@arnilo/prism 0.3.2 → 0.5.0

package/dist/tool-search.js

@@ -0,0 +1,199 @@
+export const SEARCH_TOOLS_TOOL_NAME = "search_tools";
+export const DEFAULT_TOOLS_SEARCH_TOP_K = 16;
+export const HARD_MAX_TOOLS_SEARCH_TOP_K = 64;
+/** Frozen index cap; larger registries fail closed to full disclosure. */
+export const HARD_MAX_TOOLS_INDEX = 1024;
+export const DEFAULT_MAX_TOOLS_SEARCH_QUERY_BYTES = 4_096;
+export const HARD_MAX_TOOLS_SEARCH_QUERY_BYTES = 65_536;
+export const TOOL_DISCLOSURE_ERROR_CODE = "tool_disclosure_exceeded";
+export class ToolDisclosureError extends Error {
+    code = TOOL_DISCLOSURE_ERROR_CODE;
+    constructor(message) {
+        super(message);
+        this.name = "ToolDisclosureError";
+    }
+}
+export function isToolDisclosureError(error) {
+    return error instanceof Error && error.code === TOOL_DISCLOSURE_ERROR_CODE;
+}
+/** Run options win over agent config (mirrors resolveSkillsDisclosure); default "all". */
+export function resolveToolsDisclosure(run, agent) {
+    return run ?? agent ?? "all";
+}
+export function createActiveToolSet() {
+    const names = new Set();
+    return {
+        has(name) {
+            return names.has(name);
+        },
+        add(name) {
+            names.add(name);
+        },
+        list() {
+            return [...names];
+        },
+        clear() {
+            names.clear();
+        },
+    };
+}
+/** Fixed tokenization: lowercase alphanumeric runs. No user-controlled regex anywhere. */
+const WORD_SPLIT = /[^a-z0-9]+/;
+function tokenize(text) {
+    return text
+        .toLowerCase()
+        .split(WORD_SPLIT)
+        .filter((token) => token.length > 0);
+}
+/** ponytail: O(n·d) lexical index, rebuilt on registry change by the caller — embedder-backed
+ *  scoring via the @arnilo/prism-memory/rag seam if accuracy fixtures fall short (plan 041). */
+export function createToolSearchIndex(tools, skip) {
+    if (tools.length > HARD_MAX_TOOLS_INDEX) {
+        throw new ToolDisclosureError(`Tool index exceeds hard cap (${HARD_MAX_TOOLS_INDEX} tools)`);
+    }
+    const postings = new Map();
+    for (const [toolIndex, tool] of tools.entries()) {
+        if (skip?.(tool))
+            continue;
+        // Name tokens weigh ×3 so an exact name match outranks description-only matches.
+        const seen = new Map();
+        for (const term of [...tokenize(tool.name), ...tokenize(tool.name), ...tokenize(tool.name), ...tokenize(tool.description ?? "")]) {
+            seen.set(term, (seen.get(term) ?? 0) + 1);
+        }
+        for (const [term, tf] of seen) {
+            const list = postings.get(term) ?? [];
+            list.push({ toolIndex, tf });
+            postings.set(term, list);
+        }
+    }
+    return { tools, postings };
+}
+/** Bounded lexical scoring: BM25-lite (tf × IDF, registry-derived DF). Ties keep registry order. */
+export function scoreTools(index, query, k, queryByteCap = DEFAULT_MAX_TOOLS_SEARCH_QUERY_BYTES) {
+    const bounded = query.slice(0, Math.trunc(queryByteCap));
+    const terms = tokenize(bounded);
+    if (terms.length === 0 || k <= 0 || index.tools.length === 0)
+        return [];
+    const limit = Math.min(Math.trunc(k), index.tools.length);
+    const total = index.tools.filter((tool) => tool.name !== SEARCH_TOOLS_TOOL_NAME).length;
+    const scores = new Array(index.tools.length).fill(0);
+    const matchedTerms = new Map();
+    for (const term of new Set(terms)) {
+        const list = index.postings.get(term);
+        if (!list)
+            continue;
+        const idf = 1 + Math.log(total / list.length);
+        for (const entry of list) {
+            scores[entry.toolIndex] += entry.tf * idf;
+            const names = matchedTerms.get(entry.toolIndex) ?? [];
+            if (names.length < 8)
+                names.push(term);
+            matchedTerms.set(entry.toolIndex, names);
+        }
+    }
+    const ranked = scores
+        .map((score, toolIndex) => ({ score, toolIndex }))
+        .filter((entry) => entry.score > 0)
+        .sort((a, b) => b.score - a.score || a.toolIndex - b.toolIndex)
+        .slice(0, limit);
+    return ranked.map(({ toolIndex }) => ({
+        name: index.tools[toolIndex].name,
+        description: index.tools[toolIndex].description,
+        matched: matchedTerms.get(toolIndex) ?? [],
+    }));
+}
+export function createToolSearchState(options) {
+    const requested = options.search?.topK;
+    const topK = requested === undefined ? DEFAULT_TOOLS_SEARCH_TOP_K : Math.min(Math.max(1, Math.trunc(requested)), HARD_MAX_TOOLS_SEARCH_TOP_K);
+    // ponytail: index built once per run; mid-run registry mutation is not observed — rebuild by starting a new run.
+    const index = createToolSearchIndex(options.tools, (tool) => tool.name === SEARCH_TOOLS_TOOL_NAME);
+    return { index, activated: options.activated, topK };
+}
+/** Provider-facing narrowing: activated tools ∪ top-k for the turn. Fails closed — any
+ *  scoring/index error discloses the full input list (never zero, never wider than input). */
+export function selectDisclosedTools(options) {
+    if (options.tools.length === 0)
+        return options.tools;
+    try {
+        const keep = new Set();
+        for (const tool of options.tools)
+            if (tool.name === SEARCH_TOOLS_TOOL_NAME || options.activated?.has(tool.name) === true)
+                keep.add(tool.name);
+        const index = createToolSearchIndex(options.tools, (tool) => tool.name === SEARCH_TOOLS_TOOL_NAME);
+        const topK = Math.min(Math.max(1, Math.trunc(options.search?.topK ?? DEFAULT_TOOLS_SEARCH_TOP_K)), HARD_MAX_TOOLS_SEARCH_TOP_K);
+        for (const match of scoreTools(index, inputText(options.input), topK, options.queryByteCap ?? DEFAULT_MAX_TOOLS_SEARCH_QUERY_BYTES))
+            keep.add(match.name);
+        const disclosed = options.tools.filter((tool) => keep.has(tool.name));
+        if (disclosed.length > 0)
+            return disclosed;
+        // Nothing scored or activated and no always-on tools in the list: bounded deterministic
+        // prefix instead of zero tools (the wired session always keeps `search_tools`, so the
+        // un-wired caller is the only one that reaches this).
+        return options.tools.slice(0, Math.min(Math.max(1, Math.trunc(options.search?.topK ?? DEFAULT_TOOLS_SEARCH_TOP_K)) + 1, options.tools.length));
+    }
+    catch {
+        return options.tools;
+    }
+}
+function inputText(input) {
+    if (typeof input === "string")
+        return input;
+    const messages = input === null || input === undefined || Array.isArray(input) === false ? [input] : input;
+    let text = "";
+    for (const message of messages) {
+        for (const block of message.content) {
+            if (block.type === "text") {
+                text += `${block.text}\n`;
+                if (text.length > HARD_MAX_TOOLS_SEARCH_QUERY_BYTES)
+                    return text;
+            }
+        }
+    }
+    return text;
+}
+/** Model-facing activation tool, generated only in search mode. Results are inert
+ *  name+description lines — no schemas or bodies — and activation re-checks allow/deny
+ *  at dispatch time (blocked-reason matrix unchanged). */
+export function createSearchToolsTool(state, queryByteCap = DEFAULT_MAX_TOOLS_SEARCH_QUERY_BYTES) {
+    return {
+        name: SEARCH_TOOLS_TOOL_NAME,
+        description: `Search available tools by relevance. Returns up to k tool names with short descriptions and marks them active so their full definitions appear on the next turn. Try queries made of tool keywords.`,
+        parameters: {
+            type: "object",
+            properties: { query: { type: "string" }, k: { type: "integer", minimum: 1 } },
+            required: ["query"],
+        },
+        execute(args, context) {
+            const fail = (message) => ({
+                toolCallId: context.toolCallId,
+                name: SEARCH_TOOLS_TOOL_NAME,
+                error: { code: "ERR_PRISM_TOOL_SEARCH_INVALID", message },
+            });
+            if (typeof args.query !== "string" || args.query.trim().length === 0)
+                return fail("query must be a non-empty string");
+            if (Buffer.byteLength(args.query, "utf8") > HARD_MAX_TOOLS_SEARCH_QUERY_BYTES)
+                return fail(`query exceeds ${HARD_MAX_TOOLS_SEARCH_QUERY_BYTES} bytes`);
+            const k = args.k === undefined ? state.topK : typeof args.k === "number" && Number.isInteger(args.k) ? args.k : NaN;
+            if (Number.isNaN(k) || k < 1)
+                return fail("k must be an integer >= 1");
+            const matches = scoreTools(state.index, args.query, k, queryByteCap);
+            for (const match of matches)
+                state.activated.add(match.name);
+            return {
+                toolCallId: context.toolCallId,
+                name: SEARCH_TOOLS_TOOL_NAME,
+                content: [
+                    {
+                        type: "text",
+                        text: matches.length === 0
+                            ? `No tools matched ${JSON.stringify(args.query.slice(0, 64))}. Try different keywords.`
+                            : matches
+                                .map((match) => `- ${match.name}${match.description ? `: ${match.description.slice(0, 512)}` : ""} [matched: ${match.matched.join(", ")}]`)
+                                .join("\n"),
+                    },
+                ],
+            };
+        },
+    };
+}
+//# sourceMappingURL=tool-search.js.map

