@arnilo/prism 0.6.0 → 0.8.0

package/docs/host-compositions.md

@@ -0,0 +1,149 @@
+# Host compositions
+
+Prism agents are host-assembled: the host application owns credentials, providers, persistence, permissions, tool definitions, and connected-app transports. Prism provides two canonical, maintained host compositions and a zero-network inspection and readiness API to ensure host setups conform to their operational contracts:
+
+- **`personal` (`personal-assistant`)**: Local-personal host composition for single-operator productivity, personal tools, local/memory persistence, and secret redaction.
+- **`business` (`business-worker`)**: Multi-tenant enterprise worker host composition with verified tenant identity, mandatory durable storage, sandbox workspace containment, and strict governance enforcement.
+
+## Profiles
+
+| Profile | Ownership | Identity | Persistence | Sandbox | Governance |
+| --- | --- | --- | --- | --- | --- |
+| `personal` | Single user (`userId`) | Optional unverified operator | Memory or durable storage | Local workspace | Optional |
+| `business` | Tenant + user (`tenantId`, `userId`) | Mandatory verified identity (`verified: true`) matching tenant | Mandatory durable store (`durable: true`); memory rejected | Contained sandbox roots within workspace | Required supported governance |
+
+## Host composition API
+
+Both helper functions and the error class are exported from `@arnilo/prism`:
+
+```ts
+import {
+  inspectHostComposition,
+  assertHostCompositionReadiness,
+  HostCompositionError,
+  type HostCompositionProfile,
+  type HostCompositionOptions,
+  type HostCompositionReport,
+} from "@arnilo/prism";
+```
+
+### `inspectHostComposition(options)`
+
+Inspects an agent configuration and returns a typed `HostCompositionReport`. Inspection is **completely inert and performs zero network calls**. Canary secrets in credentials are never leaked.
+
+```ts
+const report = inspectHostComposition({
+  profile: "personal",
+  agent: personalAgent,
+  store: memoryStore,
+  credentialRefs: ["OPENAI_API_KEY"],
+  connectedApps: { appIds: ["slack"], serverIds: ["slack"] },
+});
+```
+
+Report structure:
+
+- `profile`: `"personal"` or `"business"`.
+- `effectiveTools`: Readonly list of tool names registered on the agent.
+- `credentialRefs`: Host credential references (sanitized, values never included).
+- `connectedApps`: Optional copied `appIds` and `serverIds` (up to 32 identifiers per list); transports, environment, headers, and tokens are never accepted or reported. Business hosts require a verified identity when this field is present.
+- `ownership`: Tenant and user ownership identifiers.
+- `storage`: Storage summary with `kind` (`"memory"`, `"postgres"`, `"sqlite"`, etc.) and `durable` boolean. Memory stores are truthfully reported with `durable: false`. `snapshotRunBundle()` ([effective run bundle snapshots](run-bundle.md)) reuses this classification for the per-run store kinds.
+- `sandbox`: Isolation status and resolved root paths.
+- `governance`: Coverage flags (authorization, trust, and custom policies).
+- `readiness`: Object with `ok: boolean` and list of `reasons` if not ready.
+
+### `assertHostCompositionReadiness(options)`
+
+Validates that the host composition satisfies all profile constraints. Throws `HostCompositionError` on the first violated rule:
+
+| Error Code | Violation |
+| --- | --- |
+| `ERR_PRISM_HOST_COMPOSITION_PROFILE` | Unknown or missing profile. |
+| `ERR_PRISM_HOST_COMPOSITION_OWNERSHIP` | Missing `userId` (personal), missing `tenantId` (business), or identity/ownership mismatch. |
+| `ERR_PRISM_HOST_COMPOSITION_STORAGE` | Non-durable or in-memory persistence passed to a business composition. |
+| `ERR_PRISM_HOST_COMPOSITION_SECRETS` | Agent lacks a configured `SecretRedactor`. |
+| `ERR_PRISM_HOST_COMPOSITION_PROVIDER` | Agent lacks an active `AIProvider` or model selection. |
+| `ERR_PRISM_HOST_COMPOSITION_SANDBOX` | Sandbox roots escape the declared `workspaceRoot`. |
+| `ERR_PRISM_HOST_COMPOSITION_GOVERNANCE` | Governance policy disabled or unsupported. |
+
+### Integration with `createSecureAgent`
+
+`createSecureAgent` accepts an optional `composition` field. When provided, readiness is asserted immediately before the agent is returned:
+
+```ts
+import { createSecureAgent } from "@arnilo/prism";
+
+const agent = createSecureAgent({
+  id: "worker-1",
+  definitionRevision: "1",
+  ownership: { tenantId: "acme-corp", userId: "worker-prod" },
+  identity: {
+    tenantId: "acme-corp",
+    userId: "worker-prod",
+    principal: { kind: "user", id: "worker-prod" },
+    scopes: ["task:execute"],
+    verified: true,
+    issuedAt: new Date().toISOString(),
+  },
+  composition: {
+    profile: "business",
+    store: postgresStore,
+    workspaceRoot: "/data/acme",
+    sandboxRoots: ["/data/acme/scratch"],
+  },
+  // ... other required secure agent options
+});
+```
+
+## Package install vs. import subpaths
+
+Always install containing packages directly. **NPM install never accepts subpaths**:
+
+```bash
+# Correct — install containing published packages:
+npm install @arnilo/prism @arnilo/prism-core @arnilo/prism-providers @arnilo/prism-work
+
+# Never install subpaths:
+# npm install @arnilo/prism-work/connectors (WRONG: fails with 404 / E404)
+```
+
+In your application code, import from documented subpaths:
+
+```ts
+// Subpaths exported by @arnilo/prism-work:
+import { createWorkTools } from "@arnilo/prism-work/connectors";
+import { createJsonSchemaArgumentValidator } from "@arnilo/prism-core/validation/json-schema";
+
+// Subpaths exported by @arnilo/prism-providers:
+import { createOpenAIProvider } from "@arnilo/prism-providers/openai";
+```
+
+## Background workers
+
+Business workers that share a durable checkpoint queue should pass `admission: { perTenant, drain }` into `createWorkflowCoordinator` and mount `createPrismOperatorHandler` beside health/drain. See [Operations runbook](operations.md) and [Workflows](workflows.md). Do not introduce a second scheduler.
+
+## Starter templates
+
+Scaffold fresh host compositions using `prism init`:
+
+```bash
+# Personal assistant composition
+prism init my-assistant --template personal-assistant
+
+# Business worker composition
+prism init my-worker --template business-worker
+```
+
+Each template produces a runnable agent, mock test fixtures, environment templates, and strict typing.
+
+## Dev inspector endpoint
+
+When running `@arnilo/prism-coding-tools/dev`, host compositions can be inspected via HTTP:
+
+```bash
+GET /inspect
+# or GET {basePath}/inspect
+```
+
+Returns the JSON serialized `HostCompositionReport` corresponding to the inspected agent and options.

