@arnilo/prism 0.4.0 → 0.5.0

package/docs/model-routing.md

@@ -2,7 +2,7 @@
 
 ## What it does
 
-`@arnilo/prism-model-router` is an optional governance facade over an existing `ProviderResolver`. It enforces allow-lists, residency, token/cost budgets, rate limits, circuit breaking, and bounded fallbacks before provider selection, and emits redacted selection diagnostics. It does not implement a second provider runtime.
+`@arnilo/prism-core/governance/model-router` is an optional governance facade over an existing `ProviderResolver`. It enforces allow-lists, residency, token/cost budgets, rate limits, circuit breaking, and bounded fallbacks before provider selection, and emits redacted selection diagnostics. It does not implement a second provider runtime.
 
 ## When to use it
 
@@ -57,8 +57,8 @@ Frozen caps (default / hard): attempts `3 / 8`, circuit keys `1,024 / 16,384`, d
 
 ```ts
 import { createAgent, createProviderResolver } from "@arnilo/prism";
-import { createModelRouter } from "@arnilo/prism-model-router";
-import { createPostgresEnterpriseState } from "@arnilo/prism-enterprise-postgres";
+import { createModelRouter } from "@arnilo/prism-core/governance/model-router";
+import { createPostgresEnterpriseState } from "@arnilo/prism-core/enterprise/postgres";
 
 const enterprise = await createPostgresEnterpriseState({ pool, schema: "prism" });
 const router = createModelRouter({
@@ -91,7 +91,7 @@ await enterprise.close();
 
 ## Extension and configuration notes
 
-Router is optional. Chain returned `providerRequestPolicy` with other `ProviderRequestPolicy` values. Wire `onDiagnostics` to `@arnilo/prism-policy` when audit export is required. OpenRouter package behavior is unchanged; routing metadata participates only when this gate allows it.
+Router is optional. Chain returned `providerRequestPolicy` with other `ProviderRequestPolicy` values. Wire `onDiagnostics` to `@arnilo/prism-core/governance/policy` when audit export is required. OpenRouter package behavior is unchanged; routing metadata participates only when this gate allows it.
 
 ### Selection policies (0.1.7)
 
@@ -100,7 +100,7 @@ By default the router tries candidates in input order: the primary model, then
 `createModelRouter` to rank the candidates before the governance checks run:
 
 ```ts
-import { createCostLatencySelection, createModelRouter } from "@arnilo/prism-model-router";
+import { createCostLatencySelection, createModelRouter } from "@arnilo/prism-core/governance/model-router";
 
 const router = createModelRouter({
   resolver,

package/docs/moderation.md

@@ -0,0 +1,117 @@
+# Moderation
+
+## What it does
+
+`ModerationProvider` is the provider-neutral content-classification contract:
+`moderate({ input })` sends text to a provider classifier and returns per-category
+`{ score, flagged }` verdicts keyed by a provider-neutral vocabulary (plan 061
+Task 6). Raw provider category/score fields ride along unmodified as `raw` for
+host-side audits. Scores and flagged booleans are **provider output** — core
+bakes in no policy: thresholds, blocking, and routing stay host-owned
+([host security](host-security.md)). The first-party adapter is
+[`createOpenAIModerationProvider`](providers/openai.md) (`POST /v1/moderations`,
+`omni-moderation-latest`); offline conformance runs via
+`runModerationConformance` from `@arnilo/prism/testing/provider-conformance`.
+
+## When to use it
+
+Use it when a host or guardrail seam wants pre-flight or post-hoc text
+classification from a vendor classifier with portable category names. Do not use
+it for local policy enforcement — Prism core never decides what is blocked;
+hosts read `flagged`/`score` and apply their own thresholds.
+
+## Inputs / request
+
+| Field | Type | Meaning |
+| --- | --- | --- |
+| `input` | `string \| readonly string[]` | One input per call, or a batch (results match input arity and order). |
+| `model` | `string?` | Classification model; adapter default `omni-moderation-latest`. |
+| `signal` | `AbortSignal?` | Cancellation. |
+
+Adapter options: `apiKey` (`CredentialValueSource` — resolved per call, redacted
+from errors), `baseUrl`, `fetch` (fake transport for offline tests), `headers`,
+`model`. Input caps reject typed before network I/O
+(`OPENAI_MODERATION_INPUT_MAX_CHARS`, 100,000 chars — no provider-documented limit,
+conservative ceiling).
+
+## Outputs / response / events
+
+| Field | Type | Meaning |
+| --- | --- | --- |
+| `flagged` | `boolean` | Provider's own top-level decision, verbatim. |
+| `categories` | `Record<string, { score, flagged }>` | Verdicts keyed by the neutral vocabulary (see below); unknown raw categories pass through untouched. |
+| `categories[k].score` | `number` | Provider-reported score in [0,1] — never locally recomputed. |
+| `raw` | `JsonObject?` | Provider-native response fields for audits. |
+
+Neutral category vocabulary (`MODERATION_CATEGORIES`): `harassment`,
+`harassment/threatening`, `hate`, `hate/threatening`, `illicit`,
+`illicit/violent`, `self-harm`, `self-harm/instructions`, `self-harm/intent`,
+`sexual`, `sexual/minors`, `violence`, `violence/graphic`. The OpenAI adapter
+maps via a data-driven table; vendor categories missing from the table surface
+under their raw names so no provider signal is dropped.
+
+Failures throw `ModerationError` with a stable `code`: `empty_input`,
+`input_too_large`, `unsupported_model` (via `assertModerationSupported` when the
+host checks `ModelCapabilities.moderation`), `request_failed` (non-2xx,
+secret-redacted), `response_malformed` (missing `results`, non-numeric scores
+downstream).
+
+## Request/response example
+
+```json
+{ "model": "omni-moderation-latest", "input": "text to classify" }
+```
+
+## Implementation example
+
+```ts
+import { createOpenAIModerationProvider } from "@arnilo/prism-providers/openai";
+import { runModerationConformance } from "@arnilo/prism/testing/provider-conformance";
+
+const moderation = createOpenAIModerationProvider({ apiKey: process.env.OPENAI_API_KEY });
+const result = await moderation.moderate({ input: text });
+// Host-owned policy — Prism applies no thresholds:
+if (result.categories.violence?.score ?? 0 > myPolicy.violenceCutoff) { ... }
+
+// Batch where the provider allows it (arity- and order-preserving):
+const batch = await moderation.moderate({ input: ["first", "second"] });
+
+// Offline conformance (fake transport, no network):
+await runModerationConformance({
+  provider: createOpenAIModerationProvider({ apiKey: "sk-test", fetch: fakeFetch }),
+  model: "omni-moderation-latest",
+  maxInputChars: 100_000,
+  sample: { input: "conformance probe" },
+});
+```
+
+## Extension and configuration notes
+
+- Implement `ModerationProvider` for other vendors; the contract is structural —
+  no base class, no registry. Keep the data-driven category table per provider;
+  never hard-code category logic in call paths.
+- Models declare support with `capabilities.moderation`; hosts gate with
+  `modelSupportsModeration` / `assertModerationSupported`, mirroring the
+  embeddings/speech/image/video guard pattern.
+- Guardrail seams consume the contract at the host layer: wire `moderate()`
+  into request/output inspection stages; core stays policy-free by design.
+
+## Security and performance notes
+
+- API keys resolve through the existing `CredentialValueSource` seam and are
+  redacted from every thrown error; no new secret paths.
+- Classification responses are read through the bounded JSON reader
+  (`OPENAI_MODERATION_MAX_RESPONSE_BYTES`, 8 MiB) — oversized payloads reject
+  instead of buffering.
+- One provider request per input; batch inputs loop the same bounded path.
+- Inputs, verdicts, and raw payloads are never logged by core; error messages
+  carry status and a redacted body only.
+
+## Related APIs
+
+- [Host security](host-security.md): policy ownership — thresholds and blocking
+  stay host-side.
+- [Provider conformance](provider-conformance.md): `runModerationConformance`
+  and the offline conformance matrix.
+- [Provider packages](provider-packages.md): subpath import rules for
+  `@arnilo/prism-providers/openai`.

