@kodax-ai/kodax 0.7.71 → 0.7.72

package/CHANGELOG.md

@@ -6,500 +6,615 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
-## [0.7.71] - 2026-07-17
+## [0.7.72] - 2026-07-19
 
 ### Added
 
-- **Kimi Code K3 support.** The `kimi-code` subscription provider now exposes
-  `k3-256k` (Moderato) and `k3` (1,048,576 context tokens, Allegretto+) as
-  explicit catalog choices, alongside `kimi-for-coding-highspeed` and the
-  stable `kimi-for-coding` default. Both K3 choices send the upstream model id
-  `k3`, so users do not need to override compaction settings for their plan.
-  K3 sends its effort inside `thinking.effort` on both Anthropic- and
-  OpenAI-compatible transports, defaults omitted reasoning to `max`, and
-  preserves both legacy `reasoning=false` and explicit `effort=none` as disabled
-  thinking. Static capability, reasoning, media, cost-tracking, and opt-in
-  real-wire regressions cover the subscription routes and local context-tier
-  mapping.
-- **Standards-based A2A authentication and Agent activation (FEATURE_267/268
-  closure).** Outbound A2A entries can use OAuth 2.0 Client Credentials with an
-  external Authorization Server, while inbound KodaX Agents can validate RFC
-  9068 JWT access tokens against an external issuer/JWKS as an OAuth Resource
-  Server. The fixed environment Bearer profile remains available for
-  compatibility. A hot `agents.<name>.enabled` switch plus `kodax a2a
-  enable|disable` lets operators keep many configured third-party Agents while
-  controlling which ones admit new orchestration; in-flight tasks are not
-  cancelled.
+- **Learning Center and learned-capability Runtime control plane
+  (FEATURE_266).** KodaX now owns learned capability lifecycle, notification
+  cursors, lower-precedence learned Skill discovery, F224 proposal projection,
+  promotion/rollback actions, and inline/Worker/daemon SDK parity through one
+  agent-layer service. `/learn`, status summaries, and the Ink learning segment
+  expose the same durable state without creating a second runtime engine.
+- **Unified adaptive Actor/Turn control plane (FEATURE_270).** AMA collaboration
+  now uses one Runtime-owned actor tree and scheduler across native, recursive,
+  Workflow-owned, constructed, and external Agent work. The canonical
+  `spawn_agent`, `send_message`, `followup_task`, `wait_agent`,
+  `interrupt_agent`, `list_agents`, and `agent_output` surface supports reusable
+  Actor identities, durable Turn history, direct-parent completion, recursive
+  delegation, shared capacity, and SDK/daemon recovery. A manifest-first,
+  fail-closed behavioral eval driver freezes the released/current production
+  prompt and tool bytes, call graphs, budgets, raw evidence, and blind review
+  mapping before any separately authorized provider call.
 
 ### Changed
 
-- **External Agent SDK migration notes.** `AgentRegistrationService` now
-  requires `setEnabled`; custom implementations must add the same
-  revision/owner-conditional enablement operation. `executorConfig` and
-  executor-reference `metadata` are `AgentJsonObject` values and reject class
-  instances, accessors, circular references, and other non-JSON-safe data at
-  runtime. SDK daemon auto-start without an explicit `homeDir` now follows the
-  resolved `KODAX_HOME`; embedders that intentionally need the OS-home endpoint
-  must pass `homeDir`, while custom endpoints remain attach-only.
+- **Current coding-eval aliases and MiniMax default model.** Newly authored or
+  revised evals now route Zhipu through `zhipu/glm52` (`glm-5.2`) and MiniMax
+  through `mmx/m3` (`MiniMax-M3`). `minimax-coding` now defaults to M3 while
+  the old `zhipu/glm51` and `mmx/m27` aliases remain explicitly selectable for
+  historical replay; existing raw evidence and reports keep their original
+  route labels.
+- **AMA and Workflow orchestration cutover.** AMAW and the old model-visible
+  child-task vocabulary are retired. Persisted `amaw`/`ama-workflow` settings
+  migrate once to AMA, while new inputs fail with a migration hint. Workflow
+  remains available for explicit natural-language, command, named-pattern, and
+  SDK requests, but its child Agents now use the unified Actor scheduler and
+  task complexity alone no longer activates Workflow.
 
 ### Fixed
 
-- **A2A durable-owner upgrade and admission concurrency.** New inbound tasks
-  persist a non-secret principal-key scheme marker. Pre-realm tasks remain
-  inaccessible during normal serving, but stopped operators can use
-  `kodax a2a migrate-tasks` to dry-run and explicitly apply the configured
-  owner mapping; custom hosts can use the public
-  `migrateA2ALegacyTaskOwners()` SDK with exact mappings. Ambiguous or live-
-  store migration fails closed. Global task capacity now uses a synchronous
-  pending reservation, keeping slow workspace/session/run preparation outside
-  any global lock while preserving exact limits and per-principal ordering.
-- **Bounded External Agent and daemon shutdown/startup.** Executor-plane close
-  now has a 30-second default upper bound (overrideable with `closeTimeoutMs`),
-  obsolete-executor cleanup runs outside the serialized registration mutation
-  lane, and revision tombstones are SHA-256 fingerprints capped at 4,096
-  entries. Current registrations and task snapshots continue to enforce exact
-  revision immutability after older, unreferenced tombstones age out. Daemon
-  auto-start now races health checks against the spawned child's exit, keeps
-  the child referenced until readiness, and terminates it on early exit,
-  timeout, identity mismatch, or when another daemon wins ownership. A startup
-  candidate that exits after losing the owner race now lets its SDK caller wait
-  for and attach to the competing owner instead of failing that caller.
-- **Faster packaged-Electron gates.** Release jobs build once and reuse that
-  output for both the Windows Electron smoke and binary packaging. CI and
-  release jobs cache the version-pinned Electron smoke toolchain, whose local
-  directory is now explicitly ignored. Both paths explicitly materialize the
-  Electron binary after cache restore or dependency installation, preventing a
-  successful npm package install with a missing `electron/dist` from bypassing
-  the real packaged-daemon gate.
-- **A2A authentication and reconciliation hardening.** Card-level and
-  Skill-level security requirements now fail closed unless one complete
-  alternative is satisfiable. Card, RPC, and token origins remain separate;
-  exact credentials used by active RPC/SSE requests remain retained through
-  response parsing and are redacted from errors and successful results;
-  concurrent rejected-token invalidation cannot discard a newer token and each
-  RPC retries at most once. Direct SDK and file configuration now share strict
-  issuer, endpoint, resource, and RFC 6749 scope validation. Task ownership
-  also requires a stable `securityRealm` and hashes the
-  `(realm, subject, tenant)` tuple: built-in Bearer/OAuth derive realms from the
-  token-env name/exact issuer, custom authentication must provide one, authority
-  switches and legacy pre-realm tasks fail closed, and same-realm restart
-  preserves new-format tasks. Authentication/effect changes participate in
-  executor revisions; registration persistence
-  precedes catalog mutation; first-class management ownership plus revision-
-  conditional mutations protects unrelated or concurrently replaced SDK
-  registrations, including same-revision owner takeovers; changed authority is
-  fenced before parallel discovery; live drift is repaired; and a final
-  post-preflight admission check closes disable/removal races without
-  rediscovering unchanged peers. Internal immutable route snapshots preserve
-  admitted task input/cancel/reconcile routing across registration update or
-  removal and Runtime restart without exposing secret material or expanding the
-  public task DTO. Admission now rechecks globally unique task IDs, task writes
-  publish to memory only after durable persistence, and terminal event-write
-  failures cannot strand waiters or route snapshots. Returned registration
-  summaries are detached, executor cache keys are unambiguous tuples, and one
-  ownership conflict or observer failure cannot abort unrelated Agent
-  reconciliation or leave unawaited activation work. Daemon A2A ownership is
-  now bound to the exact resolved config home—`<homeDir>/.kodax` when explicitly
-  selected, otherwise the possibly arbitrary `KODAX_HOME`—recorded in daemon
-  state, and checked across every local profile before mutation. Legacy
-  non-empty version-1 A2A files require an explicit stopped-owner migration,
-  while version-2 migration is a read-only idempotent no-op. Failed initial A2A
-  reconciliation also closes the newly created Runtime before releasing daemon
-  ownership.
-- **A2A post-closure lifecycle and resource correctness.** Executor operations
-  and close now drain without disposal races; configured artifact references
-  and direct `a2a call` use a bounded reference-only/no-fetch policy. CLI task
-  RPC/SSE permits 32 MiB while Card/interface/OAuth/security metadata remains
-  capped at 2 MiB, and unsupported required Card extensions fail discovery.
-  Daemon mutation now requires independently owner-derived
-  `externalAgentAdmin: 1` and `a2aConfigReconciler: 1`; capability overrides
-  cannot forge them. Public `/a2a` config exports are read-only, with raw writers
-  retained inside the fenced CLI owner. Inbound serving now has a global
-  admission reservation, subscribe-first replay, authentication-before-body,
-  exact JSON/SSE media matching, an admitted-handler close barrier, and fixed
-  four-per-task/eight-per-server/24 MiB-per-stream SSE ceilings without
-  terminating the underlying task for one slow subscriber.
-- **Public Kimi Open Platform parity and live coverage.** `kimi` now defaults to
-  `kimi-k2.7-code`, exposes the HighSpeed route and wire-legal K2.5 id, uses the
-  exact 262,144-token limits and current prices, and has gated real-key coverage
-  for credential verification, K2.7 thinking, forced-tool fallback, and K2.6
-  thinking disablement. K2.7 disable requests now fail locally instead of being
-  silently ignored, while K2.6 disable requests emit the required wire toggle.
+- **Remote Runtime subscription readiness.** Daemon event/workflow
+  subscriptions now expose an awaitable `RuntimeSubscription.ready` handshake,
+  so hosts can establish cross-client ordering before starting work whose first
+  event must not be missed. Handshake failures remain observable to new callers
+  without creating unhandled rejections in legacy callers that ignore `ready`.
 
