@open-agent-toolkit/cli 0.2.73 → 0.2.74

package/assets/skills/explainer-kit/examples/project-recap/fact-base.json

@@ -1,104 +0,0 @@
-{
-  "schemaVersion": "explainer-kit.fact-base/v1",
-  "generatedAt": "2026-03-09T18:00:00Z",
-  "mode": "supplied",
-  "freshnessPolicy": "live-wins",
-  "sources": [
-    {
-      "id": "atlas-index-project",
-      "kind": "file",
-      "locator": "https://docs.example.com/atlas-index/project-record",
-      "hash": "sha256:1f0c4d2b8a6e5937c41d0b7a2e8f36154c9d0ab7e25f8341d6c07b9ae4315f28",
-      "observedAt": "2026-03-09T18:00:00Z"
-    }
-  ],
-  "claims": [
-    {
-      "id": "F-101",
-      "text": "Nightly full rebuilds were replaced by incremental indexing with no change to the public query contract.",
-      "status": "confirmed",
-      "sections": ["original-request"],
-      "citations": [
-        {
-          "sourceId": "atlas-index-project",
-          "locator": "project-record#request"
-        }
-      ]
-    },
-    {
-      "id": "F-102",
-      "text": "Checkpoints are partition-local, index writes are idempotent, and the full rebuild survives as a recovery path.",
-      "status": "confirmed",
-      "sections": ["key-agent-decisions"],
-      "citations": [
-        {
-          "sourceId": "atlas-index-project",
-          "locator": "project-record#decisions"
-        }
-      ]
-    },
-    {
-      "id": "F-103",
-      "text": "A checkpointed change reader feeds idempotent workers, and a scheduled audit samples both sides for drift.",
-      "status": "confirmed",
-      "sections": ["as-built-architecture"],
-      "citations": [
-        {
-          "sourceId": "atlas-index-project",
-          "locator": "project-record#as-built"
-        }
-      ]
-    },
-    {
-      "id": "F-104",
-      "text": "Checkpoint persistence, replay-safe workers, and the drift audit shipped across three sequential milestones.",
-      "status": "confirmed",
-      "sections": ["implementation-record"],
-      "citations": [
-        {
-          "sourceId": "atlas-index-project",
-          "locator": "project-record#milestones"
-        }
-      ]
-    },
-    {
-      "id": "F-105",
-      "text": "Contract, interrupted-restart, duplicate-batch, and sampled parity suites all passed before cutover.",
-      "status": "confirmed",
-      "sections": ["validation-evidence"],
-      "citations": [
-        {
-          "sourceId": "atlas-index-project",
-          "locator": "project-record#validation"
-        }
-      ]
-    },
-    {
-      "id": "F-106",
-      "text": "Incremental indexing is active and the nightly rebuild is documented as a recovery-only procedure.",
-      "status": "confirmed",
-      "sections": ["outcome"],
-      "citations": [
-        {
-          "sourceId": "atlas-index-project",
-          "locator": "project-record#outcome"
-        }
-      ]
-    }
-  ],
-  "unresolvedClaims": [
-    {
-      "id": "F-107",
-      "text": "Retention of audit samples beyond ninety days awaits a governance decision.",
-      "reason": "needs-confirmation",
-      "sections": ["validation-evidence"],
-      "citations": [
-        {
-          "sourceId": "atlas-index-project",
-          "locator": "project-record#open-questions"
-        }
-      ]
-    }
-  ],
-  "overrides": []
-}

package/assets/skills/explainer-kit/examples/project-recap/fact-base.md

@@ -1,44 +0,0 @@
-# Example fact base: Atlas Index recap
-
-This fictional fact base demonstrates a completed-project recap. The prose below
-is the human-readable view; `fact-base.json` beside it is the same evidence in
-the `explainer-kit.fact-base/v1` shape a run actually consumes, with each claim
-tagged to the narrative section it belongs to.
-
-## Reconciled claims
-
-- **F-101 — Request:** Replace a nightly full rebuild with incremental indexing
-  while preserving the existing query contract.