package/docs/multi-agent-patterns.md

@@ -6,7 +6,7 @@ Maps the four Prism answers for "more than one agent" onto one decision table. A
 
 - **In-session handoff (swarm)** — agent A transfers control of the ongoing conversation to agent B by calling a host-built `handoff` tool; the host resolves the target `AgentDefinition` with `resolveAgentDefinition` and opens the specialist against the same session (same store + session id, previous run's `leafId`). One transcript, no new session. No helper primitive ships; the tool factory lives in [`examples/handoff-swarm.ts`](../examples/handoff-swarm.ts).
 - **Hierarchical crew** — a manager agent decomposes a goal into typed tasks (`{ tasks: [{ role, instruction }] }`) via structured output ([`Artifact*`](structured-output.md)), fans out to parallel role specialists with bounded `maxFanOut` ([`fanOutNode`](workflows.md)), aggregates deliverables with host reduce ([`joinNode`](workflows.md)), and validates outputs with conditional routing to completion or revision ([`conditionalNode`](workflows.md)). The entire process is a deterministic DAG workflow with zero new runtime primitives. Live demo in [`examples/crew-hierarchy.ts`](../examples/crew-hierarchy.ts).
-- **Supervisor delegation** — `@arnilo/prism-supervisor` `delegate()` invokes allow-listed child agents as bounded runs and returns their result to the parent. Separate child transcripts, hooks, budgets, narrowing.
+- **Supervisor delegation** — `@arnilo/prism-core/runtime/supervisor` `delegate()` invokes allow-listed child agents as bounded runs and returns their result to the parent. Separate child transcripts, hooks, budgets, narrowing.
 - **A2A 1.0** — cross-service interop over the JSON-RPC/HTTPS binding; the remote peer's lifecycle is host-owned behind `A2ATaskLifecycle`.
 
 ## When to use it
@@ -153,15 +153,15 @@ Live demo: [`examples/crew-hierarchy.ts`](../examples/crew-hierarchy.ts) — man
 - **Narrowing on transfer, never widening.** If the specialist needs the caller's verified identity, project it through `narrowIdentity` / `assertIdentityPropagation` ([Agent identity](agent-identity.md)) so scopes and tenant cannot widen across the swap. For delegation the same discipline is built in (`narrowIdentity`, AND-composed policies); for A2A the exact-origin client plus per-operation authorization is the boundary.
 - **Manager-generated task plans are untrusted model output.** Manager plan outputs are validated against the typed schema via `ArtifactValidator` before being persisted to workflow state or dispatched to `fan_out`. Malformed or invalid plans trigger the artifact repair loop or fail closed before any specialist is invoked.
 - **Redaction of carried context.** Handoff carries the raw transcript by design — same rows a human replay would read. Apply the session egress seams on the way out: `redactSessionEntry` / `redactMessage` with a host field policy (see [Data classification](data-classification.md)) and `AgentConfig.redactor`; for durable replay across tenants reuse the redacted transcript seam discipline used by ACP `sessions.transcript` ([ACP interop](acp.md)).
-- **Telemetry attribution.** Which agent produced which turn is not stored on message entries; the host knows (it performed the swap or aggregated fan-out results) and should pin it per run via `RunOptions.identity` (principal kind `agent`) so `identityTelemetryAttributes` (`prism.identity.*`) carries redacted attribution on telemetry, or via observability metadata. Supervisor runs emit dedicated `delegation_*` events; adapter-owned delegation timelines emit `delegated_agent_step` through `createDelegatedAgentStep` (see [Agent events](agent-events.md)) — an in-process definition swap has no session seam to emit it, which is why the swap records attribution host-side.
+- **Telemetry attribution.** Which agent produced which turn is not stored on message entries; the host knows (it performed the swap or aggregated fan-out results) and should pin it per run via `RunOptions.identity` (principal kind `agent`) so `identityTelemetryAttributes` (`prism.identity.*`) carries redacted attribution on telemetry, or via observability metadata. Supervisor runs emit dedicated `delegation_*` events; an in-process definition swap has no session seam to emit one, so the host records attribution.
 - **Performance.** The swap performs zero provider calls; it costs one registry resolution plus one session open (~sub-millisecond in the example fixture). The transferred turn costs what any tool round costs.
 
 ## Extension and configuration notes
 
 - Handoff targets may be code-defined `AgentDefinition` objects or `<configRoot>/agents/<name>/AGENT.md` bundles resolved via `resolveAgentBundle` — the allow-list maps names to either.
-- Hosts wanting the pattern behind a UI timeline can emit their own step events from the swap; `delegated_agent_step` remains reserved for adapter-driven delegation loops (`@arnilo/prism-antigravity-agent`).
+- Hosts wanting the pattern behind a UI timeline can emit their own step events from the swap.
 - A reusable in-session handoff helper was evaluated and **not** shipped in 0.3.x: the unavoidable boilerplate is a ~20-line allow-list tool plus one `createAgentSession` call. Revisit only if multiple hosts show materially different swap semantics.
-- Hierarchical crew patterns compose entirely on existing `@arnilo/prism-workflows` and `@arnilo/prism` primitives (`agentNode`, `fanOutNode`, `joinNode`, `conditionalNode`, `ArtifactValidator`, `resolveAgentDefinition`); no separate helper package is needed.
+- Hierarchical crew patterns compose entirely on existing `@arnilo/prism-core/runtime/workflows` and `@arnilo/prism` primitives (`agentNode`, `fanOutNode`, `joinNode`, `conditionalNode`, `ArtifactValidator`, `resolveAgentDefinition`); no separate helper package is needed.
 
