@orion-agents/orion-code 0.1.9 → 0.2.2

package/CHANGELOG.md

@@ -22,6 +22,91 @@ which is **not** a pass.
 
 ## [Unreleased]
 
+## [0.2.2] — 2026-08-27
+
+> **Status: published.** The `v0.2.2` tag and npm `latest` package identify this release tree.
+
+### Fixed
+
+- Isolate Session discovery from malformed historical model context so one interrupted V2 Thread
+  cannot block `/session`, `/resume --last`, or a healthy explicit resume for the whole project.
+- Recover incomplete imported tool-call groups as explicit cancelled tool results before provider
+  requests, retain the original transcript facts, and surface typed recovery provenance to users.
+- Keep compact Goal token usage visible ahead of long objective text on narrow TUI status rows while
+  preserving Goal escape controls and the purple mode override.
+
+## [0.2.1] — CANDIDATE
+
+> **Status: candidate.** This source version is not a Git tag, GitHub Release, or npm publication
+> until each external receipt is created and read back.
+
+### Fixed
+
+- Project session discovery now projects message count, durable history size, and last activity
+  from the authoritative v2 Thread instead of treating an empty legacy JSONL sidecar as the session.
+- `/resume` and `/resume --last` restore the latest TurnCommit model history and replay the selected
+  Thread into the UI exactly once without starting an extra model turn or duplicating user input.
+- Runtime restart treats legacy Harness and Goal sidecars as first-migration seeds only; once a
+  TurnCommit exists, its TaskContext and Goal state remain the sole durable authority.
+- TUI submission uses the durable Thread user item as its only transcript echo, including queued
+  revisions, so one user input renders as one entry.
+- TUI context pressure now flows from the product Agent Loop into a live, width-prioritized `CTX`
+  percentage instead of disappearing until the turn completes.
+- Goal V2 TurnCommits now restore the purple Goal mode chrome, clear it on completion, and display
+  only compact cumulative usage such as `tokens:581.6K` instead of an internal unlimited sentinel.
+- Cross-process file locking no longer lets healthy contenders starve the active owner through the
+  recovery sentinel; stale recovery remains serialized and fail-closed.
+
+## [0.2.0] — CANDIDATE
+
+> **Status: candidate.** Implementation evidence does not imply a Git tag, GitHub Release, npm
+> publication, or dist-tag promotion. Those receipts remain pending until performed and read back.
+
+### Added
+
+- Add the versioned `Thread → Turn → Step → Item` runtime protocol, append-only Thread event store,
+  deterministic projection/replay, bounded renderer buffering, and typed admission for start, steer,
+  follow-up, interrupt, overload, and maintenance.
+- Add immutable Step Snapshots and Capability Receipts binding model, prompt, Authority, Policy,
+  selected Skills/MCP, visible schemas, exact executors, and durable per-request lineage.
+- Add a single ToolGateway execution boundary for core, long-tail, nested batch, MCP, Skill, and
+  subagent invocations through Capability → Policy → Approval → Sandbox → Execute.
+- Add descriptor-first lazy Skill and MCP runtimes with scope layering, bounded caches, digest
+  invalidation, single-flight loading, exact server leases, idle teardown, and crash isolation.
+- Add Prompt Registry budgets, stable prefix receipts, first-party contributor slots, redaction,
+  and deterministic omission reasons.
+- Add transactional Compact maintenance, atomic TurnCommit, Goal Runtime V2, durable PlanReceipt,
+  modern child Thread runtime, and a side-by-side legacy Session materializer with atomic index
+  cutover.
+- Add machine-readable Harness benchmark/eval, architecture confluence, exact tarball, Node 20/22/24
+  runtime matrix, gate evidence, and aggregate ReleaseReceipt contracts.
+
+### Changed
+
+- Replace the legacy Brain/Agent/Harness/query runtime graph with one statically composed product
+  Runtime and one Agent Loop implementation for root and child turns.
+- Reduce the ordinary coding schema from the frozen v0.1.9 baseline of 33 tools / 20,596 bytes to
+  7 exact core schemas / 3,947 bytes; long-tail capabilities are selected or deferred by task.
+- Make `/plan <task>` commit a PlanReceipt and exit automatically; implementation starts in a new
+  logical turn after BUILD/AUTO is restored.
+- Let productive Goals continue without a fixed turn-count cap; evidence audit, resource budget,
+  no-progress, blocker, provider, persistence, interrupt, and completion decisions remain explicit.
+- Keep BUILD/PLAN/AUTO as workflow modes independent from Authority and tool permission policy.
+
+### Removed
+
+- Remove the Ink renderer, legacy Agent/Brain/Harness/SDK public surface, global `TOOLS` and eager MCP
+  singleton, compatibility command roots, and direct model→tool execution bypasses from the package.
+- Remove `/target`, `/mode`, model-facing `enter_plan_mode`/`exit_plan_mode`, and legacy Goal mutations
+  `/goal exit|edit|replace|confirm|budget` plus `clear --yes`.
+
+### Security
+
+- Freeze exact schema/executor/Authority/Policy bindings per model request and fail closed on digest
+  or catalog drift.
+- Preserve project-boundary, symlink, sandbox, destructive-command, cancellation, durable receipt,
+  and indeterminate-side-effect enforcement across all modes and nested execution.
+
 ## [0.1.9] — CANDIDATE
 
