ai-capability-framework 1.0.0-rc.3 → 1.0.0

package/docs/architecture/current-state.md

@@ -1,49 +1,46 @@
 # Current Architecture State
 
-This document records the public baseline used for the F0 reconciliation gate.
-It describes the current repository shape before later governance-completion
-work begins.
+This document records the public baseline used for the F0 reconciliation gate. It
+describes the current repository shape before later governance-completion work begins.
 
 ## Core Package Boundary
 
 The package root is the provider-neutral Core API. It loads and validates public
-manifests, builds registries, selects capability slices, exports descriptor-only
-adapter tools, parses provider tool calls back to AICF capability IDs, scores
-deterministic eval fixtures, and formats model-safe tool results.
+manifests, builds registries, selects capability slices, exports descriptor-only adapter
+tools, parses provider tool calls back to AICF capability IDs, scores deterministic eval
+fixtures, and formats model-safe tool results.
 
-The package root must not call model providers, execute host side effects,
-persist approvals, or require optional provider SDKs. Host applications remain
-responsible for authentication, authorization, provider clients, durable
-storage, approval UI, audit retention, and final side-effect execution.
+The package root must not call model providers, execute host side effects, persist
+approvals, or require optional provider SDKs. Host applications remain responsible for
+authentication, authorization, provider clients, durable storage, approval UI, audit
+retention, and final side-effect execution.
 
 ## Runtime And Provider Subpaths
 
-The runtime subpath provides deterministic host-controlled runtime utilities:
-context building, policy brokering, capability routing, redaction, handler
-registration, read/prepare execution, action lifecycle stores, audit events, and
-runtime envelopes. It does not call model providers or expose commit execution
-to model-facing tools.
+The runtime subpath provides deterministic host-controlled runtime utilities: context
+building, policy brokering, capability routing, redaction, handler registration,
+read/prepare execution, action lifecycle stores, audit events, and runtime envelopes. It
+does not call model providers or expose commit execution to model-facing tools.
 
-The provider-specific APIs live behind optional subpaths. OpenAI, Anthropic,
-Gemini, AI SDK, LangChain, MCP, Semantic Kernel, AWS, observability, live eval,
-Promptfoo, Langfuse, and MCP server integrations are imported only by their
-dedicated subpaths. Optional SDKs are peer dependencies and are loaded only when
-a host uses the relevant integration.
+The provider-specific APIs live behind optional subpaths. OpenAI, Anthropic, Gemini, AI
+SDK, LangChain, MCP, Semantic Kernel, AWS, observability, live eval, Promptfoo,
+Langfuse, and MCP server integrations are imported only by their dedicated subpaths.
+Optional SDKs are peer dependencies and are loaded only when a host uses the relevant
+integration.
 
 ## Validation And Release Gates
 
-The repository baseline includes schema validation, generated type freshness,
-TypeScript build/typechecking, deterministic tests, manifest validation, package
-contents checks, public hygiene checks, workspace hygiene checks, and clean
-consumer install smoke tests.
+The repository baseline includes schema validation, generated type freshness, TypeScript
+build/typechecking, deterministic tests, manifest validation, package contents checks,
+public hygiene checks, workspace hygiene checks, and clean consumer install smoke tests.
 
-The public hygiene checks keep private drafts, raw prompts, traces, provider
-payloads, generated local artifacts, credentials, archives, and local-only
-material out of tracked and package-published paths.
+The public hygiene checks keep private drafts, raw prompts, traces, provider payloads,
+generated local artifacts, credentials, archives, and local-only material out of tracked
+and package-published paths.
 