 ## Related APIs
 

package/docs/multimodal-content.md

@@ -2,7 +2,7 @@
 
 ## What it does
 
-Prism core ships generic `audio`, `file`, and `document` `ContentBlock` types plus bounded media resolution helpers. Blocks carry MIME type, optional name, and exactly one source: inline base64 `data`, remote `url`, or host `resourceUri`. Optional `transcript` metadata can accompany audio/document blocks.
+Prism core ships generic `audio`, `file`, `document`, and `video` `ContentBlock` types plus bounded media resolution helpers. Blocks carry MIME type, optional name, and exactly one source: inline base64 `data`, remote `url`, or host `resourceUri`. Optional `transcript` metadata can accompany audio/document blocks.
 
 `assembleProviderInput()` calls `assertMessagesSupportModelCapabilities()` so declared `ModelCapabilities.input` tags are enforced before provider calls. First-party provider packages map supported blocks locally; unsupported combinations fail closed with `UnsupportedModalityError` or an explicit provider error.
 
@@ -10,7 +10,7 @@ Prism core ships generic `audio`, `file`, and `document` `ContentBlock` types pl
 
 - **Host apps** attaching PDFs, audio clips, or generic files to user messages before a provider turn.
 - **Resource loaders** returning binary payloads for `resourceUri` references under trust/permission policy.
-- **Provider authors** reading truthful `ModelCapabilities.input` tags (`text`, `image`, `audio`, `file`, `document`) before mapping wire formats.
+- **Provider authors** reading truthful `ModelCapabilities.input` tags (`text`, `image`, `audio`, `file`, `document`, `video`) before mapping wire formats.
 
 Do not embed provider upload IDs, tenant-scoped remote file IDs, or API-specific handles in core content blocks.
 
@@ -54,6 +54,7 @@ Known `ModelCapabilities.input` tags are exported as `MODEL_INPUT_CAPABILITIES`:
 | `audio` | `audio` | OpenAI Responses (`input_audio`) and Google `generateContent` inline data. OpenAI Realtime instead receives `RealtimeSession.sendAudio()` chunks, not an `audio` `ContentBlock`. |
 | `file` | `file` | OpenAI Responses (`input_file`); Anthropic/Kimi/OpenCode Go Anthropic route accept PDF file/document forms; Google maps inline file data. |
 | `document` | `document` | OpenAI Responses (`input_file`); Anthropic/Kimi/OpenCode Go Anthropic route map PDF; Google maps inline document data. |
+| `video` | `video` | Alibaba (Qwen-VL compatible mode maps to `video_url`, plan 061 Task 5); other providers reject with `UnsupportedModalityError` until they declare and map the tag. Optional `fps` frame-sampling hint and `durationMs` ride on the block. |
 
 The AI SDK adapter maps declared user text/image/audio/file/document blocks (and assistant text/image/file/document) to AI SDK file parts; `resourceUri` remains host-resolved before `doStream`. Its output `file`, `reasoning-file`, and `source` parts are deliberately rejected as `unsupported_mapping`, not converted to trusted Prism content. Provider capability metadata is the gate—this matrix never upgrades a model that does not declare the matching input tag.
 
@@ -130,6 +131,29 @@ try {
 }
 ```
 
+## Video generation (output)
+
+Video generation is a separate, deliberately minimal contract — jobs run minutes,
+not seconds, so there is no synchronous `generate`. `VideoGenerationProvider`
+(plan 061 Task 5, from `@arnilo/prism`) has two methods:
+
+- `submit(request)` → `{ jobId }`; the request carries `model`, `prompt`, optional
+  `images` (first entry wins, image-to-video), `size`, `durationSeconds`, `fps`, and
+  an `AbortSignal`. Providers without image-to-video reject with a typed
+  `VideoGenerationError("unsupported_operation")`-shaped error path.
+- `status(jobId, signal?)` → point-in-time `VideoGenerationJob` with `state`
+  (`queued` / `running` / `succeeded` / `failed`), a `video` (with `provider`/`model`
+  provenance and `bytes` or `url`) on success, and an `error` message on failure.
+  Hosts own the polling loop.
+
+Models declare the `capabilities.videoGeneration` flag; hosts gate with
+`modelSupportsVideoGeneration()` / `assertVideoGenerationSupported()`. The Alibaba
+adapter (`createAlibabaVideoGenerationProvider` from
+`@arnilo/prism-providers/alibaba`) runs the DashScope wanx async-task lifecycle
+(text-to-video and image-to-video routes) with an adapter-local `waitFor()`
+convenience poller; conformance runs offline via `runVideoGenerationConformance()`
+from `@arnilo/prism/testing/provider-conformance`.
+
 ## Extension and configuration notes
 
 - URL fetches use the DNS-classifying, address-pinned Node transport by default. `resolveHostname` and `requestUrl` are paired test/custom seams; `requestUrl` must connect to the supplied validated address while preserving the original URL hostname for HTTP Host/TLS verification.

package/docs/obscura.md

@@ -158,8 +158,8 @@ agent.tools = [...agent.tools, ...web.tools];
 the same `ToolDefinition[]` with one read tool (`web_fetch`) and one mutating tool
 (`obscura_scrape`) — through every Prism host's public API: core agent/session
 execution, the Prism MCP server, the `createPrismHandler` server lifecycle, AG-UI
-MCP-tool injection, ACP fronting, workflow `toolNode`/`agentNode`s, supervisor
-children, and Antigravity delegated MCP exposure. It verifies host authorization
+MCP-tool injection, ACP fronting, workflow `toolNode`/`agentNode`s, and supervisor
+children. It verifies host authorization
 and selection deny before execution, that no host needs an Obscura-specific branch,
 and that an aborted in-flight call settles and kills the owned child. Composition
 walkthrough: [`examples/obscura.ts`](../examples/obscura.ts).

package/docs/observability.md

@@ -4,14 +4,14 @@
 
 Prism exposes provider and tool timing through stable, metadata-only `AgentEvent` variants. Hosts subscribe via `session.subscribe()` or persist events through `RunLedger`. Core helpers build `ProviderTurnMetadata` and classify HTTP failures without echoing prompts, tool arguments, or credentials.
 
-Optional package `@arnilo/prism-observability-opentelemetry` maps those events to OpenTelemetry spans and low-cardinality metrics, and adapts `@arnilo/prism-rag`'s dependency-free telemetry seam (`createRagTelemetry()`) onto the same tracer. OpenTelemetry is **not** a dependency of `@arnilo/prism`.
+Optional package `@arnilo/prism-core/governance/observability` maps those events to OpenTelemetry spans and low-cardinality metrics, and adapts `@arnilo/prism-memory/rag`'s dependency-free telemetry seam (`createRagTelemetry()`) onto the same tracer. OpenTelemetry is **not** a dependency of `@arnilo/prism`.
 
 APIs:
 
 - `ProviderTurnMetadata`, `ToolExecutionMetadata` on `AgentEvent`
 - `createProviderTurnMetadata()`, `readProviderHttpStatus()` in `@arnilo/prism`
-- `createOpenTelemetryInstrumentation()`, `wrapOpenTelemetryApi()`, `createInMemoryTelemetry()` in `@arnilo/prism-observability-opentelemetry`
-- `createRagTelemetry()` in `@arnilo/prism-observability-opentelemetry` (RAG spans/events; see span tree below)
+- `createOpenTelemetryInstrumentation()`, `wrapOpenTelemetryApi()`, `createInMemoryTelemetry()` in `@arnilo/prism-core/governance/observability`
+- `createRagTelemetry()` in `@arnilo/prism-core/governance/observability` (RAG spans/events; see span tree below)
 - `handleRunFeedback()` / `handleEvaluation()` for explicit safe post-run projection
 
 ## When to use it
@@ -51,7 +51,7 @@ OpenTelemetry adapter:
 
