@arnilo/prism 0.5.3 → 0.5.5

package/CHANGELOG.md

@@ -1,3 +1,16 @@
+## [0.5.5] - 2026-09-08
+
+### Fixed
+- **Byte limits are per-frame, not cumulative.** `maxRequestBytes`/`maxResponseBytes` now compare each individual provider frame (request payload, streamed event) against the cap instead of a run-lifetime byte sum, so long autonomous coding runs (many megabyte-scale frames, each far under 64 MiB) no longer trip `Run limit exceeded: maxRequestBytes` after ~40 turns. HARD stays per-frame process safety — one giant frame still fails, 40 legal frames never do. Cumulative byte counters remain in snapshots/telemetry; token/turn/wall/cost axes stay cumulative.
+
+## [0.5.4] - 2026-09-08 (plan 067)
+
+### Changed
+- **Run limits: process-safety HARD split from host policy.** `DEFAULT_RUN_LIMITS` stays the unconfigured fence (turns 16, attempts 24, tool rounds 8, calls 32, wall 120s, bytes 8 MiB, tokens 40k/10k/50k), but `HARD_RUN_LIMITS` shrinks to the two process-integrity axes (`maxRequestBytes`/`maxResponseBytes`, 64 MiB) so a bug cannot OOM the host through a giant provider frame — and hosts can legally raise or disable everything else. Policy axes accept `number | null`: omit for the default, set a positive safe integer, or set `null` to disable the axis (disabled wall still honors `RunOptions.signal`). Resolution stays narrowing-only with `null` as +Infinity (agent 16 + run `null` → 16); an omitted `maxProviderAttempts` lifts to at least a raised/disabled `maxTurns` so attempts cannot undercut turns. Byte axes reject `null` and >64 MiB. The former `$10k` `maxCost` ceiling is removed (any finite non-negative amount). Documented ceiling: vendors that omit usage charge zero to token counters; a configured `maxCost` remains fail-closed. Durable checkpoints omit `deadlineAt` on no-wall runs; older checkpoints with a deadline still resume. New `ResolvedRunLimits` type; `resolveRunLimits` returns it.
+
+### Removed
+- **`HARD_MAX_RUN_COST` export** (was a `$10k` validation ceiling; `maxCost` now accepts any finite non-negative amount plus one currency).
+
 ## [0.5.3] - 2026-09-08
 
 ### Fixed

package/README.md

@@ -162,16 +162,16 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 
 | package | version | notes |
 | --- | --- | --- |
-| `@arnilo/prism` | 0.5.3 | core — runtime, CLI/RPC, templates, docs |
-| `@arnilo/prism-coding-tools` | 0.5.3 | family — /agent, /security, /document-reader, /openapi, /computer-use-linux, /dev, /caveman, /ponytail, /impeccable subpaths |
-| `@arnilo/prism-core` | 0.5.3 | family — /runtime, /sessions, /governance, /credentials, /enterprise, /work, /validation subpaths |
-| `@arnilo/prism-providers` | 0.5.3 | family — all provider adapters as `/<adapter>` subpaths |
-| `@arnilo/prism-acp-agent` | 0.5.3 | capability — ACP adapter |
-| `@arnilo/prism-ag-ui` | 0.5.3 | capability — AG-UI/A2A/A2UI adapter |
-| `@arnilo/prism-mcp` | 0.5.3 | capability — MCP client/server/OAuth interop |
-| `@arnilo/prism-memory` | 0.5.3 | capability — memory plus /rag, /compaction/*, /graft, /wiki subpaths |
-| `@arnilo/prism-office` | 0.5.3 | capability — /documents, /sheets, /diagrams subpaths |
-| `@arnilo/prism-web-tools` | 0.5.3 | capability — Brave/Exa/Firecrawl plus peer-gated /browser and /obscura subpaths |
+| `@arnilo/prism` | 0.5.5 | core — runtime, CLI/RPC, templates, docs |
+| `@arnilo/prism-coding-tools` | 0.5.5 | family — /agent, /security, /document-reader, /openapi, /computer-use-linux, /dev, /caveman, /ponytail, /impeccable subpaths |
+| `@arnilo/prism-core` | 0.5.5 | family — /runtime, /sessions, /governance, /credentials, /enterprise, /work, /validation subpaths |
+| `@arnilo/prism-providers` | 0.5.5 | family — all provider adapters as `/<adapter>` subpaths |
+| `@arnilo/prism-acp-agent` | 0.5.5 | capability — ACP adapter |
+| `@arnilo/prism-ag-ui` | 0.5.5 | capability — AG-UI/A2A/A2UI adapter |
+| `@arnilo/prism-mcp` | 0.5.5 | capability — MCP client/server/OAuth interop |
+| `@arnilo/prism-memory` | 0.5.5 | capability — memory plus /rag, /compaction/*, /graft, /wiki subpaths |
+| `@arnilo/prism-office` | 0.5.5 | capability — /documents, /sheets, /diagrams subpaths |
+| `@arnilo/prism-web-tools` | 0.5.5 | capability — Brave/Exa/Firecrawl plus peer-gated /browser and /obscura subpaths |
 <!-- generated:package-truth:inventory end -->
 
