@oneciel-ai/ciel-runtime 0.2.47 → 0.2.48

package/ciel_runtime_support/providers/opencode.py

@@ -1,5 +1,6 @@
 """OpenCode Zen provider adapter."""
 
+import secrets
 from dataclasses import dataclass, field
 from typing import Mapping
 
@@ -20,11 +21,39 @@ from .base import (
     provider_configuration,
 )
 from .constants import DEFAULT_REQUEST_TIMEOUT_MS, PROVIDER_DEFAULT_BASE_URLS
-from .opencode_catalog import OPENCODE_ZEN_MODEL_PROTOCOLS
+from .opencode_catalog import (
+    OPENCODE_UNION_ALPHA_CONTEXT_WINDOW,
+    OPENCODE_UNION_ALPHA_MAX_OUTPUT_TOKENS,
+    OPENCODE_ZEN_MODEL_PROTOCOLS,
+)
 
 
 OPENCODE_ZEN_OX_ALPHA_FREE_MODEL = "x-preview-f-free"
 OPENCODE_GO_OX_ALPHA_FREE_MODEL = "ox-alpha-free"
+# Latest OpenCode CLI release (2026-09-17, GitHub tag v1.18.31), used only to
+# present the same User-Agent the OpenCode client sends to the opencode
+# gateway (packages/opencode/src/session/llm/request.ts).
+OPENCODE_CLIENT_VERSION = "1.18.31"
+_BASE62 = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
+
+
+def _new_opencode_id(prefix: str) -> str:
+    # OpenCode ID shape as stored by the client itself (session: ses_...,
+    # message: msg_...), 24 base62 characters after the prefix.
+    return prefix + "".join(secrets.choice(_BASE62) for _ in range(24))
+
+
+def new_opencode_session_id() -> str:
+    return _new_opencode_id("ses_")
+
+
+def new_opencode_message_id() -> str:
+    return _new_opencode_id("msg_")
+
+
+# One router process serves one workspace conversation, so its own requests
+# (advisor, compaction, probes) share one stable session for routing/caching.
+_ROUTER_SESSION_ID = new_opencode_session_id()
 
 
 @dataclass(frozen=True)
@@ -87,6 +116,37 @@ class OpenCodeProviderAdapter(HttpBearerProviderAdapter):
             hosted_timeout=True,
         )
 
+    def model_configuration_profile(
+        self, config: ProviderConfig
+    ) -> tuple[Mapping[str, object], str | None]:
+        if self.normalize_model_id(config.model).casefold() != "union-alpha":
+            return {}, None
+        return (
+            {
+                "context_window": OPENCODE_UNION_ALPHA_CONTEXT_WINDOW,
+                "max_model_len": OPENCODE_UNION_ALPHA_CONTEXT_WINDOW,
+                "max_output_tokens": OPENCODE_UNION_ALPHA_MAX_OUTPUT_TOKENS,
+                "supports_vision": True,
+                "model_profile": "opencode-union-alpha-262k",
+            },
+            "OpenCode Union Alpha profile applied: 262,144-token context and "
+            "131,072-token maximum output.",
+        )
+
+    def session_headers(self, config: ProviderConfig) -> Mapping[str, str]:
+        # Present the OpenCode CLI identity to the opencode gateway (Go and
+        # Zen): the client sends User-Agent opencode/<version>,
+        # x-opencode-client, a stable x-opencode-session per conversation and a
+        # per-message x-opencode-request id (packages/opencode/src/session/
+        # llm/request.ts). Without the session Go answers 400 MissingSessionID.
+        del config
+        return {
+            "x-opencode-session": _ROUTER_SESSION_ID,
+            "x-opencode-request": new_opencode_message_id(),
+            "x-opencode-client": "cli",
+            "user-agent": f"opencode/{OPENCODE_CLIENT_VERSION}",
+        }
+
     def router_native_anthropic_enabled(
         self, config: ProviderConfig, model: str | None = None
     ) -> bool:
@@ -242,7 +302,10 @@ class OpenCodeProviderAdapter(HttpBearerProviderAdapter):
 
 
 __all__ = [
+    "OPENCODE_CLIENT_VERSION",
     "OPENCODE_GO_OX_ALPHA_FREE_MODEL",
     "OPENCODE_ZEN_OX_ALPHA_FREE_MODEL",
     "OpenCodeProviderAdapter",
+    "new_opencode_message_id",
+    "new_opencode_session_id",
 ]

package/ciel_runtime_support/providers/opencode_catalog.py

@@ -1,4 +1,4 @@
-"""Official OpenCode endpoint snapshot (2026-09-12).
+"""Official OpenCode endpoint snapshot (Union Alpha verified 2026-09-16).
 