package/docs/0.1.0-readiness.md

@@ -1,6 +1,6 @@
 # 0.1.0 / 1.0 Readiness Gates
 
-Status: **0.3.0** is the current release line (the final 0.3.x lockstep cut: Linux desktop wrapper, coding/ACP closeouts, and independent package versions with Decision B `^0.3.0` ranges); **0.1.7** was the terminal 0.1.x baseline; **1.0** readiness remains operator-gated, not automatic.
+Status: **0.5.0** is the current release line (dead-export removal cut: 10 active packages, family subpaths, `^0.5.0` peers); **0.3.3** was the terminal 0.3.x cut; **0.1.7** was the terminal 0.1.x baseline; **1.0** readiness remains operator-gated, not automatic.
 
 This page distills runnable readiness gates into one command-per-gate table.
 The **Last evidence** column records the 0.1.0-tree snapshot (plan 012 Tasks
@@ -20,7 +20,7 @@ Historical release lines (0.0.16 floor → 0.0.27 Phase 10 ACP interop → 0.1.0
 keep their per-phase evidence in the pages above; this page records the 0.2.6
 snapshot (plan 026) with the 0.1.x tables below as the historical record.
 
-## Current line (0.3.2)
+## Current line (0.5.0)
 
 | Item | Status |
 |---|---|
@@ -66,7 +66,7 @@ snapshot (plan 026) with the 0.1.x tables below as the historical record.
 | Publish order + tarball validation | `node scripts/release.mjs publish --version 0.1.0 --dry-run --allow-dirty --allow-untagged` | 49/49 packages `dry-run` twice with byte-identical reports, deterministic dependency order, no failures (Task 7) | Operator (dry-run), CI |
 | Node 20 compatibility | CI `node20-compat` (build + public-import smoke) | all 21 root exports import cleanly on Node 20.20.2 | CI |
 | PostgreSQL suite | `PRISM_TEST_POSTGRES_URL="$DATABASE_URL" npm run test:postgres` | 0.1.0: Phase 7 conformance + Phase 12 restart-recovery + 74 workspace checks green against PostgreSQL 16 (Task 4 recording, re-run green at 0.1.0 on 2026-08-09); operator-gated | Operator |
-| Keychain suite | `PRISM_TEST_KEYCHAIN=1 npm test --workspace @arnilo/prism-credentials-node` (protected) | 28/28 green incl. native keychain round-trip against the OS secret-service backend (gnome-keyring, 2026-08-09) | Operator host |
+| Keychain suite | `PRISM_TEST_KEYCHAIN=1 npm test --workspace @arnilo/prism-core/credentials/node` (protected) | 28/28 green incl. native keychain round-trip against the OS secret-service backend (gnome-keyring, 2026-08-09) | Operator host |
 | Live-provider suites | `npm run test:live` (protected) | **operator-gated** (requires credentials; `live-canaries.yml` blocked gate, `canary-report.json` retained) | Operator |
 | SAST | GitHub CodeQL | **operator-gated** (runs in CI workflow) | CI |
 | Signed, provenance publication | `npm run release:publish` (clean tagged tree, OIDC) | **operator-gated** (see "Remaining for 1.0") | Operator |

