@sunerpy/kiro-provider 0.5.0-rc.3 → 0.5.0-rc.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +113 -70
  2. package/dist/cli.js +150 -83
  3. package/package.json +1 -1
package/README.md CHANGED
@@ -31,17 +31,18 @@
31
31
  - OpenAI Responses `POST /v1/responses` and Anthropic Messages `POST /v1/messages` (both streaming and non-streaming), plus `POST /v1/messages/count_tokens`, `GET /v1/models`, `GET /health`, and authenticated `GET /ready`.
32
32
  - Legacy OpenAI Chat Completions is available at `POST /v1/chat/completions`, but is disabled by default and must be explicitly enabled with `enable_legacy_chat_completions`.
33
33
  - Bearer API-key gate that fails closed: the server refuses to start with no configured keys, and defaults to binding `127.0.0.1`.
34
- - Live OpenCode authentication reuse by default: `auth_source: "opencode-shared"` reads the same `~/.config/opencode/kiro.db`, honors tombstones, updates shared health/usage, and uses the account schema and refresh-lock behavior of `opencode-kiro-auth` v0.20.7.
35
- - Explicit-only session affinity by default: Responses requests can opt in through standard `metadata`, compatibility `client_metadata`, or `prompt_cache_key`; requests without an explicit key never derive identity from prompt text. A matching Zuno native OpenAI transport supplies `metadata.zuno_session_id` automatically.
36
- - Account-scoped scheduling and cached SDK/transport objects: unrelated accounts can run concurrently, while one account is protected from overlapping Kiro streams; access-token refresh updates the cached client instead of rebuilding it. Kiro model-call HTTP keep-alive is disabled by default and is an explicit transport opt-in.
34
+ - Provider-owned authentication by default: `auth_source: "local"` stores credentials in `~/.config/kiro-provider/accounts.db`. Existing `opencode-kiro-auth` accounts can be imported once with `kiro-provider accounts import`; after that, kiro-provider refreshes access tokens, usage, quota recovery, and account health without reading or locking OpenCode's database.
35
+ - Explicit-only session affinity by default: Responses requests can opt in through standard `metadata`, compatibility `client_metadata`, or `prompt_cache_key`; standard clients that resend complete history can also continue through the exact prior assistant-output lineage. User prompts are never fingerprinted to guess a session. A matching Zuno native OpenAI transport supplies `metadata.zuno_session_id` automatically.
36
+ - Account-scoped scheduling and cached SDK/transport objects: unrelated accounts can run concurrently, while one account is protected from overlapping Kiro streams. Access-token rotation rebuilds the credential-bound SDK client while retaining the account transport. A production-default service lock prevents multiple processes from silently splitting those queues and pools. Kiro model-call HTTP keep-alive is disabled by default and is an explicit transport opt-in.
37
+ - Live per-account model discovery and account-aware routing through Kiro management, with bounded stale/static fallback. Production calls use the live-probe-confirmed `runtime.<region>.kiro.dev` dialect. Token-usage metadata is an immediate completion witness; the current runtime's valid terminal metering event is accepted only when followed by clean EOF.
37
38
  - Zero provider-owned prompt injection in the default `safe` mode: a canonical
38
39
  input IR preserves client text, roles, content-block boundaries, tool
39
40
  identity, ordering, and source paths; Kiro output is normalized into a
40
41
  separate canonical completion/event IR before protocol-specific encoding.
41
42
  - Encrypted reasoning replay for complete native Kiro envelopes: opaque `kr1_...` tokens, AES-256-GCM storage, tenant/model/account/conversation/output binding, TTL/LRU cleanup, and account-locked replay.
42
- - Multi-account rotation with automatic token refresh and failover. Shared mode treats OpenCode's database as the authentication authority; the provider database stores session affinity only.
43
- - An explicit `auth_source: "local"` compatibility mode retains `kiro-provider login` and `accounts import`; imported accounts are snapshots and must not be confused with live shared authentication.
44
- - A single global `proxy_url` that, when set, routes all upstream egress (model requests, token refresh, device-code login) through one HTTP(S) proxy.
43
+ - Multi-account rotation with automatic token refresh and failover. Exhausted accounts are hard-excluded from model attempts, then automatically rejoin only after a bounded, deduplicated Kiro usage probe confirms a new quota window. A provider-owned maintenance loop also refreshes near-expiry tokens and stale usage while the service is idle.
44
+ - `kiro-provider login` and `accounts import` write directly to the provider-owned local authentication store. `auth_source: "opencode-shared"` remains an explicit compatibility option, but it is not the production default and is not required after import.
45
+ - A single global `proxy_url` that, when set, routes all upstream egress (model requests, token refresh, quota probes, device-code login) through one HTTP(S) proxy.
45
46
  - Ships as a self-contained compiled binary via `bun build --compile` — no runtime install required on the target machine.
46
47
 