-  Source: [approved request](https://docs.example.com/atlas-index/request).
-- **F-102 — Decisions:** Checkpoints are partition-local, writes are idempotent,
-  and the full rebuild is retained as a recovery path.
-  Source: [decision log](https://docs.example.com/atlas-index/decisions).
-- **F-103 — As built:** A checkpointed change reader feeds idempotent index
-  workers; a scheduled audit detects drift.
-  Source: [as-built record](https://docs.example.com/atlas-index/as-built).
-- **F-104 — Implementation:** Checkpoint persistence, replay-safe workers, and
-  the drift audit shipped across three milestones.
-  Source: [milestone record](https://docs.example.com/atlas-index/milestones).
-- **F-105 — Validation:** Contract, restart, duplicate-delivery, and sampled
-  parity checks passed.
-  Source: [validation evidence](https://docs.example.com/atlas-index/evidence).
-- **F-106 — Outcome:** Incremental indexing is active and the nightly rebuild
-  remains available only as a recovery procedure.
-  Source: [outcome record](https://docs.example.com/atlas-index/outcome).
-
-## Unresolved
-
-- **F-107 — Retention:** How long audit samples are kept is still a governance
-  question, so the recap reports it as unresolved rather than deciding it.
-
-## Reconciliation notes
-
-An early plan proposed one shared checkpoint. Implementation evidence records a
-checkpoint per partition, so F-102 treats the implementation as authoritative.
-
-## Companion draft
-
-`content.md` is the authored floor draft this evidence supports. It is written
-for the v2 authoring model: tables, a fenced `diagram` block, a `timeline`,
-callouts, and lists, all of which the deterministic narrative renderer turns
-into real structured HTML rather than flat paragraphs.

package/assets/skills/explainer-kit/examples/theme-bundle.json

@@ -1,87 +0,0 @@
-{
-  "schemaVersion": "explainer-kit.theme/v1",
-  "name": "neutral-clean",
-  "defaultMode": "light",
-  "modes": {
-    "light": {
-      "surface": {
-        "canvas": "#ffffff",
-        "panel": "#f3f4f6",
-        "elevated": "#e5e7eb"
-      },
-      "ink": { "primary": "#111827", "muted": "#4b5563", "inverse": "#ffffff" },
-      "accent": { "primary": "#374151", "secondary": "#4b5563" },
-      "status": {
-        "success": "#166534",
-        "warning": "#854d0e",
-        "danger": "#991b1b",
-        "info": "#1e40af"
-      },
-      "diagramSeries": ["#374151", "#1e40af", "#166534", "#854d0e"]
-    },
-    "dark": {
-      "surface": {
-        "canvas": "#111827",
-        "panel": "#1f2937",
-        "elevated": "#374151"
-      },
-      "ink": { "primary": "#f9fafb", "muted": "#d1d5db", "inverse": "#111827" },
-      "accent": { "primary": "#d1d5db", "secondary": "#e5e7eb" },
-      "status": {
-        "success": "#86efac",
-        "warning": "#fde047",
-        "danger": "#fca5a5",
-        "info": "#93c5fd"
-      },
-      "diagramSeries": ["#d1d5db", "#93c5fd", "#86efac", "#fde047"]
-    }
-  },
-  "provenance": {
-    "palette": "neutral",
-    "visualProfile": "clean",
-    "derived": false
-  },
-  "typography": {
-    "sans": ["system-ui", "-apple-system", "BlinkMacSystemFont", "sans-serif"],
-    "serif": ["ui-serif", "Georgia", "serif"],
-    "mono": ["ui-monospace", "SFMono-Regular", "Consolas", "monospace"],
-    "scale": {
-      "caption": "0.875rem",
-      "body": "1rem",
-      "title": "1.5rem",
-      "display": "2.25rem"
-    },
-    "lineHeight": { "caption": 1.4, "body": 1.6, "title": 1.25, "display": 1.1 }
-  },
-  "spacing": {
-    "unit": 4,
-    "scale": { "xs": 4, "sm": 8, "md": 16, "lg": 24, "xl": 40 }