package/docs/a2a.md

@@ -2,7 +2,7 @@
 
 ## What it does
 
-`@arnilo/prism-supervisor` implements bounded A2A 1.0 over the JSON-RPC/HTTPS binding. Supported operations: `SendMessage`, `SendStreamingMessage`, `GetTask`, `ListTasks`, `CancelTask`, `SubscribeToTask`, push-notification-config create/get/list/delete, and `GetExtendedAgentCard`. `client.streamMessage()` additionally exposes verified rich task/message events for frontend adapters while legacy `stream()` remains text-compatible. Agent Cards retain explicit ES256 verification. gRPC, HTTP+JSON, discovery registries, automatic JWK/OAuth fetching, and an internal task worker/store are absent.
+`@arnilo/prism-core/runtime/supervisor` implements bounded A2A 1.0 over the JSON-RPC/HTTPS binding. Supported operations: `SendMessage`, `SendStreamingMessage`, `GetTask`, `ListTasks`, `CancelTask`, `SubscribeToTask`, push-notification-config create/get/list/delete, and `GetExtendedAgentCard`. `client.streamMessage()` additionally exposes verified rich task/message events for frontend adapters while legacy `stream()` remains text-compatible. Agent Cards retain explicit ES256 verification. gRPC, HTTP+JSON, discovery registries, automatic JWK/OAuth fetching, and an internal task worker/store are absent.
 
 ## When to use it
 
@@ -41,7 +41,7 @@ Parts, messages, artifacts, histories, metadata, and aggregate responses are unt
 
 ## AG-UI server-side exposure (Task 13, 0.0.26)
 
-`createAgUiA2AServer()` in `@arnilo/prism-ag-ui` fronts one host-selected **local AG-UI agent** as an A2A 1.0 server, the reverse direction of `createAgUiA2AAdapter()`: remote A2A clients start and stream local runs through the same AG-UI input allow-list and event mapper as the AG-UI SSE path (same projection, redaction, and byte caps). It reuses this package's `createA2AHandler` transport/lifecycle; it creates no second runtime, task store, or worker. Requires the optional `@arnilo/prism-supervisor` peer (imported lazily; plain `@arnilo/prism-ag-ui` imports keep working without it).
+`createAgUiA2AServer()` in `@arnilo/prism-ag-ui` fronts one host-selected **local AG-UI agent** as an A2A 1.0 server, the reverse direction of `createAgUiA2AAdapter()`: remote A2A clients start and stream local runs through the same AG-UI input allow-list and event mapper as the AG-UI SSE path (same projection, redaction, and byte caps). It reuses this package's `createA2AHandler` transport/lifecycle; it creates no second runtime, task store, or worker. Requires the optional `@arnilo/prism-core/runtime/supervisor` peer (imported lazily; plain `@arnilo/prism-ag-ui` imports keep working without it).
 
 ```ts
 import { createAgentEventSourceAgUiReplay, createAgUiA2AServer } from "@arnilo/prism-ag-ui";

package/docs/acp-agent.md

@@ -56,7 +56,7 @@ The binary is pure wiring (~200 lines) — no protocol code lives here. It build
 
 ```ts
 import { createSpawnableAgent, loadConfig } from "@arnilo/prism-acp-agent";
-import { createOpenAIResponsesProvider } from "@arnilo/prism-provider-openai";
+import { createOpenAIResponsesProvider } from "@arnilo/prism-providers/openai";
 
 const agent = createSpawnableAgent({
   config: loadConfig("prism-acp-agent.json"),

package/docs/acp.md

@@ -112,7 +112,7 @@ const agent = createPrismAcpAgent({
 
 - **Seam = capability.** Wiring `sessions.load` advertises `loadSession`; removing it withdraws the method. There is no separate capability flag to keep in sync — the freeze manifest's advertise-when matrix is enforced by construction and asserted by `scripts/phase10-conformance.test.mjs`.
 - **Transcript replay (F2).** When `sessions.transcript` is wired, `session/load` and `session/resume` replay `user_message_chunk`/`agent_message_chunk` text chunks (from `SessionEntry`s with `kind: "message"` and a user/assistant role, text blocks only) before returning `sessionState`. Each chunk passes the shared redactor and is truncated at `maxTextBytes`; replay stops at `maxReplayEvents` chunks and counts against the stream event/byte caps (an oversized transcript fails the load/resume request closed). Absent seam = no replay, behavior unchanged.
-- **Client fs/terminal are adapters, not a second implementation.** `AcpClientFilesystem` / `AcpClientTerminals` wrap the client's `fs/*` and `terminal/*` methods behind the Phase 9 `ProcessSession`-flavored interfaces; the agent pre-generates the session id so terminal requests can carry it. `createAcpFilesystemOperations` from `@arnilo/prism-coding-agent` maps that filesystem seam onto the coding tools' `read`/`write`/`edit` operations. This editor-buffer mode is intentionally hybrid: `repo_list`, `repo_search`, `glob`, `delete`, and `move` remain disk-backed unless the host supplies separate operations; binary/image/document handling never falls back to local disk. Host repo operations remain default when the client fs is absent.
+- **Client fs/terminal are adapters, not a second implementation.** `AcpClientFilesystem` / `AcpClientTerminals` wrap the client's `fs/*` and `terminal/*` methods behind the Phase 9 `ProcessSession`-flavored interfaces; the agent pre-generates the session id so terminal requests can carry it. `createAcpFilesystemOperations` from `@arnilo/prism-coding-tools/agent` maps that filesystem seam onto the coding tools' `read`/`write`/`edit` operations. This editor-buffer mode is intentionally hybrid: `repo_list`, `repo_search`, `glob`, `delete`, and `move` remain disk-backed unless the host supplies separate operations; binary/image/document handling never falls back to local disk. Host repo operations remain default when the client fs is absent.
 - **Spawnable ACP coding registry (Task 6).** `@arnilo/prism-acp-agent` wires `createAcpClientFilesystem` and creates a separate coding tool registry per ACP session when the client advertises `fs/read_text_file` or `fs/write_text_file`. That session's `read`/`write`/`edit` operations use editor buffers; without fs advertisement, the existing disk registry is used. `shell`, repository search/list/glob, `delete`, and `move` remain disk-backed in this hybrid mode. Durable approvals resolve the same per-session agent, so one session cannot resume through another session's buffer adapter.
 - **Modes and config options are a pure host overlay.** The agent stores only a thin per-session registry; `apply`/`onChange` hooks narrow the host's own behavior. Mode switches can narrow or host-authorized widen — never a parallel policy evaluator, never a client-enabled tool.
 - **Lifecycle wiring.** Pass your `createCodingLifecycleEmitter()` as `coding.lifecycle`; `file_changed` etc. then flow to streaming sessions. `configuration_changed` broadcasts `config_option_update` (agent-message fallback if the SDK rejects the kind).
@@ -152,14 +152,14 @@ const agent = createPrismAcpAgent({
 - **Deny-closed by default.** Unknown mode ids, unadvertised methods, unprojected lifecycle events, oversize diffs/locations/media, thrown projection hooks, and failed elicitation all fail closed. Raw tool arguments/results are never sent unless a projection allow-list says otherwise.
 - **Slash commands (F9).** `commands.list` is a host-owned slash-command list (not derived from the tool registry). The agent emits `available_commands_update` on session start (`session/new`, `session/load`, `session/resume`). Mid-session refresh is not in this release — re-list by starting a session. Names, descriptions, and input hints pass the shared redactor; the list is sliced at `acpCommandsPerUpdate`. Absent seam or a thrown list ⇒ no update.
 - **Projected images (F8).** `AgUiProjection.toolResult` may return `{ type: "image", data, mimeType }` (return-type widening — existing string returns stay valid). The mapper emits `{ type: "content", content: { type: "image", data, mimeType } }` (SDK v1 `ToolCallContent` has no top-level image variant). `data` is the host-supplied base64; it is not redacted and not truncated — payloads over `acpImageBytes` are dropped. Default (no hook / non-image return) emits no image.
-- **Coding-tool projection (F7).** `createCodingToolProjection({ maxDiffBytes? })` is an opt-in `AgUiProjection` for first-party `@arnilo/prism-coding-agent` results: `edit` → `toolDiff` (`path` + unified `patch` as `newText`) and `toolLocations` (`path` + `firstChangedLine`); `write` and `delete` → `toolLocations` (`path` only); `move` → destination `toolLocations` (`metadata.to`, with `from` fallback). No delete/move diff is fabricated. Pass as `projection: createCodingToolProjection()` on the agent/mapper. Mapper still redacts and enforces `acpDiffBytes` / `acpLocationsPerUpdate`; optional `maxDiffBytes` pre-truncates the patch so a slightly-oversize edit is shortened instead of dropped. Without the factory, behavior is unchanged (deny-by-default).
+- **Coding-tool projection (F7).** `createCodingToolProjection({ maxDiffBytes? })` is an opt-in `AgUiProjection` for first-party `@arnilo/prism-coding-tools/agent` results: `edit` → `toolDiff` (`path` + unified `patch` as `newText`) and `toolLocations` (`path` + `firstChangedLine`); `write` and `delete` → `toolLocations` (`path` only); `move` → destination `toolLocations` (`metadata.to`, with `from` fallback). No delete/move diff is fabricated. Pass as `projection: createCodingToolProjection()` on the agent/mapper. Mapper still redacts and enforces `acpDiffBytes` / `acpLocationsPerUpdate`; optional `maxDiffBytes` pre-truncates the patch so a slightly-oversize edit is shortened instead of dropped. Without the factory, behavior is unchanged (deny-by-default).
 - **No secrets.** Updates carry no raw file bodies, terminal output is capped by the Phase 9 chunk budget, and the shared redactor is applied before anything leaves the host. `permission_denied` never includes raw args.
 - **Performance.** The adapter is O(1) per update with no unbounded buffering; p95 targets (fs round trip 250 ms, mode switch 250 ms, terminal chunk ack 1000 ms, prompt first update 2000 ms, prompt end 30 s) are recorded by `scripts/benchmark-0.0.27.mjs` and gated in `scripts/budgets.json` `phase10`.
 