47
48
  ## Protocol compatibility
@@ -56,12 +57,14 @@ Key boundaries:
56
57
 
57
58
  - plain text, consecutive same-role turns, function/custom tool declarations,
58
59
  calls, and results retain their original structure and order;
59
- - a message containing multiple top-level text blocks returns
60
- `unsupported_content_block_projection`, because Kiro exposes only one text
61
- field and concatenation would erase block boundaries;
60
+ - plain-text-only top-level blocks remain distinct in the canonical request,
61
+ then are concatenated byte-for-byte with no inserted separator at Kiro's
62
+ single-text-field boundary; multiple text blocks interleaved with images or
63
+ tool content still return `unsupported_content_block_projection`;
62
64
  - `instructions`, `system`, and `developer` return
63
- `unsupported_instruction_projection` in safe mode because the tested Kiro
64
- `additionalContext` channel was rejected;
65
+ `unsupported_instruction_projection` in safe mode because Kiro accepted a
66
+ valid `additionalContext` shape but did not preserve its instruction content
67
+ or priority in live GPT and Claude probes;
65
68
  - `tool_choice: auto` is supported; `parallel_tool_calls: false` is accepted as
66
69
  a no-op only when no callable tool can run (including `tool_choice: none`),
67
70
  and otherwise returns `unsupported_parallel_tool_calls`; required/named
@@ -69,23 +72,35 @@ Key boundaries:
69
72
  rather than weakened;
70
73
  - base64/data-URL images are supported, while remote image URLs and detail
71
74
  controls are rejected;
75
+ - Responses `input_file` supports inline base64/data-URL documents in Kiro's
76
+ native document formats. The original filename remains in the canonical
77
+ request; its recognized extension becomes the separate Kiro `format`, while
78
+ the extensionless ASCII name is validated before the SDK call. Names that
79
+ would require lossy rewriting return `invalid_file_name`; `file_id`
80
+ references are rejected because the provider has no OpenAI file store;
72
81
  - an output-token limit is probe-confirmed for `claude-sonnet-5` and
73
82
  `claude-opus-5` variants in the range 1,024–128,000;
83
+ - Responses omits only the exact `...`/`…` reasoning placeholder emitted by
84
+ GPT 5.6 Sol; Opus reasoning, non-placeholder Sol reasoning, effort mapping,
85
+ and encrypted reasoning replay remain unchanged;
74
86
  - stateful Responses fields and native Web Search remain unsupported, and the
75
87
  provider never fabricates search/citation events.
76
88
 
