@arnilo/prism 0.7.0 → 0.8.0

package/docs/history/085-honesty-and-cut-primitive-review.md

@@ -0,0 +1,91 @@
+# Honesty gates, runtime split, and 0.8.0 cut primitive review
+
+Plan 085 Task 0 freezes evidence, compatibility, scope, and the 0.8.0 changelog inventory for Tasks 1–8. Evidence only: no runtime path, public symbol, dependency, or budget changed here.
+
+Reviewed tree: `a7915d6c`, with the 0.8.0 working tree already dirty from plans 079–084. Root and all eleven publishable manifests still declare `0.7.0`; this is not release evidence.
+
+## Sources reviewed
+
+Current contracts: [testing](../testing.md), [release and install](../release-and-install.md), [observational memory](../compaction-observational-memory.md), [messaging channels](../messaging-channels.md), and [messaging channel operations](../messaging-channel-operations.md).
+
+External contract: Node 24 [`--test-isolation=mode`](https://nodejs.org/docs/latest-v24.x/api/cli.html#--test-isolationmode) and [test execution model](https://nodejs.org/docs/latest-v24.x/api/test.html#test-runner-execution-model), verified 2026-09-17 through Context7 `/websites/nodejs_latest-v24_x_api`. `process` is the default (one child per file); `none` imports all files into the runner process and runs top-level tests serially. The nested wiki child must continue to remove `NODE_TEST_CONTEXT` and `NODE_TEST_WORKER_ID`.
+
+Historical context: [079 review](079-messaging-primitive-review.md), [080 review](080-messaging-followon-primitive-review.md), [081 review](081-connected-apps-primitive-review.md), [083 review](083-prism-work-primitive-review.md), [084 review](084-primitive-review.md), [080 Task 10](../../plans/080-Messaging-Channel-Followons-And-0-8-0-Cut.md), and the [085 plan](../../plans/085-Honesty-Gates-Runtime-Split-And-0-8-0-Cut.md).
+
+## Findings and frozen implementation boundary
+
+| Review item | Evidence | Frozen boundary | Owning task |
+| --- | --- | --- | --- |
+| 1. Honest release, coverage, and wiki evidence | `scripts/release-skip-manifest.mjs:26-33` selects the newest `phase*-baseline.json`; `:152-180` turns its `testPostgres` count into a pass whenever `PRISM_TEST_POSTGRES_URL` is set. `scripts/coverage-summary.json:1-120` is captured `2026-09-16T21:26:54.219Z`, contains `@arnilo/prism-office`, and lacks live `@arnilo/prism-work` (`packages/prism-work/package.json:2`). `scripts/wiki-scratch-isolation.test.mjs:83-96` strips nested-runner environment but invokes default process isolation. | Postgres pass must require current-HEAD, this-run evidence; coverage keys must equal workspace manifests; use `node --test --test-isolation=none` for the nested wiki child, retaining fixture-hash pollution checks and environment scrubbing. No retry or sleep. | 1 |
+| 2. OM worker contract | `packages/memory/src/compaction/observational-memory/worker-loop.ts:68-70` discards every non-tool event; `:91-92` returns when a provider turn made no tool calls. `:71-81` and `:84-88` identify worker failures by English message prefix before redacting other errors. `runMemoryWorkerLoop` has only the three worker callers listed in `workers/{dropper,observer,reflector}.ts`. | Tool-only is intentional: text/thinking/done-only turns are successful no-ops. Keep no text writer. Replace only the prefix-based internal error classification with a typed memory error in Task 2; provider/tool failures still redact. | 2 |
+| 3. Channel lease release | `packages/prism-channels/src/runtime.ts:657-672` clears `route.lease` before awaiting the persistent release, then swallows an exception after incrementing `storageFailures`. The only callers are `scheduleRoute` (`:1295-1308`) and `stop` (`:1774-1797`). SQLite’s store release itself is ownership/token fenced (`packages/prism-core/src/sessions/sqlite/leases.ts:92-107`). | A failed store release is not success: retain the in-memory lease until persistent acknowledgement, then clear it. Do not roll back an already delivered reply or add a retry loop; idle/stop may retry and lease TTL remains the cross-process backstop. `telegram.ts:631-650` and `signal.ts:427-442` are receiver-specific best-effort paths, not a reason to weaken runtime fencing. | 3 |
+| 4. Runtime decomposition | `createMessagingRuntime` is one 1,878-line closure, `packages/prism-channels/src/runtime.ts:141-2018`, with 80 nested helpers and state interfaces at `:81-139`. It owns authorization, binding/journal, leases, previews/media/replies, approval/resume, admission, drain/stop, and reconciliation. Its callers import only package `index` (examples, runtime/recovery/adapter tests, restart and soak fixtures). | Move private helpers into private sibling modules behind unchanged `createMessagingRuntime`; preserve authorize → lease → claim → provider order and package-index export. This target alone gets the ≤800-line rule—no repository-wide god-file campaign. | 4 |
+| 5. Provider test/dead-binding cleanup | Exactly eleven source-regex tests read an adapter `index.ts` and assert an export at line 8: `anthropic`, `clinepass`, `deepseek`, `google`, `kimi`, `neuralwatt`, `openai`, `opencode-go`, `openrouter`, `xai`, and `zai` under `packages/prism-providers/src/*/__tests__/index.test.ts`. `alibaba/video.ts:23-51` declares `fetchUrl` but binds unused `_fetchUrl`; `openai/speech.ts:32-38` has zero-call `_bearerHeaders`; `alibaba/__tests__/embeddings.test.ts:14-18` only uses `_assignable` for a structural pin. | Delete the eleven vacuous tests, retain one real packaging assertion already owned by root packaging tests, make video’s declared `fetchUrl` work while retaining `pinnedFetch` default, delete speech helper, and use `satisfies` for the embedding shape. No provider test framework. | 5 |
+| 6. Small dedupe only | `retryableAdmission` is equivalent in Telegram (`packages/prism-channels/src/telegram.ts:524-527`) and Signal (`signal.ts:164-170`); caller paths are Telegram poll/webhook and Signal notification enqueue. `pushM365Tools` (`packages/prism-work/src/connectors/tools.ts:435-723`) and `pushGwsTools` (`:725-1083`) are only called from `createWorkTools` (`:1085-1093`), which is 1,093 lines total. | One private admission predicate; one local tool-push helper, not a cross-provider schema DSL. Preserve `assertExternalAllowed` and `executeApprovedMutation` (`tools.ts:192-199,227-407`) on every mutation. Split work catalog files only if the local helper leaves a file over 800 lines. | 6 |
+
+## Threat posture
+
+| Threat | Current gap | Required posture |
+| --- | --- | --- |
+| A stale Postgres pass hides SQL/durable-store defects | The skip manifest accepts a historical baseline count once the environment variable exists; it does not bind that count to `HEAD`. | Task 1 records only redacted metadata and counts from the current commit. Missing/mismatched evidence is **blocked**, never inherited pass. NATS remains protected when infrastructure is absent. |
+| Swallowed release makes a binding appear free locally | Runtime memory forgets a lease despite the persistent release throwing. A later local scheduling decision is no longer fenced by the held route state. | Task 3 keeps the route lease through a failed store call and proves a later idle/stop path retries it. Ownership/token checks and TTL remain fail-closed. |
+| Later “keep text” change silently drops observations | Current worker ignores non-tools; adding text retention without an explicit writer would look like a successful observation while persisting nothing. | Task 2 documents text-only turns as no-op. A future text-observation feature must add a writer, bounded/redacted payload, ledger semantics, and tests in a separate plan. |
+
+## Non-goals frozen out of 085
+
+| Out of scope | Evidence / reason | Reconsider only when |
+| --- | --- | --- |
+| SQLite/Postgres persistence unification | Separate SQLite migration and Postgres store implementations have distinct transaction and driver contracts (`packages/prism-core/src/sessions/sqlite/migrations.ts:37-74`; `packages/memory/src/postgres.ts:93-246`). | A measured parity defect requires a shared contract, not merely similar code. |
+| Provider framework | Twenty provider subpackages already have independent request/auth/conformance choices (`scripts/package-truth.json` `providers`). | A third implementation repeats an identical adapter seam after Task 5 cleanup. |
+| Another memory API | Existing observational-memory extension/runtime and `createMemoryFabric` are established public surfaces (`packages/memory/src/compaction/observational-memory/extension.ts:13-24`; `fabric/create.ts:130-469`). | A host has a concrete missing use case neither current surface can express. |
+| Byte-cap increases | Hard request/response limits are explicit process-safety boundaries (`src/run-limits.ts:9-22`; `src/__tests__/run-limits.test.ts:55-68`). | Measurement shows a valid bounded payload cannot fit and a corresponding hard-cap/security review approves it. |
+| Embedder-backed tool search | Current tool search is bounded lexical scoring (`src/tool-search.ts:226-268`) and has a benchmark budget (`scripts/benchmark-tool-search.test.mjs`). | Tool count/relevance measurements fail the current indexed approach. |
+| `asRecord` consolidation | Seven local variants have differing return/validation shapes, including channel and work HTTP code (`packages/prism-channels/src/telegram.ts:175-177`; `packages/prism-work/src/connectors/normalize.ts:3-5`). | A specific correctness defect reaches more than one implementation. |
+| Semaphore consolidation | Existing copies serve different package-local roles (e.g. coding-tools `Semaphore`, `packages/prism-coding-tools/src/security/semaphore.ts:18-55`; core artifact transfer `createSemaphore`, `packages/prism-core/src/runtime/server/artifact-bodies.ts:188-203`). | Profiling or a shared fairness/cancellation bug proves a common contract. |
+| `createGovernedProvider` work | It is a public governance seam with many direct tests (`packages/prism-core/src/governance/model-router/invocation.ts:87-429`). | A separately scoped governance bug or compatibility request exists. |
+| Canonical model comparison | Model-change recording uses `JSON.stringify` in `src/agent-session/session/assemble.ts:223`; unrelated to this cut’s honesty/routing work. | Object key ordering produces a reproducible false model-change record. |
+
+## 0.8.0 cut inventory
+
+Task 7’s changelog and migration must name these working-tree surfaces. “Completed” below means all task checkboxes are checked; 083 and 084 still have stale `Status: planned` headers, which Task 7 must correct before cut evidence is produced.
+
+| Plan | Changelog/migration surface |
+| --- | --- |
+| 079 | New `@arnilo/prism-channels`: transport-neutral runtime/journal, Telegram adapter, experimental Signal adapter, verified identity, durable approvals, restart/recovery and examples. |
+| 080 Tasks 1–9 | Telegram group/topic ownership, draft streaming, bounded attachments/voice, opt-in notifications, ERP outbox composition, SIGTERM/soak, nested test glob, resume signal, and checkpoint scope fixes. |
+| 081 | Identity-bound connected-app MCP session, host-selected allowlists, Google Workspace/Microsoft 365 HTTP adapters, Slack MCP wrap, and sidecar example. |
+| 082 | Package-truth evidence generation and connected-app follow-up safety review. |
+| 083 | `@arnilo/prism-office` replacement with `@arnilo/prism-work` subpaths, work sandbox/composition, file transfer, and vendored Hermes skills. This is the only planned breaking import-map change. |
+| 084 | Durable turn checkpoints/continue, turn-stop policy, server-authoritative AG-UI input, run bundle, evidence grounding, typed provider failure classification, and tool-call reliability metadata. |
+| 085 Tasks 1–6 | This-tree evidence gates, OM worker contract, fail-closed lease release, private runtime split, provider cleanup, and small channel/work dedupe. |
+
+**080 Task 10 is superseded by 085 Tasks 7–8.** It remains unchecked in `plans/080-Messaging-Channel-Followons-And-0-8-0-Cut.md:427` until Task 7 marks it with that note; this review does not rewrite past completion evidence.
+
+## Task 7 budget baseline
+
+Measured 2026-09-17 using `npm pack --workspace <name> --dry-run --json`, against the reviewed dirty working tree. These measurements are Task 7 delta reference points, **not newly enforced budgets**.
+
+No package-specific packed-size ceiling exists for the four target workspaces. `scripts/budgets.json:3-36` supplies only the root `@arnilo/prism` pack ceiling: 1,320,080 packed bytes, 4,356,107 unpacked bytes, and 505 files, each with 5% tolerance. The historical aggregate ceiling is explicitly obsolete (`scripts/budgets.json` `aggregate.$comment`). Keep that policy unchanged unless Task 7 adds a separately justified package-pack gate.
+
+| Package | Packed bytes | Unpacked bytes | Files | Export ceiling |
+| --- | ---: | ---: | ---: | ---: |
+| `@arnilo/prism-channels` | 51,593 | 234,935 | 24 | 85 |
+| `@arnilo/prism-memory` | 215,525 | 865,582 | 272 | 828 |
+| `@arnilo/prism-work` | 176,039 | 765,717 | 176 | 392 |
+| `@arnilo/prism-providers` | 157,932 | 759,339 | 234 | 528 |
+
+Export ceilings come from `scripts/budgets.json:39` (memory), `:43` (work), `:55` (channels), and `:59` (providers); they remain unchanged through Tasks 1–6. Task 7 must record every deliberate budget rebaseline with a dated reason, rather than silently raising a tolerance.
+
+## Verification evidence
+
+- `node scripts/package-truth.mjs` confirmed 11 publishable manifests and all target manifests at `0.7.0`.
+- Direct artifact probe confirmed the coverage-package mismatch above.
+- Direct source probe found all 11 provider source-regex tests and all three unused binding sites.
+- `npm pack --workspace <name> --dry-run --json` produced the four baseline rows above without creating tarballs.
+- This task intentionally adds no runtime test. Subsequent tasks own the smallest failing checks for their behavior changes.
+
+## Plan corrections found during review
+
+- Task 7 must update both `plans/083-Prism-Work-Package-Sandbox-And-Skills.md` and `plans/084-Host-Long-Run-Durability-Steering-And-Honesty-Surfaces.md` headers from `Status: planned`; their task checkboxes are complete but their header prose is stale.
+- The four target packages have export ceilings, but **not** independent packed-size ceilings. Task 7 reports measured package pack deltas against this table while retaining the existing root-pack gate.
+- The objective says “table-driven work-tool registration,” but evidence supports only a shared local `pushTool` helper. Task 6 must not introduce a catalog DSL.