-  },
-  "geometry": {
-    "radius": { "sm": 4, "md": 8, "lg": 12 },
-    "borderWidth": 1
-  },
-  "elevation": {
-    "shadows": {
-      "low": "0 1px 2px rgb(0 0 0 / 0.08)",
-      "high": "0 12px 28px rgb(0 0 0 / 0.16)"
-    }
-  },
-  "density": "comfortable",
-  "motion": {
-    "enabled": true,
-    "durationMs": { "fast": 120, "normal": 200, "slow": 320 },
-    "easing": {
-      "standard": "ease",
-      "emphasized": "cubic-bezier(0.2, 0, 0, 1)"
-    },
-    "reducedMotion": "disable-nonessential"
-  },
-  "diagrams": {
-    "lineWidth": 2,
-    "nodeGap": 32,
-    "arrowStyle": "straight",
-    "labelTreatment": "boxed"
-  },
-  "bundleHash": "sha256:7e7b935c2a6d1603fe4e9fb6bdd32859d3a8fc558db38a7b3289d78e8c1396b3"
-}

package/assets/skills/explainer-kit/recipes/project-recap.v1.json

@@ -1,93 +0,0 @@
-{
-  "schemaVersion": "explainer-kit.recipe/v2",
-  "id": "project-recap",
-  "version": "1",
-  "sourceRoles": [
-    {
-      "role": "project",
-      "required": true,
-      "accepts": ["file", "directory", "git", "github"],
-      "minBindings": 1,
-      "maxBindings": 1
-    }
-  ],
-  "floor": [
-    {
-      "id": "project-recap",
-      "type": "hub",
-      "authoring": "html",
-      "template": "house-style",
-      "required": true,
-      "briefRef": "briefs/project-recap.md",
-      "requiredNarrative": [
-        "original-request",
-        "key-agent-decisions",
-        "as-built-architecture",
-        "implementation-record",
-        "validation-evidence",
-        "outcome"
-      ]
-    },
-    {
-      "id": "architecture",
-      "type": "diagram",
-      "authoring": "html",
-      "template": "diagram-shell",
-      "required": true,
-      "briefRef": "briefs/supporting-diagram.md",
-      "requiredNarrative": ["as-built-architecture"]
-    },
-    {
-      "id": "deck",
-      "type": "deck",
-      "authoring": "html",
-      "template": "deck-shell",
-      "required": true,
-      "briefRef": "briefs/walkthrough-deck.md",
-      "requiredNarrative": ["outcome"]
-    }
-  ],
-  "expansion": {
-    "profiles": [
-      {
-        "profileId": "status-view",
-        "type": "explainer",
-        "authoring": "html",
-        "briefRef": "briefs/project-recap.md",
-        "shell": "house-style",
-        "maxCount": 1,
-        "allowedJustificationKinds": ["status-change"]
-      },
-      {
-        "profileId": "rollout-view",
-        "type": "explainer",
-        "authoring": "html",
-        "briefRef": "briefs/project-recap.md",
-        "shell": "house-style",
-        "maxCount": 1,
-        "allowedJustificationKinds": ["rollout-complexity"]
-      },
-      {
-        "profileId": "deep-dive",
-        "type": "explainer",
-        "authoring": "markdown",
-        "briefRef": "briefs/deep-dive.md",
-        "maxCount": 3,
-        "allowedJustificationKinds": ["source-backed-detail"]
-      }
-    ],
-    "limits": {
-      "maxArtifacts": 5
-    }
-  },
-  "fallback": {
-    "mode": "deterministic-markdown",
-    "selection": "explicit",
-    "authoring": "markdown",
-    "scope": "portfolio"
-  },
-  "discoveryLimits": {
-    "consecutiveNoNewFindingsRounds": 2,
-    "maxRounds": 8
-  }
-}

package/assets/skills/explainer-kit/references/contracts.md

@@ -1,324 +0,0 @@
-# Core run contract
-
-`scripts/run.mjs` is the config-blind orchestration entry point. It reads only
-the explicit `ExplainerRunRequestV1`, bundled skill assets, and source paths
-named by that request. It does not search for `.oat`, user configuration,
-provider configuration, vaults, or destinations.
