@omercnet/paseo-omp 0.3.0 → 0.4.0-next.119.1

package/shared/omp-settings.ts

@@ -17,6 +17,163 @@ export type OmpSettingType = z.infer<typeof OmpSettingTypeSchema>;
 export const OmpScalarValueSchema = z.union([z.boolean(), z.number(), z.string()]);
 export type OmpScalarValue = z.infer<typeof OmpScalarValueSchema>;
 
+const MAX_ROUTING_ENTRIES = 64;
+const MAX_FALLBACK_CHAIN_LENGTH = 16;
+const MAX_AGENT_MODEL_CHOICES = 8;
+const MAX_MODEL_SELECTOR_LENGTH = 513;
+
+function containsControlCharacter(value: string): boolean {
+  for (const character of value) {
+    const codePoint = character.codePointAt(0) ?? 0;
+    if (codePoint < 32 || codePoint === 127) return true;
+  }
+  return false;
+}
+
+function utf8ByteLength(value: string): number {
+  let bytes = 0;
+  for (const character of value) {
+    const codePoint = character.codePointAt(0) ?? 0;
+    bytes += codePoint <= 0x7f ? 1 : codePoint <= 0x7ff ? 2 : codePoint <= 0xffff ? 3 : 4;
+  }
+  return bytes;
+}
+
+export const OmpRoleNameSchema = z
+  .string()
+  .min(1)
+  .max(64)
+  .regex(
+    /^[A-Za-z][A-Za-z0-9_-]*$/,
+    "Role names must start with a letter and use only letters, digits, _ or -.",
+  );
+
+export const OmpModelSelectorSchema = z
+  .string()
+  .min(1)
+  .max(MAX_MODEL_SELECTOR_LENGTH)
+  .refine(
+    (value) => utf8ByteLength(value) <= MAX_MODEL_SELECTOR_LENGTH,
+    `Model selectors must not exceed ${MAX_MODEL_SELECTOR_LENGTH} UTF-8 bytes.`,
+  )
+  .refine(
+    (value) => value === value.trim() && !/\s/u.test(value) && !containsControlCharacter(value),
+    {
+      message: "Model selectors must be a single printable token.",
+    },
+  );
+
+export function isValidOmpModelSelector(value: string): boolean {
+  return OmpModelSelectorSchema.safeParse(value).success;
+}
+
+const OmpAgentNameSchema = z
+  .string()
+  .min(1)
+  .max(128)
+  .refine((value) => value === value.trim() && !containsControlCharacter(value), {
+    message: "Agent names cannot have surrounding whitespace or control characters.",
+  });
+
+export const OmpModelRolesSchema = z
+  .record(OmpRoleNameSchema, OmpModelSelectorSchema)
+  .refine((value) => Object.keys(value).length <= MAX_ROUTING_ENTRIES, "Too many model roles.");
+
+const OmpFallbackKeySchema = z.string().superRefine((value, context) => {
+  const schema = value.includes("/") ? OmpModelSelectorSchema : OmpRoleNameSchema;
+  const result = schema.safeParse(value);
+  if (!result.success) {
+    context.addIssue({
+      code: "custom",
+      message: result.error.issues[0]?.message ?? "Invalid fallback chain key.",
+    });
+  }
+});
+
+export const OmpFallbackChainsSchema = z
+  .record(OmpFallbackKeySchema, z.array(OmpModelSelectorSchema).max(MAX_FALLBACK_CHAIN_LENGTH))
+  .refine((value) => Object.keys(value).length <= MAX_ROUTING_ENTRIES, "Too many fallback chains.");
+
+export const OmpCycleOrderSchema = z
+  .array(OmpRoleNameSchema)
+  .max(MAX_ROUTING_ENTRIES)
+  .refine((value) => new Set(value).size === value.length, "Cycle roles must be unique.");
+
+export const OmpAgentModelOverridesSchema = z
+  .record(
+    OmpAgentNameSchema,
+    z.union([
+      OmpModelSelectorSchema,
+      z.array(OmpModelSelectorSchema).min(1).max(MAX_AGENT_MODEL_CHOICES),
+    ]),
+  )
+  .refine(
+    (value) => Object.keys(value).length <= MAX_ROUTING_ENTRIES,
+    "Too many agent model overrides.",
+  );
+
+export const OmpAgentServiceTierOverridesSchema = z
+  .record(
+    OmpAgentNameSchema,
+    z.enum(["inherit", "none", "auto", "default", "flex", "scale", "priority"]),
+  )
+  .refine(
+    (value) => Object.keys(value).length <= MAX_ROUTING_ENTRIES,
+    "Too many agent service tier overrides.",
+  );
+
+const OmpAgentToggleOrSelectorSchema = z.union([z.enum(["on", "off"]), OmpModelSelectorSchema]);
+
+export const OmpAgentPrewalkSchema = z
+  .record(OmpAgentNameSchema, OmpAgentToggleOrSelectorSchema)
+  .refine(
+    (value) => Object.keys(value).length <= MAX_ROUTING_ENTRIES,
+    "Too many agent prewalk overrides.",
+  );
+
+export const OmpAgentAdvisorSchema = z
+  .record(OmpAgentNameSchema, OmpAgentToggleOrSelectorSchema)
+  .refine(
+    (value) => Object.keys(value).length <= MAX_ROUTING_ENTRIES,
+    "Too many agent advisor overrides.",
+  );
+
+export const OMP_STRUCTURED_SETTING_PATHS = [
+  "modelRoles",
+  "retry.fallbackChains",
+  "cycleOrder",
+  "task.agentModelOverrides",
+  "task.agentServiceTierOverrides",
+  "task.agentPrewalk",
+  "task.agentAdvisor",
+] as const;
+export type OmpStructuredSettingPath = (typeof OMP_STRUCTURED_SETTING_PATHS)[number];
+
+export function parseOmpStructuredSettingValue(path: string, value: unknown): unknown | undefined {
+  switch (path) {
+    case "modelRoles":
+      return OmpModelRolesSchema.safeParse(value).data;
+    case "retry.fallbackChains":
+      return OmpFallbackChainsSchema.safeParse(value).data;
+    case "cycleOrder":
+      return OmpCycleOrderSchema.safeParse(value).data;
+    case "task.agentModelOverrides":
+      return OmpAgentModelOverridesSchema.safeParse(value).data;
+    case "task.agentServiceTierOverrides":
+      return OmpAgentServiceTierOverridesSchema.safeParse(value).data;
+    case "task.agentPrewalk":
+      return OmpAgentPrewalkSchema.safeParse(value).data;
+    case "task.agentAdvisor":
+      return OmpAgentAdvisorSchema.safeParse(value).data;
+    default:
+      return undefined;
+  }
+}
+
+export function isOmpStructuredSettingPath(path: string): path is OmpStructuredSettingPath {
+  return (OMP_STRUCTURED_SETTING_PATHS as readonly string[]).includes(path);
+}
+
 export const OmpSettingSchema = z
   .object({
     path: z.string(),
@@ -184,9 +341,76 @@ export const listOmpSettings = defineRpc({