package/docs/history/README.md

@@ -9,3 +9,8 @@ page instead and note the archive where provenance matters.
 - `migrate-to-0.4.md`: retired 0.3-era package reorganization guide (current line: [migrate-to-0.5.md](../migrate-to-0.5.md)).
 - `0.1.0-readiness.md`: frozen 0.1.x readiness record.
 - `persistence-credentials-multimodality-primitives.md`, `workflow-orchestration-primitives.md`, `workflow-tui-primitives.md`: plan-era primitive-review inventories.
+- `079-messaging-primitive-review.md`, `080-messaging-followon-primitive-review.md`: messaging-channel primitive reviews (079 shipped runtime; 080 follow-ons + 0.8.0 cut).
+- `081-connected-apps-primitive-review.md`: connected-apps / work-HTTP primitive review (081; page written in 081 Task 1).
+- `083-prism-work-primitive-review.md`: work-family, sandbox, and vendored-skills primitive review (083; page written in 083 Task 1).
+- `084-primitive-review.md`: host long-run durability, steering, and honesty primitive review (084; page written in 084 Task 0).
+- `085-honesty-and-cut-primitive-review.md`: release/coverage/wiki honesty, OM worker and channel lease boundaries, private runtime split, dedupe scope, and 0.8.0 cut inventory (085; page written in Task 0).