77
- Current compiled-binary acceptance on 2026-08-27: RC.3 exposes
78
- `claude-opus-5` plus `low/medium/high/xhigh/max`, with a 1,000,000-token
79
- context window and a probe-confirmed 1,024–128,000 native output limit. OpenAI
80
- JavaScript SDK 7.5.0 passes Opus 5 Responses streaming/non-streaming, explicit
81
- Chat, function tools, and direct Anthropic Messages JSON/SSE. OpenCode 1.18.18
82
- passes a real Opus 5 Max bash/read tool loop in explicit
83
- `legacy-user-prefix` mode while reusing one account and Kiro conversation.
84
- Codex 0.150.0-alpha.9 now passes model validation but remains blocked before
85
- Kiro by `reasoning.summary`; Claude Code 2.1.209 likewise passes Opus 5 model
86
- validation but remains blocked by `context_management`. Zuno was intentionally
87
- not changed or rerun. These are RC findings; stable v0.5.0 remains gated
88
- rather than silently discarding unsupported fields.
89
+ Current compiled-binary RC.4 acceptance on 2026-08-29 retains the RC.3
90
+ protocol matrix and adds provider-owned authentication lifecycle validation.
91
+ Starting from a one-time import, an isolated local store deliberately used an
92
+ expired access token, stale usage, and a nonexistent OpenCode database path.
93
+ The compiled service independently refreshed the token and usage, then OpenAI
94
+ JavaScript SDK 7.5.0 completed two standard Responses turns and OpenCode
95
+ 1.18.18 completed a real bash/write/read tool loop. No live shared database or
96
+ cross-process lock was used. OpenCode still requires explicit
97
+ `legacy-user-prefix` because it sends developer instructions that Kiro cannot
98
+ project losslessly. The known RC.3 protocol blockers are unchanged: Codex is
99
+ blocked before Kiro by `reasoning.summary`, Claude Code 2.1.209 by
100
+ `context_management`, and OpenCode Chat by the client's nonstandard
101
+ `messages.0.cache_control`. Zuno was intentionally not changed or rerun.
102
+ These are RC findings; stable v0.5.0 remains gated rather than silently
103
+ discarding unsupported fields.
89
104
 
90
105
  For the complete capability matrix, error codes, reasoning replay contract,
91
106
  and v0.4 migration steps, see
@@ -151,31 +166,35 @@ In the rest of this README, `./dist/kiro-provider` refers to any of the above; s
151
166
 
152
167
  ## Quickstart
153
168
 
154
- 1. **Authenticate Kiro through OpenCode.** The default shared-auth mode uses
155
- OpenCode's live account database:
169
+ 1. **Create a config with your own API key.**
156
170
 
157
171
  ```bash
158
- opencode auth login
172
+ mkdir -p "${XDG_CONFIG_HOME:-$HOME/.config}/kiro-provider"
173
+ cp config.example.json "${XDG_CONFIG_HOME:-$HOME/.config}/kiro-provider/config.json"
174
+ # edit config.json and replace "sk-REPLACE-ME" with a private, random key
159
175
  ```
160
176
 
161
- Select Kiro and complete the normal login flow. If you intentionally want
162
- an independent compatibility store instead, set `"auth_source": "local"`
163
- and then use:
177
+ The example already uses the production default, `"auth_source": "local"`.
178
+
179
+ 2. **Populate the provider-owned authentication store.** If you previously
180
+ authenticated through OpenCode plus `opencode-kiro-auth`, import that
181
+ database once:
164
182
 
165
183
  ```bash
166
- ./dist/kiro-provider login
167
- # or take a one-time snapshot:
168
184
  ./dist/kiro-provider accounts import
169
185
  ```
170
186
 
171
- 2. **Create a config with your own API key.**
187
+ The default source is `~/.config/opencode/kiro.db`; use `--from <path>` when
188
+ needed. This is a copy, not a live link: subsequent token and usage refreshes
189
+ are owned by kiro-provider. Alternatively, authenticate directly:
172
190
 
173
191
  ```bash
174
- mkdir -p "${XDG_CONFIG_HOME:-$HOME/.config}/kiro-provider"
175
- cp config.example.json "${XDG_CONFIG_HOME:-$HOME/.config}/kiro-provider/config.json"
176
- # edit config.json and replace "sk-REPLACE-ME" with a private, random key
192
+ ./dist/kiro-provider login
177
193
  ```
178
194
 
195
+ Avoid continuing to use the same imported refresh tokens from two
196
+ independently running authentication owners.
197
+
179
198
  3. **Start the gateway.**
180
199
 