 ## Public Examples
 
-Public examples are synthetic. They demonstrate support and scheduling
-capability manifests, eval fixtures, decision fixtures, provider exports, and a
-mock runtime flow without using real tenants, customers, credentials, provider
-payloads, raw prompts, or production endpoints.
+Public examples are synthetic. They demonstrate support and scheduling capability
+manifests, eval fixtures, decision fixtures, provider exports, and a mock runtime flow
+without using real tenants, customers, credentials, provider payloads, raw prompts, or
+production endpoints.

package/docs/audit/index.md

@@ -1,34 +1,35 @@
 # Audit Ledger
 
-The audit subpath defines canonical ledger records for AICF runtime evidence.
-It is optional and additive:
+The audit subpath defines canonical ledger records for AICF runtime evidence. It is
+optional and additive:
 
 ```ts
 import { DefaultAuditLedger } from "ai-capability-framework/audit";
 ```
 
-The ledger records policy decisions, action state, approvals, commit outcomes,
-and idempotency reservations in a public-safe JSON shape. It does not replace
-host audit systems, production storage, authorization, approval UI, payment
-systems, or business-side effects.
+The ledger records policy decisions, action state, approvals, commit outcomes, and
+idempotency reservations in a public-safe JSON shape. It does not replace host audit
+systems, production storage, authorization, approval UI, payment systems, or
+business-side effects.
 
 ## What Gets Recorded
 
 The canonical records are:
 
-- `PolicyDecisionRecord`: capability, operation, decision, reasons, autonomy,
-  risk, input hash, trace reference, and redacted subject/account/tenant refs.
+- `PolicyDecisionRecord`: capability, operation, decision, reasons, autonomy, risk,
+  input hash, trace reference, and redacted subject/account/tenant refs.
 - `ActionRecord`: lifecycle state from `proposed` through `prepared`,
-  `approval_required`, `approved`, `committing`, `committed`, `failed`,
-  `expired`, or `cancelled`.
+  `approval_required`, `approved`, `committing`, `committed`, `failed`, `expired`, or
+  `cancelled`. Verification is tracked separately with optional `verificationStatus` so
+  committed side effects are not reclassified after a verification check fails.
 - `ApprovalRecord`: pending, approved, rejected, expired, or cancelled approval
   decisions with redacted requester and decider refs.
-- `IdempotencyRecord`: scoped idempotency reservations and completions with a
-  safe result reference.
+- `IdempotencyRecord`: scoped idempotency reservations and completions with a safe
+  result reference.
 
-Records store hashes and summaries, not raw input, raw previews, raw result
-payloads, raw prompts, provider payloads, stack traces, secrets, user IDs,
-account IDs, or tenant IDs.
+Records store hashes and summaries, not raw input, raw previews, raw result payloads,
+raw prompts, provider payloads, stack traces, secrets, user IDs, account IDs, or tenant
+IDs.
 
 ## Runtime Integration
 
@@ -56,21 +57,21 @@ const executor = new AicfToolExecutor({
 });
 ```
 
-Without `ledger`, runtime behavior is unchanged. With `ledger`, AICF records
-evidence when tool calls are proposed, policy decisions are made, prepare
-succeeds, approval is required, approvals are recorded, commits start, commits
-succeed, commits fail, and idempotency keys are reserved or completed.
+Without `ledger`, runtime behavior is unchanged. With `ledger`, AICF records evidence
+when tool calls are proposed, policy decisions are made, prepare succeeds, approval is
+required, approvals are recorded, commits start, commits succeed, commits fail, and
+idempotency keys are reserved or completed.
 
-The in-memory ledger stores are reference utilities for tests and local
-examples. Production applications should implement the store interfaces using
-their own durable, access-controlled audit system.
+The in-memory ledger stores are reference utilities for tests and local examples.
+Production applications should implement the store interfaces using their own durable,
+access-controlled audit system.
 
 ## Redaction Defaults
 
-`hashAuditValue()` uses deterministic SHA-256 hashes over stable JSON. The
-redaction helpers hash subject, account, and tenant identifiers by default.
-`diagnosticMode: "unsafe_unredacted"` exists for isolated tests only and should
-not be used in production or public examples.
+`hashAuditValue()` uses deterministic SHA-256 hashes over stable JSON. The redaction
+helpers hash subject, account, and tenant identifiers by default.
+`diagnosticMode: "unsafe_unredacted"` exists for isolated tests only and should not be
+used in production or public examples.
 
 ## Schemas
 
@@ -81,6 +82,5 @@ Strict JSON Schemas live under `schemas/audit/`:
 - `approval-record.schema.json`
 - `idempotency-record.schema.json`
 
-They are intended for validation, storage contracts, and source review. Host
-systems may add their own private storage metadata outside these public record
-contracts.
+They are intended for validation, storage contracts, and source review. Host systems may
+add their own private storage metadata outside these public record contracts.

package/docs/aws/cloudwatch-telemetry.md

@@ -1,8 +1,7 @@
 # CloudWatch Telemetry
 
-`CloudWatchTelemetryPublisher` emits sanitized AICF trace and audit events to
-CloudWatch metrics and CloudWatch Logs when caller-provided clients are
-configured.
+`CloudWatchTelemetryPublisher` emits sanitized AICF trace and audit events to CloudWatch
+metrics and CloudWatch Logs when caller-provided clients are configured.
 
