@arnilo/prism 0.11.1 → 0.12.0

package/CHANGELOG.md

@@ -1,3 +1,30 @@
+## [0.12.0] - 2026-09-26
+
+> **Twelve publishable packages.** Lockstep minor from 0.11.1. Runtime is Bun `>=1.4.2`. Optional local document extraction is not a default install. See [docs/history/migrate-to-0.12.0.md](docs/history/migrate-to-0.12.0.md).
+
+### Added
+- **`@arnilo/prism-providers/decisions` typed decision call.** `askSystemOneDecisions(body, { timeoutMs?, maxStateBytes? }, signal?)` makes one `/v1/systemone` round trip and returns `{ model, answers, usage, timingMs }` with raw choice/score probabilities and confidence preserved; pre-fetch bounds (1–256 questions, 2–255 choice options, 2–10 score levels, 256 KiB state), typed auth/invalid-request/retry-exhausted/aborted errors, and deadline/abort composition into the existing retry loop. The `/typesafe` and `/laya` provider adapters still render schema text only. See [docs/providers/decisions.md](docs/providers/decisions.md).
+- **Per-iteration replay forking with state and input injection.** `replayWorkflow` accepts `iteration?: number`, `injectState?: JsonObject`, and `injectInput?: unknown` in `ReplayWorkflowInput`. Targeted replay verifies the iteration exists in node execution history, restores checkpoint state at `stateVersionBefore` in $O(1)$ from `stateHistory`, merges injected state overrides, and seeds subsequent supersteps with deterministic lineage metadata. See [docs/workflows.md](docs/workflows.md).
+- **Workflow state scoping & subgraph isolation (`withNodeScope`, `createScopedState`, `scopedSubgraphNode`).** Higher-order node wrapper `withNodeScope(scopeKey, node)` isolates node reads and updates to a sub-namespace within workflow state (`ctx.state = rootState[scopeKey]`), while exposing `ctx.rootState` for explicit cross-scope reads and validating scope keys against identifier traversal. `scopedSubgraphNode` executes nested workflows in isolated state namespaces with bidirectional input/output mapping. See [docs/workflows.md](docs/workflows.md).
+- **Declarative event-driven swarm topology (`swarmRouterNode`, `defineSwarmWorkflow`).** Topic-based pub/sub multi-agent routing over cyclic supersteps. Agents publish events via `publishSwarmEvent(ctx, event)` and query triggering events via `getActiveSwarmEvents(ctx)`. `swarmRouterNode` matches topics (including wildcard patterns `topic:*` and `*`) against declared subscriptions and dynamically fans out to subscriber agents, draining cleanly to completion when all topic queues are empty. See [docs/workflows.md](docs/workflows.md) and [docs/multi-agent-patterns.md](docs/multi-agent-patterns.md).
+- **Cyclic workflow graphs and dynamic routing (`routeNode`).** Wave-based superstep execution engine for cyclic workflows (`limits.maxSupersteps`, hard cap 256), node activation semantics (`activation: "all" | "any"`), dynamic branch selection via `routeNode({ select })` with fail-closed target validation against declared edges (`WorkflowRouteTargetError`, `ERR_PRISM_WORKFLOW_ROUTE_TARGET`), idle-drain completion, fail-closed host-unforgeable budget enforcement (`WorkflowSuperstepLimitError`, `ERR_PRISM_WORKFLOW_SUPERSTEP_LIMIT`), checkpoint schemaVersion 2 (`execution.superstep`, `execution.pending`, `execution.maxSupersteps`) with crash-consistent wave resumes, and cyclic replay resolution to latest succeeded iteration evidence. See [docs/workflows.md](docs/workflows.md).
+- **Field-evidence guardrail (`createFieldEvidenceGuardrail`).** Opt-in `tool_input` guardrail beside claim grounding: each host-selected argument dot-path must resolve to a claim envelope (`{ value, source, path, revision? }`) that synchronous host-supplied evidence confirms for the same source and revision. Failures block with reason `field_evidence` and a violation token, never echo claimed or evidence values, and cap required fields (256) and evidence records (4,096). See [docs/guardrails.md](docs/guardrails.md).
+- **Optional local document extraction.** `@arnilo/prism-work/document-extraction` converts supported bytes to Markdown with optional `@firecrawl/anydoc@0.2.4`. Scanned PDFs and explicit image OCR need a host-provisioned Docling worker (`docling/ocr.py`). Default hosts install neither. One OCR job. No upload by default.
+- **`advertiseRecall` for observational-memory compaction.** `renderObservationalMemory` / `buildObservationalMemoryContextBlocks` can withhold the recall guidance sentence when the host exposes no recall tool; default `true` keeps existing output. See [docs/compaction-observational-memory.md](docs/compaction-observational-memory.md).
+
+### Changed
+- **Lockstep `0.11.1` → `0.12.0`.** All twelve manifests and internal caret ranges move together. The `src/index.ts` version constant is `"0.12.0"`.
+- **SQLite is `bun:sqlite`.** The `better-sqlite3` peer is removed. Blob reads are `Uint8Array`. `lastInsertRowid` is a number unless `safeIntegers`. An `undefined` bind stores NULL. A `get()` miss is `null`. A Node import fails with the Bun runtime message.
+- **Scaffolds emit Bun.** `prism init` writes `packageManager` `bun@1.4.2` and Bun install commands.
+- **Coverage-safe observational-memory compaction.** The strategy keeps every eligible message entry after `latestObservationCoverageId`, not only the recent-message window, and leaves the fold boundary behind an unscanned prefix so a covered prefix can still compact. Automatic compaction defers when the observer skipped and no coverage cursor exists yet (`run_active`, `passive`, `missing_model`, `missing_credentials`, `in_flight`, `error`) instead of appending a per-turn compaction entry that folds nothing; `ObservationalMemoryFlushResult.skipped` is now the exported `ObservationalMemoryFlushSkipReason` union. See [docs/compaction-observational-memory.md](docs/compaction-observational-memory.md).
+
+### Security
+- The field-evidence verifier fails closed and keeps claimed and evidence values out of guardrail decisions. The typed decision call keeps timeout/error distinguishable from measured uncertainty and grants no effect authority; calibration stays host configuration.
+- Route targets in `routeNode` are strictly constrained fail-closed to declared workflow edges (`targets ⊆ declaredSuccessors`), preventing arbitrary node injection or traversal of undeclared paths. Superstep execution budgets (`limits.maxSupersteps`) are host-unforgeable across crash restarts and resumes.
+
+### Removed
+- **Node runtime support (retired in 0.12.0).** All twelve publishable manifests declare `engines.bun >=1.4.2` and no longer declare `engines.node`; the two measured Node CI legs (the Node 24 public-import smoke and the `node22-compat` job) retired with them, and every install page moved to `bun add`. `engines.bun` is advisory metadata on Bun 1.4.2 — neither npm nor Bun enforces it — so the compensating control is the fail-closed import message plan 126 adds when the durable storage layer moves to `bun:sqlite`; the registry keeps the 0.11.x line for Node hosts, and `npm pack`/`npm publish`/`npm sbom` stay on the release host (plan 125 Task 5). See [docs/history/retire-node-runtime.md](docs/history/retire-node-runtime.md).
+
 ## [0.11.1] - 2026-09-24 (System One decision models)
 
