@timurproko/a1 0.1.0 → 0.1.1-dev.2

package/dist/src/foundation/transparent-terminal/main.d.ts

@@ -3,8 +3,7 @@ export interface TransparentForegroundOptions {
     readonly environment?: NodeJS.ProcessEnv;
     readonly profileId?: LaunchProfileId;
     readonly cwd?: string;
-    readonly executable?: string;
-    readonly arguments?: readonly string[];
+    readonly executable: string;
+    readonly arguments: readonly string[];
 }
-export declare function runTransparentForeground(options?: TransparentForegroundOptions): Promise<number>;
-//# sourceMappingURL=main.d.ts.map
+export declare function runTransparentForeground(options: TransparentForegroundOptions): Promise<number>;

package/dist/src/foundation/transparent-terminal/main.js

@@ -3,15 +3,15 @@ import { realpath } from "node:fs/promises";
 import { resolve } from "node:path";
 import { assertLaunchProfileId } from "../lifecycle/index.js";
 import { SupervisorClient } from "../protocol/index.js";
-import { resolveAddOnePaths } from "../supervision/index.js";
+import { resolveProductPaths } from "../supervision/index.js";
 import { runForegroundBroker } from "./foreground-broker.js";
 import { createPlatformTransparentLauncher } from "./native-launcher.js";
-export async function runTransparentForeground(options = {}) {
+export async function runTransparentForeground(options) {
     const environment = { ...(options.environment ?? process.env) };
-    const profileId = options.profileId ?? environment.ADDONE_LAUNCH_PROFILE ?? "addone";
+    const profileId = options.profileId ?? environment.A1_LAUNCH_PROFILE ?? "a1";
     assertLaunchProfileId(profileId);
-    const paths = resolveAddOnePaths(environment);
-    const client = new SupervisorClient(environment.ADDONE_RELEASE_ID);
+    const paths = resolveProductPaths(environment);
+    const client = new SupervisorClient(environment.A1_RELEASE_ID);
     await client.connect(paths.endpoint);
     const ownerId = `foreground-broker-${randomUUID()}`;
     const profile = await launchProfile(environment, options, profileId);
@@ -32,11 +32,8 @@ export async function runTransparentForeground(options = {}) {
     }
 }
 async function launchProfile(environment, options, profileId) {
-    const executable = options.executable ?? environment.ADDONE_TERMINAL_EXECUTABLE ?? "pi";
-    const arguments_ = options.arguments
-        ?? parseArguments(environment.ADDONE_LAUNCH_ARGUMENTS_JSON)
-        ?? parseArguments(environment.ADDONE_TERMINAL_ARGUMENTS_JSON)
-        ?? [];
+    const executable = options.executable;
+    const arguments_ = options.arguments;
     const cwd = await realpath(options.cwd ?? process.cwd());
     const terminalType = environment.TERM?.trim() || "xterm-256color";
     return {
@@ -54,19 +51,10 @@ async function launchProfile(environment, options, profileId) {
         visualReconnection: "none",
     };
 }
-function parseArguments(source) {
-    if (!source)
-        return null;
-    const value = JSON.parse(source);
-    if (!Array.isArray(value) || value.some(item => typeof item !== "string")) {
-        throw new TypeError("ADDONE_TERMINAL_ARGUMENTS_JSON must be a JSON array of strings");
-    }
-    return value;
-}
 function selectedChildEnvironment(environment) {
     const selected = {};
     for (const [name, value] of Object.entries(environment)) {
-        if (value !== undefined && !name.startsWith("ADDONE_"))
+        if (value !== undefined && !name.startsWith("A1_"))
             selected[name] = value;
     }
     return selected;
@@ -104,4 +92,3 @@ function stopSignal() {
         },
     };
 }
-//# sourceMappingURL=main.js.map

package/dist/src/foundation/transparent-terminal/native-launcher.d.ts

@@ -23,4 +23,3 @@ export declare class UnixTransparentLauncher implements TransparentNativeLaunche
     constructor(adapter?: NativeSpawnAdapter);
     launch(profile: TransparentTerminalLaunchProfile): Promise<TransparentChildHandle>;
 }
-//# sourceMappingURL=native-launcher.d.ts.map

package/dist/src/foundation/transparent-terminal/native-launcher.js

@@ -144,4 +144,3 @@ const defaultSpawnAdapter = {
         });
     },
 };
-//# sourceMappingURL=native-launcher.js.map

package/dist/src/foundation/workspace-contracts/index.d.ts

@@ -1,3 +1,2 @@
 export * from "./model.js";
 export * from "./validation.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/src/foundation/workspace-contracts/index.js