 > **Status: candidate.** Source, CI, exact tarball, npm `next`, tag, GitHub Release, and stable

package/README.md

@@ -1,390 +1,209 @@
 # Orion Code
 
-> **Goal-driven coding agent for the terminal.**
->
-> v0.1.9 — semantic compact, evidence-driven completion, and autonomous progress control
+Goal-driven coding agent for the terminal.
 
-[![License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
-[![Node.js](https://img.shields.io/badge/node-%3E%3D20.0-green.svg)](https://nodejs.org)
-[![TypeScript](https://img.shields.io/badge/typescript-5.0-blue.svg)](https://www.typescriptlang.org)
+> v0.2.2 — resilient Thread session recovery, provider-safe interrupted tool
+> history, and width-stable Goal usage visibility on the v0.2 Harness.
 
----
+[中文说明](README.zh-CN.md) · [Architecture plan](docs/plan/v0.2.0-dsh-harness-redesign-plan.md) ·
+[Migration guide](docs/migration/v0.1.9-to-v0.2.0.md) ·
+[Release checklist](docs/plan/v0.2.0-release-checklist.md)
 
-**Language**: [English](README.md) | [简体中文](README.zh-CN.md)
+## What changed in v0.2.0
 
----
+Orion now has one product execution spine:
 
-## Overview
-
-Orion Code is a terminal-based coding agent. It wraps LLM APIs in a harness of safety checks, tool orchestration, session management, and context awareness.
-
-| Dimension         | Description                                            |
-| ----------------- | ------------------------------------------------------ |
-| **Agent Harness** | Safety boundaries, task constraints, result validation |
-| **Tool Calling**  | LLM autonomously invokes tools to complete tasks       |
-| **Memory System** | Layered memory with semantic search                    |
-| **MCP Protocol**  | Connect external MCP servers for tool extension        |
-
-## Quick Start
-
-### Requirements
-
-- Node.js 20, 22, or 24 LTS
-- npm >= 9.0
+```text
+Thread → Turn → Step → Item
+                    │
+                    ├─ frozen prompt/model/capability snapshot
+                    └─ Capability → Policy → Approval → Sandbox → Execute → durable receipt
+```
 