package/docs/history/release-handoffs.md

@@ -2,6 +2,44 @@
 
 Operator publish handoffs per release line, kept verbatim. Not read on the hot path.
 
+### 0.8.0 publish handoff (plan 085 Tasks 7–8)
+
+**Decision: GO when the operator prerequisites below are recorded on the tagged commit.** Release **0.8.0** is the **seven-plan cut**: [079](../../plans/079-Prism-Messaging-Channels-Telegram-Signal.md) (messaging channels), [080](../../plans/080-Messaging-Channel-Followons-And-0-8-0-Cut.md) Tasks 1–9, [081](../../plans/081-Connected-Apps-Mcp-Host-And-Work-Http.md) (connected apps / work HTTP), [082](../../plans/082-Package-Evidence-Generation-And-Connected-App-Follow-Up-Review.md), [083](../../plans/083-Prism-Work-Package-Sandbox-And-Skills.md) (`@arnilo/prism-work` replacing `@arnilo/prism-office`), [084](../../plans/084-Host-Long-Run-Durability-Steering-And-Honesty-Surfaces.md) (durable runs), [085](../../plans/085-Honesty-Gates-Runtime-Split-And-0-8-0-Cut.md) Tasks 1–6 (honesty gates). **080 Task 10 is superseded here.** Plan 079 is **in** this cut.
+
+The graph is **11 publishable manifests** at exact **0.8.0** with internal caret ranges `^0.8.0`: root `@arnilo/prism` plus 10 workspace packages (4 `prism-*` family packages, 6 capability packages, 19 provider adapter subpaths inside the providers family). The predecessor published release is **0.7.0**.
+
+Host-visible delta (full detail in [migrate-to-0.8.md](../migrate-to-0.8.md)): one **import-map break** — `@arnilo/prism-office` and the work/document-reader subpaths move to `@arnilo/prism-work` with no shim; catch work-idempotency by `code`. Everything else is additive or a documented pin: `@arnilo/prism-channels`, connected-app MCP sessions, durable turn checkpoints / `continue`, turn-stop policy, run bundle, claim-grounding guardrail, OM workers stay tool-only, channel lease release is fail-closed, AG-UI `inputPolicy.clientState: "ignore"` is opt-in.
+
+Evidence recorded for the tree under publication. `scripts/release-evidence.json` — **43 surfaces, 12 pass, 31 protected with reasons, `blocked: false`** (`test:postgres durable conformance` is a this-tree pass, count 544, `gitHead` matches `git rev-parse HEAD`). `npm test` 6/6 stages; `npm run typecheck` green for root, all workspaces, and `examples/`; coverage core 92.50 lines against the 60/70/75 gate with every non-protected workspace above its recorded lines threshold (artifact keys include `@arnilo/prism-work`, not `@arnilo/prism-office`); `npm run pack:dry-run` green for all eleven packages; `npm run release:check --lockstep --version 0.8.0` reports **11/11 packages available**; `npm run release:publish --dry-run --lockstep --version 0.8.0` produces all eleven packs deterministically; `npm run security:threat-suites` **83/83**; `npm audit --audit-level=moderate` **0**; secret scan **6895 files, 0 findings**; SBOM regenerated (173 packages) and `scripts/verify-sbom.mjs` clean against `security/license-policy.json`.
+
+Protected legs actually run here (not just recorded): `PRISM_TEST_POSTGRES_URL=… npm run test:postgres` against `pgvector/pgvector:pg16` — 544 tests, 540 pass, 0 fail; `node scripts/drill-migration-rollback.mjs --url …` — Postgres apply → downgrade `009` → verify-compat → re-apply → checksum-fail-closed and the SQLite flow all pass, plus the `--self-test` URL-refusal check. The release workflow's `postgres-integration` job must be green on the release commit before publication. No registry write in this plan. Ledger: [0.8.0-cut.md](../_evidence/0.8.0-cut.md).
+
+```bash
+# Operator prerequisites (each a named blocked gate — none may be skipped):
+#  1. protected live-canary matrix green (live-canaries.yml, canary-report.json retained)
+#  2. PostgreSQL protected suite green (test:postgres) with this-tree scripts/postgres-evidence.json
+#     matching git rev-parse HEAD, and CodeQL SAST green on the release commit
+#  3. npm OIDC trusted publishing identity authenticated (NPM_TOKEN with id-token, provenance)
+#  4. branch protection: the compatibility leg is node22-compat
+
+git diff --check
+npm ci
+# sdk:ready phases, as .github/workflows/release.yml runs them (env scoped to release:gate only):
+npm run typecheck && npm run lint && npm run format:check
+npm test && npm run test:coverage && npm run pack:dry-run
+PRISM_TEST_POSTGRES_URL=... npm run test:postgres
+PRISM_TEST_POSTGRES_URL=... npm run release:gate
+npm run security:threat-suites
+
+# Sign the release on the clean tagged tree (operator GPG key) — Task 8 / operator only:
+# git tag -s v0.8.0 -m "0.8.0"
+# node scripts/release.mjs publish --lockstep --version 0.8.0
+
+# First-party package tags: push in batches of <=3 per push (tag-push storms; VENT 26-08-29).
+```
+
+Rollback pins the previous published line — `@arnilo/prism@0.7.0` and its siblings, exact pins per package. Session/checkpoint schema is unchanged; channel journals and `@arnilo/prism-work` stores are new 0.8.0 surfaces a 0.7.0 host never opened.
+
 ### 0.7.0 publish handoff (plan 073 Tasks 28–29)
 
 **Decision: GO when the operator prerequisites below are recorded.** Release **0.7.0** is the **six-plan cut** that closed the extended line: [072](../evaluations.md) (execution timeline, workflow graph, trajectory/outcome evals, cockpit aggregations, workflow OTel), [073](../index.md) (host completeness: traps A–C, R01–R06, R08, R10–R14, Tasks 15/30/31 and the cut itself), [074](../attention-compiler.md) (R17 attention compiler and the host-programmable compaction trigger), [075](../memory-fabric.md) (Memory Fabric subpath), [077](../compaction-observational-memory.md) (R16 work-scope memory index) and [078](../supervisors.md) (host-owned subagent spawn, bounded async spawn/wait/cancel, worktree isolation). **Plan 079 (Telegram/Signal channels) was moved to 0.8.0 on 2026-09-15** so the cut stopped waiting on unstarted work; no channel adapter ships in 0.7.0.