 ## Scripts

package/dist/agent-run-state.d.ts

@@ -28,7 +28,8 @@ export interface StoredAgentRunState extends AgentRunState {
     readonly stickyDecisions?: readonly StickyDecision[];
     readonly interruptBeforeTool?: boolean;
     readonly counters: RunLimitCounters;
-    readonly deadlineAt: string;
+    /** Wall deadline; absent when the run has no wall limit. Old snapshots with a deadline still parse. */
+    readonly deadlineAt?: string;
     /** Loop-local durable state captured by the strategy's snapshot hook at suspension. */
     readonly loopState?: {
         readonly name: string;
@@ -84,7 +85,7 @@ export declare function initialAgentRunState(input: {
     readonly leafId?: string;
     readonly model: ModelConfig;
     readonly counters: RunLimitCounters;
-    readonly deadlineAt: string;
+    readonly deadlineAt?: string;
     readonly status: "suspended" | "running";
     readonly interruption?: AgentRunInterruption;
     readonly messages?: readonly Message[];

package/dist/agent-run-state.js

@@ -165,8 +165,7 @@ export function parseAgentRunState(value, version) {
         !state.sessionId ||
         !state.model ||
         !state.status ||
-        !state.counters ||
-        !state.deadlineAt) {
+        !state.counters) {
         throw new AgentRunStateError("Malformed agent run state");
     }
     if (state.pendingCalls !== undefined &&

package/dist/agent-session/session/assemble.js

@@ -106,7 +106,8 @@ async function assembleRoundContext(params) {
     for (const message of inputMessages)
         await session.appendMessage(message, runId);
     await session.autoCompact(runId, options, controller.signal, inputMessages);
-    const maxToolRounds = resolveRunLimits(session.agent.config.limits, options.limits).maxToolRounds;
+    // Disabled cap (`null`) maps to +Infinity so loop comparisons never trip (`n >= null` would be true).
+    const maxToolRounds = resolveRunLimits(session.agent.config.limits, options.limits).maxToolRounds ?? Number.POSITIVE_INFINITY;
     const systemInstructions = composeSystemPrompt(mergeSystemPromptConfig(session.agent.config.systemPrompt, options.systemPrompt), {
         base: session.agent.config.instructions,
     });
@@ -317,7 +318,8 @@ export async function executeRun(session, input, options, runId, resumed) {
         deadlineAt: resumed?.state?.deadlineAt,
     });
     session.activeLimits = limits;
-    session.activeLimitOutputBuffer = [session.agent.config.limits, requestedLimits].some((value) => value?.maxOutputTokens !== undefined || value?.maxTotalTokens !== undefined || value?.maxCost !== undefined);
+    const hasFiniteTokenCap = (value) => typeof value === "number" && Number.isFinite(value);
+    session.activeLimitOutputBuffer = [session.agent.config.limits, requestedLimits].some((value) => hasFiniteTokenCap(value?.maxOutputTokens) || hasFiniteTokenCap(value?.maxTotalTokens) || value?.maxCost !== undefined);
     try {
         const ctx = await assembleRoundContext({
             session,

