@kodax-ai/kodax 0.7.97-alpha.1 → 0.7.97-alpha.11

package/CHANGELOG.md

@@ -8,6 +8,406 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## [0.7.97-alpha.11] - 2026-10-29
+
+### Added
+
+- Add explicit Agent, Coding and experimental Script work modes through the
+  CLI, interactive `/work-mode` command and managed SDK/Session paths. Coding
+  remains the default. Script executes supported leaf tools through the existing
+  permission and receipt boundaries; SDK profiles and specialist agents retain
+  their declared capabilities.
+
+- Refresh Ark, MiMo and MiniMax model catalogs and their reasoning/capacity
+  metadata. Provider-specific mappings and validation limits are documented in
+  the provider configuration guide.
+
+### Fixed
+
+- Run release builds alongside full CI while retaining all publication gates;
+  move the complete serial Node 20 system suite to its own runner, validate
+  archives before lengthy Electron checks, and bound bundle/archive execution
+  with retained failure evidence. Ordinary branch pushes still do not trigger CI.
+- Preserve the Windows PowerShell module search path in isolated archive tests,
+  avoiding stalled OS containment probes. Reject unverified supervised Hosts
+  before publishing incomplete capabilities and a misleading upgrade error.
+
+- Align current SDK, Client, design and user documentation with post-alpha.10
+  work modes, question deadlines, saved tool originals, structured task reports
+  and streaming token estimates; retain historical release/validation limits.
+
+- Preserve non-interactive question outcomes through the REPL client and reject
+  client-supplied timeout answers before daemon submission; the Host owns deadlines.
+- Constrain Skill `Bash(pattern)` rules to a single parsed command, preventing
+  wildcard matches from admitting additional shell statements, pipelines,
+  redirects or command substitutions. Bare Bash and absent Skill restrictions
+  continue through normal Host authorization.
+- Correct Windows stale-process recovery startup overhead and history browsing
+  cursor resynchronization; validate sandbox filesystem capabilities at startup.
+  Historical intermittent first-read latency remains under investigation.
+- Display estimated tokens consistently across model streaming progress surfaces.
+
+- Project existing task-result metadata into Product live views and recovered
+  history with explicit source, task identity, terminal/unknown status and
+  Markdown report bodies. Preserve multi-report order, literal report content,
+  existing full-body reads and raw canonical envelopes; decode only explicitly
+  sourced legacy deliveries and keep child failures separate from root Provider
+  errors. Deduplicate only identified task-message mirrors; preserve independent
+  same-text notices and ambiguous old UI records during history restoration.
+
+- Keep Skill discovery rooted at the repository when the SDK runs from a
+  subdirectory, synchronize catalogs with loader availability in SA/AMA, and
+  invalidate stale bodies across rediscovery and in-flight reads. Model loads
+  now apply the existing Skill action policies, lifecycle hooks and model
+  preference, retaining Host authorization and safe multi-Skill composition.
+
+- Preserve complete MCP tool output behind explicit SDK `part: 'original'`
+  reads, including daemon IPC and Host restart, while retaining existing preview
+  offsets. Keep results inline when recovery cannot be read, improve long JSON
+  previews, and stop Session-local automatic cleanup from deleting shared output
+  artifacts. Add simulated-provider/MCP E2E coverage against the built SDK.
+
+---
+
+## [0.7.97-alpha.10] - 2026-10-27
+
+Tenth alpha of the v0.7.97 line: live context-capacity recovery reaches
+durable generation boundaries — checkpointed Runs and task trees resume
+after Host restart with fresh scoped authority, Kimi K3.1 routes join the
+provider registry with full effort coverage, and AskUser interactions gain
+answer-aware policies with explicit skip semantics. Every v0.7.96 stable
+and v0.7.97-alpha.1 through alpha.9 contract is retained. npm publication
+remains a manual maintainer action.
+
+### Added
+
+- Forward actual Host initialization phases through the existing SDK startup callback and CLI indicator, including MCP prewarm and task recovery; reuse bounded bootstrap-log observation without extra readiness probes or waits.
