@arnilo/prism 0.5.3 → 0.5.5

package/docs/{workflow-orchestration-primitives.md → history/workflow-orchestration-primitives.md}

@@ -16,7 +16,7 @@ Interactive TUI (**C-012**) is **out of scope** for Plan 057 and deferred. Workf
 
 ## When to use it
 
-- **Workflow package authors** should start here, then follow [Agent/session runtime](agent-session-runtime.md), [Agent loops](agent-loops.md), [Runs and usage ledger](runs-and-usage.md), [CLI/RPC](cli-rpc.md), and [Database persistence](database-persistence.md).
+- **Workflow package authors** should start here, then follow [Agent/session runtime](../agent-session-runtime.md), [Agent loops](../agent-loops.md), [Runs and usage ledger](../runs-and-usage.md), [CLI/RPC](../cli-rpc.md), and [Database persistence](../database-persistence.md).
 - **Host authors** use CLI/RPC and `CommandDefinition` as the non-interactive control seam for start/status/cancel/resume.
 - **Core maintainers** own generic `CheckpointStore` and `EventMultiplexer`; workflow node/DAG vocabulary remains outside core.
 - **Security reviewers** use the threat model and design matrix on this page as the acceptance baseline for Plan 057 Tasks 2–7.
@@ -593,14 +593,14 @@ await session.run("Hi", { signal: AbortSignal.timeout(60_000) });
 
 ## Related APIs
 
-- [Agent/session runtime](agent-session-runtime.md): single-session run surface workflow nodes call.
-- [Agent loops](agent-loops.md): within-node validate/revise; custom `AgentLoopStrategy` for function-equivalent behavior.
-- [Agent events](agent-events.md): per-session stream workflow may observe/merge.
-- [CLI/RPC](cli-rpc.md): non-interactive host seam for optional workflow commands.
-- [Runs and usage ledger](runs-and-usage.md): durable audit for workflow and agent runs.
-- [Database persistence](database-persistence.md): optional generic `CheckpointStore` capability implemented by first-party persistence adapters.
+- [Agent/session runtime](../agent-session-runtime.md): single-session run surface workflow nodes call.
+- [Agent loops](../agent-loops.md): within-node validate/revise; custom `AgentLoopStrategy` for function-equivalent behavior.
+- [Agent events](../agent-events.md): per-session stream workflow may observe/merge.
+- [CLI/RPC](../cli-rpc.md): non-interactive host seam for optional workflow commands.
+- [Runs and usage ledger](../runs-and-usage.md): durable audit for workflow and agent runs.
+- [Database persistence](../database-persistence.md): optional generic `CheckpointStore` capability implemented by first-party persistence adapters.
 - [Persistence, credentials, and multimodality primitives](persistence-credentials-multimodality-primitives.md): Plan 056 inventory baseline.
-- [Tool execution primitives](tool-execution-primitives.md): `ExecutionPolicy` and approval pattern.
-- [Host security guide](host-security.md): fail-closed checklist for workflow hosts.
-- [Performance limits](performance.md): subscriber queue defaults workflow tightens.
-- [Review coverage (2026-07-14)](_evidence/review-coverage-2026-07-14.md): C-009/C-012 traceability.
+- [Tool execution primitives](../tool-execution-primitives.md): `ExecutionPolicy` and approval pattern.
+- [Host security guide](../host-security.md): fail-closed checklist for workflow hosts.
+- [Performance limits](../performance.md): subscriber queue defaults workflow tightens.
+- [Review coverage (2026-07-14)](../_evidence/review-coverage-2026-07-14.md): C-009/C-012 traceability.