package/dist/contracts-core/run-limits.d.ts

@@ -2,17 +2,39 @@
  * Moved verbatim from contracts-core.ts; public surface unchanged behind the barrel. */
 import type { ProviderTurnResult, ToolResult } from "../contracts-protocol.js";
 import type { Message, ToolCallContent } from "./content.js";
+/**
+ * Host-authored run limits. Policy axes accept `null` to explicitly disable the cap
+ * (process safety still caps request/response bytes, which reject `null`). Omitted keys
+ * resolve to `DEFAULT_RUN_LIMITS`.
+ */
 export interface RunLimits {
-    readonly maxTurns?: number;
-    readonly maxProviderAttempts?: number;
-    readonly maxToolRounds?: number;
-    readonly maxToolCalls?: number;
-    readonly maxWallTimeMs?: number;
+    readonly maxTurns?: number | null;
+    readonly maxProviderAttempts?: number | null;
+    readonly maxToolRounds?: number | null;
+    readonly maxToolCalls?: number | null;
+    readonly maxWallTimeMs?: number | null;
     readonly maxRequestBytes?: number;
     readonly maxResponseBytes?: number;
-    readonly maxInputTokens?: number;
-    readonly maxOutputTokens?: number;
-    readonly maxTotalTokens?: number;
+    readonly maxInputTokens?: number | null;
+    readonly maxOutputTokens?: number | null;
+    readonly maxTotalTokens?: number | null;
+    readonly maxCost?: {
+        readonly amount: number;
+        readonly currency: string;
+    };
+}
+/** Fully resolved limits after `resolveRunLimits`: every policy axis is a finite cap or `null` (disabled). */
+export interface ResolvedRunLimits {
+    readonly maxTurns: number | null;
+    readonly maxProviderAttempts: number | null;
+    readonly maxToolRounds: number | null;
+    readonly maxToolCalls: number | null;
+    readonly maxWallTimeMs: number | null;
+    readonly maxRequestBytes: number;
+    readonly maxResponseBytes: number;
+    readonly maxInputTokens: number | null;
+    readonly maxOutputTokens: number | null;
+    readonly maxTotalTokens: number | null;
     readonly maxCost?: {
         readonly amount: number;
         readonly currency: string;

package/dist/index.d.ts

@@ -88,7 +88,7 @@ export { createDefaultRetryPolicy, isTransientErrorInfo, waitForRetry } from "./
 export type { BatchedRunLedgerOptions } from "./run-ledger.js";
 export { createBatchedRunLedger, DEFAULT_LEDGER_BATCH_BYTES, DEFAULT_LEDGER_BATCH_DELAY_MS, DEFAULT_LEDGER_BATCH_ENTRIES, HARD_LEDGER_BATCH_BYTES, HARD_LEDGER_BATCH_DELAY_MS, HARD_LEDGER_BATCH_ENTRIES, isFlushableRunLedger, } from "./run-ledger.js";
 export type { RunLimitTrackerOptions } from "./run-limits.js";
-export { createRunLimitTracker, DEFAULT_RUN_LIMITS, HARD_MAX_RUN_COST, HARD_RUN_LIMITS, RunLimitError, RunLimitTracker, resolveRunLimits, } from "./run-limits.js";
+export { createRunLimitTracker, DEFAULT_RUN_LIMITS, HARD_RUN_LIMITS, RunLimitError, RunLimitTracker, resolveRunLimits, } from "./run-limits.js";
 export { createSecureAgent } from "./secure-agent.js";
 export type { PermissionDecision, PermissionPolicy, PermissionRequest, TrustDecision, TrustPolicy, TrustRequest } from "./security.js";
 export { assertPermission, assertTrusted, checkPermission, createStaticPermissionPolicy, createStaticTrustPolicy, denialToErrorInfo, isTrusted, PermissionDeniedError, TrustDeniedError, } from "./security.js";
@@ -119,5 +119,5 @@ export { trimTrailingSlashes } from "./trim-trailing-slashes.js";
 export type { ResolvedUseCaseModel, ResolveUseCaseModelInput, UseCaseModelBinding, } from "./use-case-model.js";
 export { resolveUseCaseModel, resolveUseCaseModelBinding, useCaseCredentialProviderId, } from "./use-case-model.js";
 export declare const name = "prism";
-export declare const version = "0.5.3";
+export declare const version = "0.5.5";
 export declare const description = "Agent harness for AI providers, agents, sessions, and tools.";

package/dist/index.js

@@ -47,7 +47,7 @@ export { createSecretRedactor, errorToErrorInfo, redactAgentEvent, redactMessage
 export { loadBinaryResource, loadJsonResource, loadManifestResource, loadTextResource } from "./resources.js";
 export { createDefaultRetryPolicy, isTransientErrorInfo, waitForRetry } from "./retry.js";
 export { createBatchedRunLedger, DEFAULT_LEDGER_BATCH_BYTES, DEFAULT_LEDGER_BATCH_DELAY_MS, DEFAULT_LEDGER_BATCH_ENTRIES, HARD_LEDGER_BATCH_BYTES, HARD_LEDGER_BATCH_DELAY_MS, HARD_LEDGER_BATCH_ENTRIES, isFlushableRunLedger, } from "./run-ledger.js";
-export { createRunLimitTracker, DEFAULT_RUN_LIMITS, HARD_MAX_RUN_COST, HARD_RUN_LIMITS, RunLimitError, RunLimitTracker, resolveRunLimits, } from "./run-limits.js";
+export { createRunLimitTracker, DEFAULT_RUN_LIMITS, HARD_RUN_LIMITS, RunLimitError, RunLimitTracker, resolveRunLimits, } from "./run-limits.js";
 export { createSecureAgent } from "./secure-agent.js";
 export { assertPermission, assertTrusted, checkPermission, createStaticPermissionPolicy, createStaticTrustPolicy, denialToErrorInfo, isTrusted, PermissionDeniedError, TrustDeniedError, } from "./security.js";
 export { createMemorySessionStore, createSessionEntry, getSessionBranchEntries, listSessionBranches, rebuildSessionContext, } from "./session-stores.js";
@@ -66,6 +66,6 @@ export { createToolParameterValidator, createToolRegistry, dispatchToolCall, fil
 export { trimTrailingSlashes } from "./trim-trailing-slashes.js";
 export { resolveUseCaseModel, resolveUseCaseModelBinding, useCaseCredentialProviderId, } from "./use-case-model.js";
 export const name = "prism";
-export const version = "0.5.3";
+export const version = "0.5.5";
 export const description = "Agent harness for AI providers, agents, sessions, and tools.";
 //# sourceMappingURL=index.js.map