@@ -1,3 +1,2 @@
 export * from "./model.js";
 export * from "./validation.js";
-//# sourceMappingURL=index.js.map

package/dist/src/foundation/workspace-contracts/model.d.ts

@@ -246,4 +246,3 @@ export interface ComposedRecoveryAuthority {
     readonly streamPosition: number;
 }
 export type AgentRecoveryAuthority = StructuredRecoveryAuthority | ComposedRecoveryAuthority;
-//# sourceMappingURL=model.d.ts.map

package/dist/src/foundation/workspace-contracts/model.js

@@ -1,3 +1,2 @@
 export const WORKSPACE_CONTRACT_VERSION = 1;
 export const NATIVE_HOST_PROTOCOL_VERSION = 1;
-//# sourceMappingURL=model.js.map

package/dist/src/foundation/workspace-contracts/validation.d.ts

@@ -11,4 +11,3 @@ export declare function assertTerminalTopologySnapshot(topology: TerminalTopolog
 export declare function assertNativeHostCommand(command: NativeHostCommand): void;
 export declare function assertRecoveryAuthority(authority: AgentRecoveryAuthority): void;
 export declare function assertTerminalSessionLaunch(session: TerminalSessionLaunch): void;
-//# sourceMappingURL=validation.d.ts.map

package/dist/src/foundation/workspace-contracts/validation.js

@@ -333,4 +333,3 @@ function assertIntegerInRange(value, minimum, maximum, name) {
         throw new RangeError(`${name} must be an integer from ${minimum} to ${maximum}`);
     }
 }
-//# sourceMappingURL=validation.js.map

package/dist/src/product-identity.d.ts

@@ -0,0 +1,37 @@
+declare const ENVIRONMENT_KEYS: readonly ["certificationTarball", "configDir", "dataDir", "databasePath", "developmentInstanceId", "developmentRoot", "endpoint", "fixture", "fixtureInput", "fixtureToken", "inputAcknowledgement", "internalPackaging", "launchArgumentsJson", "launchProfile", "nativePi", "paneId", "piParityIntentionalMutation", "piPortRoot", "piSourceLedgerPath", "piSourceScanRoot", "probeTrace", "profileHome", "protocolVersion", "releaseDigest", "releaseId", "releaseRoot", "releaseRunnerLabel", "runtimeDir", "structuredFlowLimits", "terminalArgumentsJson", "terminalExecutable", "terminalSessionId"];
+declare const FILESYSTEM_KEYS: readonly ["slug", "windowsDirectory", "unixDirectory", "temporaryPrefix"];
+declare const STATE_KEYS: readonly ["windowsControlDirectory", "unixControlDirectory", "developmentDirectory", "piAgentProfile", "piVanillaProfile", "piSandboxProfile"];
+declare const ENDPOINT_KEYS: readonly ["windowsPipeStem", "unixSocketFilename", "metadataFilename", "supervisorLogFilename", "databaseFilename"];
+declare const MANIFEST_KEYS: readonly ["releaseFilename", "packageFilename"];
+declare const PROTOCOL_KEYS: readonly ["namespace", "controlEnvelope", "supervisorSchema", "nativeHostSchema", "structuredAgentSchema", "controlStoreSchema", "releaseCohortSchema", "updateJournalSchema"];
+declare const EVIDENCE_KEYS: readonly ["nativeSpikeSchema", "terminalProvenanceSchema", "terminalProofSchema", "stableReleaseSchema", "previewReleaseSchema", "releaseCertificationSchema", "previewPlatformVerdictSchema", "piSourceLedgerSchema", "piComponentParitySchema", "piEventFrameParitySchema"];
+declare const ARTIFACT_KEYS: readonly ["cliEntry", "supervisorEntry", "uiEntry", "nativeExecutable", "nativeCrate", "releaseTarballStem", "diagnosticStem"];
+type StringRecord<Keys extends readonly string[]> = {
+    readonly [Key in Keys[number]]: string;
+};
+export interface ProductIdentity {
+    readonly schema: string;
+    readonly displayName: string;
+    readonly commandName: string;
+    readonly packageName: string;
+    readonly filesystem: StringRecord<typeof FILESYSTEM_KEYS>;
+    readonly environment: StringRecord<typeof ENVIRONMENT_KEYS>;
+    readonly state: StringRecord<typeof STATE_KEYS>;
+    readonly endpoint: StringRecord<typeof ENDPOINT_KEYS>;
+    readonly manifest: StringRecord<typeof MANIFEST_KEYS>;
+    readonly protocol: StringRecord<typeof PROTOCOL_KEYS>;
+    readonly evidence: StringRecord<typeof EVIDENCE_KEYS>;
+    readonly artifacts: StringRecord<typeof ARTIFACT_KEYS>;
+}
+export declare function validateProductIdentity(value: unknown): ProductIdentity;
+export interface ProductIdentityText {
+    readonly displayName: string;
+    readonly commandName: string;
+    readonly packageName: string;
+    readonly diagnostic: (message: string) => string;
+    readonly usage: (forms: readonly string[]) => string;
+}
+export declare function createProductIdentityText(identity: Pick<ProductIdentity, "displayName" | "commandName" | "packageName">): ProductIdentityText;
+export declare const PRODUCT_IDENTITY: ProductIdentity;
+export declare const PRODUCT_TEXT: ProductIdentityText;
+export {};