181
200
  ```bash
@@ -235,10 +254,13 @@ Do not start a new provider for every agent or conversation. Keeping one
235
254
  process alive lets requests with an explicit affinity key reuse their
236
255
  persisted account/Kiro-conversation binding, while all requests can reuse
237
256
  process-local, account-scoped SDK clients and transport objects. A request
238
- without an explicit key gets a fresh Kiro conversation. Kiro model-call HTTP
239
- sockets are fresh by default (`sdk_http_keep_alive: false`); enabling it is a
240
- best-effort transport optimization, never a promise that one session owns one
241
- physical TCP connection.
257
+ without an explicit key starts a fresh Kiro conversation on its first turn,
258
+ then can recover the same binding from exact assistant-output history on later
259
+ turns. Kiro model-call HTTP sockets are fresh by default
260
+ (`sdk_http_keep_alive: false`); enabling it is a best-effort transport
261
+ optimization, never a promise that one session owns one physical TCP
262
+ connection. The default `enforce_single_instance: true` also prevents a second
263
+ service process from splitting the in-memory queues and pools.
242
264
 
243
265
  Use a pinned standalone binary for a service rather than fetching through
244
266
  `bunx` on every start. The examples below assume the release installers'
@@ -249,13 +271,12 @@ defaults:
249
271
  - config: `~/.config/kiro-provider/config.json`;
250
272
  - service/task name: `kiro-provider`.
251
273
 
252
- Run the service as the **same OS user** that ran `opencode auth login`.
253
- Default `auth_source: "opencode-shared"` resolves that user's OpenCode
254
- database and home/XDG directories; running as `root`, `LocalSystem`, or
255
- another user will normally select different credentials. Use absolute paths,
256
- keep the API key in the protected config file rather than service arguments,
257
- and set `opencode_auth_db_path` explicitly if the service has a different XDG
258
- environment.
274
+ Run the one-time import and the service as the **same OS user** so the service
275
+ owns the same `~/.config/kiro-provider/accounts.db`, config, keyring, and
276
+ instance lock. Running as `root`, `LocalSystem`, or another user normally
277
+ selects a different local store. Use absolute paths and keep the API key in
278
+ the protected config file rather than service arguments. The OpenCode
279
+ database is not read again after the import.
259
280
 
260
281
  ### Linux: systemd user service
261
282
 
@@ -327,9 +348,9 @@ Service Control Manager executable. Do not register it directly with
327
348
  [Scheduled Task](https://learn.microsoft.com/powershell/module/scheduledtasks/register-scheduledtask)
328
349
  that starts at sign-in, runs as the current user, and restarts after failure.
329
350
 
330
- Run the following in PowerShell as the same user that owns the OpenCode
331
- credentials. It creates a small launcher so stdout/stderr are retained under
332
- `%LOCALAPPDATA%\kiro-provider`:
351
+ Run the following in PowerShell as the same user that owns the provider's
352
+ local authentication database and config. It creates a small launcher so
353
+ stdout/stderr are retained under `%LOCALAPPDATA%\kiro-provider`:
333
354
 
334
355
  ```powershell
335
356
  $Binary = Join-Path $HOME ".local\bin\kiro-provider.exe"
@@ -412,10 +433,10 @@ Remove-Item "$HOME\.config\kiro-provider\service.ps1"
412
433
  ```
413
434
 
414
435
  This task intentionally runs only in the current user's interactive session,
415
- so it can use that user's network access and OpenCode credentials without
416
- storing a Windows password. A true pre-login Windows service requires a
417
- service wrapper and a deliberately configured user account; do not run it as
418
- `LocalSystem` and expect the same OpenCode database.
436
+ so it can use that user's network access, provider database, and keyring
437
+ without storing a Windows password. A true pre-login Windows service requires
438
+ a service wrapper and a deliberately configured user account; do not run it
439
+ as `LocalSystem` and expect the same provider-owned files.
419
440
 
420
441
  ### Health checks and automation contract
421
442
 
@@ -462,12 +483,27 @@ Config is loaded from `~/.config/kiro-provider/config.json` (or `$XDG_CONFIG_HOM
462
483
  | `enable_legacy_chat_completions` | `false` | `KIRO_PROVIDER_ENABLE_LEGACY_CHAT_COMPLETIONS` |
463
484
  | `protocol_projection_mode` | `safe` | `KIRO_PROVIDER_PROTOCOL_PROJECTION_MODE` |
464
485
  | `session_affinity_mode` | `explicit-only` | `KIRO_PROVIDER_SESSION_AFFINITY_MODE` |
465
- | `auth_source` | `opencode-shared` | `KIRO_PROVIDER_AUTH_SOURCE` |
486
+ | `auth_source` | `local` | `KIRO_PROVIDER_AUTH_SOURCE` |
