@arnilo/prism 0.5.3 → 0.5.4

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+## [0.5.4] - 2026-09-08 (plan 067)
+
+### Changed
+- **Run limits: process-safety HARD split from host policy.** `DEFAULT_RUN_LIMITS` stays the unconfigured fence (turns 16, attempts 24, tool rounds 8, calls 32, wall 120s, bytes 8 MiB, tokens 40k/10k/50k), but `HARD_RUN_LIMITS` shrinks to the two process-integrity axes (`maxRequestBytes`/`maxResponseBytes`, 64 MiB) so a bug cannot OOM the host through a giant provider frame — and hosts can legally raise or disable everything else. Policy axes accept `number | null`: omit for the default, set a positive safe integer, or set `null` to disable the axis (disabled wall still honors `RunOptions.signal`). Resolution stays narrowing-only with `null` as +Infinity (agent 16 + run `null` → 16); an omitted `maxProviderAttempts` lifts to at least a raised/disabled `maxTurns` so attempts cannot undercut turns. Byte axes reject `null` and >64 MiB. The former `$10k` `maxCost` ceiling is removed (any finite non-negative amount). Documented ceiling: vendors that omit usage charge zero to token counters; a configured `maxCost` remains fail-closed. Durable checkpoints omit `deadlineAt` on no-wall runs; older checkpoints with a deadline still resume. New `ResolvedRunLimits` type; `resolveRunLimits` returns it.
+
+### Removed
+- **`HARD_MAX_RUN_COST` export** (was a `$10k` validation ceiling; `maxCost` now accepts any finite non-negative amount plus one currency).
+
 ## [0.5.3] - 2026-09-08
 
 ### Fixed

package/README.md

@@ -162,16 +162,16 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 
 | package | version | notes |
 | --- | --- | --- |
-| `@arnilo/prism` | 0.5.3 | core — runtime, CLI/RPC, templates, docs |
-| `@arnilo/prism-coding-tools` | 0.5.3 | family — /agent, /security, /document-reader, /openapi, /computer-use-linux, /dev, /caveman, /ponytail, /impeccable subpaths |
-| `@arnilo/prism-core` | 0.5.3 | family — /runtime, /sessions, /governance, /credentials, /enterprise, /work, /validation subpaths |
-| `@arnilo/prism-providers` | 0.5.3 | family — all provider adapters as `/<adapter>` subpaths |
-| `@arnilo/prism-acp-agent` | 0.5.3 | capability — ACP adapter |
-| `@arnilo/prism-ag-ui` | 0.5.3 | capability — AG-UI/A2A/A2UI adapter |
-| `@arnilo/prism-mcp` | 0.5.3 | capability — MCP client/server/OAuth interop |
-| `@arnilo/prism-memory` | 0.5.3 | capability — memory plus /rag, /compaction/*, /graft, /wiki subpaths |
-| `@arnilo/prism-office` | 0.5.3 | capability — /documents, /sheets, /diagrams subpaths |
-| `@arnilo/prism-web-tools` | 0.5.3 | capability — Brave/Exa/Firecrawl plus peer-gated /browser and /obscura subpaths |
+| `@arnilo/prism` | 0.5.4 | core — runtime, CLI/RPC, templates, docs |
+| `@arnilo/prism-coding-tools` | 0.5.4 | family — /agent, /security, /document-reader, /openapi, /computer-use-linux, /dev, /caveman, /ponytail, /impeccable subpaths |
+| `@arnilo/prism-core` | 0.5.4 | family — /runtime, /sessions, /governance, /credentials, /enterprise, /work, /validation subpaths |
+| `@arnilo/prism-providers` | 0.5.4 | family — all provider adapters as `/<adapter>` subpaths |
+| `@arnilo/prism-acp-agent` | 0.5.4 | capability — ACP adapter |
+| `@arnilo/prism-ag-ui` | 0.5.4 | capability — AG-UI/A2A/A2UI adapter |
+| `@arnilo/prism-mcp` | 0.5.4 | capability — MCP client/server/OAuth interop |
+| `@arnilo/prism-memory` | 0.5.4 | capability — memory plus /rag, /compaction/*, /graft, /wiki subpaths |
+| `@arnilo/prism-office` | 0.5.4 | capability — /documents, /sheets, /diagrams subpaths |
+| `@arnilo/prism-web-tools` | 0.5.4 | capability — Brave/Exa/Firecrawl plus peer-gated /browser and /obscura subpaths |
 <!-- generated:package-truth:inventory end -->
 
 ## Scripts

package/dist/agent-run-state.d.ts

@@ -28,7 +28,8 @@ export interface StoredAgentRunState extends AgentRunState {
     readonly stickyDecisions?: readonly StickyDecision[];
     readonly interruptBeforeTool?: boolean;
     readonly counters: RunLimitCounters;
-    readonly deadlineAt: string;
+    /** Wall deadline; absent when the run has no wall limit. Old snapshots with a deadline still parse. */
+    readonly deadlineAt?: string;
     /** Loop-local durable state captured by the strategy's snapshot hook at suspension. */
     readonly loopState?: {
         readonly name: string;
@@ -84,7 +85,7 @@ export declare function initialAgentRunState(input: {
     readonly leafId?: string;
     readonly model: ModelConfig;
     readonly counters: RunLimitCounters;
-    readonly deadlineAt: string;
+    readonly deadlineAt?: string;
     readonly status: "suspended" | "running";
     readonly interruption?: AgentRunInterruption;
     readonly messages?: readonly Message[];

package/dist/agent-run-state.js

@@ -165,8 +165,7 @@ export function parseAgentRunState(value, version) {
         !state.sessionId ||
         !state.model ||
         !state.status ||
-        !state.counters ||
-        !state.deadlineAt) {
+        !state.counters) {
         throw new AgentRunStateError("Malformed agent run state");
     }
     if (state.pendingCalls !== undefined &&

package/dist/agent-session/session/assemble.js

@@ -106,7 +106,8 @@ async function assembleRoundContext(params) {
     for (const message of inputMessages)
         await session.appendMessage(message, runId);
     await session.autoCompact(runId, options, controller.signal, inputMessages);
-    const maxToolRounds = resolveRunLimits(session.agent.config.limits, options.limits).maxToolRounds;
+    // Disabled cap (`null`) maps to +Infinity so loop comparisons never trip (`n >= null` would be true).
+    const maxToolRounds = resolveRunLimits(session.agent.config.limits, options.limits).maxToolRounds ?? Number.POSITIVE_INFINITY;
     const systemInstructions = composeSystemPrompt(mergeSystemPromptConfig(session.agent.config.systemPrompt, options.systemPrompt), {
         base: session.agent.config.instructions,
     });
@@ -317,7 +318,8 @@ export async function executeRun(session, input, options, runId, resumed) {
         deadlineAt: resumed?.state?.deadlineAt,
     });
     session.activeLimits = limits;
-    session.activeLimitOutputBuffer = [session.agent.config.limits, requestedLimits].some((value) => value?.maxOutputTokens !== undefined || value?.maxTotalTokens !== undefined || value?.maxCost !== undefined);
+    const hasFiniteTokenCap = (value) => typeof value === "number" && Number.isFinite(value);
+    session.activeLimitOutputBuffer = [session.agent.config.limits, requestedLimits].some((value) => hasFiniteTokenCap(value?.maxOutputTokens) || hasFiniteTokenCap(value?.maxTotalTokens) || value?.maxCost !== undefined);
     try {
         const ctx = await assembleRoundContext({
             session,

package/dist/contracts-core/run-limits.d.ts

@@ -2,17 +2,39 @@
  * Moved verbatim from contracts-core.ts; public surface unchanged behind the barrel. */
 import type { ProviderTurnResult, ToolResult } from "../contracts-protocol.js";
 import type { Message, ToolCallContent } from "./content.js";
+/**
+ * Host-authored run limits. Policy axes accept `null` to explicitly disable the cap
+ * (process safety still caps request/response bytes, which reject `null`). Omitted keys
+ * resolve to `DEFAULT_RUN_LIMITS`.
+ */
 export interface RunLimits {
-    readonly maxTurns?: number;
-    readonly maxProviderAttempts?: number;
-    readonly maxToolRounds?: number;
-    readonly maxToolCalls?: number;
-    readonly maxWallTimeMs?: number;
+    readonly maxTurns?: number | null;
+    readonly maxProviderAttempts?: number | null;
+    readonly maxToolRounds?: number | null;
+    readonly maxToolCalls?: number | null;
+    readonly maxWallTimeMs?: number | null;
     readonly maxRequestBytes?: number;
     readonly maxResponseBytes?: number;
-    readonly maxInputTokens?: number;
-    readonly maxOutputTokens?: number;
-    readonly maxTotalTokens?: number;
+    readonly maxInputTokens?: number | null;
+    readonly maxOutputTokens?: number | null;
+    readonly maxTotalTokens?: number | null;
+    readonly maxCost?: {
+        readonly amount: number;
+        readonly currency: string;
+    };
+}
+/** Fully resolved limits after `resolveRunLimits`: every policy axis is a finite cap or `null` (disabled). */
+export interface ResolvedRunLimits {
+    readonly maxTurns: number | null;
+    readonly maxProviderAttempts: number | null;
+    readonly maxToolRounds: number | null;
+    readonly maxToolCalls: number | null;
+    readonly maxWallTimeMs: number | null;
+    readonly maxRequestBytes: number;
+    readonly maxResponseBytes: number;
+    readonly maxInputTokens: number | null;
+    readonly maxOutputTokens: number | null;
+    readonly maxTotalTokens: number | null;
     readonly maxCost?: {
         readonly amount: number;
         readonly currency: string;

package/dist/index.d.ts

@@ -88,7 +88,7 @@ export { createDefaultRetryPolicy, isTransientErrorInfo, waitForRetry } from "./
 export type { BatchedRunLedgerOptions } from "./run-ledger.js";
 export { createBatchedRunLedger, DEFAULT_LEDGER_BATCH_BYTES, DEFAULT_LEDGER_BATCH_DELAY_MS, DEFAULT_LEDGER_BATCH_ENTRIES, HARD_LEDGER_BATCH_BYTES, HARD_LEDGER_BATCH_DELAY_MS, HARD_LEDGER_BATCH_ENTRIES, isFlushableRunLedger, } from "./run-ledger.js";
 export type { RunLimitTrackerOptions } from "./run-limits.js";
-export { createRunLimitTracker, DEFAULT_RUN_LIMITS, HARD_MAX_RUN_COST, HARD_RUN_LIMITS, RunLimitError, RunLimitTracker, resolveRunLimits, } from "./run-limits.js";
+export { createRunLimitTracker, DEFAULT_RUN_LIMITS, HARD_RUN_LIMITS, RunLimitError, RunLimitTracker, resolveRunLimits, } from "./run-limits.js";
 export { createSecureAgent } from "./secure-agent.js";
 export type { PermissionDecision, PermissionPolicy, PermissionRequest, TrustDecision, TrustPolicy, TrustRequest } from "./security.js";
 export { assertPermission, assertTrusted, checkPermission, createStaticPermissionPolicy, createStaticTrustPolicy, denialToErrorInfo, isTrusted, PermissionDeniedError, TrustDeniedError, } from "./security.js";
@@ -119,5 +119,5 @@ export { trimTrailingSlashes } from "./trim-trailing-slashes.js";
 export type { ResolvedUseCaseModel, ResolveUseCaseModelInput, UseCaseModelBinding, } from "./use-case-model.js";
 export { resolveUseCaseModel, resolveUseCaseModelBinding, useCaseCredentialProviderId, } from "./use-case-model.js";
 export declare const name = "prism";
-export declare const version = "0.5.3";
+export declare const version = "0.5.4";
 export declare const description = "Agent harness for AI providers, agents, sessions, and tools.";