-- **Packaged Electron shared-daemon auto-start.** Runtime SDK embedders running
-  from packaged/asar Electron applications now launch the detached daemon child
-  through a bootstrap-only Node execution boundary without changing the host or
-  long-lived daemon environment, leaking `ELECTRON_RUN_AS_NODE` to user child
-  processes, or opening a second GUI instance. Trusted internal JavaScript
-  children retain a bounded Electron-to-Node launch path. Missing packaged CLI
-  sidecars fail immediately, disabled `RunAsNode` fuses receive an actionable
-  timeout diagnostic, and a real Windows Electron 42.5.0 + asar smoke now gates
-  CI and releases. Public docs also distinguish CLI-style `homeDir` from the
-  lower-level `.kodax` path used by `KODAX_HOME`.
-- **Cross-platform release template checks.** Generated configuration templates
-  now compare normalized line endings, so Windows CRLF checkouts no longer report
-  false drift during binary builds.
+- **Detached daemon lifecycle cleanup.** CLI and SDK startup now retain the
+  exact candidate process until its PID is healthy and reclaim only that process
+  tree on early exit, timeout, identity mismatch, owner-race loss, or startup
+  cancellation. Vitest-owned daemons also shut down when a forcibly terminated
+  worker cannot run normal teardown; production daemons remain persistent after
+  ordinary client detach and have no idle reaper. A source daemon child now
+  carries only KodaX's production preload, explicit `tsx` support, and safe
+  Node engine flags instead of inheriting arbitrary parent loaders, preventing
+  test-runner hooks from parsing daemon CLI arguments.
 
-## [0.7.70] - 2026-07-15
+- **Windows memory lifecycle lock contention.** Concurrent forget/archive
+  operations now retry short-lived Windows sharing denials within the existing
+  bounded lock deadline instead of failing immediately with `EPERM`; unrelated
+  filesystem errors remain fail-fast.
 