 ```ts
 import { trace, metrics } from "@opentelemetry/api";
-import { createOpenTelemetryInstrumentation, wrapOpenTelemetryApi } from "@arnilo/prism-observability-opentelemetry";
+import { createOpenTelemetryInstrumentation, wrapOpenTelemetryApi } from "@arnilo/prism-core/governance/observability";
 
 const { tracer, meter } = wrapOpenTelemetryApi(
   trace.getTracer("app"),
@@ -97,7 +97,7 @@ OpenTelemetry mapping (when enabled):
 | `handleRunFeedback` | active-run `prism.run.feedback` event or ended-run span | `prism.run.feedback` |
 | `handleEvaluation` | active-run `gen_ai.evaluation.result` event or ended-run span | `prism.run.evaluation` (`status`) |
 
-RAG span tree (`@arnilo/prism-rag` + `createRagTelemetry()`):
+RAG span tree (`@arnilo/prism-memory/rag` + `createRagTelemetry()`):
 
 | Span | Parent | Notes |
 | --- | --- | --- |
@@ -148,7 +148,7 @@ High-cardinality identifiers (`sessionId`, `runId`, `requestId`, `toolCallId`) a
 
 ```ts
 import { createAgent, createMockProvider, providerDone, providerTextDelta } from "@arnilo/prism";
-import { createInMemoryTelemetry, createOpenTelemetryInstrumentation } from "@arnilo/prism-observability-opentelemetry";
+import { createInMemoryTelemetry, createOpenTelemetryInstrumentation } from "@arnilo/prism-core/governance/observability";
 
 const memory = createInMemoryTelemetry();
 const telemetry = createOpenTelemetryInstrumentation({ tracer: memory.tracer, meter: memory.meter });
@@ -176,17 +176,42 @@ const found = await retrieveContext("policy", { embedder, store, scope, telemetr
 - Events flow through `redactAgentEvent` before subscribers and ledger writes — configure `createSecretRedactor` on the agent/run.
 - `retry_scheduled` still signals backoff; each retry attempt emits its own `provider_turn_*` pair with `metadata.attempt`.
 - NeuralWatt `neuralwatt:telemetry` provider events remain package-local; hosts may forward numeric cost/energy into custom metrics.
-- `@arnilo/prism-observability-opentelemetry` is optional and included through `@arnilo/prism-sdk` and `@arnilo/prism-all`; instrumentation remains disabled until a host configures it.
+- `@arnilo/prism-core/governance/observability` is optional and included through `@arnilo/prism-core` family installs; instrumentation remains disabled until a host configures it.
 - Exporter failures are isolated: instrumentation catches tracer/meter errors and invokes `onExporterError` without affecting the run, feedback persistence, or evaluation scoring.
 - Trace grading uses `createPersistenceTraceResolver()` with explicit session/run/ownership and finite pages/bytes. Judge reasons remain evaluation data; `gen_ai.evaluation.result` receives only name, finite score, controlled status, and reason-presence.
 - Run spans parent provider, tool, guardrail, and explicit delegation spans. Pass `{ context, trace }` to `wrapOpenTelemetryApi()` for native parent context creation; `parentContext` can attach the run to host ambient/remote context.
 - `onTraceReference` receives `{ runId, traceId }` when a run starts. `traceId(runId)` keeps only the newest 1,024 mappings by default (`maxTraceReferences`, hard cap 10,000); durable linkage remains host-owned.
 - Run `error`, suspension, denial, and detach close every attributable span. Repeated terminal events are idempotent and cannot end a span twice.
 - Disabled instrumentation performs no per-delta span work (`enabled: false` or missing tracer/meter).
+- `createProviderCapture()` (plan 062) is the opt-in request/response capture middleware: register `capture.middleware()` on the existing `provider_request` hook and feed `provider_turn_finished` events from the session subscriber loop into `capture.observeEvent()`. Entries land in a capped FIFO ring buffer (`policy.maxEvents`, default 100) exposed via `capture.events()`.
+
+### Provider request/response capture middleware
+
+```ts
+import { createProviderCapture, createMiddlewareRegistry } from "@arnilo/prism";
+
+const capture = createProviderCapture({
+  secrets, // same redactor seam as the logging paths
+  policy: { redact: "secrets", maxEvents: 100 },
+});
+const middleware = createMiddlewareRegistry({ secrets });
+middleware.use("provider_request", capture.middleware()); // request entries, pass-through
+
+for await (const event of session.subscribe()) {
+  if (event.type === "provider_turn_finished") capture.observeEvent(event); // response entries
+}
+
+const entries = capture.events(); // oldest-first snapshot; capture.clear() resets
+```
+
+- The `policy.redact` field governs content retention: `"all"` keeps structure only, `"secrets"` (default) also drops message content, `"none"` retains message content for replay debugging. Secret redaction through the shared logging helpers is unconditional in every mode — captured buffers are replay-safe by construction.
+- Captured shapes are already-normalized (`ProviderRequest` on the request side, `provider_turn_finished` metadata/usage on the response side) — never raw HTTP. Request/response `options` and headers are never captured at all (headers are where credentials ride).
+- Disabled by default with zero overhead: an unregistered capture performs no work; the enabled path adds one entry per round plus the pass-through.
 
 ## Security and performance notes
 
 - Default events are metadata-only — no prompts, streamed deltas, tool arguments, or credentials.
+- Capture middleware follows the same default: `redact: "secrets"` drops message content; buffers are capped and secrets are redacted unconditionally, so a captured buffer can be persisted or replayed without leaking credentials.
 - Use `identityTelemetryAttributes(identity)` when attaching enterprise identity to run metadata or OTel attributes; it emits `prism.identity.*` refs only (tenant/principal/scope counts), never credential secrets or raw tokens.
 - Opt-in content in other event types (`message_delta`, tool `result`) is still subject to `redactAgentEvent`.
 - Metric labels stay low-cardinality (`gen_ai.operation.name`, `gen_ai.provider.name`, token type, controlled outcome/status, feedback rating bucket/link presence); never use session/run/request/call IDs, model output, comments, tag values, scorer/evaluation IDs, or arbitrary metadata as labels. Token usage is recorded once at provider operation scope.

package/docs/openapi-tools.md

@@ -1,15 +1,15 @@
-# OpenAPI tools adapter (`@arnilo/prism-openapi-tools`)
+# OpenAPI tools adapter (`@arnilo/prism-coding-tools/openapi`)
 
 Optional `createOpenApiTools` compiles host-selected OpenAPI 3.1 operations into bounded Prism `ToolDefinition`s. Zero dependencies (native fetch + WebCrypto-free); the compile step is pure and separated from the runtime executor.
 
 ## When to use it
 
-Hosts that already expose a JSON API with an OpenAPI 3.1 document and want the agent to call a **fixed, host-chosen subset** of it — never model-driven discovery, never a raw method/path passthrough. For vendor web search/extraction use `@arnilo/prism-web-tools`; for M365/GWS use `@arnilo/prism-work-tools`; this adapter is for arbitrary host APIs.
+Hosts that already expose a JSON API with an OpenAPI 3.1 document and want the agent to call a **fixed, host-chosen subset** of it — never model-driven discovery, never a raw method/path passthrough. For vendor web search/extraction use `@arnilo/prism-web-tools`; for M365/GWS use `@arnilo/prism-core/integrations/work`; this adapter is for arbitrary host APIs.
 
 ## Usage
 