package/docs/host-security.md

@@ -190,7 +190,7 @@ PostgreSQL TLS/network policy, MCP endpoint trust/credentials and egress policy
 ## Web research boundaries
 
 - Construct `@arnilo/prism-web-tools` with one host-selected Brave or Exa adapter; never expose adapter/provider/credential/schema selection to model arguments.
-- Construct `@arnilo/prism-core/integrations/work` with host-pinned CLI binary + isolated `configDir` + verified `AgentIdentity` (M365 and/or GWS). Never pass model-built command strings, `login`/`setup`/`auth`/`schema`/`--debug`, or credentials in argv. Mutations require draft approval; external recipients and anonymous/`anyone` shares fail closed.
+- Construct `@arnilo/prism-work/connectors` with host-pinned CLI binary + isolated `configDir` + verified `AgentIdentity` (M365 and/or GWS). Never pass model-built command strings, `login`/`setup`/`auth`/`schema`/`--debug`, or credentials in argv. Mutations require draft approval; external recipients and anonymous/`anyone` shares fail closed.
 - Provider API origins are fixed exact HTTPS origins and redirects fail. Credentials resolve immediately before I/O; remote bodies and secrets are excluded from errors/results/telemetry.
 - Firecrawl targets reject userinfo, non-HTTP(S), private literals, and policy-denied hosts. Supply `validateUrl` for host DNS/rebinding/egress checks. Firecrawl performs remote retrieval, so Prism cannot pin target DNS after handoff.
 - Treat every snippet, highlight, Markdown byte, metadata field, and extracted JSON value as prompt-injection-capable untrusted data. Never elevate it into system instructions or let it modify tools, permissions, trust, credentials, routing, or extraction schema.
@@ -201,7 +201,7 @@ PostgreSQL TLS/network policy, MCP endpoint trust/credentials and egress policy
 - Require `security / codeql`, `security / supply-chain`, PR dependency review, release readiness, and PostgreSQL integration in protected-branch rules. Enable GitHub secret scanning and push protection as repository settings; checked-in workflows cannot enable those service controls.
 - Actions are pinned to full commit revisions. Dependabot proposes weekly npm/action revision changes; review upstream release notes before merge rather than replacing pins with moving tags.
 - `scripts/verify-sbom.mjs` accepts only bounded SPDX 2.3 inventory with exact checked-in permissive licenses. Any missing/new expression fails until reviewed; do not widen policy merely to unblock CI.
-- `scripts/scan-secrets.mjs` checks tracked source and unpacked public tarballs for high-confidence credential/private-key forms without printing matched values. It complements GitHub secret scanning; it is not entropy scanning or DLP.
+- `scripts/scan-secrets.mjs` checks tracked source and unpacked public tarballs for high-confidence credential/private-key forms without printing matched values. It complements GitHub secret scanning; it is not entropy scanning or DLP. Local credential files are the one carve-out: `scripts/live.env` and any `*.local.env` are skipped by name because `.gitignore` already excludes them, they hold real keys by design, and CI scans the tracked set where they cannot appear (`scripts/scan-secrets.test.mjs` asserts both names are still gitignored). Every other gitignored file is scanned.
 - Tag publication alone receives npm/OIDC/attestation permissions. Untrusted pull-request code receives no canary, npm, or OIDC secret and no workflow uses `pull_request_target`.
 - Scheduled/manual canaries run only in protected `live-canaries` environment. Use dedicated read-only/low-quota credentials and provider account spend limits. Runner performs four probes, at most one MCP cleanup, one provider output token, one Brave result, 64-KiB responses, and finite timeouts; report excludes endpoints, headers, bodies, credentials, and MCP session IDs.
 - Scheduled/manual coding/browser containment checks run in protected `sandbox-browser` environment (`.github/workflows/sandbox-browser.yml`). They receive no provider/npm/OIDC secrets; Docker/Playwright enablement is variable-gated with host-preloaded digest-pinned images/binaries; uploads are redacted aggregate status only.