+- Kimi K3.1 provider routes: all seven user effort levels map through the Anthropic-compatible endpoint exactly like the official Kimi client (explicit thinking enablement plus output_config effort), with live subscription results, inconclusive high self-reports, and the public account balance limitation documented.
+
+### Fixed
+
+- Repair bundled Skill shell declarations against the full-command glob contract while retaining Host authorization; make Git/TDD discoverable, separate tests-only and Skill creation/packaging/evaluation flows, and align visual preparation and unverified fallbacks. Skill Creator helpers now resolve public Skill SDK exports in installed tarballs and create fresh description-loop workspaces; semantic-screening output no longer implies observed model selection.
+- Classify trusted Skill loading and policy restoration failures as local execution failures with stable codes and path-safe Skill messages; preserve the facts through Runtime persistence, daemon IPC and Product Client outcomes without weakening trusted reloads or changing Provider error classification.
+- Resume checkpointed Runs and task trees after Host restart: original history, tool receipts, pending input intent and iteration budgets are preserved across independent child and Host recovery; scoped authority rebinds freshly, suspended worktrees stay protected, and bounded verbatim constraint memory retains oversized requests (Issue 322 follow-up).
+- Converge client exit recovery without rewriting unknown outcomes: startup readiness is separated from historical client cleanup acknowledgements, exact Host/process/Job shutdown evidence is reverified, referenced outcomes are retained with late cleanup results preserved, and old exit requests can no longer fence or stop replacement Hosts.
+- Preserve non-interactive question settlement in one-shot CLI: report normal `unanswered/non_interactive` results without default answers or Run interruption, retain MCP protocol cancellation and independent permission rejection, and update the adjacent regression assertions.
+- Close adjacent question/restart regressions: retain checkpoints on unanswered recovery prompts, cancel unanswered MCP confirmation/URL requests, preserve UI callback errors through the SDK MCP bridge for protocol cancellation, surface ordinary prompt callback errors without overriding prior settlements, scope client Stop intent to its exact Run, and persist thread concurrency limits. Expose the existing new-Host question deadline through the Product launcher; repair classic assertions and capacity-test cleanup.
+- Honor a partially delivered durable Session Stop during Root/Actor generation recovery; its original request can finish through verified dead-owner checkpoint Stop takeover, while later Runs remain outside the old frontier.
+
+- Preserve prior summary failures when an irreducibly oversized user input
+  needs request-only degradation (Issue 322). Single-agent and managed
+  compaction no longer reset the breaker on an oversized partial result;
+  the single-agent capacity-error branch also retains its prior count.
+  Ordinary failures still accumulate, successful relief still rearms the
+  breaker, and oversized inputs retain their bounded recovery attempt. String
+  and mixed text/image user messages share this behavior; images and tool
+  receipts cannot independently qualify as irreducible user text.
+
+- Extend live context-capacity recovery with retrievable older assistant history,
+  cumulative request-only user-text paging (including mixed image messages),
+  budgeted runtime provenance, small-window safety accounting, and emergency
+  schema discovery through the existing tool bridge. Preserve protected tools,
+  canonical user messages, and completed execution receipts; paging requires an
+  authorized read capability and readable saved artifacts.
+- Retry rejected generations only after measured request reduction (at most four
+  recovery retries). A Host can save the transcript and wait in `recovering`, then
+  continue the same execution when model settings change or corrective input arrives.
+  Stop cancels the wait; the independent SDK keeps typed failure semantics unless
+  its caller supplies the recovery callback. Automatic continuation after Host death
+  or expired credential authority is not included.
+- Retry transient context-history and artifact I/O with cancellable backoff. Read
+  back a failed save acknowledgement before retrying, preserving newer metadata
+  and avoiding duplicate history transactions; permission failures still surface.
+
+- Keep the natural-eval fixture's `npm test` working on staged Node installs by
+  allowing reads of an npm CLI installed outside the binary directory, and
+  canonicalize the native test fixture root so hosted-runner 8.3 temp paths
+  (`RUNNER~1`) are not rejected by the native path policy.