 ### Added

package/README.md

@@ -1,6 +1,6 @@
 # prism
 
-`prism` is a TypeScript/Node.js agent harness. Host apps and extension packages
+`prism` is a TypeScript agent harness for the Bun runtime. Host apps and extension packages
 bring their tools, providers, credentials, storage, and UI; Prism supplies the
 common contracts, registries, agent/session runtime, replaceable input/prompt
 and compaction strategies, CLI/RPC adapters, and first-party provider/compaction
@@ -46,7 +46,7 @@ packages. The current 0.4 line publishes the generated package inventory (see
 ## Install
 
 ```bash
-npm install @arnilo/prism
+bun add @arnilo/prism
 ```
 
 First-party code packages are separate imports and require `@arnilo/prism` as
@@ -54,14 +54,14 @@ a non-optional peer. Install atomic packages directly or choose a manifest-only
 family/profile; profiles install packages but expose no alias exports and activate nothing:
 
 ```bash
-npm install @arnilo/prism @arnilo/prism-providers            # core + all provider adapters
-npm install @arnilo/prism @arnilo/prism-core @arnilo/prism-memory   # replaces prism-base
-npm install @arnilo/prism @arnilo/prism-coding-tools @arnilo/prism-mcp @arnilo/prism-providers  # replaces prism-code
-npm install @arnilo/prism @arnilo/prism-core @arnilo/prism-mcp @arnilo/prism-providers          # replaces prism-sdk
-npm install @arnilo/prism @arnilo/prism-core @arnilo/prism-providers  # pick families explicitly (no umbrella)
-npm install @arnilo/prism-core/runtime/server @arnilo/prism-core/runtime/workflows    # optional Web API boundary
-npm install @arnilo/prism-core/runtime/supervisor                         # optional local delegation + A2A 1.0
-npm install @arnilo/prism-web-tools                          # unified web tools family (root search + /browser + /obscura subpaths)
+bun add @arnilo/prism @arnilo/prism-providers            # core + all provider adapters
+bun add @arnilo/prism @arnilo/prism-core @arnilo/prism-memory   # replaces prism-base
+bun add @arnilo/prism @arnilo/prism-coding-tools @arnilo/prism-mcp @arnilo/prism-providers  # replaces prism-code
+bun add @arnilo/prism @arnilo/prism-core @arnilo/prism-mcp @arnilo/prism-providers          # replaces prism-sdk
+bun add @arnilo/prism @arnilo/prism-core @arnilo/prism-providers  # pick families explicitly (no umbrella)
+bun add @arnilo/prism-core/runtime/server @arnilo/prism-core/runtime/workflows    # optional Web API boundary
+bun add @arnilo/prism-core/runtime/supervisor                         # optional local delegation + A2A 1.0
+bun add @arnilo/prism-web-tools                          # unified web tools family (root search + /browser + /obscura subpaths)
 ```
 
 See [docs/release-and-install.md](docs/release-and-install.md) for install
@@ -72,12 +72,12 @@ specifiers, tarball contents, and the offline test budget.
 Scaffold a project (offline mock test included):
 
 ```bash
-npx --package @arnilo/prism prism init my-agent
+bunx --package @arnilo/prism prism init my-agent
 # or, scaffold with a real provider package selected:
-npx --package @arnilo/prism prism init my-agent --provider openai
+bunx --package @arnilo/prism prism init my-agent --provider openai
 # or, scaffold a full deep research agent from the template gallery:
-npx --package @arnilo/prism prism init my-research --template deep-research
-cd my-agent && npm install && npm test
+bunx --package @arnilo/prism prism init my-research --template deep-research
+cd my-agent && bun install && bun test
 ```
 
 List available template gallery starters:
@@ -158,22 +158,22 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 ## Packages
 
 <!-- generated:package-truth:inventory begin -->
-**12 publishable manifests** — root `@arnilo/prism` plus 11 workspace packages (4 `prism-*` family packages, 7 capability packages). Generated by `node scripts/package-truth.mjs --emit-docs` — do not hand-edit.
+**12 publishable manifests** — root `@arnilo/prism` plus 11 workspace packages (4 `prism-*` family packages, 7 capability packages). Generated by `bun scripts/package-truth.mjs --emit-docs` — do not hand-edit.
 