   }),
 });
 
-const OmpSettingChangeSchema = z.discriminatedUnion("operation", [
-  z.object({ operation: z.literal("set"), path: z.string().min(1), value: OmpScalarValueSchema }),
-  z.object({ operation: z.literal("reset"), path: z.string().min(1) }),
+const OmpScalarSettingPathSchema = z
+  .string()
+  .min(1)
+  .refine(
+    (path) => !isOmpStructuredSettingPath(path),
+    "Structured routing settings require typed values.",
+  );
+
+const OmpStructuredSettingChangeSchema = z.discriminatedUnion("path", [
+  z
+    .object({
+      operation: z.literal("set"),
+      path: z.literal("modelRoles"),
+      value: OmpModelRolesSchema,
+    })
+    .strict(),
+  z
+    .object({
+      operation: z.literal("set"),
+      path: z.literal("retry.fallbackChains"),
+      value: OmpFallbackChainsSchema,
+    })
+    .strict(),
+  z
+    .object({
+      operation: z.literal("set"),
+      path: z.literal("cycleOrder"),
+      value: OmpCycleOrderSchema,
+    })
+    .strict(),
+  z
+    .object({
+      operation: z.literal("set"),
+      path: z.literal("task.agentModelOverrides"),
+      value: OmpAgentModelOverridesSchema,
+    })
+    .strict(),
+  z
+    .object({
+      operation: z.literal("set"),
+      path: z.literal("task.agentServiceTierOverrides"),
+      value: OmpAgentServiceTierOverridesSchema,
+    })
+    .strict(),
+  z
+    .object({
+      operation: z.literal("set"),
+      path: z.literal("task.agentPrewalk"),
+      value: OmpAgentPrewalkSchema,
+    })
+    .strict(),
+  z
+    .object({
+      operation: z.literal("set"),
+      path: z.literal("task.agentAdvisor"),
+      value: OmpAgentAdvisorSchema,
+    })
+    .strict(),
+]);
+
+const OmpSettingChangeSchema = z.union([
+  z
+    .object({
+      operation: z.literal("set"),
+      path: OmpScalarSettingPathSchema,
+      value: OmpScalarValueSchema,
+    })
+    .strict(),
+  OmpStructuredSettingChangeSchema,
+  z.object({ operation: z.literal("reset"), path: z.string().min(1) }).strict(),
 ]);
 
 export const updateOmpSettings = defineRpc({

package/shared/support-diagnostics.ts

@@ -0,0 +1,32 @@
+import { defineRpc } from "@getpaseo/plugin";
+import { z } from "zod";
+import { OmpWorkspaceCwdSchema } from "./hub";
+import { OmpStoreSchema } from "./omp-store";
+
+export const OMP_SUPPORT_REPORT_SCHEMA_VERSION = 1 as const;
+export const OMP_SUPPORT_REPORT_MAX_BYTES = 64 * 1024;
+export const OMP_SUPPORT_ISSUE_URL =
+  "https://github.com/omercnet/paseo-plugins/issues/new?template=omp-plugin.yml";
+
+export function supportReportByteLength(value: string): number {
+  return new TextEncoder().encode(value).byteLength;
+}
+
+export const OmpSupportReportTextSchema = z
+  .string()
+  .min(1)
+  .refine((value) => supportReportByteLength(value) <= OMP_SUPPORT_REPORT_MAX_BYTES, {
+    message: "OMP support report exceeds 64 KiB",
+  });
+
+export const getOmpSupportReport = defineRpc({
+  name: "paseo-omp.get-support-report",
+  input: z
+    .object({
+      store: OmpStoreSchema.optional(),
+      force: z.boolean().optional(),
+      cwd: OmpWorkspaceCwdSchema.optional(),
+    })
+    .strict(),
+  output: z.object({ report: OmpSupportReportTextSchema }).strict(),
+});

package/CHANGELOG.md

@@ -1,113 +0,0 @@
-# Changelog
-
-## [0.3.0](https://github.com/omercnet/paseo-plugins/compare/paseo-omp-v0.2.1...paseo-omp-v0.3.0) (2026-09-18)
-
-
-### Features
-
-* **paseo-omp:** add first-class MCP management ([#64](https://github.com/omercnet/paseo-plugins/issues/64)) ([5a8fefa](https://github.com/omercnet/paseo-plugins/commit/5a8fefa9148e8d01f0461aa4a90619ec6ae2c2fa))
-* **paseo-omp:** add workspace-scoped OMP management ([#59](https://github.com/omercnet/paseo-plugins/issues/59)) ([2807aec](https://github.com/omercnet/paseo-plugins/commit/2807aec6217ed2d52f8b4666f0a41a688109f8f5))
-* **paseo-omp:** make composer pills configurable ([#76](https://github.com/omercnet/paseo-plugins/issues/76)) ([28e7501](https://github.com/omercnet/paseo-plugins/commit/28e75011a06a11cdc963187aa4106dfc21d561e6))
-* **release:** publish plugins to npm ([#80](https://github.com/omercnet/paseo-plugins/issues/80)) ([3c93048](https://github.com/omercnet/paseo-plugins/commit/3c93048cfefda97d8c2bc1631e3428fb64bdad09))
-
-
-### Bug Fixes
-
-* **paseo-omp:** advertise nested subsession capability ([#62](https://github.com/omercnet/paseo-plugins/issues/62)) ([fcb4e82](https://github.com/omercnet/paseo-plugins/commit/fcb4e8243e9559d70f26ac6945e2f3c0bf05d575))
-* **paseo-omp:** bound model catalogs and retain safe failure diagnostics ([#73](https://github.com/omercnet/paseo-plugins/issues/73)) ([e70afb7](https://github.com/omercnet/paseo-plugins/commit/e70afb72be782446e7ff585bad40940c7231bdc5))
-* **paseo-omp:** correlate terminal events by request ([#81](https://github.com/omercnet/paseo-plugins/issues/81)) ([41f756e](https://github.com/omercnet/paseo-plugins/commit/41f756e9bebf5cbc275e5cbd3657c37d45a18997))
-* **paseo-omp:** fail closed on unowned later-turn terminal events ([#69](https://github.com/omercnet/paseo-plugins/issues/69)) ([072cd09](https://github.com/omercnet/paseo-plugins/commit/072cd09e38e450376bcd3f4c7b5eae9a670b56b5))
-* **paseo-omp:** preserve prompt scheduling error fidelity ([#67](https://github.com/omercnet/paseo-plugins/issues/67)) ([1c6d549](https://github.com/omercnet/paseo-plugins/commit/1c6d549fddca48be8fd86b4dd2c5faea526c8ac0))
-* **paseo-omp:** reconcile incomplete terminal outcomes ([#68](https://github.com/omercnet/paseo-plugins/issues/68)) ([854f4e6](https://github.com/omercnet/paseo-plugins/commit/854f4e6daddf905c671bb39a94d06a2de0c6d51d))