package/docs/host-compositions.md

@@ -1,6 +1,6 @@
 # Host compositions
 
-Prism agents are host-assembled: the host application owns credentials, providers, persistence, permissions, and tool definitions. Prism provides two canonical, maintained host compositions and a zero-network inspection and readiness API to ensure host setups conform to their operational contracts:
+Prism agents are host-assembled: the host application owns credentials, providers, persistence, permissions, tool definitions, and connected-app transports. Prism provides two canonical, maintained host compositions and a zero-network inspection and readiness API to ensure host setups conform to their operational contracts:
 
 - **`personal` (`personal-assistant`)**: Local-personal host composition for single-operator productivity, personal tools, local/memory persistence, and secret redaction.
 - **`business` (`business-worker`)**: Multi-tenant enterprise worker host composition with verified tenant identity, mandatory durable storage, sandbox workspace containment, and strict governance enforcement.
@@ -37,6 +37,7 @@ const report = inspectHostComposition({
   agent: personalAgent,
   store: memoryStore,
   credentialRefs: ["OPENAI_API_KEY"],
+  connectedApps: { appIds: ["slack"], serverIds: ["slack"] },
 });
 ```
 
@@ -45,8 +46,9 @@ Report structure:
 - `profile`: `"personal"` or `"business"`.
 - `effectiveTools`: Readonly list of tool names registered on the agent.
 - `credentialRefs`: Host credential references (sanitized, values never included).
+- `connectedApps`: Optional copied `appIds` and `serverIds` (up to 32 identifiers per list); transports, environment, headers, and tokens are never accepted or reported. Business hosts require a verified identity when this field is present.
 - `ownership`: Tenant and user ownership identifiers.
-- `storage`: Storage summary with `kind` (`"memory"`, `"postgres"`, `"sqlite"`, etc.) and `durable` boolean. Memory stores are truthfully reported with `durable: false`.
+- `storage`: Storage summary with `kind` (`"memory"`, `"postgres"`, `"sqlite"`, etc.) and `durable` boolean. Memory stores are truthfully reported with `durable: false`. `snapshotRunBundle()` ([effective run bundle snapshots](run-bundle.md)) reuses this classification for the per-run store kinds.
 - `sandbox`: Isolation status and resolved root paths.
 - `governance`: Coverage flags (authorization, trust, and custom policies).
 - `readiness`: Object with `ok: boolean` and list of `reasons` if not ready.
@@ -100,17 +102,17 @@ Always install containing packages directly. **NPM install never accepts subpath
 
 ```bash
 # Correct — install containing published packages:
-npm install @arnilo/prism @arnilo/prism-core @arnilo/prism-providers
+npm install @arnilo/prism @arnilo/prism-core @arnilo/prism-providers @arnilo/prism-work
 
 # Never install subpaths:
-# npm install @arnilo/prism-core/integrations/work (WRONG: fails with 404 / E404)
+# npm install @arnilo/prism-work/connectors (WRONG: fails with 404 / E404)
 ```
 
 In your application code, import from documented subpaths:
 
 ```ts
-// Subpaths exported by @arnilo/prism-core:
-import { createWorkTools } from "@arnilo/prism-core/integrations/work";
+// Subpaths exported by @arnilo/prism-work:
+import { createWorkTools } from "@arnilo/prism-work/connectors";
 import { createJsonSchemaArgumentValidator } from "@arnilo/prism-core/validation/json-schema";
 
 // Subpaths exported by @arnilo/prism-providers:

package/docs/host-security.md

@@ -190,7 +190,7 @@ PostgreSQL TLS/network policy, MCP endpoint trust/credentials and egress policy
 ## Web research boundaries
 
 - Construct `@arnilo/prism-web-tools` with one host-selected Brave or Exa adapter; never expose adapter/provider/credential/schema selection to model arguments.
-- Construct `@arnilo/prism-core/integrations/work` with host-pinned CLI binary + isolated `configDir` + verified `AgentIdentity` (M365 and/or GWS). Never pass model-built command strings, `login`/`setup`/`auth`/`schema`/`--debug`, or credentials in argv. Mutations require draft approval; external recipients and anonymous/`anyone` shares fail closed.
+- Construct `@arnilo/prism-work/connectors` with host-pinned CLI binary + isolated `configDir` + verified `AgentIdentity` (M365 and/or GWS). Never pass model-built command strings, `login`/`setup`/`auth`/`schema`/`--debug`, or credentials in argv. Mutations require draft approval; external recipients and anonymous/`anyone` shares fail closed.
 - Provider API origins are fixed exact HTTPS origins and redirects fail. Credentials resolve immediately before I/O; remote bodies and secrets are excluded from errors/results/telemetry.
 - Firecrawl targets reject userinfo, non-HTTP(S), private literals, and policy-denied hosts. Supply `validateUrl` for host DNS/rebinding/egress checks. Firecrawl performs remote retrieval, so Prism cannot pin target DNS after handoff.
 - Treat every snippet, highlight, Markdown byte, metadata field, and extracted JSON value as prompt-injection-capable untrusted data. Never elevate it into system instructions or let it modify tools, permissions, trust, credentials, routing, or extraction schema.
@@ -201,7 +201,7 @@ PostgreSQL TLS/network policy, MCP endpoint trust/credentials and egress policy
 - Require `security / codeql`, `security / supply-chain`, PR dependency review, release readiness, and PostgreSQL integration in protected-branch rules. Enable GitHub secret scanning and push protection as repository settings; checked-in workflows cannot enable those service controls.
 - Actions are pinned to full commit revisions. Dependabot proposes weekly npm/action revision changes; review upstream release notes before merge rather than replacing pins with moving tags.
 - `scripts/verify-sbom.mjs` accepts only bounded SPDX 2.3 inventory with exact checked-in permissive licenses. Any missing/new expression fails until reviewed; do not widen policy merely to unblock CI.
-- `scripts/scan-secrets.mjs` checks tracked source and unpacked public tarballs for high-confidence credential/private-key forms without printing matched values. It complements GitHub secret scanning; it is not entropy scanning or DLP.
+- `scripts/scan-secrets.mjs` checks tracked source and unpacked public tarballs for high-confidence credential/private-key forms without printing matched values. It complements GitHub secret scanning; it is not entropy scanning or DLP. Local credential files are the one carve-out: `scripts/live.env` and any `*.local.env` are skipped by name because `.gitignore` already excludes them, they hold real keys by design, and CI scans the tracked set where they cannot appear (`scripts/scan-secrets.test.mjs` asserts both names are still gitignored). Every other gitignored file is scanned.
 - Tag publication alone receives npm/OIDC/attestation permissions. Untrusted pull-request code receives no canary, npm, or OIDC secret and no workflow uses `pull_request_target`.
 - Scheduled/manual canaries run only in protected `live-canaries` environment. Use dedicated read-only/low-quota credentials and provider account spend limits. Runner performs four probes, at most one MCP cleanup, one provider output token, one Brave result, 64-KiB responses, and finite timeouts; report excludes endpoints, headers, bodies, credentials, and MCP session IDs.
 - Scheduled/manual coding/browser containment checks run in protected `sandbox-browser` environment (`.github/workflows/sandbox-browser.yml`). They receive no provider/npm/OIDC secrets; Docker/Playwright enablement is variable-gated with host-preloaded digest-pinned images/binaries; uploads are redacted aggregate status only.

package/docs/index.md

@@ -2,21 +2,29 @@
 
 Prism is a TypeScript/Node.js agent harness. Hosts own providers, tools, credentials, storage, and behavior; Prism supplies contracts, registries, events, and replaceable runtime primitives.
 