package/docs/hosted-sandboxes.md

@@ -0,0 +1,94 @@
+# Hosted sandboxes
+
+## What it does
+
+`createE2BSandbox` / `connectE2BSandbox` map one hosted vendor (E2B) onto the existing `DisposableSandbox` contract: `execFile`, optional `startProcess` / `attachProcess`, `pause` / `resume`, and explicit `kill`. Prism does not run hosted compute. The host owns the E2B account, template, API key, and lifecycle. Pause is the snapshot. `keepMemory: false` is filesystem-only: resume reboots and running processes are gone. `Sandbox.connect` auto-resumes a paused sandbox; this adapter never calls it unless the host calls `resume()` or passes `resume: true`.
+
+## When to use it
+
+Use this adapter when coding or process work should run in an E2B cloud sandbox rather than Docker. Use `createDockerSandbox` when you need a local digest-pinned container with `network: none`. Do not assume E2B isolation matches Docker: default capabilities report `networkIsolated` and `egressRestricted` false (E2B sandboxes have internet).
+
+## Inputs / request
+
+| Field | Required | Notes |
+| --- | --- | --- |
+| `apiKey` | unless `client` | Resolved at the SDK edge only. Never logged. |
+| `client` | unless `apiKey` | Host-injected `e2b` `Sandbox` surface for tests or a pinned SDK. |
+| `template` | no | Default `base`. Host-owned image/template. |
+| `workdir` | no | Default `/workspace`. |
+| `timeoutMs` / `limits.wallTimeMs` | no | Passed to E2B as sandbox timeout (idle/cost budget). |
+| `onTimeout` | no | `kill` (default) or `pause`. `autoResume` is always false. |
+| `labels` | no | Stored as E2B metadata for reconnect attestation. No secrets. |
+| `expectedLabels` (connect) | no | Fail-closed mismatch → wrong owner. |
+| `resume` (connect) | no | Default false. Paused sandboxes stay paused until `resume()`. |
+| `capabilities` | no | Full host attestation; omitted fields resolve false. |
+
+Optional peer: `e2b@2.49.1` (MIT). Install it or pass `client`.
+
+## Outputs / response / events
+
+`createE2BSandbox` returns a `DisposableSandbox`:
+
+- `id` is the E2B sandbox id (non-secret reconnect identity).
+- `pause({ keepMemory })` → `{ kind: "memory" \| "filesystem", state: "paused" }`. HTTP 503 (`ServiceBusyError`) leaves the sandbox **running**.
+- `resume()` calls `Sandbox.connect` (explicit).
+- `startProcess` refs are `prism-e2b-proc:<base64url>`. Filesystem-only pause makes `attachProcess` return null.
+- `stop()` pauses with memory. `kill()` / `close()` destroy the sandbox. `close({ export })` is unsupported (pause is the snapshot).
+- Default capabilities: workspace coherent, filesystem isolated from the host, process isolated; **not** network/egress/privilege isolated.
+
+## Request/response example
+
+```json
+{
+  "template": "base",
+  "timeoutMs": 600000,
+  "onTimeout": "kill",
+  "labels": { "app.owner": "alice" },
+  "pause": { "keepMemory": false }
+}
+```
+
+## Implementation example
+
+```ts
+import { connectE2BSandbox, createE2BSandbox } from "@arnilo/prism-coding-tools/security";
+
+const sandbox = await createE2BSandbox({
+  apiKey: process.env.E2B_API_KEY,
+  labels: { "app.owner": "alice" },
+  timeoutMs: 10 * 60_000,
+});
+await sandbox.execFile({ file: "/bin/echo", args: ["ok"], cwd: "/workspace" });
+await sandbox.pause!({ keepMemory: false });
+
+const again = await connectE2BSandbox({
+  apiKey: process.env.E2B_API_KEY,
+  sandboxId: sandbox.id,
+  expectedLabels: { "app.owner": "alice" },
+});
+await again.resume!();
+await again.kill();
+```
+
+## Extension and configuration notes
+
+- Detect `pause` / `startProcess` like Docker: `typeof sandbox.pause === "function"`. Absence is not an error on other backends.
+- `createE2BProcessRecoveryBackend(sandbox, { expectedSandboxId, expectedWorkspace, expectedLabels })` is the attested `ProcessRecoveryBackend`. `createProcessSessions({ sandbox })` still auto-wires `attachProcess` when present.
+- `lifecycle.autoResume` is forced false. Activity (exec, file, HTTP) must not resume paused work.
+- Paused E2B sandboxes persist until `kill()`. There is no vendor TTL; the host must delete.
+
+## Security and performance notes
+
+- Attest vendor isolation; do not copy Docker `network: none` claims. Override `capabilities` only when the host actually restricted the template/network.
+- API keys belong in `apiKey` or the injected client, never metadata, refs, labels, argv, or logs. Errors pass through `createSecretRedactor`.
+- Process refs carry sandbox id, pid, command fingerprint, and workspace — no secrets.
+- Pause duration is vendor-bound (about 4s per GiB RAM). Command output, env, and concurrent execs use the same sandbox limit caps as Docker (`maxOutputBytes`, `maxCommands`, `maxConcurrentExecs`).
+- A 503 pause refusal is not success: status stays `running`.
+- Filesystem-only resume is a reboot: in-memory state and processes are gone; do not auto-restart them.
+
+## Related APIs
+
+- [Coding execution approval and sandboxing](coding-security.md)
+- [Process sessions](process-sessions.md)
+- [Optional peer dependencies](peer-dependencies.md)
+- [Live testing](live-testing.md)

package/docs/index.md

@@ -2,9 +2,29 @@
 
 Prism is a TypeScript/Node.js agent harness. Hosts own providers, tools, credentials, storage, and behavior; Prism supplies contracts, registries, events, and replaceable runtime primitives.
 
-## Current line (0.6.0)
+## Current line (0.8.0)
 
-- **Node 22 floor**: `engines.node` is `>=22` in all ten publishable packages, the `node20-compat` CI leg becomes `node22-compat`, and `@types/node` moves to `^22.20.0` (plan 071; Node 20 is upstream EOL since 2026-04-30).
+- **Messaging channels**: `@arnilo/prism-channels` transport-neutral runtime with deny-by-default authorization, owned bindings, one-use durable approvals, official Telegram (private DMs, opt-in granted groups/topics, drafts, bounded media/voice, opt-in notices) and experimental pinned signal-cli Signal.
+- **Connected apps**: identity-bound MCP server sessions admit host-selected transports and register prefixed tools; Google Workspace and Microsoft 365 HTTP adapters live under `@arnilo/prism-work/connectors`.
+- **Work family**: `@arnilo/prism-work` replaces `@arnilo/prism-office` — connectors, documents, sheets, diagrams, document-reader, sandbox, and vendored office skills. No pre-1.0 shim.
+- **Durable long runs**: turn-boundary checkpoints with host-only `decision: "continue"`, turn-stop policy, frozen run-bundle snapshots, claim-grounding guardrail, and typed provider failure classes.
+- **Honesty surfaces**: Postgres release evidence is this-commit, channel lease release stays held until the store acknowledges, and observational-memory workers ignore non-tool events on purpose.
+- **11 publishable packages** at current **0.8.0** lockstep, with the migration guide reachable from the release section below — inventory below.
+
+### Carried from the 0.7.0 line
+
+- **Traps closed**: ACP MCP destination matching uses WHATWG origin plus path-segment subtree rules, the ACP launcher requires a real provider (mock mode is explicit), and the model-router facade refuses governance it cannot enforce (`ERR_PRISM_MODEL_ROUTER_ASYNC_REQUIRED` / `_ASYNC_STATE`).
+- **Governed host surfaces**: validated personal/business compositions, governed provider invocation with aggregate task/tenant accounting, durable business-action drafts with editable approvals, Docker process sessions and coherent workspace recovery, Drive knowledge synchronization, snapshot/reconnect with one hosted sandbox, fair worker admission, cross-layer memory lineage with correction/revocation, evidence-backed citations with import-fidelity/OCR reports, and monotonic per-run tool narrowing.
+- **Evidence cockpit**: execution timeline, workflow graph, trajectory/outcome evals (scenarios, trials, manifests), cockpit aggregations, and workflow OpenTelemetry spans — with the cross-package journey matrix behind them.
+- **Attention Compiler**: opt-in per-turn gate that mutates the transcript only after a ratio of the model input cap, with sticky thinking/tool stubs and a host-programmable compaction trigger.
+- **Memory Fabric**: opt-in typed notes (fact/procedure/file/working/episode) with links, validity windows, and time/tool recall over the working, semantic, and observational-memory engines.
+- **Work-scope memory index**: host-named work scopes (`open`/`bind`/`project`/`enter`) project the observational outline; unscoped attach keeps the 0.6.0 dropper.
+- **Host-owned subagent spawn**: `spawn_agent` over the host supervisor (allow-listed children, narrowed identity, redacted results), bounded async spawn with `wait_agent`/`cancel_agent`, opt-in per-child worktree isolation, and redacted `subagent_started`/`subagent_stopped` lifecycle events.
+- **Native Bedrock Converse and governed realtime voice**: `createBedrockConverseProvider` adds a native `Converse`/`ConverseStream` route next to the OpenAI-compatible one, with no AWS SDK dependency; realtime voice sessions stay host-governed.
+
+### Carried from the 0.6.0 line
+
+- **Node 22 floor**: `engines.node` is `>=22` in all eleven publishable packages, the `node20-compat` CI leg becomes `node22-compat`, and `@types/node` moves to `^22.20.0` (plan 071; Node 20 is upstream EOL since 2026-04-30).
 - **Folded 0.5.7 content**: the 0.5.7 cut was never published — its durable-tool-round and strict-tool-result fixes, host knobs, peer/options truth, and dependency floors ship in 0.6.0 (migration guide below).
 - **Release-truth gates**: one forward-claim version-literal gate (manifests, internal ranges, lockfile, version constant, index banner, workflow tags), a workflow-liveness gate (every script target and action reference resolves, actions SHA-pinned), and a load-tolerant startup budget ratio (plan 071).
 - **Self-describing coverage failures**: a failing coverage child prints its redacted output tail and records `status`/`exitCode`/`tail` on its artifact row (plan 071).
@@ -19,13 +39,12 @@ Prism is a TypeScript/Node.js agent harness. Hosts own providers, tools, credent
 - **Tool-result fold**: content-only `ToolResult`s fold into `tool_result.result` (0.5.3).
 - **Stream token coalesce**: adjacent text/thinking deltas merge on persist (0.5.2).
 - **Provider request construction**: kernel session/cache/thinking defaults; hosts overlay (0.5.1).
-- **10 publishable packages** at current **0.6.0** lockstep — inventory below.
 