-### Added
-
-- **Typed shared-daemon rollback management (FEATURE_269 patch).** Daemon
-  facades now expose revisioned management inspection and atomic
-  `stopForInline()`, plus public owner-fence queries and revision-free daemon
-  re-enable helpers for safe embedder rollback workflows.
-
-### Changed
-
-- **KAI-FCL licensing from v0.7.70.** Official KodaX source, binaries, and npm
-  packages now use the KodaX-AI Fair Core License 1.0: community use remains
-  available, while commercial or managed use requires KodaX-AI authorization.
-  Previously released Apache-2.0 copies retain their original grants.
-
-### Fixed
-
-- **A2A interoperability and execution boundaries.** Selected Card interfaces
-  remain bound to their trusted discovery origin and advertised Bearer scheme;
-  concrete recursive reads and child runs retain the parent policy ceiling;
-  pending input resumes the original Runtime run; task retention, history,
-  cleanup, stable cursor pagination, protocol correlation/version, authenticated
-  SSE, appended artifact chunks, and early-stream-EOF semantics are bounded;
-  and direct, staged, or successfully promoted admitted Skill outputs are
-  returned as negotiated artifacts without exposing ordinary workspace writes.
-- **MCP multilingual zero-match efficiency.** Compact CJK queries now segment
-  into words, while cross-language lexical zero matches can return a lossless
-  shared-prefix exact-id inventory only when it is no more expensive than a
-  normal default search page and fits the real result capacity. Oversized
-  recovery emits one concise catalog-language retry with no biased partial list.
-  Fully unavailable catalogs no longer trigger a duplicate inventory attempt;
-  concurrent discovery is coalesced, in-flight invalidation cannot be overwritten,
-  and filtered cursor revisions ignore unrelated capability families.
-- **Logical daemon client accounting.** Stop preflight now counts only live,
-  initialized SDK clients. Daemon self-connections and read-only health probes
-  are excluded, and awaited client close converges the count across processes.
-  Health probes also tolerate the daemon token disappearing during a concurrent
-  shutdown or owner transition instead of leaking an `ENOENT` race to clients.
-- **Preflight/stop race.** Rollback commit gates new clients and mutations,
-  validates the same Runtime, management revision, owner-policy revision, and
-  blockers, and changes sticky inline policy while the verified daemon still
-  owns the profile fence. Stale commits fail with structured `conflict` and do
-  not stop or change policy.
-- **Complete rollback draining and background-work blockers.** Credential and
-  Host Tool bridge state can no longer change after draining starts, while
-  running/paused Workflows and non-terminal or unknown External Agent tasks now
-  block stop and participate in the management revision. Reverse-result frames
-  remain outside the durable journal so credentials and Host Tool results are
-  not persisted. In-flight stop conflicts identify the active mutation methods
-  and counts so lifecycle stalls can be diagnosed without reproducing them.
-
-## [0.7.69] - 2026-07-15
-
-> Scope note: this release delivers **FEATURE_267**, **FEATURE_268**, and
-> **FEATURE_269** as one bounded interoperability/runtime release: bidirectional
-> A2A 1.0, split hot-reloadable integration configuration, and one authoritative
-> shared Coder daemon with secure host bridges. It does not expose the daemon
-> remotely, migrate Partner from its private embedded Runtime, or publish
-> credentials/Host Tools outside their bound run.
-
-### Added
-
-- **Bidirectional A2A 1.0 interoperability (FEATURE_267).** Added the
-  `@kodax-ai/kodax/a2a` integration edge: allowlisted Agent Card discovery and
-  a JSON-RPC/SSE executor over the existing F258 plane, plus an authenticated,
-  caller-scoped, durable Runtime-backed KodaX Agent server with continuation,
-  cancellation, ordered replay/subscription, and restart reattachment.
-- **No-code A2A product path and Runtime binding.** Added declarative
-  `a2a add/list/test/call/remove`, automatic `external:<name>` registration for
-  built-in Runtime owners, and explicit `a2a expose` / loopback-only `a2a
-  serve`. The inbound server can publish the Runtime default or one validated
-  user Markdown Agent with pinned Agent/Skill/tool/workspace revisions,
-  structured `toolPolicy`, `~/.agents/skills` discovery, and exact Skill-script
-  execution through the fail-closed ASRT adapter.
-- **Split integration configuration and hot reload (FEATURE_268).** MCP, A2A,
-  and Extensions now use one user-level versioned file per domain, backed by
-  four canonical templates, explicit lossless migration, locked atomic writes,
-  last-known-good watchers with metadata fallback, whole-provider MCP draining,
-  entry-transactional Extension/outbound-A2A reconciliation, and explicit
-  restart-required handling for inbound execution/store authority changes.
-- **A2A network and publication boundaries.** Outbound fetches enforce origin,
-  DNS/private-address, TLS, redirect, credential, timeout, content-type, and
-  size policy. The built-in server listener is loopback-only; public hosts use
-  `handle()` behind TLS. A2A 0.3, gRPC, HTTP+JSON, push notifications, automatic
-  public Agent exposure, and remote Runtime configuration are not advertised.
-- **Authoritative shared Coder daemon (FEATURE_269).** Added atomic
-  `sessions.observe()` join/resync, durable operation identities and receipts,
-  stable same-session ordering, settings/grant CAS, transport-safe AskUser and
-  permission resolution, live run projection, structured restart outcomes, and
-  a truthful per-capability Coder compatibility matrix for CLI, Space, IDE, and
-  SDK clients.
-- **Shared-daemon SDK completion.** Server-side Coder/Partner admission now
-  covers every session and run path; late-join snapshots include transcript
-  revision, managed tasks, queued continuation metadata, and reverse
-  requirements. The SDK adds prompt connection lifecycle signals, typed event
-  parsing with per-event degradation, daemon-safe run DTOs,
-  `agentMode`/`autoModeEngine` settings CAS, durable operation/Host Tool outcome
-  queries, and daemon stop/rollback preflight.
-- **Secure host bridges and owner fencing.** Provider credentials are supplied
-  just in time through stable-client/run/provider-bound leases and never
-  persisted. A keychain-held stable client secret can reattach credential and
-  Host Tool handlers after Space reconnects; Host Tools remain immutable and
-  run-bound, with fsynced dispatch truth and explicit unknown outcomes rather
-  than blind replay. Daemon and inline Coder ownership share one revisioned
-  fence with sticky rollback, while Partner remains isolated.
-
-### Changed
-
-- **Tool-result delivery now optimizes end-to-end context use.** Tool handlers
-  collect complete results and one aggregate next-request capacity owner keeps
-  every result inline when the batch fits. Default Bash processing no longer
-  applies command-specific lossy filters; its former 512 KiB capture limit is
-  now only a memory-to-disk spool threshold. Capacity is solved against the
-  final input (`Pmax`), so the 3% uncertainty margin grows with the admitted
-  batch instead of being frozen at the smaller pre-batch request.
-- **History compaction is physical-capacity driven.** Default automatic
-  compaction waits until the final provider envelope (system prompt, actual
-  tools, messages/framing, output reserve, and safety margin) cannot fit.
-  Default microcompaction and destructive pre-summary/fallback pruning are off;
-  pressure uses semantic summary first and stops as soon as the next request
-  fits. Static early percentages remain explicit opt-ins, and manual
-  `/compact` remains an explicit force operation.
-- **Self-knowledge follows the v0.7.69 capability surface.** `kodax_manual`
-  now documents the three split integration files and migration/hot-reload
-  behavior, the `/a2a` SDK subpath, atomic shared-daemon observation, durable
-  controls, run-scoped credentials/Host Tools, and daemon/inline ownership.
-
-### Fixed
-
-- **Recoverable overflow and hidden output caps.** Overflow of the final
-  operational request budget saves the complete result and emits one explicit
-  incomplete marker. Long lines have exact continuation offsets, completed task
-  output is complete, and hidden caps were removed from grep, glob, code search,
-  and retrieval rendering.
-- **Cache token accounting and history preservation.** Cache tokens are charged
-  once. Empty, failed, or insufficient summaries now surface a typed capacity
-  error while retaining the canonical transcript and immutable Worker prompt.
-- **Tool-result completeness and retention edge cases.** No-usage accounting
-  includes the final system prompt, active schemas, and same-request recovery;
-  explicit limits use one-extra-item probes; delayed Bash drain remains
-  recoverable. Referenced result/image artifacts and fresh checkpoints are no
-  longer removed by age-only cleanup.
-- **Post-review capacity correctness.** Trusted artifact metadata cannot be
-  forged by raw tool text; failures carry the last legal transcript; observers
-  see admitted content; child evidence uses the routed model's physical budget;
-  bounded acquisition exposes continuation instead of silent loss; direct Bash
-  artifacts remain canonical without nested spill markers.
-- **Windows process-tree fallback.** A failed or timed-out `taskkill /t` now
-  triggers a native Toolhelp parent snapshot before direct escalation, with
-  CIM/WMIC retained only as fallback. Agent and LLM cleanup stay aligned and a
-  real nested-process regression proves descendants exit.
-- **Windows lock deletion races.** Proposal and lifecycle lock probes treat
-  transient `EPERM`/`EACCES`/`EBUSY` as non-stale and retry, preserving the
-  fail-closed owner-token contract during concurrent removal.
-- **Frozen FEATURE_259 eval inputs.** The pre-iteration dispatch schema is
-  reconstructed from its historical bytes, so later production tool-schema
-  improvements cannot mutate the baseline or invite a hash-only CI workaround.
-- **Governed-memory Bash guard bypasses.** Commands that directly address
-  recognized scoped or legacy memory roots now permit only one simple read-only
-  inspection; command chaining, pipelines, redirects, home-relative paths, and
-  interpreter writes fail closed at the Bash tool boundary.
-- **Memory proposal and review persistence integrity.** Invalid approval
-  metadata now produces a store warning and blocks rewrites; project-less review
-  drains no longer claim project-owned work; persisted outcome evidence receives
-  full shape validation; atomic writes clean temporary files on failure.
-- **Memory store lock ownership.** Proposal and lifecycle locks now carry a PID
-  plus random owner token, avoid reclaiming stale locks held by a live process,
-  and remove a lock only when the releasing owner token still matches. Lifecycle
-  state writes now use temporary-file rename instead of direct truncating writes.
-- **Interactive resume handoff and large-store startup.** Bare `kodax -r` now
-  keeps the selected session through the picker-to-TUI handoff instead of
-  exiting, and the picker uses bounded metadata paging instead of repeatedly
-  full-reading every matching session before it opens.
-- **A2A/configuration release hardening.** Review gaps in remote execution,
-  Skill-script admission/isolation, hot reload, listener preparation, binding
-  pinning, last-known-good reconciliation, and redacted diagnostics now fail
-  closed or retain the prior healthy revision as specified. The public A2A
-  server type now exposes its existing readiness wait, validated DNS results
-  narrow explicitly to IPv4/IPv6, and safe request-body typing no longer
-  depends on an undeclared DOM global, keeping root TypeScript validation green.
-
-## [0.7.68] - 2026-07-12
-
-> Scope note: this release delivers **FEATURE_260**, the KodaX Memory Agent,
-> as a thin experimental SDK and governed runtime extension over the existing
-> F228 Memory Control Plane. It does not add a second memory database, a
-> resident specialist agent, filesystem memory actions, or online self-modification.
-
-### Added
-
-- **Thin experimental Memory Agent SDK.** Added
-  `@kodax-ai/agent/experimental-memory` and the root `/experimental-memory`
-  entry with scoped `MemorySession` lifecycle, zero-wait passive recall,
-  read-only deliberate `query()`, bounded observations, and episode outcomes.
-- **Deliberate governed recall for the Action LLM.** A session-bound
-  `memory_recall` tool exposes only one `need` field, returns prompt-safe
-  low-authority evidence from the same F228 plane, and keeps identity, scope,
-  revision, and sequence outside model input.
-- **Auditable memory decisions and outcomes.** Trace-only
-  `MemoryDecisionReceipt` records candidate/selected/injected refs and policy
-  version; accepted Outcome Digests can conservatively link influence without
-  storing hidden reasoning or creating a second event store.
-- **Bounded episode review and promotion.** Timed-out review work persists in a
-  scoped inbox for bounded next-session drain and revalidation. Promotion now
-  consults compatible claims before choosing create, evidence update,
-  condition refinement, conflict, no-action, reject, or quarantine.
-
-### Changed
+- **MiniMax M3 default media regression.** The media capability suite now
+  expects the current `minimax-coding` default, MiniMax M3, to support image
+  input while retaining fail-closed checks for unverified nearby routes.
 
-- **Memory applicability is exact and fail-closed.** Tenant, user, agent,
-  workspace, project, and branch identity participate in deterministic scope
-  checks; sibling/cross-user/cross-tenant fallback is prohibited.
-- **Memory policy is source-versioned and cache-safe.** `f260-v0.7.68.2`
-  binds production reminder rules, evidence rendering, and deliberate-recall
-  tool bytes. Passive reminders only affect the dynamic suffix; deliberate
-  queries add a normal tool-call/result tail while preserving earlier provider
-  cache bytes.
-- **Safety-critical boundaries remain deterministic.** Secret filtering,
-  memory-file mutation guards, poisoning/source-evidence checks, and governed
-  proposal/preview/fingerprint/apply remain zero-violation code gates rather
-  than probabilistic LLM recall thresholds.
-- **Self-knowledge follows the v0.7.68 capability surface.** `kodax_manual`
-  now has a dedicated governed-memory topic, names all 43 built-in slash
-  commands under a two-way drift guard, and documents the current 10 SDK
-  subpaths plus Runtime and `/experimental-memory` ownership boundaries.
+- **Bare resume cancellation terminal release.** Pressing Esc in `kodax -r`
+  now pauses and unreferences the picker-owned stdin path before the bootstrap
+  exits, so Windows PowerShell regains its prompt immediately without requiring
+  an extra keypress. The full CLI remains unloaded while listing sessions,
+  successful selection hands input to the REPL, and replay retains each
+  persisted event timestamp.
+- **Auto[LLM] approval reliability.** The default classifier budget is now 20
+  seconds, pure readonly invocations bypass classification by invariant, and
+  SDK/daemon session settings can select the classifier model and timeout without
+  stale guardrail-cache reuse. Runtime advertises and requires
+  `runtimeAutoModeGuardrail:1` for auto-started daemon clients, owns the Session
+  guardrail ahead of the generic permission hook, persists LLM-to-rules
+  fallback, and creates a shared pending request only for an explicit
+  escalation. An older daemon is replaced only after a revision/owner-policy
+  fenced preflight proves that active/queued work and pending interactions are
+  absent; busy or unfenceable daemons return a typed recoverable error. The one
+  conditional readonly exception, `semantic_lookup(refresh:true)`, remains
+  classified because it rebuilds the on-disk derived index.
+- **Runtime permission boundary correctness.** Relative operands resolve from
+  the validated execution directory while `gitRoot` remains a safety boundary;
+  Windows containment is case-insensitive, deterministic direct/nested-shell
+  writes to the user `.kodax` credential zone are Tier-0 denied, and quoted
+  Python/regexp source is not treated as a path. Permission previews use a
+  scan-bounded field whitelist, omit write/edit bodies, redact JSON/YAML/PEM
+  and command-line credentials, and remain valid size-limited JSON with that
+  directory. `exit_plan_mode` is absent without a real host approval bridge.
+- **0.7.x SDK source compatibility.** Deprecated `amaw` input is accepted and
+  normalized to AMA without restoring retired behavior; formal `SkillSource`
+  remains exhaustive while `ResolvedSkillSource` adds `learned`; daemon
+  preflight normalizes canonical `activeAgentTurns` and deprecated
+  `activeAgentTasks` to the same required array across old and current wire
+  shapes.
+- **Queued follow-up responsiveness.** REPL, AMA, and SA now share the same
+  Actor queue routing contract while SA retains its legacy unscoped queue. User
+  input wakes `wait_agent` and idle-yield through lossless subscriptions and
+  resumes at a safe turn boundary without canceling unrelated parallel tools.
+  SDK media follow-ups accept an explicit `sessionId`, preserve old single-Actor
+  calls through lifecycle-bound auto-routing, and reject ambiguous concurrent
+  calls instead of crossing sessions.
 