-## Current line (0.7.0)
-
-- **Traps closed (plan 073)**: ACP MCP destination matching uses WHATWG origin plus path-segment subtree rules, the ACP launcher requires a real provider (mock mode is explicit), and the model-router facade refuses governance it cannot enforce (`ERR_PRISM_MODEL_ROUTER_ASYNC_REQUIRED` / `_ASYNC_STATE`).
-- **Governed host surfaces (plan 073)**: validated personal/business compositions, governed provider invocation with aggregate task/tenant accounting, durable business-action drafts with editable approvals, Docker process sessions and coherent workspace recovery, Drive knowledge synchronization, snapshot/reconnect with one hosted sandbox, fair worker admission, cross-layer memory lineage with correction/revocation, evidence-backed citations with import-fidelity/OCR reports, and monotonic per-run tool narrowing.
-- **Evidence cockpit (plan 072)**: execution timeline, workflow graph, trajectory/outcome evals (scenarios, trials, manifests), cockpit aggregations, and workflow OpenTelemetry spans — with the cross-package journey matrix behind them.
-- **Attention Compiler (plan 074)**: opt-in per-turn gate that mutates the transcript only after a ratio of the model input cap, with sticky thinking/tool stubs and a host-programmable compaction trigger.
-- **Memory Fabric (plan 075)**: opt-in typed notes (fact/procedure/file/working/episode) with links, validity windows, and time/tool recall over the working, semantic, and observational-memory engines.
-- **Work-scope memory index (plan 077)**: host-named work scopes (`open`/`bind`/`project`/`enter`) project the observational outline; unscoped attach keeps the 0.6.0 dropper.
-- **Host-owned subagent spawn (plan 078)**: `spawn_agent` over the host supervisor (allow-listed children, narrowed identity, redacted results), bounded async spawn with `wait_agent`/`cancel_agent`, opt-in per-child worktree isolation, and redacted `subagent_started`/`subagent_stopped` lifecycle events.
-- **Native Bedrock Converse and governed realtime voice (plan 073 R12/R14)**: `createBedrockConverseProvider` adds a native `Converse`/`ConverseStream` route next to the OpenAI-compatible one, with no AWS SDK dependency; realtime voice sessions stay host-governed.
-- **10 publishable packages** at current **0.7.0** lockstep, with the migration guide reachable from the release section below — inventory below.
+## Current line (0.8.0)
+
+- **Messaging channels**: `@arnilo/prism-channels` transport-neutral runtime with deny-by-default authorization, owned bindings, one-use durable approvals, official Telegram (private DMs, opt-in granted groups/topics, drafts, bounded media/voice, opt-in notices) and experimental pinned signal-cli Signal.
+- **Connected apps**: identity-bound MCP server sessions admit host-selected transports and register prefixed tools; Google Workspace and Microsoft 365 HTTP adapters live under `@arnilo/prism-work/connectors`.
+- **Work family**: `@arnilo/prism-work` replaces `@arnilo/prism-office` — connectors, documents, sheets, diagrams, document-reader, sandbox, and vendored office skills. No pre-1.0 shim.
+- **Durable long runs**: turn-boundary checkpoints with host-only `decision: "continue"`, turn-stop policy, frozen run-bundle snapshots, claim-grounding guardrail, and typed provider failure classes.
+- **Honesty surfaces**: Postgres release evidence is this-commit, channel lease release stays held until the store acknowledges, and observational-memory workers ignore non-tool events on purpose.
+- **11 publishable packages** at current **0.8.0** lockstep, with the migration guide reachable from the release section below — inventory below.
+
+### Carried from the 0.7.0 line
+
+- **Traps closed**: ACP MCP destination matching uses WHATWG origin plus path-segment subtree rules, the ACP launcher requires a real provider (mock mode is explicit), and the model-router facade refuses governance it cannot enforce (`ERR_PRISM_MODEL_ROUTER_ASYNC_REQUIRED` / `_ASYNC_STATE`).
+- **Governed host surfaces**: validated personal/business compositions, governed provider invocation with aggregate task/tenant accounting, durable business-action drafts with editable approvals, Docker process sessions and coherent workspace recovery, Drive knowledge synchronization, snapshot/reconnect with one hosted sandbox, fair worker admission, cross-layer memory lineage with correction/revocation, evidence-backed citations with import-fidelity/OCR reports, and monotonic per-run tool narrowing.
+- **Evidence cockpit**: execution timeline, workflow graph, trajectory/outcome evals (scenarios, trials, manifests), cockpit aggregations, and workflow OpenTelemetry spans — with the cross-package journey matrix behind them.
+- **Attention Compiler**: opt-in per-turn gate that mutates the transcript only after a ratio of the model input cap, with sticky thinking/tool stubs and a host-programmable compaction trigger.
+- **Memory Fabric**: opt-in typed notes (fact/procedure/file/working/episode) with links, validity windows, and time/tool recall over the working, semantic, and observational-memory engines.
+- **Work-scope memory index**: host-named work scopes (`open`/`bind`/`project`/`enter`) project the observational outline; unscoped attach keeps the 0.6.0 dropper.
+- **Host-owned subagent spawn**: `spawn_agent` over the host supervisor (allow-listed children, narrowed identity, redacted results), bounded async spawn with `wait_agent`/`cancel_agent`, opt-in per-child worktree isolation, and redacted `subagent_started`/`subagent_stopped` lifecycle events.
+- **Native Bedrock Converse and governed realtime voice**: `createBedrockConverseProvider` adds a native `Converse`/`ConverseStream` route next to the OpenAI-compatible one, with no AWS SDK dependency; realtime voice sessions stay host-governed.
 
 ### Carried from the 0.6.0 line
 
-- **Node 22 floor**: `engines.node` is `>=22` in all ten publishable packages, the `node20-compat` CI leg becomes `node22-compat`, and `@types/node` moves to `^22.20.0` (plan 071; Node 20 is upstream EOL since 2026-04-30).
+- **Node 22 floor**: `engines.node` is `>=22` in all eleven publishable packages, the `node20-compat` CI leg becomes `node22-compat`, and `@types/node` moves to `^22.20.0` (plan 071; Node 20 is upstream EOL since 2026-04-30).
 - **Folded 0.5.7 content**: the 0.5.7 cut was never published — its durable-tool-round and strict-tool-result fixes, host knobs, peer/options truth, and dependency floors ship in 0.6.0 (migration guide below).
 - **Release-truth gates**: one forward-claim version-literal gate (manifests, internal ranges, lockfile, version constant, index banner, workflow tags), a workflow-liveness gate (every script target and action reference resolves, actions SHA-pinned), and a load-tolerant startup budget ratio (plan 071).
 - **Self-describing coverage failures**: a failing coverage child prints its redacted output tail and records `status`/`exitCode`/`tail` on its artifact row (plan 071).
@@ -35,8 +43,8 @@ Prism is a TypeScript/Node.js agent harness. Hosts own providers, tools, credent
 ## Public contracts
 
 - [Public contracts](public-contracts.md): canonical message, agent, tool, store, resource, credential, and event shapes.
-- [Coding tools, sandboxing, and personas](coding-tools.md): `@arnilo/prism-coding-tools` family subpaths — agent, security, document-reader, openapi, computer-use-linux, dev, personas.
-- [Core runtime, sessions, and governance](core.md): `@arnilo/prism-core` family subpaths — runtime, sessions, governance, credentials, enterprise, work, validation.
+- [Coding tools, sandboxing, and personas](coding-tools.md): `@arnilo/prism-coding-tools` family subpaths — agent, security, openapi, computer-use-linux, dev, personas.
+- [Core runtime, sessions, and governance](core.md): `@arnilo/prism-core` family subpaths — runtime, sessions, governance, credentials, enterprise, validation.
 - [Configuration options index](options-index.md): every public `*Options`/`*Limits`/`*Config` surface mapped to the doc page that owns its fields.
 