 Sources: https://opencode.ai/docs/zen/ and https://opencode.ai/docs/go/.
 Live model discovery remains authoritative for availability; this snapshot
@@ -6,7 +6,13 @@ provides offline choices and exact per-plan protocol routing. No model capacity
 or sampling parameters are inferred from model names.
 """
 
+# OpenCode's models.dev catalog publishes the same Union Alpha limits for
+# opencode and opencode-go: https://models.dev/api.json
+OPENCODE_UNION_ALPHA_CONTEXT_WINDOW = 262144
+OPENCODE_UNION_ALPHA_MAX_OUTPUT_TOKENS = 131072
+
 OPENCODE_ZEN_MODEL_PROTOCOLS = {
+    "union-alpha": "anthropic_messages",
     "gpt-6-astra": "openai_responses",
     "gpt-5.6-sol": "openai_responses",
     "gpt-5.6-terra": "openai_responses",
@@ -79,6 +85,7 @@ OPENCODE_ZEN_MODEL_PROTOCOLS = {
 }
 
 OPENCODE_GO_MODEL_PROTOCOLS = {
+    "union-alpha": "anthropic_messages",
     "grok-4.6": "openai_responses",
     "gpt-5.6-luna": "openai_responses",
     "glm-5.3-flash": "openai_chat",
@@ -108,4 +115,3 @@ OPENCODE_GO_MODEL_PROTOCOLS = {
     "hy4-preview": "openai_chat",
     "hy3": "openai_chat",
 }
-

package/ciel_runtime_support/providers/opencode_go.py

@@ -3,11 +3,17 @@
 from dataclasses import dataclass, field
 from typing import Mapping
 
-from ..architecture import MessageProtocol
+from ..architecture import MessageProtocol, ProviderConfig
 
 from .base import provider_configuration
 from .constants import DEFAULT_REQUEST_TIMEOUT_MS, PROVIDER_DEFAULT_BASE_URLS
-from .opencode import OPENCODE_GO_OX_ALPHA_FREE_MODEL, OpenCodeProviderAdapter
+from .opencode import (
+    OPENCODE_CLIENT_VERSION,
+    OPENCODE_GO_OX_ALPHA_FREE_MODEL,
+    OpenCodeProviderAdapter,
+    new_opencode_message_id,
+    new_opencode_session_id,
+)
 from .opencode_catalog import OPENCODE_GO_MODEL_PROTOCOLS
 
 
@@ -38,6 +44,18 @@ class OpenCodeGoProviderAdapter(OpenCodeProviderAdapter):
     def documented_model_protocols(self) -> Mapping[str, MessageProtocol]:
         return OPENCODE_GO_MODEL_PROTOCOLS
 
+    def compatibility_headers(self, config: ProviderConfig) -> Mapping[str, str]:
+        # Each compatibility probe is one fresh OpenCode conversation; the
+        # identity headers mirror the OpenCode CLI (see OpenCodeProviderAdapter
+        # .session_headers).
+        del config
+        return {
+            "x-opencode-session": new_opencode_session_id(),
+            "x-opencode-request": new_opencode_message_id(),
+            "x-opencode-client": "cli",
+            "user-agent": f"opencode/{OPENCODE_CLIENT_VERSION}",
+        }
+
     api_key_launch_error_value: str = (
         "Launch blocked: OpenCode Go requires a OpenCode Go API key."
     )

package/ciel_runtime_support/providers/openrouter.py

@@ -16,6 +16,14 @@ from .constants import DEFAULT_REQUEST_TIMEOUT_MS, PROVIDER_DEFAULT_BASE_URLS
 OPENROUTER_OX_ALPHA_MODEL = "stealth/ox-alpha"
 OPENROUTER_OX_ALPHA_CONTEXT_WINDOW = 1_048_576
 OPENROUTER_OX_ALPHA_MAX_OUTPUT_TOKENS = 131_072
+# stealth/union-alpha ended its testing period on 2026-09-17 (POST replies
+# 404 "This model was Unbiased's Pareto. Use it now:
+# https://openrouter.ai/unbiased/pareto"); the same model continues as
+# unbiased/pareto (GET /api/v1/models 2026-09-17: 262,144-token context).
+# Only Chat Completions is documented, so it stays on openai_chat.
+OPENROUTER_PARETO_MODEL = "unbiased/pareto"
+OPENROUTER_PARETO_CONTEXT_WINDOW = 262_144
+OPENROUTER_PARETO_MAX_OUTPUT_TOKENS = 131_072
 
 
 @dataclass(frozen=True)
@@ -25,7 +33,7 @@ class OpenRouterProviderAdapter(OpenAICompatibleProviderAdapter):
     configuration_defaults_value: dict = field(
         default_factory=lambda: provider_configuration(
             "nvidia/nemotron-3-ultra-550b-a55b:free",
-            custom_models=(OPENROUTER_OX_ALPHA_MODEL,),
+            custom_models=(OPENROUTER_OX_ALPHA_MODEL, OPENROUTER_PARETO_MODEL),
             native_compat=False,
             rate_limit_rpm=0,
             rate_limit_status=False,
@@ -91,7 +99,20 @@ class OpenRouterProviderAdapter(OpenAICompatibleProviderAdapter):
     def model_configuration_profile(
         self, config: ProviderConfig
     ) -> tuple[Mapping[str, Any], str | None]:
-        if self.normalize_model_id(config.model) != OPENROUTER_OX_ALPHA_MODEL:
+        selected = self.normalize_model_id(config.model)
+        if selected == OPENROUTER_PARETO_MODEL:
+            return (
+                {
+                    "context_window": OPENROUTER_PARETO_CONTEXT_WINDOW,
+                    "max_model_len": OPENROUTER_PARETO_CONTEXT_WINDOW,
+                    "max_output_tokens": OPENROUTER_PARETO_MAX_OUTPUT_TOKENS,
+                    "model_profile": "openrouter-pareto-262k",
+                    "supports_tool_choice": True,
+                    "supports_vision": True,
+                },
+                "OpenRouter Pareto profile applied: 262,144-token context and 131,072-token maximum output.",
+            )
+        if selected != OPENROUTER_OX_ALPHA_MODEL:
             return {}, None
         return (
             {
@@ -126,5 +147,8 @@ __all__ = [
     "OPENROUTER_OX_ALPHA_CONTEXT_WINDOW",
     "OPENROUTER_OX_ALPHA_MAX_OUTPUT_TOKENS",
     "OPENROUTER_OX_ALPHA_MODEL",
+    "OPENROUTER_PARETO_CONTEXT_WINDOW",
+    "OPENROUTER_PARETO_MAX_OUTPUT_TOKENS",
+    "OPENROUTER_PARETO_MODEL",
     "OpenRouterProviderAdapter",
 ]