package/dist/index.js

@@ -47,7 +47,7 @@ export { createSecretRedactor, errorToErrorInfo, redactAgentEvent, redactMessage
 export { loadBinaryResource, loadJsonResource, loadManifestResource, loadTextResource } from "./resources.js";
 export { createDefaultRetryPolicy, isTransientErrorInfo, waitForRetry } from "./retry.js";
 export { createBatchedRunLedger, DEFAULT_LEDGER_BATCH_BYTES, DEFAULT_LEDGER_BATCH_DELAY_MS, DEFAULT_LEDGER_BATCH_ENTRIES, HARD_LEDGER_BATCH_BYTES, HARD_LEDGER_BATCH_DELAY_MS, HARD_LEDGER_BATCH_ENTRIES, isFlushableRunLedger, } from "./run-ledger.js";
-export { createRunLimitTracker, DEFAULT_RUN_LIMITS, HARD_MAX_RUN_COST, HARD_RUN_LIMITS, RunLimitError, RunLimitTracker, resolveRunLimits, } from "./run-limits.js";
+export { createRunLimitTracker, DEFAULT_RUN_LIMITS, HARD_RUN_LIMITS, RunLimitError, RunLimitTracker, resolveRunLimits, } from "./run-limits.js";
 export { createSecureAgent } from "./secure-agent.js";
 export { assertPermission, assertTrusted, checkPermission, createStaticPermissionPolicy, createStaticTrustPolicy, denialToErrorInfo, isTrusted, PermissionDeniedError, TrustDeniedError, } from "./security.js";
 export { createMemorySessionStore, createSessionEntry, getSessionBranchEntries, listSessionBranches, rebuildSessionContext, } from "./session-stores.js";
@@ -66,6 +66,6 @@ export { createToolParameterValidator, createToolRegistry, dispatchToolCall, fil
 export { trimTrailingSlashes } from "./trim-trailing-slashes.js";
 export { resolveUseCaseModel, resolveUseCaseModelBinding, useCaseCredentialProviderId, } from "./use-case-model.js";
 export const name = "prism";
-export const version = "0.5.3";
+export const version = "0.5.4";
 export const description = "Agent harness for AI providers, agents, sessions, and tools.";
 //# sourceMappingURL=index.js.map

package/dist/run-limits.d.ts

@@ -1,7 +1,25 @@
-import type { RunLimitBreach, RunLimitCounters, RunLimitName, RunLimits, Usage } from "./contracts.js";
-export declare const DEFAULT_RUN_LIMITS: Required<Omit<RunLimits, "maxCost">>;
-export declare const HARD_MAX_RUN_COST = 10000;
-export declare const HARD_RUN_LIMITS: Required<Omit<RunLimits, "maxCost">>;
+import type { ResolvedRunLimits, RunLimitBreach, RunLimitCounters, RunLimitName, RunLimits, Usage } from "./contracts.js";
+export declare const DEFAULT_RUN_LIMITS: Readonly<{
+    maxTurns: 16;
+    maxProviderAttempts: 24;
+    maxToolRounds: 8;
+    maxToolCalls: 32;
+    maxWallTimeMs: 120000;
+    maxRequestBytes: number;
+    maxResponseBytes: number;
+    maxInputTokens: 40000;
+    maxOutputTokens: 10000;
+    maxTotalTokens: 50000;
+}>;
+/**
+ * Process-safety ceilings that exist so a bug cannot OOM the host via JSON.parse of giant
+ * provider frames. Product axes (turns, wall time, tokens, …) have no hard cap: hosts set
+ * them per workload, and `null` explicitly disables an axis.
+ */
+export declare const HARD_RUN_LIMITS: Readonly<{
+    maxRequestBytes: number;
+    maxResponseBytes: number;
+}>;
 export declare class RunLimitError extends Error {
     readonly breach: RunLimitBreach;
     readonly code = "ERR_PRISM_RUN_LIMIT";
@@ -14,16 +32,17 @@ export interface RunLimitTrackerOptions {
     readonly deadlineAt?: string;
 }
 /** Validate one host-authored layer. Defaults are applied only after inheritance is resolved. */
-export declare function resolveRunLimits(agent?: RunLimits, run?: RunLimits): Readonly<Required<Omit<RunLimits, "maxCost">> & Pick<RunLimits, "maxCost">>;
+export declare function resolveRunLimits(agent?: RunLimits, run?: RunLimits): Readonly<ResolvedRunLimits>;
 export declare class RunLimitTracker {
     private readonly options;
-    readonly limits: Readonly<Required<Omit<RunLimits, "maxCost">> & Pick<RunLimits, "maxCost">>;
+    readonly limits: Readonly<ResolvedRunLimits>;
     private readonly startedAt;
-    readonly deadlineAt: string;
+    /** Wall deadline ISO string; absent when the run has no wall limit. */
+    readonly deadlineAt: string | undefined;
     private readonly counters;
     private timer?;
     private exceeded?;
-    constructor(limits: Readonly<Required<Omit<RunLimits, "maxCost">> & Pick<RunLimits, "maxCost">>, options?: RunLimitTrackerOptions);
+    constructor(limits: Readonly<ResolvedRunLimits>, options?: RunLimitTrackerOptions);
     get breach(): RunLimitBreach | undefined;
     snapshot(): RunLimitCounters;
     dispose(): void;

package/dist/run-limits.js

@@ -10,20 +10,17 @@ export const DEFAULT_RUN_LIMITS = Object.freeze({
     maxOutputTokens: 10_000,
     maxTotalTokens: 50_000,
 });
-export const HARD_MAX_RUN_COST = 10_000;
+/**
+ * Process-safety ceilings that exist so a bug cannot OOM the host via JSON.parse of giant
+ * provider frames. Product axes (turns, wall time, tokens, …) have no hard cap: hosts set
+ * them per workload, and `null` explicitly disables an axis.
+ */
 export const HARD_RUN_LIMITS = Object.freeze({
-    maxTurns: 64,
-    maxProviderAttempts: 256,
-    maxToolRounds: 64,
-    maxToolCalls: 256,
-    maxWallTimeMs: 30 * 60_000,
     maxRequestBytes: 64 * 1024 * 1024,
     maxResponseBytes: 64 * 1024 * 1024,
-    maxInputTokens: 1_000_000,
-    maxOutputTokens: 250_000,
-    maxTotalTokens: 1_000_000,
 });
 const LIMIT_NAMES = Object.keys(DEFAULT_RUN_LIMITS);
+const POLICY_NAMES = LIMIT_NAMES.filter((name) => name !== "maxRequestBytes" && name !== "maxResponseBytes");
 const COUNTER_FOR = {
     maxTurns: "turns",
     maxProviderAttempts: "providerAttempts",
@@ -46,16 +43,44 @@ export class RunLimitError extends Error {
         this.name = "RunLimitError";
     }
 }
+/** `null` means "no cap" and behaves as +Infinity when narrowing against a finite layer. */
+function minCap(a, b) {
+    if (a === undefined)
+        return b;
+    if (b === undefined)
+        return a;
+    if (a === null)
+        return b;
+    if (b === null)
+        return a;
+    return Math.min(a, b);
+}
 /** Validate one host-authored layer. Defaults are applied only after inheritance is resolved. */
 export function resolveRunLimits(agent, run) {
     const base = agent ? validateLimits(agent) : undefined;
     const override = run ? validateLimits(run) : undefined;
     const resolved = { ...DEFAULT_RUN_LIMITS };
-    for (const name of LIMIT_NAMES) {
+    for (const name of POLICY_NAMES) {
+        const narrowed = minCap(base?.[name], override?.[name]);
+        resolved[name] = narrowed !== undefined ? narrowed : DEFAULT_RUN_LIMITS[name];
+    }
+    for (const name of ["maxRequestBytes", "maxResponseBytes"]) {
         if (base?.[name] !== undefined)
-            resolved[name] = base[name];
+            resolved[name] = Math.min(resolved[name], base[name]);
         if (override?.[name] !== undefined)
-            resolved[name] = base ? Math.min(resolved[name], override[name]) : override[name];
+            resolved[name] = Math.min(resolved[name], override[name]);
+    }
+    // A raised/disabled maxTurns must not be silently undercut by the attempts default:
+    // generate-then-tool-loop needs at least one attempt per turn (plus retries).
+    if (base?.maxProviderAttempts === undefined && override?.maxProviderAttempts === undefined) {
+        const turns = resolved.maxTurns;
+        resolved.maxProviderAttempts = turns === null ? null : Math.max(DEFAULT_RUN_LIMITS.maxProviderAttempts, turns);
+    }
+    else {
+        const attempts = resolved.maxProviderAttempts;
+        const turns = resolved.maxTurns;
+        if (attempts !== null && turns !== null && attempts < turns)
+            resolved.maxProviderAttempts = turns;
     }
     const maxCost = override?.maxCost ?? base?.maxCost;
     return Object.freeze({
@@ -80,14 +105,21 @@ function validateLimits(input) {
         const value = input[name];
         if (value === undefined)
             continue;
-        if (!Number.isSafeInteger(value) || value < 1 || value > HARD_RUN_LIMITS[name]) {
-            throw new TypeError(`${name} must be a positive safe integer at most ${HARD_RUN_LIMITS[name]}`);
+        if (name === "maxRequestBytes" || name === "maxResponseBytes") {
+            // Process-safety axes: a giant frame cannot be host-approved away, so `null` is rejected.
+            if (value === null || !Number.isSafeInteger(value) || value < 1 || value > HARD_RUN_LIMITS[name])
+                throw new TypeError(`${name} must be a positive safe integer at most ${HARD_RUN_LIMITS[name]}`);
+            continue;
         }
+        if (value === null)
+            continue;
+        if (!Number.isSafeInteger(value) || value < 1)
+            throw new TypeError(`${name} must be a positive safe integer or null to disable`);
     }
     if (input.maxCost) {
         const { amount, currency } = input.maxCost;
-        if (!Number.isFinite(amount) || amount < 0 || amount > HARD_MAX_RUN_COST || !currency.trim())
-            throw new TypeError(`maxCost requires a finite amount from 0 through ${HARD_MAX_RUN_COST} and currency`);
+        if (!Number.isFinite(amount) || amount < 0 || !currency.trim())
+            throw new TypeError("maxCost requires a finite non-negative amount and currency");
     }
     return input;
 }
@@ -95,6 +127,7 @@ export class RunLimitTracker {
     options;
     limits;
     startedAt = performance.now();
+    /** Wall deadline ISO string; absent when the run has no wall limit. */
     deadlineAt;
     counters;
     timer;
@@ -121,21 +154,46 @@ export class RunLimitTracker {
                 throw new TypeError("Run limit snapshot must contain finite non-negative counters");
             }
         }
-        const deadline = options.deadlineAt ? Date.parse(options.deadlineAt) : Date.now() + limits.maxWallTimeMs;
-        if (!Number.isFinite(deadline))
-            throw new TypeError("Run limit deadlineAt is invalid");
-        this.deadlineAt = new Date(deadline).toISOString();
-        const remaining = Math.max(0, deadline - Date.now());
-        this.timer = setTimeout(() => this.exceed("maxWallTimeMs", limits.maxWallTimeMs), remaining);
-        this.timer.unref?.();
-        if (remaining === 0)
-            this.exceed("maxWallTimeMs", limits.maxWallTimeMs);
+        // A restored durable deadline wins even when the wall limit is now disabled (never drop an existing wall).
+        const deadline = options.deadlineAt
+            ? Date.parse(options.deadlineAt)
+            : limits.maxWallTimeMs === null
+                ? undefined
+                : Date.now() + limits.maxWallTimeMs;
+        if (deadline === undefined) {
+            this.deadlineAt = undefined;
+        }
+        else {
+            if (!Number.isFinite(deadline))
+                throw new TypeError("Run limit deadlineAt is invalid");
+            this.deadlineAt = new Date(deadline).toISOString();
+            const remaining = Math.max(0, deadline - Date.now());
+            // Node clamps setTimeout delays above 2^31-1 (~24.8 days) to 1ms, which would breach early;
+            // arm capped and re-check the real clock before exceeding.
+            const arm = (delay) => {
+                this.timer = setTimeout(() => {
+                    const left = deadline - Date.now();
+                    if (left > 0)
+                        arm(Math.min(left, 2_147_483_647));
+                    else
+                        this.exceed("maxWallTimeMs", limits.maxWallTimeMs ?? 0);
+                }, delay);
+                this.timer.unref?.();
+            };
+            arm(Math.min(remaining, 2_147_483_647));
+            if (remaining === 0)
+                this.exceed("maxWallTimeMs", limits.maxWallTimeMs ?? 0);
+        }
     }
     get breach() {
         return this.exceeded;
     }
     snapshot() {
-        return { ...this.counters, wallTimeMs: Math.min(this.limits.maxWallTimeMs, Math.ceil(performance.now() - this.startedAt)) };
+        const elapsed = Math.ceil(performance.now() - this.startedAt);
+        return {
+            ...this.counters,
+            wallTimeMs: this.limits.maxWallTimeMs === null ? elapsed : Math.min(this.limits.maxWallTimeMs, elapsed),
+        };
     }
     dispose() {
         if (this.timer)
@@ -150,7 +208,8 @@ export class RunLimitTracker {
         if (!Number.isSafeInteger(observed))
             this.exceed(limit, Number.MAX_SAFE_INTEGER + 1);
         this.counters[counter] = observed;
-        if (observed > this.limits[limit])
+        const cap = this.limits[limit];
+        if (cap !== null && observed > cap)
             this.exceed(limit, observed);
     }
     recordUsage(usage) {
@@ -183,7 +242,7 @@ export class RunLimitTracker {
     }
     exceed(limit, observed) {
         if (!this.exceeded) {
-            const maximum = limit === "maxCost" ? (this.limits.maxCost?.amount ?? 0) : this.limits[limit];
+            const maximum = limit === "maxCost" ? (this.limits.maxCost?.amount ?? 0) : (this.limits[limit] ?? 0);
             this.exceeded = {
                 limit,
                 maximum,