 | package | version | notes |
 | --- | --- | --- |
-| `@arnilo/prism` | 0.11.1 | core — runtime, CLI/RPC, templates, docs |
-| `@arnilo/prism-channels` | 0.11.1 | family — transport-neutral messaging runtime, durable journal, pairing and one-use approvals; official /telegram (private DMs, opt-in granted groups/topics) and experimental pinned signal-cli /signal |
-| `@arnilo/prism-coding-tools` | 0.11.1 | family — /agent, /security, /openapi, /computer-use-linux, /dev, /impeccable subpaths |
-| `@arnilo/prism-core` | 0.11.1 | family — /runtime, /sessions, /governance, /credentials, /enterprise, /validation subpaths |
-| `@arnilo/prism-providers` | 0.11.1 | family — all provider adapters as `/<adapter>` subpaths |
-| `@arnilo/prism-acp-agent` | 0.11.1 | capability — ACP adapter |
-| `@arnilo/prism-ag-ui` | 0.11.1 | capability — AG-UI/A2A/A2UI adapter |
-| `@arnilo/prism-hooks` | 0.11.1 | capability — Claude/Codex-compatible hooks.json adapter compiled onto middleware, guardrail, injector, and stop-hook seams |
-| `@arnilo/prism-mcp` | 0.11.1 | capability — MCP client/server/OAuth interop |
-| `@arnilo/prism-memory` | 0.11.1 | capability — memory plus /rag, /compaction/*, /fabric, /wiki subpaths |
-| `@arnilo/prism-web-tools` | 0.11.1 | capability — Brave/Exa/Firecrawl plus peer-gated /browser and /obscura subpaths |
-| `@arnilo/prism-work` | 0.11.1 | capability — /connectors, /documents, /sheets, /diagrams, /document-reader, /sandbox, /skills, /tools subpaths |
+| `@arnilo/prism` | 0.12.0 | core — runtime, CLI/RPC, templates, docs |
+| `@arnilo/prism-channels` | 0.12.0 | family — transport-neutral messaging runtime, durable journal, pairing and one-use approvals; official /telegram (private DMs, opt-in granted groups/topics) and experimental pinned signal-cli /signal |
+| `@arnilo/prism-coding-tools` | 0.12.0 | family — /agent, /security, /openapi, /computer-use-linux, /dev, /impeccable subpaths |
+| `@arnilo/prism-core` | 0.12.0 | family — /runtime, /sessions, /governance, /credentials, /enterprise, /validation subpaths |
+| `@arnilo/prism-providers` | 0.12.0 | family — all provider adapters as `/<adapter>` subpaths |
+| `@arnilo/prism-acp-agent` | 0.12.0 | capability — ACP adapter |
+| `@arnilo/prism-ag-ui` | 0.12.0 | capability — AG-UI/A2A/A2UI adapter |
+| `@arnilo/prism-hooks` | 0.12.0 | capability — Claude/Codex-compatible hooks.json adapter compiled onto middleware, guardrail, injector, and stop-hook seams |
+| `@arnilo/prism-mcp` | 0.12.0 | capability — MCP client/server/OAuth interop |
+| `@arnilo/prism-memory` | 0.12.0 | capability — memory plus /rag, /compaction/*, /fabric, /wiki subpaths |
+| `@arnilo/prism-web-tools` | 0.12.0 | capability — Brave/Exa/Firecrawl plus peer-gated /browser and /obscura subpaths |
+| `@arnilo/prism-work` | 0.12.0 | capability — /connectors, /documents, /sheets, /diagrams, /document-extraction, /document-reader, /sandbox, /skills, /tools subpaths |
 <!-- generated:package-truth:inventory end -->
 
 ## Scripts
@@ -185,6 +185,7 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 | `bun run typecheck` | Type-check without emitting |
 | `bun run test` | Build + run network-free tests (`npm test` still works) |
 | `bun run test:coverage` | Coverage gate: `bun test --coverage` over the core suite and every gated workspace, with Bun-measured floors (`scripts/coverage-thresholds.json`) |
+| `bun run test:coverage` | Coverage gate: `bun test --coverage` over the core suite and every gated workspace, with Bun-measured floors (`scripts/coverage-thresholds.json`) |
 | `bun run test:live` | Run live suites whose credentials are present (skip the rest) |
 | `prism --help` | CLI help |
 

package/dist/cli-dev.js

@@ -10,7 +10,7 @@ import { join } from "node:path";
 import process from "node:process";
 import { pathToFileURL } from "node:url";
 const installHint = "prism dev requires the dev inspector package in this project.\n" +
-    "  npm install --save-dev @arnilo/prism-coding-tools\n" +
+    "  bun add --dev @arnilo/prism-coding-tools\n" +
     "(Scaffolded projects from newer `prism init` templates already include it.)\n";
 /**
  * Default loader: resolve `@arnilo/prism-coding-tools/dev/cli` (or `@arnilo/prism-dev/cli`)

package/dist/cli-init.js

@@ -235,8 +235,8 @@ export async function runInitCommand(argv, runtime) {
             "",
             "Next:",
             `  cd ${shellQuote(displayPath(result.targetDir, runtime.cwd ?? process.cwd()))}`,
-            "  npm install",
-            "  npm test",
+            "  bun install",
+            "  bun test",
             "",
         ].join("\n"));
         return 0;
@@ -482,8 +482,8 @@ function buildTokens(input) {
         ? `# Placeholder only — never commit real secrets.\n${input.provider.envKey}=${input.provider.envPlaceholder ?? ""}\n`
         : `# No API key required for the mock provider.\n# Switch providers with: prism init <dir> --provider openai --force\n`;
     const nextStepsLive = input.provider.envKey
-        ? `2. Copy \`.env.example\` to \`.env\` and set \`${input.provider.envKey}\`.\n3. Run \`npm start\` for a live provider call.`
-        : `2. Run \`npm start\` (mock provider; no network or credentials).`;
+        ? `2. Copy \`.env.example\` to \`.env\` and set \`${input.provider.envKey}\`.\n3. Run \`bun run start\` for a live provider call.`
+        : `2. Run \`bun run start\` (mock provider; no network or credentials).`;
     const optionalDocs = [
         ...(input.withWorkflows ? ["- `src/workflows-example.ts` — tiny DAG example using `@arnilo/prism-workflows`."] : []),
         ...(input.withEvals ? ["- `src/evals-example.ts` — deterministic scorer example using `@arnilo/prism-evals`."] : []),