+- Keep eval dump directories and unrelated `kodax-eval-*` directories out of orphan
+  worktree cleanup. Require a worktree gitfile and successful Git-owned removal;
+  isolate the cleanup regression from the shared system temporary directory.
+- AskUser questions wait indefinitely by default (timeout 0) and support explicit skip; skip and Host timeout return an `unanswered` result with its reason instead of cancelling the Run, defaults are never submitted automatically, and only Stop interrupts. Permission prompts keep their five-minute default; both accept 0 to disable their timer. MCP reverse elicitation and the client plane follow the same policy.
+- Close the A2A server task store when agent-card validation fails during
+  construction, so a rejected server no longer leaks its data-dir lock handle;
+  on Windows the leaked handle kept the data dir undeletable (`ENOTEMPTY`)
+  for the life of the process.
+- Deliver observation handoff events to event-stream observers. Daemon
+  `session.observe` subscribers never read the snapshot, so events published
+  while the snapshot materialized were silently deduplicated away whenever the
+  snapshot's seq raced past them — a late `run.failed` could be lost forever.
+  Snapshot consumers keep the existing no-duplicates handoff contract.
+
+---
+
+## [0.7.97-alpha.9] - 2026-10-19
+
+Ninth alpha of the v0.7.97 line: shared Host Run inspection checks Session
+admission through canonical identity metadata instead of loading complete
+historical transcripts, so a readable metadata header with an unreadable
+body (for example a Windows ERROR_CRC surfacing as EIO) no longer blocks
+unrelated Run listing, daemon inspection, or idle-exit inspection; admission
+reuse is fenced to initialized Actor controllers so live persistence,
+trailing saves, and `protected` exit receipts for other clients' work are
+preserved. Every
+v0.7.96 stable and v0.7.97-alpha.1 through alpha.8 contract is retained.
+npm publication remains a manual maintainer action.
+
+### Fixed
+
+- Shared Host Run inspection now checks Session admission through canonical identity metadata instead of loading complete historical transcripts. A readable metadata header with an unreadable body no longer blocks unrelated Run listing, daemon inspection, or idle-exit inspection. Unreadable metadata still fails closed, active/unknown Runs and Actor turns still block exit, and explicitly opening the affected Session still reports its read error.
+- Shared Host Run listing and inspection reuse Session admission only for initialized Actor controllers that still hold their owner fence, matching Actor preflight. This avoids racing live persistence, including trailing saves after Run completion, preserves `protected` exit receipts for other clients' work, and retains strict canonical metadata checks for unclaimed Sessions and after controller ownership is released.
+
+---
+
+## [0.7.97-alpha.8] - 2026-10-18
+
+Eighth alpha of the v0.7.97 line: the Artifact SDK ships inside the single
+main package — `@kodax-ai/kodax` gains `/artifacts`, `/artifacts/client`,
+`/artifacts/runtime` and `/artifacts/kodax` subpath exports while the
+workspace module turns private, its pinned dependencies declare in the root
+package, and the declared Node floor advances to 20.16. Every v0.7.96
+stable and v0.7.97-alpha.1 through alpha.7 contract is retained. npm
+publication remains a manual maintainer action.
+
+### Changed
+
+- Single-package Artifact distribution: the main tarball stages the existing module/worker/resource layout under `dist/artifacts/`, the tarball audit validates every export/entry/dependency, the Release workflow runs an installed-package Artifact gate, and `release.mjs` rejects a separate `--artifacts` publication. There is no separate `@kodax-ai/artifacts` npm package. Core startup stays free of renderer loading and probes.