-### Install & Run
+- **Lean by default.** Ordinary coding starts with seven exact core tools instead of sending every
+  built-in schema. Long-tail Git, LSP, web, Skill, MCP, batch, and subagent capabilities are selected
+  only when the task needs them.
+- **One trustworthy loop.** Root turns and child agents use the same Agent Loop and ToolGateway;
+  schema and dispatch are bound by the same Step Snapshot.
+- **Lazy extensions.** Skill catalogs contain bounded descriptors; definition bodies and resources
+  load only after selection. Configured MCP servers stay disconnected until an exact server/tool is
+  selected and release their lease when idle.
+- **Durable completion.** History, TaskContext evidence, Goal state, StopDecision, capability
+  receipts, and Plan receipts commit together. A productive Goal may continue beyond 20 turns and
+  exits automatically only after its completion audit passes.
+- **Crash-safe recovery.** Append-only runtime facts are authoritative. UI projection, Compact,
+  legacy-session cutover, and resume are digest-checked and fail closed on partial or conflicting
+  state.
+- **Stable interaction.** TUI, terminal, print, Plan, Goal, Compact, and subagents consume the same
+  versioned runtime protocol.
+
+The design borrows scoped resource lifecycle ideas from DeepSeek Harness and immutable execution
+contracts from Codex while keeping Orion's Goal/Evidence model at the center. Orion is **not** a
+plugin marketplace or arbitrary JavaScript plugin host; Model, Skills, and MCP remain the supported
+user extension boundaries.
+
+## Install
+
+Node.js 20, 22, and 24 are supported.
+
+Install the published `0.2.2` release:
 
 ```bash
-# After the registry receipt exists, install this exact prerelease version:
-npm install -g @orion-agents/orion-code@0.1.9
-# Install the current prerelease channel:
-npm install -g @orion-agents/orion-code@next
-
-# Or run from a checked-out source tree:
-npm ci
-npm run build
-npm start
-
-# Configure API key
-export ORION_CODE_API_KEY=your-api-key
-# or create ~/.orion-code/orion.json on first run
-
-# Start
-orion
-
-# TUI renderer (default)
-orion --ui tui
-
-# Technical terminal renderer for diagnostics and compatibility
-orion --ui terminal
-
-# Deprecated compatibility renderer; scheduled for removal in v0.2.0
-orion --ui ink
-
-# Diagnostics
+npm install -g @orion-agents/orion-code@0.2.2
+orion --version
 orion doctor
-
-# Workspace diff
-orion diff
-
-# Commit plan
-orion commit-plan
-
-# Experimental non-interactive print mode
-orion -p "review the current git diff"
-echo "summarize this project" | orion --print
 ```
 
-Before upgrading, read the [v0.1.8 → v0.1.9 migration guide](docs/migration/v0.1.8-to-v0.1.9.md).
-Release verification is tracked in the [v0.1.9 checklist](docs/plan/v0.1.9-release-checklist.md).
-
-> **Release status.** `0.1.9` is the current release candidate for the npm `next` channel. Stable
-> `latest` remains `0.1.4`; tag, GitHub Release, npm publish, and `latest` promotion are verified as
-> separate delivery actions.
-
-### TUI startup banner
-
-The default TUI uses the original Orion Pixel theme and a portable “little star hunter” mascot.
-Typed chrome keeps Goal, permission, model, context, queue, and active-work state visible without
-polluting code or tool output. It uses only safe terminal character cells: classic mode,
-`NO_COLOR`, and narrow terminals automatically fall back to compact text with no image protocol.
+To run from source:
 
 ```bash
-# Default portable pixel banner
-ORION_TUI_IMAGE=off orion
-
-# Opt into a PNG in compatible terminals
-ORION_TUI_IMAGE=auto orion
-ORION_TUI_IMAGE=kitty orion
-ORION_TUI_IMAGE=iterm2 orion
-
-# Override the bundled PNG
-ORION_TUI_ICON=/absolute/path/to/icon.png orion
+git clone https://github.com/orion-agents/orion-code.git
+cd orion-code
+npm install
+npm run build
+npm run start
 ```
 
-Apple Terminal does not support either inline image protocol. Capability detection
-therefore selects the pixel banner instead of emitting image data. Real macOS
-Terminal validation remains part of the release gate.
-
-## Key Features
+## Configure a model
 