 ```ts
 import { CloudWatchTelemetryPublisher } from "ai-capability-framework/aws";
@@ -16,7 +15,6 @@ const telemetry = new CloudWatchTelemetryPublisher({
 });
 ```
 
-The helper publishes count metrics and metadata-mode log entries. It should not
-be used to capture raw prompts, raw provider payloads, secrets, tokens, cookies,
-payment data, or private diagnostics.
-
+The helper publishes count metrics and metadata-mode log entries. It should not be used
+to capture raw prompts, raw provider payloads, secrets, tokens, cookies, payment data,
+or private diagnostics.

package/docs/aws/dynamodb-single-table.md

@@ -7,9 +7,9 @@ The AWS reference stores use one DynamoDB table with:
 - `GSI2PK` and `GSI2SK` for entity-type and relationship lookups;
 - `schemaVersion`, `entityType`, timestamps, and optional `ttlEpochSeconds`.
 
-Supported item families include prepared actions, runtime approvals,
-idempotency reservations, audit events, canonical ledger records, controls,
-budget usage, Step Functions approval tasks, and sanitized replay metadata.
+Supported item families include prepared actions, runtime approvals, idempotency
+reservations, audit events, canonical ledger records, controls, budget usage, Step
+Functions approval tasks, and sanitized replay metadata.
 
 Example CDK-style table shape:
 
@@ -21,10 +21,9 @@ new dynamodb.Table(this, "AicfRuntimeState", {
 });
 ```
 
-Add GSIs named `GSI1` and `GSI2` with string partition and sort keys matching
-the field names above.
-
-Use least-privilege IAM scoped to the table and the operations your host
-actually enables: `dynamodb:PutItem`, `dynamodb:Query`, `dynamodb:UpdateItem`,
-and `dynamodb:DeleteItem`.
+Add GSIs named `GSI1` and `GSI2` with string partition and sort keys matching the field
+names above.
 
+Use least-privilege IAM scoped to the table and the operations your host actually
+enables: `dynamodb:PutItem`, `dynamodb:Query`, `dynamodb:UpdateItem`, and
+`dynamodb:DeleteItem`.

package/docs/aws/kms-redaction.md

@@ -1,7 +1,7 @@
 # KMS Redaction References
 
-`KmsRedactionProvider` creates deterministic redaction references with AWS KMS
-HMAC keys. It returns a redacted ref and never returns the raw input value.
+`KmsRedactionProvider` creates deterministic redaction references with AWS KMS HMAC
+keys. It returns a redacted ref and never returns the raw input value.
 
 ```ts
 import { KmsRedactionProvider } from "ai-capability-framework/aws";
@@ -15,7 +15,6 @@ const redaction = new KmsRedactionProvider({
 const ref = await redaction.redact({ tenantId: "tenant_example" });
 ```
 