package/dist/src/product-identity.js

@@ -0,0 +1,149 @@
+import rawIdentity from "./product-identity.json" with { type: "json" };
+const ENVIRONMENT_KEYS = [
+    "certificationTarball",
+    "configDir",
+    "dataDir",
+    "databasePath",
+    "developmentInstanceId",
+    "developmentRoot",
+    "endpoint",
+    "fixture",
+    "fixtureInput",
+    "fixtureToken",
+    "inputAcknowledgement",
+    "internalPackaging",
+    "launchArgumentsJson",
+    "launchProfile",
+    "nativePi",
+    "paneId",
+    "piParityIntentionalMutation",
+    "piPortRoot",
+    "piSourceLedgerPath",
+    "piSourceScanRoot",
+    "probeTrace",
+    "profileHome",
+    "protocolVersion",
+    "releaseDigest",
+    "releaseId",
+    "releaseRoot",
+    "releaseRunnerLabel",
+    "runtimeDir",
+    "structuredFlowLimits",
+    "terminalArgumentsJson",
+    "terminalExecutable",
+    "terminalSessionId",
+];
+const FILESYSTEM_KEYS = ["slug", "windowsDirectory", "unixDirectory", "temporaryPrefix"];
+const STATE_KEYS = ["windowsControlDirectory", "unixControlDirectory", "developmentDirectory", "piAgentProfile", "piVanillaProfile", "piSandboxProfile"];
+const ENDPOINT_KEYS = ["windowsPipeStem", "unixSocketFilename", "metadataFilename", "supervisorLogFilename", "databaseFilename"];
+const MANIFEST_KEYS = ["releaseFilename", "packageFilename"];
+const PROTOCOL_KEYS = ["namespace", "controlEnvelope", "supervisorSchema", "nativeHostSchema", "structuredAgentSchema", "controlStoreSchema", "releaseCohortSchema", "updateJournalSchema"];
+const EVIDENCE_KEYS = ["nativeSpikeSchema", "terminalProvenanceSchema", "terminalProofSchema", "stableReleaseSchema", "previewReleaseSchema", "releaseCertificationSchema", "previewPlatformVerdictSchema", "piSourceLedgerSchema", "piComponentParitySchema", "piEventFrameParitySchema"];
+const ARTIFACT_KEYS = ["cliEntry", "supervisorEntry", "uiEntry", "nativeExecutable", "nativeCrate", "releaseTarballStem", "diagnosticStem"];
+const ROOT_KEYS = ["schema", "displayName", "commandName", "packageName", "filesystem", "environment", "state", "endpoint", "manifest", "protocol", "evidence", "artifacts"];
+export function validateProductIdentity(value) {
+    const root = exactObject(value, ROOT_KEYS, "product identity");
+    const schema = stringValue(root.schema, "product identity schema");
+    const displayName = stringValue(root.displayName, "product display name");
+    const commandName = stringValue(root.commandName, "product command name");
+    const packageName = stringValue(root.packageName, "product package name");
+    const filesystem = stringObject(root.filesystem, FILESYSTEM_KEYS, "filesystem identity");
+    const environment = stringObject(root.environment, ENVIRONMENT_KEYS, "environment identity");
+    const state = stringObject(root.state, STATE_KEYS, "state identity");
+    const endpoint = stringObject(root.endpoint, ENDPOINT_KEYS, "endpoint identity");
+    const manifest = stringObject(root.manifest, MANIFEST_KEYS, "manifest identity");
+    const protocol = stringObject(root.protocol, PROTOCOL_KEYS, "protocol identity");
+    const evidence = stringObject(root.evidence, EVIDENCE_KEYS, "evidence identity");
+    const artifacts = stringObject(root.artifacts, ARTIFACT_KEYS, "artifact identity");
+    if (!/^[a-z][a-z0-9-]*$/.test(commandName))
+        throw new TypeError("product command name must be a lowercase command slug");
+    if (!/^@[a-z0-9-]+\/[a-z0-9-]+$/.test(packageName))
+        throw new TypeError("product package name must be a lowercase scoped npm package");
+    if (displayName.trim() !== displayName || displayName.length === 0)
+        throw new TypeError("product display name must be non-empty without surrounding whitespace");
+    if (schema !== `${commandName}-product-identity-v1`)
+        throw new TypeError("product identity schema must derive from the command name");
+    if (filesystem.slug !== commandName || filesystem.unixDirectory !== filesystem.slug || filesystem.windowsDirectory !== displayName) {
