | network-free |
+| processChunkPage | 0.048 | 10 | coding/process/forge/egress (0.0.26) | network-free |
+| lspDiagnosticNormalize | 0.610 | 100 | coding/process/forge/egress (0.0.26) | network-free |
+| forgePagination | 144.868 | 10,000 | coding/process/forge/egress (0.0.26) | network-free |
+| proxyDownload | 86.879 | 30,000 | coding/process/forge/egress (0.0.26) | network-free |
+| rendererStreamOps | 1.647 | 100 | coding/process/forge/egress (0.0.26) | network-free |
+| agUiMapperSync | 33.059 | 100 | coding/process/forge/egress (0.0.26) | network-free |
+| fsReadWriteRoundTripMs | 0.210 | 250 | ACP (0.0.27) | network-free |
+| modeSwitchMs | 0.185 | 250 | ACP (0.0.27) | network-free |
+| terminalChunkAckMs | 0.049 | 1,000 | ACP (0.0.27) | network-free |
+| promptFirstUpdateMs | 0.082 | 2,000 | ACP (0.0.27) | network-free |
+| promptEndMs | 0.094 | 30,000 | ACP (0.0.27) | network-free |
+| policyAppend | 0.684 | 50 | enterprise PostgreSQL (0.0.23) | protected |
+| policyQuery | 1.274 | 50 | enterprise PostgreSQL (0.0.23) | protected |
+| evaluationAppend | 0.721 | 50 | enterprise PostgreSQL (0.0.23) | protected |
+| evaluationQuery | 0.918 | 50 | enterprise PostgreSQL (0.0.23) | protected |
+| workClaimComplete | 1.938 | 50 | enterprise PostgreSQL (0.0.23) | protected |
+| workContention | 5.002 | 50 | enterprise PostgreSQL (0.0.23) | protected |
+| routerRateContention | 17.582 | 50 | enterprise PostgreSQL (0.0.23) | protected |
+| routerBudgetContention | 6.018 | 50 | enterprise PostgreSQL (0.0.23) | protected |
+| routerCircuitContention | 27.098 | 50 | enterprise PostgreSQL (0.0.23) | protected |
+| cleanupBatch | 3.509 | 100 | enterprise PostgreSQL (0.0.23) | protected |
+| eventAppend | 1.553 | 50 | distributed events (0.0.24) | protected |
+| eventPage | 3.187 | 50 | distributed events (0.0.24) | protected |
+| effectClaimTransition | 2.642 | 50 | distributed events (0.0.24) | protected |
+| eventCleanup | 1.255 | 100 | distributed events (0.0.24) | protected |
+| effectCleanup | 3.174 | 100 | distributed events (0.0.24) | protected |
+| reconnectCatchup | 8.374 | 100 | distributed events (0.0.24) | protected |
+
+Install/startup rows (same helpers as the budget gate — no duplicate
+measurement): startup import 41.7 ms (ceiling 250 ms); root packed 711,755
+bytes vs baseline 678,541 (+5%, tolerance 5%); root file count 295 vs 293
+(+5%). Storage-growth rows and query plans from the protected legs are in the
+recorded JSON (`storageBeforeCleanup` / `storageAfterCleanup` per leg).
+
+Conformance companions: `scripts/phase8–11-conformance.test.mjs` plus the
+Task 3 packed-install journeys and Task 4 restart-recovery evidence (see
+[`docs/0.1.0-readiness.md`](./0.1.0-readiness.md)).
+
+## Release 0.0.28 enterprise auth, policy, MCP OAuth, API, and artifact adapters
+
+`node scripts/benchmark-0.0.28.mjs` is network-free (in-process fake JWKS/OPA/API fetches plus loopback fixture servers for the authorization server, Prism MCP server, and S3-compatible object store). Checked `scripts/benchmark-0.0.28.json` (Node v24.18.0/Linux x64): 20 warmups, 100 measured ops per seam.