-### Fixed
-
-- **Post-review Memory Agent release hardening.** Repository identity now strips
-  Git remote userinfo/query credentials before scoped or legacy persistence;
-  managed-path guards are Windows-case-safe, protect governance sidecars, and
-  fail closed for non-read-only shell access to addressed memory roots. Episode
-  reviews use atomic processing claims with stale recovery, while proposal and
-  lifecycle stores serialize concurrent read-modify-write updates. Eval manifest
-  schema v2 binds untracked file bytes in addition to the tracked patch, corrupt
-  raw JSON fails loudly, and summary review state points to the separate
-  main-session review artifact instead of remaining permanently pending.
-- **Runtime daemon state replacement is atomic.** Daemon lifecycle updates now
-  stage and rename `daemon.json` instead of truncating it in place, preventing
-  shutdown polling from mistaking a partial write for completed cleanup and
-  leaving an orphaned `stopping` process under full-suite load.
-
-### Performance
-
-- **The preregistered v2 memory-routing panel passes all release gates.** On
-  `ark/v4flash`, general immediate recall passed 59/60 (98.3%), high-value
-  recall 40/40, must-silent 200/200 (Wilson lower 98.1%), paired routing lift
-  was +73.3 percentage points with zero control regression, and bounded
-  two-decision recovery passed 20/20. The 520-cell panel represented 782,721
-  tokens and an estimated $0.004447 against the $0.02 cap. Main-session blinded
-  review recommends ship for routing value while documenting that the panel is
-  not an end-to-end task-completion claim.
-
-## [0.7.67] - 2026-07-11
-
-> Scope note: a stabilization and agent-efficiency release. **FEATURE_258**
-> adds the protocol-neutral external-agent executor plane, **FEATURE_259**
-> makes workflow/review orchestration more focused and cost-disciplined, and
-> the bounded corrective **FEATURE_261** delivers searchable session resume
-> plus safe ACP-session cleanup. GitHub source/binary release work is included;
-> npm publication remains a separate operator step.
-
-### Added
-
-- **External Agent Executor Plane and dispatchable catalog.** Host-injected
-  executors now share a protocol-neutral registration/catalog/task contract,
-  redacted policy-filtered discovery, durable task ledger, recovery, and a
-  reference executor. Worker tools, Workflow, Embedded Runtime, and daemon
-  clients discover and dispatch the same canonical agent IDs.
-- **External-agent SDK and daemon surfaces.** Runtime sessions expose catalog,
-  start/continue/cancel/reconcile, event, and task-result operations with
-  versioned schemas, configuration revisions, credential-presence checks, and
-  public in-process daemon-factory bootstrap support.
-- **Focused scoped-review workflow.** `/review --workflow` now uses immutable
-  review packets, one primary per scope, an additional authoritative primary
-  only for risk-flagged packets, batched fresh verification for candidate
-  findings, stable finding IDs, capable synthesis, and an audit artifact.
-- **Explicit model-tier intent and route telemetry.** Workflow and substantive
-  child briefs carry focused scope/constraints/evidence/output fields plus
-  explicit `fast` / `balanced` / `deep` intent. Runtime reports the resolved
-  source, fallback, effort, usage, duration, packet-read topology, and token
-  coverage without fabricating missing external usage.
-- **Searchable session resume picker.** Running `kodax -r` without an ID now
-  opens an interactive TUI with incremental search, keyboard selection, title
-  completion, pagination, and the full selected session ID. An explicit value
-  resolves a complete ID first, then a unique exact title; duplicate titles
-  open a narrowed picker rather than silently selecting one.
-- **Session listing filters and cursors.** SessionManager, Runtime SDK, and
-  daemon protocol listings now accept an exact `surface` filter and an opaque
-  continuation `cursor`, applied before the requested page limit.
-
-### Changed
-
-- **Resident workflow context is smaller and discoverable.** The turn-resident
-  `run_workflow` hint stays below the deferred-tool budget while the full
-  authoring contract remains available through `tool_search`. Recorded
-  workflow-shaped plans start directly instead of being expanded into duplicate
-  todo/dispatch scaffolding.
-- **Review handoffs are structured and conservative.** Positive observations
-  are not findings; missing evidence remains `not-verifiable` rather than being
-  promoted into a defect; unreasoned severity overrides retain the original
-  severity instead of failing the review.
-- **Eval execution is value-driven and bounded.** Main-session evidence review
-  determines whether a candidate has material value over baseline; executor
-  aliases are not reused as judge models. Raw reuse, per-call/round/token/cost
-  caps, one bounded structured repair, and provider/model concurrency lanes
-  prevent runaway panels.
-- **SDK embedder documentation matches the v0.7.67 public surface.** The guide
-  now covers external-agent owner/consumer setup and safety boundaries, Runtime
-  registration/catalog/task services, exact-surface session pagination,
-  run-scoped workflow tiers, live route facts, and durable efficiency reports;
-  the English/Chinese subpath tables reflect all 10 published SDK entries.
-
-### Fixed
-
-- **Restricted Workflow scripts preserve the public Agent routing contract.**
-  `phase` and FEATURE_258 `target` values now cross the script host boundary
-  with fail-loud validation, so generated/saved workflows can route the same
-  canonical external Agent IDs as direct Workflow and Worker dispatch.
-- **Executor-plane shutdown is terminal and waiter-safe.** Closing the plane is
-  idempotent, rejects pending task waits, and prevents later registration,
-  catalog, or task operations from recreating executors after owner shutdown.
-- **Review/eval trust boundaries fail loudly without replacing real results.**
-  Built-in scoped-review outputs are validated against their declared schemas;
-  local ledger mirror failures retain the authoritative child result/error;
-  Feature 259 baseline reconstruction now requires every exact rewrite and no
-  longer leaks candidate-only briefing fields into the baseline.
-- **Runtime tests no longer leave detached Node processes behind.** The config
-  suite explicitly shuts down its auto-started daemon owner before deleting
-  temporary state, and long-running process fixtures self-exit if an abnormal
-  test-runner termination prevents normal managed cleanup.
-- **External tasks keep identity and terminal state across failures.** A remote
-  start followed by ledger failure preserves its executor reference as
-  `unknown`; in-flight tasks retain immutable executor bindings across catalog
-  updates; task-level mutation queues prevent late callbacks from overwriting a
-  terminal snapshot; Workflow external waits honor `timeoutMs`.
-- **External task safety and policy boundaries fail closed.** Executor
-  availability, health, capability, concurrency, credential presence,
-  configuration revision, target side effects, and read-only intent are checked
-  before start without exposing secret values.
-- **ACP tests no longer pollute real user sessions.** ACP harnesses now use an
-  isolated temporary runtime home and session store, with a guard that rejects
-  paths under the real user home. ACP sessions remain provisional until the
-  first valid prompt instead of persisting an empty `ACP Session` during
-  protocol setup.
-- **Empty ACP pollution can be audited and recovered safely.**
-  `kodax -s cleanup-acp` previews only strict empty ACP matches; explicit
-  `--apply-session-cleanup` archives them reversibly instead of deleting data.
-
-### Performance
-
-- **Feature 259 controlled comparison validates the review optimization.** The
-  proposed topology passed 8/8 Layer-3 oracle cells versus 6/8 baseline, reduced
-  total model tokens 16.9% and output tokens 49.1%, and on standard reviews
-  reduced median tokens 57.2%, primary starts 75%, and duplicate packet reads
-  83.3%. High-risk multi-area reviews intentionally spend more calls for fresh
-  verification and explicit packet coverage.
-
-## [0.7.66] - 2026-07-10
+## [0.7.72-hotfix.0] - 2026-07-17
+
+### Fixed
+
+- **Ark Coding image input routing.** The SDK now recognizes the five verified
+  Ark Coding routes (`doubao-seed-2.0-code`, `doubao-seed-2.0-pro`,
+  `kimi-k2.7-code`, `kimi-k2.6`, and `MiniMax-M3`) as image-capable instead of
+  raising `MODEL_INPUT_UNSUPPORTED` before provider dispatch. The change is
+  scoped to those exact provider/model pairs; other Ark models and all Ark
+  video input remain fail-closed. Capability, validation, final Anthropic
+  base64 serialization, and opt-in real-gateway regressions cover all five.
+
+## [0.7.71] - 2026-07-17
+
+### Added
+
+- **Kimi Code K3 support.** The `kimi-code` subscription provider now exposes
+  `k3-256k` (Moderato) and `k3` (1,048,576 context tokens, Allegretto+) as
+  explicit catalog choices, alongside `kimi-for-coding-highspeed` and the
+  stable `kimi-for-coding` default. Both K3 choices send the upstream model id
+  `k3`, so users do not need to override compaction settings for their plan.
+  K3 sends its effort inside `thinking.effort` on both Anthropic- and
+  OpenAI-compatible transports, defaults omitted reasoning to `max`, and
+  preserves both legacy `reasoning=false` and explicit `effort=none` as disabled
+  thinking. Static capability, reasoning, media, cost-tracking, and opt-in
+  real-wire regressions cover the subscription routes and local context-tier
+  mapping.
+- **Standards-based A2A authentication and Agent activation (FEATURE_267/268
+  closure).** Outbound A2A entries can use OAuth 2.0 Client Credentials with an
+  external Authorization Server, while inbound KodaX Agents can validate RFC
+  9068 JWT access tokens against an external issuer/JWKS as an OAuth Resource
+  Server. The fixed environment Bearer profile remains available for
+  compatibility. A hot `agents.<name>.enabled` switch plus `kodax a2a
+  enable|disable` lets operators keep many configured third-party Agents while