package/docs/0.1.0-readiness.md

@@ -1,6 +1,6 @@
 # 0.1.0 / 1.0 Readiness Gates
 
-Status: **0.5.3** is the current release line (10 active packages, family subpaths, `^0.5.3` peers); **0.3.3** was the terminal 0.3.x cut; **0.1.7** was the terminal 0.1.x baseline; **1.0** readiness remains operator-gated, not automatic.
+Status: **0.5.4** is the current release line (10 active packages, family subpaths, `^0.5.4` peers); **0.3.3** was the terminal 0.3.x cut; **0.1.7** was the terminal 0.1.x baseline; **1.0** readiness remains operator-gated, not automatic.
 
 This page distills runnable readiness gates into one command-per-gate table.
 The **Last evidence** column records the 0.1.0-tree snapshot (plan 012 Tasks
@@ -20,7 +20,7 @@ Historical release lines (0.0.16 floor → 0.0.27 Phase 10 ACP interop → 0.1.0
 keep their per-phase evidence in the pages above; this page records the 0.2.6
 snapshot (plan 026) with the 0.1.x tables below as the historical record.
 
-## Current line (0.5.3)
+## Current line (0.5.4)
 
 | Item | Status |
 |---|---|

package/docs/agent-session-runtime.md

@@ -47,7 +47,7 @@ string | Message | readonly Message[]
 
 `AgentSessionConfig.store` overrides `AgentConfig.store`; otherwise the session gets a private memory store. `AgentSessionConfig.leafId` selects the branch leaf to resume from.
 
-`AgentConfig.limits` sets run ceilings; `RunOptions.limits` may only narrow configured agent values. Limits cover turns, provider attempts, tool rounds/calls, wall time, request/response bytes, tokens, and optional single-currency cost. A breach emits one `run_limit_exceeded` event and throws `AgentRunError` with `result.limit`; see [Runs and usage ledger](runs-and-usage.md#run-limits).
+`AgentConfig.limits` sets run ceilings; `RunOptions.limits` may only narrow configured agent values (`null` counts as no cap, so a configured finite ceiling still wins). Limits cover turns, provider attempts, tool rounds/calls, wall time, request/response bytes, tokens, and optional single-currency cost. Policy axes accept `null` (0.5.4) to disable the axis; request/response bytes reject `null` and stay process-hard at 64 MiB. A breach emits one `run_limit_exceeded` event and throws `AgentRunError` with `result.limit`; see [Runs and usage ledger](runs-and-usage.md#run-limits).
 
 `RunOptions.model` can override the request model for a run. Model overrides append a `model_change` entry. `AgentConfig.inputLayout` selects the default input assembly layout (`"cache_aware"` by default, or opt-in `"legacy"`); `RunOptions.inputLayout` wins for one run. `AgentConfig.thinkingLevel` / `RunOptions.thinkingLevel` (run wins) is the session thinking intent — Prism snaps it onto the request after host `providerOptions`. `AgentConfig.providerOptions`/`RunOptions.providerOptions` supply generic provider request options (session/cache/header/compat/extra hints only — provider-level timeout/retry hints were removed in 0.1.5). Kernel construction always stamps `options.sessionId`/`cacheKey` from `session.id` when missing; `createSessionCachePolicy` is an overlay, not required. Use `RunOptions.signal`/host abort controllers for timeouts and `AgentConfig.retry`/`RunOptions.retry` for retry. `AgentConfig.providerRequestPolicies`/`RunOptions.providerRequestPolicies` run before `AIProvider.generate()` and before `provider_request` middleware. `AgentConfig.systemPrompt` and `RunOptions.systemPrompt` add explicit layered system prompt contributions; `RunOptions.systemPrompt: false` disables configured prompt layers for that run while keeping `AgentConfig.instructions` as the base path. `RunOptions.compaction` can enable auto-compaction for that run or use `false` to disable configured auto-compaction. `RunOptions.retry` can enable provider-turn retry for that run or use `false` to disable configured retry. `RunOptions.metadata` is merged with agent/session metadata for assembly, provider requests, and tool contexts. Run tool-round limits via `RunOptions.limits.maxToolRounds`. `RunOptions.signal` is bridged into the per-run abort signal passed to assembly, providers, tools, auto-compaction, and retry backoff.
 

package/docs/index.md

@@ -2,12 +2,12 @@
 
 Prism is a TypeScript/Node.js agent harness. Host apps and extension packages own providers, tools, resources, credentials, storage, UI, and business behavior. Prism supplies contracts, registries, streaming events, and replaceable runtime primitives.
 
-## Current line (0.5.3)
+## Current line (0.5.4)
 
 - **Tool result content on the wire**: content-only `ToolResult`s fold into `tool_result.result`; adapters join sibling text so the model sees tool output instead of JSON `"null"`.
 - **Stream token coalesce**: adjacent `text`/`thinking` deltas merge on persist; replay serializers join with `""` so multi-turn tool loops do not grow interstitial newlines.
 - **Provider request construction**: Prism stamps `sessionId`/`cacheKey` on every owned generate site, default cache breakpoints on `cache_control` / explicit-breakpoint models, and `thinkingLevel` on `AgentConfig` / `RunOptions`. Host policies are overlays. OpenCode Go missing session fails closed with `ProviderRequirementError` before fetch.
-- **10 publishable packages**: lockstep `0.5.3` (plans 055–066); family packages use explicit subpaths.
+- **10 publishable packages**: lockstep `0.5.4` (plans 055–067); family packages use explicit subpaths.
 - **Linux desktop control**: optional `@arnilo/prism-coding-tools/computer-use-linux` wraps a host-owned `computer-use-linux` MCP binary; DeviceAdapter admission is deny-by-default and the package is omitted from umbrellas.
 - **Coding/ACP closeouts**: `read.findText`, visible fuzzy edit outcomes and miss context, ACP editor-buffer operations, per-session spawnable coding registries, and delete/move projections.
 
@@ -33,7 +33,7 @@ Prism is a TypeScript/Node.js agent harness. Host apps and extension packages ow
 - [Disaster recovery and backup operations](disaster-recovery.md): the plan 027 Task 7 runbook — standard-tool backup/restore/migration-rollback/PITR/DR drill (`scripts/phase27-dr.test.mjs`), guarded commands, app-level verification, the rollback decision tree, and measured RPO/RTO in `docs/_evidence/phase27-dr-evidence.json`.
 - [Data classification and field-level redaction](data-classification.md): the plan 027 Task 8 contract — `applyFieldPolicy` walking JSON-like values with allow/redact/tokenize/deny decisions, the fail-closed protected default, per-boundary `labelFor` hints (no auto-discovery), sparse-copy overhead, and the ERP-T9 leak matrix incl. egress/audit/telemetry seams.
 - [Evaluations](evaluations.md): deterministic and bounded trace/model-judge/pairwise scoring, CI thresholds, OTel trace-reference linkage, coding/browser adversarial fixtures, ID-only linkage to immutable owned run feedback, optional durable PostgreSQL records, and trace-to-dataset curation of production runs.
-- [Runs and usage ledger](runs-and-usage.md): durable run/event/tool/usage persistence, optional bounded FIFO durability policies, session snapshot caching, immutable run/trace feedback, and the host-supplied `CostCatalog` pricing adapter (usage-only without one).
+- [Runs and usage ledger](runs-and-usage.md): durable run/event/tool/usage persistence, optional bounded FIFO durability policies, session snapshot caching, immutable run/trace feedback, host-raisable `RunLimits` with `null` per-axis disable (bytes stay process-HARD), and the host-supplied `CostCatalog` pricing adapter (usage-only without one).
 - [Performance limits](performance.md): **0.1.0 capacity envelopes** (frozen performance contract, 24 network-free + 16 protected p95 rows, startup/pack rows), 0.0.26 coding-intelligence/process/forge/egress network-free evidence, 0.0.25 durable-loop/HITL/A2UI network-free evidence, 0.0.24 distributed event/effect PostgreSQL evidence, 0.0.23 enterprise state evidence, 0.0.15 network-free provider/RAG/memory benchmark evidence and frozen caps, bounded evaluation traces/judges/reports, and production sizing assumptions.
 - [Structured output](structured-output.md): the `Artifact*` seam plus provider-native `StructuredOutputOptions` / `structuredOutputMode` for capable models.
 