package/ciel_runtime_support/runtime_constants.py

@@ -97,7 +97,7 @@ OPENCODE_ENDPOINT_ALIASES = {
 }
 
 APP_NAME = "Ciel Runtime"
-VERSION = "0.2.47"
+VERSION = "0.2.48"
 CREDITS = "Credits: One Ciel LLC"
 PRELAUNCH_CANCEL = 10
 PRELAUNCH_LAUNCH_CODEX = 11

package/ciel_runtime_support/windows_conpty.py

@@ -17,6 +17,7 @@ from .windows_terminal_modes import (
     WindowsTerminalModeFilter,
 )
 from .terminal_input_frames import TerminalInputFrames
+from .windows_console_guard import start_console_guard, stop_console_guard
 from .windows_command_line import command_line_for_create_process
 
 
@@ -473,6 +474,10 @@ class WindowsConPtySession:
             )
             self._mirror_output = False
             self._restore_parent_console()
+            guard = getattr(self, "_console_guard", None)
+            if guard is not None:
+                stop_console_guard(guard)
+                self._console_guard = None
 
     def _write_parent_terminal_modes(self, sequence: str) -> bool:
         with self._parent_output_lock():
@@ -779,6 +784,15 @@ class WindowsConPtySession:
                 self._old_output_mode = old_output_mode
                 self._stdout_console_handle = output_handle
                 self._parent_vt_output_ready = True
+                # The guard only restores console modes if this process dies
+                # before its own restore path runs; a failed start must not
+                # take the whole ConPTY session down with it.
+                try:
+                    self._console_guard = start_console_guard(
+                        self._old_input_mode, self._old_output_mode
+                    )
+                except OSError:
+                    self._console_guard = None
 
     def _restore_parent_console(self) -> None:
         kernel32 = self._kernel32

package/ciel_runtime_support/windows_console_guard.py

@@ -0,0 +1,96 @@
+"""Out-of-process restoration of shared console modes after owner termination.
+
+The helper shares the existing console; it never creates a window. It opens its
+own console handles before acknowledging readiness and waits on an owner process
+handle, so PID reuse cannot cause it to watch a different process.
+"""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+import subprocess
+import sys
+import threading
+
+
+def start_console_guard(input_mode: int, output_mode: int) -> subprocess.Popen:
+    child = subprocess.Popen(
+        [sys.executable, str(Path(__file__).resolve()), str(os.getpid()),
+         str(input_mode), str(output_mode)],
+        stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL,
+    )
+    ready = threading.Event()
+    response = []
+
+    def read_ready() -> None:
+        try:
+            response.append(child.stdout.readline())
+        finally:
+            ready.set()
+
+    threading.Thread(target=read_ready, daemon=True).start()
+    if not ready.wait(5) or response != [b"READY\n"]:
+        stop_console_guard(child)
+        raise OSError("console recovery helper failed to become ready")
+    child.stdout.close()
+    return child
+
+
+def stop_console_guard(child: subprocess.Popen) -> None:
+    if child.poll() is None:
+        child.terminate()
+    child.wait(timeout=5)
+    if child.stdout is not None:
+        child.stdout.close()
+
+
+def _watch(owner_pid: int, input_mode: int, output_mode: int) -> int:
+    import ctypes
+    from ctypes import wintypes
+
+    kernel = ctypes.WinDLL("kernel32", use_last_error=True)
+    kernel.OpenProcess.argtypes = [wintypes.DWORD, wintypes.BOOL, wintypes.DWORD]
+    kernel.OpenProcess.restype = wintypes.HANDLE
+    kernel.CreateFileW.argtypes = [wintypes.LPCWSTR, wintypes.DWORD, wintypes.DWORD,
+                                  wintypes.LPVOID, wintypes.DWORD, wintypes.DWORD, wintypes.HANDLE]
+    kernel.CreateFileW.restype = wintypes.HANDLE
+    kernel.SetConsoleMode.argtypes = [wintypes.HANDLE, wintypes.DWORD]
+    kernel.WriteConsoleW.argtypes = [wintypes.HANDLE, wintypes.LPCWSTR, wintypes.DWORD,
+                                    ctypes.POINTER(wintypes.DWORD), wintypes.LPVOID]
+    kernel.WaitForSingleObject.argtypes = [wintypes.HANDLE, wintypes.DWORD]
+    kernel.CloseHandle.argtypes = [wintypes.HANDLE]
+    owner = kernel.OpenProcess(0x00100000, False, owner_pid)
+    handles = [owner]
+    try:
+        if not owner:
+            return 2
+        console_in = kernel.CreateFileW("CONIN$", 0xC0000000, 3, None, 3, 0, None)
+        console_out = kernel.CreateFileW("CONOUT$", 0xC0000000, 3, None, 3, 0, None)
+        handles.extend([console_in, console_out])
+        invalid = ctypes.c_void_p(-1).value
+        if any(h in (None, invalid) for h in handles):
+            return 3
+        sys.stdout.buffer.write(b"READY\n")
+        sys.stdout.buffer.flush()
+        if kernel.WaitForSingleObject(owner, 0xFFFFFFFF) != 0:
+            return 4
+        # The owner is gone; its finally/atexit handlers cannot restore this.
+        # Reset emulator modes while VT output is enabled, then restore exact
+        # Win32 modes. Do not flush pending user keystrokes from the input queue.
+        kernel.SetConsoleMode(console_out, output_mode | 5)
+        reset = "".join(f"\x1b[?{mode}l" for mode in
+                        (9, 1000, 1001, 1002, 1003, 1004, 1005, 1006, 1015, 1016, 2004, 9001))
+        written = wintypes.DWORD()
+        kernel.WriteConsoleW(console_out, reset, len(reset), ctypes.byref(written), None)
+        kernel.SetConsoleMode(console_in, input_mode)
+        kernel.SetConsoleMode(console_out, output_mode)
+        return 0
+    finally:
+        for handle in handles:
+            if handle and handle != ctypes.c_void_p(-1).value:
+                kernel.CloseHandle(handle)
+
+
+if __name__ == "__main__":
+    raise SystemExit(_watch(*(int(value) for value in sys.argv[1:])))