package/dist/cli-provider-add.js

@@ -112,8 +112,8 @@ export async function runProviderAddCommand(argv, runtime) {
             "",
             "Next:",
             `  cd ${result.name}`,
-            "  npm install",
-            "  npm test",
+            "  bun install",
+            "  bun test",
             "  Replace the starter model metadata and docs stub with docs-verified values before publishing.",
             "",
         ].join("\n"));

package/dist/field-evidence.d.ts

@@ -0,0 +1,53 @@
+import type { Guardrail, JsonObject } from "./contracts.js";
+/** One authoritative host evidence row: the current value of `path` inside `source` at `revision`. */
+export interface FieldEvidenceRecord {
+    /** Host ledger / tool-result identity the value lives in. */
+    readonly source: string;
+    /** Field path inside that source object; matched literally against the claim's `path`. */
+    readonly path: string;
+    readonly value: unknown;
+    /** Source revision/freshness marker; a claim must name the same revision when the host sets one. */
+    readonly revision?: string | number;
+}
+export interface FieldEvidenceContext {
+    readonly sessionId: string;
+    readonly runId: string;
+    readonly toolName: string;
+    readonly toolCallId?: string;
+    /** The tool call's normalized arguments, so the host can resolve evidence per call. */
+    readonly arguments: JsonObject;
+    readonly metadata: Readonly<Record<string, unknown>>;
+    readonly signal: AbortSignal;
+}
+/** Supplies per-call host evidence without coupling this primitive to a host ledger or store. */
+export type FieldEvidenceSource = (context: FieldEvidenceContext) => readonly FieldEvidenceRecord[];
+/** The provenance envelope a proposal-shaped call must place at a required field path. */
+export interface FieldProvenanceClaim {
+    readonly value: unknown;
+    readonly source: string;
+    /** Field path inside `source`; matched literally against {@link FieldEvidenceRecord.path}. */
+    readonly path: string;
+    readonly revision?: string | number;
+}
+/** Canonicalizes claimed and evidence values before exact comparison (units, currency, case). */
+export type FieldEvidenceNormalizer = (value: unknown, field: string) => unknown;
+/** Closed rejection reasons; the decision metadata carries the field and this code. */
+export type FieldEvidenceViolation = "missing_field" | "malformed_claim" | "missing_evidence" | "unknown_source" | "stale_revision" | "value_mismatch" | "evidence_over_limit";
+export interface FieldEvidenceGuardrailOptions {
+    /** Only calls to this tool are verified; every other tool call is allowed. */
+    readonly toolName: string;
+    /** Argument paths that must carry a {@link FieldProvenanceClaim}; 1–256 entries. */
+    readonly required: readonly string[];
+    /** Host-supplied authoritative evidence for the call. Must be synchronous — no retrieval here. */
+    readonly evidence: FieldEvidenceSource;
+    /** Defaults to identity; comparison after normalization is exact (`Object.is`). */
+    readonly normalize?: FieldEvidenceNormalizer;
+}
+/**
+ * Deterministic tool-input guardrail verifying claimed field provenance on one host-selected tool.
+ * It performs no retrieval and grants no authority: it only checks that each required field carries
+ * a typed source reference whose revision and normalized value match the host's evidence set.
+ * Fail-closed: an absent field, absent evidence, unknown source, revision mismatch, or value
+ * mismatch blocks the tool call before dispatch.
+ */
+export declare function createFieldEvidenceGuardrail(options: FieldEvidenceGuardrailOptions): Guardrail<"tool_input">;