+        throw new TypeError("product filesystem identity must derive from display and command names");
+    }
+    if (filesystem.temporaryPrefix !== `${filesystem.slug}-`)
+        throw new TypeError("product temporary prefix must derive from the filesystem slug");
+    if (state.windowsControlDirectory !== filesystem.windowsDirectory || state.unixControlDirectory !== filesystem.unixDirectory) {
+        throw new TypeError("product state directories must match the filesystem identity");
+    }
+    if (endpoint.windowsPipeStem !== filesystem.slug)
+        throw new TypeError("product endpoint stem must match the filesystem slug");
+    if (protocol.namespace !== commandName)
+        throw new TypeError("product protocol namespace must match the command name");
+    if (artifacts.diagnosticStem !== filesystem.slug)
+        throw new TypeError("product diagnostic stem must match the filesystem slug");
+    const environmentPrefix = `${commandName.toUpperCase()}_`;
+    const environmentValues = Object.values(environment);
+    if (new Set(environmentValues).size !== environmentValues.length)
+        throw new TypeError("product environment keys must be unique");
+    for (const key of environmentValues) {
+        if (!key.startsWith(environmentPrefix) || !/^[A-Z][A-Z0-9_]+$/.test(key)) {
+            throw new TypeError(`product environment key must use ${environmentPrefix}: ${key}`);
+        }
+    }
+    for (const [name, identifier] of Object.entries(protocol)) {
+        if (name !== "namespace" && !identifier.startsWith(`${protocol.namespace}-`)) {
+            throw new TypeError(`product protocol identifier must use ${protocol.namespace}: ${identifier}`);
+        }
+    }
+    for (const identifier of Object.values(evidence)) {
+        if (!identifier.startsWith(`${protocol.namespace}-`))
+            throw new TypeError(`product evidence identifier must use ${protocol.namespace}: ${identifier}`);
+    }
+    return deepFreeze({
+        schema,
+        displayName,
+        commandName,
+        packageName,
+        filesystem,
+        environment,
+        state,
+        endpoint,
+        manifest,
+        protocol,
+        evidence,
+        artifacts,
+    });
+}
+export function createProductIdentityText(identity) {
+    return Object.freeze({
+        displayName: identity.displayName,
+        commandName: identity.commandName,
+        packageName: identity.packageName,
+        diagnostic: (message) => `${identity.displayName} ${message}`,
+        usage: (forms) => `Usage: ${forms.map(form => `${identity.commandName}${form ? ` ${form}` : ""}`).join(" | ")}`,
+    });
+}
+export const PRODUCT_IDENTITY = validateProductIdentity(rawIdentity);
+export const PRODUCT_TEXT = createProductIdentityText(PRODUCT_IDENTITY);
+function exactObject(value, keys, name) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        throw new TypeError(`${name} must be an object`);
+    const actualKeys = Object.keys(value).sort();
+    const expectedKeys = [...keys].sort();
+    if (actualKeys.length !== expectedKeys.length || actualKeys.some((key, index) => key !== expectedKeys[index])) {
+        throw new TypeError(`${name} must contain exactly: ${expectedKeys.join(", ")}`);
+    }
+    return value;
+}
+function stringObject(value, keys, name) {
+    const object = exactObject(value, keys, name);
+    return Object.fromEntries(keys.map((key) => [key, stringValue(object[key], `${name}.${key}`)]));
+}
+function stringValue(value, name) {
+    if (typeof value !== "string" || value.length === 0)
+        throw new TypeError(`${name} must be a non-empty string`);
+    return value;
+}
+function deepFreeze(value) {
+    if (typeof value !== "object" || value === null || Object.isFrozen(value))
+        return value;
+    for (const child of Object.values(value))
+        deepFreeze(child);
+    return Object.freeze(value);
+}