 ## Related APIs
 
 - [AG-UI](ag-ui.md): sibling frontend protocol; shared projection/redaction/caps and the same pending-decision model. This page is the full ACP reference.
-- [Coding agent tools](coding-agent-tools.md): the `CodingLifecycleEvent` source mapped here; `@arnilo/prism-coding-agent` `process.outputChunkBytes` caps terminal chunks.
+- [Coding agent tools](coding-agent-tools.md): the `CodingLifecycleEvent` source mapped here; `@arnilo/prism-coding-tools/agent` `process.outputChunkBytes` caps terminal chunks.
 - [Agent events](agent-events.md): the durable `AgentEventSource`/replay story behind `session/load` and `session/resume`.
 - [Host security guide](host-security.md): fail-closed checklist rows for ACP boundaries (authorize, ownership, redaction, untrusted MCP).
 - [Migration guide](migration.md): 0.0.26 → 0.0.27 advertise/surface changes for hosts that parsed the old `initialize`.

package/docs/ag-ui-adoption.md

@@ -2,7 +2,7 @@
 
 ## What it does
 
-This page records Prism's compatibility review against official AG-UI `@ag-ui/core` **0.0.57** and the official repository at commit [`a40b5c0`](https://github.com/ag-ui-protocol/ag-ui/commit/a40b5c0824564eb2f9ab9edf2be43f355f42a3b8). It separates shipped transport/replay support from remaining work needed to claim full AG-UI support, including AG-UI fronting MCP and A2A agents.
+This page records Prism's compatibility review against official AG-UI `@ag-ui/core` **0.0.59** and the official repository at commit [`a40b5c0`](https://github.com/ag-ui-protocol/ag-ui/commit/a40b5c0824564eb2f9ab9edf2be43f355f42a3b8). It separates shipped transport/replay support from remaining work needed to claim full AG-UI support, including AG-UI fronting MCP and A2A agents.
 
 Official material reviewed:
 

package/docs/ag-ui.md

@@ -4,7 +4,7 @@
 
 `@arnilo/prism-ag-ui` is an optional, framework-free protocol adapter over Prism's existing redacted `AgentEvent`, session, durable-run, and persistence seams.
 
-- Root export maps Prism events to AG-UI `@ag-ui/core` **0.0.57** events and offers `createAgUiHandler()` (`Request` → SSE `Response`), compatible `createPersistenceAgUiReplay()` pages, distributed `createAgentEventSourceAgUiReplay()` follow, and explicit `createAgUiMcpAdapter()` / `createAgUiMcpAppHandler()` / `createAgUiA2AAdapter()` protocol handshakes.
+- Root export maps Prism events to AG-UI `@ag-ui/core` **0.0.59** events and offers `createAgUiHandler()` (`Request` → SSE `Response`), compatible `createPersistenceAgUiReplay()` pages, distributed `createAgentEventSourceAgUiReplay()` follow, and explicit `createAgUiMcpAdapter()` / `createAgUiMcpAppHandler()` / `createAgUiA2AAdapter()` protocol handshakes.
 - `@arnilo/prism-ag-ui/acp` is the stable ACP **v1** sibling: `createAcpEventMapper()` and `createPrismAcpAgent()` over `@agentclientprotocol/sdk` **1.3.0** root exports. ACP is a protocol adapter — sessions, modes, MCP, fs/terminal, lifecycle mapping, and caps live on the host seams. See [ACP coding-host interop](acp.md) for the full reference; this page covers AG-UI only.
 - Core remains protocol-free. `resumeAgentRunStream()` / `AgentRunLifecycle.resumeStream()` are generic durable-resume streams shared by adapters.
 