package/docs/journal/2026/09/16/diagnostics/opencode/go-session-header.okf

@@ -0,0 +1,26 @@
+okf_version: "1.0"
+task: Diagnose OpenCode Go Union Alpha 400 and 503 reports after nightly deployment.
+user_observations:
+  compatibility: HTTP 400 MissingSessionID from Console Go during Text response.
+  codex: HTTP 503 overloaded_error, Console Go Upstream request failed: Endpoint is unavailable, via local router /v1/responses on port 9407.
+official_source: https://opencode.ai/docs/ko/go/ (client requirements: distinct user agent and stable x-opencode-session per conversation; Codex native session header is recognized when forwarded)
+source_evidence:
+  compatibility_test: ciel_runtime_support/compatibility_test.py creates provider_headers(provider, pcfg) without inbound headers or session ID before text/tool phases.
+  provider_request_access: No-inbound path creates content-type, anthropic-version, user-agent, and provider credentials, but no session header.
+  header_forwarding: Inbound end-to-end session headers are preserved by the generic forwarding policy when provided.
+  synthetic_capture: Compatibility header names contain no session header; a synthetic x-codex-session-id survives normal openai_responses header projection.
+  local_reachability: No listener on 127.0.0.1:9407 from this computer at inspection time, so the user's 503 request was not directly captured.
+confirmed: The current compatibility test fails OpenCode Go's documented session-header requirement; the reported 400 is consistent with this confirmed omission.
+unconfirmed: The 503 response has a different upstream error body. No evidence yet that it shares the MissingSessionID cause; upstream endpoint availability or a request-specific routing failure remain possibilities.
+implementation:
+  adapter_contract: ProviderAdapter compatibility_headers defaults to empty.
+  go_adapter: OpenCodeGoProviderAdapter supplies one UUID x-opencode-session and Ciel Runtime user-agent for each compatibility-test run.
+  test_pipeline: The test creates the provider headers once and reuses them across text, tool-use, and tool-result phases.
+  production_proxy: Existing end-to-end forwarding of native Codex/Claude session headers is unchanged.
+verification:
+  simulated_full_probe: Three test phases received the same x-opencode-session and completed with Compatibility OK.
+  regressions: OpenCode 63 tests and architecture-budget tests passed.
+  full_suite: npm test passed; unit 1444 (46 skipped), router 1108, channel 406 (80 skipped), runtime 287 (19 skipped).
+  static: Changed Python files pass Ruff; documentation metadata and git diff --check pass.
+  live_hosted: Not exercised because no OpenCode Go credential is configured on this computer.
+  503: No change claims to repair upstream Endpoint is unavailable; requires separate live request evidence.

package/docs/journal/2026/09/16/fixes/opencode/kimi-k3-turn-recovery.okf

@@ -0,0 +1,21 @@
+okf_version: "1.0"
+task: "Prevent tool-backed Codex turns from silently ending with an unconfirmed text reply across routed and native Responses paths."
+evidence:
+  live_transcript: "YETI-01 E:\\ciel-qb-mcp Codex session emitted task_complete after a progress reply without the promised work tool call."
+  route: "Router activity showed provider=opencode-go, model=kimi-k3, endpoint=https://opencode.ai/zen/go/v1/chat/completions."
+  code_gap: "Completion check previously required a reasoning block; the observed final replies had no reasoning block. Kimi's bounded retry did not recognize the opencode-go route."
+  cross_provider_gap: "Native OpenAI Responses completion gate also required a reasoning output item, so a text-only candidate after function_call_output skipped its independent confirmation path. This source-level condition is provider-independent; the upstream cause of text-only endings remains unverified."
+  corroborating_report: "OpenAI Codex GitHub issue #45096 reports a similar custom Responses premature completion; issue #43329 reports premature completion on a stock OpenAI backend. These are independent user reports, not proof of the cause in our sessions."
+changes:
+  - "A visible no-tool reply after a tool_result now enters the private completion check regardless of reasoning-block presence."
+  - "Kimi K3 model identity enables the existing bounded retry across provider transports."
+  - "Plan Mode remains excluded through the existing policy callback."
+  - "Native OpenAI Responses gate now checks a text-only candidate when the current input ends with a function/custom tool output, even without a reasoning item."
+verification:
+  regression_tests: "151 targeted tests passed: 47 turn recovery, 22 backend item repair, 6 completion gate, 18 reasoning-output recovery, and 58 OpenCode provider. Python compileall and git diff --check passed."
+  isolated_full_suite: "The repository's npm test command passed all four isolated groups on 2026-09-17: unit 1,444 (46 skipped), router 1,108, channel 406 (80 skipped), runtime 293 (19 skipped); 3,251 tests total."
+  provider_probe: "From YETI-01, authenticated OpenCode Go kimi-k3 Chat Completions with x-opencode-session and required tool choice returned HTTP 200, finish_reason=tool_calls, one ciel_runtime_confirm_completion tool call."
+  preliminary_full_suite: "Earlier direct unittest discovery was interrupted after unrelated launch tests opened an interactive Codex resume TUI. The supported isolated npm test subsequently passed."
+  limitation: "The updated local runtime has not been installed into the active YETI-01 Codex process; its 187 MB live session was not replayed end-to-end."
+  causal_limit: "No captured raw upstream terminal frame from an affected routed or native turn; no conclusion about a recent provider/model regression or Codex CLI change."
+scope: "Local code and tests only; no remote installation or release push."