-* **paseo-omp:** replay failed turns from native transcript ([#79](https://github.com/omercnet/paseo-plugins/issues/79)) ([4a13b77](https://github.com/omercnet/paseo-plugins/commit/4a13b778a9ba413b61fe0cc85878d3c333c161d2))
-* **paseo-omp:** scope providers and auxiliary state to named profiles ([#74](https://github.com/omercnet/paseo-plugins/issues/74)) ([b265ad3](https://github.com/omercnet/paseo-plugins/commit/b265ad317a47230ec76dba799197443664492729))
-* **paseo-omp:** settle concurrent startup races ([#70](https://github.com/omercnet/paseo-plugins/issues/70)) ([9d4e6ef](https://github.com/omercnet/paseo-plugins/commit/9d4e6efb26041f9c88ab4ed6c02a9526520b83e9))
-* **paseo-omp:** show immutable approval mode ([#66](https://github.com/omercnet/paseo-plugins/issues/66)) ([4c586dc](https://github.com/omercnet/paseo-plugins/commit/4c586dc7d012127ee7570077a0d12cc0d6415bd4))
-* **paseo-omp:** support Paseo 0.9 beta ([#103](https://github.com/omercnet/paseo-plugins/issues/103)) ([0444d52](https://github.com/omercnet/paseo-plugins/commit/0444d52078a52befa62bb52f44545f22ab10e8c7))
-* **paseo-omp:** support unkeyed terminal events ([#89](https://github.com/omercnet/paseo-plugins/issues/89)) ([a00a831](https://github.com/omercnet/paseo-plugins/commit/a00a83158993fdf648fc10e06f1d8f8ebc62fa6a))
-
-## [0.2.1](https://github.com/omercnet/paseo-plugins/compare/paseo-omp-v0.2.0...paseo-omp-v0.2.1) (2026-09-15)
-
-
-### Bug Fixes
-
-* **paseo-omp:** handle oversized pasted images ([#55](https://github.com/omercnet/paseo-plugins/issues/55)) ([4b6ed7d](https://github.com/omercnet/paseo-plugins/commit/4b6ed7d3015f1f85dcc13a9dd29061efef5f22c7))
-* **paseo-omp:** preserve buffered terminal ownership evidence ([#54](https://github.com/omercnet/paseo-plugins/issues/54)) ([b49400e](https://github.com/omercnet/paseo-plugins/commit/b49400e09d73cd67a23986f52c17bfc1f23cd297))
-* **paseo-omp:** steer auto messages during active turns ([#61](https://github.com/omercnet/paseo-plugins/issues/61)) ([b36002b](https://github.com/omercnet/paseo-plugins/commit/b36002bbc5b108cd525dd9c356fbdb89d6a9f3e6))
-
-## [0.2.0](https://github.com/omercnet/paseo-plugins/compare/paseo-omp-v0.1.2...paseo-omp-v0.2.0) (2026-09-14)
-
-
-### Features
-
-* **paseo-omp:** add config workspace shell ([#48](https://github.com/omercnet/paseo-plugins/issues/48)) ([1c0126b](https://github.com/omercnet/paseo-plugins/commit/1c0126b51bd3c8ceccacf7758fc14270cd67440e))
-* **paseo-omp:** add opt-in output redaction ([#44](https://github.com/omercnet/paseo-plugins/issues/44)) ([0b0cea1](https://github.com/omercnet/paseo-plugins/commit/0b0cea1501230437fe4d6390b67ca25ee2079c93))
-* **paseo-omp:** browse complete runtime settings catalog ([#49](https://github.com/omercnet/paseo-plugins/issues/49)) ([ef68cd7](https://github.com/omercnet/paseo-plugins/commit/ef68cd754fa3aad4a15bcdc8649f8c7dcdcde79e))
-* **paseo-omp:** edit scalar settings in sidebar ([#50](https://github.com/omercnet/paseo-plugins/issues/50)) ([78da43f](https://github.com/omercnet/paseo-plugins/commit/78da43fd155ed06e29faef507156399b55cf3439))
-* **paseo-omp:** support explicit env passthrough ([#39](https://github.com/omercnet/paseo-plugins/issues/39)) ([e22b3b4](https://github.com/omercnet/paseo-plugins/commit/e22b3b448f218bdecfcb3a168c14fa32051a6392))
-
-
-### Bug Fixes
-
-* **omp:** preserve safe published URLs ([#42](https://github.com/omercnet/paseo-plugins/issues/42)) ([4530430](https://github.com/omercnet/paseo-plugins/commit/4530430a02bee076f8940c376401d3266ce17499))
-* **paseo-omp:** align prompt attachment rendering ([#41](https://github.com/omercnet/paseo-plugins/issues/41)) ([4b708c8](https://github.com/omercnet/paseo-plugins/commit/4b708c897b4af4cd6673e7581f736e95843b545b))
-* **paseo-omp:** expose native Paseo tools ([#52](https://github.com/omercnet/paseo-plugins/issues/52)) ([3b52adf](https://github.com/omercnet/paseo-plugins/commit/3b52adff1de6329fa9f0bc4a1dcea339166e3974))
-* **paseo-omp:** label direct MCP tool calls ([#53](https://github.com/omercnet/paseo-plugins/issues/53)) ([e09b1fd](https://github.com/omercnet/paseo-plugins/commit/e09b1fd2c05cb45422e7d0633e8b638d0841b931))
-* **paseo-omp:** preserve structured tool results ([#46](https://github.com/omercnet/paseo-plugins/issues/46)) ([9e5fe98](https://github.com/omercnet/paseo-plugins/commit/9e5fe989e57e100f67285257cada3242218eee58))
-* **paseo-omp:** render WebP images across clients ([#51](https://github.com/omercnet/paseo-plugins/issues/51)) ([397cb2d](https://github.com/omercnet/paseo-plugins/commit/397cb2d1e660e43e22312ecf9f054d77afcddc6e))
-* **paseo-omp:** stop speculative stream redaction ([#40](https://github.com/omercnet/paseo-plugins/issues/40)) ([539cb61](https://github.com/omercnet/paseo-plugins/commit/539cb61db0b904b8130319c7887852f991c50aba))
-
-## [0.1.2](https://github.com/omercnet/paseo-plugins/compare/paseo-omp-v0.1.1...paseo-omp-v0.1.2) (2026-09-13)
-
-
-### Bug Fixes
-
-* **paseo-omp:** serialize persistent session registration ([#35](https://github.com/omercnet/paseo-plugins/issues/35)) ([03d38bc](https://github.com/omercnet/paseo-plugins/commit/03d38bc7e4a3d00ec54190e2b234a459bbdc55ae))
-* **paseo-omp:** settle late child dispatches ([#34](https://github.com/omercnet/paseo-plugins/issues/34)) ([0746f11](https://github.com/omercnet/paseo-plugins/commit/0746f11fd94f15028fd624ac7a99ac8ebd88b63d))
-
-## [0.1.1](https://github.com/omercnet/paseo-plugins/compare/paseo-omp-v0.1.0...paseo-omp-v0.1.1) (2026-09-13)
-
-
-### Bug Fixes
-
-* **paseo-omp:** preserve Plexus plugin credentials ([#27](https://github.com/omercnet/paseo-plugins/issues/27)) ([0674ef1](https://github.com/omercnet/paseo-plugins/commit/0674ef1d3d66efa37ec9d2da9a19dd57472c2cdd))