 ## Public contracts
 
 - [Public contracts](public-contracts.md): canonical message, agent, tool, store, resource, credential, and event shapes.
-- [Coding tools, sandboxing, and personas](coding-tools.md): `@arnilo/prism-coding-tools` family subpaths — agent, security, document-reader, openapi, computer-use-linux, dev, personas.
-- [Core runtime, sessions, and governance](core.md): `@arnilo/prism-core` family subpaths — runtime, sessions, governance, credentials, enterprise, work, validation.
+- [Coding tools, sandboxing, and personas](coding-tools.md): `@arnilo/prism-coding-tools` family subpaths — agent, security, openapi, computer-use-linux, dev, personas.
+- [Core runtime, sessions, and governance](core.md): `@arnilo/prism-core` family subpaths — runtime, sessions, governance, credentials, enterprise, validation.
 - [Configuration options index](options-index.md): every public `*Options`/`*Limits`/`*Config` surface mapped to the doc page that owns its fields.
 
 ## Identity and governance
@@ -33,21 +52,23 @@ Prism is a TypeScript/Node.js agent harness. Hosts own providers, tools, credent
 - [Agent identity](agent-identity.md): host-verified `Principal`/`AgentIdentity`, delegation narrowing, redacted telemetry refs, optional OIDC verifier.
 - [Policy and audit](policy-and-audit.md): allow/deny/modify/approval decision ledger, multi-party approvals, OPA evaluator — evidence refs only.
 - [Signed, hash-chained audit export](audit-export.md): tenant-scoped signed, hash-chained audit batches with independent verification; no key storage.
-- [Model routing](model-routing.md): allow-list/residency/budget/rate/circuit/fallback governance with atomic budget reservation.
+- [Model routing](model-routing.md): allow-list/residency/budget/rate/circuit/fallback governance with atomic budget reservation, aggregate task/tenant accounting across all paid work, and fail-closed synchronous invocation boundaries.
 
 ## Agent/session runtime
 
-- [Agent/session runtime](agent-session-runtime.md): create agents/sessions, `run`/`prompt`/`steer`/`stream`, durable resume, batch approvals.
+- [Agent/session runtime](agent-session-runtime.md): create agents/sessions, `run`/`prompt`/`steer`/`stream`, durable resume, batch approvals, per-run `toolNames` narrowing.
+- [Durable runs](durable-runs.md): turn-boundary `checkpointPolicy: "every-turn"` checkpoints and `decision: "continue"` crash recovery for long runs.
 - [Agent definitions](agent-definitions.md): declarative `AgentDefinition` resolution and `AGENT.md` bundle discovery, fail-closed activation.
 - [Agent loops](agent-loops.md): replaceable loops with `limits.maxToolRounds` budgets and durable revision/restore hooks.
 - [Guardrails](guardrails.md): typed fail-closed input/output/tool checks with redacted decision records.
 - [Agent events](agent-events.md): `turn_started`/`tool_call_delta` stream plus durable page/resume sources for reconnect.
-- [Observability](observability.md): OTel GenAI span hierarchy, RAG span tree, bounded trace linkage, exporter isolation.
-- [Operations runbook](operations.md): high-availability fencing model, failover drill, replay rules; never unlock leases manually.
+- [Observability](observability.md): OTel GenAI span hierarchy, workflow spans, cockpit aggregations, RAG span tree, bounded trace linkage, exporter isolation.
+- [Execution timeline](execution-timeline.md): execution timeline projection and cockpit summaries for host dashboards and trajectory evals.
+- [Operations runbook](operations.md): high-availability fencing, fair worker admission, operator queue/cancel/reconcile; never unlock leases manually.
 - [Disaster recovery and backup operations](disaster-recovery.md): backup/restore/PITR/DR-drill runbook with guarded commands and RPO/RTO.
 - [Data classification and field-level redaction](data-classification.md): `applyFieldPolicy` allow/redact/tokenize/deny walks with fail-closed protected default.
-- [Evaluations](evaluations.md): deterministic bounded trace/model-judge/pairwise scoring with CI thresholds and trace linkage.
-- [Runs and usage ledger](runs-and-usage.md): durable run/event/usage persistence, host-raisable `RunLimits`, `CostCatalog` pricing.
+- [Evaluations](evaluations.md): trajectory/outcome scorers over execution timelines, citation-integrity invariant, workflow experiments, scenarios, repeated trials that re-run items with sample standard error, failure injection, two-field and release manifests, deterministic bounded trace/model-judge scoring.
+- [Runs and usage ledger](runs-and-usage.md): durable run/event/usage persistence, aggregate task accounting across paid work, host-raisable `RunLimits`, `CostCatalog` pricing.
 - [Performance limits](performance.md): frozen 0.1.0 capacity envelopes and network-free benchmark evidence — the performance contract.
 - [Structured output](structured-output.md): `Artifact*` seam plus provider-native `StructuredOutputOptions` for capable models.
 