-| Feature                | Description                                                                   |
-| ---------------------- | ----------------------------------------------------------------------------- |
-| **Tool Orchestration** | 29 built-in tools: file I/O, shell, web, memory, git, LSP, Goal, and planning |
-| **Multi-Model**        | Provider profiles, model switching, and explicit effort capabilities          |
-| **Context Awareness**  | Per-model context windows, token-based auto-compact                           |
-| **MCP Protocol**       | stdio MCP servers with heartbeat + reconnect                                  |
-| **Memory System**      | User / Project / Session memory with semantic search                          |
-| **Session Management** | Persistent sessions with history restore                                      |
-| **Persistent Goal**    | Typed multi-turn continuation, safe restart/resume, criterion evidence audit  |
-| **Safety Boundaries**  | Bash safety checks, audit logging, permission modes                           |
-| **Skills System**      | Builtin + user + project-level skill extensions                               |
-| **Multi-Agent**        | Subagent fork/worker-pool with smart routing                                  |
-| **CLI Utilities**      | `doctor`, `diff`, `commit-plan`, experimental `-p` print mode                 |
+Orion reads `~/.orion-code/orion.json`. Start from
+[`docs/orion.example.json`](docs/orion.example.json). Provider keys may be literal local values or
+environment references such as `$HUOSHAN_API_KEY`; never commit credentials.
 
-## Configuration
+Minimal OpenAI-compatible example:
 
 ```json
 {
+  "schemaVersion": 1,
   "providers": [
     {
       "id": "my-provider",
-      "baseUrl": "https://api.example.com/v1",
-      "apiKey": "$MY_API_KEY",
+      "displayName": "My Provider",
+      "baseUrl": "https://example.invalid/v1",
+      "apiKey": "$MY_PROVIDER_API_KEY",
       "protocol": "openai-completions"
     }
   ],
   "models": [
     {
       "id": "my-model",
+      "displayName": "My Model",
       "provider": "my-provider",
       "model": "model-name",
       "contextWindow": 200000,
-      "maxOutputTokens": 64000,
-      "reasoningCapability": {
-        "kind": "effort-level",
-        "supportedLevels": ["low", "medium", "high"],
-        "defaultLevel": "medium",
-        "adapter": "openai-chat-reasoning-effort",
-        "source": "config"
-      }
+      "maxOutputTokens": 8192
     }
   ],
   "defaultModel": "my-model",
-  "defaultEffort": "auto",
-  "toolConfirmation": "deny",
-  "subagents": { "mode": "auto", "maxParallel": 3 }
+  "toolConfirmation": "allow"
 }
 ```
 
-Configuration: `~/.orion-code/orion.json` | Priority: `CLI flags > config > env vars > defaults`
+Run `orion doctor` after configuration. Diagnostics never need to print the secret itself.
 
-`reasoningCapability` is an explicit provider contract, not a model-name guess. Only add it
-after the configured endpoint is known to accept the selected adapter and levels. A legacy
-`"reasoning": true` flag does not enable a wire parameter. With no explicit capability Orion
-keeps `/effort` unavailable and sends no reasoning-effort override. Project defaults can be set
-with `projects["<absolute path>"].defaultEffort`; session overrides are changed with `/effort`.
+## Use Orion
 
-The renderer is a runtime choice rather than a persisted setting: `orion` starts
-the TUI, while `--ui terminal` selects the technical renderer.
+```bash
+orion                         # default product TUI
+orion --ui terminal           # technical terminal fallback
+orion -p "explain this repo"  # experimental non-interactive mode
+orion -p --output-format json "run the focused tests"
+orion diff
+orion commit
+```
 
-### Interactive and scoped tool permissions (`allowedTools`)
+Experimental non-interactive print mode is available through `orion -p`; keep it out of
+interactive workflows that require confirmations or live steering.
 