@@ -164,7 +164,7 @@ Prism is a TypeScript/Node.js agent harness. Host apps and extension packages ow
 - [Impeccable behavior integration](impeccable.md): optional `@arnilo/prism-coding-tools/impeccable` — host `upstreamPath` to compiled Impeccable `SKILL.md`, skill + `/impeccable` → `load_skill`; no detector CLI, no live browser, not in code/sdk/all.
 
 ## Release and install
-- [Release and install](release-and-install.md): current **0.5.3** package graph — generated inventory in the [package-inventory section](#package-inventory) and the release page — plan 041-044 changed-package cut (progressive tool loading with `search_tools` disclosure, `@arnilo/prism-prompts` initial cut with run-ledger `promptVersion` provenance (persistence schema 9), trace-to-dataset curation in `@arnilo/prism-evals`, and composite memory-recall scoring in `@arnilo/prism-memory@0.3.2`) and independent `^0.3.0` publication; plan 050 changed-package cut (clay-integration-findings fixes + OKF v0.2 wiki bundles) and independent `^0.3.0` publication; plan 030 last-lockstep cut and independent `^0.3.0` publication; plan 029 **0.2.9** provider adoption (DeepSeek, xAI SuperGrok OAuth, ClinePass), `@arnilo/prism-impeccable`, Ponytail 4.9.0, Caveman v2.1 extras; then plan 028 **0.2.8** ACP adoption fixes; then plan 026 the fully-featured coding-agent-readiness cut: **host-selected PTY** (`pty: true` delegates only to the host `ptyBackend`, fails closed as unsupported when absent, bounded resize/TERM/attach caps), **indexed code search** (host-owned incremental index seam with explicit `indexed_literal`/`semantic` modes, literal remains the default, stale/failed/untrusted indexes fail closed `ERR_PRISM_INDEX_*`, results labeled `untrusted_index`), **coding workspaces** (`createCodingWorkspaceLifecycle`: durable CheckpointStore CAS records + LeaseStore fencing, locked worktrees, credential-free fingerprints, cleanup refusal matrix), **durable recovery** (process intent/ACP `activeRun` refs over Postgres/SQLite stores with attach-if-attested `recover()` and durable fence-checked cancellation, never fabricated exits), **patch review and diagnostics** (`createCodingPatchReviewManifest` + `assertCodingPatchAccepted` with pending/accepted/rejected/superseded bound to digest + revision + identity, opt-in LSP `syncDocument`/`diagnosticDelta`), and the **protected real coding journey** (packed consumer through real provider/Docker/Postgres/GitHub/Playwright/PTY services with retained evidence report; forge breadth GitLab/Bitbucket stays demand-gated); then plan 025 the maintainability-and-bounded-performance cut: **god-module splits** (the six remaining implementation monoliths — `src/contracts-core.ts` 1,719 L, `src/agent-session.ts` 2,049 L, `workflows/src/run.ts` 1,227 L, `server/src/handler.ts` 1,005 L, `coding-agent/src/repository.ts` 974 L, `ag-ui/src/acp/agent.ts` 836 L — split into cohesive family files behind preserved barrels, compat-preserving with zero breaking deltas, no `exports`-map subpath, `RuntimeAgentSession` kept as one class with a recorded reason), **persistence-mechanics dedup** (21 pure ownership/cursor/checkpoint/lifecycle/search helpers moved into the dependency-free `session-store-codecs`; postgres/sqlite adapters shrank 273 lines; SQL dialect stays per-adapter; no schema/shape change; cross-store conformance green), **bounded accumulation removed** (per-push `Buffer.concat` in language framing + tar parsing → chunk-array readers; framing ~100–200× faster at 4,000 chunks, tar linear at 8 MiB, caps fail-closed byte-identical; CLI `collectOutput` audited already linear), **dead-code cleanup internal-only** (62 candidates triaged: 2 internal removals + 60 allow-listed in `docs/_evidence/phase25-dead-exports-triage.md`), and **coverage close** (76 behavior-backed regressions; core 90.53/84.20/90.54 → 91.43/84.80/91.60); additive-only compat (105 helper exports), no migration; then plan 024 the package-documentation-and-compatibility-truth cut: **umbrella wording matches manifests** (`@arnilo/prism-providers` installs 11 of 14 provider adapters — Azure/Bedrock/Vertex are added separately by `prism-all`; `prism-all` installs 20 direct / 43 transitive packages and omits document-reader, OpenAPI tools, NATS, Caveman, Ponytail; membership unchanged in 0.2.x), **manifest-derived package truth** (`scripts/package-truth.mjs` → `scripts/package-truth.json` is the single source for counts, provider membership, and closures; docs literals regenerate from it and drift fails the gates), **peer-version policy Decision A** (exact `@arnilo/prism: 0.2.4` pins, atomic-upgrade rule, ERESOLVE refusal for partial upgrades, `^1.0.0` widening at 1.x), and **current-line truth** (`docs/0.1.0-readiness.md` at the 0.2.x line with 0.1.7 as the terminal 0.1.x baseline); no runtime contract delta (compat gate at 0.2.4: version literal only), no migration; then plan 023 the build-coverage-and-release-evidence-integrity cut: **build serialization** (dependency-free `scripts/with-build-lock.mjs` — one O_EXCL lockfile at `node_modules/.prism-build.lock` serializing every emit/test leaf so concurrent compilers can never expose a partial live `dist/`, stale-PID reclaim, env-overridable `PRISM_BUILD_LOCK_TIMEOUT_MS`, fail-closed; documented direct-`tsc` caveat), **corrected workspace coverage denominators** (package-local `--test-coverage-include=dist/**` so imported core `dist` no longer pollutes workspace rows — `mcp` 45.47→90.25, `rag` 19.70→94.82; evidence-based per-package thresholds in `scripts/coverage-thresholds.json` with `protectedException` for durable-leg packages shown separately, machine-readable `scripts/coverage-summary.json`), **machine-auditable release skip manifest** (`scripts/release-skip-manifest.mjs` → `scripts/release-evidence.json`: every surface recorded `pass`/`skip`/`blocked`/`protected` with reason and required env; the 33 protected/live skips named; a required surface without evidence records `blocked` and fails the release gate fail-closed — missing credentials/services can never convert into a green release), and **stabilized quality gates** (Biome 2.x `preset` config migration with zero lint diagnostics, the racy 150ms MCP bridge timing assert replaced by a deterministic barrier, load-sensitive guards carry documented `ponytail:` ceilings, machine-readable `lint-report.sarif` + `unused-report.json` retained by CI); no runtime contract delta (compat gate at 0.2.3: version literal only), no migration; then plan 022 the concurrent-state-and-durability-integrity cut: atomic model-budget reservation (`ModelRouterStateStore.reserveBudget`/`commitBudget`/`releaseBudget` with fencing tokens, `reservationTtlMs` expiry and unknown-usage reconciliation, rate/budget key-map caps with LRU eviction that never drops a held reservation), atomic conversation metadata (`SessionRecord.version` + `appendSession` `expectedVersion` CAS across Postgres/SQLite — create-only `0`, exact-version `N>0`, legacy last-write-wins when omitted; `SessionMetadataConflictError` `metadata_conflict` with versions only, HTTP 409; concurrent create/branch/archive single-statement with branch caps inside the CAS, archive wins, deleted rows never resurrect), single-consumer `EventMultiplexer` (`EventMultiplexerError` `ERR_PRISM_EVENT_MULTIPLEXER_SINGLE_CONSUMER` instead of silent queue sharing), restart-stable NATS durable consumer identity (`prism_<hmac16>` with no random suffix — crash-resumed subscribe continues from the last ack, orphaned 0.2.1 consumers reclaimed on clean stop), and bounded non-durable active-run registries (sweep + fail-closed 512 cap `ERR_PRISM_WORKFLOW_RUN_REGISTRY_OVERFLOW`); new regression surface `scripts/phase22-security.test.mjs` (4 blockers + gate accounting over built public entrypoints) + packed plain-JS `security22.mjs` consumer + the `@arnilo/prism/testing/state-concurrency-conformance` harness (7 probes across memory/Postgres/SQLite/NATS legs, no timing-only sleeps) + the `scripts/phase22-conformance.test.mjs` gate; additive-only compat (new exports only, no removals); forward-only migrations 008 (`prism_sessions.version`) and 003 (`prism_model_router_budgets.reservations`); migration `0.2.1 → 0.2.2`; then plan 021 the provider-completion-and-outbound-trust-boundaries cut: strict stream completion is the shared OpenAI-compatible default (truncated streams fail `incomplete_delta`, explicit `strictCompletion: false` opt-out), bounded success bodies via `readBoundedResponseJson` on all discovery/quota/embeddings/upload/OAuth JSON endpoints (65,536-byte ceiling, depth/property/shape caps), DNS-pinned OIDC JWKS/OPA/content fetches through the core `pinnedFetch` primitive with 3xx redirects rejected outright (private/metadata answers fail closed `ssrf_denied`), shared bounded OAuth device/token polling (`pollDeviceCodeToken`) across provider-openai and credentials-node, and the four edge fixes (Azure/Vertex credential-once, Bedrock duplicate-case/repeated-query SigV4 canonicalization, OpenAI upload failed-DELETE retention, cache `__overflow__` tokens-only); public-entrypoint threat-suite `scripts/phase21-security.test.mjs` + packed plain-JS consumer; additive-only compat (MCP transport helpers re-exported from core, no removals); migration `0.2.0 → 0.2.1`; then plan 020 the fail-closed runtime-and-sandbox-security cut on the 0.2.x review-remediation line: durable-resume decision validation in core (`assertValidAgentRunResume` — unknown decisions/malformed batches fail closed with `ERR_PRISM_DECISION_*` before any state claim, checkpoint write, or tool execution; server parser remains defense in depth), isolated work-tool subprocess environments (`@arnilo/prism-work-tools` — fixed base allow-list + explicit env + forced HOME/telemetry + late-bound per-identity tokens, 64-name/64-KiB caps, absolute binary/configDir, linear output capture), and explicit sandbox capabilities (`@arnilo/prism-coding-security` — `SandboxAdapter.capabilities` with omission-is-false fail-closed resolution, `SandboxCodingComposition.capabilities` from verified wiring, `containmentClaim` deprecated as the conservative projection; Docker reports only verified controls, native reports filesystem/process/privilege `false`); public-entrypoint security conformance (`scripts/phase20-security.test.mjs`, wired into `security:threat-suites`), packed plain-JS consumer regressions, and the sandbox-browser workflow's fail-loud Docker/native capability evidence gate — 0.2.0 never ships while a blocker is skipped; migration and rollback notes in `docs/migration.md` `0.1.7 → 0.2.0`, store-compatible with 0.1.7 in both directions; 0.1.7 was the performance-and-DX patch — dependency-free `createCacheTelemetry()` per-provider/model cache hit/miss aggregator (bounded cardinality with `__overflow__`, token counters/rates only, host-activated), host-configurable `ModelRouterSelectionPolicy` on `createModelRouter` with the reference `createCostLatencySelection` (ModelCost rank then in-memory latency EMA, default ordered behavior byte-identical), `prism providers add <name>` OpenAI-compatible provider scaffold (manifest/provider/models/cache/conformance test/docs stub, npm-name + traversal + symlink-escape validation, placeholders only), and the async `AgUiProjection` verification closeout (plan 009 Task 15 evidence recorded, no new code); plan 017 the documented breaking cut — deprecated-option removal with `docs/migration.md` `0.1.4 → 0.1.5` section and reviewed compat-baseline regeneration via `--allow-break` then `--update-baseline`: the inert provider request knobs, `RunOptions.maxToolRounds`, observational-memory flat settings keys + top-level worker aliases, `ReadToolOptions.autoResizeImages`, `INIT_PROVIDERS`; all removals fail closed naming their replacement; plan 016 internal god-module split — `agents.ts`/`contracts.ts` reorganized behind barrel re-exports with a byte-identical public entry surface, measured tree-shaking improvement in `scripts/phase16-baseline.json`, and additive `@arnilo/prism-browser` Chrome DevTools Protocol capabilities — `browser_evaluate`/`browser_observe` and `block_urls`/`unblock_urls`/`throttle`/`emulate` act actions; plan 015 dead-code and deprecation hygiene on the frozen 0.1.x line — parameterized benchmark runner `scripts/benchmark.mjs` absorbing the per-version runners, archived review-coverage evidence in `docs/_evidence/`, non-blocking unused-code sweep `npm run sweep:unused`, opt-in checkpoint persistence for loaded-skill names and read-path sets; plan 014 Alibaba provider enrichment — embeddings, video input, verified compatible-mode surface decision table; plan 013 post-release hardening — build single-flight, MCP SSE relay test, combined coverage summary, canonical manifest-count narrative, ACP modes/config persistence guidance; Phase 12 release-candidate hardening; plan 012 — freeze manifest, compatibility matrix, upgrade matrix, packed-install e2e journeys, restart-recovery evidence, capacity envelopes, security policy), exact-peer/install/tarball rules, deterministic resumable publication and publish dry-run, frozen 0.1.x compatibility and support matrix (Node/PostgreSQL/platform/provider/protocol pins and unsupported combinations, machine-checked against `scripts/phase12-freeze-manifest.json`), protected PostgreSQL gate, pinned supply-chain gates, offline tests, the 0.0.15 provider/AI-SDK/RAG/memory protected live-canary matrix, and sandbox-browser Docker/Playwright gates. 0.2.6 (plan 026 Task 7) adds the protected coding journey: `scripts/phase26-coding-journey.test.mjs` runs a packed consumer through real provider calls, a digest-pinned Docker sandbox, the durable Postgres worktree lifecycle, provider-driven ACP edits with policy approval, named checks with `diagnosticDelta`, patch review over the server ArtifactService, cross-replica process recovery, durable cancellation, real GitHub PR push/reconcile/cleanup, host Playwright inspection, and the host PTY adapter (frozen profile) — the retained `scripts/phase26-coding-journey-report.json` gates release evidence (pass/blocked/protected, never a passing skip).