package/docs/journal/2026/09/16/providers/opencode/union-alpha.okf

@@ -0,0 +1,34 @@
+title: OpenCode Zen and Go Union Alpha model card and runtime profile
+sources:
+  zen: https://opencode.ai/docs/ko/zen/ (Union Alpha Free endpoint and price)
+  go: https://opencode.ai/docs/ko/go/ (Union Alpha Free endpoint and price)
+  card: https://models.dev/api.json (opencode and opencode-go union-alpha entries)
+  catalog_origin: https://github.com/anomalyco/models.dev/blob/dev/README.md (OpenCode uses this catalog internally)
+verified_metadata:
+  model_id: union-alpha
+  zen_endpoint: https://opencode.ai/zen/v1/messages
+  go_endpoint: https://opencode.ai/zen/go/v1/messages
+  protocol: anthropic_messages for both plans
+  name: Union Alpha Free
+  description: Stealth model built for agentic coding
+  context_window_tokens: 262144
+  max_output_tokens: 131072
+  input_modalities: text, image
+  output_modalities: text
+  reasoning: true
+  tool_call: true
+  reasoning_options: [] (no documented effort levels)
+  open_weights: false
+  catalog_release_date: 2026-09-16
+  price: free on both plans at time of verification
+implementation:
+  catalog: Exact official model ID and Messages routing for both provider catalogs.
+  profile: Selected Union Alpha applies model-specific context, output, and vision support to both plans.
+  scope: No inferred effort levels or sampling parameters. Other models retain their prior profiles.
+verification:
+  command: python -m unittest discover -s tests -p test_opencode*.py
+  result: 60 OpenCode tests passed.
+  regression: Both plans expose union-alpha; client operations and runtime-prefixed aliases select Anthropic Messages; other models unchanged.
+  runtime_capture: apply_provider_model_profile on current_model=union-alpha yields context_window=262144, max_model_len=262144, max_output_tokens=131072, supports_vision=true for both plans; repeated application is idempotent.
+  static: Ruff on changed Python files and git diff --check passed.
+limitations: Real hosted generation not exercised. No credentials, live sessions, installed runtime, git remotes or published packages changed.