-Use KMS key policies and IAM conditions to limit who can generate redaction
-refs. Host applications remain responsible for key rotation, retention policy,
-and secure handling of the original values.
-
+Use KMS key policies and IAM conditions to limit who can generate redaction refs. Host
+applications remain responsible for key rotation, retention policy, and secure handling
+of the original values.

package/docs/aws/overview.md

@@ -1,8 +1,8 @@
 # AWS Overview
 
-AWS support is an optional reference integration under
-`ai-capability-framework/aws`. Root, runtime, provider, governance, control, and
-evidence imports do not require AWS SDK modules.
+AWS support is an optional reference integration under `ai-capability-framework/aws`.
+Root, runtime, provider, governance, control, and evidence imports do not require AWS
+SDK modules.
 
 Read:
 
@@ -13,5 +13,5 @@ Read:
 - [CloudWatch telemetry](cloudwatch-telemetry.md)
 - [KMS redaction](kms-redaction.md)
 
-Host applications own AWS credentials, IAM, deployment, table provisioning,
-retention, and cleanup.
+Host applications own AWS credentials, IAM, deployment, table provisioning, retention,
+and cleanup.

package/docs/aws/production-reference.md

@@ -1,12 +1,12 @@
 # AWS Production Reference
 
-AICF AWS support is optional. Import it from `ai-capability-framework/aws`
-when a host application wants AWS-backed reference adapters for durable runtime
-state, audit evidence, approvals, controls, telemetry, and redaction.
+AICF AWS support is optional. Import it from `ai-capability-framework/aws` when a host
+application wants AWS-backed reference adapters for durable runtime state, audit
+evidence, approvals, controls, telemetry, and redaction.
 
-The package root, runtime, provider, governance, audit, controls, and
-control-plane subpaths do not import AWS SDK packages. AWS clients are provided
-by the host application or constructed by host code outside AICF.
+The package root, runtime, provider, governance, audit, controls, and control-plane
+subpaths do not import AWS SDK packages. AWS clients are provided by the host
+application or constructed by host code outside AICF.
 
 ## Supported v1 Adapter
 
@@ -21,17 +21,16 @@ import {
 } from "ai-capability-framework/aws";
 ```
 
-These adapters store public-safe evidence: hashes, redacted refs, summaries,
-states, reasons, coverage metadata, and sanitized events. They do not store raw
-prompts, raw provider payloads, raw transcripts, secrets, stack traces, or
-unredacted account, tenant, or user identifiers by default.
+These adapters store public-safe evidence: hashes, redacted refs, summaries, states,
+reasons, coverage metadata, and sanitized events. They do not store raw prompts, raw
+provider payloads, raw transcripts, secrets, stack traces, or unredacted account,
+tenant, or user identifiers by default.
 
 ## Host Responsibilities
 
-The host application owns AWS credentials, IAM roles, table provisioning,
-tenant/account authorization, approval identity, workflow definitions, evidence
-retention, backups, monitoring, and cleanup.
+The host application owns AWS credentials, IAM roles, table provisioning, tenant/account
+authorization, approval identity, workflow definitions, evidence retention, backups,
+monitoring, and cleanup.
 
 Default tests use fake clients only. Live AWS tests are skipped unless
 `RUN_AWS_INTEGRATION=1` and the required resource environment variables are set.
-

package/docs/aws/step-functions-approval.md

@@ -1,7 +1,7 @@
 # Step Functions Approval Handoff
 
-`StepFunctionsApprovalAdapter` starts and resumes host-owned approval workflows.
-It sends a safe prepared-action summary, not raw args or provider payloads.
+`StepFunctionsApprovalAdapter` starts and resumes host-owned approval workflows. It
+sends a safe prepared-action summary, not raw args or provider payloads.
 