+
+---
+
+## [0.7.97-alpha.7] - 2026-10-16
+
+Seventh alpha of the v0.7.97 line: shared-Session Host ownership resolves
+across daemon profiles — launchers wait for a starting owner's verified
+descriptor within the original startup deadline, reuse compatible Hosts
+without restarting work, and permit only a guarded same-build orphan-exit
+policy refresh — daemon startup and connection timeouts surface as
+structured, retryable failures, idle interactive Hosts retire after a
+bounded 30-second lifetime while explicit daemon/A2A service owners are
+retained, and Windows SDK attachment reads targeted exact identities within
+the original startup controls (Space #222). Every v0.7.96 stable and
+v0.7.97-alpha.1 through alpha.6 contract is retained. npm publication
+remains a manual maintainer action.
+
+### Fixed
+
+- Space Issue 222 CI regression: use one conservative process-liveness check for shared storage discovery, daemon health and verified exit, recognizing unreaped Linux zombies while retaining PID generation checks. Release temporary attachments and rediscover current ownership on bounded startup-only retries within the original deadline and cancellation signal; never replay accepted input or tool work. Gate the original crash cases and deterministic zombie/owner-handoff regressions on Linux Node 20/22 before release.
+- Bound Windows startup cleanup of unverifiable historical child records: the automatic historical sweep keeps incomplete Run trees `unknown` instead of launching a PowerShell termination helper per unverified record — a helper storm that invalidated the shared process snapshot and made startup cost grow with history (24-record fixture: 11,069ms and 48 helpers before, 10ms and none after). Exact-handle Run recovery and verified live-descendant cleanup are preserved.
+- Bound Windows SDK attachment work: fresh PID identity checks read targeted exact FILETIME identities instead of repeatedly scanning the full process table, initial Job ownership evidence is collected together, and the original startup deadline passes through readiness and attachment — expired startup stays an expired failure instead of misclassifying the launcher's own new Host as a competitor (nine isolated same-CPU callers reproduced the timeout and now pass without budget increases). Readiness keeps verified-owner status fresh after authenticated OS inspection, checks deadline/cancellation after final owner/build validation, and aborts pending socket/supervisor readiness through existing cleanup paths; discovery that has crossed its boundary no longer opens attachment leases, and the idle inspection cancels when clients attach.
+- Recognize a starting daemon as an existing owner: a concurrent CLI start while initial A2A reconciliation holds the fence before `daemon.json` exists now reports `already_running` against the actual PID/runtimeId instead of claiming a second `started: true` Host.
+- Retire idle interactive Hosts after the accepted 30-second CLI idle lifetime while retaining explicit services: daemon `start` and A2A-serving owners stay in place, explicit/service retention is authenticated separately from default SDK persistence, conflicting orphan-exit requirements are rejected before shutdown, persistent intent survives rebuild refresh, and configured services are re-evaluated in the replacement Host. Idle exit is fenced on pending memory/managed-task maintenance and unknown legacy startup intent; tracked background work blocks automatic idle exit (including the final draining check) without breaking cancellable explicit shutdown, review or compaction contracts; startup admission uses authenticated read-only checks off idle preflight scans without scanning Session history before any real client.
+- Drain a Run queued after its predecessor finishes: admission can retain its queued decision across asynchronous journal binding while the active predecessor completes and drains an empty queue; the existing guarded drain now wakes after queue publication so the queued Run starts exactly once instead of stranding.
+- Keep the preceding turn visible when submitting a new query in a restored Session with legacy display checkpoints. The Host retains its bounded 150-item tail instead of advancing to the next query and collapsing the entire view to the new input; canonical history, full-item reads and input/tool identities are preserved.
+- Keep saved history readable when its final tool call has no result yet: reaching the end of a valid cached revision no longer reports a history-change conflict. Preserve canonical tool timestamps across observed and paged history, and show the session banner only at the beginning of saved history while browsing ordinary chat, avoiding banner flashes at intermediate page boundaries.
+- Space Issue 222: resolve the daemon that owns the canonical Session directory across profiles before startup, and recheck ownership if a peer wins during bootstrap. Wait for a starting owner's descriptor within the original startup deadline and cancellation signal. Reuse compatible Hosts without restarting work. Permit guarded same-build orphan-exit policy refresh, retaining active-work preflight, exact owner identity and process-exit verification. Publish structured owner/profile and upgrade blocker diagnostics; mark transient blockers retryable.