+
+| Scenario | Recorded p95 ms | Ceiling |
+| --- | ---: | ---: |
+| OIDC verify (warm JWKS cache) | 0.178 | 5 |
+| OIDC verify (TTL-expired JWKS refetch) | 0.366 | 100 |
+| OPA policy decision (fake endpoint) | 0.063 | 100 |
+| MCP OAuth discovery round trip | 2.196 | 250 |
+| MCP OAuth interactive handshake (PKCE + token + authorized connect) | 6.359 | 2,000 |
+| OpenAPI tool call (compiled operation, fake API) | 0.023 | 1,000 |
+| Artifact 1 MiB body put (fake object store) | 11.810 | 2,000 |
+| Artifact presign | 0.630 | 100 |
+
+Conformance: `scripts/phase11-conformance.test.mjs` (5 network-free cases: composed OIDC → OPA ledger → MCP OAuth tool → OpenAPI side effect → artifact body + signed delivery, adapter-absent baseline, hostile origins and limit ladder, redaction sweep). Values are environment evidence, not universal SLOs.
+
+## Release 0.0.25 durable loops and human-in-the-loop
+
+`node scripts/benchmark-0.0.25.mjs` is network-free (in-memory checkpoint store). Checked `scripts/benchmark-0.0.25.json` (Node v24.18.0/Linux x64): 20 warmups, 100 measured ops, 32 pending decisions, ~250 KiB snapshot, 64 A2UI ops/message.
+
+| Scenario | Recorded p95 ms | Ceiling |
+| --- | ---: | ---: |
+| Decision apply (batch CAS) | 3.913 | 5 |
+| Sticky match | 0.407 | 5 |
+| Snapshot capture/restore | 6.742 | 20 |
+| A2UI paint | 0.348 | 10 |
+
+Conformance: `scripts/phase8-conformance.test.mjs` (8 network-free cases). Values are environment evidence, not universal SLOs.
+
+## Release 0.0.26 coding intelligence, processes, forge, and egress
+
+`node scripts/benchmark-0.0.26.mjs` is network-free (fake LSP/forge/proxy, synthetic 100k-file repo, real process spill). Checked `scripts/benchmark-0.0.26.json` (Node v24.18.0/Linux x64): 5 warmups, 20 measured ops, 100k enumeration files, 1 GiB process spill, 1,000 LSP diagnostics, 100 forge pages × 100 items, 64 MiB proxy download.
+
+| Scenario | Recorded p95 ms | Ceiling |
+| --- | ---: | ---: |
+| Git-aware enumeration (100k-file repo, ≤ 2 git invocations, 10k results cap) | 299.166 | 2,000 |
+| Process chunk page (50 KiB pages over 1 GiB spill, 64 MiB retained) | 0.051 | 10 |
+| LSP diagnostic normalization (1,000 diagnostics at hard per-file cap) | 0.210 | 100 |
+| Forge pagination (100 pages × 100 check-runs, deduped) | 144.233 | 10,000 |
+| Proxy download (64 MiB at default response cap, resident buffering ≤ 2× maxBytes) | 93.667 | 30,000 |
+| Renderer stream (1,000-op A2UI surface as 16×64-op batches + full tree render) | 2.000 | 100 |
+| AG-UI mapper sync path (4,000 events through the async pipeline, sync hooks only) | 30.924 | 100 |
+
+Conformance: `scripts/phase9-conformance.test.mjs` (8 network-free cases: composed enumeration → LSP rename → process → forge → egress, symlink/ignore escape, LSP URI escape, process ownership, forge cross-tenant + token hygiene, egress private/metadata bypass, limit ladder, packed example). Values are environment evidence, not universal SLOs.
+
+## Release 0.0.24 distributed events and tool effects
+
+`node scripts/benchmark-0.0.24.mjs` is an explicit protected PostgreSQL benchmark behind `PRISM_TEST_POSTGRES_URL`. Checked `scripts/benchmark-0.0.24.json` (Node v24.18.0/Linux x64, PostgreSQL 16.14): 10 tenants × 10 principals × 1,000 events/owner, 16 producers/subscribers, 100 warmups, 1,000 measured ops, 10,000-event sustained replay, 100-row cleanup.