+- [Release and install](release-and-install.md): current **0.5.4** package graph — generated inventory in the [package-inventory section](#package-inventory) and the release page — plan 041-044 changed-package cut (progressive tool loading with `search_tools` disclosure, `@arnilo/prism-prompts` initial cut with run-ledger `promptVersion` provenance (persistence schema 9), trace-to-dataset curation in `@arnilo/prism-evals`, and composite memory-recall scoring in `@arnilo/prism-memory@0.3.2`) and independent `^0.3.0` publication; plan 050 changed-package cut (clay-integration-findings fixes + OKF v0.2 wiki bundles) and independent `^0.3.0` publication; plan 030 last-lockstep cut and independent `^0.3.0` publication; plan 029 **0.2.9** provider adoption (DeepSeek, xAI SuperGrok OAuth, ClinePass), `@arnilo/prism-impeccable`, Ponytail 4.9.0, Caveman v2.1 extras; then plan 028 **0.2.8** ACP adoption fixes; then plan 026 the fully-featured coding-agent-readiness cut: **host-selected PTY** (`pty: true` delegates only to the host `ptyBackend`, fails closed as unsupported when absent, bounded resize/TERM/attach caps), **indexed code search** (host-owned incremental index seam with explicit `indexed_literal`/`semantic` modes, literal remains the default, stale/failed/untrusted indexes fail closed `ERR_PRISM_INDEX_*`, results labeled `untrusted_index`), **coding workspaces** (`createCodingWorkspaceLifecycle`: durable CheckpointStore CAS records + LeaseStore fencing, locked worktrees, credential-free fingerprints, cleanup refusal matrix), **durable recovery** (process intent/ACP `activeRun` refs over Postgres/SQLite stores with attach-if-attested `recover()` and durable fence-checked cancellation, never fabricated exits), **patch review and diagnostics** (`createCodingPatchReviewManifest` + `assertCodingPatchAccepted` with pending/accepted/rejected/superseded bound to digest + revision + identity, opt-in LSP `syncDocument`/`diagnosticDelta`), and the **protected real coding journey** (packed consumer through real provider/Docker/Postgres/GitHub/Playwright/PTY services with retained evidence report; forge breadth GitLab/Bitbucket stays demand-gated); then plan 025 the maintainability-and-bounded-performance cut: **god-module splits** (the six remaining implementation monoliths — `src/contracts-core.ts` 1,719 L, `src/agent-session.ts` 2,049 L, `workflows/src/run.ts` 1,227 L, `server/src/handler.ts` 1,005 L, `coding-agent/src/repository.ts` 974 L, `ag-ui/src/acp/agent.ts` 836 L — split into cohesive family files behind preserved barrels, compat-preserving with zero breaking deltas, no `exports`-map subpath, `RuntimeAgentSession` kept as one class with a recorded reason), **persistence-mechanics dedup** (21 pure ownership/cursor/checkpoint/lifecycle/search helpers moved into the dependency-free `session-store-codecs`; postgres/sqlite adapters shrank 273 lines; SQL dialect stays per-adapter; no schema/shape change; cross-store conformance green), **bounded accumulation removed** (per-push `Buffer.concat` in language framing + tar parsing → chunk-array readers; framing ~100–200× faster at 4,000 chunks, tar linear at 8 MiB, caps fail-closed byte-identical; CLI `collectOutput` audited already linear), **dead-code cleanup internal-only** (62 candidates triaged: 2 internal removals + 60 allow-listed in `docs/_evidence/phase25-dead-exports-triage.md`), and **coverage close** (76 behavior-backed regressions; core 90.53/84.20/90.54 → 91.43/84.80/91.60); additive-only compat (105 helper exports), no migration; then plan 024 the package-documentation-and-compatibility-truth cut: **umbrella wording matches manifests** (`@arnilo/prism-providers` installs 11 of 14 provider adapters — Azure/Bedrock/Vertex are added separately by `prism-all`; `prism-all` installs 20 direct / 43 transitive packages and omits document-reader, OpenAPI tools, NATS, Caveman, Ponytail; membership unchanged in 0.2.x), **manifest-derived package truth** (`scripts/package-truth.mjs` → `scripts/package-truth.json` is the single source for counts, provider membership, and closures; docs literals regenerate from it and drift fails the gates), **peer-version policy Decision A** (exact `@arnilo/prism: 0.2.4` pins, atomic-upgrade rule, ERESOLVE refusal for partial upgrades, `^1.0.0` widening at 1.x), and **current-line truth** (`docs/0.1.0-readiness.md` at the 0.2.x line with 0.1.7 as the terminal 0.1.x baseline); no runtime contract delta (compat gate at 0.2.4: version literal only), no migration; then plan 023 the build-coverage-and-release-evidence-integrity cut: **build serialization** (dependency-free `scripts/with-build-lock.mjs` — one O_EXCL lockfile at `node_modules/.prism-build.lock` serializing every emit/test leaf so concurrent compilers can never expose a partial live `dist/`, stale-PID reclaim, env-overridable `PRISM_BUILD_LOCK_TIMEOUT_MS`, fail-closed; documented direct-`tsc` caveat), **corrected workspace coverage denominators** (package-local `--test-coverage-include=dist/**` so imported core `dist` no longer pollutes workspace rows — `mcp` 45.47→90.25, `rag` 19.70→94.82; evidence-based per-package thresholds in `scripts/coverage-thresholds.json` with `protectedException` for durable-leg packages shown separately, machine-readable `scripts/coverage-summary.json`), **machine-auditable release skip manifest** (`scripts/release-skip-manifest.mjs` → `scripts/release-evidence.json`: every surface recorded `pass`/`skip`/`blocked`/`protected` with reason and required env; the 33 protected/live skips named; a required surface without evidence records `blocked` and fails the release gate fail-closed — missing credentials/services can never convert into a green release), and **stabilized quality gates** (Biome 2.x `preset` config migration with zero lint diagnostics, the racy 150ms MCP bridge timing assert replaced by a deterministic barrier, load-sensitive guards carry documented `ponytail:` ceilings, machine-readable `lint-report.sarif` + `unused-report.json` retained by CI); no runtime contract delta (compat gate at 0.2.3: version literal only), no migration; then plan 022 the concurrent-state-and-durability-integrity cut: atomic model-budget reservation (`ModelRouterStateStore.reserveBudget`/`commitBudget`/`releaseBudget` with fencing tokens, `reservationTtlMs` expiry and unknown-usage reconciliation, rate/budget key-map caps with LRU eviction that never drops a held reservation), atomic conversation metadata (`SessionRecord.version` + `appendSession` `expectedVersion` CAS across Postgres/SQLite — create-only `0`, exact-version `N>0`, legacy last-write-wins when omitted; `SessionMetadataConflictError` `metadata_conflict` with versions only, HTTP 409; concurrent create/branch/archive single-statement with branch caps inside the CAS, archive wins, deleted rows never resurrect), single-consumer `EventMultiplexer` (`EventMultiplexerError` `ERR_PRISM_EVENT_MULTIPLEXER_SINGLE_CONSUMER` instead of silent queue sharing), restart-stable NATS durable consumer identity (`prism_<hmac16>` with no random suffix — crash-resumed subscribe continues from the last ack, orphaned 0.2.1 consumers reclaimed on clean stop), and bounded non-durable active-run registries (sweep + fail-closed 512 cap `ERR_PRISM_WORKFLOW_RUN_REGISTRY_OVERFLOW`); new regression surface `scripts/phase22-security.test.mjs` (4 blockers + gate accounting over built public entrypoints) + packed plain-JS `security22.mjs` consumer + the `@arnilo/prism/testing/state-concurrency-conformance` harness (7 probes across memory/Postgres/SQLite/NATS legs, no timing-only sleeps) + the `scripts/phase22-conformance.test.mjs` gate; additive-only compat (new exports only, no removals); forward-only migrations 008 (`prism_sessions.version`) and 003 (`prism_model_router_budgets.reservations`); migration `0.2.1 → 0.2.2`; then plan 021 the provider-completion-and-outbound-trust-boundaries cut: strict stream completion is the shared OpenAI-compatible default (truncated streams fail `incomplete_delta`, explicit `strictCompletion: false` opt-out), bounded success bodies via `readBoundedResponseJson` on all discovery/quota/embeddings/upload/OAuth JSON endpoints (65,536-byte ceiling, depth/property/shape caps), DNS-pinned OIDC JWKS/OPA/content fetches through the core `pinnedFetch` primitive with 3xx redirects rejected outright (private/metadata answers fail closed `ssrf_denied`), shared bounded OAuth device/token polling (`pollDeviceCodeToken`) across provider-openai and credentials-node, and the four edge fixes (Azure/Vertex credential-once, Bedrock duplicate-case/repeated-query SigV4 canonicalization, OpenAI upload failed-DELETE retention, cache `__overflow__` tokens-only); public-entrypoint threat-suite `scripts/phase21-security.test.mjs` + packed plain-JS consumer; additive-only compat (MCP transport helpers re-exported from core, no removals); migration `0.2.0 → 0.2.1`; then plan 020 the fail-closed runtime-and-sandbox-security cut on the 0.2.x review-remediation line: durable-resume decision validation in core (`assertValidAgentRunResume` — unknown decisions/malformed batches fail closed with `ERR_PRISM_DECISION_*` before any state claim, checkpoint write, or tool execution; server parser remains defense in depth), isolated work-tool subprocess environments (`@arnilo/prism-work-tools` — fixed base allow-list + explicit env + forced HOME/telemetry + late-bound per-identity tokens, 64-name/64-KiB caps, absolute binary/configDir, linear output capture), and explicit sandbox capabilities (`@arnilo/prism-coding-security` — `SandboxAdapter.capabilities` with omission-is-false fail-closed resolution, `SandboxCodingComposition.capabilities` from verified wiring, `containmentClaim` deprecated as the conservative projection; Docker reports only verified controls, native reports filesystem/process/privilege `false`); public-entrypoint security conformance (`scripts/phase20-security.test.mjs`, wired into `security:threat-suites`), packed plain-JS consumer regressions, and the sandbox-browser workflow's fail-loud Docker/native capability evidence gate — 0.2.0 never ships while a blocker is skipped; migration and rollback notes in `docs/migration.md` `0.1.7 → 0.2.0`, store-compatible with 0.1.7 in both directions; 0.1.7 was the performance-and-DX patch — dependency-free `createCacheTelemetry()` per-provider/model cache hit/miss aggregator (bounded cardinality with `__overflow__`, token counters/rates only, host-activated), host-configurable `ModelRouterSelectionPolicy` on `createModelRouter` with the reference `createCostLatencySelection` (ModelCost rank then in-memory latency EMA, default ordered behavior byte-identical), `prism providers add <name>` OpenAI-compatible provider scaffold (manifest/provider/models/cache/conformance test/docs stub, npm-name + traversal + symlink-escape validation, placeholders only), and the async `AgUiProjection` verification closeout (plan 009 Task 15 evidence recorded, no new code); plan 017 the documented breaking cut — deprecated-option removal with `docs/migration.md` `0.1.4 → 0.1.5` section and reviewed compat-baseline regeneration via `--allow-break` then `--update-baseline`: the inert provider request knobs, `RunOptions.maxToolRounds`, observational-memory flat settings keys + top-level worker aliases, `ReadToolOptions.autoResizeImages`, `INIT_PROVIDERS`; all removals fail closed naming their replacement; plan 016 internal god-module split — `agents.ts`/`contracts.ts` reorganized behind barrel re-exports with a byte-identical public entry surface, measured tree-shaking improvement in `scripts/phase16-baseline.json`, and additive `@arnilo/prism-browser` Chrome DevTools Protocol capabilities — `browser_evaluate`/`browser_observe` and `block_urls`/`unblock_urls`/`throttle`/`emulate` act actions; plan 015 dead-code and deprecation hygiene on the frozen 0.1.x line — parameterized benchmark runner `scripts/benchmark.mjs` absorbing the per-version runners, archived review-coverage evidence in `docs/_evidence/`, non-blocking unused-code sweep `npm run sweep:unused`, opt-in checkpoint persistence for loaded-skill names and read-path sets; plan 014 Alibaba provider enrichment — embeddings, video input, verified compatible-mode surface decision table; plan 013 post-release hardening — build single-flight, MCP SSE relay test, combined coverage summary, canonical manifest-count narrative, ACP modes/config persistence guidance; Phase 12 release-candidate hardening; plan 012 — freeze manifest, compatibility matrix, upgrade matrix, packed-install e2e journeys, restart-recovery evidence, capacity envelopes, security policy), exact-peer/install/tarball rules, deterministic resumable publication and publish dry-run, frozen 0.1.x compatibility and support matrix (Node/PostgreSQL/platform/provider/protocol pins and unsupported combinations, machine-checked against `scripts/phase12-freeze-manifest.json`), protected PostgreSQL gate, pinned supply-chain gates, offline tests, the 0.0.15 provider/AI-SDK/RAG/memory protected live-canary matrix, and sandbox-browser Docker/Playwright gates. 0.2.6 (plan 026 Task 7) adds the protected coding journey: `scripts/phase26-coding-journey.test.mjs` runs a packed consumer through real provider calls, a digest-pinned Docker sandbox, the durable Postgres worktree lifecycle, provider-driven ACP edits with policy approval, named checks with `diagnosticDelta`, patch review over the server ArtifactService, cross-replica process recovery, durable cancellation, real GitHub PR push/reconcile/cleanup, host Playwright inspection, and the host PTY adapter (frozen profile) — the retained `scripts/phase26-coding-journey-report.json` gates release evidence (pass/blocked/protected, never a passing skip).
 - [Migrate 0.4 to 0.5](migrate-to-0.5.md): the complete 0.5.x migration guide (plans 055–066) — 0.5.0 lockstep plus **0.5.1** additive request construction (`thinkingLevel` field, kernel session/cache defaults, OpenCode Go `ProviderRequirementError`) — plus rollback.
 - [Migrate legacy 0.3 packages to 0.4](migrate-to-0.4.md): complete breaking package-reorganization guide — all retired package/import mappings, profile replacements, optional peers and host binaries, security boundaries, rollback, and npm `legacy`/deprecation lifecycle.
 - [0.1.0 / 1.0 readiness gates](0.1.0-readiness.md): command-per-gate 1.0 readiness table — frozen API surface + compat gate, migration/docs tripwires, budget table, live-suite matrix, security matrix, current-line status (**0.2.5** current line; 0.1.7 terminal 0.1.x baseline), signed-publication/live-canary prerequisites for 1.0, and Phase 12 demand-evidence entry criteria.
@@ -180,15 +180,15 @@ The generated inventory below derives from [`scripts/package-truth.json`](../scr
 