-* **paseo-omp:** wait for session registration ([#30](https://github.com/omercnet/paseo-plugins/issues/30)) ([82e901e](https://github.com/omercnet/paseo-plugins/commit/82e901e4bb0e66cafeb572c4bd92e0461b57a647))
-
-## 0.1.0 (2026-09-13)
-
-
-### Features
-
-* **paseo-omp:** add first OMP provider plugin ([#19](https://github.com/omercnet/paseo-plugins/issues/19)) ([f6f3e5e](https://github.com/omercnet/paseo-plugins/commit/f6f3e5e224bf8537f85305d79ea5d1bcf5849549))
-
-## Changelog
-
-## Unreleased
-
-### Features
-
-* Add the permanent `omp-plugin` direct provider, OMP workspace tools, diagnostics, versioned persistence, and nested-subagent support.
-* Add Release Please packaging, Git installation, compatibility policy, and release rollback guidance.
-* Add a digest-pinned official Paseo Docker canary with deterministic mock, configured MCP, and optional local Ollama inference.
-* Document the deduplicated Paseo core OMP issue audit, verified plugin fixes, host-owned concerns, and remaining alpha gaps.
-* Add the OMP sidebar configuration editor with revision-checked scalar writes, structured collection display, and documentation of provider-profile options including names-only inherited environment settings.
-* Add official OMP documentation links and an OMP-native plugin manager with status, user-scoped lifecycle actions, upgrades, write-only non-secret scalar configuration, and presence-only secret handling.
-
-### Bug Fixes
-
-* Cancel pending generic permissions before interrupting OMP so the host receives a terminal cancellation.
-* Rebuild the native branch watermark during replay so a post-rewind prompt retains terminal ownership.
-* Label `xd://` and MCP timeline calls with their registered human-readable title instead of the generic `write` transport or technical route name.
-* Support host-wide session discovery when Paseo opens the unscoped import sheet, preventing its provider failure path from crashing affected 0.8 daemons.
-* Recover degraded or compacted `agent_end` outcomes from complete streamed assistant evidence while continuing to fail closed on partial evidence.
-* Preserve `PLEXUS_API_KEY` when launching OMP so Plexus extension providers can attach their configured bearer header.
-* Serialize concurrent persistent-session registration so startup restoration waits instead of returning transient provider failures.
-* Expose caller-scoped Paseo orchestration tools under their native names so OMP skills can invoke `list_profiles`, `create_agent`, and related tools without CLI fallback.
-* Render validated WebP timeline images on capable clients, show a local fallback when decoding fails, hide machine-facing coordinate annotations, and request PNG/JPEG output from OMP for cross-client compatibility.
-
-### Security
-
-* Split release metadata from least-privilege artifact publishing, gate publication on exact-commit CI, and attest release artifacts.
-* Make release archives self-contained, restrict source inputs to tracked allowlisted files, and verify offline installation plus contained extraction.
-* Disable dependency lifecycle scripts during Git installation and verify both plugin entries from a fresh checkout.
-* Document native-output fidelity, optional best-effort configured-value replacement, its limits, and the host-owned redaction boundary.

package/SUPPORT.md

@@ -1,44 +0,0 @@
-# Support
-
-## Ownership
-
-`@omercnet` maintains the `paseo-omp` package, its release artifacts, and the translation between Paseo's provider protocol and OMP's `rpc-ui` protocol. Support is best effort; no response-time or compatibility SLA is promised.
-
-Report plugin packaging, installation, provider behavior, and compatibility failures in the [paseo-plugins issue tracker](https://github.com/omercnet/paseo-plugins/issues). Use the [OMP RPC compatibility template](https://github.com/omercnet/paseo-plugins/issues/new?template=omp-rpc-compatibility.yml) for native protocol changes.
-
-After the failure is isolated:
-
-- report an OMP CLI or `rpc-ui` implementation defect to [Oh My Pi](https://github.com/can1357/oh-my-pi/issues);
-- report a Paseo plugin SDK, loader, or provider-protocol defect to [Paseo](https://github.com/getpaseo/paseo/issues);
-- keep adaptation, packaging, and cross-project compatibility work in this repository.
-
-Do not put credentials, private repository paths, session transcripts, or unredacted RPC payloads in an issue. Report vulnerabilities through the [private GitHub Security Advisory form](https://github.com/omercnet/paseo-plugins/security/advisories/new), not a public issue.
-
-## Supported versions
-
-- Paseo: `>=0.8.0 <0.10.0` on both the daemon and every app loading the client entry. The pinned SDK and controlled canary use `0.9.0-beta.1`; 0.8.x remains the compatibility line.
-- OMP: `18.1.15` is the oldest release in the required real-binary regression job. The hard runtime contract is `rpc-ui` protocol v2, not the version string alone.
-- Plugin release channel: alpha. Backward compatibility is best effort until stable `0.1.0`; every known migration requirement must be stated in the release notes.
-- Typed approvals: optional. When both peers negotiate `typedToolApprovals: 1`, the plugin uses typed tool permissions. Otherwise it retains the bounded generic extension-question flow.
-
-## Known limitations
-
-- `omp` and `omp-plugin` are independent provider identities. Agents, provider settings, and persisted handles do not migrate automatically between them.
-- Do not open the same underlying OMP session concurrently through both providers. Reservation tracking is provider-local and cannot coordinate ownership with Paseo's bundled adapter.