-When a tool needs confirmation, the TUI, Ink UI, and technical Terminal renderer wait for one
-of four explicit decisions: allow once, always allow this tool in the current project, always
-allow it on this machine for every project, or deny. Persistent approvals are written before
-the waiting tool continues. A write failure denies the call.
+### BUILD, PLAN, AUTO
 
-Machine-wide rules live at root `allowedTools`; project rules live under
-`projects["<absolute path>"].allowedTools`. Both sets are evaluated, and the most restrictive
-matching effect wins (`deny` > `ask` > `allow`). Choosing project or machine scope is explicit
-durable consent for that tool, so a durable `allow` skips repeated prompts for external tools, file
-edits, and shell operations that are not hard-blocked by command safety policy. AUTO skips all
-interactive prompts and authorizes every invocation after hard tool-policy and explicit `deny`
-checks. PLAN exposes the same registry as BUILD and inherits the independently selected permission
-policy, including durable project or machine grants.
+Press `Shift+Tab` to cycle `BUILD → PLAN → AUTO`. The status bar and input border show the current
+mode. Mode controls workflow behavior; Authority, approval, containment, and sandbox policy remain
+independent.
 
-```json
-{
-  "allowedTools": ["allow:web_fetch"],
-  "projects": {
-    "/Users/me/work/api": {
-      "allowedTools": [
-        "exec_command(git status*)",
-        "exec_command(npm test*)",
-        "ask:exec_command(git push*)",
-        "deny:read_file(*.env)"
-      ]
-    }
-  }
-}
-```
+- **BUILD** is normal collaborative implementation.
+- **PLAN** explores with the same available tool universe, commits a decision-complete PlanReceipt,
+  exits automatically, restores BUILD/AUTO, and starts implementation in a separate logical turn.
+- **AUTO** removes interactive approval prompts within the configured Authority; hard policy and
+  sandbox boundaries still fail closed.
 
-- Grammar: `[allow|ask|deny:]tool[(subject glob)]`; `*` matches any run of characters,
-  `?` a single one, and `*` as the tool name matches every tool.
-- The subject is the call's `command` / `file_path` / `path` / `url` / `pattern` / `query`
-  argument, whichever comes first.
-- Conflicts resolve most-restrictive-first (`deny` > `ask` > `allow`), independent of order.
-- Interactive persistent choices add an exact tool rule such as `allow:exec_command`; edit
-  `~/.orion-code/orion.json` to audit or revoke a stored rule. `/permissions show` reports the
-  active machine-wide and project rule counts.
-- `allow` skips an interactive confirmation. It never overrides a tool's own `deny`, an explicit
-  allowlist `deny`, workspace containment, sandbox restrictions, or hard command safety policy.
-- Malformed entries are ignored and listed by `/config` rather than silently applied.
+Start a task-scoped plan with:
 