+  controlling which ones admit new orchestration; in-flight tasks are not
+  cancelled.
+
+### Changed
+
+- **External Agent SDK migration notes.** `AgentRegistrationService` now
+  requires `setEnabled`; custom implementations must add the same
+  revision/owner-conditional enablement operation. `executorConfig` and
+  executor-reference `metadata` are `AgentJsonObject` values and reject class
+  instances, accessors, circular references, and other non-JSON-safe data at
+  runtime. SDK daemon auto-start without an explicit `homeDir` now follows the
+  resolved `KODAX_HOME`; embedders that intentionally need the OS-home endpoint
+  must pass `homeDir`, while custom endpoints remain attach-only.
+
+### Fixed
+
+- **A2A durable-owner upgrade and admission concurrency.** New inbound tasks
+  persist a non-secret principal-key scheme marker. Pre-realm tasks remain
+  inaccessible during normal serving, but stopped operators can use
+  `kodax a2a migrate-tasks` to dry-run and explicitly apply the configured
+  owner mapping; custom hosts can use the public
+  `migrateA2ALegacyTaskOwners()` SDK with exact mappings. Ambiguous or live-
+  store migration fails closed. Global task capacity now uses a synchronous
+  pending reservation, keeping slow workspace/session/run preparation outside
+  any global lock while preserving exact limits and per-principal ordering.
+- **Bounded External Agent and daemon shutdown/startup.** Executor-plane close
+  now has a 30-second default upper bound (overrideable with `closeTimeoutMs`),
+  obsolete-executor cleanup runs outside the serialized registration mutation
+  lane, and revision tombstones are SHA-256 fingerprints capped at 4,096
+  entries. Current registrations and task snapshots continue to enforce exact
+  revision immutability after older, unreferenced tombstones age out. Daemon
+  auto-start now races health checks against the spawned child's exit, keeps
+  the child referenced until readiness, and terminates it on early exit,
+  timeout, identity mismatch, or when another daemon wins ownership. A startup
+  candidate that exits after losing the owner race now lets its SDK caller wait
+  for and attach to the competing owner instead of failing that caller.
+- **Faster packaged-Electron gates.** Release jobs build once and reuse that
+  output for both the Windows Electron smoke and binary packaging. CI and
+  release jobs cache the version-pinned Electron smoke toolchain, whose local
+  directory is now explicitly ignored. Both paths explicitly materialize the
+  Electron binary after cache restore or dependency installation, preventing a
+  successful npm package install with a missing `electron/dist` from bypassing
+  the real packaged-daemon gate.
+- **A2A authentication and reconciliation hardening.** Card-level and
+  Skill-level security requirements now fail closed unless one complete
+  alternative is satisfiable. Card, RPC, and token origins remain separate;
+  exact credentials used by active RPC/SSE requests remain retained through
+  response parsing and are redacted from errors and successful results;
+  concurrent rejected-token invalidation cannot discard a newer token and each
+  RPC retries at most once. Direct SDK and file configuration now share strict
+  issuer, endpoint, resource, and RFC 6749 scope validation. Task ownership
+  also requires a stable `securityRealm` and hashes the
+  `(realm, subject, tenant)` tuple: built-in Bearer/OAuth derive realms from the
+  token-env name/exact issuer, custom authentication must provide one, authority
+  switches and legacy pre-realm tasks fail closed, and same-realm restart
+  preserves new-format tasks. Authentication/effect changes participate in
+  executor revisions; registration persistence
+  precedes catalog mutation; first-class management ownership plus revision-
+  conditional mutations protects unrelated or concurrently replaced SDK
+  registrations, including same-revision owner takeovers; changed authority is
+  fenced before parallel discovery; live drift is repaired; and a final
+  post-preflight admission check closes disable/removal races without
+  rediscovering unchanged peers. Internal immutable route snapshots preserve
+  admitted task input/cancel/reconcile routing across registration update or
+  removal and Runtime restart without exposing secret material or expanding the
+  public task DTO. Admission now rechecks globally unique task IDs, task writes
+  publish to memory only after durable persistence, and terminal event-write
+  failures cannot strand waiters or route snapshots. Returned registration
+  summaries are detached, executor cache keys are unambiguous tuples, and one
+  ownership conflict or observer failure cannot abort unrelated Agent
+  reconciliation or leave unawaited activation work. Daemon A2A ownership is
+  now bound to the exact resolved config home—`<homeDir>/.kodax` when explicitly
+  selected, otherwise the possibly arbitrary `KODAX_HOME`—recorded in daemon
+  state, and checked across every local profile before mutation. Legacy
+  non-empty version-1 A2A files require an explicit stopped-owner migration,
+  while version-2 migration is a read-only idempotent no-op. Failed initial A2A
+  reconciliation also closes the newly created Runtime before releasing daemon
+  ownership.
+- **A2A post-closure lifecycle and resource correctness.** Executor operations
+  and close now drain without disposal races; configured artifact references
+  and direct `a2a call` use a bounded reference-only/no-fetch policy. CLI task
+  RPC/SSE permits 32 MiB while Card/interface/OAuth/security metadata remains
+  capped at 2 MiB, and unsupported required Card extensions fail discovery.
+  Daemon mutation now requires independently owner-derived
+  `externalAgentAdmin: 1` and `a2aConfigReconciler: 1`; capability overrides
+  cannot forge them. Public `/a2a` config exports are read-only, with raw writers
+  retained inside the fenced CLI owner. Inbound serving now has a global
+  admission reservation, subscribe-first replay, authentication-before-body,
+  exact JSON/SSE media matching, an admitted-handler close barrier, and fixed
+  four-per-task/eight-per-server/24 MiB-per-stream SSE ceilings without
+  terminating the underlying task for one slow subscriber.
+- **Public Kimi Open Platform parity and live coverage.** `kimi` now defaults to
+  `kimi-k2.7-code`, exposes the HighSpeed route and wire-legal K2.5 id, uses the
+  exact 262,144-token limits and current prices, and has gated real-key coverage
+  for credential verification, K2.7 thinking, forced-tool fallback, and K2.6
+  thinking disablement. K2.7 disable requests now fail locally instead of being
+  silently ignored, while K2.6 disable requests emit the required wire toggle.
+
+- **Packaged Electron shared-daemon auto-start.** Runtime SDK embedders running
+  from packaged/asar Electron applications now launch the detached daemon child
+  through a bootstrap-only Node execution boundary without changing the host or
+  long-lived daemon environment, leaking `ELECTRON_RUN_AS_NODE` to user child
+  processes, or opening a second GUI instance. Trusted internal JavaScript
+  children retain a bounded Electron-to-Node launch path. Missing packaged CLI
+  sidecars fail immediately, disabled `RunAsNode` fuses receive an actionable
+  timeout diagnostic, and a real Windows Electron 42.5.0 + asar smoke now gates
+  CI and releases. Public docs also distinguish CLI-style `homeDir` from the
+  lower-level `.kodax` path used by `KODAX_HOME`.
+- **Cross-platform release template checks.** Generated configuration templates
+  now compare normalized line endings, so Windows CRLF checkouts no longer report
+  false drift during binary builds.
+
+## [0.7.70] - 2026-07-15
+
+### Added
+
+- **Typed shared-daemon rollback management (FEATURE_269 patch).** Daemon
+  facades now expose revisioned management inspection and atomic
+  `stopForInline()`, plus public owner-fence queries and revision-free daemon
+  re-enable helpers for safe embedder rollback workflows.
+
+### Changed
+
+- **KAI-FCL licensing from v0.7.70.** Official KodaX source, binaries, and npm
+  packages now use the KodaX-AI Fair Core License 1.0: community use remains
+  available, while commercial or managed use requires KodaX-AI authorization.
+  Previously released Apache-2.0 copies retain their original grants.
+
+### Fixed
+
+- **A2A interoperability and execution boundaries.** Selected Card interfaces
+  remain bound to their trusted discovery origin and advertised Bearer scheme;
+  concrete recursive reads and child runs retain the parent policy ceiling;
+  pending input resumes the original Runtime run; task retention, history,
+  cleanup, stable cursor pagination, protocol correlation/version, authenticated
+  SSE, appended artifact chunks, and early-stream-EOF semantics are bounded;
+  and direct, staged, or successfully promoted admitted Skill outputs are
+  returned as negotiated artifacts without exposing ordinary workspace writes.
+- **MCP multilingual zero-match efficiency.** Compact CJK queries now segment
+  into words, while cross-language lexical zero matches can return a lossless
+  shared-prefix exact-id inventory only when it is no more expensive than a
+  normal default search page and fits the real result capacity. Oversized
+  recovery emits one concise catalog-language retry with no biased partial list.
+  Fully unavailable catalogs no longer trigger a duplicate inventory attempt;
+  concurrent discovery is coalesced, in-flight invalidation cannot be overwritten,
+  and filtered cursor revisions ignore unrelated capability families.
+- **Logical daemon client accounting.** Stop preflight now counts only live,
+  initialized SDK clients. Daemon self-connections and read-only health probes
+  are excluded, and awaited client close converges the count across processes.
+  Health probes also tolerate the daemon token disappearing during a concurrent
+  shutdown or owner transition instead of leaking an `ENOENT` race to clients.
+- **Preflight/stop race.** Rollback commit gates new clients and mutations,
+  validates the same Runtime, management revision, owner-policy revision, and