package/dist/src/product-identity.json

@@ -0,0 +1,96 @@
+{
+    "schema": "a1-product-identity-v1",
+    "displayName": "A1",
+    "commandName": "a1",
+    "packageName": "@timurproko/a1",
+    "filesystem": {
+        "slug": "a1",
+        "windowsDirectory": "A1",
+        "unixDirectory": "a1",
+        "temporaryPrefix": "a1-"
+    },
+    "environment": {
+        "certificationTarball": "A1_CERTIFICATION_TARBALL",
+        "configDir": "A1_CONFIG_DIR",
+        "dataDir": "A1_DATA_DIR",
+        "databasePath": "A1_DATABASE_PATH",
+        "developmentInstanceId": "A1_DEV_INSTANCE_ID",
+        "developmentRoot": "A1_DEV_ROOT",
+        "endpoint": "A1_ENDPOINT",
+        "fixture": "A1_FIXTURE",
+        "fixtureInput": "A1_FIXTURE_INPUT",
+        "fixtureToken": "A1_FIXTURE_TOKEN",
+        "inputAcknowledgement": "A1_INPUT_ACK",
+        "internalPackaging": "A1_INTERNAL_PACKAGING",
+        "launchArgumentsJson": "A1_LAUNCH_ARGUMENTS_JSON",
+        "launchProfile": "A1_LAUNCH_PROFILE",
+        "nativePi": "A1_NATIVE_PI",
+        "paneId": "A1_PANE_ID",
+        "piParityIntentionalMutation": "A1_PI_PARITY_INTENTIONAL_MUTATION",
+        "piPortRoot": "A1_PI_PORT_ROOT",
+        "piSourceLedgerPath": "A1_PI_SOURCE_LEDGER_PATH",
+        "piSourceScanRoot": "A1_PI_SOURCE_SCAN_ROOT",
+        "probeTrace": "A1_PROBE_TRACE",
+        "profileHome": "A1_PROFILE_HOME",
+        "protocolVersion": "A1_PROTOCOL_VERSION",
+        "releaseDigest": "A1_RELEASE_DIGEST",
+        "releaseId": "A1_RELEASE_ID",
+        "releaseRoot": "A1_RELEASE_ROOT",
+        "releaseRunnerLabel": "A1_RELEASE_RUNNER_LABEL",
+        "runtimeDir": "A1_RUNTIME_DIR",
+        "structuredFlowLimits": "A1_STRUCTURED_FLOW_LIMITS",
+        "terminalArgumentsJson": "A1_TERMINAL_ARGUMENTS_JSON",
+        "terminalExecutable": "A1_TERMINAL_EXECUTABLE",
+        "terminalSessionId": "A1_TERMINAL_SESSION_ID"
+    },
+    "state": {
+        "windowsControlDirectory": "A1",
+        "unixControlDirectory": "a1",
+        "developmentDirectory": "a1-development",
+        "piAgentProfile": ".a1/agent",
+        "piVanillaProfile": ".pi/agent",
+        "piSandboxProfile": ".a1/sandbox"
+    },
+    "endpoint": {
+        "windowsPipeStem": "a1",
+        "unixSocketFilename": "supervisor.sock",
+        "metadataFilename": "supervisor.json",
+        "supervisorLogFilename": "supervisor.log",
+        "databaseFilename": "control.sqlite3"
+    },
+    "manifest": {
+        "releaseFilename": ".a1-release.json",
+        "packageFilename": "package.json"
+    },
+    "protocol": {
+        "namespace": "a1",
+        "controlEnvelope": "a1-control-envelope",
+        "supervisorSchema": "a1-supervisor-v1",
+        "nativeHostSchema": "a1-native-host-v1",
+        "structuredAgentSchema": "a1-structured-agent-v1",
+        "controlStoreSchema": "a1-control-store-v1",
+        "releaseCohortSchema": "a1-release-cohort-v1",
+        "updateJournalSchema": "a1-update-journal-v1"
+    },
+    "evidence": {
+        "nativeSpikeSchema": "a1-native-host-spike-evidence-v1",
+        "terminalProvenanceSchema": "a1-terminal-host-provenance-v1",
+        "terminalProofSchema": "a1-terminal-host-proof-v1",
+        "stableReleaseSchema": "a1-stable-release-v1",
+        "previewReleaseSchema": "a1-preview-release-v1",
+        "releaseCertificationSchema": "a1-release-certification-v1",
+        "previewPlatformVerdictSchema": "a1-development-preview-platform-verdict-v2",
+        "piSourceLedgerSchema": "a1-pinned-pi-source-port-ledger-v1",
+        "piComponentParitySchema": "a1-pi-static-component-parity-v1",
+        "piEventFrameParitySchema": "a1-pi-event-frame-parity-v1"
+    },
+    "artifacts": {
+        "cliEntry": "bin/a1.js",
+        "supervisorEntry": "bin/a1-supervisor.js",
+        "uiEntry": "bin/a1-ui.js",
+        "nativeExecutable": "a1-terminal-host",
+        "nativeCrate": "a1-terminal-host",
+        "releaseTarballStem": "timurproko-a1",
+        "diagnosticStem": "a1"
+    }
+}