-### Shell execution sandbox (`sandbox`)
-
-`exec_command` can run inside an OS-level sandbox. This is a **security POC**: the
-backend is probed at runtime and a configured-but-unusable sandbox **fails closed**
-(refuses to run) rather than silently degrading to an unsandboxed execution.
-
-```json
-{
-  "sandbox": {
-    "profile": "none",
-    "backend": "auto",
-    "allowNetwork": false,
-    "writableRoots": [],
-    "image": "alpine:latest"
-  }
-}
+```text
+/plan refactor the storage boundary and verify crash recovery
 ```
 
-- **Ownership** — `sandbox` lives in the global config (`~/.orion-code/orion.json`)
-  and can be overridden per project under `projects["<path>"].sandbox`. Project
-  keys win individually; absent keys inherit the global value.
-- **`profile`** — `none` (default, no isolation, identical to the legacy `sh -c`),
-  `read-only` (no writes anywhere, no network), or `workspace-write` (writes
-  confined to the workspace + temp dirs, network still blocked unless
-  `allowNetwork: true`). An unknown value (e.g. written by a newer Orion) is a
-  hard failure, never a downgrade to `none`.
-- **`backend`** — `auto` (default, picks the first usable backend), `seatbelt`
-  (macOS `sandbox-exec`), `bubblewrap` (Linux `bwrap`), or `docker`. Each backend
-  is validated with a real execution probe; `which`-based guessing is never used.
-- **`image`** — required only for `docker`; names the container image to run in.
-- **`writableRoots`** — extra host roots the `workspace-write` profile may write
-  to (in addition to the cwd and temp). Non-string / empty entries are dropped.
-- **Migration / rollback** — adding the `sandbox` key is backward compatible: the
-  default `profile: "none"` reproduces the previous behaviour exactly. Removing the
-  key (or reverting to a pre-sandbox version) is a safe rollback; older Orion
-  simply ignores the unknown field. No secrets are stored, so no redaction is
-  required.
-- **Known limitations** — `seatbelt` cannot be nested inside another sandbox (e.g.
-  when Orion itself runs inside an app sandbox); `docker` runs the command in a
-  separate process tree and only constrains what is bind-mounted (the image rootfs
-  is made read-only via `--read-only`); none of the backends constrain CPU/memory.
-
-## Interactive Commands
-
-| Command                | Description                                                                 |
-| ---------------------- | --------------------------------------------------------------------------- |
-| `/help`                | Show help                                                                   |
-| `/goal`                | Create, inspect, pause, resume, replace, budget, or exit a persistent goal  |
-| `/plan [task]`         | Plan with normal tool access, save it, then restore the previous agent mode |
-| `/status`              | System status                                                               |
-| `/model`               | View or switch models                                                       |
-| `/effort`              | View or change supported reasoning effort                                   |
-| `/permissions`         | View or change tool confirmation and edit policy                            |
-| `/config`              | Show configuration                                                          |
-| `/usage`               | Token usage and cost                                                        |
-| `/compact [N] [focus]` | Trigger context compact with optional retained-message threshold and focus  |
-| `/session`             | List, inspect, or rename sessions                                           |
-| `/resume`              | Resume last session                                                         |
-| `/memory`              | Memory status, reference validation, and semantic reindexing                |
-| `/skills`              | List loaded skills                                                          |
-| `/mcp`                 | MCP server status                                                           |
-| `/doctor`              | Run diagnostics                                                             |
-| `/diff`                | Workspace diff                                                              |
-| `/commit-plan`         | Create a read-only commit plan                                              |
-| `/clear`               | Clear screen                                                                |
-| `/context clear --yes` | Clear in-memory model context; preserve the saved session                   |
-| `/exit`                | Exit                                                                        |
-
-Project-level compact guidance can be set in
-`projects["<absolute path>"].compactInstructions` in `~/.orion-code/orion.json`. It applies to