@@ -225,5 +225,4 @@ Defaults / hard caps: request 64 KiB / 1 MiB; input 128 / 1024 messages, 32 / 25
 - [MCP bridge/server](mcp-tools.md): `mcpApps` negotiation, bounded resources, and remote tool trust.
 - [A2A interoperability](a2a.md): verified rich task client and remote task lifecycle.
 - [Host security guide](host-security.md): authorization, ownership, redaction, and credential boundaries.
-- [Antigravity delegated agent](antigravity-agent.md): delegated Antigravity CLI execution with timeline step projection.
 - [Work artifacts and review](work-artifacts-and-review.md): durable artifact service that produces the co-work approval/progress/download-link events projected here.

package/docs/agent-definitions.md

@@ -224,7 +224,7 @@ Use `activateAllCapabilities: true` only while migrating old configs. It intenti
 - `ExtensionAPI.registerAgent(agent)` contributes an inert `AgentDefinition` programmatically; its `create()` (if present) is only invoked when the host runs it through `resolveAgentDefinition`. See [Extensions](extensions.md).
 - Bundle resolution is config over code: every seam lives on `AgentDefinition`, `AgentDefinitionResolutionContext`, or `ResolveAgentBundleOptions`. `systemPrompt` and `loop` are passed via `context.overrides` / `create()` rather than frontmatter.
 - Migration note: before Phase 38, a definition that omitted `tools` but had a tool scope could receive every scoped tool. Now omitted `tools`/`skills` activates none. Add explicit names to `tools` / `skills`; use `activateAllCapabilities: true` only while migrating old configs.
-- `parseAgentFile(text, path)` (re-exported from `@arnilo/prism`) is the stdlib-only frontmatter parser for `AGENT.md`. `parseContextFile` and `parseToolFile` parse colocated `CONTEXT.md` / tool descriptors inside the Node subpath.
+- `parseAgentFile(text, path)` (re-exported from `@arnilo/prism`) is the stdlib-only frontmatter parser for `AGENT.md`. Colocated `CONTEXT.md` / tool-descriptor parsing is host-owned (the thin `parseContextFile`/`parseToolFile` helpers were removed in 0.5.0 — see `docs/migrate-to-0.5.md`).
 - Repo contributions (`<workspaceRoot>/.agents/{skills,tools}/`) are scanned by `discoverContributions` and passed via `repoContributions`. Repo `.agents/` is preserved as a shared contribution surface across every agent that operates on the same repository; multiple agents from different apps can work the same repo, and all share its repo-level skills.
 
 ## Security and performance notes

package/docs/agent-events.md

@@ -24,10 +24,10 @@ Event records preserve emission order within a run because the runtime drains pe
 
 ### Placement (FR-7 answer, 0.0.26)
 
-The durable `AgentEventSource` **stays in `@arnilo/prism-session-store-postgres`** for the 0.0.26 line and is importable from the package root (FR-6):
+The durable `AgentEventSource` **stays in `@arnilo/prism-core/sessions/postgres`** for the 0.0.26 line and is importable from the package root (FR-6):
 
 ```ts
-import { createPostgresAgentEventSource } from "@arnilo/prism-session-store-postgres";
+import { createPostgresAgentEventSource } from "@arnilo/prism-core/sessions/postgres";
 const source = createPostgresAgentEventSource({ pool, schema: "prism", cursorSecret });
 ```
 
@@ -35,11 +35,11 @@ PostgreSQL `LISTEN`/`NOTIFY` remains the **reference durable implementation**; `
 
 ### NATS JetStream adapter (FR-5)
 
-`@arnilo/prism-session-store-nats` ships a sibling durable `AgentEventSource` over NATS JetStream for JetStream backbones (Postgres remains the reference implementation):
+`@arnilo/prism-core/sessions/nats` ships a sibling durable `AgentEventSource` over NATS JetStream for JetStream backbones (Postgres remains the reference implementation):
 
 ```ts
 import { connect } from "@nats-io/transport-node";
-import { createNatsAgentEventSource, createNatsJetStream } from "@arnilo/prism-session-store-nats";
+import { createNatsAgentEventSource, createNatsJetStream } from "@arnilo/prism-core/sessions/nats";
 
 const nc = await connect({ servers: process.env.NATS_URL });
 const source = createNatsAgentEventSource({ connection: await createNatsJetStream(nc), stream: "prism_agent_events" });
@@ -249,4 +249,4 @@ for await (const event of session.stream("draft", { loop: { strategy: "generate-
 - [Observability](observability.md): `ProviderTurnMetadata`; optional adapter builds one parented GenAI span tree from metadata-only lifecycle events and ignores message/progress deltas.
 - [Tools](tools.md): `tool_execution_*` variants.
 - [Compaction and retry policies](compaction-and-retry.md): `compaction_*` and `retry_scheduled` variants.
-- [Frontend interoperability (AG-UI and ACP)](ag-ui.md): optional redacted mapping of this stream; durable replay is ledger-backed and at-least-once, never a live-subscriber substitute. [ACP coding-host interop](acp.md) additionally maps `CodingLifecycleEvent`s from `@arnilo/prism-coding-agent` (`file_changed`, `worktree_changed`, `permission_denied`, `configuration_changed`, `plan_changed`, `plan_removed`; process events reuse `CodingProcessEvent`) into ACP session updates — locations/diff blocks only through projection allow-lists, terminal chunks under `process.outputChunkBytes`, plan updates only to clients that advertised the UNSTABLE `plan` capability.
+- [Frontend interoperability (AG-UI and ACP)](ag-ui.md): optional redacted mapping of this stream; durable replay is ledger-backed and at-least-once, never a live-subscriber substitute. [ACP coding-host interop](acp.md) additionally maps `CodingLifecycleEvent`s from `@arnilo/prism-coding-tools/agent` (`file_changed`, `worktree_changed`, `permission_denied`, `configuration_changed`, `plan_changed`, `plan_removed`; process events reuse `CodingProcessEvent`) into ACP session updates — locations/diff blocks only through projection allow-lists, terminal chunks under `process.outputChunkBytes`, plan updates only to clients that advertised the UNSTABLE `plan` capability.

package/docs/agent-identity.md

@@ -87,7 +87,7 @@ await agent.createSession().run("Summarize inbox", {
 
 Server / MCP / A2A authorize callbacks may include the same `identity` beside `ownership`. Handlers assert activity and ownership match before admitting work.
 
-## OIDC/JWKS verifier adapter (`@arnilo/prism-credentials-node/oidc`)
+## OIDC/JWKS verifier adapter (`@arnilo/prism-core/credentials/node/oidc`)
 
 Optional `createOidcIdentityVerifier` turns a pinned issuer/audience and pinned JWKS URL into a core `IdentityVerifier` — one bounded reference adapter for hosts that already authenticate callers with OIDC JWTs (Entra, Keycloak, Auth0, …). Native `fetch` + WebCrypto only; no JOSE dependency.
 
@@ -102,7 +102,7 @@ Optional `createOidcIdentityVerifier` turns a pinned issuer/audience and pinned
 | `limits` | Bounded JWKS/claims knobs; `identity` reuses core identity caps |
 