@@ -55,11 +76,12 @@ Prism is a TypeScript/Node.js agent harness. Hosts own providers, tools, credent
 
 - [Compaction and retry policies](compaction-and-retry.md): host-replaceable summarize/retry policies with deprecated-option removals fail closed.
 - [LLM compaction subpath](compaction-llm.md): provider-backed summarization with finite `model.parameters.maxTokens` and coding handoff strategy.
-- [Observational memory compaction subpath](compaction-observational-memory.md): observations/reflections with `appendEntry`, exact-id recall, nested-only settings.
-- [Working and semantic memory](working-and-semantic-memory.md): working-memory store, semantic recall, pgvector path, consent lifecycle.
+- [Observational memory compaction subpath](compaction-observational-memory.md): source-backed observations/reflections, an optional work-scope index for the current working set, and exact-id recall; `invalidatedIds` withhold derived injection.
+- [Working and semantic memory](working-and-semantic-memory.md): working-memory store, semantic recall, pgvector path, consent lifecycle, lineage invalidation, parent-child share grants.
+- [Memory fabric](memory-fabric.md): opt-in typed notes (fact/procedure/file/working/episode) with validity windows over the existing vector and working stores.
 - [Session stores](session-stores.md): `SessionStore` contract, append options, branches, bounded search — start here for persistence.
 - [Conversations](conversations.md): durable user-scoped threads with versioned metadata and legal-hold-aware deletion.
-- [Work artifacts and review](work-artifacts-and-review.md): artifact attach, revision compare, approve/reject, expiring delivery links.
+- [Work artifacts and review](work-artifacts-and-review.md): artifact attach, revision compare, evidence-bound citations, approve/reject, expiring delivery links.
 - [Session stores and branching](session-stores-and-branching.md): branch-semantics helper reference (compatibility stub for session-stores.md).
 - [Database persistence](database-persistence.md): production persistence contracts, migrations, retention, and adapter conformance harnesses.
 - [SQLite persistence](sqlite-persistence.md): optional `better-sqlite3` adapter with FTS search and verified migrations.
@@ -72,6 +94,7 @@ Prism is a TypeScript/Node.js agent harness. Hosts own providers, tools, credent
 
 - [Embeddings](embeddings.md): provider-neutral batch `embedMany` contract with OpenAI-compatible and DashScope adapters.
 - [Speech and transcription](speech.md): provider-neutral synthesis and transcription contracts with streaming variants.
+- [Realtime voice](realtime-voice.md): governed OpenAI Realtime bridge into host tool dispatch, barge-in, reconnect, and transcript privacy.
 - [Image generation and editing](image-generation.md): provider-neutral generate/edit contract with OpenAI and DashScope adapters.
 - [Moderation](moderation.md): provider-neutral classification under a neutral vocabulary; scores are provider output.
 - [Batch jobs](batch-jobs.md): provider-neutral submit/status/cancel/results contract with OpenAI Files-API adapter.
@@ -84,7 +107,7 @@ Prism is a TypeScript/Node.js agent harness. Hosts own providers, tools, credent
 - [Provider request policies](provider-request-policies.md): kernel request-option defaults with host `ProviderRequestPolicy` overlays.
 - [Provider packages](provider-packages.md): all adapters as `@arnilo/prism-providers/<adapter>` subpaths; tool_result and event wire shapes stay provider-neutral.
   - First-party adapters: [`openai`](providers/openai.md), [`anthropic`](providers/anthropic.md), [`google`](providers/google.md), [`opencode-go`](providers/opencode-go.md), [`openrouter`](providers/openrouter.md), [`zai`](providers/zai.md), [`deepseek`](providers/deepseek.md), [`xai`](providers/xai.md), [`clinepass`](providers/clinepass.md), [`hyper`](providers/hyper.md), [`commandcode`](providers/commandcode.md), [`kimi`](providers/kimi.md), [`alibaba`](providers/alibaba.md), [`ollama`](providers/ollama.md), [`neuralwatt`](providers/neuralwatt.md), plus the cross-vendor `model-discovery` listing adapters on the same page.
-  - Enterprise cloud (workload identity): [`azure`](providers/azure.md) (Entra/Foundry), [`bedrock`](providers/bedrock.md) (IAM/SigV4), [`vertex`](providers/vertex.md) (ADC/Vertex).
+  - Enterprise cloud (workload identity): [`azure`](providers/azure.md) (Entra/Foundry), [`bedrock`](providers/bedrock.md) (IAM/SigV4; OpenAI-compatible or native Converse route), [`vertex`](providers/vertex.md) (ADC/Vertex).
   - Optional AI SDK adapter: [`ai-sdk`](providers/ai-sdk.md) maps host-owned pinned `LanguageModelV4` models onto Prism streams.
 - [OpenAI-compatible provider](providers/openai-compatible.md): base Chat Completions subpath with strict-completion default and vendor hooks.
 
@@ -92,42 +115,47 @@ Prism is a TypeScript/Node.js agent harness. Hosts own providers, tools, credent
 
 - [SDK customization guide](customization.md): map every replaceable seam — providers, middleware, loops, stores — to explicit host wiring.
 - [Input and prompt assembly](input-and-prompt-assembly.md): input-to-message builders, cache-aware ordering, optional context-budget eviction.
+- [Attention compiler](attention-compiler.md): opt-in per-turn gate that mutates only after a ratio of the model input cap.
 - [Multimodal content](multimodal-content.md): media resolution, SSRF/MIME policy, capability tags, video generation contract.
 - [System prompts](system-prompts.md): layered system prompts plus trust-gated `AGENTS.md`/`SYSTEM.md` file auto-load.
 - [Versioned prompt registry](prompt-registry.md): immutable content-hashed prompt assets with durable stores and bounded diff.
 - [Instruction injection](instruction-injection.md): package injectors layer redacted instructions without granting capabilities.
-- [Context and skills](context-and-skills.md): ordered context providers, progressive skill disclosure, fail-closed activation.
+- [Context and skills](context-and-skills.md): ordered context providers, progressive skill disclosure, fail-closed activation. `@arnilo/prism-work` ships `docx`, `xlsx`, `powerpoint`, `pdf`.
 - [LLM Wiki](wiki.md): optional knowledge compiler emitting OKF bundles, with `/wiki-ingest` raw staging (text, file, image, or URL via a host `fetchUrl` hook) and on-device hybrid search.
-- [Retrieval-augmented generation](rag.md): bounded source lifecycle, hybrid retrieval, reranking, citations, inert injection.
+- [Retrieval-augmented generation](rag.md): bounded source lifecycle, hybrid retrieval, permission-trimmed query legs, reranking, evidence-backed citations, inert injection.
+- [Knowledge synchronization](knowledge-sync.md): paged enterprise-source import with a Drive connector, checkpointed change cursors, and host-owned ACL mapping.
 