 ```ts
-import { createOpenApiTools } from "@arnilo/prism-openapi-tools";
+import { createOpenApiTools } from "@arnilo/prism-coding-tools/openapi";
 
 const tools = createOpenApiTools({
   document, // OpenAPI 3.1 document (JSON string or parsed object)
@@ -48,6 +48,16 @@ Register the returned tools with `createToolRegistry` (or pass them to the MCP b
 
 Defaults and hard caps (frozen in `scripts/phase11-freeze-manifest.json`): `maxDocumentBytes` 2 MiB/16 MiB, `maxOperations` 256/1024, `maxSchemaDepth` 32/128, `maxRefs` 1024/8192, `maxBodyBytes` 1 MiB/16 MiB, `maxResponseBytes` 1 MiB/16 MiB, `maxPages` 20/100, `maxPaginationItems` 1000/10000, `maxRetries` 0/3. Invalid limits throw `ERR_PRISM_OPENAPI_DOCUMENT_BOUNDS`.
 
+## Live probe (plans/064 Task 7)
+
+A live wire probe compiles the real public Warnely OpenAPI 3.1 spec (petstore serves 3.0 — the compiler requires 3.1) and drives real GET operations against it:
+
+```bash
+PRISM_LIVE_OPENAPI_TOOLS=1 node --test packages/prism-coding-tools/dist/openapi/__tests__/live.test.js
+```
+
+3 requests total against the allow-listed public host: spec compile, a real 200 tool call, and a real 404 mapped to a status-carrying untrusted result; a missing-argument case proves validation fails closed locally (zero wire calls). Skips (never fails) when `PRISM_LIVE_OPENAPI_TOOLS` is unset. Registered in `scripts/live-matrix.json` as `coding-tools/openapi-live`.
+
 ## Related
 
 - [Tools](tools.md): registry, dispatch, validation

package/docs/operations.md

@@ -94,6 +94,17 @@ tenant's reads, writes, and lease takeover all fail closed.
   with bounded, jittered acquisition polls (no hot loops) and reports the
   measured numbers in the evidence JSON.
 
+## Live probe (plans/064 Task 9)
+
+The outbound webhook notifier has an operator-gated live probe against a receiver you own:
+
+```bash
+PRISM_TEST_WEBHOOK_URL=https://ops.example.com/hooks/prism \
+PRISM_TEST_WEBHOOK_SECRET=<at-least-32-byte-shared-key> npm test -w @arnilo/prism-core -- webhooks-live
+```
+
+Probes: one signed delivery to your receiver (verify `x-prism-signature: sha256=<hex>` over the raw body) and a retry-after-5xx leg over a local loopback receiver (500 then 200, signature verified, retries recorded). Bounded to 1 real request + ≤ 2 loopback requests. Registered in `scripts/live-matrix.json` as `core/webhooks-live`.
+
 ## Related APIs
 
 - `LeaseStore` / `CheckpointStore` — the durable contracts this runbook relies on.

package/docs/performance.md

@@ -1,6 +1,6 @@
 # Performance limits
 
-Evaluation defaults are finite: 100 trace rows × 20 pages and 4 MiB aggregate trace data; one model-judge attempt with 30-second/16-KiB bounds; 8 comparison candidates, 1-MiB candidate results, 10,000 dataset items, and 4-MiB serialized reports. Hard caps are exported by `@arnilo/prism-evals`; overflow fails rather than truncating grading evidence.
+Evaluation defaults are finite: 100 trace rows × 20 pages and 4 MiB aggregate trace data; one model-judge attempt with 30-second/16-KiB bounds; 8 comparison candidates, 1-MiB candidate results, 10,000 dataset items, and 4-MiB serialized reports. Hard caps are exported by `@arnilo/prism-core/governance/evals`; overflow fails rather than truncating grading evidence.
 
 ## What it does
 
@@ -377,9 +377,9 @@ Security automation is isolated from `npm test`: CodeQL/supply-chain jobs have 1
 
 Web tools default/hard ceilings are query 4/16 KiB, results 10/20, URLs 5/20, request 256 KiB/1 MiB, response/aggregate 2/16 MiB, Markdown 1/8 MiB, extraction 256 KiB/1 MiB, schema 64/256 KiB, concurrency 4/16, retries 2/4, polling 20/100, and wall time 60 seconds/30 minutes. Bounds charge before request, retention, retry, or polling; overflow fails rather than truncating citation/extraction evidence.
 