+
+| Scenario | Recorded p95 ms | Ceiling |
+| --- | ---: | ---: |
+| Event append / page | 1.502 / 3.103 | 50 / 100 |
+| Effect claim+transition / cleanup | 3.084 / 3.242 | 50 / 100 |
+| Event cleanup / reconnect catch-up | 1.370 / 7.883 | 100 / 2000 |
+
+Sustained replay delivered 160,000 subscriber-events at 101.34 events/s. Five `EXPLAIN (ANALYZE, BUFFERS, FORMAT JSON)` plans used named indexes with no sequential scans. Process conformance (`scripts/phase7-conformance.test.mjs`) covers 16-process producers, `LISTEN` backend kill + poll catch-up, and pending/dispatched effect crash windows. Values are environment evidence, not universal SLOs.
+
+## Release 0.0.23 enterprise PostgreSQL evidence
+
+`node scripts/benchmark-0.0.23.mjs` is an explicit protected PostgreSQL benchmark, not part of `npm test` or `sdk:ready`. It requires `PRISM_TEST_POSTGRES_URL`, creates/drops an isolated schema, and checks frozen p95 ceilings from `scripts/budgets.json`. The checked `scripts/benchmark-0.0.23.json` evidence was recorded on Node v24.18.0/Linux x64 with `postgres:16-alpine`: 10 tenants × 10 principals × 1,000 policy/evaluation rows, 10,000 router keys, 16 pool clients, 100 warmups, 1,000 measured operations, and 100-row cleanup batches.
+
+| Scenario | Recorded p95 ms | Ceiling |
+| --- | ---: | ---: |
+| Policy append / query | 0.747 / 1.479 | 50 / 100 |
+| Evaluation append / query | 0.698 / 0.963 | 50 / 100 |
+| Work claim+complete / contention | 1.892 / 4.162 | 50 / 50 |
+| Router rate / budget / circuit contention | 12.011 / 6.715 / 28.410 | 50 / 50 / 50 |
+| Explicit cleanup batch | 2.981 | 100 |
+
+The same run accepted 1,000 rate claims, accumulated 16,000 budget tokens, granted 1,000 circuit probes, and verified 14 named-index `EXPLAIN (ANALYZE, BUFFERS, FORMAT JSON)` plans with no sequential scans. Before cleanup it recorded 101,100 policy rows (68,517,888 bytes), 101,100 evaluation rows (97,296,384 bytes), and 121,100 router-rate rows; cleanup removed exactly 100,000 expired rate rows. PostgreSQL relation allocation does not necessarily shrink after `DELETE` under MVCC, so row removal—not immediate file shrink—is the cleanup assertion. Values are dated environment evidence, not universal production SLOs; size pools, partitions, retention, and cleanup frequency from host measurements.
+
+## Release 0.0.16 performance budgets and artifact diet
+
+Release 0.0.16 is a simplification/readiness release: it added no performance-affecting code, so the six network-free scenario medians are held at the 0.0.15 baseline and the win is a smaller published artifact. Budgets live in `scripts/budgets.json` (measured baselines + tolerance) and are enforced two ways:
+
+- **Fast gate (every `npm test`)** — `scripts/budget-gate.test.mjs` re-packs the root tarball (`npm pack --dry-run --json`) and fails if packed bytes, unpacked bytes, or file count exceed baseline + 5%, and fails if cold-process `import('./dist/index.js')` exceeds the 250 ms sanity ceiling. Negative fixtures prove an inflated/regressed value fails.
+- **Release evidence runner** — `node scripts/benchmark-0.0.16.mjs` re-measures root pack + startup, spawns `benchmark-0.0.15.mjs` for the six scenario medians (reused unchanged), compares every value to `budgets.json` (throughput floor / latency ceiling at ±25%), prints the evidence report below, and exits non-zero on any regression.