 | package | version | notes |
 | --- | --- | --- |
-| `@arnilo/prism` | 0.5.3 | core — runtime, CLI/RPC, templates, docs |
-| `@arnilo/prism-coding-tools` | 0.5.3 | family — /agent, /security, /document-reader, /openapi, /computer-use-linux, /dev, /caveman, /ponytail, /impeccable subpaths |
-| `@arnilo/prism-core` | 0.5.3 | family — /runtime, /sessions, /governance, /credentials, /enterprise, /work, /validation subpaths |
-| `@arnilo/prism-providers` | 0.5.3 | family — all provider adapters as `/<adapter>` subpaths |
-| `@arnilo/prism-acp-agent` | 0.5.3 | capability — ACP adapter |
-| `@arnilo/prism-ag-ui` | 0.5.3 | capability — AG-UI/A2A/A2UI adapter |
-| `@arnilo/prism-mcp` | 0.5.3 | capability — MCP client/server/OAuth interop |
-| `@arnilo/prism-memory` | 0.5.3 | capability — memory plus /rag, /compaction/*, /graft, /wiki subpaths |
-| `@arnilo/prism-office` | 0.5.3 | capability — /documents, /sheets, /diagrams subpaths |
-| `@arnilo/prism-web-tools` | 0.5.3 | capability — Brave/Exa/Firecrawl plus peer-gated /browser and /obscura subpaths |
+| `@arnilo/prism` | 0.5.4 | core — runtime, CLI/RPC, templates, docs |
+| `@arnilo/prism-coding-tools` | 0.5.4 | family — /agent, /security, /document-reader, /openapi, /computer-use-linux, /dev, /caveman, /ponytail, /impeccable subpaths |
+| `@arnilo/prism-core` | 0.5.4 | family — /runtime, /sessions, /governance, /credentials, /enterprise, /work, /validation subpaths |
+| `@arnilo/prism-providers` | 0.5.4 | family — all provider adapters as `/<adapter>` subpaths |
+| `@arnilo/prism-acp-agent` | 0.5.4 | capability — ACP adapter |
+| `@arnilo/prism-ag-ui` | 0.5.4 | capability — AG-UI/A2A/A2UI adapter |
+| `@arnilo/prism-mcp` | 0.5.4 | capability — MCP client/server/OAuth interop |
+| `@arnilo/prism-memory` | 0.5.4 | capability — memory plus /rag, /compaction/*, /graft, /wiki subpaths |
+| `@arnilo/prism-office` | 0.5.4 | capability — /documents, /sheets, /diagrams subpaths |
+| `@arnilo/prism-web-tools` | 0.5.4 | capability — Brave/Exa/Firecrawl plus peer-gated /browser and /obscura subpaths |
 <!-- generated:package-truth:inventory end -->
 

package/docs/migrate-to-0.5.md

@@ -1,6 +1,6 @@
 # Migrate Prism 0.4 to 0.5
 
-> **Status: 0.5.3** (tool-result content fold, additive on the 2026-09-08 `v0.5.2` tag). 0.5.0 covers plans 055–065. 0.5.1 adds kernel provider-request construction. 0.5.2 coalesces stream tokens.
+> **Status: 0.5.4** (run-limit HARD split from host policy on the 2026-09-08 `v0.5.3` tag). 0.5.0 covers plans 055–065. 0.5.1 adds kernel provider-request construction. 0.5.2 coalesces stream tokens. 0.5.3 folds content-only tool results.
 
 ## What changes
 
@@ -126,6 +126,16 @@ What to do:
 4. Custom generate sites should call `applyDefaultProviderRequestOptions(request, { sessionId, thinkingLevel })`.
 5. Nothing persisted changes. Session/cache keys are correlation ids, never secrets.
 