+- Add bundled real-process shared-Host recovery to the continuous `test:bundle` gate.
+
+---
+
+## [0.7.97-alpha.6] - 2026-10-15
+
+Sixth alpha of the v0.7.97 line: shared-Host startup runs historical child
+recovery once under the owner fences and projects canonical Actor metadata
+during preflight, and `kodax -r`/Host/SDK Session lists order by genuine
+recent message activity with an optional `lastMessageAt`. New REPL Sessions
+stay Host-local drafts until their first accepted input is saved (Issue 368),
+restored views preserve user image attachments, and concurrent resume
+launchers recover from transient inspection conflicts while refreshing an
+older Host (Issue 369). Every v0.7.96 stable and v0.7.97-alpha.1 through
+alpha.5 contract is retained. npm publication remains a manual maintainer
+action.
+
+### Fixed
+
+- Retry transient initialization and read-only inspection failures during concurrent CLI/SDK Host refresh after releasing temporary clients. Account for slow preflight duration in contention backoff, retain the original deadline, and never replay shutdown or business requests (Issue 369).
+- Avoid repeated historical process sweeps during shared-Host startup and exit. Recover under the Host/storage owner fences, retain exact local-child final cleanup, batch Windows identity observations, and read canonical Actor metadata for preflight without materializing Session transcripts.
+- Order `kodax -r`, Host and SDK Session lists by genuine recent message activity. Preserve creation time, compaction/fork provenance and metadata-only writes; expose optional `lastMessageAt`, retain creation-based `before`, and continue new cursors after anchor deletion or activity changes.
+- Keep new REPL Sessions as Host-local drafts until the first accepted user input is saved. Preserve draft settings and Actor CAS in memory, avoid empty history records after exit or rejected input, and persist settings on admission. CLI requires `sessionDrafts:1`; explicit durable SDK creation keeps its existing semantics.
+- Save initial draft inputs and settings before low-level Runs dispatch, preserve settings after restart, and reuse canonical inputs when retrying failed promotion instead of duplicating them.
+- Declare `relationship_scan.depth` as an integer range from 1 to 3 for cross-protocol tool schema compatibility, preserving numeric inputs and stream completion checks.
+- Preserve user image references when restoring canonical accepted inputs into the public Session view. Resolve attachments by the original inputId, retaining item identity, order and text, including repeated identical prompts with different images.
+
+---
+
+## [0.7.97-alpha.5] - 2026-10-13
+
+Fifth alpha of the v0.7.97 line: FEATURE_301's unified Artifact SDK and
+format backends ship — the `ArtifactExecutionPort` seam grows to nine
+public operations with native PDF, exact PNG/JPEG/WebP/SVG, candidate DOCX
+pagination, and local HTML/SMIL evidence over one execution port serving
+independent Node and shared-Host clients — and busy daemon preflights are
+bounded before redundant full state scans (Issue 367). Every v0.7.96
+stable and v0.7.97-alpha.1 through alpha.4 contract is retained. npm
+publication remains a manual maintainer action.
+
+### Added
+
+- Unified optional Artifact SDK (developed in `27d08788`): public
+  `prepare` and `readEvidence`, native PDF, exact PNG and JPEG/WebP/SVG evidence,
+  candidate DOCX pagination, local HTML loaded-view capture and SVG SMIL samples.
+  The same execution port serves independent Node and existing shared-Host clients.
+
+### Changed
+
+- Artifact contracts use content formats, structured capabilities, file/surface
+  provenance, kind-matched capture locators, PNG dimensions and paginated layout.
+  These pre-release changes have no legacy aliases. Shared-Host image bytes use
+  existing attachment reads; core startup does not load optional renderers.
+- SDK, Client/Space integration, migration, architecture and feature documents
+  distinguish source support from released packages and evidence readiness from
+  visual approval. See [support and limits](docs/ARTIFACT_SDK.md).