-
-## Invocation
-
-Programmatic callers import `runExplainer(request, options)`. Command-line
-callers use:
-
-```bash
-node scripts/run.mjs --request request.json
-```
-
-Federated runs require a provider-neutral critic callback. A command-line
-caller supplies one with `--critic-module critic.mjs`; the module exports
-`critic(request)` or a default function. The callback receives reconciled
-claims, sources, overrides, and the freshness policy. It returns:
-
-```json
-{
-  "criticId": "skeptical-pass",
-  "executedAt": "2026-07-17T20:00:00Z",
-  "findings": []
-}
-```
-
-No provider name, command, credential, or dispatch protocol is part of this
-contract.
-
-Every run, interactive or unattended, also requires a provider-neutral author
-callback; a run without one fails `E_AUTHOR_REQUIRED`. An in-process caller
-supplies `options.author(request)`; a JSON-only CLI caller uses
-`--author-module author.mjs`. The core invokes it once per resolved artifact
-with an `explainer-kit.author-request/v3` payload containing the artifact
-identity and type, the artifact's authoring path, the inlined brief, the bundled
-`visualAuthoringGuidance`, the reconciled fact base, the resolved theme, the
-shell source for artistic artifacts, the required narrative sections for
-narrative floor artifacts, bounded-discovery context, and `artifactLinks`.
-Each canonical link entry names the planned artifact, its explicit site-relative
-path ending in `index.html`, and the relative `href` from the receiving
-artifact's own location. The guidance is
-loaded only from the installed skill's `references/visual-authoring.md`; no
-ambient or home-directory file is consulted. The callback must return an
-`explainer-kit.author-result/v2` carrying exactly one of `content.markdown` or
-`content.html`, matching the artifact's declared authoring path, plus non-secret
-provenance. The executable callback is never persisted in `run-request.json`.
-
-New project recap producers select immutable `project-recap@2`. Its
-navigational hub is the only mandatory artifact. A diagram, deck, or deep dive
-is an optional expansion only when its justification states a distinct reader
-question, supporting source evidence, and the rationale for using that medium.
-Project recap requests also have an explicit `recapMode`. Omitting it selects
-and persists `artistic`, which keeps the recipe's rich HTML floor. Selecting
-`deterministic-markdown` before the run applies the recipe-owned fallback to the
-complete planned portfolio — the hub plus any accepted expansions — without
-changing its artifact identities. The resulting Markdown author records and
-`source/content/*.md` paths remain distinct in the manifest and immutable
-rebuild package. An artistic author failure fails the run; the core never
-silently retries or downgrades it as Markdown. `project-recap@1` is immutable
-replay guidance only: retained v1 requests remain readable, but current
-producers do not select it.
-
-Before artifact authoring, a caller supplies one provider-neutral `planSet`
-callback. It receives the reconciled fact base and recipe policy and returns
-`explainer-kit.set-plan/v1`:
-
-```json
-{
-  "schemaVersion": "explainer-kit.set-plan/v1",
-  "planId": "project-recap-set",
-  "recipe": { "id": "project-recap", "version": "2" },
-  "sourceIds": ["plan"],
-  "ledger": {
-    "terminology": [],
-    "statuses": [],
-    "numbers": []
-  },
-  "portfolio": [
-    {
-      "artifactId": "project-recap",
-      "artifactType": "hub",
-      "profileId": "recap-hub",
-      "required": true,
-      "sourceIds": ["plan"],
-      "draft": "Lead with the validated outcome.",
-      "visualIntent": "Orient the reader in the first viewport."
-    }
-  ]
-}
-```
-
-The set plan owns the shared terminology/status/number ledger, source coverage,
-adaptive portfolio, per-artifact draft, and visual intent. Optional entries add
-a source-backed `justification`; undeclared sources, conflicting ledger values,
-duplicate artifact IDs, and unjustified optional entries are invalid. Each
-`author-request/v3` carries the complete immutable `setContext` plus the exact
-matching `plannedArtifact`. The planner finalizes floor and expansion entries
-before authoring; author results cannot add, remove, or replace artifacts.