package/dist/run-limits.d.ts

@@ -1,7 +1,25 @@
-import type { RunLimitBreach, RunLimitCounters, RunLimitName, RunLimits, Usage } from "./contracts.js";
-export declare const DEFAULT_RUN_LIMITS: Required<Omit<RunLimits, "maxCost">>;
-export declare const HARD_MAX_RUN_COST = 10000;
-export declare const HARD_RUN_LIMITS: Required<Omit<RunLimits, "maxCost">>;
+import type { ResolvedRunLimits, RunLimitBreach, RunLimitCounters, RunLimitName, RunLimits, Usage } from "./contracts.js";
+export declare const DEFAULT_RUN_LIMITS: Readonly<{
+    maxTurns: 16;
+    maxProviderAttempts: 24;
+    maxToolRounds: 8;
+    maxToolCalls: 32;
+    maxWallTimeMs: 120000;
+    maxRequestBytes: number;
+    maxResponseBytes: number;
+    maxInputTokens: 40000;
+    maxOutputTokens: 10000;
+    maxTotalTokens: 50000;
+}>;
+/**
+ * Process-safety ceilings that exist so a bug cannot OOM the host via JSON.parse of giant
+ * provider frames. Product axes (turns, wall time, tokens, …) have no hard cap: hosts set
+ * them per workload, and `null` explicitly disables an axis.
+ */
+export declare const HARD_RUN_LIMITS: Readonly<{
+    maxRequestBytes: number;
+    maxResponseBytes: number;
+}>;
 export declare class RunLimitError extends Error {
     readonly breach: RunLimitBreach;
     readonly code = "ERR_PRISM_RUN_LIMIT";
@@ -14,16 +32,17 @@ export interface RunLimitTrackerOptions {
     readonly deadlineAt?: string;
 }
 /** Validate one host-authored layer. Defaults are applied only after inheritance is resolved. */
-export declare function resolveRunLimits(agent?: RunLimits, run?: RunLimits): Readonly<Required<Omit<RunLimits, "maxCost">> & Pick<RunLimits, "maxCost">>;
+export declare function resolveRunLimits(agent?: RunLimits, run?: RunLimits): Readonly<ResolvedRunLimits>;
 export declare class RunLimitTracker {
     private readonly options;
-    readonly limits: Readonly<Required<Omit<RunLimits, "maxCost">> & Pick<RunLimits, "maxCost">>;
+    readonly limits: Readonly<ResolvedRunLimits>;
     private readonly startedAt;
-    readonly deadlineAt: string;
+    /** Wall deadline ISO string; absent when the run has no wall limit. */
+    readonly deadlineAt: string | undefined;
     private readonly counters;
     private timer?;
     private exceeded?;
-    constructor(limits: Readonly<Required<Omit<RunLimits, "maxCost">> & Pick<RunLimits, "maxCost">>, options?: RunLimitTrackerOptions);
+    constructor(limits: Readonly<ResolvedRunLimits>, options?: RunLimitTrackerOptions);
     get breach(): RunLimitBreach | undefined;
     snapshot(): RunLimitCounters;
     dispose(): void;