package/dist/field-evidence.js

@@ -0,0 +1,143 @@
+const MAX_REQUIRED_FIELDS = 256;
+const MAX_FIELD_PATH_CHARS = 256;
+const MAX_EVIDENCE_RECORDS = 4096;
+const MAX_EVIDENCE_KEY_CHARS = 512;
+/**
+ * Deterministic tool-input guardrail verifying claimed field provenance on one host-selected tool.
+ * It performs no retrieval and grants no authority: it only checks that each required field carries
+ * a typed source reference whose revision and normalized value match the host's evidence set.
+ * Fail-closed: an absent field, absent evidence, unknown source, revision mismatch, or value
+ * mismatch blocks the tool call before dispatch.
+ */
+export function createFieldEvidenceGuardrail(options) {
+    const resolved = resolveOptions(options);
+    return {
+        name: "field-evidence",
+        stage: "tool_input",
+        revision: "1",
+        evaluate(context) {
+            if (context.toolName !== resolved.toolName)
+                return { action: "allow" };
+            const args = context.value.arguments;
+            const { records, truncated } = resolveEvidence(resolved.evidence, resolved.toolName, context);
+            if (truncated)
+                return { action: "block", reason: "field_evidence", metadata: { violation: "evidence_over_limit" } };
+            for (const field of resolved.required) {
+                const violation = verifyField(field, args, records, resolved.normalize);
+                if (violation !== undefined) {
+                    return { action: "block", reason: "field_evidence", metadata: { field, violation } };
+                }
+            }
+            return { action: "allow" };
+        },
+    };
+}
+function resolveOptions(options) {
+    if (!options || typeof options.toolName !== "string" || options.toolName.trim().length === 0) {
+        throw new TypeError("Field evidence toolName must be a non-empty string");
+    }
+    if (!Array.isArray(options.required) || options.required.length === 0 || options.required.length > MAX_REQUIRED_FIELDS) {
+        throw new TypeError(`Field evidence required must be 1–${MAX_REQUIRED_FIELDS} field paths`);
+    }
+    for (const field of options.required) {
+        if (typeof field !== "string" || field.trim().length === 0 || field.length > MAX_FIELD_PATH_CHARS) {
+            throw new TypeError(`Field evidence required paths must be non-empty strings of at most ${MAX_FIELD_PATH_CHARS} chars`);
+        }
+    }
+    if (typeof options.evidence !== "function")
+        throw new TypeError("Field evidence requires an evidence source function");
+    if (options.normalize !== undefined && typeof options.normalize !== "function") {
+        throw new TypeError("Field evidence normalize must be a function");
+    }
+    return {
+        toolName: options.toolName,
+        required: [...options.required],
+        evidence: options.evidence,
+        normalize: options.normalize ?? ((value) => value),
+    };
+}
+function resolveEvidence(source, toolName, context) {
+    const value = context.value;
+    const raw = source({
+        sessionId: context.sessionId,
+        runId: context.runId,
+        toolName,
+        ...(context.toolCallId === undefined ? {} : { toolCallId: context.toolCallId }),
+        arguments: value.arguments,
+        metadata: context.metadata,
+        signal: context.signal,
+    });
+    if (!Array.isArray(raw))
+        return { records: [], truncated: false };
+    const valid = raw.filter(validRecord);
+    return { records: valid.slice(0, MAX_EVIDENCE_RECORDS), truncated: valid.length > MAX_EVIDENCE_RECORDS };
+}
+function validRecord(record) {
+    if (!record || typeof record !== "object")
+        return false;
+    if (typeof record.source !== "string" || record.source.length === 0 || record.source.length > MAX_EVIDENCE_KEY_CHARS)
+        return false;
+    if (typeof record.path !== "string" || record.path.length === 0 || record.path.length > MAX_EVIDENCE_KEY_CHARS)
+        return false;
+    if (!Object.hasOwn(record, "value"))
+        return false;
+    const revision = record.revision;
+    return (revision === undefined ||
+        (typeof revision === "string" && revision.length > 0) ||
+        (typeof revision === "number" && Number.isFinite(revision)));
+}
+function verifyField(field, args, records, normalize) {
+    const raw = readPath(args, field);
+    if (raw === undefined)
+        return "missing_field";
+    const claim = asClaim(raw);
+    if (claim === undefined)
+        return "malformed_claim";
+    if (records.length === 0)
+        return "missing_evidence";
+    const candidates = records.filter((record) => record.source === claim.source && record.path === claim.path);
+    if (candidates.length === 0)
+        return "unknown_source";
+    const fresh = candidates.filter((record) => record.revision === claim.revision);
+    if (fresh.length === 0)
+        return "stale_revision";
+    const claimed = normalize(claim.value, field);
+    if (fresh.some((record) => Object.is(normalize(record.value, field), claimed)))
+        return undefined;
+    return "value_mismatch";
+}
+function asClaim(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return undefined;
+    const record = raw;
+    if (!Object.hasOwn(record, "value"))
+        return undefined;
+    if (typeof record.source !== "string" || record.source.length === 0)
+        return undefined;
+    if (typeof record.path !== "string" || record.path.length === 0)
+        return undefined;
+    const revision = record.revision;
+    if (revision !== undefined &&
+        !(typeof revision === "string" && revision.length > 0) &&
+        !(typeof revision === "number" && Number.isFinite(revision))) {
+        return undefined;
+    }
+    return { value: record.value, source: record.source, path: record.path, ...(revision === undefined ? {} : { revision }) };
+}
+function readPath(value, path) {
+    let current = value;
+    for (const segment of path.split(".")) {
+        if (Array.isArray(current)) {
+            const index = Number(segment);
+            if (!Number.isInteger(index) || index < 0)
+                return undefined;
+            current = current[index];
+            continue;
+        }
+        if (!current || typeof current !== "object")
+            return undefined;
+        current = current[segment];
+    }
+    return current;
+}
+//# sourceMappingURL=field-evidence.js.map

package/dist/index.d.ts

@@ -53,6 +53,8 @@ export type { ActivatedKernelConfig, AgentEventBridgeOptions, ExtensionErrorPoli
 export { activateKernel, createExtensionEventBus, createExtensionKernel, forwardAgentEvents } from "./extensions.js";
 export type { MemoryRunFeedbackStoreOptions, PrepareRunFeedbackOptions, RunFeedbackLimits, RunFeedbackRun, RunFeedbackRunResolver, } from "./feedback.js";
 export { createMemoryRunFeedbackStore, prepareRunFeedback, RunFeedbackError, requireRunFeedbackOwnership, runFeedbackPageLimit, } from "./feedback.js";
+export type { FieldEvidenceContext, FieldEvidenceGuardrailOptions, FieldEvidenceNormalizer, FieldEvidenceRecord, FieldEvidenceSource, FieldEvidenceViolation, FieldProvenanceClaim, } from "./field-evidence.js";
+export { createFieldEvidenceGuardrail } from "./field-evidence.js";
 export type { ApplyFieldPolicyOptions, AuditFieldRedaction, AuditFieldRedactorLike, AuditFieldRedactorOptions, FieldPolicy, FieldPolicyAction, FieldPolicyDecision, FieldPolicyInput, ProtectedFieldPolicyOptions, } from "./field-policy.js";
 export { ALLOW_FIELD_POLICY, applyFieldPolicy, createAuditFieldRedactor, createProtectedFieldPolicy, FIELD_POLICY_LIMITS, FieldPolicyError, } from "./field-policy.js";
 export { BUILT_IN_GUARDRAIL_PACK_IDS } from "./guardrail-packs/index.js";
@@ -131,5 +133,5 @@ export { MODEL_FAMILY_TOKENS, resolveModelFamily } from "./usage-estimation.js";
 export type { ResolvedUseCaseModel, ResolveUseCaseModelInput, UseCaseModelBinding, } from "./use-case-model.js";
 export { resolveUseCaseModel, resolveUseCaseModelBinding, useCaseCredentialProviderId, } from "./use-case-model.js";
 export declare const name = "prism";
-export declare const version = "0.11.1";
+export declare const version = "0.12.0";
 export declare const description = "Agent harness for AI providers, agents, sessions, and tools.";