 ```ts
-import { createOidcIdentityVerifier } from "@arnilo/prism-credentials-node/oidc";
+import { createOidcIdentityVerifier } from "@arnilo/prism-core/credentials/node/oidc";
 
 const verifier = createOidcIdentityVerifier({
   issuer: "https://id.example.com/tenant",
@@ -132,6 +132,17 @@ Identity is optional. Hosts that only set `ownership` keep prior behavior. When
 - Checks are O(fields) and network-free in core; remote auth stays in the host verifier.
 - Raising hard caps requires updating `docs/_evidence/review-coverage-2026-07-23-phase-8.md`, tests, and docs.
 
+## Live probe (plans/064 Task 9)
+
+The OIDC/JWKS identity verifier has an operator-gated live probe against a real issuer:
+
+```bash
+PRISM_TEST_OIDC_ISSUER=https://id.example.com/tenant PRISM_TEST_OIDC_AUDIENCE=prism-api \
+PRISM_TEST_OIDC_TOKEN=<real bearer token> npm test -w @arnilo/prism-core -- oidc-live
+```
+
+Set `PRISM_TEST_OIDC_JWKS_URL` to pin a non-default JWKS URL (default `<issuer>/.well-known/jwks.json`). Probes: a valid token verifies against the live JWKS (1 fetch), a tampered token fails closed with `ERR_PRISM_OIDC_SIGNATURE` (error text never echoes the token), and a garbage token fails closed without JWKS traffic. Bounded to 1 real request. Registered in `scripts/live-matrix.json` as `core/oidc-live`.
+
 ## Related APIs
 
 - [Policy and audit](policy-and-audit.md)

package/docs/audit-export.md

@@ -2,7 +2,7 @@
 
 ## What it does
 
-`@arnilo/prism-policy` exports tenant-scoped audit records as signed, hash-chained
+`@arnilo/prism-core/governance/policy` exports tenant-scoped audit records as signed, hash-chained
 batches: each record envelope is canonicalized (RFC 8785 semantics), hashed with
 SHA-256 including the prior digest, so records form a tamper-evident chain. A
 batch of chained records is wrapped in a manifest that a host-provided
@@ -69,7 +69,7 @@ canonical `record` payload. `verifyAuditBatch` returns `{ ok, errors, batch }`.
 ## Request/response example
 
 ```ts
-import { createAuditExporter, createMemoryAuditCursorStore } from "@arnilo/prism-policy";
+import { createAuditExporter, createMemoryAuditCursorStore } from "@arnilo/prism-core/governance/policy";
 
 const exporter = createAuditExporter({
   source,                                 // host: tenant-scoped record pages
@@ -87,7 +87,7 @@ const result = await exporter.exportNext({ tenantId: "acme", maxRecords: 1000 })
 
 ```ts
 import { readFileSync } from "node:fs";
-import { verifyAuditBatch } from "@arnilo/prism-policy";
+import { verifyAuditBatch } from "@arnilo/prism-core/governance/policy";
 
 const artifactBytes = new Uint8Array(readFileSync("./acme-000001.json"));
 const verified = verifyAuditBatch({