-- OMP 18.1.15 does not advertise typed tool approvals. The plugin uses its bounded generic permission fallback until both peers negotiate `typedToolApprovals: 1`.
-- OMP releases through 18.2.x may omit the originating prompt `requestId` from `agent_end`. A matching ID is authoritative when present, and a mismatch is discarded before changing turn state. For an unkeyed later-turn terminal, the plugin uses a bounded ordered fallback: the accepted prompt must not be known local-only, a fresh native user entry must correlate to it, current-turn assistant activity must follow that entry, OMP must report idle and non-compacting, and no permission, tool, steer, or child-session work may remain. Ambiguous candidates are ignored while OMP is active; once OMP is confirmed idle, unresolved ambiguity fails only the Paseo turn and keeps the OMP process available. This deliberately accepts a residual same-agent risk: a sufficiently delayed unkeyed event with indistinguishable ordered evidence can still be misattributed. It is safer than accepting any idle `agent_end`, while remaining usable with released OMP builds that cannot provide request identity.
-- Timeline correlation rebuilds an invalid watermark from a complete pre-prompt `get_branch_messages` snapshot, not replayed model context or an evicting identity cache. Snapshots are limited to 1,024 entries and 4 MiB; duplicate IDs, surplus exact-text matches, unavailable history, and exceeded bounds leave users uncorrelated rather than claiming an old entry. Repeated accepted prompts within a turn consume matching branch occurrences in order.
-- Configured MCP servers are supported and bridged into OMP. Paseo's own orchestration tools appear under their native names when the daemon's **Enable Paseo tools** / `daemon.mcp.injectIntoAgents` setting is enabled; other MCP servers remain namespaced. Exact Paseo `toolPolicy` preapproval cannot be represented by OMP `set_host_tools` and therefore fails session startup closed. `disallowedTools` applies only to recognized native OMP built-ins; unknown names are rejected and MCP tools are not silently filtered through it.
-- `qwen2.5:0.5b` is provided only for free exploratory inference. It may ignore exact-output instructions and is not a deterministic protocol or tool-use oracle; use `canary-mock/Deterministic Canary` for assertions.
-- The deterministic mock does not implement OMP's compaction-summary contract, so `/compact` reports `OMP compaction failed` in the canary; compaction remains covered by protocol fixtures.
-- `/handoff` reports `OMP command failed` in the controlled canary even with deterministic role models configured; treat handoff as unavailable there until its native prerequisite is isolated.
-- On official Paseo 0.8.0, requesting a live approval-mode change that the plugin rejects can trigger the daemon's unhandled-rejection restart path. Create a new `full`, `write`, or `ask` session instead of changing mode in place.
-- Paseo 0.8 clients do not expose the platform-owned plugin URL opener and transform timeline items after Overview grouping. Use a 0.9.0-beta.1 app for external documentation/device-authorization actions and for reliable image-card transformation of every source tool call.
-- Native Fast mode and a first-class plan mode are not exposed. `/handoff` is implemented but is not reproducible in the controlled canary without its native OMP workflow prerequisites.
-- Terminal-started OMP sessions are discoverable and importable but are not registered automatically through a terminal hook.
-- Paseo clients do not own OMP sessions. Mobile or desktop disconnects remain subject to Paseo's reconnect grace while the daemon-owned provider and OMP child continue independently; reconnecting can reveal an existing turn but does not transfer or sever runtime ownership.
-- OMP tool output reaching RPC stdout is strictly parsed and bounded, but channel purity ultimately depends on OMP keeping non-protocol output off stdout.
-
-The deduplicated comparison with every known OMP report in `getpaseo/paseo` is maintained in [docs/core-provider-issue-audit.md](docs/core-provider-issue-audit.md).
-
-See [TESTING.md](TESTING.md#omp-rpc-compatibility-intake) for the schema-drift intake and regression process.

package/TESTING.md

@@ -1,150 +0,0 @@
-# OMP provider parity audit
-
-Validated against the Paseo plugin SDK versions pinned in `package.json` and the real OMP compatibility matrix: high-use historical releases 17.2.15, 17.3.4, 18.0.11, and 18.1.10; minimum supported release 18.1.15; latest published 18.1 patch 18.1.22; and current release 18.2.0. Validation against official Paseo Docker image `0.9.0-beta.1@sha256:f75a0eb3547ad3cc6bbdeaa7277d2d50eb4d06a9dd669d480371d7adf1c911b5` is partial as recorded below.
-
-Classifications:
-
-- **Equivalent**: same consumer-observable behavior is implemented by the `omp-plugin` provider.
-- **Unsupported**: OMP has no meaningful native operation for this behavior.
-- **Protocol**: Paseo core owns the behavior for every public provider.
-- **Blocked**: parity needs the linked narrow public API or core change; the plugin fails visibly or provides the documented partial behavior.