-Version 2 requests remain valid for deterministic replay; new runs emit only
-the complete v3 request.
-When a planner draft contains a supported non-linear graph, the request also
-carries its closed `graphSemantics` (direction, nodes, edges, and topology).
-Artistic HTML must expose one exact `data-direction`. Each planned node requires
-one observation carrying `data-node`, `data-node-label`, `data-node-shape`, and
-`data-node-explicit`; each planned edge requires one observation carrying
-`data-from`, `data-to`, `data-edge-kind`, and `data-edge-label`. Values must
-match the complete frozen planner tuples exactly, including canonical HTML
-attribute escaping and explicit empty edge labels. Missing, extra, duplicate,
-malformed, noncanonical, rewired, or semantically drifting observations fail
-with `E_DIAGRAM_TOPOLOGY` before browser or visual-critic review.
-
-Visual review uses provider-neutral
-`explainer-kit.visual-review-request/v1` and
-`explainer-kit.visual-review-result/v1` envelopes. The request combines the
-shared plan with rendered artifact paths and viewport evidence, binds every
-rendered file, screenshot, and metrics file by raw-byte SHA-256 hash, and
-binds the launched Chromium name, version, and stable capture identity from
-`explainer-kit.browser-evidence/v2`. It derives a deterministic `requestId` and
-canonical `requestHash`. The critic
-receives a confined reader for those snapshotted paths and cannot read
-unlisted evidence. Core revalidates the bytes after the callback returns.
-Before snapshotting, each screenshot must fully decode as a bounded,
-CRC-verified, non-interlaced 8-bit RGB or RGBA PNG with exact zlib consumption
-and viewport-matched dimensions. The pixel hash established during QA must
-match the later visual-review snapshot.
-The result must echo the exact request identity and hash, name the complete
-artifact set, include artifact-scoped rubric findings, and select exactly one
-`pass`, `correct`, or `fail` disposition. Application validation must pass the
-reviewed request as `visualReviewRequest` context when validating the result.
-Request artifacts must exactly equal the planned portfolio, result artifact IDs
-must exactly equal that reviewed set, and every finding must name one of those
-artifacts. `pass` permits no findings; `correct` and `fail` require at least one
-correction finding. Provider, model, command, credential, and dispatch fields
-are not part of any core contract.
-
-Unattended project recaps require retained browser evidence at every required
-viewport from a branded session returned by `createBrowserProbeSession()` and a
-final visual-critic `pass`. The core derives `runtime.name` and
-`runtime.version` from the launched browser instance; caller assertions cannot
-replace that identity. Deterministic fixture sessions are explicit and may be
-used only in bounded non-production tests. A fixture session, missing trusted
-session, visual-critic failure, terminal `fail`, or second `correct` after the
-one allowed correction pass closes the QA gate with `built-needs-review`. That
-terminal outcome preserves rendered artifacts and all available review
-evidence while skipping durability and publish callbacks.
-
-The canonical immutable evidence consumer contract is
-`explainer-kit.package-coverage/v2`. It requires one matching launched-Chromium
-runtime and capture identity across browser metrics, review requests, retained
-attempt copies, manifest hashes, finalization, and archive validation.
-
-## Explicit source forms
-
-- `factBase.mode: supplied` points to a valid `FactBaseV1` JSON file. The core
-  performs only the lightweight consistency and freshness check and never
-  invokes the critic.
-- `factBase.mode: federated` names explicit source bindings. File locators
-  contain JSON with a `claims` array of
-  `{ "id", "text", "locator"?, "sections"? }`. Optional `sections` values
-  are recipe `requiredNarrative` IDs; untagged claims remain shared across
-  every required section.
-  Non-file bindings require a caller-supplied `sourceLoader(source)` callback.
-  Every binding names its recipe `role` and `sourceSetId`. Multiple documents
-  may share one source-set ID; recipe cardinality counts distinct sets, not
-  documents. The core validates these bindings before loading facts, then
-  reconciles the loaded claims and invokes the critic exactly once.