-Docker sandbox defaults/hard caps from `@arnilo/prism-coding-security`: startup 30 s/120 s; wall 20 min/30 min; idle 5 min/15 min; CPUs 2/8; memory 2 GiB/16 GiB (swap equal to memory); PIDs 256/1,024; FDs 1,024/8,192; workspace/tmp/download tmpfs 1 GiB/8 GiB, 256 MiB/2 GiB, 64 MiB/512 MiB; commands 100/256 with concurrent execs 1/8; env 64/256 names and 64 KiB/256 KiB values; export 50,000/250,000 entries and 256 MiB/2 GiB bytes with 16/64 retained artifacts; stop grace 5 s/30 s and cleanup 30 s/120 s. Caps validate before `docker create`/exec/export; overflow aborts and cleans the recorded container. Output still streams into the coding-agent `OutputAccumulator` ceilings (64 MiB/1 GiB).
+Docker sandbox defaults/hard caps from `@arnilo/prism-coding-tools/security`: startup 30 s/120 s; wall 20 min/30 min; idle 5 min/15 min; CPUs 2/8; memory 2 GiB/16 GiB (swap equal to memory); PIDs 256/1,024; FDs 1,024/8,192; workspace/tmp/download tmpfs 1 GiB/8 GiB, 256 MiB/2 GiB, 64 MiB/512 MiB; commands 100/256 with concurrent execs 1/8; env 64/256 names and 64 KiB/256 KiB values; export 50,000/250,000 entries and 256 MiB/2 GiB bytes with 16/64 retained artifacts; stop grace 5 s/30 s and cleanup 30 s/120 s. Caps validate before `docker create`/exec/export; overflow aborts and cleans the recorded container. Output still streams into the coding-agent `OutputAccumulator` ceilings (64 MiB/1 GiB).
 
-Repository list/search defaults/hard caps from `@arnilo/prism-coding-agent`: depth 32/128; entries/files 10,000/100,000; page/results 1,000/10,000; search scan 64 MiB/1 GiB aggregate and 8 MiB/64 MiB per file; matches 1,000/10,000; pattern 512 B/4 KiB; line 50 KiB/1 MiB; context 5/20; wall 30 s/300 s; concurrency config 8/32. Walks stream via `opendir`/`lstat`, never follow symlink escapes, and stop immediately on aggregate limits or abort.
+Repository list/search defaults/hard caps from `@arnilo/prism-coding-tools/agent`: depth 32/128; entries/files 10,000/100,000; page/results 1,000/10,000; search scan 64 MiB/1 GiB aggregate and 8 MiB/64 MiB per file; matches 1,000/10,000; pattern 512 B/4 KiB; line 50 KiB/1 MiB; context 5/20; wall 30 s/300 s; concurrency config 8/32. Walks stream via `opendir`/`lstat`, never follow symlink escapes, and stop immediately on aggregate limits or abort.
 
 Structured Git/check/handoff defaults/hard caps: paths 1,000/10,000; refs 1 KiB/4 KiB; commit message 64 KiB/256 KiB; inline Git output 4 MiB/64 MiB; diff lines 10,000/100,000; changed files 1,000/10,000; patch input 16 MiB/64 MiB; worktrees 4/16; named checks 8/32 names, concurrency 1/4, timeout 10 min/60 min, diagnostic lines 2,000/100,000, output 4 MiB/64 MiB; PR handoff JSON 256 KiB/1 MiB with 100/1,000 commits. Git tools use typed argument arrays (never shell), disable hooks/credential prompts/external diff by default, and emit host-owned PR handoff data only — no push/network/PR client.
 
@@ -557,7 +557,7 @@ Scope froze at commit `f5128a816ae204c52f3e2f089de71c99bd5de6d4`. Measurement ho
 | Root artifact | `@arnilo/prism@0.0.4` dry-run tarball | 346.0 kB packed; 1.3 MB unpacked; 196 files |
 | Installed workspace | Current root `node_modules` | 72 MiB |
 
-Synthetic stream/tool/workflow values are medians of seven measured runs after one warm-up and contain no network, database, or exporter I/O. The temporary benchmark reused public `AgentSession`, `dispatchToolCallsInOrder`, and `@arnilo/prism-workflows` APIs; it was not added to CI because this phase records a baseline rather than creating hardware-sensitive tests.
+Synthetic stream/tool/workflow values are medians of seven measured runs after one warm-up and contain no network, database, or exporter I/O. The temporary benchmark reused public `AgentSession`, `dispatchToolCallsInOrder`, and `@arnilo/prism-core/runtime/workflows` APIs; it was not added to CI because this phase records a baseline rather than creating hardware-sensitive tests.
 
 Repository size at the same commit, counted from `src/` and `packages/` while excluding `dist/`:
 
@@ -590,7 +590,7 @@ Usage aggregation performs one constant-size accumulator update per terminal pro
 
 ### 0.0.5 Phase 4 verification (2026-07-15)
 
-Optional `@arnilo/prism-evals` adds package-local scoring without changing core run latency. Validation stayed within the frozen release gate:
+Optional `@arnilo/prism-core/governance/evals` adds package-local scoring without changing core run latency. Validation stayed within the frozen release gate:
 
 | Surface | Result |
 | --- | --- |
@@ -671,7 +671,7 @@ Optional `@arnilo/prism-rag` reuses Phase 7 vector contracts and adds no core pa
 
 ### 0.0.5 Phase 10 verification (2026-07-16)
 
-Optional `@arnilo/prism-server` and MCP server-direction APIs compose existing agent/workflow/tool/SDK primitives; no core path, framework/listener, auth provider, database, or profile activation was added.
+Optional `@arnilo/prism-core/runtime/server` and MCP server-direction APIs compose existing agent/workflow/tool/SDK primitives; no core path, framework/listener, auth provider, database, or profile activation was added.
 
 | Surface | Result |
 | --- | --- |
@@ -752,7 +752,7 @@ No performance ceiling was raised. Core grew from Phase 0's 346.0 kB packed base
 
 ### 0.0.13 Phase 8 server deployment seams (2026-07-23)
 
-Optional health/drain/rate-limit/replay/deployment-lease helpers on `@arnilo/prism-server`. No listener, queue adapter, or concurrency hard-cap raise.
+Optional health/drain/rate-limit/replay/deployment-lease helpers on `@arnilo/prism-core/runtime/server`. No listener, queue adapter, or concurrency hard-cap raise.
 
 | Surface | Result |
 | --- | --- |

package/docs/persistence-credentials-multimodality-primitives.md

@@ -9,7 +9,7 @@ Implementation is **shipped and phase-verified** (Tasks 0–7). Optional package
 ## When to use it
 
 - **Adapter authors** implementing SQLite/PostgreSQL `SessionStore` + `RunLedger` should start here, then follow [Database persistence](database-persistence.md) and [Session store conformance](session-store-conformance.md).
-- **Host apps** wiring CLI/desktop credential persistence should use the credential seams and package matrix here before choosing `@arnilo/prism-credentials-node` backends.
+- **Host apps** wiring CLI/desktop credential persistence should use the credential seams and package matrix here before choosing `@arnilo/prism-core/credentials/node` backends.
 - **Provider and core authors** extending multimodal input should use the content/resource/capability designs here instead of embedding provider upload IDs in core contracts.
 - **Security reviewers** use the threat model and conformance matrix on this page as the acceptance baseline for Plan 056 Tasks 1–7.
 