-
-## Evidence matrix
-
-| Inventory behavior | Classification | Evidence |
-| --- | --- | --- |
-| Binary availability and version diagnostics | **Equivalent** | Provider refresh calls the bounded `checkAvailability` hook with normalized profile options and the host deadline. `server/provider-diagnostics.ts` distinguishes missing, unrunnable, incompatible, and available runtimes without exposing probe output. |
-| Catalog discovery | **Equivalent** | `server/provider/catalog.ts::discoverOmpCatalog` launches with the normalized profile command, environment policy, parameters, workspace, and timeout settings; selected daemon values are resolved only when the catalog child spawns. |
-| Catalog cache identity | **Equivalent** | `getCatalogCacheKey` hashes normalized `providerOptions`, including configured `inheritEnv` names but never their values or secret-derived fingerprints, plus profile `settings`, scope, working directory, and the effective default command. Core applies configured `models` and `additionalModels` per profile. |
-| Default mode | **Equivalent** | Catalog reports `defaultMode: full`; `full` is always available, while bundled `write`/`ask` modes are advertised only after `permission` negotiation. Covered by `tests/provider.test.ts` and `tests/provider-options.test.ts`. |
-| Create session | **Equivalent** | `OmpProviderSession.open`; ordered `session.opened`, committed `session.config`, and `session.ready` regression. |
-| Resume session | **Equivalent** | Versioned plugin persistence validates the native session ID, authorizes cwd against the configured `providerOptions.params.sessionDir`, resumes exactly, and replays before ready. Covered by `tests/provider.test.ts` and `tests/provider-conformance.test.ts`. |
-| List sessions | **Equivalent** | `session.list` consumes profile-scoped `providerOptions` and `settings`, scans the configured session root, and returns separate bounded first- and last-user-prompt previews. |
-| Import session | **Protocol** and **Equivalent** | `session.list` plus persistence replay feeds the generic plugin-provider import path and creates an `omp-plugin` agent without changing bundled-provider records. |
-| Archive/unarchive | **Unsupported** | OMP has no native archive operation. Neither adapter mutates OMP transcripts; Paseo still archives its own agent record. |
-| Working directory | **Equivalent** | Absolute cwd validation, launch forwarding, resume ownership checks, session-list scoping, and host-tool cwd tests. |
-| Environment propagation | **Equivalent** | `config-normalization.ts` overlays session env on profile env; `omp-rpc.ts::buildOmpEnvironment` allowlists inherited runtime/provider variables and rejects loader/path injection. |
-| System prompts | **Protocol** and **Equivalent** | Core combines agent and daemon prompts before `session.open`; plugin forwards one bounded `--append-system-prompt`. Profile/recovery tests preserve it. |
-| Persisted sessions | **Equivalent** | Versioned opaque plugin persistence, transcript reservation, replay, process recovery, and cleanup quarantine regressions are covered in `tests/provider.test.ts` and `tests/provider-conformance.test.ts`. |
-| Ephemeral sessions | **Equivalent** | `persist: false` maps to `--no-session`; runtime loss fails visibly instead of inventing a resume handle. |
-| Internal sessions | **Protocol** and **Equivalent** | Metadata generation requests `persistSession: false`; the generic plugin host maps that to `config.persist: false`, then OMP receives `--no-session`. |
-| Text prompts | **Equivalent** | Bounded multipart text joins and native prompt lifecycle coverage in `tests/provider.test.ts`. |
-| Image prompts | **Equivalent** | Valid native image models receive image blocks; text-only models receive private content-addressed local files with an aggregate cap and turn/session/failure cleanup. The file path is valid because the direct provider and OMP child share the daemon host. |
-| Structured attachments | **Equivalent** | Forge change requests/issues, legacy GitHub forms, text, reviews, and uploaded files render to bounded OMP prompt text; regression in `tests/provider.test.ts`. |
-| Optimistic message correlation | **Equivalent** | Native entry lookup, repeated-text occurrence correlation, steering correlation, replay-boundary dedupe, and exactly-one `session.prompt_result` regressions. Bounded branch snapshots rebuild incomplete or evicted replay watermarks; duplicate IDs, surplus matching entries, unavailable snapshots, and count/byte overflow retain local user-message fallback instead of claiming an old entry. |
-| Terminal correlation on later turns | **Equivalent with legacy fallback** | A matching `agent_end.requestId` is authoritative and a mismatch is discarded before turn state changes. Released OMP builds that omit the field use ordered evidence from the accepted prompt: a fresh branch-correlated native user entry, later current-turn assistant activity, an idle non-compacting runtime, and no conflicting permission, tool, steer, or child-session work. `prompt_result.agentInvoked: false` remains local-only. Active ambiguous terminals are ignored; confirmed-idle ambiguity fails only the Paseo turn without killing the OMP process. Tests cover three sequential legacy prompts, stale terminals before evidence and while active, repeated text, local-only results, keyed mismatch/match, and degraded state/history. The remaining risk is same-agent misattribution when a delayed unkeyed event is indistinguishable from this ordered evidence. |
-| Streaming assistant text | **Equivalent** | `OmpTimelineProjector` publishes stable complete snapshots with frame coalescing and bounded retained bytes. |
-| Streaming reasoning | **Equivalent** | Indexed thinking blocks map to stable `reasoning` items and share stream bounds. |
-| `contentIndex` ordering | **Equivalent** | Stable 0→1→0 updates, sparse-index rejection, and 64-block bounds are tested in `tests/provider.test.ts`. |
-| Tool lifecycle | **Equivalent** | Running/update/terminal snapshots, mapped shell/read/edit/write/search/fetch/subagent details, ID reuse defense, and terminal cleanup are covered. |
-| Todo lifecycle | **Equivalent** | Todo tool results and reminder/auto-clear events reduce to one stable `omp:todos` item; malformed inputs degrade safely. |
-| Compaction events | **Equivalent** | Manual and automatic operations retain IDs, distinguish retry/skipped/canceled/failed states, flush streams, and refresh usage. |
-| Custom messages | **Equivalent** | Displayable custom and bash-execution messages map to typed or fallback items; `display: false` remains hidden. |
-| Advisor messages | **Equivalent** | Advisor notes preserve severity/attribution in stable tool-call blocks; `advisor_yielded` emits completion notice. |
-| System notices | **Equivalent** | Native notices and safe passive UI notifications map to bounded notification items; hidden custom notices remain hidden. Negotiated MCP authorization URLs use a schema-validated plugin item, can route through the caller-scoped Paseo `browser_new_tab` tool, and retain a notification fallback. |
-| Ask interactions | **Equivalent** | Select/confirm/input/editor questions, including remote OAuth redirect/code completion, option descriptions, fixed-only rejection, bounded freeform input, native sentinel/follow-up submission, cancellation, timeout, and turn ownership are covered by permission regressions. Allow, deny, cancel, timeout, and interruption remain in the agent timeline. |
-| Typed tool permission presentation | **Equivalent** | OMP `typedToolApprovals: 1` is negotiated reciprocally; strict native request/cancel/response frames are correlated exactly once and mapped from trusted shell/edit/write identity to bounded, content-preserving `kind: "tool"` permissions. Older OMP builds retain generic extension questions. |
-| Slash command catalog | **Equivalent** | Native commands and aliases refresh authoritatively; the bundled `compact`, `autocompact`, `handoff`, `steer`, and `follow-up` commands are always published. |
-| Manual `/compact` | **Equivalent** | Uses native `compact`, exposes one loading/completed operation, keeps long requests alive, refreshes usage, and supports interruption. |
-| `/autocompact` | **Equivalent** | `on`, `off`, and state-backed `toggle` use native `set_auto_compaction`; invalid or unavailable state fails visibly. |
-| `/handoff` | **Equivalent** | Structured command calls native `handoff` with optional instructions and owns a provider turn until native assistant/tool/permission/terminal events settle. |