 ## Identity and governance
@@ -49,6 +57,7 @@ Prism is a TypeScript/Node.js agent harness. Hosts own providers, tools, credent
 ## Agent/session runtime
 
 - [Agent/session runtime](agent-session-runtime.md): create agents/sessions, `run`/`prompt`/`steer`/`stream`, durable resume, batch approvals, per-run `toolNames` narrowing.
+- [Durable runs](durable-runs.md): turn-boundary `checkpointPolicy: "every-turn"` checkpoints and `decision: "continue"` crash recovery for long runs.
 - [Agent definitions](agent-definitions.md): declarative `AgentDefinition` resolution and `AGENT.md` bundle discovery, fail-closed activation.
 - [Agent loops](agent-loops.md): replaceable loops with `limits.maxToolRounds` budgets and durable revision/restore hooks.
 - [Guardrails](guardrails.md): typed fail-closed input/output/tool checks with redacted decision records.
@@ -111,7 +120,7 @@ Prism is a TypeScript/Node.js agent harness. Hosts own providers, tools, credent
 - [System prompts](system-prompts.md): layered system prompts plus trust-gated `AGENTS.md`/`SYSTEM.md` file auto-load.
 - [Versioned prompt registry](prompt-registry.md): immutable content-hashed prompt assets with durable stores and bounded diff.
 - [Instruction injection](instruction-injection.md): package injectors layer redacted instructions without granting capabilities.
-- [Context and skills](context-and-skills.md): ordered context providers, progressive skill disclosure, fail-closed activation.
+- [Context and skills](context-and-skills.md): ordered context providers, progressive skill disclosure, fail-closed activation. `@arnilo/prism-work` ships `docx`, `xlsx`, `powerpoint`, `pdf`.
 - [LLM Wiki](wiki.md): optional knowledge compiler emitting OKF bundles, with `/wiki-ingest` raw staging (text, file, image, or URL via a host `fetchUrl` hook) and on-device hybrid search.
 - [Retrieval-augmented generation](rag.md): bounded source lifecycle, hybrid retrieval, permission-trimmed query legs, reranking, evidence-backed citations, inert injection.
 - [Knowledge synchronization](knowledge-sync.md): paged enterprise-source import with a Drive connector, checkpointed change cursors, and host-owned ACL mapping.
@@ -124,15 +133,17 @@ Prism is a TypeScript/Node.js agent harness. Hosts own providers, tools, credent
 - [Tool execution primitives](tool-execution-primitives.md): bounded JSON Schema validation, parallel dispatch, MCP bridge mapping.
 - [Tool validator JSON Schema package](../packages/prism-core/README.md): optional `@arnilo/prism-core/validation/json-schema` adapter.
 - [MCP client bridge and server exposure](mcp-tools.md): SDK v2 bridge and serving with OAuth transports and DNS-pinned transport.
+- [Connected apps](connected-apps.md): identity-bound MCP server sessions that admit host-selected transports and register prefixed tools.
 - [Web search, fetch, and extraction](web-tools.md): Brave/Exa/Firecrawl tools with finite limits, hashed web evidence snapshots, and untrusted-content boundaries.
-- [Work tools](work-tools.md): identity-scoped M365/GWS connectors — durable draft persistence, revision binding, draft-then-approve, isolated subprocess environments.
+- [Work tools](work-tools.md): identity-scoped M365/GWS connectors — scanned file get, hash-bound uploads/copies, fixed Docs/Sheets/Slides updates, approvals, isolated subprocess environments.
 - [Work connectors](work-connectors.md): connector principles, capability gates, scoped OAuth establishment, out-of-scope boundaries.
+- [Work sandbox](work-sandbox.md): host-pinned document image and `createWorkComposition` — office/exec in an injected Docker sandbox, connectors stay on the host.
 - [Browser automation](browser-automation.md): Playwright-backed browser tools with egress policy, caps, and verified checkpoints.
 - [Device adapters](device-adapters.md): deny-by-default realtime voice/desktop-control contract with consent and sandbox gating.
 - [Linux desktop control](computer-use-linux.md): optional `computer-use-linux` MCP wrapper — doctor-first, approval-gated mutators.
 - [Obscura browser engine](obscura.md): optional host-binary browser engine adapter with fail-closed lifecycle and CDP composition.
 - [Coding agent tools](coding-agent-tools.md): shell/read/write/edit/search toolset with caps, document reader, and optional Git awareness.
-- [Document reader](document-reader.md): bounded PDF/DOCX text extraction behind `createReadTool({ documentReader })`; optional host-selected Mistral OCR parser (not default).
+- [Document reader](document-reader.md): bounded PDF/DOCX/XLSX/PPTX text extraction behind `createReadTool({ documentReader })`; optional host-selected Mistral OCR parser (not default).
 - [Indexed code search](indexed-code-search.md): host-owned incremental index seam; results labeled `untrusted_index`.
 - [Coding workspaces](coding-workspaces.md): worktree lifecycle with CheckpointStore CAS records, LeaseStore fencing, and opt-in per-child spawn isolation.
 - [Coding review and diagnostics](coding-review-and-diagnostics.md): bounded patch-review manifests and normalized LSP diagnostics.
@@ -159,6 +170,7 @@ Prism is a TypeScript/Node.js agent harness. Hosts own providers, tools, credent
 ## Configuration/manifests
 