+## 9. Run limits: HARD vs host policy (plan 067 / 0.5.4, export-shape break)
+
+- **Removed export:** `HARD_MAX_RUN_COST` (delete the import; no replacement — `maxCost` now accepts any finite non-negative amount).
+- **Reshaped export:** `HARD_RUN_LIMITS` is now `{ maxRequestBytes: 67108864, maxResponseBytes: 67108864 }` — the only process-safety caps (a giant provider frame cannot OOM the host). Product axes have no hard cap; hosts size them per workload.
+- **New capability:** `RunLimits` policy axes (`maxTurns`, `maxProviderAttempts`, `maxToolRounds`, `maxToolCalls`, `maxWallTimeMs`, `maxInputTokens`, `maxOutputTokens`, `maxTotalTokens`) accept `number | null`. `null` disables the axis; omitted keys resolve to `DEFAULT_RUN_LIMITS` (unchanged fence: 16/24/8/32/120s/8 MiB/40k/10k/50k). Byte axes reject `null` and values above 64 MiB.
+- **New type:** `ResolvedRunLimits` (`resolveRunLimits` return; policy axes `number | null`).
+- **Resolution rules:** narrowing-only is kept — `null` acts as +Infinity, so agent `16` + run `null` → `16`; an omitted `maxProviderAttempts` lifts to `max(24, maxTurns)` (or `null` when `maxTurns` is `null`); explicitly set attempts lift only when both are finite.
+- **Durable state:** runs with `maxWallTimeMs: null` persist checkpoints without `deadlineAt`; older checkpoints with a deadline still resume under it.
+- **Documented ceiling:** vendors that omit usage charge zero to token counters; a configured `maxCost` stays the fail-closed envelope (missing/mixed-currency cost breaches immediately).
+
 ## Upgrade steps
 
 1. Bump every `@arnilo/*` dependency/peer to `^0.5.1` (0.5.0 hosts: `^0.5.0` still works until you want construction).

package/docs/migration.md

@@ -1,5 +1,9 @@
 # Migration guide
 
+## 0.5.3 → 0.5.4 (export-shape break in `@arnilo/prism`)
+
+Run-limit process ceilings split from host policy (plan 067). `HARD_RUN_LIMITS` shrinks to the two process-safety axes (`maxRequestBytes`/`maxResponseBytes`, 64 MiB) and `HARD_MAX_RUN_COST` is removed — delete imports; no replacement exists because product axes have no hard cap. `RunLimits` policy axes (turns, attempts, tool rounds/calls, wall time, tokens) now accept `number | null`, where `null` explicitly disables the axis and omitted keys keep the `DEFAULT_RUN_LIMITS` fence; byte axes reject `null`. Resolution stays narrowing-only (`null` acts as +Infinity), an omitted `maxProviderAttempts` lifts to at least a raised/disabled `maxTurns`, and the former `$10k` `maxCost` ceiling is gone (any finite non-negative amount is valid). `resolveRunLimits` returns the new `ResolvedRunLimits` type (policy axes `number | null`). Durable run state without a wall limit omits `deadlineAt`; older checkpoints carrying one still resume with it. `DEFAULT_RUN_LIMITS` values and all breach semantics are unchanged.
+
 ## 0.5.2 → 0.5.3 (additive)
 
 Content-only tool results fold onto `tool_result.result` at construction. Serializers join sibling `type:text` blocks when `result` is missing, so coding tools that return `content` (not `value`) no longer reach the model as JSON `"null"`. No import, store, or peer-range break; bump `@arnilo/prism*` to `^0.5.3`.

package/docs/provider-packages.md

@@ -25,26 +25,26 @@ Do not use provider packages as a package manager, credential store, env loader,
 
 | adapter package | version |
 | --- | --- |
-| `@arnilo/prism-providers/ai-sdk` | 0.5.3 |
-| `@arnilo/prism-providers/alibaba` | 0.5.3 |
-| `@arnilo/prism-providers/anthropic` | 0.5.3 |
-| `@arnilo/prism-providers/azure` | 0.5.3 |
-| `@arnilo/prism-providers/bedrock` | 0.5.3 |
-| `@arnilo/prism-providers/clinepass` | 0.5.3 |
-| `@arnilo/prism-providers/commandcode` | 0.5.3 |
-| `@arnilo/prism-providers/deepseek` | 0.5.3 |
-| `@arnilo/prism-providers/google` | 0.5.3 |
-| `@arnilo/prism-providers/hyper` | 0.5.3 |
-| `@arnilo/prism-providers/kimi` | 0.5.3 |
-| `@arnilo/prism-providers/model-discovery` | 0.5.3 |
-| `@arnilo/prism-providers/neuralwatt` | 0.5.3 |
-| `@arnilo/prism-providers/ollama` | 0.5.3 |
-| `@arnilo/prism-providers/openai` | 0.5.3 |
-| `@arnilo/prism-providers/opencode-go` | 0.5.3 |
-| `@arnilo/prism-providers/openrouter` | 0.5.3 |
-| `@arnilo/prism-providers/vertex` | 0.5.3 |
-| `@arnilo/prism-providers/xai` | 0.5.3 |
-| `@arnilo/prism-providers/zai` | 0.5.3 |
+| `@arnilo/prism-providers/ai-sdk` | 0.5.4 |
+| `@arnilo/prism-providers/alibaba` | 0.5.4 |
+| `@arnilo/prism-providers/anthropic` | 0.5.4 |
+| `@arnilo/prism-providers/azure` | 0.5.4 |
+| `@arnilo/prism-providers/bedrock` | 0.5.4 |
+| `@arnilo/prism-providers/clinepass` | 0.5.4 |
+| `@arnilo/prism-providers/commandcode` | 0.5.4 |
+| `@arnilo/prism-providers/deepseek` | 0.5.4 |
+| `@arnilo/prism-providers/google` | 0.5.4 |
+| `@arnilo/prism-providers/hyper` | 0.5.4 |
+| `@arnilo/prism-providers/kimi` | 0.5.4 |
+| `@arnilo/prism-providers/model-discovery` | 0.5.4 |
+| `@arnilo/prism-providers/neuralwatt` | 0.5.4 |
+| `@arnilo/prism-providers/ollama` | 0.5.4 |
+| `@arnilo/prism-providers/openai` | 0.5.4 |
+| `@arnilo/prism-providers/opencode-go` | 0.5.4 |
+| `@arnilo/prism-providers/openrouter` | 0.5.4 |
+| `@arnilo/prism-providers/vertex` | 0.5.4 |
+| `@arnilo/prism-providers/xai` | 0.5.4 |
+| `@arnilo/prism-providers/zai` | 0.5.4 |
 <!-- generated:package-truth:providers end -->
 
 

package/docs/release-and-install.md

@@ -2,7 +2,7 @@
 
 ## What it does
 
-Prism's current **0.5.x** line has **10 publishable manifests**: the root `@arnilo/prism` core package plus **9 workspace packages** — **19 provider adapters** (19 provider adapter subpaths inside the `@arnilo/prism-providers` family), 3 `prism-*` family/profile packages, and 6 capability packages. (Generated by `node scripts/package-truth.mjs` → `scripts/package-truth.json` — the manifest-derived single source for counts, provider membership, umbrella closures, and profile closures.) The last lockstep cut was 0.3.0; Decision B now publishes changed packages independently inside `^0.3.0` — the plan 039 changed-package cut moved root `@arnilo/prism` and every plan-035+ changed package to **0.3.1**, and the plan 050 changed-package cut moved root plus four changed packages to **0.3.2**; the plan 041-044 changed-package cut moves root to **0.3.3** with `@arnilo/prism-memory@0.3.2` (composite recall scoring), `@arnilo/prism-evals@0.3.1` (trace-to-dataset curation), the three session-store packages at **0.3.1** (run-ledger `promptVersion` provenance), and the initial `@arnilo/prism-prompts@0.0.1` (independent opt-in, outside `prism-all`); plan 054 consolidation then folded `@arnilo/prism-browser` and `@arnilo/prism-obscura` into the `@arnilo/prism-web-tools` family as `/browser` and `/obscura` subpaths, folded `@arnilo/prism-rag`, both compaction strategies, `@arnilo/prism-graft`, and `@arnilo/prism-wiki` into the `@arnilo/prism-memory` family as `/rag`, `/compaction/llm`, `/compaction/observational-memory`, `/graft`, and `/wiki` subpaths (deleting the `@arnilo/prism-compaction` profile), and folded all 17 `@arnilo/prism-provider-*` packages into the `@arnilo/prism-providers` family as `/<adapter>` subpaths (Azure/Bedrock/Vertex stop being special all-only manifests); independent publication continues inside `^0.3.0` ranges (which satisfy 0.3.1, 0.3.2, and 0.3.3). This page describes how they are packed, what each tarball contains, how to install them, the required non-optional **caret** `@arnilo/prism@^0.5.3` peer range, the release workflow, and the offline test budget. The measurable 1.0 readiness gates (command-per-gate) live in [`0.1.0-readiness.md`](./0.1.0-readiness.md).
+Prism's current **0.5.x** line has **10 publishable manifests**: the root `@arnilo/prism` core package plus **9 workspace packages** — **19 provider adapters** (19 provider adapter subpaths inside the `@arnilo/prism-providers` family), 3 `prism-*` family/profile packages, and 6 capability packages. (Generated by `node scripts/package-truth.mjs` → `scripts/package-truth.json` — the manifest-derived single source for counts, provider membership, umbrella closures, and profile closures.) The last lockstep cut was 0.3.0; Decision B now publishes changed packages independently inside `^0.3.0` — the plan 039 changed-package cut moved root `@arnilo/prism` and every plan-035+ changed package to **0.3.1**, and the plan 050 changed-package cut moved root plus four changed packages to **0.3.2**; the plan 041-044 changed-package cut moves root to **0.3.3** with `@arnilo/prism-memory@0.3.2` (composite recall scoring), `@arnilo/prism-evals@0.3.1` (trace-to-dataset curation), the three session-store packages at **0.3.1** (run-ledger `promptVersion` provenance), and the initial `@arnilo/prism-prompts@0.0.1` (independent opt-in, outside `prism-all`); plan 054 consolidation then folded `@arnilo/prism-browser` and `@arnilo/prism-obscura` into the `@arnilo/prism-web-tools` family as `/browser` and `/obscura` subpaths, folded `@arnilo/prism-rag`, both compaction strategies, `@arnilo/prism-graft`, and `@arnilo/prism-wiki` into the `@arnilo/prism-memory` family as `/rag`, `/compaction/llm`, `/compaction/observational-memory`, `/graft`, and `/wiki` subpaths (deleting the `@arnilo/prism-compaction` profile), and folded all 17 `@arnilo/prism-provider-*` packages into the `@arnilo/prism-providers` family as `/<adapter>` subpaths (Azure/Bedrock/Vertex stop being special all-only manifests); independent publication continues inside `^0.3.0` ranges (which satisfy 0.3.1, 0.3.2, and 0.3.3). This page describes how they are packed, what each tarball contains, how to install them, the required non-optional **caret** `@arnilo/prism@^0.5.4` peer range, the release workflow, and the offline test budget. The measurable 1.0 readiness gates (command-per-gate) live in [`0.1.0-readiness.md`](./0.1.0-readiness.md).
 