 ## Tools
 
 - [Recoverable tool effects](tool-effects.md): effect declarations, claim/CAS store, unknown reconciliation classifications.
-- [Tools](tools.md): host-owned tool registration, allow/deny filtering, bounded artifact-loop dispatch, progressive loading.
+- [Tools](tools.md): host-owned tool registration, allow/deny filtering, per-run `toolNames` narrowing, bounded artifact-loop dispatch, progressive loading.
 - [OpenAPI tools adapter](openapi-tools.md): compile allow-listed OpenAPI 3.1 operations into bounded, approval-gated tools.
 - [Tool execution primitives](tool-execution-primitives.md): bounded JSON Schema validation, parallel dispatch, MCP bridge mapping.
 - [Tool validator JSON Schema package](../packages/prism-core/README.md): optional `@arnilo/prism-core/validation/json-schema` adapter.
 - [MCP client bridge and server exposure](mcp-tools.md): SDK v2 bridge and serving with OAuth transports and DNS-pinned transport.
-- [Web search, fetch, and extraction](web-tools.md): Brave/Exa/Firecrawl tools with finite limits and untrusted-content boundaries.
-- [Work tools](work-tools.md): identity-scoped M365/GWS connectors — draft-then-approve, isolated subprocess environments.
+- [Connected apps](connected-apps.md): identity-bound MCP server sessions that admit host-selected transports and register prefixed tools.
+- [Web search, fetch, and extraction](web-tools.md): Brave/Exa/Firecrawl tools with finite limits, hashed web evidence snapshots, and untrusted-content boundaries.
+- [Work tools](work-tools.md): identity-scoped M365/GWS connectors — scanned file get, hash-bound uploads/copies, fixed Docs/Sheets/Slides updates, approvals, isolated subprocess environments.
 - [Work connectors](work-connectors.md): connector principles, capability gates, scoped OAuth establishment, out-of-scope boundaries.
+- [Work sandbox](work-sandbox.md): host-pinned document image and `createWorkComposition` — office/exec in an injected Docker sandbox, connectors stay on the host.
 - [Browser automation](browser-automation.md): Playwright-backed browser tools with egress policy, caps, and verified checkpoints.
 - [Device adapters](device-adapters.md): deny-by-default realtime voice/desktop-control contract with consent and sandbox gating.
 - [Linux desktop control](computer-use-linux.md): optional `computer-use-linux` MCP wrapper — doctor-first, approval-gated mutators.
 - [Obscura browser engine](obscura.md): optional host-binary browser engine adapter with fail-closed lifecycle and CDP composition.
 - [Coding agent tools](coding-agent-tools.md): shell/read/write/edit/search toolset with caps, document reader, and optional Git awareness.
-- [Document reader](document-reader.md): bounded PDF/DOCX text extraction behind `createReadTool({ documentReader })`.
+- [Document reader](document-reader.md): bounded PDF/DOCX/XLSX/PPTX text extraction behind `createReadTool({ documentReader })`; optional host-selected Mistral OCR parser (not default).
 - [Indexed code search](indexed-code-search.md): host-owned incremental index seam; results labeled `untrusted_index`.
-- [Coding workspaces](coding-workspaces.md): worktree lifecycle with CheckpointStore CAS records and LeaseStore fencing.
+- [Coding workspaces](coding-workspaces.md): worktree lifecycle with CheckpointStore CAS records, LeaseStore fencing, and opt-in per-child spawn isolation.
 - [Coding review and diagnostics](coding-review-and-diagnostics.md): bounded patch-review manifests and normalized LSP diagnostics.
 - [Language intelligence](language-intelligence.md): bounded LSP client with lazy spawn, URI confinement, policy-gated rename.
-- [Process sessions](process-sessions.md): long-running process registry with durable recovery and fail-closed ownership.
+- [Process sessions](process-sessions.md): long-running process registry with durable recovery, Docker/E2B container sessions, and fail-closed ownership.
 - [Forge integration](forge-integration.md): reference GitHub adapter — every mutation policy-gated and effect-recorded.
-- [Coding execution approval and sandboxing](coding-security.md): path/command approval, workspace modes, Docker/native sandboxes, egress allow-listing.
+- [Coding execution approval and sandboxing](coding-security.md): path/command approval, workspace modes, Docker/native/E2B sandboxes with long-running process handles, egress allow-listing.
+- [Hosted sandboxes](hosted-sandboxes.md): E2B `DisposableSandbox` adapter with pause/resume, filesystem-only snapshots, and reconnect by non-secret sandbox id.
 
 ## Documents, sheets, and diagrams
 
-- [Documents, spreadsheets, and presentations](documents.md): OOXML generation, parsing, patching, and bounded preview for Office formats.
+- [Documents, spreadsheets, and presentations](documents.md): OOXML generation, parsing, import fidelity reports, patching, structural diffs, and bounded preview for Office formats.
 - [Spreadsheets and CSV data](sheets.md): fail-closed XLSX/CSV ingestion with decimal-safety guarantees.
 - [Diagrams and mxGraph embed](diagrams.md): origin-enforced draw.io embed client with XXE-safe XML validation.
 