+
+**Artifact diet (the 0.0.16 finding).** The Task 1 tarball deny list dropped the historical `docs/review-coverage-*.md` (11 files, 283,022 bytes) from the root package: the root tarball went from **659,478 packed / 2,310,686 unpacked / 281 files** (0.0.15) to a budgeted **≈575,680 packed / 2,043,402 unpacked / 270 files**. The per-release `scripts/benchmark-0.0.*.mjs` history never shipped in artifacts (root `files` is `dist`/`docs`/`templates`/`CHANGELOG.md` only — zero `scripts/` entries packed), so no archive move was needed; `benchmark-0.0.16.mjs` consolidates the current evidence behind one budget-gating runner.
+
+**Recorded budgets (`scripts/budgets.json`, measured 2026-07-26, Node v24.18.0, Linux x86_64):**
+
+| Budget | Baseline | Tolerance |
+| --- | --- | --- |
+| Root packed bytes | 575,680 | +5% |
+| Root unpacked bytes | 2,043,402 | +5% |
+| Root file count | 270 | +5% |
+| Aggregate packed bytes (44 manifests, reference only) | 1,217,694 | +10% |
+| Startup `import('./dist/index.js')` | ~38 ms | ceiling 250 ms |
+| Six scenario medians (below) | 0.0.15 baseline | ±25% |
+
+**0.0.16 measured evidence** (`node scripts/benchmark-0.0.16.mjs`, 100 iterations each, network-free, 0 backpressure / 0 resource-limit signals; all 22 budget checks passed):
+
+| Scenario | throughput/s | p50 ms | p95 ms |
+| --- | --- | --- | --- |
+| openai-hosted-continuation | 5,514.9 | 0.1305 | 0.2735 |
+| openai-realtime-envelope | 900.5 | 1.1277 | 1.2002 |
+| ai-sdk-v4-stream-mapping | 23,850.4 | 0.0225 | 0.0795 |
+| provider-package-metadata | 54,097.0 | 0.0066 | 0.0386 |
+| rag-parse-replace-rerank-retrieve | 5,176.6 | 0.1428 | 0.3671 |
+| memory-retention-export-rebuild | 13,952.1 | 0.0470 | 0.1339 |
+
+Root startup measured ≈37.7 ms (ceiling 250 ms). Timing is machine-dependent, so medians carry a wide ±25% band and are release evidence rather than tight cross-machine guarantees; the deterministic artifact-size gate is the hard CI tripwire. Raise the baselines in `scripts/budgets.json` after a deliberate, reviewed performance change.
+
+## Release 0.0.15 provider, RAG, and memory evidence
+
+Run `node scripts/benchmark-0.0.15.mjs`; `PRISM_BENCH_ITERATIONS` accepts 10–100,000 (default 100). Schema/bounds test: `node --test scripts/benchmark-0.0.15.test.mjs`. Default mode is network-free: fake Responses SSE/WebSocket transports, a fake AI SDK v4 model, zero-fetch provider-package registration, hash embeddings, in-memory RAG replacement/reranking/retrieval/status, and in-memory memory retention/export/rebuild.
+
+Scenarios: `openai-hosted-continuation`, `openai-realtime-envelope`, `ai-sdk-v4-stream-mapping`, `provider-package-metadata`, `rag-parse-replace-rerank-retrieve`, and `memory-retention-export-rebuild`.
+
+Every row reports throughput, p50/p95 latency, heap, disk, queue/backpressure, and safety signals. `resourceLimitSignals` must be zero: hosted calls remain provider-owned, continuation stops after its finite path, Realtime credentials are absent from events, provider setup does not resolve credentials, retrieved RAG content stays inert, and memory export redacts the fixture secret. These are behavior/bound gates; host-local timings are comparison evidence, not portable release thresholds.