466
487
  | `opencode_auth_db_path` | `null` (uses the OpenCode default) | `KIRO_PROVIDER_OPENCODE_AUTH_DB_PATH` |
467
488
  | `proxy_url` | `null` | `KIRO_PROVIDER_PROXY_URL` |
468
489
  | `default_region` | `us-east-1` | `KIRO_PROVIDER_DEFAULT_REGION` |
469
490
  | `sdk_http_keep_alive` | `false` | `KIRO_PROVIDER_SDK_HTTP_KEEP_ALIVE` |
491
+ | `enforce_single_instance` | `true` | `KIRO_PROVIDER_ENFORCE_SINGLE_INSTANCE` |
492
+ | `instance_lock_path` | platform config directory | `KIRO_PROVIDER_INSTANCE_LOCK_PATH` |
493
+ | `runtime_endpoint_mode` | `kiro-runtime` | `KIRO_PROVIDER_RUNTIME_ENDPOINT_MODE` |
494
+ | `dynamic_model_catalog` | `true` | `KIRO_PROVIDER_DYNAMIC_MODEL_CATALOG` |
495
+ | `model_catalog_ttl_ms` | `900000` | `KIRO_PROVIDER_MODEL_CATALOG_TTL_MS` |
496
+ | `model_catalog_stale_ttl_ms` | `86400000` | `KIRO_PROVIDER_MODEL_CATALOG_STALE_TTL_MS` |
497
+ | `model_catalog_request_timeout_ms` | `10000` | `KIRO_PROVIDER_MODEL_CATALOG_REQUEST_TIMEOUT_MS` |
470
498
  | `account_selection_strategy` | `lowest-usage` | `KIRO_PROVIDER_ACCOUNT_SELECTION_STRATEGY` |
499
+ | `quota_recheck_interval_ms` | `900000` | `KIRO_PROVIDER_QUOTA_RECHECK_INTERVAL_MS` |
500
+ | `quota_recheck_timeout_ms` | `10000` | `KIRO_PROVIDER_QUOTA_RECHECK_TIMEOUT_MS` |
501
+ | `quota_recheck_concurrency` | `4` | `KIRO_PROVIDER_QUOTA_RECHECK_CONCURRENCY` |
502
+ | `account_maintenance_enabled` | `true` | `KIRO_PROVIDER_ACCOUNT_MAINTENANCE_ENABLED` |
503
+ | `account_maintenance_interval_ms` | `60000` | `KIRO_PROVIDER_ACCOUNT_MAINTENANCE_INTERVAL_MS` |
504
+ | `account_maintenance_timeout_ms` | `120000` | `KIRO_PROVIDER_ACCOUNT_MAINTENANCE_TIMEOUT_MS` |
505
+ | `account_maintenance_concurrency` | `4` | `KIRO_PROVIDER_ACCOUNT_MAINTENANCE_CONCURRENCY` |
506
+ | `usage_refresh_interval_ms` | `900000` | `KIRO_PROVIDER_USAGE_REFRESH_INTERVAL_MS` |
471
507
  | `session_affinity_ttl_ms` | `86400000` | `KIRO_PROVIDER_SESSION_AFFINITY_TTL_MS` |
472
508
  | `session_affinity_max_entries` | `10000` | `KIRO_PROVIDER_SESSION_AFFINITY_MAX_ENTRIES` |
473
509
  | `reasoning_replay_key_path` | auto-generated config path | `KIRO_PROVIDER_REASONING_REPLAY_KEY_PATH` |
@@ -480,14 +516,15 @@ The full field reference, including retry/timeout tuning and the test-only `test
480
516
 
481
517
  ## Proxy
482
518
 
483
- Some networks reach one model family directly while another needs a proxy (for example, GPT direct, Claude via an approved egress). Set `proxy_url` (config file, `KIRO_PROVIDER_PROXY_URL`, or `serve --proxy`) to route **all** upstream traffic — model calls, token refresh, and device-code login — through a single HTTP(S) proxy. Leave it `null` for direct connections. See [`docs/CONFIGURATION.md`](docs/CONFIGURATION.md#proxy) for precedence details and examples.
519
+ Some networks reach one model family directly while another needs a proxy (for example, GPT direct, Claude via an approved egress). Set `proxy_url` (config file, `KIRO_PROVIDER_PROXY_URL`, or `serve --proxy`) to route **all** upstream traffic — model calls, token refresh, quota probes, and device-code login — through a single HTTP(S) proxy. Leave it `null` for direct connections. See [`docs/CONFIGURATION.md`](docs/CONFIGURATION.md#proxy) for precedence details and examples.
484
520
 
485
521
  ## Security
486
522
 
487
523
  - **Fail-closed authentication.** The server will not start without at least one non-empty `api_keys` entry. OpenAI routes require `Authorization: Bearer <key>`; Anthropic routes also accept `x-api-key: <key>`.
488
524
  - **Local bind by default.** `host` defaults to `127.0.0.1`; only bind `0.0.0.0` behind a firewall or authenticated reverse proxy.
489
- - **Single authentication authority.** Shared mode reads and updates OpenCode's existing Kiro database and fails closed on an incompatible schema; it never runs provider-owned migrations against that database.
490
- - **Locked-down provider state.** `accounts.db` (and its WAL/SHM files) are created with mode `0600`; in shared mode this database contains affinity/state, not the authoritative credentials.
525
+ - **Single authentication authority.** The default local mode makes kiro-provider the sole owner after one-time import. Do not keep two independent processes rotating the same imported refresh token. The explicit shared compatibility mode validates OpenCode's schema and never migrates it.
526
+ - **Single service owner by default.** The compiled service acquires a platform-config lock before listening, so process-local account/session queues and SDK pools cannot be split accidentally.
527
+ - **Locked-down provider state.** `accounts.db` (and its WAL/SHM files) are created with mode `0600`; in default local mode it contains credentials, usage, health, session affinity, and encrypted replay state.