@@ -142,29 +170,31 @@ Prism is a TypeScript/Node.js agent harness. Hosts own providers, tools, credent
 ## Configuration/manifests
 
 - [Configuration and manifests](configuration-and-manifests.md): layered JSON config merge with data-only manifest validation.
+- [Effective run bundle snapshots](run-bundle.md): frozen JSON projection of the effective run bundle — prompt/skill/tool/guardrail digests, resolved limits, storage kinds, one pinning digest, zero network or store reads.
+- [Host compositions](host-compositions.md): personal and business worker host compositions, inspection reports, storage durability truth, sandbox isolation, and fail-closed readiness enforcement.
 - [Node filesystem config loader](node-filesystem-config.md): explicitly read caller-named JSON config files in Node.
 - [Resource loading](resource-loading.md): decode text/JSON/binary through caller-provided loaders; RAG bridge.
 - [Optional peer dependencies](peer-dependencies.md): every third-party peer a package declares, the subpath it unlocks, its install line, pin rationale, and which peers touch the network.
 
 ## Server/API
 
-- [Web-standard server handler](server.md): framework-free authorized agent/SSE handler with durable reconnect and webhook seams.
+- [Web-standard server handler](server.md): framework-free authorized agent/SSE handler with durable reconnect, editable approvals, and webhook seams.
 
 ## Multi-agent and interoperability
 
-- [Multi-agent patterns (handoff/crew/supervisor/A2A)](multi-agent-patterns.md): decision table for handoff, crew, supervisor, and A2A.
-- [Supervisor delegation](supervisors.md): child allow-lists, narrowed permissions, finite budgets, nested delegation.
+- [Multi-agent patterns (handoff/crew/supervisor/spawn/A2A)](multi-agent-patterns.md): decision table for handoff, crew, supervisor, in-process spawn, and A2A.
+- [Supervisor delegation](supervisors.md): child allow-lists, model-facing sync/async spawn, wait/cancel, narrowed permissions, finite budgets, nested delegation.
 - [A2A interoperability](a2a.md): A2A 1.0 cards, durable task seams, verified client, AG-UI fronting.
-- [Frontend interoperability (AG-UI and ACP)](ag-ui.md): AG-UI event mapping, A2UI middleware, hardened MCP/A2A adapters, ACP sibling.
+- [Frontend interoperability (AG-UI and ACP)](ag-ui.md): AG-UI event mapping with editable durable approvals, A2UI middleware, hardened MCP/A2A adapters, ACP sibling.
 - [ACP coding-host interop](acp.md): stable ACP v1 agent with capability advertisement, approvals, durability, and projections.
-- [Spawnable ACP agent](acp-agent.md): stdio bin serving `createPrismAcpAgent` from a validated config file.
+- [Spawnable ACP agent](acp-agent.md): stdio bin serving `createPrismAcpAgent` with lazy real providers, credential references, explicit offline mock mode, durable SQLite recovery, and origin- and path-safe MCP allow-listing.
 - [AG-UI adoption evaluation](ag-ui-adoption.md): official AG-UI matrix and shipped handshake boundaries.
 
 ## CLI/RPC
 
-- [Dev inspector](dev-inspector.md): loopback-only local playground over a configured agent; `prism dev` composition.
-- [CLI/RPC](cli-rpc.md): print/json modes, LF-delimited RPC, `prism init` scaffold, provider scaffolding, allow-listed `--extension` activation.
-- [Workflows](workflows.md): typed bounded DAG orchestration with durable suspend/resume, schedules, sagas.
+- [Dev inspector](dev-inspector.md): loopback-only local playground over a configured agent; composition inspection via `GET /inspect`; quality/cost/latency compare from timeline summaries; `prism dev` composition.
+- [CLI/RPC](cli-rpc.md): print/json modes, LF-delimited RPC, `prism init` scaffold (`personal-assistant`, `business-worker`, `deep-research` templates), provider scaffolding, allow-listed `--extension` activation.
+- [Workflows](workflows.md): typed DAG orchestration plus serializable graph/Mermaid overlay for host UIs.
 
 ## Security and credentials
 
@@ -185,7 +215,7 @@ Prism is a TypeScript/Node.js agent harness. Hosts own providers, tools, credent
 - [Compaction conformance](compaction-conformance.md): assert redacted non-empty summaries and abort observation.
 - [Tool conformance](tool-conformance.md): assert blocked-reason matrix and success-path dispatch behavior.
 - [Extension conformance](extension-conformance.md): assert inert contributions and redacted setup errors.
-- `examples/`: compile-checked typed examples ([`conversation-durable-replay.ts`](../examples/conversation-durable-replay.ts), [`artifact-review-delivery.ts`](../examples/artifact-review-delivery.ts), [`enterprise-identity.ts`](../examples/enterprise-identity.ts), [`enterprise-policy-audit.ts`](../examples/enterprise-policy-audit.ts), [`enterprise-work-connectors.ts`](../examples/enterprise-work-connectors.ts), [`server-deployment-seams.ts`](../examples/server-deployment-seams.ts), [`neuralwatt-agent-run.ts`](../examples/neuralwatt-agent-run.ts), [`cache-aware-prompt-assembly.ts`](../examples/cache-aware-prompt-assembly.ts), [`ag-ui-server.ts`](../examples/ag-ui-server.ts), [`acp-coding-host.ts`](../examples/acp-coding-host.ts), and more), plus runnable mock demos.
+- `examples/`: compile-checked typed examples ([`conversation-durable-replay.ts`](../examples/conversation-durable-replay.ts), [`artifact-review-delivery.ts`](../examples/artifact-review-delivery.ts), [`enterprise-identity.ts`](../examples/enterprise-identity.ts), [`enterprise-policy-audit.ts`](../examples/enterprise-policy-audit.ts), [`enterprise-work-connectors.ts`](../examples/enterprise-work-connectors.ts), [`connected-slack-mcp.ts`](../examples/connected-slack-mcp.ts), [`server-deployment-seams.ts`](../examples/server-deployment-seams.ts), [`neuralwatt-agent-run.ts`](../examples/neuralwatt-agent-run.ts), [`cache-aware-prompt-assembly.ts`](../examples/cache-aware-prompt-assembly.ts), [`ag-ui-server.ts`](../examples/ag-ui-server.ts), [`acp-coding-host.ts`](../examples/acp-coding-host.ts), [`telegram-agent.ts`](../examples/telegram-agent.ts), [`signal-agent.ts`](../examples/signal-agent.ts), [`messaging-agent.ts`](../examples/messaging-agent.ts), and more), plus runnable mock demos.
 