package/dist/index.js

@@ -27,6 +27,7 @@ export { createClaimGroundingGuardrail } from "./evidence-grounding.js";
 export { applyExecutionDecision, assertExecutionAllowed, checkExecution, ExecutionDeniedError } from "./execution-policy.js";
 export { activateKernel, createExtensionEventBus, createExtensionKernel, forwardAgentEvents } from "./extensions.js";
 export { createMemoryRunFeedbackStore, prepareRunFeedback, RunFeedbackError, requireRunFeedbackOwnership, runFeedbackPageLimit, } from "./feedback.js";
+export { createFieldEvidenceGuardrail } from "./field-evidence.js";
 export { ALLOW_FIELD_POLICY, applyFieldPolicy, createAuditFieldRedactor, createProtectedFieldPolicy, FIELD_POLICY_LIMITS, FieldPolicyError, } from "./field-policy.js";
 export { BUILT_IN_GUARDRAIL_PACK_IDS } from "./guardrail-packs/index.js";
 export { assertGuardrailsAllowed, compileGuardrailPacks, describeGuardrailPacks, GuardrailError, GuardrailPackError, MAX_GUARDRAIL_CONCURRENCY, MAX_GUARDRAIL_PACK_RULES, MAX_GUARDRAIL_PACKS, runGuardrails, } from "./guardrails.js";
@@ -72,6 +73,6 @@ export { trimTrailingSlashes } from "./trim-trailing-slashes.js";
 export { MODEL_FAMILY_TOKENS, resolveModelFamily } from "./usage-estimation.js";
 export { resolveUseCaseModel, resolveUseCaseModelBinding, useCaseCredentialProviderId, } from "./use-case-model.js";
 export const name = "prism";
-export const version = "0.11.1";
+export const version = "0.12.0";
 export const description = "Agent harness for AI providers, agents, sessions, and tools.";
 //# sourceMappingURL=index.js.map

package/dist/run-bundle.js

@@ -23,7 +23,7 @@ export function snapshotRunBundle(input) {
     const model = run?.model ?? config.model;
     const effectiveLoop = run?.loop ?? config.loop;
     const systemPrompt = run?.systemPrompt ?? config.systemPrompt;
-    const policies = run?.providerRequestPolicies ?? config.providerRequestPolicies;
+    const policies = [config.providerRequestPolicies, run?.providerRequestPolicies].flatMap((policy) => policy ?? []);
     const snapshot = {
         schemaVersion: RUN_BUNDLE_SCHEMA_VERSION,
         fingerprint: agentFingerprint(input.agent, definitionRevision ?? ""),
@@ -64,7 +64,7 @@ export function snapshotRunBundle(input) {
             provider: typeof model === "string" ? (config.provider?.id ?? null) : (model?.provider ?? null),
             model: typeof model === "string" ? model : (model?.model ?? null),
         },
-        requestPolicies: policies === undefined ? [] : (Array.isArray(policies) ? policies : [policies]).map((policy) => policy.name),
+        requestPolicies: policies.map((policy) => policy.name),
         storage: {
             sessionStore: kindOf(describeStorage(input.config?.store ?? config.store, undefined)),
             checkpoints: kindOf(describeStorage(undefined, (run?.runState ?? config.runState)?.checkpoints)),

package/docs/acp-agent.md

@@ -5,7 +5,7 @@ New in 0.2.8 (plan 028 Task 10 / adoption F3). A thin binary that serves [`creat
 ## Running
 
 ```sh
-npx prism-acp-agent [--config prism-acp-agent.json]
+bunx prism-acp-agent [--config prism-acp-agent.json]
 ```
 
 The agent speaks ACP v1 as newline-delimited JSON on `stdin`/`stdout` (SDK `ndJsonStream` adapter over `Readable.toWeb(process.stdin)` / `Writable.toWeb(process.stdout)`). It serves until the client closes stdin; an `EPIPE` on stdout (client disconnected) is a normal shutdown.
@@ -13,7 +13,7 @@ The agent speaks ACP v1 as newline-delimited JSON on `stdin`/`stdout` (SDK `ndJs
 ```sh
 # a config file must exist; missing/invalid config fails closed with a clear error and exit 1
 printf '%s\n' '{"userId":"local","cwd":"/workspace"}' > prism-acp-agent.json
-npx prism-acp-agent
+bunx prism-acp-agent
 ```
 
 ## Config reference

package/docs/ag-ui.md

@@ -21,7 +21,7 @@ Use [A2A interoperability](a2a.md) for remote agent-to-agent JSON-RPC/HTTPS task
 Install the optional package beside the core runtime (it becomes publishable with the 0.0.12 release graph):
 
 ```bash
-npm install @arnilo/prism @arnilo/prism-ag-ui
+bun add @arnilo/prism @arnilo/prism-ag-ui
 ```
 
 `createAgUiHandler()` takes host-owned callbacks:

package/docs/attention-compiler.md

@@ -338,7 +338,7 @@ await resumeAgentRun(agent, { runId, sessionId }, { decision: "continue", expect
 - Compaction stays a task boundary: the compiler never writes the store and never triggers compaction mid-run (`session.compact()` still refuses while a run is active), and it never rewrites observational memory.
 - Telemetry stays payload-free: the `attention_compiled` event carries `used`, `usedAfter`, `inputCap`, `triggerRatio`, `droppedThinkingTurns`, `stubbedToolResults`, `stubbedBytes`, and `truncated` only.
 - `applyContextBudget` is not the compiler's last resort — overflowing after all eligible stages throws `AttentionBudgetError` so the frozen prefix (system instructions, `AGENTS.md`, skill catalog, tool declarations) cannot be silently evicted.
-- Measured on the hermetic fixture in [`docs/_evidence/phase74-attention-measurements.md`](_evidence/phase74-attention-measurements.md): 63.7 % fewer input tokens, one cache bust on the turn the gate trips (compiler-off is append-only), and a volatile provider block that re-sends everything behind it every turn — which is why pinning a block stays a host recipe (`resolve` once per session) rather than compiler behavior. Regenerate with `node scripts/benchmark.mjs --scenario attention-compiler`.
+- Measured on the hermetic fixture in [`docs/_evidence/phase74-attention-measurements.md`](_evidence/phase74-attention-measurements.md): 63.7 % fewer input tokens, one cache bust on the turn the gate trips (compiler-off is append-only), and a volatile provider block that re-sends everything behind it every turn — which is why pinning a block stays a host recipe (`resolve` once per session) rather than compiler behavior. Regenerate with `bun scripts/benchmark.mjs --scenario attention-compiler`.
 