-| `/follow-up` | **Equivalent** | Structured command sends native `follow_up` and owns a provider turn rather than publishing an immediate synthetic completion. |
-| Native steering | **Equivalent** | `delivery: steer` and `/steer` use native steering, correlate one user row, preserve active-turn ownership, and reject stale/terminal targets. |
-| Interrupt | **Equivalent** | Native abort, exactly-one terminal event, in-flight tool/child retirement, permission cleanup, and concurrent-close serialization are covered. |
-| Model selection | **Equivalent** | Catalog-backed opaque public IDs map to native provider/model IDs; committed state is re-read after open/configure/recovery. |
-| Thinking selection | **Equivalent** | Model-specific effort lists, defaults, runtime changes, invalid selections, and recovery are covered. |
-| Mode selection | **Equivalent** | `full`/`write`/`ask` map to `yolo`/`write`/`always-ask`; catalogs and opens expose interactive modes only when `permission` was negotiated, and live changes retain the bundled “new session” constraint. |
-| Retry fallback events | **Equivalent** | Fallback telemetry renders bounded status items and triggers committed model/thinking refresh without trusting event strings as state. |
-| Context and token usage | **Equivalent** | Periodic, post-compaction, fallback, terminal, timeout, and stale-generation samples publish `session.usage`. |
-| Native host tools | **Equivalent** | Paseo's caller-scoped MCP endpoint is converted to OMP host tools with workspace identity, progress, cancellation, bounded results, and ownership cleanup. |
-| Configured MCP servers | **Equivalent** | stdio/http/SSE transports are opened by the plugin host process, namespaced, paginated, bounded, and passed through OMP's native host-tool API. The agent-scoped MCP composer control invokes OMP's native management commands without copying its discovery or credential state. |
-| Subagents | **Equivalent** | Live lifecycle/progress/events create provider-owned child sessions; subscription failure removes the negotiated capability. |
-| Nested child timelines | **Equivalent** | Child/grandchild ancestry, stable IDs, live restart, cold transcript replay, terminal states, and cumulative replay bounds are covered. |
-| Conversation rewind | **Equivalent** | Only conversation scope is advertised; active-turn/stale-token rejection and branch replay are tested. |
-| Native branch transition | **Equivalent** | New native IDs atomically replace persistence/reservation ownership; indeterminate post-branch failures close and quarantine the session. |
-| Custom executable command | **Equivalent** | Strict `providerOptions.command` replaces the executable prefix and survives recovery. |
-| Custom environment | **Equivalent** | Strict `providerOptions.env` is merged below launch env and survives recovery. Strict `providerOptions.inheritEnv` stores bounded names only and resolves unshadowed daemon values at catalog/session spawn. Unexpected or internal launch failures use fixed fallbacks rather than serializing launch configuration, while explicit public validation errors may include caller-supplied configuration names or values. |
-| Configured output redaction | **Equivalent** | `providerOptions.outputRedaction` defaults to `none`. `configured-values` performs bounded best-effort literal replacement for explicitly supplied credential values and every non-empty value selected through `inheritEnv`, regardless of its name, across root and nested timelines; generated, encoded, transformed, and independently streamed fragments remain outside its scope. |
-| Provider parameters | **Equivalent** | `sessionDir`, `rpcTimeoutMs`, and `smol`/`slow`/`plan` model roles map to native arguments and survive recovery; cold resume authorization scans the normalized configured `sessionDir`. |
-| Configured model replacement/additions | **Protocol** and **Equivalent** | Paseo applies profile `models` replacement and `additionalModels` overlays to the profile-specific plugin catalog. |
-| Generic denied tools | **Equivalent** | Core forwards a bounded, deduplicated `deniedTools` list; the plugin turns recognized OMP built-ins into an explicit launch allow-list before the process starts and rejects unknown names rather than silently under-enforcing. |
-| Strict provider option validation before launch | **Equivalent** | The provider registers `OmpProviderOptionsSchema`, including bounded `inheritEnv` names; core normalizes once and forwards the same names-only value through availability, cache identity, discovery, listing, and launch. |
-| Profile settings in provider discovery | **Equivalent** | Core forwards profile settings to catalog, cache-key, and session-list operations; the provider includes them in cache identity without claiming unsupported live OMP settings. |
-| Terminal-started OMP session hooks | **Unsupported** | The bundled terminal hook registry contains Claude, Codex, and OpenCode only; OMP exposes no registered terminal activity hook to preserve. |
-| Metadata-generation flows | **Protocol** and **Equivalent** | Generic structured generation selects plugin models from catalog metadata and creates non-persisted sessions; provider responses use the existing parse/validation retry loop. |
-
-The output boundary validates protocol shapes and bounds strings, structured values, depth, item counts, nodes, cumulative serialized bytes, and cycles. With the default `outputRedaction: "none"`, it does not heuristically redact or rewrite native OMP, model, tool, or permission content. The optional `configured-values` mode replaces exact configured credential literals on a best-effort basis, but it cannot detect generated secrets or encoded, transformed, or independently streamed fragments. Credentials therefore must not appear in prompts or tool output, and centralized Paseo policy is required for redaction guarantees. Unexpected or internal launch failures use fixed public fallbacks rather than serializing launch configuration, while explicit public validation errors may include caller-supplied configuration names or values.
-
-## Integration boundary tests
-
-The provider identity boundary is permanent: `server/provider/registration.ts` registers only `omp-plugin`, while diagnostics recognize both the bundled `omp` provider and this plugin. `tests/server-bundle.test.ts` verifies the packaged server contribution keeps that identity. No test removes, replaces, aliases, migrates, or assumes ownership of the bundled provider.
-
-Run the real Docker host/container ownership boundary test with:
-
-```sh
-npm run test:integration:docker
-```
-
-The script starts the MCP server as a host process, calls it from a Node container, executes a host tool, and verifies the returned host PID, host working directory, caller agent ID, and workspace ID. Set `PASEO_OMP_DOCKER_IMAGE` to override the default `node:22.22.1-bookworm-slim` image.
-
-Run the equivalent Windows-host/WSL boundary with:
-
-```sh
-npm run test:integration:wsl
-```
-
-The WSL script skips when `wsl.exe` or WSL Node is unavailable. Set `PASEO_OMP_REQUIRE_WSL=1` to make either condition fatal, as CI does. `PASEO_OMP_WSL_NODE` may override the default `node` executable inside WSL.
-
-Run the full local provider integration canary with:
-
-```sh
-npm run test:integration:canary
-```
-
-Set `PASEO_CANARY_OMP_VERSION` to exercise another pinned release. The local runner knows the SHA-256 values for every version in the compatibility matrix; an unlisted version requires explicit `PASEO_CANARY_OMP_SHA256_AMD64` and `PASEO_CANARY_OMP_SHA256_ARM64` values. It allocates isolated loopback ports, builds a version-specific image, waits for both services to become healthy, runs the deterministic provider scenarios, prints container logs on failure, and always removes its containers, volumes, and image namespace.
-
-The Linux real-OMP CI matrix downloads checksummed `omp-linux-x64` assets for OMP 17.2.15, 17.3.4, 18.0.11, 18.1.10, 18.1.15, 18.1.22, and 18.2.0, verifies each binary's pinned GitHub release SHA-256, and runs `PASEO_OMP_REAL_E2E=1 PASEO_OMP_VERSION=<version> npm test -- tests/provider.real.e2e.test.ts`. The historical entries are the four pre-floor releases with more than 4,000 downloads shown by npm for the seven days ending 2026-09-15; they are compatibility regression probes, not a support commitment. The remaining entries cover the supported floor, newest patch in that minor line, and current release. The test uses the real OMP binary and a local deterministic OpenAI-compatible model endpoint, including three sequential prompts on one native session, a Bash tool, and oversized-image transport.