-manual and automatic compact, is bounded and redacted before model use, and cannot override tool
-protocol, safety constraints, acceptance criteria, evidence, failures, or pending work.
-
-Agent modes are TUI actions: use `Shift+Tab` to cycle `BUILD → PLAN → AUTO`; `/mode` and `/perm`
-are not registered commands. The remaining deprecated spellings keep their v0.3.0 compatibility
-window: `/target` → `/goal`, `/commit` → `/commit-plan`, `/sessions` → `/session list`,
-`/session-rename` → `/session rename`, `/context-clear` and `/clear-history` → `/context clear`,
-`/models` → `/model`, `/loop-stats` → `/usage loop`, `/checkpoint` → `/rewind`, `/cost` → `/usage`,
-`/agents` → `/subagents`, `/task` → `/goal`, and `/run` or `/chat` → plain text.
-
-TUI is the public product interface and the default launch path. `terminal-ui`
-is maintained as a technical diagnostics/compatibility renderer, not a second
-public product. Ink is deprecated, receives no new product features, and is
-scheduled for removal in v0.2.0.
-
-### Task-scoped Plan mode
-
-Use `/plan` to arm planning for the next message, `/plan <task>` to start immediately, or press
-`Shift+Tab` to cycle `BUILD → PLAN → AUTO → BUILD` while preserving the draft. Orion allows
-the complete tool registry in every Agent mode. PLAN never blocks a call solely because of the
-mode: writes, commands, and external tools use the current `/permissions` policy and reusable
-project/machine grants. Explicit denies, workspace containment, sandboxing, and hard safety rules
-remain enforced. When the plan is decision-complete, the model calls `exit_plan_mode` once;
-Orion saves it, exits Plan, and starts implementation in a separate logical request. Base modes are
-changed only with `Shift+Tab`; the retired `/mode` and `/perm` commands are not compatibility entry
-points. Auto runs without permission or clarification prompts, while hard safety policies and
-explicit user boundaries remain enforced.
-
-See [the Plan-mode lifecycle contract](docs/plan/plan-mode-contract.md).
-Authorization precedence, AUTO network behavior, and audit provenance are defined in the
-[Agent Mode and Tool Permission Contract](docs/architecture/agent-mode-permission-contract.md).
-
-### Persistent Goal safety contract
-
-`/goal <objective>` creates one active Goal for the current session. Automatic
-continuations are typed runtime requests: they are not echoed or stored as fake
-user messages. After a process restart or `/resume`, an active Goal is restored
-in a visible paused state; run `/target resume` to continue deliberately.
-
-The model may request `complete` or `blocked`, but cannot set either terminal
-state directly. Orion records runtime/tool evidence and audits every success
-criterion. Missing, failed, unmapped, wrong-kind, expired, or stale evidence keeps the
-Goal open. Criteria that require human acceptance can only receive trusted
-`user` evidence from `/goal confirm <criterion-id>`; model tools cannot mint
-that confirmation. v0.1.2 remains single-session and single-active-Goal; it does not
-promise multi-Goal scheduling or unattended background execution.
-
-After a completion audit passes, Orion automatically clears the session's active Goal binding,
-returns the TUI to its current BUILD/PLAN/AUTO base mode, and retains the terminal Goal sidecar as
-the durable completion receipt. A trailing lifecycle clause such as `测试一轮，然后退出目标模式`
-is separated from the auditable work: Orion verifies `测试一轮`, then performs the same runtime-owned
-automatic exit after the audit passes. It is not treated as an impossible success criterion. Use
-`/goal exit` to abandon before completion: it aborts the active
-turn, rejects pending permission requests, and removes the persisted Goal. Explicit natural-language
-requests such as `exit goal mode` or `退出 goal 模式` route through the same deterministic runtime
-boundary. Session binding and Goal-sidecar cleanup fail closed as one lifecycle operation; Orion
-never reports a successful exit after only one persisted object changed. Rejected completion requests
-cannot be retried in the same turn until new runtime evidence exists, and autonomous continuation
-turns have stricter model/tool budgets than fresh user turns. Two consecutive blocked autonomous
-continuations pause for review instead of spending the full continuation window. The old `/goal clear --yes` and
-`/target clear --yes` syntax is intentionally unsupported in v0.1.6.
-
-## Migration from OpenHorse
+There is no `exit_plan_mode` tool and no `/mode` command.
 
-```bash
-# Preview only (default)
-orion migrate openhorse [--include-env]
+### Durable Goal mode
 
-# Execute after reviewing the preview
-orion migrate openhorse --yes [--include-env]
+```text
+/goal fix the open issues, run the release gates, and stop only when evidence is complete
+/goal status
+/goal pause
+/goal resume
+/goal clear
 ```
 