package/docs/architecture/boundaries.md

@@ -11,9 +11,9 @@ mutable a1 entry
   -> child with inherited physical terminal handles
 ```
 
-After handoff, AddOne does not read ordinary terminal input, parse child output, render cells, infer frames, synthesize terminal responses, or emit display control. The child and physical terminal own terminal behavior. AddOne owns validated launch intent, one exclusive foreground lease, native process identity, lifecycle outcome, and bounded cleanup.
+After handoff, A1 does not read ordinary terminal input, parse child output, render cells, infer frames, synthesize terminal responses, or emit display control. The child and physical terminal own terminal behavior. A1 owns validated launch intent, one exclusive foreground lease, native process identity, lifecycle outcome, and bounded cleanup.
 
-Transparent mode has no AddOne-authoritative terminal surface, internal pane, virtual scrollback, inactive resident tab, or visual reconnection. A future feature that requires those properties must introduce and certify a separate composed-terminal authority; it must not weaken or silently intercept transparent mode.
+Transparent mode has no A1-authoritative terminal surface, internal pane, virtual scrollback, inactive resident tab, or visual reconnection. A future feature that requires those properties must introduce and certify a separate composed-terminal authority; it must not weaken or silently intercept transparent mode.
 
 ## Current module responsibilities
 

package/docs/architecture/project-structure.md

@@ -74,8 +74,8 @@ Build output belongs in ignored `dist/`; release/test evidence belongs in ignore
 
 ## Terminal capability boundary
 
-Transparent terminal attachment owns one foreground child and no AddOne surface. It cannot retain inactive terminal state or switch among arbitrary interactive CLIs inside AddOne. Bare-`a1` multi-agent UX may use structured/RPC surfaces without terminal emulation, but arbitrary-CLI tabs require a separate composed-terminal capability with PTY, authoritative terminal state, rendering, input routing, inactive-surface lifecycle, reconnection, and cross-platform certification. That future capability must not silently intercept or replace the transparent path. Explicit launch profiles and transparent fallback must not import, initialize, launch, or connect to composed terminal-host infrastructure.
+Transparent terminal attachment owns one foreground child and no A1 surface. It cannot retain inactive terminal state or switch among arbitrary interactive CLIs inside A1. Bare-`a1` multi-agent UX may use structured/RPC surfaces without terminal emulation, but arbitrary-CLI tabs require a separate composed-terminal capability with PTY, authoritative terminal state, rendering, input routing, inactive-surface lifecycle, reconnection, and cross-platform certification. That future capability must not silently intercept or replace the transparent path. Explicit launch profiles and transparent fallback must not import, initialize, launch, or connect to composed terminal-host infrastructure.
 
-Composed terminals use a console terminal host that runs inside the user's existing terminal. The host owns pseudoterminal bytes, retained terminal state, keyboard/text/mouse/IME encoding, frame scheduling, and presentation to the containing terminal. AddOne's JavaScript control plane may exchange typed identity, topology revision, capability, lifecycle, status, and recovery messages only; it must not relay terminal output, per-event child input, or rendered cells. A desktop-native window, GPU renderer, Ghostty GUI runtime, Winghostty Win32 runtime, Metal, GTK, and AppKit are postponed and are not required for the in-terminal product.
+Composed terminals use a console terminal host that runs inside the user's existing terminal. The host owns pseudoterminal bytes, retained terminal state, keyboard/text/mouse/IME encoding, frame scheduling, and presentation to the containing terminal. A1's JavaScript control plane may exchange typed identity, topology revision, capability, lifecycle, status, and recovery messages only; it must not relay terminal output, per-event child input, or rendered cells. A desktop-native window, GPU renderer, Ghostty GUI runtime, Winghostty Win32 runtime, Metal, GTK, and AppKit are postponed and are not required for the in-terminal product.
 
 A tab owns a revisioned split tree. Each leaf pane references one PTY-backed terminal session. Structured/RPC agents remain semantically separate and may not derive state from ANSI text, terminal timing, or screen content. Native source ownership lives outside `src/` when introduced; packaged host selection is governed by release/package owners. Existing architecture tests reject terminal-host hot-path bytes in JavaScript protocol code, terminal inference in structured runtime code, composed imports from explicit launch modes, and replacement lightweight terminal parsers/renderers.

package/docs/architecture/resource-and-data-policy.md

@@ -32,7 +32,7 @@ Every asynchronous consumer must implement a finite queue or window. Backpressur
 |---|---|---|
 | Workspace metadata | IDs, names, lifecycle, capability versions, topology revisions, recovery references | May persist in the control store |
 | Structured payloads | Messages, tool calls, snapshots, attachments | Bound and process; persist only under a future typed retention policy |
-| Terminal content | PTY bytes, scrollback, selection, rendered cells | Never persist in AddOne's control store or diagnostics |
+| Terminal content | PTY bytes, scrollback, selection, rendered cells | Never persist in A1's control store or diagnostics |
 | Host topology metadata | Window/tab/pane/session IDs, layout shape, dimensions, revision | May persist; not terminal content |
 | Native proof evidence | Artifact hashes, source revisions, workloads, latency/resource measurements, paint diagnostics | May persist in versioned evidence files without terminal content |
 | Environment values | `PATH`, profile overrides, arbitrary launch environment | Do not persist; treat as potentially sensitive |

package/docs/architecture/terminal-host-proof-gate.md

@@ -1,6 +1,6 @@