package/dist/run-limits.js

@@ -10,20 +10,17 @@ export const DEFAULT_RUN_LIMITS = Object.freeze({
     maxOutputTokens: 10_000,
     maxTotalTokens: 50_000,
 });
-export const HARD_MAX_RUN_COST = 10_000;
+/**
+ * Process-safety ceilings that exist so a bug cannot OOM the host via JSON.parse of giant
+ * provider frames. Product axes (turns, wall time, tokens, …) have no hard cap: hosts set
+ * them per workload, and `null` explicitly disables an axis.
+ */
 export const HARD_RUN_LIMITS = Object.freeze({
-    maxTurns: 64,
-    maxProviderAttempts: 256,
-    maxToolRounds: 64,
-    maxToolCalls: 256,
-    maxWallTimeMs: 30 * 60_000,
     maxRequestBytes: 64 * 1024 * 1024,
     maxResponseBytes: 64 * 1024 * 1024,
-    maxInputTokens: 1_000_000,
-    maxOutputTokens: 250_000,
-    maxTotalTokens: 1_000_000,
 });
 const LIMIT_NAMES = Object.keys(DEFAULT_RUN_LIMITS);
+const POLICY_NAMES = LIMIT_NAMES.filter((name) => name !== "maxRequestBytes" && name !== "maxResponseBytes");
 const COUNTER_FOR = {
     maxTurns: "turns",
     maxProviderAttempts: "providerAttempts",
@@ -46,16 +43,44 @@ export class RunLimitError extends Error {
         this.name = "RunLimitError";
     }
 }
+/** `null` means "no cap" and behaves as +Infinity when narrowing against a finite layer. */
+function minCap(a, b) {
+    if (a === undefined)
+        return b;
+    if (b === undefined)
+        return a;
+    if (a === null)
+        return b;
+    if (b === null)
+        return a;
+    return Math.min(a, b);
+}
 /** Validate one host-authored layer. Defaults are applied only after inheritance is resolved. */
 export function resolveRunLimits(agent, run) {
     const base = agent ? validateLimits(agent) : undefined;
     const override = run ? validateLimits(run) : undefined;
     const resolved = { ...DEFAULT_RUN_LIMITS };
-    for (const name of LIMIT_NAMES) {
+    for (const name of POLICY_NAMES) {
+        const narrowed = minCap(base?.[name], override?.[name]);
+        resolved[name] = narrowed !== undefined ? narrowed : DEFAULT_RUN_LIMITS[name];
+    }
+    for (const name of ["maxRequestBytes", "maxResponseBytes"]) {
         if (base?.[name] !== undefined)
-            resolved[name] = base[name];
+            resolved[name] = Math.min(resolved[name], base[name]);
         if (override?.[name] !== undefined)
-            resolved[name] = base ? Math.min(resolved[name], override[name]) : override[name];
+            resolved[name] = Math.min(resolved[name], override[name]);
+    }
+    // A raised/disabled maxTurns must not be silently undercut by the attempts default:
+    // generate-then-tool-loop needs at least one attempt per turn (plus retries).
+    if (base?.maxProviderAttempts === undefined && override?.maxProviderAttempts === undefined) {
+        const turns = resolved.maxTurns;
+        resolved.maxProviderAttempts = turns === null ? null : Math.max(DEFAULT_RUN_LIMITS.maxProviderAttempts, turns);
+    }
+    else {
+        const attempts = resolved.maxProviderAttempts;
+        const turns = resolved.maxTurns;
+        if (attempts !== null && turns !== null && attempts < turns)
+            resolved.maxProviderAttempts = turns;
     }
     const maxCost = override?.maxCost ?? base?.maxCost;
     return Object.freeze({
@@ -80,14 +105,21 @@ function validateLimits(input) {
         const value = input[name];
         if (value === undefined)
             continue;
-        if (!Number.isSafeInteger(value) || value < 1 || value > HARD_RUN_LIMITS[name]) {
-            throw new TypeError(`${name} must be a positive safe integer at most ${HARD_RUN_LIMITS[name]}`);
+        if (name === "maxRequestBytes" || name === "maxResponseBytes") {
+            // Process-safety axes: a giant frame cannot be host-approved away, so `null` is rejected.
+            if (value === null || !Number.isSafeInteger(value) || value < 1 || value > HARD_RUN_LIMITS[name])
+                throw new TypeError(`${name} must be a positive safe integer at most ${HARD_RUN_LIMITS[name]}`);
+            continue;
         }
+        if (value === null)
+            continue;
+        if (!Number.isSafeInteger(value) || value < 1)
+            throw new TypeError(`${name} must be a positive safe integer or null to disable`);
     }
     if (input.maxCost) {
         const { amount, currency } = input.maxCost;
-        if (!Number.isFinite(amount) || amount < 0 || amount > HARD_MAX_RUN_COST || !currency.trim())