package/docs/batch-jobs.md

@@ -0,0 +1,120 @@
+# Batch jobs
+
+## What it does
+
+`BatchJobsProvider` is the provider-neutral async batch contract (plan 061
+Task 7): `submit` (requests + metadata → opaque job id), `status`, `cancel`, and
+paged `results`, with a typed job-state union and a `pollBatch` backoff utility
+exported standalone — core never loops or awaits completion for you. The
+first-party adapter is [`createOpenAIBatchJobsProvider`](providers/openai.md)
+(Files API JSONL upload + `/v1/batches` lifecycle). Offline conformance runs via
+`runBatchJobsConformance` from `@arnilo/prism/testing/provider-conformance`.
+
+## When to use it
+
+Use it for large asynchronous workloads that tolerate 24-hour completion
+windows — offline scoring, backfills, bulk classification. Do not use it as a
+scheduler or an orchestration saga: the contract is standalone by decision
+(integration with the workflows saga is deferred — see plan 061 Further
+Actions). Interactive low-latency requests belong on the normal provider path.
+
+## Inputs / request
+
+| Call | Inputs | Meaning |
+| --- | --- | --- |
+| `submit` | `{ model, requests, metadata? }` | `requests` are provider-native `{ customId?, body: JsonObject }` items; bodies are opaque to the contract and inherit provider caps. |
+| `status` | opaque job id | Current `BatchJob` snapshot (state union + provider counts + `raw`). |
+| `cancel` | opaque job id | Best-effort cancellation; returns the transitioning job (`cancelling`). |
+| `results` | job id + `{ cursor?, pageSize? }` | Page of per-request outcomes; cursor is an opaque continuation token. |
+| `pollBatch` | provider + job id + `{ intervalMs?, backoffMultiplier?, maxIntervalMs?, maxAttempts? }` | Utility only — resolves on `completed`, throws typed on `failed`/`cancelled`/`expired`. |
+
+Adapter options: `apiKey` (`CredentialValueSource` — resolved per call,
+redacted from errors), `baseUrl`, `fetch` (fake transport for offline tests),
+`headers`, `endpoint` (defaults to `/v1/chat/completions`),
+`completionWindow` (defaults `24h`).
+
+## Outputs / response / events
+
+| Field | Type | Meaning |
+| --- | --- | --- |
+| `job.state` | `"queued" \| "running" \| "cancelling" \| "completed" \| "failed" \| "cancelled" \| "expired"` | Neutral union; adapters map provider states (OpenAI `validating`→`queued`, `in_progress`/`finalizing`→`running`, …). `isBatchJobTerminal` classifies. |
+| `job.id` | `string` | Opaque provider id — the contract never parses or scopes it. |
+| `job.requestCounts` | `{ total, completed, failed }?` | Provider progress counts. |
+| `job.raw` | `JsonObject?` | Provider-native job fields, unmodified, for audits. |
+| `result.items[n]` | `{ customId, response?, error?, raw? }` | Per-request outcome; per-item failures ride alongside a `completed` job. |
+
+Failures throw `BatchJobsError` with a stable `code`: `empty_requests`,
+`too_many_requests` (adapter cap `OPENAI_BATCH_MAX_REQUESTS` = 50,000, OpenAI's
+documented limit), `unsupported_model` (via `assertBatchJobsSupported` when the
+host checks `ModelCapabilities.batchJobs`), `job_not_found`, `invalid_cursor`,
+`request_failed` (non-2xx, secret-redacted), `response_malformed`, and — from
+`pollBatch` on terminal states — `job_failed`, `job_cancelled`, `job_expired`.
+
+## Request/response example
+
+```json
+{ "input_file_id": "file-X123", "endpoint": "/v1/chat/completions", "completion_window": "24h" }
+```
+
+## Implementation example
+
+```ts
+import { createOpenAIBatchJobsProvider } from "@arnilo/prism-providers/openai";
+import { pollBatch, runBatchJobsConformance } from "@arnilo/prism";
+import { runBatchJobsConformance } from "@arnilo/prism/testing/provider-conformance";
+
+const batch = createOpenAIBatchJobsProvider({ apiKey: process.env.OPENAI_API_KEY });
+const job = await batch.submit({
+  model: "gpt-4o-mini",
+  requests: [{ customId: "doc-1", body: { messages: [{ role: "user", content: "summarize" }] } }],
+});
+// pollBatch is a plain utility — host owns scheduling and persistence:
+const done = await pollBatch(batch, job.id, { intervalMs: 30_000, backoffMultiplier: 1.5, maxIntervalMs: 300_000 });
+let cursor: string | null | undefined = null;
+do {
+  const page = await batch.results(done.id, { cursor });
+  for (const item of page.items) { /* host owns per-item handling */ }
+  cursor = page.nextCursor ?? null;
+} while (cursor !== null);
+
+// Offline conformance (fake transport, no network):
+await runBatchJobsConformance({
+  provider: createOpenAIBatchJobsProvider({ apiKey: "sk-test", fetch: fakeFetch }),
+  maxRequests: 50_000,
+  sample: { model: "gpt-4o-mini", requests: [{ body: { messages: [] } }] },
+});
+```
+
+## Extension and configuration notes
+
+- Implement `BatchJobsProvider` for other vendors; the contract is structural —
+  no base class, no registry. Map your provider's states onto the neutral union
+  and surface your raw job payload on `job.raw`.
+- Models declare support with `capabilities.batchJobs`; hosts gate with
+  `modelSupportsBatchJobs` / `assertBatchJobsSupported`, mirroring the
+  embeddings/speech/image/video/moderation guard pattern.
+- Workflow-saga integration (auto-submission from run failure recovery) is
+  intentionally out of scope for v1 — see plan 061 Further Actions.
+
+## Security and performance notes
+
+- Job ids are opaque strings; results cursors are opaque continuation tokens
+  (adapter: line offsets — never parsed as authorization).
+- API keys resolve through the existing `CredentialValueSource` seam and are
+  redacted from every thrown error; no new secret paths.
+- All responses read through the bounded readers
+  (`OPENAI_BATCH_MAX_RESPONSE_BYTES`, 256 MiB for JSONL downloads — batches are
+  large by design); oversized payloads reject instead of buffering.
+- One provider request per call; paging is client-side over the downloaded
+  output/error file — no network per page boundary.
+- Inputs, payloads, and raw files are never logged by core; error messages
+  carry status and a redacted body only.
+
+## Related APIs
+
+- [Provider conformance](provider-conformance.md): `runBatchJobsConformance`
+  and the offline conformance matrix.
+- [Provider packages](provider-packages.md): subpath import rules for
+  `@arnilo/prism-providers/openai`.
+- [Multimodal content](multimodal-content.md): sibling one-shot modality
+  contracts sharing the same capability-flag and guard pattern.

package/docs/browser-automation.md

@@ -2,7 +2,7 @@
 
 ## What it does
 
-`@arnilo/prism-browser` exposes six exclusive model-facing tools—`browser_open`, `browser_snapshot`, `browser_act`, `browser_close`, `browser_evaluate`, and `browser_observe`—over a host-supplied Playwright `Browser`. Prism creates one non-persistent `BrowserContext` per run, serializes actions, returns bounded AI-mode accessibility snapshots with snapshot-scoped refs, enforces egress/side-effect/upload/download/screenshot policy, and closes context/pages/listeners/quarantined downloads on close, abort, or manager disposal. Since 0.1.4 the package also rides playwright-core's existing CDP transport for bounded page evaluation, console/network observation, and network/emulation control on Chromium hosts — zero new dependencies, Prism still never launches or downloads browsers.
+The `@arnilo/prism-web-tools/browser` subpath exposes six exclusive model-facing tools—`browser_open`, `browser_snapshot`, `browser_act`, `browser_close`, `browser_evaluate`, and `browser_observe`—over a host-supplied Playwright `Browser`. Prism creates one non-persistent `BrowserContext` per run, serializes actions, returns bounded AI-mode accessibility snapshots with snapshot-scoped refs, enforces egress/side-effect/upload/download/screenshot policy, and closes context/pages/listeners/quarantined downloads on close, abort, or manager disposal. Since 0.1.4 the package also rides playwright-core's existing CDP transport for bounded page evaluation, console/network observation, and network/emulation control on Chromium hosts — zero new dependencies, Prism still never launches or downloads browsers.
 
 ## When to use it
 
@@ -65,8 +65,8 @@ import {
   createBrowserManager,
   createBrowserTools,
   createSharedSandboxBrowserOptions,
-} from "@arnilo/prism-browser";
-import { assertBrowserSandboxNetwork } from "@arnilo/prism-coding-security";
+} from "@arnilo/prism-web-tools/browser";
+import { assertBrowserSandboxNetwork } from "@arnilo/prism-coding-tools/security";
 