@@ -108,10 +108,10 @@ Prism `engines.node` is `>=20`. Optional packages stay package-local; core adds
 
 | Package (planned) | Driver / backend | Pinned version | Node support | Rationale |
 | --- | --- | --- | --- | --- |
-| `@arnilo/prism-session-store-sqlite` | `better-sqlite3` | `^12.11.1` | 20.x–26.x per upstream engines | Synchronous API, WAL/busy_timeout, mature Node 20 baseline; `node:sqlite` rejected — requires Node ≥22.5 and is still experimental vs declared `>=20` baseline |
-| `@arnilo/prism-session-store-postgres` | `pg` | `^8.22.0` | ≥16 (satisfies 20+) | Standard pool + parameterized queries; TLS/credentials host-owned |
-| `@arnilo/prism-credentials-node` encrypted file | Node `crypto` (AES-256-GCM + scrypt) | built-in | 20+ | No extra deps for AEAD/KDF; atomic rename writes |
-| `@arnilo/prism-credentials-node` keychain | `@napi-rs/keyring` | `^1.3.0` | ≥10 (satisfies 20+) | Cross-platform, actively maintained (2026); `keytar@7.9.0` rejected — last release 2022, heavier native rebuild friction |
+| `@arnilo/prism-core/sessions/sqlite` | `better-sqlite3` | `^12.11.1` | 20.x–26.x per upstream engines | Synchronous API, WAL/busy_timeout, mature Node 20 baseline; `node:sqlite` rejected — requires Node ≥22.5 and is still experimental vs declared `>=20` baseline |
+| `@arnilo/prism-core/sessions/postgres` | `pg` | `^8.22.0` | ≥16 (satisfies 20+) | Standard pool + parameterized queries; TLS/credentials host-owned |
+| `@arnilo/prism-core/credentials/node` encrypted file | Node `crypto` (AES-256-GCM + scrypt) | built-in | 20+ | No extra deps for AEAD/KDF; atomic rename writes |
+| `@arnilo/prism-core/credentials/node` keychain | `@napi-rs/keyring` | `^1.3.0` | ≥10 (satisfies 20+) | Cross-platform, actively maintained (2026); `keytar@7.9.0` rejected — last release 2022, heavier native rebuild friction |
 
 **Rejected options:**
 
@@ -131,7 +131,7 @@ Prism `engines.node` is `>=20`. Optional packages stay package-local; core adds
 | Persistence location | Core built-in DB | Optional packages over contracts | **Optional packages** | Matches Plan 053 JSONL boundary and `ProductionPersistenceStore` extension point |
 | Schema/migrations | Core DDL generator | Shared fixture model + dialect-local SQL | **Shared fixtures + local SQL** | Two adapters without ORM |
 | Run ledger conformance | Per-package tests only | Shared conformance module (Task 1) | **Shared module** | Parity with session-store conformance |
-| Credential persistence | Core global store | `@arnilo/prism-credentials-node` | **Optional package** | Host selects file vs keychain |
+| Credential persistence | Core global store | `@arnilo/prism-core/credentials/node` | **Optional package** | Host selects file vs keychain |
 | KDF | PBKDF2 default | scrypt with documented minimums | **scrypt** (configurable N/r/p) | Node built-in; calibrate in Task 4 tests |
 | Multimodal content | Provider-specific options only | Generic `ContentBlock` + capability tags | **Generic blocks + capabilities** | Portable input; provider maps/uploads locally |
 | URL/file sources | Loader reads anything | Bounded loader policy + trust integration | **Bounded + trust** | Reuse `createPathTrustPolicy` patterns; SSRF deny-by-default for URLs |

package/docs/policy-and-audit.md

@@ -2,7 +2,7 @@
 
 ## What it does
 
-`@arnilo/prism-policy` records redacted allow/deny/modify/approval decisions with policy version, actor refs from verified `AgentIdentity`, target, reason, expiry, and evidence references. Hosts export cursor-paginated pages to append-only/WORM sinks. The package does not embed a mandatory global policy engine, KMS, or cloud WORM SDK.
+`@arnilo/prism-core/governance/policy` records redacted allow/deny/modify/approval decisions with policy version, actor refs from verified `AgentIdentity`, target, reason, expiry, and evidence references. Hosts export cursor-paginated pages to append-only/WORM sinks. The package does not embed a mandatory global policy engine, KMS, or cloud WORM SDK.
 
 ## When to use it
 
@@ -64,7 +64,7 @@ import {
   evaluateAndAppend,
   exportPolicyDecisions,
   recordToolApprovalDecision,
-} from "@arnilo/prism-policy";
+} from "@arnilo/prism-core/governance/policy";
 
 const evaluator = createPolicyEvaluator({
   policyId: "mail",
@@ -129,7 +129,7 @@ Immutable approval requests carry an action digest, requester, and required role
 | `ApprovalRecord` | Request + `status` (`pending/approved/rejected/revoked/consumed`) + `revision` + immutable `decisions` + `policyRevision` |
 | `ApprovalStore.create/decide/revoke/consume/get/query` | Durable transitions; every transition records an `auditRef` |
 | `createMemoryApprovalStore({ authority })` | Single-process reference adapter sharing the pure transition logic |
-| `createPostgresApprovalStore({ pool, schema, authority })` | Cross-replica storage (migration `005_erp_approvals`, `@arnilo/prism-enterprise-postgres`) |
+| `createPostgresApprovalStore({ pool, schema, authority })` | Cross-replica storage (migration `005_erp_approvals`, `@arnilo/prism-core/enterprise/postgres`) |
 
 Quorum rules:
 
@@ -152,7 +152,7 @@ WHERE status = 'pending' AND expires_at < now();
 
 Hosts own identity verification and the role source; Prism does not certify NIST compliance. NIST SP 800-53 AC-5 (separation of duties) and AC-6 (least privilege) are control guidance only, not certification claims.
 