-            throw new TypeError(`maxCost requires a finite amount from 0 through ${HARD_MAX_RUN_COST} and currency`);
+        if (!Number.isFinite(amount) || amount < 0 || !currency.trim())
+            throw new TypeError("maxCost requires a finite non-negative amount and currency");
     }
     return input;
 }
@@ -95,6 +127,7 @@ export class RunLimitTracker {
     options;
     limits;
     startedAt = performance.now();
+    /** Wall deadline ISO string; absent when the run has no wall limit. */
     deadlineAt;
     counters;
     timer;
@@ -121,21 +154,46 @@ export class RunLimitTracker {
                 throw new TypeError("Run limit snapshot must contain finite non-negative counters");
             }
         }
-        const deadline = options.deadlineAt ? Date.parse(options.deadlineAt) : Date.now() + limits.maxWallTimeMs;
-        if (!Number.isFinite(deadline))
-            throw new TypeError("Run limit deadlineAt is invalid");
-        this.deadlineAt = new Date(deadline).toISOString();
-        const remaining = Math.max(0, deadline - Date.now());
-        this.timer = setTimeout(() => this.exceed("maxWallTimeMs", limits.maxWallTimeMs), remaining);
-        this.timer.unref?.();
-        if (remaining === 0)
-            this.exceed("maxWallTimeMs", limits.maxWallTimeMs);
+        // A restored durable deadline wins even when the wall limit is now disabled (never drop an existing wall).
+        const deadline = options.deadlineAt
+            ? Date.parse(options.deadlineAt)
+            : limits.maxWallTimeMs === null
+                ? undefined
+                : Date.now() + limits.maxWallTimeMs;
+        if (deadline === undefined) {
+            this.deadlineAt = undefined;
+        }
+        else {
+            if (!Number.isFinite(deadline))
+                throw new TypeError("Run limit deadlineAt is invalid");
+            this.deadlineAt = new Date(deadline).toISOString();
+            const remaining = Math.max(0, deadline - Date.now());
+            // Node clamps setTimeout delays above 2^31-1 (~24.8 days) to 1ms, which would breach early;
+            // arm capped and re-check the real clock before exceeding.
+            const arm = (delay) => {
+                this.timer = setTimeout(() => {
+                    const left = deadline - Date.now();
+                    if (left > 0)
+                        arm(Math.min(left, 2_147_483_647));
+                    else
+                        this.exceed("maxWallTimeMs", limits.maxWallTimeMs ?? 0);
+                }, delay);
+                this.timer.unref?.();
+            };
+            arm(Math.min(remaining, 2_147_483_647));
+            if (remaining === 0)
+                this.exceed("maxWallTimeMs", limits.maxWallTimeMs ?? 0);
+        }
     }
     get breach() {
         return this.exceeded;
     }
     snapshot() {
-        return { ...this.counters, wallTimeMs: Math.min(this.limits.maxWallTimeMs, Math.ceil(performance.now() - this.startedAt)) };
+        const elapsed = Math.ceil(performance.now() - this.startedAt);
+        return {
+            ...this.counters,
+            wallTimeMs: this.limits.maxWallTimeMs === null ? elapsed : Math.min(this.limits.maxWallTimeMs, elapsed),
+        };
     }
     dispose() {
         if (this.timer)
@@ -150,8 +208,14 @@ export class RunLimitTracker {
         if (!Number.isSafeInteger(observed))
             this.exceed(limit, Number.MAX_SAFE_INTEGER + 1);
         this.counters[counter] = observed;
-        if (observed > this.limits[limit])
-            this.exceed(limit, observed);
+        const cap = this.limits[limit];
+        if (cap === null)
+            return;
+        // Byte caps are per-frame (HARD exists so one giant provider frame cannot OOM the host),
+        // not run-lifetime sums; every other axis stays cumulative.
+        const against = limit === "maxRequestBytes" || limit === "maxResponseBytes" ? delta : observed;
+        if (against > cap)
+            this.exceed(limit, against);
     }
     recordUsage(usage) {
         if (!usage) {
@@ -183,7 +247,7 @@ export class RunLimitTracker {
     }
     exceed(limit, observed) {
         if (!this.exceeded) {
-            const maximum = limit === "maxCost" ? (this.limits.maxCost?.amount ?? 0) : this.limits[limit];
+            const maximum = limit === "maxCost" ? (this.limits.maxCost?.amount ?? 0) : (this.limits[limit] ?? 0);
             this.exceeded = {
                 limit,
                 maximum,