+  blockers, and changes sticky inline policy while the verified daemon still
+  owns the profile fence. Stale commits fail with structured `conflict` and do
+  not stop or change policy.
+- **Complete rollback draining and background-work blockers.** Credential and
+  Host Tool bridge state can no longer change after draining starts, while
+  running/paused Workflows and non-terminal or unknown External Agent tasks now
+  block stop and participate in the management revision. Reverse-result frames
+  remain outside the durable journal so credentials and Host Tool results are
+  not persisted. In-flight stop conflicts identify the active mutation methods
+  and counts so lifecycle stalls can be diagnosed without reproducing them.
+
+## [0.7.69] - 2026-07-15
+
+> Scope note: this release delivers **FEATURE_267**, **FEATURE_268**, and
+> **FEATURE_269** as one bounded interoperability/runtime release: bidirectional
+> A2A 1.0, split hot-reloadable integration configuration, and one authoritative
+> shared Coder daemon with secure host bridges. It does not expose the daemon
+> remotely, migrate Partner from its private embedded Runtime, or publish
+> credentials/Host Tools outside their bound run.
+
+### Added
+
+- **Bidirectional A2A 1.0 interoperability (FEATURE_267).** Added the
+  `@kodax-ai/kodax/a2a` integration edge: allowlisted Agent Card discovery and
+  a JSON-RPC/SSE executor over the existing F258 plane, plus an authenticated,
+  caller-scoped, durable Runtime-backed KodaX Agent server with continuation,
+  cancellation, ordered replay/subscription, and restart reattachment.
+- **No-code A2A product path and Runtime binding.** Added declarative
+  `a2a add/list/test/call/remove`, automatic `external:<name>` registration for
+  built-in Runtime owners, and explicit `a2a expose` / loopback-only `a2a
+  serve`. The inbound server can publish the Runtime default or one validated
+  user Markdown Agent with pinned Agent/Skill/tool/workspace revisions,
+  structured `toolPolicy`, `~/.agents/skills` discovery, and exact Skill-script
+  execution through the fail-closed ASRT adapter.
+- **Split integration configuration and hot reload (FEATURE_268).** MCP, A2A,
+  and Extensions now use one user-level versioned file per domain, backed by
+  four canonical templates, explicit lossless migration, locked atomic writes,
+  last-known-good watchers with metadata fallback, whole-provider MCP draining,
+  entry-transactional Extension/outbound-A2A reconciliation, and explicit
+  restart-required handling for inbound execution/store authority changes.
+- **A2A network and publication boundaries.** Outbound fetches enforce origin,
+  DNS/private-address, TLS, redirect, credential, timeout, content-type, and
+  size policy. The built-in server listener is loopback-only; public hosts use
+  `handle()` behind TLS. A2A 0.3, gRPC, HTTP+JSON, push notifications, automatic
+  public Agent exposure, and remote Runtime configuration are not advertised.
+- **Authoritative shared Coder daemon (FEATURE_269).** Added atomic
+  `sessions.observe()` join/resync, durable operation identities and receipts,
+  stable same-session ordering, settings/grant CAS, transport-safe AskUser and
+  permission resolution, live run projection, structured restart outcomes, and
+  a truthful per-capability Coder compatibility matrix for CLI, Space, IDE, and
+  SDK clients.
+- **Shared-daemon SDK completion.** Server-side Coder/Partner admission now
+  covers every session and run path; late-join snapshots include transcript
+  revision, managed tasks, queued continuation metadata, and reverse
+  requirements. The SDK adds prompt connection lifecycle signals, typed event
+  parsing with per-event degradation, daemon-safe run DTOs,
+  `agentMode`/`autoModeEngine` settings CAS, durable operation/Host Tool outcome
+  queries, and daemon stop/rollback preflight.
+- **Secure host bridges and owner fencing.** Provider credentials are supplied
+  just in time through stable-client/run/provider-bound leases and never
+  persisted. A keychain-held stable client secret can reattach credential and
+  Host Tool handlers after Space reconnects; Host Tools remain immutable and
+  run-bound, with fsynced dispatch truth and explicit unknown outcomes rather
+  than blind replay. Daemon and inline Coder ownership share one revisioned
+  fence with sticky rollback, while Partner remains isolated.
+
+### Changed
+
+- **Tool-result delivery now optimizes end-to-end context use.** Tool handlers
+  collect complete results and one aggregate next-request capacity owner keeps
+  every result inline when the batch fits. Default Bash processing no longer
+  applies command-specific lossy filters; its former 512 KiB capture limit is
+  now only a memory-to-disk spool threshold. Capacity is solved against the
+  final input (`Pmax`), so the 3% uncertainty margin grows with the admitted
+  batch instead of being frozen at the smaller pre-batch request.
+- **History compaction is physical-capacity driven.** Default automatic
+  compaction waits until the final provider envelope (system prompt, actual
+  tools, messages/framing, output reserve, and safety margin) cannot fit.
+  Default microcompaction and destructive pre-summary/fallback pruning are off;
+  pressure uses semantic summary first and stops as soon as the next request
+  fits. Static early percentages remain explicit opt-ins, and manual
+  `/compact` remains an explicit force operation.
+- **Self-knowledge follows the v0.7.69 capability surface.** `kodax_manual`
+  now documents the three split integration files and migration/hot-reload
+  behavior, the `/a2a` SDK subpath, atomic shared-daemon observation, durable
+  controls, run-scoped credentials/Host Tools, and daemon/inline ownership.
+
+### Fixed
+
+- **Recoverable overflow and hidden output caps.** Overflow of the final
+  operational request budget saves the complete result and emits one explicit
+  incomplete marker. Long lines have exact continuation offsets, completed task
+  output is complete, and hidden caps were removed from grep, glob, code search,
+  and retrieval rendering.
+- **Cache token accounting and history preservation.** Cache tokens are charged
+  once. Empty, failed, or insufficient summaries now surface a typed capacity
+  error while retaining the canonical transcript and immutable Worker prompt.
+- **Tool-result completeness and retention edge cases.** No-usage accounting
+  includes the final system prompt, active schemas, and same-request recovery;
+  explicit limits use one-extra-item probes; delayed Bash drain remains
+  recoverable. Referenced result/image artifacts and fresh checkpoints are no
+  longer removed by age-only cleanup.
+- **Post-review capacity correctness.** Trusted artifact metadata cannot be
+  forged by raw tool text; failures carry the last legal transcript; observers
+  see admitted content; child evidence uses the routed model's physical budget;
+  bounded acquisition exposes continuation instead of silent loss; direct Bash
+  artifacts remain canonical without nested spill markers.
+- **Windows process-tree fallback.** A failed or timed-out `taskkill /t` now
+  triggers a native Toolhelp parent snapshot before direct escalation, with
+  CIM/WMIC retained only as fallback. Agent and LLM cleanup stay aligned and a
+  real nested-process regression proves descendants exit.
+- **Windows lock deletion races.** Proposal and lifecycle lock probes treat
+  transient `EPERM`/`EACCES`/`EBUSY` as non-stale and retry, preserving the
+  fail-closed owner-token contract during concurrent removal.
+- **Frozen FEATURE_259 eval inputs.** The pre-iteration dispatch schema is
+  reconstructed from its historical bytes, so later production tool-schema
+  improvements cannot mutate the baseline or invite a hash-only CI workaround.
+- **Governed-memory Bash guard bypasses.** Commands that directly address
+  recognized scoped or legacy memory roots now permit only one simple read-only
+  inspection; command chaining, pipelines, redirects, home-relative paths, and
+  interpreter writes fail closed at the Bash tool boundary.
+- **Memory proposal and review persistence integrity.** Invalid approval
+  metadata now produces a store warning and blocks rewrites; project-less review
+  drains no longer claim project-owned work; persisted outcome evidence receives
+  full shape validation; atomic writes clean temporary files on failure.
+- **Memory store lock ownership.** Proposal and lifecycle locks now carry a PID
+  plus random owner token, avoid reclaiming stale locks held by a live process,
+  and remove a lock only when the releasing owner token still matches. Lifecycle
+  state writes now use temporary-file rename instead of direct truncating writes.
+- **Interactive resume handoff and large-store startup.** Bare `kodax -r` now
+  keeps the selected session through the picker-to-TUI handoff instead of
+  exiting, and the picker uses bounded metadata paging instead of repeatedly
+  full-reading every matching session before it opens.
+- **A2A/configuration release hardening.** Review gaps in remote execution,
+  Skill-script admission/isolation, hot reload, listener preparation, binding
+  pinning, last-known-good reconciliation, and redacted diagnostics now fail
+  closed or retain the prior healthy revision as specified. The public A2A
+  server type now exposes its existing readiness wait, validated DNS results
+  narrow explicitly to IPv4/IPv6, and safe request-body typing no longer
+  depends on an undeclared DOM global, keeping root TypeScript validation green.
+
+## [0.7.68] - 2026-07-12
+
+> Scope note: this release delivers **FEATURE_260**, the KodaX Memory Agent,
+> as a thin experimental SDK and governed runtime extension over the existing
+> F228 Memory Control Plane. It does not add a second memory database, a
+> resident specialist agent, filesystem memory actions, or online self-modification.
+
+### Added
+
+- **Thin experimental Memory Agent SDK.** Added
+  `@kodax-ai/agent/experimental-memory` and the root `/experimental-memory`
+  entry with scoped `MemorySession` lifecycle, zero-wait passive recall,
+  read-only deliberate `query()`, bounded observations, and episode outcomes.
+- **Deliberate governed recall for the Action LLM.** A session-bound