+
+### Fixed
+
+- Mixed-size PDF viewport cropping, DOCX rendering without optional settings,
+  cross-bundle admitted fixed-argv authority and Host tool image attachment delivery.
+- Daemon preflight rejects known in-flight mutations before redundant full state
+  scans, and reports the actual method/count using the existing shutdown fence
+  (Issue 367). A mutation beginning during a read also stops further scans;
+  busy work is never treated as safe to stop.
+
+Validation: 16,589 tests passed, with package/bundle/native/type checks recorded
+in the [regression guide](docs/test-guides/FEATURE_301_v0.7.97_TEST_GUIDE.md).
+Natural-task GLM/DeepSeek smoke observed automatic image review, but full
+repair/re-review/delivery has not passed all checks. Native DOCX fidelity and
+model-facing schema gaps remain open; see [E2E evidence](docs/test-guides/FEATURE_301_v0.7.97_TEST_GUIDE.md#natural-task-observations-2026-10-13).
+
+---
+
+## [0.7.97-alpha.4] - 2026-10-12
+
+Fourth alpha of the v0.7.97 line: FEATURE_301 adds the independent
+`@kodax-ai/artifacts` package — PPTX authoring, bounded editing, and
+current-file visual evidence through lightweight rendering (optional
+LibreOffice/PDF conversion) — with an
+optional managed KodaX adapter, and retires the out-of-band Sidecar
+Verifier in favor of evidence-based in-run result review with the
+`visual-review` builtin skill. Every v0.7.96 stable and
+v0.7.97-alpha.1/alpha.2/alpha.3 contract is retained. npm publication
+remains a manual maintainer action.
+
+### Added
+
+- `@kodax-ai/artifacts`: independent optional package for PPTX authoring,
+  bounded editing, and current-file visual evidence; its optional KodaX
+  bridge uses managed permissions, sandbox, and cancellation (FEATURE_301).
+- Managed PPT review loop: native Office and autonomous non-Office PPT
+  validation with rendered-page evidence and bounded edit cycles.
+- `visual-review` builtin skill covering static images/charts, paginated
+  documents/slides/sheets, interactive web/app/terminal/canvas/3D surfaces,
+  and temporal video/animation results; missing capabilities and unchecked
+  scope are reported honestly as unverified.
+
+### Changed
+
+- Main-agent result verification replaces the Sidecar Verifier (ADR
+  2026-10-11): the main agent verifies each requested requirement with
+  actual tool and rendered evidence before delivery, and an ordinary
+  read-only child reviewer may contribute findings within the same Run.
+  Retired: verifier execution, config, live callbacks, the synthetic
+  revision producer, `/verifier-log`, and `KODAX_VERIFIER_*` diagnostics;
+  persisted verifier history readers remain. Stall sidecar, Auto
+  permission reviewer, Bash/sandbox policy, Actor waits, and Stop hooks
+  are unchanged.
+- Bundled skill discovery resolves the packaged `builtin` layout, and
+  provider capability profiles carry the capability snapshot into managed
+  task admission; the release audit now walks the runtime tarball
+  (`audit-runtime-tarball.mjs`).
+- Unified client startup progress: `connectKodaXClient` /
+  `ensureKodaXClient` accept an `onStartupProgress` observer over the
+  pure-data `ClientStartupProgress` contract (checking / starting /
+  upgrading / connecting / ready, with waiting reasons
+  `connected_clients`, `host_starting`, `host_stopping`). Observation is
+  local, never awaited, and observer failures never change the startup
+  result; the CLI drives its loading animation from the same notifications
+  and stays responsive, and the REPL gains an optional `onBeforeRender` to
+  clear the loading display before restoring prompts.
+
+---
+
+## [0.7.97-alpha.3] - 2026-10-10
+
+Third alpha of the v0.7.97 line: trusted Main can now bound Product
+Workflows. `authorizeExecution` may return a `workflowHostPolicy`
+(`maxAgents`, `tokenBudget`) without registering credential or hostTools
+leases; the Host capability moves to `productExecutionAuthorization:2`.