 # In-terminal 2×2 proof gate
 
-The composed-terminal proof is a stop/go gate. AddOne must not merge or productize composed terminal panes until the exact in-terminal spike artifact passes both technical and physical acceptance.
+The composed-terminal proof is a stop/go gate. A1 must not merge or productize composed terminal panes until the exact in-terminal spike artifact passes both technical and physical acceptance.
 
 ## Go criteria
 
@@ -8,7 +8,7 @@ A `go` decision requires all of the following:
 
 1. Every mandatory workload in the terminal-host evidence schema passes.
 2. The proof runs inside an existing terminal without creating a desktop window.
-3. The exact artifact is tied to pinned AddOne and terminal-component revisions.
+3. The exact artifact is tied to pinned A1 and terminal-component revisions.
 4. Automated evidence came from an isolated worker.
 5. The physical verdict is `accepted` through user-controlled manual validation or an attested isolated disposable worker.
 6. Input-to-process p95 latency is at most 16 ms.

package/docs/architecture/terminal-host-provenance.md

@@ -10,7 +10,7 @@ The composed-terminal proof uses a small console-hosted stack. It runs inside th
 | `portable-pty` | version `0.9.0` | ConPTY/Unix PTY and process ownership | MIT |
 | Crossterm | version `0.29.0` | Outer-terminal raw mode and host input events | MIT-compatible candidate; notice must be vendored before packaging |
 
-A buffered AddOne-owned frame composer is the initial presentation layer. Ratatui is an optional evaluation candidate only if the narrow composer increases rendering risk; it is not selected by default.
+A buffered A1-owned frame composer is the initial presentation layer. Ratatui is an optional evaluation candidate only if the narrow composer increases rendering risk; it is not selected by default.
 
 ## Explicitly excluded
 
@@ -44,7 +44,7 @@ Do not patch terminal semantics to support a specific CLI. Report unsupported ge
 
 The console proof requires:
 
-- Rust/Cargo for the AddOne terminal host;
+- Rust/Cargo for the A1 terminal host;
 - Zig `0.15.x` with patch `>= 0.15.2` to build `libghostty-vt`;
 - the platform C/C++ build toolchain required by Rust and the PTY/input crates (Visual Studio 2022 Build Tools/MSVC on Windows);
 - Windows 10/11 x64 or ARM64 for the first proof;
@@ -58,7 +58,7 @@ No GUI SDK, OpenGL runtime, Win32 window pipeline, Metal, GTK, or AppKit runtime
 Every spike or production host artifact must record:
 
 - artifact path, SHA-256, size, signature status, and build timestamp;
-- AddOne source commit and protocol version;
+- A1 source commit and protocol version;
 - `libghostty-vt`, PTY, input, and renderer component identities;
 - retained/adapted component manifest;
 - compiler/toolchain versions and target triple;

package/docs/architecture/terminal-host-spike-evidence.md

@@ -1,6 +1,6 @@
 # In-terminal 2×2 spike evidence
 
-The spike must produce machine-readable evidence with schema `addone-native-host-spike-evidence-v1`. Evidence is valid only when it names the exact artifact, hashes, pinned source commits, isolated worker environment, all mandatory workloads, measurements, paint diagnostics, resources, and physical/manual verdict. The artifact is a console terminal host that runs inside an existing terminal and does not open a desktop window.
+The spike must produce machine-readable evidence with schema `a1-native-host-spike-evidence-v1`. Evidence is valid only when it names the exact artifact, hashes, pinned source commits, isolated worker environment, all mandatory workloads, measurements, paint diagnostics, resources, and physical/manual verdict. The artifact is a console terminal host that runs inside an existing terminal and does not open a desktop window.
 
 ## Mandatory workloads
 

package/docs/architecture/toolchain.md

@@ -45,22 +45,48 @@ npm run test:release
 
 `check:deprecated` verifies the complete lockfile graph against registry metadata. The release gate exercises durable stable/preview update transitions and writes an ignored machine-readable verdict under `artifacts/release-verdicts/`.
 
+## Pi maintenance workflows
+
+Engine compatibility and presentation synchronization are intentionally separate:
+
+```sh
+npm run test:pi-engine-conformance
+```
+
+This mandatory candidate workflow checks documented package-root exports and the owned engine integration. It does not read private interactive source, compare source maps, regenerate UI fixtures, or require presentation provenance to match a candidate package.
+
+```sh
+npm run sync:pi-ui
+```
+
+This optional, mutating presentation-maintenance workflow regenerates component and event-frame parity evidence when maintainers deliberately adopt upstream UI changes. Review generated diffs, attribution, source-ledger records, and terminal parity before committing them. It is never an engine candidate acceptance gate and is not run by `check`, `prepack`, or release publication.
+
+`npm run test:pi-terminal-parity` remains an explicit presentation acceptance command. `node scripts/check-pinned-pi-source-ledger.mjs` validates accepted provenance; its `--engine-only` mode validates the ownership partition without comparing private upstream source.
+
 ## Preview publication
 
 A preview candidate must use a unique `-dev.N` version and exact manually accepted bytes. Publication packs once, binds evidence to source commit/version/integrity, runs applicable non-desktop gates, publishes under npm `next`, and verifies registry identity. It must keep `latest` unchanged and record physical/cross-platform certification as deferred.
 
 The GitHub trusted-publishing workflow is `.github/workflows/publish-next.yml`. Stable publication remains a separate release process from a clean tagged `master` commit after all mandatory platform gates pass.
 
-## AddOne state paths
+## A1 state paths
 
-These paths are AddOne control and release state, not Pi profile roots. All are overrideable for hermetic tests.
+These paths are A1 control and release state, not Pi profile roots. All are overrideable for hermetic tests.
 
 | Purpose | Override | Windows default | Unix default |
 |---|---|---|---|
-| Config | `ADDONE_CONFIG_DIR` | `%APPDATA%\\AddOne` | `$XDG_CONFIG_HOME/addone` or `~/.config/addone` |
-| Durable data | `ADDONE_DATA_DIR` | `%LOCALAPPDATA%\\AddOne` | `$XDG_DATA_HOME/addone` or `~/.local/share/addone` |