 - [Configuration and manifests](configuration-and-manifests.md): layered JSON config merge with data-only manifest validation.
+- [Effective run bundle snapshots](run-bundle.md): frozen JSON projection of the effective run bundle — prompt/skill/tool/guardrail digests, resolved limits, storage kinds, one pinning digest, zero network or store reads.
 - [Host compositions](host-compositions.md): personal and business worker host compositions, inspection reports, storage durability truth, sandbox isolation, and fail-closed readiness enforcement.
 - [Node filesystem config loader](node-filesystem-config.md): explicitly read caller-named JSON config files in Node.
 - [Resource loading](resource-loading.md): decode text/JSON/binary through caller-provided loaders; RAG bridge.
@@ -203,7 +215,7 @@ Prism is a TypeScript/Node.js agent harness. Hosts own providers, tools, credent
 - [Compaction conformance](compaction-conformance.md): assert redacted non-empty summaries and abort observation.
 - [Tool conformance](tool-conformance.md): assert blocked-reason matrix and success-path dispatch behavior.
 - [Extension conformance](extension-conformance.md): assert inert contributions and redacted setup errors.
-- `examples/`: compile-checked typed examples ([`conversation-durable-replay.ts`](../examples/conversation-durable-replay.ts), [`artifact-review-delivery.ts`](../examples/artifact-review-delivery.ts), [`enterprise-identity.ts`](../examples/enterprise-identity.ts), [`enterprise-policy-audit.ts`](../examples/enterprise-policy-audit.ts), [`enterprise-work-connectors.ts`](../examples/enterprise-work-connectors.ts), [`server-deployment-seams.ts`](../examples/server-deployment-seams.ts), [`neuralwatt-agent-run.ts`](../examples/neuralwatt-agent-run.ts), [`cache-aware-prompt-assembly.ts`](../examples/cache-aware-prompt-assembly.ts), [`ag-ui-server.ts`](../examples/ag-ui-server.ts), [`acp-coding-host.ts`](../examples/acp-coding-host.ts), and more), plus runnable mock demos.
+- `examples/`: compile-checked typed examples ([`conversation-durable-replay.ts`](../examples/conversation-durable-replay.ts), [`artifact-review-delivery.ts`](../examples/artifact-review-delivery.ts), [`enterprise-identity.ts`](../examples/enterprise-identity.ts), [`enterprise-policy-audit.ts`](../examples/enterprise-policy-audit.ts), [`enterprise-work-connectors.ts`](../examples/enterprise-work-connectors.ts), [`connected-slack-mcp.ts`](../examples/connected-slack-mcp.ts), [`server-deployment-seams.ts`](../examples/server-deployment-seams.ts), [`neuralwatt-agent-run.ts`](../examples/neuralwatt-agent-run.ts), [`cache-aware-prompt-assembly.ts`](../examples/cache-aware-prompt-assembly.ts), [`ag-ui-server.ts`](../examples/ag-ui-server.ts), [`acp-coding-host.ts`](../examples/acp-coding-host.ts), [`telegram-agent.ts`](../examples/telegram-agent.ts), [`signal-agent.ts`](../examples/signal-agent.ts), [`messaging-agent.ts`](../examples/messaging-agent.ts), and more), plus runnable mock demos.
 
 ## Third-party integrations
 
@@ -211,10 +223,15 @@ Prism is a TypeScript/Node.js agent harness. Hosts own providers, tools, credent
 - [Ponytail behavior integration](ponytail.md): upstream Ponytail skills with injector and peer resolution; opt-in.
 - [Graft context-graph integration](graft.md): graft CLI pull tools, retrieval-pack context provider, blast-radius middleware, and `/graft-init` / `/graft-build` / `/graft-build-deep` commands (host-configured `deepModel`).
 - [Impeccable behavior integration](impeccable.md): upstream Impeccable skill behind `load_skill`; host supplies the compiled `SKILL.md`.
+- [Messaging channels](messaging-channels.md): `@arnilo/prism-channels` transport-neutral runtime — deny-by-default sender authorization, owned session binding, serialized turns, current-run replies, one-use durable approvals, bounded attachment refs (images reach the model only when it declares image input), and opt-in host notices to one already-bound pair.
+- [Telegram channel](telegram-channel.md): official `@arnilo/prism-channels/telegram` long polling and mountable webhook ingress with durable offset/lease handling, approval callbacks, opt-in granted group/topic text, bounded media with optional voice transcription/synthesis, and opt-in streaming drafts.
+- [Signal channel (experimental)](signal-channel.md): `@arnilo/prism-channels/signal` pinned signal-cli v0.14.8 private-socket manual receive, explicit policy gate, UUID DM filtering and bounded ambiguous delivery.
+- [Messaging channel operations](messaging-channel-operations.md): durable journal, restart and reconciliation contract, lease fencing, retention and the operator runbook.
 
 ## Release and install
 
 - [Release and install](release-and-install.md): install rules, package graph, and deterministic resumable publication.
+- [Migrate 0.7 → 0.8](migrate-to-0.8.md): work-family import map, messaging channels, connected apps, durable runs, and 0.8.0 host migration steps.
 - [Migrate 0.6 → 0.7](migrate-to-0.7.md): ACP MCP allow-list URL normalization, model router facade fail-closed governance, and 0.7.0 host migration steps.
 - [Migrate 0.5 → 0.6](migrate-to-0.6.md): Node 22 floor, folded 0.5.7 host delta, third-party floors, and upgrade/rollback steps.
 - [Migrate 0.5](migrate-to-0.5.md): 0.4 → 0.5 migration guide with per-release sections and rollback.
@@ -226,18 +243,19 @@ Prism is a TypeScript/Node.js agent harness. Hosts own providers, tools, credent
 The generated inventory below derives from [`scripts/package-truth.json`](../scripts/package-truth.json) — regenerate with `node scripts/package-truth.mjs --emit-docs`, never hand-edit.
 
 <!-- generated:package-truth:inventory begin -->
-**10 publishable manifests** — root `@arnilo/prism` plus 9 workspace packages (3 `prism-*` family packages, 6 capability packages). Generated by `node scripts/package-truth.mjs --emit-docs` — do not hand-edit.
+**11 publishable manifests** — root `@arnilo/prism` plus 10 workspace packages (4 `prism-*` family packages, 6 capability packages). Generated by `node scripts/package-truth.mjs --emit-docs` — do not hand-edit.
 
 | package | version | notes |
 | --- | --- | --- |
-| `@arnilo/prism` | 0.7.0 | core — runtime, CLI/RPC, templates, docs |
-| `@arnilo/prism-coding-tools` | 0.7.0 | family — /agent, /security, /document-reader, /openapi, /computer-use-linux, /dev, /caveman, /ponytail, /impeccable subpaths |
-| `@arnilo/prism-core` | 0.7.0 | family — /runtime, /sessions, /governance, /credentials, /enterprise, /work, /validation subpaths |
-| `@arnilo/prism-providers` | 0.7.0 | family — all provider adapters as `/<adapter>` subpaths |
-| `@arnilo/prism-acp-agent` | 0.7.0 | capability — ACP adapter |
-| `@arnilo/prism-ag-ui` | 0.7.0 | capability — AG-UI/A2A/A2UI adapter |
-| `@arnilo/prism-mcp` | 0.7.0 | capability — MCP client/server/OAuth interop |
-| `@arnilo/prism-memory` | 0.7.0 | capability — memory plus /rag, /compaction/*, /fabric, /graft, /wiki subpaths |
-| `@arnilo/prism-office` | 0.7.0 | capability — /documents, /sheets, /diagrams subpaths |
-| `@arnilo/prism-web-tools` | 0.7.0 | capability — Brave/Exa/Firecrawl plus peer-gated /browser and /obscura subpaths |
+| `@arnilo/prism` | 0.8.0 | core — runtime, CLI/RPC, templates, docs |
+| `@arnilo/prism-channels` | 0.8.0 | family — transport-neutral messaging runtime, durable journal, pairing and one-use approvals; official /telegram (private DMs, opt-in granted groups/topics) and experimental pinned signal-cli /signal |
+| `@arnilo/prism-coding-tools` | 0.8.0 | family — /agent, /security, /openapi, /computer-use-linux, /dev, /caveman, /ponytail, /impeccable subpaths |
+| `@arnilo/prism-core` | 0.8.0 | family — /runtime, /sessions, /governance, /credentials, /enterprise, /validation subpaths |
+| `@arnilo/prism-providers` | 0.8.0 | family — all provider adapters as `/<adapter>` subpaths |
+| `@arnilo/prism-acp-agent` | 0.8.0 | capability — ACP adapter |
+| `@arnilo/prism-ag-ui` | 0.8.0 | capability — AG-UI/A2A/A2UI adapter |
+| `@arnilo/prism-mcp` | 0.8.0 | capability — MCP client/server/OAuth interop |
+| `@arnilo/prism-memory` | 0.8.0 | capability — memory plus /rag, /compaction/*, /fabric, /graft, /wiki subpaths |
+| `@arnilo/prism-web-tools` | 0.8.0 | capability — Brave/Exa/Firecrawl plus peer-gated /browser and /obscura subpaths |
+| `@arnilo/prism-work` | 0.8.0 | capability — /connectors, /documents, /sheets, /diagrams, /document-reader, /sandbox, /skills, /tools subpaths |
 <!-- generated:package-truth:inventory end -->