-
-The controlled canary in `canary/compose.yml` successfully built the plugin into that official Paseo image, started the daemon, loaded `paseo-omp`, and completed runtime health, catalog/mode discovery, initial text, model switching, `autocompact`, `follow-up`, and the documented compact/handoff error collection. It then failed on the first Bash scenario because the later turn ended without request-correlated terminal ownership: `OMP terminal ownership could not be confirmed`. The subsequent image, MCP, permission, steering, interruption, persistence, subagent, Hub, usage, rewind, browser, and optional Ollama scenarios were not reached and remain unverified on Paseo 0.9.0-beta.1.
-
-## OMP RPC compatibility intake
-
-Treat every upstream `rpc-ui` change as explicit compatibility work. Do not widen a Zod schema with `passthrough`, `unknown`, or an optional field merely to accept a new frame.
-
-1. Open an issue with the [OMP RPC compatibility template](https://github.com/omercnet/paseo-plugins/issues/new?template=omp-rpc-compatibility.yml). Record exact OMP, plugin, Paseo daemon, and Paseo app versions; the negotiated protocol and capabilities; the smallest reproduction; and sanitized frame shapes. Never attach credentials, private paths, prompts, or transcripts.
-2. Reproduce against both the reported OMP revision and the pinned minimum-tested `omp/18.1.15` binary. Classify the change as additive optional, additive required, removed or renamed, type or semantic change, or negotiation change.
-3. Compare the affected ready, request, response, or event shape with the strict schemas in `server/provider/omp-rpc.ts`. Decide whether the plugin can support both contracts without ambiguity. A breaking contract requires an explicit compatibility decision and changelog entry, not silent coercion.
-
-Required drift is release-blocking. If OMP adds a mandatory frame, removes or renames a required method or field, or changes an existing field's meaning, keep the strict parser and make session startup or the active request fail visibly. Do not silently discard the frame, make the requirement optional, or route around negotiation. Resume release work only after both sides have an explicit compatible contract, fixtures, focused regressions, and a real-binary result.
-4. Add the changed frame to `tests/fixtures/fake-omp.ts`, then add a focused regression for acceptance, rejection, negotiation, cancellation, and bounds as applicable. Capability changes must cover both reciprocal negotiation and the absent-capability fallback. Typed approval drift must retain the generic extension-question path when `typedToolApprovals: 1` is not negotiated.
-5. Run `npm test -- tests/omp-rpc.test.ts tests/provider.test.ts`, `npm run test:coverage`, and `PASEO_OMP_REAL_E2E=1 npm test -- tests/provider.real.e2e.test.ts` with the candidate OMP binary.
-6. Update the minimum-tested version only after the real-binary job is pinned to that release and its SHA-256, the compatibility issue links the evidence, and the README, support matrix, CI job name, fixture version, and changelog agree.
-
-The plugin maintainer owns triage and adaptation. Escalate an isolated OMP implementation defect upstream and an isolated Paseo SDK or provider-protocol defect to Paseo, while keeping the cross-project regression in this repository.
-
-## Release publication
-
-`release-please.yml` creates GitHub releases and publishes every released plugin path to npm through trusted publishing. Stable versions use the `latest` distribution tag; prereleases use `next`. npm generates provenance from the GitHub Actions OIDC identity, and the workflow waits for registry propagation before succeeding.
-
-### Alpha release channel
-
-`release-please-config.json` sets only `paseo-omp` to `prerelease: true` with `prerelease-type: alpha`. With the existing `initial-version: 0.1.0` and manifest version `0.0.0`, the first release PR is expected to prepare `0.1.0-alpha.1`, tag it as `paseo-omp-v0.1.0-alpha.1`, and mark the GitHub release as a prerelease. Other monorepo components keep their existing stable release behavior.
-
-Do not manually edit `paseo-omp/package.json` or `.release-please-manifest.json` before that release PR; Release Please must update both atomically. After alpha validation, remove `prerelease` and `prerelease-type` from the `paseo-omp` package config and let Release Please prepare stable `0.1.0`. Never retag an alpha commit as stable.
-
-The go/no-go criteria, manual acceptance boundary, and alpha limitation list are maintained in [docs/alpha-release-checklist.md](docs/alpha-release-checklist.md). Preparation does not authorize a push, tag, GitHub release, or publication; explicit maintainer approval after testing is required.
-
-## Audit verification
-
-- `npm run check`: clean.
-- `npm run typecheck`: clean.
-- `npm test`: full Vitest suite passed, with environment-gated scenarios skipped when their runtimes were unavailable.
-- `npm test -- tests/provider-conformance.test.ts`: host-boundary conformance coverage includes `prompt.command`, `session.configure`, typed and fallback permission allow/deny/cancel paths, registry-driven reload/removal, verified stubborn-descendant cleanup, and sequential turns plus interrupt races with post-turn barriers.
-- `PASEO_OMP_REAL_E2E=1 PASEO_OMP_VERSION=<version> npm test -- tests/provider.real.e2e.test.ts`: the installed matrix version's catalog and hermetic real-binary text/Bash and oversized-image scenarios run against a local deterministic model.
-- `npm run test:coverage`: Vitest enforces aggregate 85% function and 89% line coverage over loaded source modules. Generated `dist/**` trees are excluded.
-- `npm run test:integration:install`: npm package acquisition retains required production dependencies, and a fresh Git-style checkout runs frozen production-only preparation with lifecycle scripts disabled. Both installed trees resolve runtime dependencies, compile the client and server entries with Paseo's host compiler, and load the server contribution.
-- `npm run test:integration:docker`: verifies the host/container ownership boundary.
-- `npm run test:integration:wsl`: locally skips when `wsl.exe` is unavailable; Windows CI sets `PASEO_OMP_REQUIRE_WSL=1`, so this boundary remains required there.
-- `docker compose -f canary/compose.yml`: official Paseo 0.9.0-beta.1 image build, daemon startup, plugin load, and early deterministic scenarios passed; the smoke stopped at the first later-turn Bash scenario with `OMP terminal ownership could not be confirmed`, so the remaining scenarios are unverified.
-- `zizmor .github/workflows`: no findings (offline audit; six repository-wide suppressions remain).
-- Release Please 17.1.2 `config.json` and `manifest.json` schema validation: passed for `release-please-config.json` and `.release-please-manifest.json`.