+  `memory_recall` tool exposes only one `need` field, returns prompt-safe
+  low-authority evidence from the same F228 plane, and keeps identity, scope,
+  revision, and sequence outside model input.
+- **Auditable memory decisions and outcomes.** Trace-only
+  `MemoryDecisionReceipt` records candidate/selected/injected refs and policy
+  version; accepted Outcome Digests can conservatively link influence without
+  storing hidden reasoning or creating a second event store.
+- **Bounded episode review and promotion.** Timed-out review work persists in a
+  scoped inbox for bounded next-session drain and revalidation. Promotion now
+  consults compatible claims before choosing create, evidence update,
+  condition refinement, conflict, no-action, reject, or quarantine.
+
+### Changed
+
+- **Memory applicability is exact and fail-closed.** Tenant, user, agent,
+  workspace, project, and branch identity participate in deterministic scope
+  checks; sibling/cross-user/cross-tenant fallback is prohibited.
+- **Memory policy is source-versioned and cache-safe.** `f260-v0.7.68.2`
+  binds production reminder rules, evidence rendering, and deliberate-recall
+  tool bytes. Passive reminders only affect the dynamic suffix; deliberate
+  queries add a normal tool-call/result tail while preserving earlier provider
+  cache bytes.
+- **Safety-critical boundaries remain deterministic.** Secret filtering,
+  memory-file mutation guards, poisoning/source-evidence checks, and governed
+  proposal/preview/fingerprint/apply remain zero-violation code gates rather
+  than probabilistic LLM recall thresholds.
+- **Self-knowledge follows the v0.7.68 capability surface.** `kodax_manual`
+  now has a dedicated governed-memory topic, names all 43 built-in slash
+  commands under a two-way drift guard, and documents the current 10 SDK
+  subpaths plus Runtime and `/experimental-memory` ownership boundaries.
+
+### Fixed
+
+- **Post-review Memory Agent release hardening.** Repository identity now strips
+  Git remote userinfo/query credentials before scoped or legacy persistence;
+  managed-path guards are Windows-case-safe, protect governance sidecars, and
+  fail closed for non-read-only shell access to addressed memory roots. Episode
+  reviews use atomic processing claims with stale recovery, while proposal and
+  lifecycle stores serialize concurrent read-modify-write updates. Eval manifest
+  schema v2 binds untracked file bytes in addition to the tracked patch, corrupt
+  raw JSON fails loudly, and summary review state points to the separate
+  main-session review artifact instead of remaining permanently pending.
+- **Runtime daemon state replacement is atomic.** Daemon lifecycle updates now
+  stage and rename `daemon.json` instead of truncating it in place, preventing
+  shutdown polling from mistaking a partial write for completed cleanup and
+  leaving an orphaned `stopping` process under full-suite load.
+
+### Performance
+
+- **The preregistered v2 memory-routing panel passes all release gates.** On
+  `ark/v4flash`, general immediate recall passed 59/60 (98.3%), high-value
+  recall 40/40, must-silent 200/200 (Wilson lower 98.1%), paired routing lift
+  was +73.3 percentage points with zero control regression, and bounded
+  two-decision recovery passed 20/20. The 520-cell panel represented 782,721
+  tokens and an estimated $0.004447 against the $0.02 cap. Main-session blinded
+  review recommends ship for routing value while documenting that the panel is
+  not an end-to-end task-completion claim.
+
+## [0.7.67] - 2026-07-11
+
+> Scope note: a stabilization and agent-efficiency release. **FEATURE_258**
+> adds the protocol-neutral external-agent executor plane, **FEATURE_259**
+> makes workflow/review orchestration more focused and cost-disciplined, and
+> the bounded corrective **FEATURE_261** delivers searchable session resume
+> plus safe ACP-session cleanup. GitHub source/binary release work is included;
+> npm publication remains a separate operator step.
+
+### Added
+
+- **External Agent Executor Plane and dispatchable catalog.** Host-injected
+  executors now share a protocol-neutral registration/catalog/task contract,
+  redacted policy-filtered discovery, durable task ledger, recovery, and a
+  reference executor. Worker tools, Workflow, Embedded Runtime, and daemon
+  clients discover and dispatch the same canonical agent IDs.
+- **External-agent SDK and daemon surfaces.** Runtime sessions expose catalog,
+  start/continue/cancel/reconcile, event, and task-result operations with
+  versioned schemas, configuration revisions, credential-presence checks, and
+  public in-process daemon-factory bootstrap support.
+- **Focused scoped-review workflow.** `/review --workflow` now uses immutable
+  review packets, one primary per scope, an additional authoritative primary
+  only for risk-flagged packets, batched fresh verification for candidate
+  findings, stable finding IDs, capable synthesis, and an audit artifact.
+- **Explicit model-tier intent and route telemetry.** Workflow and substantive
+  child briefs carry focused scope/constraints/evidence/output fields plus
+  explicit `fast` / `balanced` / `deep` intent. Runtime reports the resolved
+  source, fallback, effort, usage, duration, packet-read topology, and token
+  coverage without fabricating missing external usage.
+- **Searchable session resume picker.** Running `kodax -r` without an ID now
+  opens an interactive TUI with incremental search, keyboard selection, title
+  completion, pagination, and the full selected session ID. An explicit value
+  resolves a complete ID first, then a unique exact title; duplicate titles
+  open a narrowed picker rather than silently selecting one.
+- **Session listing filters and cursors.** SessionManager, Runtime SDK, and
+  daemon protocol listings now accept an exact `surface` filter and an opaque
+  continuation `cursor`, applied before the requested page limit.
+
+### Changed
+
+- **Resident workflow context is smaller and discoverable.** The turn-resident
+  `run_workflow` hint stays below the deferred-tool budget while the full
+  authoring contract remains available through `tool_search`. Recorded
+  workflow-shaped plans start directly instead of being expanded into duplicate
+  todo/dispatch scaffolding.
+- **Review handoffs are structured and conservative.** Positive observations
+  are not findings; missing evidence remains `not-verifiable` rather than being
+  promoted into a defect; unreasoned severity overrides retain the original
+  severity instead of failing the review.
+- **Eval execution is value-driven and bounded.** Main-session evidence review
+  determines whether a candidate has material value over baseline; executor
+  aliases are not reused as judge models. Raw reuse, per-call/round/token/cost
+  caps, one bounded structured repair, and provider/model concurrency lanes
+  prevent runaway panels.
+- **SDK embedder documentation matches the v0.7.67 public surface.** The guide
+  now covers external-agent owner/consumer setup and safety boundaries, Runtime
+  registration/catalog/task services, exact-surface session pagination,
+  run-scoped workflow tiers, live route facts, and durable efficiency reports;
+  the English/Chinese subpath tables reflect all 10 published SDK entries.
+
+### Fixed
+
+- **Restricted Workflow scripts preserve the public Agent routing contract.**
+  `phase` and FEATURE_258 `target` values now cross the script host boundary
+  with fail-loud validation, so generated/saved workflows can route the same
+  canonical external Agent IDs as direct Workflow and Worker dispatch.
+- **Executor-plane shutdown is terminal and waiter-safe.** Closing the plane is
+  idempotent, rejects pending task waits, and prevents later registration,
+  catalog, or task operations from recreating executors after owner shutdown.
+- **Review/eval trust boundaries fail loudly without replacing real results.**
+  Built-in scoped-review outputs are validated against their declared schemas;
+  local ledger mirror failures retain the authoritative child result/error;
+  Feature 259 baseline reconstruction now requires every exact rewrite and no
+  longer leaks candidate-only briefing fields into the baseline.
+- **Runtime tests no longer leave detached Node processes behind.** The config
+  suite explicitly shuts down its auto-started daemon owner before deleting
+  temporary state, and long-running process fixtures self-exit if an abnormal
+  test-runner termination prevents normal managed cleanup.
+- **External tasks keep identity and terminal state across failures.** A remote
+  start followed by ledger failure preserves its executor reference as
+  `unknown`; in-flight tasks retain immutable executor bindings across catalog
+  updates; task-level mutation queues prevent late callbacks from overwriting a
+  terminal snapshot; Workflow external waits honor `timeoutMs`.
+- **External task safety and policy boundaries fail closed.** Executor
+  availability, health, capability, concurrency, credential presence,
+  configuration revision, target side effects, and read-only intent are checked
+  before start without exposing secret values.
+- **ACP tests no longer pollute real user sessions.** ACP harnesses now use an
+  isolated temporary runtime home and session store, with a guard that rejects
+  paths under the real user home. ACP sessions remain provisional until the
+  first valid prompt instead of persisting an empty `ACP Session` during
+  protocol setup.
+- **Empty ACP pollution can be audited and recovered safely.**
+  `kodax -s cleanup-acp` previews only strict empty ACP matches; explicit
+  `--apply-session-cleanup` archives them reversibly instead of deleting data.
+
+### Performance
+
+- **Feature 259 controlled comparison validates the review optimization.** The
+  proposed topology passed 8/8 Layer-3 oracle cells versus 6/8 baseline, reduced
+  total model tokens 16.9% and output tokens 49.1%, and on standard reviews
+  reduced median tokens 57.2%, primary starts 75%, and duplicate packet reads
+  83.3%. High-risk multi-area reviews intentionally spend more calls for fresh
+  verification and explicit packet coverage.
+
+## [0.7.66] - 2026-07-10
 