 assertBrowserSandboxNetwork({
   mode: "custom",
@@ -106,7 +106,7 @@ await browser.close();
 - `networkPolicy` defaults to `requireContainedProxy: true` (fail closed). Hosts must supply `containedProxyAttestation: { proxyEndpoint, denyDirectEgress: true }`. Private/loopback/link-local, `file`/`data`/`blob`/`javascript`/`devtools` schemes are denied by default. Playwright routing is defense in depth — production DNS/private egress is a host firewall/proxy.
 - Uploads require absolute paths under `uploads.roots` (realpath-contained; symlink escapes rejected). Downloads stream into `downloads.quarantine` with SHA-256/MIME/name metadata; `download_release` requires host `approveRelease`. Screenshots return bounded `ImageContent`.
 - Observation (`snapshot`, `wait`, open-without-url, `close`) vs mutation/high-impact (`navigate`, click/form, dialog accept, upload, download release, popup select) is classified for `ExecutionPolicy` / `beforeSideEffect`.
-- `createSharedSandboxBrowserOptions()` aligns browser uploads/downloads with Task 1 sandbox `/workspace` and `/downloads`. `assertBrowserSandboxNetwork()` in `@arnilo/prism-coding-security` fails closed for custom Docker networks without browser egress attestation.
+- `createSharedSandboxBrowserOptions()` aligns browser uploads/downloads with Task 1 sandbox `/workspace` and `/downloads`. `assertBrowserSandboxNetwork()` in `@arnilo/prism-coding-tools/security` fails closed closed for custom Docker networks without browser egress attestation.
 - Raw CSS/XPath: since 0.1.4 `{ css }` / `{ xpath }` targets resolve via Playwright's selector engine (`locator(css)` / `locator("xpath=…")`); ref resolution keeps the built-in `aria-ref=` selector with a package-owned snapshot ref table for staleness checks.
 - CDP capabilities (0.1.4): `browser_evaluate` (bounded `Runtime.evaluate`), `browser_observe` (Runtime console/exception + Network request/response/failed events in a bounded ring with drain-on-read), and `block_urls`/`unblock_urls` (`Network.setBlockedURLs`), `throttle` (`Network.emulateNetworkConditions`), `emulate` (`Emulation.setDeviceMetricsOverride` + optional `setUserAgentOverride`). All CDP sessions are per-page via `context.newCDPSession(page)` and are detached on run close — network/emulation changes are run-scoped and reset with `browser_close`. `BrowserCdpOptions.mode` (`auto` | `on` | `off`, default `auto`) gates the surface: non-Chromium hosts or mode `off` return `ERR_PRISM_BROWSER_CDP_UNAVAILABLE` without affecting Playwright-only tools. Domains are limited to the Runtime/Network/Emulation allowlist — cookies, tracing, performance profiles, IndexedDB, and worker debugging are not exposed. CDP is not an egress bypass: page network still routes through the run's routing/blocking and `networkPolicy`.
 - CDP bounds (0.1.4): evaluate expression ≤ `maxActionInputBytes` (64 KiB default / 256 KiB hard) and result capped at `maxEvaluateResultBytes` (64 KiB / 256 KiB) with truncation marking; `browser_observe` rings capped at `maxConsoleEntries` (200/500) and `maxNetworkRequests`; `block_urls` patterns ≤ `maxBlockedUrlPatterns` (32/128); throttle latency ≤ 120 s and throughput ≤ 1 Gbps; emulate dimensions ≤ 16 384 and scale ≤ 10, user agent ≤ 2 KiB. Evaluate is classified high-impact (arbitrary page-context code execution): `ExecutionPolicy` approval and the `beforeSideEffect` hook are mandatory, it charges the action budget, and results are marked `untrusted_external`. `browser_observe` is observation-only (no side-effect hook, no action charge) and **never captures request/response bodies, cookies, or auth headers** — only bounded URL/method/status/error-text/arg previews.
@@ -118,7 +118,7 @@ Observation tools declare `kind: none`; mutations are `external_mutation`/`unsup
 
 Import is inert. Construction fails clearly when neither `browser` nor `manager` is supplied. Browser installation, launch, version, and control endpoint are host-owned. Prism never exposes init scripts, extensions, persistent profiles, or model-supplied Playwright launch options; CDP exposure is limited to the allowlisted Runtime/Network/Emulation surface above (evaluate is policy-gated arbitrary code execution — treat results as untrusted). Secrets and storage state must not appear in snapshots, tool results, logs, or checkpoints. Finite caps charge before context/page/action/queue/snapshot/network/artifact retention; snapshots retain no unbounded DOM, console, request, response, or trace history. Unreleased downloads are deleted on context close.
 
-Default tests use fake Playwright APIs only. Protected live gate: `PRISM_LIVE_PLAYWRIGHT=1` (or `PRISM_TEST_PLAYWRIGHT=1`) `npm run test:live -w @arnilo/prism-browser` exercises a local loopback hostile HTML fixture for snapshot refs, stale-ref rejection, css/xpath targets, private/file deny, upload containment, screenshot bounds, download quarantine/release, and the CDP leg (real evaluate, observe, and emulate). Missing browser binaries fail closed when the gate is enabled. The protected coding journey (0.2.6, plan 026 Task 7) additionally runs a real browser inspection leg (local loopback fixture page, snapshot text assertion, run-owned context closed before the host browser) inside the packed consumer as part of scripts/phase26-coding-journey.test.mjs, gated by PRISM_LIVE_PLAYWRIGHT with the pinned playwright-core installed into the consumer; browser storage never appears in the retained report. Adversarial network-free fixtures live in `eval-fixtures.test.ts`; see [Evaluations](evaluations.md) and `examples/coding-browser-evaluation.ts`.
+Default tests use fake Playwright APIs only. Protected live gate: `PRISM_LIVE_PLAYWRIGHT=1` (or `PRISM_TEST_PLAYWRIGHT=1`) `npm run test:live -w @arnilo/prism-web-tools` exercises a local loopback hostile HTML fixture for snapshot refs, stale-ref rejection, css/xpath targets, private/file deny, upload containment, screenshot bounds, download quarantine/release, and the CDP leg (real evaluate, observe, and emulate). Missing browser binaries fail closed when the gate is enabled. The protected coding journey (0.2.6, plan 026 Task 7) additionally runs a real browser inspection leg (local loopback fixture page, snapshot text assertion, run-owned context closed before the host browser) inside the packed consumer as part of scripts/phase26-coding-journey.test.mjs, gated by PRISM_LIVE_PLAYWRIGHT with the pinned playwright-core installed into the consumer; browser storage never appears in the retained report. Adversarial network-free fixtures live in `eval-fixtures.test.ts`; see [Evaluations](evaluations.md) and `examples/coding-browser-evaluation.ts`.
 
 ## Related APIs
 

package/docs/caveman.md

@@ -2,7 +2,7 @@
 
 ## What it does
 
-`@arnilo/prism-caveman` is an optional package that wires [juliusbrussee/caveman](https://github.com/juliusbrussee/caveman) into Prism contribution contracts.
+`@arnilo/prism-coding-tools/caveman` is an optional package that wires [juliusbrussee/caveman](https://github.com/juliusbrussee/caveman) into Prism contribution contracts.
 
 It registers upstream skills and commands, injects active level prompt slices via `InstructionInjector`, and persists level as session custom `caveman-level` entries. Import and extension `setup` without a resolvable upstream path fail closed with a bounded redacted error and register zero contributions.
 
@@ -66,7 +66,7 @@ Deactivation phrases `stop caveman` and `normal mode` clear active injection wit
 ## Implementation example
 
 ```ts
-import { createCavemanExtension } from "@arnilo/prism-caveman";
+import { createCavemanExtension } from "@arnilo/prism-coding-tools/caveman";
 import {
   createExtensionKernel,
   createLoadSkillTool,