package/docs/agent-session-runtime.md

@@ -47,7 +47,7 @@ string | Message | readonly Message[]
 
 `AgentSessionConfig.store` overrides `AgentConfig.store`; otherwise the session gets a private memory store. `AgentSessionConfig.leafId` selects the branch leaf to resume from.
 
-`AgentConfig.limits` sets run ceilings; `RunOptions.limits` may only narrow configured agent values. Limits cover turns, provider attempts, tool rounds/calls, wall time, request/response bytes, tokens, and optional single-currency cost. A breach emits one `run_limit_exceeded` event and throws `AgentRunError` with `result.limit`; see [Runs and usage ledger](runs-and-usage.md#run-limits).
+`AgentConfig.limits` sets run ceilings; `RunOptions.limits` may only narrow configured agent values (`null` counts as no cap, so a configured finite ceiling still wins). Limits cover turns, provider attempts, tool rounds/calls, wall time, request/response bytes, tokens, and optional single-currency cost. Policy axes accept `null` (0.5.4) to disable the axis; request/response bytes reject `null` and stay process-hard at 64 MiB. A breach emits one `run_limit_exceeded` event and throws `AgentRunError` with `result.limit`; see [Runs and usage ledger](runs-and-usage.md#run-limits).
 
 `RunOptions.model` can override the request model for a run. Model overrides append a `model_change` entry. `AgentConfig.inputLayout` selects the default input assembly layout (`"cache_aware"` by default, or opt-in `"legacy"`); `RunOptions.inputLayout` wins for one run. `AgentConfig.thinkingLevel` / `RunOptions.thinkingLevel` (run wins) is the session thinking intent — Prism snaps it onto the request after host `providerOptions`. `AgentConfig.providerOptions`/`RunOptions.providerOptions` supply generic provider request options (session/cache/header/compat/extra hints only — provider-level timeout/retry hints were removed in 0.1.5). Kernel construction always stamps `options.sessionId`/`cacheKey` from `session.id` when missing; `createSessionCachePolicy` is an overlay, not required. Use `RunOptions.signal`/host abort controllers for timeouts and `AgentConfig.retry`/`RunOptions.retry` for retry. `AgentConfig.providerRequestPolicies`/`RunOptions.providerRequestPolicies` run before `AIProvider.generate()` and before `provider_request` middleware. `AgentConfig.systemPrompt` and `RunOptions.systemPrompt` add explicit layered system prompt contributions; `RunOptions.systemPrompt: false` disables configured prompt layers for that run while keeping `AgentConfig.instructions` as the base path. `RunOptions.compaction` can enable auto-compaction for that run or use `false` to disable configured auto-compaction. `RunOptions.retry` can enable provider-turn retry for that run or use `false` to disable configured retry. `RunOptions.metadata` is merged with agent/session metadata for assembly, provider requests, and tool contexts. Run tool-round limits via `RunOptions.limits.maxToolRounds`. `RunOptions.signal` is bridged into the per-run abort signal passed to assembly, providers, tools, auto-compaction, and retry backoff.
 

package/docs/credential-storage.md

@@ -269,5 +269,5 @@ MCP credentials remain host inputs: resolve them before constructing client `req
 - [Azure OpenAI / Foundry](providers/azure.md) / [Amazon Bedrock](providers/bedrock.md) / [Google Vertex AI](providers/vertex.md): enterprise workload-identity credential callbacks
 - [Web search, fetch, and extraction](web-tools.md): late-bound Brave/Exa/Firecrawl credentials
 - [Security/auth/trust](settings-auth-trust-security.md): host-owned settings/credentials boundaries
-- [Persistence, credentials, and multimodality primitives](persistence-credentials-multimodality-primitives.md): Plan 056 threat model and conformance matrix rows 7–10
+- [Persistence, credentials, and multimodality primitives](history/persistence-credentials-multimodality-primitives.md): Plan 056 threat model and conformance matrix rows 7–10
 - `@arnilo/prism`: `CredentialResolver`, `OAuthCredentialStore`, `createMemoryCredentialStore()`

package/docs/graft.md

@@ -105,7 +105,7 @@ await kernel.load([
 - Import alone registers nothing (`sideEffects: false`); no timers, watchers, or network. The only child processes are budgeted graft CLI calls.
 - Retrieval happens in-process via Prism primitives (context provider, injector, tool_result middleware) — no external hook shims.
 - Ask result shape is parsed tolerantly (`nodes|results|matches|hits`) because graft is pre-1.0; formatters emit pointers (`title` + `file:line` + `[[wikilink]]`), never source bodies.
-- Not included in `@arnilo/prism-coding-tools`, `@arnilo/prism-core`, or the `prism-all` umbrella (deliberate opt-out, like Caveman/Ponytail) — opt-in install only.
+- Deliberate opt-out from family/umbrella packaging (like Caveman/Ponytail) — opt-in install only.
 - Multi-repo layouts work as upstream graft defines them (workspaces, submodules with `--follow-submodules`, sibling repos); point `projectDir` at the graft root that owns the target repo.
 