 ```ts
 import {
@@ -22,11 +22,9 @@ const approvals = new StepFunctionsApprovalAdapter({
 });
 ```
 
-The adapter can record task correlation metadata, send success for approved
-decisions, send failure for rejected decisions, and mark tasks expired or
-cancelled. It does not build approval UI, send email, decide policy, verify
-approvers, or own production auth.
-
-Hosts should store task tokens securely. AICF task records store token hashes,
-not raw task tokens.
+The adapter can record task correlation metadata, send success for approved decisions,
+send failure for rejected decisions, and mark tasks expired or cancelled. It does not
+build approval UI, send email, decide policy, verify approvers, or own production auth.
 
+Hosts should store task tokens securely. AICF task records store token hashes, not raw
+task tokens.

package/docs/aws-runtime.md

@@ -1,7 +1,7 @@
 # AWS Runtime Reference
 
-AICF AWS support is an optional reference integration for host applications that
-already run durable runtime state or approval workflows on AWS.
+AICF AWS support is an optional reference integration for host applications that already
+run durable runtime state or approval workflows on AWS.
 
 Import AWS APIs from:
 
@@ -16,14 +16,14 @@ import {
 The package root, `ai-capability-framework/runtime`, and
 `ai-capability-framework/openai` do not import AWS SDK modules.
 
-The AWS subpath itself can be imported in a clean install without AWS SDK
-packages. DynamoDB, Step Functions, and EventBridge operations dynamically
-require the relevant optional AWS SDK peer only when those operations run.
+The AWS subpath itself can be imported in a clean install without AWS SDK packages.
+DynamoDB, Step Functions, and EventBridge operations dynamically require the relevant
+optional AWS SDK peer only when those operations run.
 
 ## DynamoDB Stores
 
-The AWS subpath provides DynamoDB implementations for runtime, audit, controls,
-and control-plane state:
+The AWS subpath provides DynamoDB implementations for runtime, audit, controls, and
+control-plane state:
 
 - `DynamoDbPreparedActionStore`
 - `DynamoDbApprovalStore`
@@ -48,13 +48,13 @@ const preparedActionStore = new DynamoDbPreparedActionStore({
 ```
 
 The reference shape uses one table with `PK` and `SK`, lookup index fields, a
-`schemaVersion`, an `entityType`, timestamps, and optional `ttlEpochSeconds`.
-Prepared actions are partitioned by tenant and account. Approval and
-idempotency records use runtime metadata added by the lifecycle manager so the
-existing store interfaces do not need AWS-specific arguments.
+`schemaVersion`, an `entityType`, timestamps, and optional `ttlEpochSeconds`. Prepared
+actions are partitioned by tenant and account. Approval and idempotency records use
+runtime metadata added by the lifecycle manager so the existing store interfaces do not
+need AWS-specific arguments.
 
-Prepared action payloads store redacted args and public runtime summaries, not
-raw user prompts, provider payloads, or private traces.
+Prepared action payloads store redacted args and public runtime summaries, not raw user
+prompts, provider payloads, or private traces.
 
 See [DynamoDB single-table shape](aws/dynamodb-single-table.md) for the
 production-reference item model.
@@ -75,17 +75,16 @@ await approvals.startApproval({
 });
 ```
 
-The adapter sends safe prepared-action summaries to Step Functions. It does not
-build approval screens, send notifications, own identity, verify approvers, or
-decide policy. Host applications remain responsible for approval UI, auth,
-workflow definitions, and task-token handling.
+The adapter sends safe prepared-action summaries to Step Functions. It does not build
+approval screens, send notifications, own identity, verify approvers, or decide policy.
+Host applications remain responsible for approval UI, auth, workflow definitions, and
+task-token handling.
 
 See [Step Functions approval handoff](aws/step-functions-approval.md).
 
 ## EventBridge Publishing
 
-`EventBridgeRuntimeEventPublisher` publishes sanitized AICF trace or audit
-events:
+`EventBridgeRuntimeEventPublisher` publishes sanitized AICF trace or audit events:
 