-## OPA external policy adapter (`@arnilo/prism-policy/opa`, 0.0.28)
+## OPA external policy adapter (`@arnilo/prism-core/governance/policy/opa`, 0.0.28)
 
 Optional `createOpaPolicyEvaluator` evaluates `PolicyEvaluateRequest`s against a host-pinned OPA REST endpoint (`POST /v1/data/<path>` with `{"input": <document>}`) and returns a core `PolicyEvaluator` for `evaluateAndAppend`. Native `fetch` only; no OPA SDK dependency.
 
@@ -168,9 +168,9 @@ Optional `createOpaPolicyEvaluator` evaluates `PolicyEvaluateRequest`s against a
 | `ssrf` | `SsrfPolicy` for the endpoint; denials surface `MediaContentError` (`ssrf_denied`) |
 
 ```ts
-import { createOpaPolicyEvaluator } from "@arnilo/prism-policy/opa";
-import { createPostgresEnterpriseState } from "@arnilo/prism-enterprise-postgres";
-import { evaluateAndAppend } from "@arnilo/prism-policy";
+import { createOpaPolicyEvaluator } from "@arnilo/prism-core/governance/policy/opa";
+import { createPostgresEnterpriseState } from "@arnilo/prism-core/enterprise/postgres";
+import { evaluateAndAppend } from "@arnilo/prism-core/governance/policy";
 
 const evaluator = createOpaPolicyEvaluator({
   url: "https://opa.internal:8181/v1/data/prism/allow",
@@ -194,6 +194,16 @@ await evaluateAndAppend(request, { store: state.policy, evaluator, id: crypto.ra
 
 `state.close()` leaves a caller-owned pool open. Run `state.cleanup(...)` from an authorized host schedule only when expiration cleanup is needed; it does not run in the background.
 
+## Live probe (plans/064 Task 9)
+
+The OPA policy evaluator has an operator-gated live probe against a real decision endpoint:
+
+```bash
+PRISM_TEST_OPA_URL=https://opa:8181/v1/data/prism/allow npm test -w @arnilo/prism-core -- opa-live
+```
+
+Probes: two real decision evaluations (any valid outcome) and one fail-closed probe (unroutable endpoint ⇒ `deny` with `OPA endpoint unavailable`). Bounded to ≤ 2 real requests. Registered in `scripts/live-matrix.json` as `core/opa-live`.
+
 ## Related APIs
 
 - [Model routing](model-routing.md)

package/docs/ponytail.md

@@ -108,7 +108,7 @@ See `examples/caveman-ponytail.ts` for combined Caveman + Ponytail progressive d
 - Mode restore scans `getEntries()` for latest `data.type === "ponytail-mode"` (OM attach pattern).
 - `ponytail-subagent` hook is not wired; nested-agent behavior is host responsibility. When hosts wire the upstream hook, `PONYTAIL_SUBAGENT_MATCHER` accepts only the documented safe subset — `"explore|general"` (any literal substring) or `"^general$"` (exact), case-insensitive, max 256 chars. No `RegExp` is compiled from the environment, so arbitrary regex (including catastrophic nested quantifiers) is never evaluated; unset/invalid patterns inject into every subagent.
 - No TUI statusline scripts; use `ponytail status` command or extension events.
-- Not included in `@arnilo/prism-code` or `@arnilo/prism-sdk` profiles — opt-in install only.
+- Not included in `@arnilo/prism-coding-tools` or `@arnilo/prism-core` profiles — opt-in install only.
 
 ## Security and performance notes
 

package/docs/postgres-persistence.md

@@ -2,7 +2,7 @@
 
 ## What it does
 
-The optional `@arnilo/prism-session-store-postgres` package ships a production-oriented PostgreSQL adapter that implements:
+The optional `@arnilo/prism-core/sessions/postgres` package ships a production-oriented PostgreSQL adapter that implements:
 
 - `SessionStore` — atomic `append` / `list` / `get` / `readBranchPath` / bounded `searchSessions` / bounded `searchSessions`
 - `RunLedger` — durable run, event, tool-call, and usage rows
@@ -24,13 +24,13 @@ Use this package when you need server-backed persistence with pooled connections
 - managed cloud databases (RDS, Cloud SQL, Neon, Supabase, etc.)
 - CI integration tests against a real PostgreSQL service
 
-Prefer [`@arnilo/prism-session-store-sqlite`](sqlite-persistence.md) for local CLI tools, single-writer workloads, and network-free default tests. This adapter stores sessions/runs, not semantic vectors; use the separate [`@arnilo/prism-memory` pgvector path](working-and-semantic-memory.md), which rejects non-finite vectors before SQL, when vector recall is needed. For durable policy decisions, evaluations, work mutation idempotency, and model-router state, use the separate [`@arnilo/prism-enterprise-postgres`](enterprise-postgres-state.md) composition; it has its own migration history and does not replace session/run persistence.
+Prefer [`@arnilo/prism-core/sessions/sqlite`](sqlite-persistence.md) for local CLI tools, single-writer workloads, and network-free default tests. This adapter stores sessions/runs, not semantic vectors; use the separate [`@arnilo/prism-memory` pgvector path](working-and-semantic-memory.md), which rejects non-finite vectors before SQL, when vector recall is needed. For durable policy decisions, evaluations, work mutation idempotency, and model-router state, use the separate [`@arnilo/prism-core/enterprise/postgres`](enterprise-postgres-state.md) composition; it has its own migration history and does not replace session/run persistence.
 
 ## Inputs / request
 
 ```ts
 import { Pool } from "pg";
-import { createPostgresPersistence } from "@arnilo/prism-session-store-postgres";
+import { createPostgresPersistence } from "@arnilo/prism-core/sessions/postgres";
 ```
 
 | Field | Type | Purpose |
@@ -82,7 +82,7 @@ Migrations run automatically on open and are idempotent across reopen. Concurren
 ```ts
 import { Pool } from "pg";
 import { createAgentSession } from "@arnilo/prism";
-import { createPostgresPersistence } from "@arnilo/prism-session-store-postgres";
+import { createPostgresPersistence } from "@arnilo/prism-core/sessions/postgres";
 import { runSessionStoreConformance } from "@arnilo/prism/testing/session-store-conformance";
 
 const pool = new Pool({
@@ -111,7 +111,7 @@ await pool.end();
 Live conformance and integration tests:
 
 ```bash
-PRISM_TEST_POSTGRES_URL="$DATABASE_URL" npm run test:postgres --workspace @arnilo/prism-session-store-postgres
+PRISM_TEST_POSTGRES_URL="$DATABASE_URL" npm run test:postgres --workspace @arnilo/prism-core/sessions/postgres
 ```
 
 ## Extension and configuration notes