package/docs/journal/2026/09/17/analysis/codebase/structure-survey.okf

@@ -0,0 +1,22 @@
+okf_version: "1.0"
+task: "Codebase analysis of ciel-runtime at nightly-0.2.47 (HEAD 6fee3e8), read-only."
+method: "Direct file reads and command output by the main session, plus three read-only exploration agents (router path; launcher/channel/terminal; providers/protocols/tests/CI). docs/*.md claims were not used as evidence; agent claims listed under verified_directly were re-checked in source by the main session."
+changes: "None to source. This journal file is the only file written."
+verified_directly:
+  size: "921 tracked files, 883 commits, first commit 2026-06-23 a4736e5, HEAD 2026-09-17 6fee3e8. Tracked .py/.cjs/.js: 688 files, 192,466 physical lines (172,341 non-blank)."
+  main_file_budget: "ciel_runtime.py is 4,980 physical lines; architecture_budget.py sets MAIN_FILE_LINE_BUDGET = 4_980 and FINAL_FILE_LINE_BUDGET = 4_999."
+  packaging: "package.json: @oneciel-ai/ciel-runtime 0.2.47, bins ciel-runtime/cielrt/ciel-runtimectl/ciel-runtime-stop -> npm-bin/*.js, no dependencies block, engines.node >=18. npm test = compileall + run_test_group.py unit/router/channel/runtime."
+  test_runner_env: "scripts/run_test_group.py:75-77 sets CIEL_RUNTIME_CONFIG_DIR, CIEL_RUNTIME_ROUTER_PORT, CIEL_RUNTIME_TEST_ISOLATED=1."
+  providers: "Executing the registry: 67 descriptors, 67 adapters, 129 alias-map entries."
+  router_port: "runtime_paths.py:80-100 default_router_port: env CIEL_RUNTIME_ROUTER_PORT -> saved web_backend port -> 8799 + (uid % 1000) or 8799 + (sha256(user|HOME)[:8] % 1000); runtime_paths.py:132-139 per-workspace selection and ROUTER_INSTANCE_ID."
+  composition_root: "ciel_runtime.py:2983-3013 assembles RouterHttpServices / RouterServerRuntime with ThreadingHTTPServer injected as a port; RouterHandler subclasses RouterHttpHandler. GET channel-MCP slot is wired to `lambda _handler, _path: False` (ciel_runtime.py:2985)."
+  upstream_transport: "provider_network.py:117-128 provider_urlopen calls urllib.request.urlopen inside socket_ip_family_policy, which swaps socket.getaddrinfo under a lock (provider_network.py:82-114)."
+  legacy_menu: "ciel-runtime-menu.py imports termios/tty at module top; ciel_runtime.py:4166-4186 only runs it when os.name != 'nt' and CIEL_RUNTIME_USE_LEGACY_MENU=1."
+  launch_mode_type: "architecture.py:26 LaunchMode = Literal['native','routed','router']; README.md:112-117 lists four modes including 'bridge'."
+  channel_delivery: "ciel_runtime.py:3220-3225 normalize_channel_delivery and channel_delivery_mode discard their argument (`del value` / `del cfg`)."
+  working_tree: "git diff: channel_terminal_proxy.py +6/-1 (child exit log, BaseException log-and-reraise before existing finally), windows_conpty.py +8 (import, start_console_guard after parent VT output enabled, stop_console_guard after _restore_parent_console). Untracked windows_console_guard.py (97 lines) is imported only by windows_conpty.py:20; no file under tests/ references it (grep)."
+  apps_dir: "apps/ is empty and has no tracked files."
+agent_reported_not_rechecked: "Endpoint tables, /v1/messages and /v1/responses call chains, upstream_retry/key-cooldown details, protocol and streaming module roles, tool-guard event handling, observability storage formats, architecture-contract categories, CI workflow contents, launcher/channel/lifecycle details, config migration marker list. Line numbers in those reports can be off by a few lines (observed: run_test_group.py reported as :80-82, actual :75-77)."
+correction: "An earlier in-session figure (172,341 total lines; ciel_runtime.py 4,588) came from PowerShell Measure-Object -Line, which skips blank lines. Physical counts are 192,466 and 4,980."
+stale_memory_found: "Auto-memory ciel-runtime-project.md states `npm test` runs all tests in one process without CIEL_RUNTIME_TEST_ISOLATED. Current package.json:52 runs the four isolated groups. Memory updated."
+not_done: "No tests, lint, router, or CLI were executed. No behavior was exercised; this is a static survey."

package/docs/journal/2026/09/17/diagnostics/riskonnect/wsg-screenshot.okf

@@ -0,0 +1,15 @@
+okf_version: "1.0"
+task: "Interpret screenshot of run_wsg.bat failure without assuming a causal link to Ciel Runtime deployment."
+observed_screenshot:
+  command: "PowerShell at D:/ProgramData/Riskonnect/Batch executing ./run_wsg.bat."
+  application_stack: "metadataLoad_console.FileSynchronizer.SynchronizeCustomTable and metadataLoad_console.Program.run."
+  errors:
+    - "[NRTDMS][GetObjectBySID] No object for moniker"
+    - "RK write-back for 1 row(s): NotFound=1"
+    - "The system cannot find the file specified."
+    - "Access is denied for several files under D:/Program Files/iManage/Cloud Workspace Generator, including Analytics.dll and AutoDocPreview.ocx."
+checks:
+  local_windows: "D: drive exists, but the shown batch and iManage paths do not exist on this computer."
+  yeti_01: "SSH read-only check confirmed D:/ProgramData/Riskonnect/Batch/run_wsg.bat and the generator directory are absent on YETI-01."
+assessment: "The screenshot does not identify the host, the first exception line, or a causal relationship to Ciel Runtime. Root cause remains undetermined."
+scope: "No files or services on the screenshot host were changed."

package/docs/journal/2026/09/17/diagnostics/yeti-01/duplicate-final-and-stall.okf