+
+| Resource | Default / hard |
+| --- | --- |
+| OpenAI continuation hops | 8 |
+| Realtime audio events / bytes per second | 64 / 256 · 1 MiB / 8 MiB |
+| RAG document bytes | 1 MiB / 8 MiB |
+| RAG rerank input / time / active calls | 64 KiB / 256 KiB · 2 s / 10 s · 2 / 8 |
+| RAG ingestion-status page | 50 / 200 |
+| Memory retention batch | 500 / 5,000 |
+| Memory export | 100 / 200 entries · 4 MiB / 32 MiB · 10 s / 60 s |
+| Memory rebuild | 32 / 128 entries · 10 s / 60 s |
+
+This task adds no package or runtime dependency: package/install delta is zero and the frozen graph remains 43 publishable manifests. Credentialed protocol checks are documented in the [0.0.15 protected live-canary matrix](release-and-install.md#015-protected-live-canary-matrix); they never run in this benchmark, `npm test`, or `sdk:ready`.
+
+2026-07-26 baseline: Node v24.18.0, Linux x64, 100 iterations/scenario, network=false, credentials=false.
+
+| Scenario | ops/s | p95 ms | heap bytes | backpressure | resource limits |
+| --- | ---: | ---: | ---: | ---: | ---: |
+| OpenAI hosted continuation | 4,885 | 0.2924 | 15,475,920 | 0 | 0 |
+| OpenAI Realtime envelope | 858 | 1.3130 | 12,092,232 | 0 | 0 |
+| AI SDK v4 mapping | 27,580 | 0.0573 | 14,848,288 | 0 | 0 |
+| Provider package metadata | 79,823 | 0.0288 | 16,077,080 | 0 | 0 |
+| RAG lifecycle/reranking | 5,324 | 0.3586 | 13,894,576 | 0 | 0 |
+| Memory lifecycle | 12,892 | 0.1608 | 13,923,936 | 0 | 0 |
+
+These values are dated local comparison evidence, not portable thresholds.
+
+## Release 0.0.12 frontend interoperability caps and evidence
+
+`@arnilo/prism-ag-ui` uses finite handler/projection limits, all defaults / hard: request 64 KiB / 1 MiB; input 128 / 1024 messages and 64 KiB / 1 MiB text; event 64 KiB / 1 MiB; error 8 KiB / 64 KiB; replay cursor 4 / 16 KiB; replay page 100 / 500; subscriber queue 128 / 4096; stream 10,000 / 100,000 events and 10 / 64 MiB; request wall time 120 seconds / 30 minutes. Tool arguments/results/progress, frontend tools, and mutable frontend state default to zero exposure; hosts may only add bounded safe projection.
+
+Reconnect is one ownership-scoped redacted durable page plus an optional bounded live subscriber. It is at-least-once at a page boundary, never a polling loop or terminal-run rerun. ACP uses the same event/byte/queue caps. Coding compaction reuses LLM summary/reserve/error/file-operation bounds (16,384 / 131,072 summary and reserve tokens; 1 / 8 KiB summary errors) and makes no additional provider call.
+
+Run `node scripts/benchmark-0.0.12.mjs`; `PRISM_BENCH_ITERATIONS` accepts 10–100,000 (default 100). Schema/bounds test: `node --test scripts/benchmark-0.0.12.test.mjs`. Default mode is network-free and reports mapper/handler/replay throughput and p50/p95, peak emitted queue rows, event bytes, heap, and coding-preparation overhead. Bounds and hostile-input fixtures—not these host-local timings—are release gates.
+
+2026-07-22 baseline: Node v24.18.0, Linux x64, 100 iterations/scenario, network=false, credentials=false.
+
+| Scenario | mode | ops/s | p95 ms | heap bytes | peak queue events | event bytes | cost USD | backpressure | resource limits |
+| --- | --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: |
+| AG-UI mapper | in-process | 23,561 | 0.0398 | 12,029,512 | 2 | 166 | 0 | 0 | 0 |
+| AG-UI handler | web-in-process | 1,401 | 2.2651 | 19,545,416 | 5 | 508 | 0 | 0 | 0 |
+| AG-UI replay | memory-page | 6,094 | 0.3047 | 19,098,240 | 2 | 243 | 0 | 0 | 0 |
+| Coding compaction preparation | in-process | 75,515 | 0.0291 | 20,585,408 | 1 | 208 | 0 | 0 | 0 |
+
+No network, credentials, provider summary call, durable database, or live subscriber is involved. These values are dated local comparison evidence, not portable thresholds.