 ## Related APIs
 

package/docs/cli-rpc.md

@@ -18,7 +18,7 @@ An env-gated e2e journey drives the packed `prism` bin end to end — `init` sca
 
 ```bash
 PRISM_LIVE_PROVIDER_TESTS=1 OPENAI_API_KEY=sk-... \
-  node --test scripts/e2e-cli-live.test.mjs
+  bun test scripts/e2e-cli-live.test.mjs
 ```
 
 The provider is the first init-catalog entry whose credential env var is present; override with `PRISM_LIVE_CLI_PROVIDER=<id>`. Wire legs skip (never fail) when the provider rejects the credential (401/403) — refresh the key and rerun. Registered in `scripts/live-matrix.json` as `cli/journey`.
@@ -227,7 +227,7 @@ prism init my-research --template deep-research
 prism init my-assistant --template personal-assistant
 prism init my-worker --template business-worker
 prism init --list-templates
-cd my-agent && npm install && npm test
+cd my-agent && bun install && bun test
 
 ```
 

package/docs/coding-tools.md

@@ -5,14 +5,14 @@ The `@arnilo/prism-coding-tools` family package unifies Prism's coding agent too
 ## Installation
 
 ```bash
-npm install @arnilo/prism @arnilo/prism-coding-tools
+bun add @arnilo/prism @arnilo/prism-coding-tools
 ```
 
 For document reading or specialized integrations, install the optional peer dependencies as needed:
 
 ```bash
 # PDF and DOCX document extraction
-npm install pdf-parse mammoth
+bun add pdf-parse mammoth
 ```
 
 ## Subpaths Map
@@ -31,7 +31,7 @@ npm install pdf-parse mammoth
 