491
528
  - **Authenticated reasoning replay.** The database stores token/fingerprint hashes and AES-256-GCM ciphertext, not raw `kr1_...` tokens. Missing active decryption keys fail startup.
492
529
  - **No sensitive content in logs.** Gateway/account secrets, replay tokens, signatures, reasoning, and request prompt text are not logged; structured audit fields contain hashes and field names only. Don't commit a real config file, account database, keyring, or gateway key.
493
530
 
@@ -514,9 +551,11 @@ to guess a conversation. Responses checks, in order,
514
551
  `client_metadata.thread_id|session_id|conversation_id`, and
515
552
  `prompt_cache_key`. Chat checks only `prompt_cache_key`; Anthropic Messages
516
553
  has no verified explicit affinity field. With no key, the request gets a
517
- fresh Kiro conversation but can still reuse account-scoped SDK clients and
518
- transport objects. The Kiro SDK's direct/proxy agents use fresh sockets by default;
519
- set `sdk_http_keep_alive: true` only when the deployment has validated pooled
554
+ fresh Kiro conversation on its first turn; a later full-history request can
555
+ reuse the same account/conversation by matching the exact prior assistant
556
+ output lineage. It can also reuse account-scoped SDK clients and transport
557
+ objects. The Kiro SDK's direct/proxy agents use fresh sockets by default; set
558
+ `sdk_http_keep_alive: true` only when the deployment has validated pooled
520
559
  socket behavior.
521
560
  The temporary `legacy-initial-input` mode restores only the old affinity
522
561
  heuristics and logs a startup warning; it does not alter request content.
@@ -529,10 +568,10 @@ resend the complete input.
529
568
  <summary>Agent command reference</summary>
530
569
 
531
570
  - `kiro-provider serve [--config <path>] [--host <host>] [--port <port>] [--proxy <url>]` — start the gateway.
532
- - `kiro-provider login [--config <path>] [--start-url <url>] [--region <region>]` — local compatibility mode only; shared mode directs you to `opencode auth login`.
533
- - `kiro-provider accounts list` — list accounts in the local compatibility store.
534
- - `kiro-provider accounts import [--from <path>] [--config <path>]` — take a one-time snapshot into the local compatibility store.
535
- - `kiro-provider accounts remove <id|email>` — remove one account from the local compatibility store.
571
+ - `kiro-provider login [--config <path>] [--start-url <url>] [--region <region>]` — authenticate directly into the provider-owned local store.
572
+ - `kiro-provider accounts list` — list accounts in the provider-owned local store.
573
+ - `kiro-provider accounts import [--from <path>] [--config <path>]` — copy authenticated OpenCode Kiro accounts once into the provider-owned local store; no live database link remains.
574
+ - `kiro-provider accounts remove <id|email>` — remove one account from the provider-owned local store.
536
575
 
537
576
  Contract: human-readable status lines go to stdout, errors to stderr, non-zero exit on failure. `GET /v1/models`, `GET /health`, and authenticated `GET /ready` return structured JSON.
538
577
 
@@ -593,8 +632,9 @@ Keep `surface: "responses"` for this integration. Selecting `chat` requires
593
632
  the separately enabled legacy endpoint and does not carry the Zuno Responses
594
633
  session metadata.
595
634
 
596
- Current Zuno sends agent instructions, while the live Kiro
597
- `additionalContext` probe did not prove a lossless instruction projection.
635
+ Current Zuno sends agent instructions. Valid required-label
636
+ `additionalContext` requests reached Kiro in live GPT and Claude probes, but
637
+ the models did not receive the instruction content or preserve its priority.
598
638
  Consequently the verified functional path currently requires the provider's
599
639
  explicit `protocol_projection_mode: "legacy-user-prefix"`; `safe` correctly
600
640
  returns `unsupported_instruction_projection` and never rewrites the request.
@@ -605,7 +645,8 @@ exception scheduled for removal in v0.7.0.
605
645
 
606
646
  ## Use with Codex CLI
607
647
 
608
- Codex uses the correct Responses endpoint. The compiled RC.3 gate with Codex
648
+ Codex uses the correct Responses endpoint. The last compiled protocol gate
649
+ with Codex
609
650
  0.150.0-alpha.9 and `claude-opus-5-max` now passes provider model validation,
610
651
  but its first request is rejected before Kiro at `reasoning.summary`, which
611
652
  has no proven native equivalent. The provider does not strip that field or
@@ -631,7 +672,7 @@ EOF
631
672
  codex exec --skip-git-repo-check "say hi"
632
673
  ```
633
674
 