package/docs/live-testing.md

@@ -71,13 +71,13 @@ Set only the rows you want to run; everything else skips. Least-privilege scope
 | `web-tools/obscura-live` | active | `PRISM_LIVE_OBSCURA` + `PRISM_OBSCURA_BIN` | — | Local obscura CLI binary; suite fails closed if flag set without binary. | Local process, no API spend. |
 | `memory/observational-live` | active | `PRISM_LIVE_OBSERVATIONAL_MEMORY_TESTS` + `OPENAI_API_KEY` | `PRISM_LIVE_OPENAI_MODEL` (not wired yet) | Reuses the OpenAI key as the compaction worker provider. | A few small summarization requests. |
 | `memory/compaction-llm-live` | active | `PRISM_LIVE_COMPACTION_TESTS` | — | Stub leg today: live summary-provider checks are wired by plans/064 Task 6 (provider key + model env TBD there). | n/a until wired. |
-| `office/libreoffice-golden` | active | `PRISM_TEST_LIBREOFFICE` | — | Local LibreOffice binary renders golden documents; no secret. | Local process, no API spend. |
-| `office/drawio-live` | active | any of: `PRISM_LIVE_DRAWIO_URL` / `PRISM_TEST_DRAWIO_URL` | — | Operator-hosted drawio export service URL (not a secret). | 1-2 export requests to your own service. |
+| `work/libreoffice-golden` | active | `PRISM_TEST_LIBREOFFICE` | — | Local LibreOffice binary renders golden documents; no secret. | Local process, no API spend. |
+| `work/drawio-live` | active | any of: `PRISM_LIVE_DRAWIO_URL` / `PRISM_TEST_DRAWIO_URL` | — | Operator-hosted drawio export service URL (not a secret). | 1-2 export requests to your own service. |
 | `core/postgres` | active | `PRISM_TEST_POSTGRES_URL` | — | Throwaway PostgreSQL database URL (sessions + enterprise + event-source + memory vector legs). | Local/container DB, no API spend. |
 | `core/nats` | active | `PRISM_TEST_NATS_URL` | — | NATS server URL with JetStream enabled. | Local/container server, no API spend. |
 | `coding-tools/docker-sandbox` | active | `PRISM_TEST_DOCKER_SANDBOX` + `PRISM_TEST_DOCKER_BIN` + `PRISM_TEST_DOCKER_IMAGE` + `PRISM_TEST_DOCKER_USER` | — | Local Docker daemon + pinned minimal sandbox image; no secret. | Local containers, no API spend. |
 | `coding-tools/e2b-sandbox-live` | active | `PRISM_TEST_E2B_API_KEY` | — | E2B API key; least privilege: one throwaway sandbox, no production templates. | 1 create + 2 exec + filesystem-only pause + connect/resume + kill. |
-| `coding-tools/mistral-ocr-live` | active | `PRISM_TEST_MISTRAL_API_KEY` | — | Mistral OCR API key; least privilege: one throwaway 2-page sample PDF, no Files API upload. | 1 OCR request against mistral-ocr-latest. |
+| `work/mistral-ocr-live` | active | `PRISM_TEST_MISTRAL_API_KEY` | — | Mistral OCR API key; least privilege: one throwaway 2-page sample PDF, no Files API upload. | 1 OCR request against mistral-ocr-latest. |
 | `core/keychain` | active | `PRISM_TEST_KEYCHAIN` | — | Real OS keychain; writes throwaway test entries only. | Local, no API spend. |
 | `acp/client-smoke` | active | `PRISM_TEST_ACP_CLIENT` | — | Real ACP SDK client over stdio in a subprocess; sandboxed, policy never disabled. | Local process, no API spend. |
 | `canaries/deployed` | active | `PRISM_LIVE_CANARIES`; optional: `PRISM_CANARY_TIMEOUT_MS` `PRISM_CANARY_REPORT` | — | Deployed prism provider/MCP/A2A endpoints; script itself validates all PRISM_CANARY_* URL/token vars and credential-free HTTPS. | 1-4 bounded requests (64 KiB JSON cap) against your deployments. |
@@ -104,6 +104,8 @@ Set only the rows you want to run; everything else skips. Least-privilege scope
 | `coding-tools/lsp-forge` | active | — (hermetic leg) | — | LSP/language-intelligence + forge suites: real child-process spawns over the real LSP/forge wire protocols against fixture binaries. | Hermetic; no network. |
 | `ag-ui/conformance` | active | — (hermetic leg) | — | AG-UI + ACP conformance suites: real-event replay over the acp/a2a/ag-ui protocol surfaces (fixture agents, real event-source wire semantics). | Hermetic; no network. |
 | `prism-providers/conformance` | active | — (hermetic leg) | — | Plan-065 machine-checked thinking coverage: every first-party reasoning catalog model declares capabilities.thinkingLevels + a compat.thinkingFamily stamp and emits a legal effort field on the wire (14 catalogs walked hermetically). | free |
+| `channels/telegram-live` | active | `PRISM_LIVE_TELEGRAM` + `TELEGRAM_BOT_TOKEN`; optional: `PRISM_LIVE_TELEGRAM_CHAT_ID` | — | Operator-owned Telegram bot token. getMe + 1s poll; send only if PRISM_LIVE_TELEGRAM_CHAT_ID names a chat you operate. Never creates contacts. | 1 getMe + 1 getWebhookInfo (+ optional 1 sendMessage). |
+| `channels/signal-live` | active | `PRISM_LIVE_SIGNAL` + `PRISM_LIVE_SIGNAL_SOCKET` + `PRISM_LIVE_SIGNAL_ACCOUNT` + `PRISM_LIVE_SIGNAL_TERMS_VERSION`; optional: `PRISM_LIVE_SIGNAL_RECIPIENT_UUID` | — | Existing private signal-cli v0.14.8 Unix socket and account you already operate. Never registers or links. Send only to PRISM_LIVE_SIGNAL_RECIPIENT_UUID. | 1 subscribeReceive + health (+ optional 1 send). |
 <!-- generated:live-matrix:end -->
 
 ## Strict CI workflow

package/docs/mcp-tools.md

@@ -305,6 +305,7 @@ The scenario stays sandboxed (read-only echo tool, authorize-gated denial, no po
 
 ## Related APIs
 
+- [Connected apps](connected-apps.md): identity-bound host admission and lifecycle for a small set of MCP bridges.
 - [Agent identity](agent-identity.md): optional verified identity on MCP authorize results
 - [Tools](tools.md): registry, dispatch, validation
 - [Web search, fetch, and extraction](web-tools.md): preferred direct bounded Brave/Exa/Firecrawl production path