 ## Security and performance notes

package/docs/{0.1.0-readiness.md → history/0.1.0-readiness.md}

@@ -1,6 +1,6 @@
 # 0.1.0 / 1.0 Readiness Gates
 
-Status: **0.5.3** is the current release line (10 active packages, family subpaths, `^0.5.3` peers); **0.3.3** was the terminal 0.3.x cut; **0.1.7** was the terminal 0.1.x baseline; **1.0** readiness remains operator-gated, not automatic.
+Status: **0.5.4** is the current release line (10 active packages, family subpaths, `^0.5.4` peers); **0.3.3** was the terminal 0.3.x cut; **0.1.7** was the terminal 0.1.x baseline; **1.0** readiness remains operator-gated, not automatic.
 
 This page distills runnable readiness gates into one command-per-gate table.
 The **Last evidence** column records the 0.1.0-tree snapshot (plan 012 Tasks
@@ -10,17 +10,17 @@ the release tree before cutting 1.0. The decision to cut 1.0 stays with the
 operator after operator-gated legs run in a protected environment and Phase
 12 demand evidence exists.
 
-Evidence trail: [`docs/_evidence/review-coverage-2026-07-26-phase-11.md`](./_evidence/review-coverage-2026-07-26-phase-11.md)
-(addenda 0–9), [`docs/release-and-install.md`](./release-and-install.md),
-[`docs/migration.md`](./migration.md), [`docs/performance.md`](./performance.md),
-[`docs/public-contracts.md`](./public-contracts.md) (frozen 0.1.x contract).
-The per-phase review-coverage evidence archive lives in [`docs/_evidence/`](./_evidence/)
+Evidence trail: [`docs/_evidence/review-coverage-2026-07-26-phase-11.md`](.././_evidence/review-coverage-2026-07-26-phase-11.md)
+(addenda 0–9), [`docs/release-and-install.md`](.././release-and-install.md),
+[`docs/migration.md`](.././migration.md), [`docs/performance.md`](.././performance.md),
+[`docs/public-contracts.md`](.././public-contracts.md) (frozen 0.1.x contract).
+The per-phase review-coverage evidence archive lives in [`docs/_evidence/`](.././_evidence/)
 (plans 067–079, releases 0.0.4–0.0.16; tarball-excluded, kept in-repo for audit).
 Historical release lines (0.0.16 floor → 0.0.27 Phase 10 ACP interop → 0.1.0)
 keep their per-phase evidence in the pages above; this page records the 0.2.6
 snapshot (plan 026) with the 0.1.x tables below as the historical record.
 
-## Current line (0.5.3)
+## Current line (0.5.4)
 
 | Item | Status |
 |---|---|
@@ -82,7 +82,7 @@ material in published artifacts) and exact version-range drift. A genuine break
 requires `--allow-break` **and** a `docs/migration.md` entry mentioning the
 version. The frozen 0.1.x contract (declaration/exports, events, protocol
 payloads, migration checksums, patch-release compatibility promise) is
-published in [docs/public-contracts.md](public-contracts.md).
+published in [docs/public-contracts.md](../public-contracts.md).
 
 **Baseline maintenance:** `scripts/compat-baseline/` must stay committed.
 Regenerate only after review with `node scripts/release.mjs gate --update-baseline`,

package/docs/history/README.md

@@ -0,0 +1,11 @@
+# Documentation archive
+
+Historical records kept verbatim for audit and freeze tests. Not read on the
+hot path — do not link these pages from current-contract docs; link the live
+page instead and note the archive where provenance matters.
+
+- `migration-0.0.md` … `migration-0.4.md`: per-era release migrations (the live [migration guide](../migration.md) keeps 0.5.x only).
+- `release-handoffs.md`: operator publish handoffs per release line (the live [release and install](../release-and-install.md) page keeps current install, inventory, gates, and peer policy).
+- `migrate-to-0.4.md`: retired 0.3-era package reorganization guide (current line: [migrate-to-0.5.md](../migrate-to-0.5.md)).
+- `0.1.0-readiness.md`: frozen 0.1.x readiness record.
+- `persistence-credentials-multimodality-primitives.md`, `workflow-orchestration-primitives.md`, `workflow-tui-primitives.md`: plan-era primitive-review inventories.

package/docs/{migrate-to-0.4.md → history/migrate-to-0.4.md}

@@ -306,7 +306,7 @@ API page says so.
 
 ## Related APIs
 
-- [Release and install](release-and-install.md): package contents, peer rules, and publication.
-- [Migration guide](migration.md): migration history for prior releases.
-- [Provider packages](provider-packages.md): provider adapter behavior.
-- [Host security guide](host-security.md): preserve host trust boundaries while upgrading.
+- [Release and install](../release-and-install.md): package contents, peer rules, and publication.
+- [Migration guide](../migration.md): migration history for prior releases.
+- [Provider packages](../provider-packages.md): provider adapter behavior.
+- [Host security guide](../host-security.md): preserve host trust boundaries while upgrading.