 Core `@arnilo/prism` ships runtime, CLI, templates, and docs. Every code package has a required `@arnilo/prism` peer inside the Decision B window — the caret current spec is `@arnilo/prism@^0.3.3` and every declared window peer satisfies it: packages republishing in the plan 050 cut carry `^0.3.2`; the plan 039 set keeps `^0.3.1`; unchanged packages keep their `^0.3.0` peer; profiles are pure manifests. The plan 050 republished set declares the required `@arnilo/prism@^0.3.2` peer; the plan 041-044 republished set keeps its existing `^0.3.0` window peer; unchanged packages keep their prior window. Installation activates no provider, listener, database, browser, credential, or tool capability.
 
@@ -11,16 +11,16 @@ Core `@arnilo/prism` ships runtime, CLI, templates, and docs. Every code package
 
 | package | version | notes |
 | --- | --- | --- |
-| `@arnilo/prism` | 0.5.3 | core — runtime, CLI/RPC, templates, docs |
-| `@arnilo/prism-coding-tools` | 0.5.3 | family — /agent, /security, /document-reader, /openapi, /computer-use-linux, /dev, /caveman, /ponytail, /impeccable subpaths |
-| `@arnilo/prism-core` | 0.5.3 | family — /runtime, /sessions, /governance, /credentials, /enterprise, /work, /validation subpaths |
-| `@arnilo/prism-providers` | 0.5.3 | family — all provider adapters as `/<adapter>` subpaths |
-| `@arnilo/prism-acp-agent` | 0.5.3 | capability — ACP adapter |
-| `@arnilo/prism-ag-ui` | 0.5.3 | capability — AG-UI/A2A/A2UI adapter |
-| `@arnilo/prism-mcp` | 0.5.3 | capability — MCP client/server/OAuth interop |
-| `@arnilo/prism-memory` | 0.5.3 | capability — memory plus /rag, /compaction/*, /graft, /wiki subpaths |
-| `@arnilo/prism-office` | 0.5.3 | capability — /documents, /sheets, /diagrams subpaths |
-| `@arnilo/prism-web-tools` | 0.5.3 | capability — Brave/Exa/Firecrawl plus peer-gated /browser and /obscura subpaths |
+| `@arnilo/prism` | 0.5.4 | core — runtime, CLI/RPC, templates, docs |
+| `@arnilo/prism-coding-tools` | 0.5.4 | family — /agent, /security, /document-reader, /openapi, /computer-use-linux, /dev, /caveman, /ponytail, /impeccable subpaths |
+| `@arnilo/prism-core` | 0.5.4 | family — /runtime, /sessions, /governance, /credentials, /enterprise, /work, /validation subpaths |
+| `@arnilo/prism-providers` | 0.5.4 | family — all provider adapters as `/<adapter>` subpaths |
+| `@arnilo/prism-acp-agent` | 0.5.4 | capability — ACP adapter |
+| `@arnilo/prism-ag-ui` | 0.5.4 | capability — AG-UI/A2A/A2UI adapter |
+| `@arnilo/prism-mcp` | 0.5.4 | capability — MCP client/server/OAuth interop |
+| `@arnilo/prism-memory` | 0.5.4 | capability — memory plus /rag, /compaction/*, /graft, /wiki subpaths |
+| `@arnilo/prism-office` | 0.5.4 | capability — /documents, /sheets, /diagrams subpaths |
+| `@arnilo/prism-web-tools` | 0.5.4 | capability — Brave/Exa/Firecrawl plus peer-gated /browser and /obscura subpaths |
 <!-- generated:package-truth:inventory end -->
 
 
@@ -29,26 +29,26 @@ Core `@arnilo/prism` ships runtime, CLI, templates, and docs. Every code package
 
 | adapter package | version |
 | --- | --- |
-| `@arnilo/prism-providers/ai-sdk` | 0.5.3 |
-| `@arnilo/prism-providers/alibaba` | 0.5.3 |
-| `@arnilo/prism-providers/anthropic` | 0.5.3 |
-| `@arnilo/prism-providers/azure` | 0.5.3 |
-| `@arnilo/prism-providers/bedrock` | 0.5.3 |
-| `@arnilo/prism-providers/clinepass` | 0.5.3 |
-| `@arnilo/prism-providers/commandcode` | 0.5.3 |
-| `@arnilo/prism-providers/deepseek` | 0.5.3 |
-| `@arnilo/prism-providers/google` | 0.5.3 |
-| `@arnilo/prism-providers/hyper` | 0.5.3 |
-| `@arnilo/prism-providers/kimi` | 0.5.3 |
-| `@arnilo/prism-providers/model-discovery` | 0.5.3 |
-| `@arnilo/prism-providers/neuralwatt` | 0.5.3 |
-| `@arnilo/prism-providers/ollama` | 0.5.3 |
-| `@arnilo/prism-providers/openai` | 0.5.3 |
-| `@arnilo/prism-providers/opencode-go` | 0.5.3 |
-| `@arnilo/prism-providers/openrouter` | 0.5.3 |
-| `@arnilo/prism-providers/vertex` | 0.5.3 |
-| `@arnilo/prism-providers/xai` | 0.5.3 |
-| `@arnilo/prism-providers/zai` | 0.5.3 |
+| `@arnilo/prism-providers/ai-sdk` | 0.5.4 |
+| `@arnilo/prism-providers/alibaba` | 0.5.4 |
+| `@arnilo/prism-providers/anthropic` | 0.5.4 |
+| `@arnilo/prism-providers/azure` | 0.5.4 |
+| `@arnilo/prism-providers/bedrock` | 0.5.4 |
+| `@arnilo/prism-providers/clinepass` | 0.5.4 |
+| `@arnilo/prism-providers/commandcode` | 0.5.4 |
+| `@arnilo/prism-providers/deepseek` | 0.5.4 |
+| `@arnilo/prism-providers/google` | 0.5.4 |
+| `@arnilo/prism-providers/hyper` | 0.5.4 |
+| `@arnilo/prism-providers/kimi` | 0.5.4 |
+| `@arnilo/prism-providers/model-discovery` | 0.5.4 |
+| `@arnilo/prism-providers/neuralwatt` | 0.5.4 |
+| `@arnilo/prism-providers/ollama` | 0.5.4 |
+| `@arnilo/prism-providers/openai` | 0.5.4 |
+| `@arnilo/prism-providers/opencode-go` | 0.5.4 |
+| `@arnilo/prism-providers/openrouter` | 0.5.4 |
+| `@arnilo/prism-providers/vertex` | 0.5.4 |
+| `@arnilo/prism-providers/xai` | 0.5.4 |
+| `@arnilo/prism-providers/zai` | 0.5.4 |
 <!-- generated:package-truth:providers end -->
 
 
@@ -137,7 +137,7 @@ A packed tarball contains only public compiled output and release files:
 - Code packages ship `README.md`, `LICENSE`, and `CHANGELOG.md`; family/profile packages ship `README.md` and `CHANGELOG.md`.
 - The core tarball additionally ships the full `docs/` directory (the docs hub), `templates/init/`, and the `templates/` gallery (e.g. `deep-research`) used by `prism init`.
 - `dist/cli.js` and the `bin` link in core.
-- **Tarball filenames.** npm strips the `@scope/` prefix, so the core package `@arnilo/prism` produces a tarball named `arnilo-prism-0.5.3.tgz`; family packages produce `arnilo-prism-core-0.5.3.tgz`, `arnilo-prism-coding-tools-0.5.3.tgz`, `arnilo-prism-providers-0.5.3.tgz` (all 19 adapters inside), `arnilo-prism-memory-0.5.3.tgz`, `arnilo-prism-web-tools-0.5.3.tgz`, and `arnilo-prism-office-0.5.3.tgz`; capability packages like `arnilo-prism-mcp-0.5.3.tgz` carry their own package version. Independent-package tags carry their own version. The CLI bin name `prism` is unaffected by the package name (`npx prism` still works; npm allows the bin field to differ from the package name).
+- **Tarball filenames.** npm strips the `@scope/` prefix, so the core package `@arnilo/prism` produces a tarball named `arnilo-prism-0.5.4.tgz`; family packages produce `arnilo-prism-core-0.5.4.tgz`, `arnilo-prism-coding-tools-0.5.4.tgz`, `arnilo-prism-providers-0.5.4.tgz` (all 19 adapters inside), `arnilo-prism-memory-0.5.4.tgz`, `arnilo-prism-web-tools-0.5.4.tgz`, and `arnilo-prism-office-0.5.4.tgz`; capability packages like `arnilo-prism-mcp-0.5.4.tgz` carry their own package version. Independent-package tags carry their own version. The CLI bin name `prism` is unaffected by the package name (`npx prism` still works; npm allows the bin field to differ from the package name).
 
 Excluded from every tarball by `files` negation:
 

package/docs/runs-and-usage.md

@@ -59,7 +59,7 @@ await session.run("Summarize", {
 });
 ```
 
-Defaults/hard caps are respectively: turns 16/64, provider attempts 24/256, tool rounds 8/64, tool calls 32/256, wall time 120 seconds/30 minutes, request and response bytes 8/64 MiB, input tokens 40,000/1,000,000, output tokens 10,000/250,000, total tokens 50,000/1,000,000, and cost 10,000 currency units. Integer values must be positive safe integers. Cost needs a finite non-negative amount plus one currency; when cost is limited, absent, non-finite, or mixed-currency provider cost fails closed.
+Defaults are the unconfigured fence (OWASP LLM10): turns 16, provider attempts 24, tool rounds 8, tool calls 32, wall time 120 seconds, request and response bytes 8 MiB each, input tokens 40,000, output tokens 10,000, total tokens 50,000. Hard process ceilings exist only for request/response bytes (64 MiB each), so a bug cannot OOM the host through a giant provider frame; those two axes reject `null`. Every other axis is host policy (0.5.4): omit a key for the default, set a positive safe integer sized to the workload, or set `null` to disable the axis — overnight sessions raise turns/wall/tokens, and a disabled wall still honors `RunOptions.signal`. Resolution stays narrowing-only: `RunOptions.limits` may lower `AgentConfig.limits`, `null` acts as +Infinity (agent 16 + run `null` → 16), and a raised/disabled `maxTurns` lifts an omitted `maxProviderAttempts` (default 24) to at least `maxTurns` so attempts cannot undercut turns; explicitly set attempts values are lifted only when both are finite. Cumulative token counters are billed usage across the whole run, not the context window (`contextBudget` governs window compaction). For production, prefer an explicit `maxCost`: cost needs a finite non-negative amount plus one currency, and when cost is limited, absent, non-finite, or mixed-currency provider cost fails closed. Vendors that omit usage charge zero to the token counters (local/Ollama report none), so a configured `maxCost` is the fail-closed envelope for usage-less vendors.
 
 Prism charges turns before assembly, provider attempts and request bytes before generation, response bytes per provider event, tool rounds before a batch, tool calls before dispatch, and usage before another turn. A breach stops new work, aborts active work through the run signal, emits exactly one redacted `run_limit_exceeded` event/ledger row, and throws `AgentRunError` with `result.limit` (`limit`, `maximum`, `observed`, optional `currency`). Provider-reported token/cost totals arrive after generation, so that completed provider turn can be the unavoidable overshoot boundary.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arnilo/prism",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "Agent harness for AI providers, agents, sessions, and tools.",
   "type": "module",
   "main": "./dist/index.js",