 ## Third-party integrations
 
@@ -193,10 +223,16 @@ Prism is a TypeScript/Node.js agent harness. Hosts own providers, tools, credent
 - [Ponytail behavior integration](ponytail.md): upstream Ponytail skills with injector and peer resolution; opt-in.
 - [Graft context-graph integration](graft.md): graft CLI pull tools, retrieval-pack context provider, blast-radius middleware, and `/graft-init` / `/graft-build` / `/graft-build-deep` commands (host-configured `deepModel`).
 - [Impeccable behavior integration](impeccable.md): upstream Impeccable skill behind `load_skill`; host supplies the compiled `SKILL.md`.
+- [Messaging channels](messaging-channels.md): `@arnilo/prism-channels` transport-neutral runtime — deny-by-default sender authorization, owned session binding, serialized turns, current-run replies, one-use durable approvals, bounded attachment refs (images reach the model only when it declares image input), and opt-in host notices to one already-bound pair.
+- [Telegram channel](telegram-channel.md): official `@arnilo/prism-channels/telegram` long polling and mountable webhook ingress with durable offset/lease handling, approval callbacks, opt-in granted group/topic text, bounded media with optional voice transcription/synthesis, and opt-in streaming drafts.
+- [Signal channel (experimental)](signal-channel.md): `@arnilo/prism-channels/signal` pinned signal-cli v0.14.8 private-socket manual receive, explicit policy gate, UUID DM filtering and bounded ambiguous delivery.
+- [Messaging channel operations](messaging-channel-operations.md): durable journal, restart and reconciliation contract, lease fencing, retention and the operator runbook.
 
 ## Release and install
 
 - [Release and install](release-and-install.md): install rules, package graph, and deterministic resumable publication.
+- [Migrate 0.7 → 0.8](migrate-to-0.8.md): work-family import map, messaging channels, connected apps, durable runs, and 0.8.0 host migration steps.
+- [Migrate 0.6 → 0.7](migrate-to-0.7.md): ACP MCP allow-list URL normalization, model router facade fail-closed governance, and 0.7.0 host migration steps.
 - [Migrate 0.5 → 0.6](migrate-to-0.6.md): Node 22 floor, folded 0.5.7 host delta, third-party floors, and upgrade/rollback steps.
 - [Migrate 0.5](migrate-to-0.5.md): 0.4 → 0.5 migration guide with per-release sections and rollback.
 - [Documentation archive](history/README.md): frozen migration/history records — not read on the hot path.
@@ -207,18 +243,19 @@ Prism is a TypeScript/Node.js agent harness. Hosts own providers, tools, credent
 The generated inventory below derives from [`scripts/package-truth.json`](../scripts/package-truth.json) — regenerate with `node scripts/package-truth.mjs --emit-docs`, never hand-edit.
 
 <!-- generated:package-truth:inventory begin -->
-**10 publishable manifests** — root `@arnilo/prism` plus 9 workspace packages (3 `prism-*` family packages, 6 capability packages). Generated by `node scripts/package-truth.mjs --emit-docs` — do not hand-edit.
+**11 publishable manifests** — root `@arnilo/prism` plus 10 workspace packages (4 `prism-*` family packages, 6 capability packages). Generated by `node scripts/package-truth.mjs --emit-docs` — do not hand-edit.
 
 | package | version | notes |
 | --- | --- | --- |
-| `@arnilo/prism` | 0.6.0 | core — runtime, CLI/RPC, templates, docs |
-| `@arnilo/prism-coding-tools` | 0.6.0 | family — /agent, /security, /document-reader, /openapi, /computer-use-linux, /dev, /caveman, /ponytail, /impeccable subpaths |
-| `@arnilo/prism-core` | 0.6.0 | family — /runtime, /sessions, /governance, /credentials, /enterprise, /work, /validation subpaths |
-| `@arnilo/prism-providers` | 0.6.0 | family — all provider adapters as `/<adapter>` subpaths |
-| `@arnilo/prism-acp-agent` | 0.6.0 | capability — ACP adapter |
-| `@arnilo/prism-ag-ui` | 0.6.0 | capability — AG-UI/A2A/A2UI adapter |
-| `@arnilo/prism-mcp` | 0.6.0 | capability — MCP client/server/OAuth interop |
-| `@arnilo/prism-memory` | 0.6.0 | capability — memory plus /rag, /compaction/*, /graft, /wiki subpaths |
-| `@arnilo/prism-office` | 0.6.0 | capability — /documents, /sheets, /diagrams subpaths |
-| `@arnilo/prism-web-tools` | 0.6.0 | capability — Brave/Exa/Firecrawl plus peer-gated /browser and /obscura subpaths |
+| `@arnilo/prism` | 0.8.0 | core — runtime, CLI/RPC, templates, docs |
+| `@arnilo/prism-channels` | 0.8.0 | family — transport-neutral messaging runtime, durable journal, pairing and one-use approvals; official /telegram (private DMs, opt-in granted groups/topics) and experimental pinned signal-cli /signal |
+| `@arnilo/prism-coding-tools` | 0.8.0 | family — /agent, /security, /openapi, /computer-use-linux, /dev, /caveman, /ponytail, /impeccable subpaths |
+| `@arnilo/prism-core` | 0.8.0 | family — /runtime, /sessions, /governance, /credentials, /enterprise, /validation subpaths |
+| `@arnilo/prism-providers` | 0.8.0 | family — all provider adapters as `/<adapter>` subpaths |
+| `@arnilo/prism-acp-agent` | 0.8.0 | capability — ACP adapter |
+| `@arnilo/prism-ag-ui` | 0.8.0 | capability — AG-UI/A2A/A2UI adapter |
+| `@arnilo/prism-mcp` | 0.8.0 | capability — MCP client/server/OAuth interop |
+| `@arnilo/prism-memory` | 0.8.0 | capability — memory plus /rag, /compaction/*, /fabric, /graft, /wiki subpaths |
+| `@arnilo/prism-web-tools` | 0.8.0 | capability — Brave/Exa/Firecrawl plus peer-gated /browser and /obscura subpaths |
+| `@arnilo/prism-work` | 0.8.0 | capability — /connectors, /documents, /sheets, /diagrams, /document-reader, /sandbox, /skills, /tools subpaths |
 <!-- generated:package-truth:inventory end -->

package/docs/input-and-prompt-assembly.md

@@ -189,3 +189,4 @@ const request = await assembleProviderInput({
 - [Agent/session runtime](agent-session-runtime.md): calls assembly each turn and supplies runtime tool results to the next provider request.
 - [Tools](tools.md): host-owned tool registry and tool result boundary.
 - [Compaction and retry policies](compaction-and-retry.md): default compaction strategy that feeds summaries into input assembly.
+- [Attention compiler](attention-compiler.md): opt-in per-turn ratio gate that strips old thinking and stubs old tool results on the assembled groups before they reach the prompt builder.