 ```bash
 # Start the loopback dev inspector
-npx prism-dev --port 4311
+bunx prism-dev --port 4311
 ```
 
 ## Usage Examples

package/docs/compaction-observational-memory.md

@@ -23,7 +23,7 @@ Observational memory composes four independent layers for long sessions (Mastra-
 
 The opt-in work-scope index filters the observation and reflection layers for a host-selected working set. It is not a fifth context layer, retrieval system, or session scope.
 
-Activation is explicit: `createObservationalMemory().attach()` coordinates post-run observe/reflect/drop and compaction — by default `context.compactAfterTokens`, or whatever host gate `trigger` / `shouldCompact` supplies. Import and extension `setup` start nothing. Recall, commands, and utilities fail closed on invalid ids, wrong `sessionId`, ambiguous tool input, or oversized pages. Pass `secrets` for exact-value redaction in render/recall/worker paths. Branch isolation: hosts supply current-branch `appendEntry` and `getEntries`; mismatched store/session pairs fail closed after append.
+Activation is explicit: `createObservationalMemory().attach()` coordinates post-run observe/reflect/drop and compaction — by default `context.compactAfterTokens`, or whatever host gate `trigger` / `shouldCompact` supplies. Import and extension `setup` start nothing. Recall, commands, and utilities fail closed on invalid ids, wrong `sessionId`, ambiguous tool input, or oversized pages. Pass `secrets` for exact-value redaction in render/recall/worker paths. Branch isolation: hosts supply current-branch `appendEntry` and `getEntries`; mismatched store/session pairs fail closed after append. Automatic compaction is coverage-safe: entries no observation pass covers are retained, or compaction is deferred — see the coverage-safe admission contract under Outputs for the details and prompt-sizing trade-off.
 
 See `examples/observational-memory-lifecycle.ts` for attach → turn → projection/recall/page without live credentials.
 
@@ -85,14 +85,14 @@ Key exports:
 | `buildObservationalMemoryContextBlocks()` | Render observational-memory + recent-messages context blocks for provider input. Same `invalidatedIds` option. |
 | `selectRecentMessageEntries()` / `renderRecentMessageWindow()` | Bounded exact recent-message suffix; count via `keepRecentEntries`, optional token trim via `estimateEntryTokens`. |
 | `createFoldedMemoryDetails()` | Create JSON details for compaction `data.memory`. |
-| `renderObservationalMemory()` | Render reflections and observations into a prepared memory summary. |
+| `renderObservationalMemory()` | Render reflections and observations into a prepared memory summary. `advertiseRecall: false` omits the recall-evidence instruction; an empty pool never advertises recall. |
 | `recallObservationalMemory()` | Recover source evidence for a known observation/reflection id from supplied current-branch entries. `invalidatedIds` withholds content (`reason: "revoked"`) without injecting derived text. |
 | `listInvalidatedIds()` (`@arnilo/prism-memory`) | Read the ids one exact scope currently withholds (`corrected` stays) and pass them as `invalidatedIds`, so blocks that rest on a source revoked mid-turn go stale on the next build. Empty for stores without lineage invalidation. |
 | `createObservationalMemoryDropHandler()` | The OM leg of `createDeletionPropagator`: folds the session ledger once and appends one `om.observations.dropped` entry naming every active observation whose id or `sourceEntryIds` intersect the tombstone set (`coversUpToId` omitted — a tombstone set is not a coverage position). Register with `{ session, appendEntry }`; pair it with `listInvalidatedIds()` for the read path. |
 | `recallObservationalMemoryBranchPage()` | Page eligible user/assistant/tool messages around a cursor entry id (`forward`/`backward`, optional `detail: summary|full`). |
 | `createMemoryId()` / `isMemoryId()` | Create/check 12-character ids. |
 | `resolveObservationalMemorySettings()` | Merge `observational-memory` settings with defaults and overrides. |
-| `createObservationalMemory()` / `attach()` | One activation wires post-run observe/reflect/drop and compaction (`compactAfterTokens`, or a host `trigger` / `shouldCompact`); returns proxied session, runtime, context provider, and strategy. |
+| `createObservationalMemory()` / `attach()` | One activation wires post-run observe/reflect/drop and coverage-safe compaction (`compactAfterTokens`, or a host `trigger` / `shouldCompact`); returns proxied session, runtime, context provider, and strategy. |
 | `createObservationalMemoryRuntime()` | Low-level explicit flush for advanced hosts or tests. |
 | `createObservationalMemoryCompactionStrategy()` | Render existing folded memory as a standard Prism compaction summary with `data.memory`. |
 | `createObservationalMemoryExtension()` | Inert extension helper that registers the strategy contribution unless disabled. |
@@ -102,6 +102,16 @@ Key exports:
 
 Pure utilities create no events, workers, tools, commands, credentials, or provider requests. `createObservationalMemoryExtension()` and import alone start nothing. `createObservationalMemory().attach()` runs workers only after proxied `run`/`prompt`/`stream`/`compact` complete (or after `wrapResumeRun` / `wrapResumeStream`). `createObservationalMemoryRuntime().flush()` remains for manual/advanced use. Attached `contextProvider` renders two blocks each turn: `observational-memory` (active reflections/observations aligned to the recent-message boundary) and `recent-messages` (last `keepRecentEntries` message entries in branch order, optionally trimmed by `recentMessageMaxTokens` using `estimateEntryTokens`; oldest dropped first). Compaction uses the same `keepRecentEntries` setting. Observer input includes only eligible `message` entries (`user`, `assistant`, `tool`); memory/compaction/bookkeeping entries advance `coversUpToId` scan coverage without entering the observer prompt. Successful observer/reflector runs append coverage markers even when they record zero facts. Reflection uses only active observations recorded after the last `om.reflections.recorded` entry unless `flush({ fullReflectionRebuild: true })`. Attached `flush()` skips with `run_active` while a proxied run is in flight. The compaction strategy is O(n) over supplied entries and makes no provider call.
 
+### Coverage-safe automatic compaction
+
+Automatic compaction admits only entries an observation pass covers. `flush()` returns a typed `skipped` reason (`run_active`, `passive`, `in_flight`, `missing_model`, `missing_credentials`, `error`) distinct from a successful pass, including one that records zero observations. The attach loop then behaves as:
+
+- Flush skipped or failed **and no `om.observations.recorded` coverage marker exists** — compaction is deferred: no compaction entry is written, so no message prefix is folded into a summary that does not cover it. `debug` receives `observational-memory:compaction-deferred` with the skip reason. A successful pass — even a zero-observation one — advances coverage and compacts normally, so "observer never ran" and "observer ran empty" stay distinguishable.
+- Flush skipped or failed **with partial coverage** — compaction runs, but the strategy adds every eligible message after the coverage cursor to `keepEntryIds`, so uncovered entries survive the next `rebuildSessionContext()` beside the summary. Fully covered sessions get exactly the previous recent-window behavior. Manual `session.compact()` keeps its explicit-host-action semantics and relies on the same retention.
+- Revocation still wins: an `om.observations.dropped` entry excludes an observation from the rendered summary and folded payload regardless of what admission retains.
+
+Sizing trade-off: retaining uncovered entries grows the next prompt by their tokens until an observer pass covers them. The existing `compactAfterTokens` / `trigger` gate still decides when compaction is attempted — it no longer bounds context when retention is active, but the uncovered set is bounded by what arrived since the last successful observation pass, and a deferred compaction writes nothing. Hosts that expose no recall capability pass `compaction: { advertiseRecall: false }` to `createObservationalMemory()` (or `advertiseRecall: false` to `renderObservationalMemory()` / `buildObservationalMemoryContextBlocks()`); an empty pool never advertises recall even with the flag on.
+
 ### Revocation wiring (plan 102 Tasks 2/8)
 
 A revoked source must stop feeding memory on both sides of the write. The two halves share one tombstone set:

package/docs/computer-use-linux.md

@@ -98,7 +98,7 @@ async function installDesktop(hostSkills: { register(skill: Skill): void }, host
 
 ## Extension and configuration notes
 
-- Install and configure the host binary separately: `npm install -g @agent-sh/computer-use-linux` or another host-managed installation. Prism has no runtime dependency on that binary and never downloads it.
+- Install and configure the host binary separately: `bun add -g @agent-sh/computer-use-linux` or another host-managed installation. Prism has no runtime dependency on that binary and never downloads it.
 - The factory exposes unprefixed upstream names. Unknown or future upstream names are omitted until Prism classifies them.
 - `setup_accessibility` and `setup_window_targeting` are host-only and omitted unless `includeSetupTools: true` is explicitly selected. The bundled skill never instructs agent turns to perform setup.
 - `connect` is an injectable bridge factory for fake MCP tests. The package's normal path uses `connectMcpTools` with stdio `{ command, args: ["mcp"] }`.
@@ -118,7 +118,7 @@ A live leg drives the host's real `computer-use-linux` MCP binary over stdio —
 
 ```bash
 PRISM_TEST_COMPUTER_USE=1 PRISM_COMPUTER_USE_BIN="$(command -v computer-use-linux)" \
-  node --test packages/prism-coding-tools/dist/computer-use-linux/__tests__/live.test.js
+  bun test packages/prism-coding-tools/dist/computer-use-linux/__tests__/live.test.js
 ```
 
 Skips (never fails) when the flag, binary path, or a desktop session is unavailable. The suite performs no network I/O, so screenshot bytes cannot leave the process. Registered in `scripts/live-matrix.json` as `coding-tools/computer-use-live`.