-See the [v0.1.2 release notes](https://github.com/orion-agents/orion-code/blob/main/docs/mvp/v0.1.2.md),
-[Goal evidence and recovery guide](https://github.com/orion-agents/orion-code/blob/main/docs/goals/goal-evidence-and-recovery.md),
-and [execution plan](https://github.com/orion-agents/orion-code/blob/main/docs/archive/releases/v0.1.x/v0.1.2-execution-plan.md).
+`/goal <objective>` creates the Goal. Progressing Goals continue without a fixed turn-count stop;
+resource budgets, no-progress, blockers, provider failures, persistence failures, and user
+interrupts remain explicit stop decisions. A passed evidence audit commits completion and exits
+Goal automatically.
 
-## Research-to-Evidence (v0.1.4, experimental)
+`/target`, `/goal exit`, `edit`, `replace`, `confirm`, `budget`, and `clear --yes` were removed in the
+v0.2.0 breaking cut.
 
-> **Status: experimental.** Turns the read-only `research` subagent output into a **traceable, recoverable** research→evidence loop.
+### Useful commands
 
-Hard guarantees (any violation is a No-Go; never published):
+- `/help`, `/status`, `/doctor`, `/harness explain`
+- `/tools`, `/skills`, `/skill <name>`, `/mcp`
+- `/context`, `/memory`, `/usage`, `/trace`, `/last-tool`
+- `/model`, `/effort`, `/permissions`, `/config`
+- `/compact`, `/resume`, `/session`
+- `/diff`, `/commit-plan`, `/review`, `/research`, `/security`, `/test-gen`
 
-- **Only specialized WebSearch / WebFetch** — no generic MCP, no write/exec grant.
-- **SSRF / DNS-rebind / redirect / body-size / timeout** re-use the existing guards: a lexical SSRF pre-check at selection, and the full per-hop guard set delegated to the real WebFetch tool.
-- A **claim must bind a source** to reach `observed`; a claim with no independent verification stays `partial`/`unmet` and is never counted as verified/complete.
-- A **security-gate failure becomes `blocked`/`failed` with a structured reason** — never faked as a hit; provider fallback only swaps the provider, never downgrades a source status or writes a failure as a success.
-- Research evidence (web) and execution-verification evidence (file / test / build / file facts) are **kept distinct**; a web summary cannot stand in for execution verification.
-- Packet + source metadata are saved **atomically with a CAS token**; project / session / Goal scope isolation; resume only derives state and never replays external side effects; old schema versions fail closed.
+Use `/help` in the installed build as the authoritative command inventory.
 
-Modules: `src/runtime/subagents/{research-types,research-contract,research-citation,web-research-adapter,research-renderer,research-artifact,research-quality}.ts`.
+## Runtime guarantees
 
-> Real-terminal (PTY) and external-state evidence are marked `not_run` in CI; local tests are not treated as release completion.
+- At most one active turn per Thread; steer, follow-up, interrupt, overload, and maintenance have
+  typed admission outcomes.
+- Every started tool Item reaches exactly one durable terminal outcome. Nested batch calls retain
+  parent/child invocation lineage and re-enter ToolGateway.
+- A slow renderer may coalesce ephemeral deltas, but durable events are replayable and never silently
+  dropped.
+- Compact commits only after source-history, TaskContext, projection, and pointer CAS checks.
+- Legacy v0.1.9 sessions are materialized side by side; the active index switches only after event
+  replay and projection digests verify.
+- Public exports expose the product runtime/protocol and Model/Skill/MCP configuration boundaries,
+  not internal service locators or a plugin SDK.
 
-## Development
+## Develop and verify
 
 ```bash
-npm install      # Install dependencies
-npm run build    # Build
-npm test         # Run the full Jest suite
-npm run lint     # Lint
-npm run format   # Format
+npm run lint
+npm run build
+npm test -- --runInBand
+npm run test:coverage -- --runInBand
+npm run test:harness-confluence
+npm run bench:harness:baseline
+npm run bench:harness
+npm run bench:harness:compare -- <baseline.json> <candidate.json>
+npm run prepublishOnly
 ```
 
+Release qualification additionally builds one exact tarball and installs that unchanged hash on
+Node 20/22/24 for package identity, native SQLite, TUI, terminal, print, Goal, subagent, Skill, MCP,
+Compact, and resume journeys. See the
+[`v0.2.0 release checklist`](docs/plan/v0.2.0-release-checklist.md).
+
+## Security
+
+Do not commit `.env`, `~/.orion-code`, local databases, or credentials. File access is contained to
+the project boundary, symlink/non-regular path escapes fail closed, and all side effects pass the
+same Authority/Policy/Approval/Sandbox chain. Report vulnerabilities privately when disclosure
+could put users at risk.
+
 ## License
 
-MIT License — see [LICENSE](LICENSE) for details.
+MIT — see [LICENSE](LICENSE).