@@ -0,0 +1,29 @@
+okf_version: "1.0"
+task: "YETI-01 E:\\ciel-qb-mcp: check whether (1) the LLM's closing text being shown twice and (2) 'says it will proceed, then stops' are caused by the ciel-runtime router."
+scope: "Read-only over SSH (100.64.0.10:1004, user YETI-01). No file written, no process touched on YETI-01. Scripts were passed as base64 to python -c. No source change locally."
+target_state:
+  router: "127.0.0.1:9407 /health: version 0.2.47-nightly.20260917-050538.6fee3e8, pid 7132, workspace e:\\ciel-qb-mcp, provider github-copilot-oauth, model gpt-5.6-sol, one client pid 5532."
+  client: "pid 5532 = ciel_runtime.py cli --continue; child = codex --yolo ... wire_api=responses base_url=http://127.0.0.1:9407/v1 ... resume 01a09e13-3a25-7262-90d6-b19c054e9a15."
+  transcript: "C:\\Users\\YETI-01\\.codex\\sessions\\2026\\09\\13\\rollout-2026-09-13T21-00-55-01a09e13-...jsonl (294,947,345 bytes); last write 2026-09-17 07:53:59 local (14:53:59Z)."
+  provider_config: "workspaces/51db24129583/config.json providers.github-copilot-oauth: responses_custom_tools_as_functions unset, responses_stream_truncation_retries unset, stream_enabled true."
+  log_level: "INFO. Instance dir has router.log(+.1), tool-calls.jsonl; no requests.jsonl / responses.jsonl / router-sse-trace.jsonl."
+observed_stall:
+  last_turn: "task_started 14:09:30Z (user: '검증 진행'), task_complete 14:53:59Z, duration_ms 2,669,667, one turn_id 01a0afb3-7a82-7132-ac26-58dbadbdc6a4."
+  compactions_inside_turn: "compacted records at 14:10:16, 14:21:34, 14:33:30, 14:43:39, 14:53:55 (window_number 62/63/64 seen for the last three). Each is immediately preceded by an assistant message phase=final_answer ('## Handoff', '## 진행 상태', '## 현재 상태', '### 현재 진행 상태') whose first 200 chars are contained in the compacted.message. Router log for the 14:53:55 one: request_tools=0, request_input_items=379, request_bytes=847187, input_tokens=107040."
+  after_compaction: "14:10:25, 14:21:44, 14:33:48, 14:43:45: assistant message phase=commentary ('…이어서 진행하겠습니다…') followed by tool calls; work continued. 14:53:59: assistant message phase=final_answer, 146 chars ('검증을 이어서 진행하겠습니다. …'), no tool call in that response, then task_complete with the same text. Router log for that request: request_tools=14, request_input_items=206, input_tokens=45719."
+router_path_for_these_requests:
+  route: "provider Responses passthrough (log event provider_responses_cache, emitted by ProviderResponsesPassthrough). With both config flags unset, forward() writes each upstream chunk to the client unchanged (provider_responses_passthrough.py:449-481, projector None)."
+  no_gate_on_this_route: "codex_completion_gate is referenced only from router_http.py (:565 _validate_codex_completion in the Codex backend adapter). recover_preamble_only_turn is called only on the translated route (openai_responses_router.py:234). _handle_provider_responses_route (openai_responses_router.py:417-448) calls neither."
+  phase_field: "ciel_runtime_support never assigns phase='final_answer'; it only validates the value (protocols/openai_responses.py:2049-2050, 2886-2888; responses_anthropic_stream.py:629-630)."
+  log_histogram: "Whole router.log + router.log.1: no codex_completion_gate_*, no recovery/nudge events. Events present: transcript_delta_delivered 2104, channel_windows_console_deferred 890, provider_responses_cache 813, external_event_sse_disconnected 19, transcript_delta_delivery_failed 12, others <=4."
+observed_duplication_checks:
+  transcript_items: "In the last 120 MB of the rollout, assistant response_item texts that occur more than once: two short commentary strings on 2026-09-16 (21:59:01/22:01:08 and 23:14:55/23:17:20), minutes apart, each followed by its own tool call, item ids rs_01a0… . No turn-ending message is recorded twice as a response_item."
+  router_stream: "GET /ca/tui/recent (last 200 events): final request tui-7132-1789656835427761900 has 48 output.text.delta events totalling 146 chars = length of the transcript message. No repeated half."
+  codex_record_shape: "Each turn end is written by Codex as response_item(message) and then event_msg task_complete.last_agent_message with the same text (hash b76f7ff2 for both at 14:53:59). Each assistant message is also preceded by an event_msg item_completed(AgentMessage)."
+  transcript_webhook: "transcript_delta_delivery posts raw JSONL byte ranges. 2104 deliveries, 0 offset rewinds, 2 forward gaps, 12 failures (7 TimeoutError, 5 HTTP 502); a failed batch is re-sent from the same offset."
+not_verified:
+  - "What surface the user sees the doubled text on (Codex TUI through ConPTY, Web Chat, or a Walkie transcript consumer). The console screen of pid 5532 cannot be read over SSH."
+  - "Whether the Codex TUI rendering through the Windows ConPTY proxy shows the closing message twice. No evidence for or against was collected."
+  - "Whether the receiver processed any of the 12 failed transcript batches before the retry."
+  - "Raw upstream SSE for the 14:53:57 request is not persisted; that upstream sent phase=final_answer is inferred from the unchanged-bytes passthrough code path plus the transcript, not from a byte capture."
+assessment: "Stall: verified that the turn ended because the first post-compaction response was a no-tool message marked final_answer; on this route the router forwards bytes unchanged and has no completion check, so it neither produced nor prevented it. Duplication: not found in the model output, in the router's observed stream, or in successful transcript deliveries; the only always-at-turn-end identical pair found is Codex's own response_item + task_complete record."

package/docs/journal/2026/09/17/fixes/codex/passthrough-compaction-completion-gate.okf