-| Runtime | `ADDONE_RUNTIME_DIR` | `%LOCALAPPDATA%\\AddOne\\runtime` | `$XDG_RUNTIME_DIR/addone` or `<data>/runtime` |
-| Database | `ADDONE_DATABASE_PATH` | `<data>/control.sqlite3` | `<data>/control.sqlite3` |
-| Endpoint | `ADDONE_ENDPOINT` | runtime-scoped named pipe | `<runtime>/supervisor.sock` |
+| Config | `A1_CONFIG_DIR` | `%APPDATA%\\A1` | `$XDG_CONFIG_HOME/a1` or `~/.config/a1` |
+| Durable data | `A1_DATA_DIR` | `%LOCALAPPDATA%\\A1` | `$XDG_DATA_HOME/a1` or `~/.local/share/a1` |
+| Runtime | `A1_RUNTIME_DIR` | `%LOCALAPPDATA%\\A1\\runtime` | `$XDG_RUNTIME_DIR/a1` or `<data>/runtime` |
+| Database | `A1_DATABASE_PATH` | `<data>/control.sqlite3` | `<data>/control.sqlite3` |
+| Endpoint | `A1_ENDPOINT` | runtime-scoped `a1-*` named pipe | `<runtime>/supervisor.sock` |
+
+### Identity hard cut and cleanup
+
+A1 does not read or migrate legacy `ADDONE_*` variables, `AddOne`/`addone` control-state directories, release manifests, database schemas, endpoint records, or protocol frames. Remove obsolete control state only after stopping old processes: `%APPDATA%\\AddOne` and `%LOCALAPPDATA%\\AddOne` on Windows, or the former `addone` directories under XDG config, data, and runtime roots on Unix. This cleanup is manual and never imports data into A1.
+
+Do **not** remove `~/.a1/agent` or `~/.a1/sandbox`; those are current Pi profile roots and are intentionally preserved. `~/.pi/agent` remains the vanilla Pi profile.
+
+The obsolete npm package `@timurproko/addone` is deprecated with the registry message `This package is obsolete. Use @timurproko/a1 instead.` It is not a current identity, compatibility channel, or rollback source. Whole-package unpublication was rejected by npm policy; any later removal is owner-controlled registry administration and does not change the A1 runtime contract.
 
 The launch-profile feature separately owns Pi roots: `~/.a1/agent`, ordinary `~/.pi/agent`, and `~/.a1/sandbox`.

package/docs/features/launch-profiles.md

@@ -4,7 +4,7 @@
 
 | Command | Purpose | Pi user profile |
 |---|---|---|
-| `a1` | AddOne-owned Pi-compatible UI | `~/.a1/agent` |
+| `a1` | A1-owned Pi-compatible UI | `~/.a1/agent` |
 | `a1 pi` | Untouched vanilla Pi fallback and comparison oracle | ordinary `~/.pi/agent` |
 | `a1 sandbox` | Unchanged isolated vanilla Pi profile for experiments | `~/.a1/sandbox` |
 
@@ -12,7 +12,7 @@ There is no `a1 agent` command. The former `a1 ui` subcommand is removed. Bare `
 
 ## First launch
 
-For AddOne-owned profiles, AddOne creates only the selected profile root and empty `extensions`, `skills`, `prompts`, and `themes` directories. Existing content is preserved. AddOne does not copy, link, merge, or delete settings, credentials, sessions, packages, trust decisions, or resources from another profile.
+For A1-owned profiles, A1 creates only the selected profile root and empty `extensions`, `skills`, `prompts`, and `themes` directories. Existing content is preserved. A1 does not copy, link, merge, or delete settings, credentials, sessions, packages, trust decisions, or resources from another profile.
 
 Pi owns files within the selected root. Common locations are:
 
@@ -31,7 +31,7 @@ Run Pi’s normal `/login` independently in each profile that needs stored authe
 
 ## Vanilla Pi
 
-`a1 pi` bypasses the AddOne-owned UI and launches the untouched pinned Pi CLI. It also removes AddOne’s Pi configuration-root override, so Pi uses its normal `~/.pi/agent` settings, authentication, sessions, resources, packages, and trust decisions. This is both the comparison oracle and the recovery fallback when diagnosing the owned UI.
+`a1 pi` bypasses the A1-owned UI and launches the untouched pinned Pi CLI. It also removes A1’s Pi configuration-root override, so Pi uses its normal `~/.pi/agent` settings, authentication, sessions, resources, packages, and trust decisions. This is both the comparison oracle and the recovery fallback when diagnosing the owned UI.
 
 ## Sandbox profile
 
@@ -41,10 +41,10 @@ Run Pi’s normal `/login` independently in each profile that needs stored authe
 
 ## Terminal behavior
 
-Bare `a1` runs the AddOne-owned full-viewport TUI over public Pi engine, component, and terminal APIs. AddOne owns composition, input routing, modal focus, selection behavior, scrolling, and restoration without inserting a PTY or terminal-byte relay. Its default presentation is pinned to vanilla Pi parity; structured tabs and AddOne-specific visual customization are not enabled.
+Bare `a1` runs the A1-owned full-viewport TUI over public Pi engine, component, and terminal APIs. A1 owns composition, input routing, modal focus, selection behavior, scrolling, and restoration without inserting a PTY or terminal-byte relay. Its default presentation is pinned to vanilla Pi parity; structured tabs and A1-specific visual customization are not enabled.
 
-`a1 pi` and `a1 sandbox` retain transparent direct attachment. In those profiles, one untouched Pi process and the physical terminal own rendering, input, selection, clipboard, scrollback, and terminal modes; AddOne owns foreground lease and lifecycle only.
+`a1 pi` and `a1 sandbox` retain transparent direct attachment. In those profiles, one untouched Pi process and the physical terminal own rendering, input, selection, clipboard, scrollback, and terminal modes; A1 owns foreground lease and lifecycle only.
 
 ## Recovery and comparison
 
-If bare `a1` cannot start or a UI workflow diverges, run `a1 pi` from the same working directory and compare the behavior. Profile data is intentionally separate, so authentication or settings may need to be configured independently. Use `a1 version` to record the installed AddOne release before reporting a difference. `a1 sandbox` is for isolated profile experiments, not recovery from the owned UI and not a security boundary.
+If bare `a1` cannot start or a UI workflow diverges, run `a1 pi` from the same working directory and compare the behavior. Profile data is intentionally separate, so authentication or settings may need to be configured independently. Use `a1 version` to record the installed A1 release before reporting a difference. `a1 sandbox` is for isolated profile experiments, not recovery from the owned UI and not a security boundary.