+
+## Release 0.0.11 session search / context budget / steer caps
+
+Finite caps (defaults / hard) — full matrix in [Phase 6 evidence](review-coverage-2026-07-22-phase-6.md):
+
+| Resource | Default / hard |
+| --- | --- |
+| Session search page | 20 / 100 |
+| Search query string | 4 KiB / 16 KiB |
+| Search snippet | 512 B / 4 KiB |
+| Memory linear sessions / entries / bytes | 1000/5000 · 10000/50000 · 8 MiB/64 MiB |
+| FTS candidates | 1000 / 5000 |
+| Context budget tokens / bytes | caller-set / hard 2_000_000 tokens · 32 MiB |
+| Context omission rows | 256 / 1024 |
+| Pending steers | 8 messages / 64 KiB |
+
+Run `node scripts/benchmark-0.0.11.mjs`; `PRISM_BENCH_ITERATIONS` accepts 10–100,000 (default 100). Schema/bounds test: `node --test scripts/benchmark-0.0.11.test.mjs`. Default mode is network-free: memory-linear `searchSessions` (label + query) plus assembler `contextBudget` eviction/fit. Emits environment, scenario mode, throughput, p50/p95 latency, heap, disk bytes, process counts, zero external cost, backpressure, and resource-limit signals. Search never default-scans an unbounded store; budget fails closed on mandatory prefix overflow; steer overflow fails closed. These are evidence fields, not CI timing gates.
+
+## Release 0.0.10 reproducible workspace-mode evidence
+
+Run `node scripts/benchmark-0.0.10.mjs`; `PRISM_BENCH_ITERATIONS` accepts 10–100,000 (default 100). Schema/bounds test: `node --test scripts/benchmark-0.0.10.test.mjs`. Default mode is network-free: host-composition write/read/list plus sandbox-fake composition write/read/list/search (in-memory `DisposableSandbox`). Emits environment, scenario mode, throughput, p50/p95 latency, heap, disk bytes, process counts, zero external cost, backpressure, and resource-limit signals. Optional `PRISM_BENCH_DOCKER=1` (with `PRISM_TEST_DOCKER_*`) appends real local Docker composition rows. Unified workspace mode reuses existing sandbox/repo hard caps and adds no unbounded host↔container sync. These are evidence fields, not CI timing gates.
+
 ## Release 0.0.9 reproducible coding/browser evidence
 
 Run `node scripts/benchmark-0.0.9.mjs`; `PRISM_BENCH_ITERATIONS` accepts 10–100,000 (default 100). Schema/bounds test: `node --test scripts/benchmark-0.0.9.test.mjs`. Default mode is network-free fake/in-process only and emits environment, scenario mode, throughput, p50/p95 latency, heap, disk bytes, process counts, zero external cost, backpressure, and resource-limit signals for repository list/search, Git status, and browser open/snapshot/action/close. Optional `PRISM_BENCH_DOCKER=1` (with `PRISM_TEST_DOCKER_*`) and `PRISM_BENCH_PLAYWRIGHT=1` append real local Docker / protected Playwright rows. These are evidence fields, not CI timing gates.
@@ -54,6 +315,8 @@ Durable coding plan/checkpoint defaults/hard caps: plan Markdown 256 KiB/1 MiB;
 
 Browser automation defaults/hard caps from `@arnilo/prism-browser`: pages 4/16; actions 100/256; queued actions 16/64; snapshot refs 2,000/10,000; depth 30/100; snapshot bytes 256 KiB/2 MiB; navigation 30 s/120 s; action 10 s/60 s; wait 30 s/120 s; run wall 20 min/30 min; popups 4/16; dialogs 16/64; listeners 64/256; action input 64 KiB/256 KiB; close grace 5 s/30 s; network requests 1,000/10,000 with 10/32 redirects per request and 8/32 WebSockets; screenshots 16/64 with 16/64 megapixels and 10 MiB/32 MiB encoded; uploads 8/32 files, 16 MiB/64 MiB each, 64 MiB/256 MiB aggregate; downloads 8/32 files, 32 MiB/256 MiB each, 64 MiB/512 MiB aggregate. Caps charge before context/page/action/queue/snapshot/network/artifact retention. Host supplies Playwright and egress proxy attestation; package import launches nothing.