@@ -0,0 +1,30 @@
+okf_version: "1.0"
+task: "Stop Codex turns from ending on an unconfirmed text reply, on every Responses route and provider."
+base_commit: "6fee3e8045c174b064446a1f7955341e7bc0b132 (nightly-0.2.47), working tree only; nothing committed, pushed, or deployed."
+history: "First pass gated only Codex compaction resumes on the provider passthrough route. The user then stated the cut-offs occur broadly regardless of provider or model; the transcript scan below supports that, so the rule was generalised and the compaction-specific predicate removed."
+evidence:
+  transcript_scan: "YETI-01 rollout 01a09e13-…, last 160 MB, every task_complete with the item sequence before it, classified by structure. Turns that ended on a progress announcement with no tool call: (S1) after a tool result — opencode-go kimi-k3 04:19:17Z '트레이에 제출합니다.', meta muse-spark 09-16 20:01:31Z '결과 나오는 대로 보고하겠습니다.', 15:46:32Z '…확인하고 이어가…'; (S2) straight after the user's message, no tool call in the turn — opencode-go kimi-k3 03:57:36Z, 03:57:44Z (6 s), 03:57:56Z (5 s) '…확인하겠습니다.'; (S3) first response after Codex mid-turn compaction — github-copilot-oauth gpt-5.6-sol 05:26:33Z and 14:53:59Z. None of these final responses carried a reasoning item."
+  routes: "opencode-go kimi-k3 = translated route (collect + recover_preamble_only_turn). meta and github-copilot-oauth = provider Responses passthrough (router log shows only provider_responses_cache for them)."
+  gaps: "Passthrough route had no completion check at all. Where a check existed (Codex backend adapter, translated route) it required a reasoning item or a trailing tool result, so S2 and S3 were never checked anywhere and S1 was unchecked on the passthrough route."
+changes:
+  - "codex_completion_gate.py: request_allows_completion_check(body) = tools present and tool_choice != 'none'. request_requires_completion_check now = that + parseable completed response + no action + visible text. The reasoning / trailing-tool-result clause is gone."
+  - "codex_turn_recovery.py: message_requires_completion_check generalised the same way (tools, tool_choice not none in string or {type:none} form, no tool_use, visible text). The old structural clause survives only as _retry_still_unfinished, which bounds Kimi's retry loop exactly as before."
+  - "provider_responses_passthrough.py: non-bridge streaming requests that allow tools are buffered through _forward_buffered_stream and observed; an unconfirmed text-only final triggers one follow-up = completion_check_body -> repair_replayed_response_items -> provider normalize_request, sent with the request headers as built. A completed follow-up with a real action replaces the candidate; confirmation, any failure, or a follow-up naming the private tool keeps the candidate. Log events provider_responses_completion_gate_continued / _kept / _failed. Usage recorded for both upstream responses."
+  - "providers/meta.py: Responses tool_choice 'required' and named-function objects are projected to 'auto'."
+  - "tests: new tests/test_provider_responses_completion_gate.py (8); test_codex_completion_gate.py (+2, one assertion inverted); test_codex_turn_recovery.py (the 'needs no completion check without prior tool result' test inverted, + tool_choice none test); test_meta_provider.py (+1)."
+defects_found_by_live_probes:
+  - "Follow-up headers were rebuilt from request.header_items(); urllib had stamped the first body's Content-length there, Copilot got a truncated body and answered 400 'failed to parse request'. Eight body variants all returned 200 in a bisect, isolating the headers. Now the headers dict as built is passed; the test fake stamps Content-length like urllib."
+  - "Meta answered the follow-up with 400: 'only \"auto\" is supported for tool_choice. \"none\", \"required\", and named function choices are not currently supported'. The follow-up bypassed provider request rules and Meta's adapter had no rule for string tool_choice. Fixed by normalising the follow-up and adding the Meta rule. Normalisation was checked idempotent for all nine locally configured adapters that select openai_responses (agy, alims-intl, alitoken, alitoken-individual, codex, github-copilot-oauth, meta, xai, zai-coding-plan)."
+verification:
+  live_passthrough_meta: "meta muse-spark-1.3-contributor, single user message + exec_command tool, instruction to announce first (S2 shape). Two POSTs (tool_choice None then 'auto' with exec_command + ciel_runtime_confirm_completion, 3 input items); delivered output reasoning + message + function_call exec_command; log provider_responses_completion_gate_continued."
+  live_passthrough_copilot: "github-copilot-oauth gpt-5.6-sol. With tool_choice=none forcing a text-only candidate after a Codex summary message (first pass): follow-up accepted (200), delivered function_call exec_command, log …_continued. With the S2 prompt the model emitted message + function_call in one response, so no check was needed."
+  live_translated: "ollama-cloud kimi-k3, S2 prompt: candidate thinking + text, requires_check True, log codex_turn_retry reason=completion_check, delivered text + thinking + tool_use exec_command. ollama-cloud glm-5.1 and deepseek-v4-flash called the tool directly (no check needed). opencode could not be probed: local credential returns 401."
+  tests: "Isolated config dir, per-file: 20 files, 720 tests, all OK (architecture_contracts 261 with 42 skipped). compileall clean. ruff clean on all changed files; `ruff check .` reports 2 findings, both in untracked files under docs/journal/2026/09/12."
+  not_run: "npm test / full groups were not run because a live router (pid 51576, port 9469) was serving on this machine; its pid was unchanged after every run."
+limitations:
+  - "Every Codex turn on a routed provider now costs one extra upstream request when it ends in text (previously only after tool results / reasoning on two of the three routes)."
+  - "Passthrough responses to tool-bearing requests are delivered after buffering instead of streaming, as the Codex backend route already did."
+  - "Providers other than Meta may also reject tool_choice 'required' on this route (alibaba, xai, zai not probed: no local credentials). A rejected follow-up keeps the candidate and logs provider_responses_completion_gate_failed."
+  - "The 09-16 no-reasoning S2 turns were not replayed against opencode-go; that shape is covered by unit tests and by the live Meta probe."
+  - "YETI-01 still runs the published 6fee3e8 build; this change is not installed there."
+related: "docs/journal/2026/09/17/diagnostics/yeti-01/duplicate-final-and-stall.okf; visual last-row duplication was set aside at the user's direction (local repro: GulimChe legacy console renders U+00B7 in two cells, so a row Codex measured as exactly 132 cells wraps; Consolas does not)."