package/docs/host-security.md

@@ -214,7 +214,7 @@ PostgreSQL TLS/network policy, MCP endpoint trust/credentials and egress policy
 - **Named threat-suites leg.** `npm run security:threat-suites` aggregates the Phase 8–11 conformance suites (durable-loop/HITL approval, coding sandbox/egress/forge, ACP protocol, OIDC/OPA/MCP-OAuth/OpenAPI/artifact) into one named 0.1.0 security evidence leg — same scripts as `npm test`, no rewrite; the Phase 7 tenant-isolation suite is its protected counterpart under `npm run test:postgres` (missing `PRISM_TEST_POSTGRES_URL` is a named blocked gate). The dev-inspector leg (`scripts/phase40-security.test.mjs`, plan 040 Task 5) exercises the `@arnilo/prism-coding-tools/dev` local playground through built public entrypoints: D1 non-loopback binds refuse before any listener exists (`ERR_PRISM_DEV_REMOTE_BIND`) and loopback is the only bindable surface; D2 the host redactor scrubs secret literals from server-rendered replay payloads; D3 replay selectors outside the `resolveRun` seam's ownership fail closed 404 and replay without a durable event_source is a documented 404, never a re-execution; D4 unknown decision outcome discriminants reject `400` without consuming a run version or executing the tool, and a valid `allow_once` applies exactly once.
 - **Dev-surface boundary (plan 040 Task 5).** The `@arnilo/prism-coding-tools/dev` inspector is a developer-time tool: loopback-only by default, non-loopback requires an explicit programmatic `remoteAuthorize` callback plus a real authorizer (the CLI/bin offers no remote-bind flag at all), and it must never be the production API boundary (that stays `@arnilo/prism-core/runtime/server` under host authorization). It carries no credential storage — the host agent config owns credentials and the inspector never reads environment secrets; rendered tool args/results pass the host redactor on both the live and replay paths, and HITL decision resume composes the core `createAgentRunLifecycle` validation (fail-closed on unknown discriminants/versions/runs).
 - **Supply-chain negative fixtures.** `scripts/release-gate.test.mjs` verifies the tarball deny list rejects tampered content (plans/reviews/maps/tests), unexpected file types and credential material (native binaries, `.pem`/`.key`/`.p12`), and that a provenance flag suppressed in CI is detectable in the `release.mjs` publish dry-run arguments (`--provenance` mandatory under `GITHUB_ACTIONS`, never claimed on local OIDC-less publishes).
-- **Mandatory gate stack.** CodeQL/SAST, PR dependency review (fail on high), secret scan (source + unpacked tarballs), SPDX SBOM + license policy, tarball allow/deny content checks, and provenance (npm OIDC + GitHub build attestations on tarballs and SBOM) all run in `security.yml`/`release.yml`; evidence for the 0.1.0 tree is recorded in [0.1.0 readiness](0.1.0-readiness.md).
+- **Mandatory gate stack.** CodeQL/SAST, PR dependency review (fail on high), secret scan (source + unpacked tarballs), SPDX SBOM + license policy, tarball allow/deny content checks, and provenance (npm OIDC + GitHub build attestations on tarballs and SBOM) all run in `security.yml`/`release.yml`; evidence for the 0.1.0 tree is recorded in [0.1.0 readiness](history/0.1.0-readiness.md).
 - **CodeQL query suite.** `.github/codeql/codeql-config.yml` selects the `security-extended` suite for `javascript-typescript` (with the default suite) on push/PR/schedule in `security.yml` (10-minute job bound; measured runtime ~3m22s on the audited SHA, last successful main run `33059128198`). The ignore list covers only generated `dist`, `node_modules`, and release/security artifact directories — first-party packages, threat suites, and fixtures that ship or execute are always scanned, so new alerts enter the same plan-038 ledger/remediation loop (config + guardrails asserted in `scripts/phase38-codeql-regression.test.mjs`). Local Task 6 gates (typecheck/lint/format/threat suites/audit/secret scan/SBOM) pass on the remediations; GitHub `state=open` stays non-zero until those remediations are the analyzed head. Groups G (`js/insufficient-password-hash` on RFC 7636 S256) and H (`js/incomplete-url-substring-sanitization` on a negative docs assertion) are maintainer-reviewed false positives queued for narrow dismissal after that analyze, not code changes.
 - **Live canaries are blocked gates, not skips.** The `live-canaries` and `sandbox-browser` workflows always set their gate env (`PRISM_LIVE_CANARIES=1`), so absent credentials fail the job loudly with a named owner (the workflow + dispatching operator) and retained `canary-report.json` evidence; the local silent-skip path exists only when the gate env is not set.