634
- For Codex 0.150.0-alpha.9 the expected RC.3 result is a non-zero exit with
675
+ For Codex 0.150.0-alpha.9 the expected result is a non-zero exit with
635
676
  `unsupported_reasoning_summary` at `reasoning.summary`. A future supported request shape must
636
677
  then pass a real shell/custom-tool loop, continuation, and restart reasoning
637
678
  replay before Codex is marked supported. Full details live in
@@ -639,7 +680,7 @@ replay before Codex is marked supported. Full details live in
639
680
 
640
681
  ## Use with Claude Code
641
682
 
642
- Claude Code uses Anthropic Messages. The compiled RC.3 run with Claude Code
683
+ Claude Code uses Anthropic Messages. The last compiled protocol run with Claude Code
643
684
  2.1.209, `claude-opus-5`, and max effort passes provider model validation but
644
685
  is rejected before Kiro at `context_management`, which has no proven native
645
686
  equivalent. The provider does not discard it. Direct Opus 5 Messages JSON/SSE
@@ -658,7 +699,9 @@ subset support typed JSON/SSE and tools, while `/v1/messages/count_tokens` is
658
699
  an explicit estimate. See
659
700
  [`docs/CLAUDE_CODE.md`](docs/CLAUDE_CODE.md).
660
701
 
661
- The current compiled-service validation record is in
702
+ The current local-auth lifecycle validation record is in
703
+ [`docs/audits/kiro-provider-v0.5.0-rc.4-local-auth-maintenance-validation-2026-08-29.md`](docs/audits/kiro-provider-v0.5.0-rc.4-local-auth-maintenance-validation-2026-08-29.md).
704
+ The preceding protocol/client matrix is retained in
662
705
  [`docs/audits/kiro-provider-v0.5.0-rc.3-opus5-validation-2026-08-27.md`](docs/audits/kiro-provider-v0.5.0-rc.3-opus5-validation-2026-08-27.md).
663
706
  The older [`docs/E2E_VALIDATION_2026-08-22.md`](docs/E2E_VALIDATION_2026-08-22.md)
664
707
  is retained as historical v0.4 evidence only.