 
+0.0.14 co-work defaults/hard caps (frozen in [Phase 9 evidence](review-coverage-2026-07-25-phase-9.md)): conversation thread list pages 50/200, active branches per thread 16/64, replay/export page 100/500 events; artifact revisions per artifact 32/128, artifacts per thread 64/256, metadata record 8/64 KiB, preview 16/64 KiB, citations 32/128 (2/8 KiB each), delivery-link TTL 5 min/24 h, delivery token 4/16 KiB, compare exactly 2 revisions; memory retention batch 500/5000; proactive capability TTL 24 h/31 d, capability token record 16 KiB; browser checkpoint URL 8 KiB/16 KiB, domain-state hash 256 B/1 KiB, host-data ref 2 KiB/8 KiB, 16/64 checkpoints per run; device stream chunk 1 MiB/8 MiB, concurrent device sessions per identity 1/4 (device wall/turns/tool calls consume shared `RunLimits`). All caps charge before persist/emit and fail closed on overflow. Benchmark placeholder: `node scripts/benchmark-0.0.14.mjs` (release Task 12) reports conversation replay, memory injection/consent, artifact revision/delivery, AG-UI co-work mapping, and connector refresh overhead against these budgets.
+
 Current surfaces:
 
 - `SubscribeOptions` for bounded live `AgentEvent` subscriber queues.
@@ -415,6 +678,25 @@ Timings are one local Node v24.18.0 run over mock agents and an in-process fetch
 
 No performance ceiling was raised. Core grew from Phase 0's 346.0 kB packed baseline to ~403.7 kB after documented APIs/templates, while the full package set remains ~690.6 kB packed. Follow-up review includes all six Phase 4-13 capability packages through `prism-all` and AI SDK interoperability through `prism-providers`; focused base/code/SDK profiles remain unchanged and no capability auto-activates. Manifest tarballs remain tiny: providers 1.4 kB and all 1.6 kB packed.
 
+### 0.0.13 Phase 8 server deployment seams (2026-07-23)
+
+Optional health/drain/rate-limit/replay/deployment-lease helpers on `@arnilo/prism-server`. No listener, queue adapter, or concurrency hard-cap raise.
+
+| Surface | Result |
+| --- | --- |
+| Focused server suite | existing handler tests + 4 deployment seam tests pass |
+| Health body | default 4 KiB / hard 64 KiB; detail requires authorize |
+| Drain admit cutoff | default 30 s / hard 5 min; admits reject immediately on `beginDrain` |
+| Replay page / cursor | 100 / 4 KiB default; 500 / 16 KiB hard |
+| Concurrent runs | unchanged 16 / 256 |
+| Queues | absent; use `createWorkflowCoordinator` polling until measured need |
+
+### 0.0.13 Phase 8 identity, policy, router, and work connectors (2026-07-24)
+
+Enterprise governance and connector caps (defaults / hard). Timings: `node scripts/benchmark-0.0.13.mjs`; `PRISM_BENCH_ITERATIONS` accepts 10–100,000 (default 100). Schema/bounds test: `node --test scripts/benchmark-0.0.13.test.mjs`. Default mode is network-free and reports identity/policy/router/work-connector/deployment throughput and p50/p95 with frozen budget refs in the report JSON. Bounds and hostile-input fixtures—not these host-local timings—are release gates.
+
+Offline behavior tests (identity propagation, policy export, router deny paths, fake CLI argv) are release gates; live tenant canaries remain operator-gated.
+
 ## Related APIs
 
 - [Agent events](agent-events.md): `SubscribeOptions` and `event_subscriber_overflow` event details.