 > Scope note: the runtime migration was developed across the v0.7.64-v0.7.66
 > planning slots and is released as one v0.7.66 cut; v0.7.64 and v0.7.65 were
@@ -709,11 +824,11 @@ All notable changes to this project will be documented in this file.
   stale wide-char or skipped-cell residue cannot remain after user-driven
   transcript scrolling.
 
-## [0.7.61] - 2026-07-06
-
-> Historical release record: the command-aware lossy-filter behavior below is
-> what v0.7.61 shipped, not the current default. The 2026-07-14 correction is
-> recorded under Unreleased, ADR-050, and the FEATURE_251 design/test guide.
+## [0.7.61] - 2026-07-06
+
+> Historical release record: the command-aware lossy-filter behavior below is
+> what v0.7.61 shipped, not the current default. The 2026-07-14 correction is
+> recorded under Unreleased, ADR-050, and the FEATURE_251 design/test guide.
 
 > Scope note: a token-efficiency + workflow-reliability release. **FEATURE_251** adds command-aware
 > in-tool output compression (an rtk-style Token Killer port) inside KodaX's own `bash` tool layer,
@@ -727,7 +842,7 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- **Historical implementation — tool-output semantic compression / command-aware in-tool Token Killer (FEATURE_251, ADR-050).** A new `packages/coding/src/tools/output-filters/` module compressed bash `stdout`/`stderr` **body** after decode, before the `Command:` / `Exit:` header was assembled, at the single `bash.ts` close-handler integration point (so both the SA and AMA dispatch paths were covered by one change). It shipped a lossless generic layer (ANSI strip), compiled stateful filters (`git-diff`, `git-log`, `git-status`, `test-runner` failure-focus, `lint` diagnostic grouping, `json-output` / NDJSON structural summary), and a built-in declarative long-tail table (package-manager / docker / infra CLI progress). Hard constraints at release time: the `Command:` / `Exit:` header was preserved verbatim (FEATURE_185 hits-ledger depends on it); the generic layer was lossless-by-construction with `never_worse` as a size-only backstop; and every lossy filter persisted raw decoded body before appending a recovery hint. Isolated Layer-1 fixtures measured shorter bodies, but did not measure recovery reads, extra inference rounds, or task-level evidence quality; they are historical measurements, not current release gates or end-to-end benefit claims. Current default behavior is the correction described above. Human test guide: `docs/test-guides/FEATURE_251_v0.7.61_TEST_GUIDE.md`.
+- **Historical implementation — tool-output semantic compression / command-aware in-tool Token Killer (FEATURE_251, ADR-050).** A new `packages/coding/src/tools/output-filters/` module compressed bash `stdout`/`stderr` **body** after decode, before the `Command:` / `Exit:` header was assembled, at the single `bash.ts` close-handler integration point (so both the SA and AMA dispatch paths were covered by one change). It shipped a lossless generic layer (ANSI strip), compiled stateful filters (`git-diff`, `git-log`, `git-status`, `test-runner` failure-focus, `lint` diagnostic grouping, `json-output` / NDJSON structural summary), and a built-in declarative long-tail table (package-manager / docker / infra CLI progress). Hard constraints at release time: the `Command:` / `Exit:` header was preserved verbatim (FEATURE_185 hits-ledger depends on it); the generic layer was lossless-by-construction with `never_worse` as a size-only backstop; and every lossy filter persisted raw decoded body before appending a recovery hint. Isolated Layer-1 fixtures measured shorter bodies, but did not measure recovery reads, extra inference rounds, or task-level evidence quality; they are historical measurements, not current release gates or end-to-end benefit claims. Current default behavior is the correction described above. Human test guide: `docs/test-guides/FEATURE_251_v0.7.61_TEST_GUIDE.md`.
 - **Deterministic workflow-quality preflight lint (FEATURE_252).** A new `packages/agent/src/workflow/quality-lint.ts` (`lintRestrictedWorkflowSource` / `assertRestrictedWorkflowQuality`, exported from the workflow package) runs inside restricted workflow module materialization (`script-runner.ts` `createRestrictedWorkflowModule`) and in the coding workflow host with host-policy `maxAgents`, so structural contract violations fail before a run can start — matching the existing inline-smoke hard-fail feedback loop. It hard-fails three deterministic contract classes only: (1) an unawaited workflow-command variable (`wf.runAgent` / `wf.spawnAgent` / `wf.wait` / `wf.synthesize` / `wf.workflow` / `wf.artifact`) used in a boolean position (`if (x)`, `!x`, ternary test, `x && …`, `x || …`, loop test) — a case a runtime Proxy cannot catch because object truthiness has no Proxy trap; (2) top-level structured-output field access (`result.findings`, `result.summary`, …) when the fields belong under `result.structured`; and (3) a literal `[...]`/`[...].map(...)` agent fanout whose static upper bound exceeds `manifest.maxAgents` or a known host cap. Review/verifier/generic quality heuristics are intentionally **not** emitted as model-visible warnings (a lightweight AST pass cannot distinguish a weak workflow from a valid optimized one, and surfacing them causes needless rewrite churn). Human test guide: `docs/test-guides/FEATURE_252_v0.7.61_TEST_GUIDE.md`.
 
 ### Changed
@@ -2614,7 +2729,7 @@ repl            → coding, skills
 ### Tests
 - Added / expanded tests for `task-engine`, `reasoning`, `tool-display`, `live-streaming`, `StatusBar`, `invocation-runtime`, `types-legacy`, and `InkREPL.interrupted`
 
-<!-- last-sync: cf5f273b -->
+<!-- last-sync: a8c9c283 -->
 
 ### Added
 - **Repository intelligence substrate (FEATURE_018)**: Task-aware repository intelligence layer under `.agent/repo-intelligence/` with durable artifacts — `repo-overview.json`, `changed-scope.json`, `module-index.json`, `symbol-index.json`, `process-index.json`, `repo-intelligence-manifest.json` — supporting incremental refresh, freshness metadata, and language-tiered extraction (TS/JS via AST, Python, Go, Rust, Java, C++)