+Ceilings bind to Product Runs including their Workflow children, Workflow
+spawn slots are reserved across concurrent admissions, and output usage is
+published only when every executed round reported it. Every v0.7.96
+stable and v0.7.97-alpha.1/alpha.2 contract is retained. npm publication
+remains a manual maintainer action.
+
+### Added
+
+- Trusted-Main Workflow ceilings: `workflowHostPolicy` (`maxAgents`,
+  `tokenBudget`) on `RuntimeExecutionAuthorization`, accepted policy-only
+  on `/client` inputs, queued consumes, and Skill/command/review derived
+  Runs; rejected on independent Actor admissions; Host capability
+  `productExecutionAuthorization:2`.
+- Workflow `maxAgents` race safety: spawn slots are reserved synchronously
+  across pending backend admissions, so concurrent requests cannot exceed
+  the lifetime cap.
+- Workflow output usage: finalized managed results carry aggregate
+  input/output usage; `outputTokens` is published only when every executed
+  round (including verification repair) reported its output usage.
+
+### Changed
+
+- Product Runs capture the Host `workflow.maxConcurrency` at start and use
+  the Host-owned workflow-runs directory; the client adapter strips forged
+  `workflowHostPolicy` fields from Product payloads.
+
+### Fixed
+
+- Terminal Memory review drains no longer reclaim an unavailable preferred
+  job as backlog and steal startup recovery from the next Run (Issue 362).
+- Clipboard helper input-pipe failures now enter the existing native/tmux/OSC
+  52 fallback instead of crashing mouse copy-on-select (Issue 363).
+- MCP stdio sends observe asynchronous write failures and report them through
+  the awaited send and transport diagnostics; required initialization
+  notifications cannot turn a failed connection into ready (Issue 364).
+- Workflow child budgets retain all reported Provider fallback attempts and
+  requests before a thrown attempt, including truncated continuations. Local
+  accounting reuses normalized request facts, preserves Host observers, and
+  keeps conservative totals when component usage is incomplete (Issue 365).
+- The Host interrupt-fence and statistics fixtures wait for actual Provider entry, observe
+  early Run termination, and retain a bounded cleanup window (Issue 366).
+
+---
+
+## [0.7.97-alpha.2] - 2026-10-10
+
+Second alpha of the v0.7.97 line: completes the FEATURE_298 product seams
+embedders need to run the client inside a trusted shell (Space). Execution
+authorization moves to the trusted Main process, every provider wire request
+carries its attribution, and full exits become verifiable. Every
+v0.7.96 stable and v0.7.97-alpha.1 contract is retained. npm publication
+remains a manual maintainer action.
+
+### Added
+
+- Trusted Main execution authorization: `connectKodaXClient` /
+  `ensureKodaXClient` accept an `authorizeExecution(request, services)`
+  callback that runs only in the trusted Main process (Host capability
+  `productExecutionAuthorization:1`; older Hosts reject it instead of
+  silently dropping bindings). It registers scoped credential and hostTools
+  leases and attaches non-secret bindings per operation kind — input,
+  command, review, agents_lean, tool, workflow, agent_spawn, agent_followup,
+  and manual compaction. Queued consumes bind at consumption time, steers
+  keep the target Run's authorization, redirects carry their own, and
+  different authorizations never merge or widen.
+- Provider request attribution: every provider wire request carries its
+  execution identity and route so hosts and embedders can observe which
+  authorization issued it.
+- Client lifecycle and exit: `lifecycle.requestExit` settles client work and
+  records durable exit receipts that `readKodaXClientExits` verifies after
+  reconnect; full exits no longer rely on disconnect side effects.
+- Host surfaces for embedders: an execution facts store and per-session
+  statistics exposed through the daemon, and a bundled product-exit smoke
+  joined the release gates.
+
+---
+
 ## [0.7.97-alpha.1] - 2026-10-08
 
 First alpha of the v0.7.97 line: FEATURE_298's unified product Host and