-
-Reviewed GitHub provenance is one indivisible tuple: `repository`, full
-lowercase 40-character `revision`, repository-relative `path`, inclusive
-`lineRange`, and its exact canonical `url`. Every declared source or citation
-backlink must include the complete tuple. The URL authority is
-`scripts/lib/source-backlinks.mjs`; it rejects moving refs, dot or empty path
-segments, decoded separators, noncanonical percent encoding, credentials,
-queries, and tuple/URL mismatches. Adapters must bind facts and hashes to the
-exact reviewed Git blob bytes, not mutable working-tree content.
-
-An unattended request asserts that its explicit source artifacts are already
-approved. It does not prompt, and it fails before narrative serialization when
-the author is absent, returns an invalid result, or copies excessive verbatim
-source text. It auto-approves with `auto-drafted` marking once the artifacts are
-built and checked.
-
-## Pipeline and retained package
-
-The core executes:
-
-1. validate request and recipe
-2. reconcile or check the fact base
-3. apply bounded discovery and produce one validated set plan
-4. resolve one theme
-5. author every planned artifact against the same set context
-6. render typed artifacts through the narrative renderer or validate
-   agent-composed HTML, per each artifact's declared authoring path
-7. validate every post-render `href`, `src`, `srcset`, and embedded reference
-   against the manifest paths and generated site tree; reject directory links,
-   escapes, missing files or fragments, malformed references, and unsafe
-   embedded resources
-8. optionally apply one bounded author correction, then rerender and revalidate
-   the complete site before any browser callback
-9. run structural and guideline QA, plus required browser and independent
-   visual review for unattended project recaps
-10. close any unresolved recap review gate before external persistence
-11. resolve content approval — the interactive gate pauses here, after render and
-    QA and before anything is published or persisted externally
-12. write the manifest and build record
-
-The internal-reference gate uses a bounded tokenizer/classifier rather than a
-general HTML parser. Relative references resolve from the current explicit file
-with an isolated HTTPS base, then must bind exactly to the manifest/site tree.
-Referenced fragments must resolve to exactly one ID in the target document;
-unused duplicate renderer-generated IDs do not fail indexing. Safe base64 image
-data references and same-document fragments are classified separately. A
-malformed, unresolved, or ambiguous reference fails `E_INTERNAL_REFERENCE`.
-Once the one correction is exhausted, including after visual correction, the run
-fails hard: the QA stage is recorded `failed` with code-only evidence and the
-scrubbed message `The qa stage failed.`, and the run is not durability- or
-publication-eligible. No finding is retained and nothing names the broken
-reference — terminal evidence is code-only by design, and the failure is
-attributed to the `link-validation` evidence stage rather than to
-`browser-review`.
-
-An incomplete interactive result includes
-`approval.resumeToken: "ekrt2:<64 lowercase hex characters>"`. The token is an
-opaque v2 digest over the run ID, original canonical absolute output root, the
-raw-byte SHA-256 hash of `run-request.json`, and raw-byte SHA-256 hashes of the
-five retained `source/set-plan/*.json` records. It is generated from trusted
-in-memory run identity before the interactive pause. The external caller must
-retain it outside the run root and echo it unchanged as
-`reviewedSource.resumeToken` with the later approval decision.
-
-Resume validates the fixed-length token with a timing-safe comparison before
-parsing retained request fields or hydrating set-plan, author, or content
-state. Missing, malformed, mismatched, relocated-root, or byte-drifted tokens
-fail `E_APPROVAL_RESUME` before planner, author, durability, or publish
-callbacks. Only the fixed-format authenticated `ekrt2` token is accepted.
-Every `ekrt1` token is rejected, including a correctly derived legacy digest.
-Legacy paused runs must restart to obtain an authenticated token; a retained
-relative `outputRoot` or any other mutable package state cannot opt into legacy
-resume behavior. The token is not written into the run request, content
-approval, build record, set-plan projections, manifest, or immutable-hash
-inventory.
-
-After authenticating the retained bytes, resume applies initialization's same
-canonical privacy-safe request projection to the current request, including the
-canonical output root and default render strategy, and requires an exact match
-with `run-request.json` before installing current request state or hydrating any
-package content. This binds recipe and recap mode, fact-base input, complete
-theme and render policy, privacy, public base URL, durability, publish
-destination, and run mode. Raw art direction may differ only when
-`privacy.retainRawArtDirection` is not `true`, because that deliberately
-redacted input is non-semantic after the rendered package has paused.
-
-The run package retains the privacy-safe `run-request.json`,
-`source/content-approval.json`, `source/fact-base.json`,
-`source/fact-base.md`, authored content under `source/content/*.md` and
-`source/content/*.html`, structured `source/author/*.json` results,
-`theme.resolved.json`, rendered `site/` files, `manifest.json`, and
-`build-record.json` as far as each stage succeeds. A stage failure records a
-structured error and recovery action without deleting earlier outputs. Raw art
-direction is omitted unless the request explicitly opts in.
-
-`scripts/lib/package-coverage.mjs` is the versioned pure-ESM authority for
-required immutable paths. Successful unattended recaps require complete
-attempt-1 evidence. Successful interactive recaps require no review paths when
-none are retained, but any retained review material requires a complete
-attempt. Failed and incomplete packages follow the same no-evidence/complete-
-evidence split. Only `built-needs-review` may retain a deliberately partial
-chain. Outside that handoff, any attempt-2 material requires complete attempt
-1, the revision record, and complete attempt 2.
-
-Build-record stages are terminal once `passed` or `warned`. A rejected run that
-is later approved reopens the render and QA stages through a narrowly guarded
-record-level reset so the corrected sources are re-rendered and re-validated,
-leaving an auditable trail rather than approving stale artifacts.
-
-When a caller supplies `discover({ round, recipe, factBase })`, the callback
-returns the findings added in that round. The core stops after two consecutive
-empty rounds and always stops at the recipe's `maxRounds`.
-
-## Optional seams
-
-Durability and publishing are never implicit.
-
-`built-needs-review` is not durability-eligible. The core skips both callbacks
-for that outcome, and downstream finalizers, exporters, and archive pushers
-must reject it rather than converting it to success.
-
-- `durability.strategy: none` invokes neither seam.
-- `durability.strategy: commit` invokes the explicit `durability` callback.
-  Caller-created commit evidence is subsequently verified with
-  `record-durability.mjs`; the core never creates commits. The first evidence
-  commit must contain every path and byte hash in `manifest.immutableHashes`:
-  the privacy-safe request, content approval, fact-base JSON and Markdown,
-  declared author results, all authored content, the resolved theme, and every
-  built artifact retained in the package. Mutable `manifest.json` and
-  `build-record.json` remain excluded for the separate evidence update.
-  Schema-v1 manifests created before complete-package coverage are rejected
-  with a legacy-manifest diagnostic and must be regenerated; validators never
-  invent missing hashes.
-- `durability.strategy: publish` invokes the explicit `publish` callback with
-  the complete publish request. A verified receipt is subsequently recorded as
-  durability evidence.
-
-CLI callers provide these callbacks only with `--durability-module` and
-`--publish-module`. Building remains `built-not-durable` until evidence is
-verified. Publishing remains independently human-gated by the caller.
-
-## Result
-
-`runExplainer` returns the run root, manifest path, build-record path, outcome,
-warnings, approval status and marking, and bounded-discovery summary. The
-marking rides in the result and the approval record only; `manifest/v1` stays
-frozen and carries no marking field. Input validation and unsupported
-recipes reject before output mutation. Failures after initialization return a
-`failed` result with paths to the retained record and intermediates.
-`built-needs-review` is a distinct terminal review-gate result, not a synonym
-for `built-not-durable`.
-
-V1 readers reject unknown schema majors and unknown contract fields. Relative
-record paths are run-root confined, hashes use `sha256:<hex>`, and command
-metadata uses argv arrays rather than shell strings.