 ```ts
 const publisher = new EventBridgeRuntimeEventPublisher({
@@ -97,8 +96,8 @@ await publisher.publish(event);
 ```
 
 Trace content is emitted in metadata mode by default. Raw prompts, raw provider
-payloads, secrets, tokens, cookies, and payment data should not be included in
-runtime events.
+payloads, secrets, tokens, cookies, and payment data should not be included in runtime
+events.
 
 `CloudWatchTelemetryPublisher` and `KmsRedactionProvider` are also available for
 sanitized AWS telemetry and deterministic redaction refs. See
@@ -108,8 +107,8 @@ sanitized AWS telemetry and deterministic redaction refs. See
 ## Production Reference
 
 The full AWS production-reference guide is in
-[docs/aws/production-reference.md](aws/production-reference.md). DynamoDB is the
-only durable database adapter implemented for v1; RDS is deferred.
+[docs/aws/production-reference.md](aws/production-reference.md). DynamoDB is the only
+durable database adapter implemented for v1; RDS is deferred.
 
 ## Testing
 
@@ -119,5 +118,5 @@ The AWS subpath exports fake clients for deterministic tests:
 - `FakeStepFunctionsClient`
 - `FakeEventBridgeClient`
 
-Default package tests use these fakes only. No AWS credentials, network calls,
-CDK, CloudFormation, Terraform, or live AWS resources are required.
+Default package tests use these fakes only. No AWS credentials, network calls, CDK,
+CloudFormation, Terraform, or live AWS resources are required.

package/docs/capability-manifests.md

@@ -1,7 +1,7 @@
 # Capability Manifests
 
-A capability manifest is the contract between model-facing intent and
-application-owned execution.
+A capability manifest is the contract between model-facing intent and application-owned
+execution.
 
 See [the 1.0 spec](spec.md) for the shared vocabulary.
 
@@ -12,36 +12,32 @@ See [the 1.0 spec](spec.md) for the shared vocabulary.
 - `version`: Semantic version for the capability contract.
 - `status`: Lifecycle state such as `draft`, `active`, or `deprecated`.
 - `name` and `summary`: Human-readable labels for operators and maintainers.
-- `model_description`: Short model-facing description of when to use the
-  capability.
-- `capability_type`: The broad action class, such as read, compute, prepare, or
-  commit.
+- `model_description`: Short model-facing description of when to use the capability.
+- `capability_type`: The broad action class, such as read, compute, prepare, or commit.
 - `autonomy_tier`: Maximum autonomy level allowed for the capability.
 - `risk_tier`: Safety and business risk tier.
 - `input_schema` and `output_schema`: JSON Schema contracts.
-- `side_effects`: Explicit flags for data reads, writes, money movement,
-  external messages, permission changes, and irreversible actions.
+- `side_effects`: Explicit flags for data reads, writes, money movement, external
+  messages, permission changes, and irreversible actions.
 - `authorization`: Required permissions and scoping rules.
 - `policy`: Deny, approval, and review rules.
-- `lifecycle`: Explicit prepare, preview, approve, commit, verify, and audit
-  flags.
+- `lifecycle`: Explicit prepare, preview, approve, commit, verify, and audit flags.
 - `idempotency`: Optional commit idempotency requirements.
 - `observability`: Logging and trace expectations.
 
 ## Lifecycle Guidance
 
-Use `write_prepare_only` for capabilities that assemble a proposed action but do
-not execute it. Use `write_commit` only when the application can enforce
-authorization, idempotency, approval state, verification, and audit.
+Use `write_prepare_only` for capabilities that assemble a proposed action but do not
+execute it. Use `write_commit` only when the application can enforce authorization,
+idempotency, approval state, verification, and audit.
 
 High-risk capabilities should require explicit approval before commit. Critical
-capabilities should usually be split into separate prepare and commit
-capabilities.
+capabilities should usually be split into separate prepare and commit capabilities.
 
-Commit capabilities should be excluded from normal model tool sets until
-application code has verified approval and idempotency state.
+Commit capabilities should be excluded from normal model tool sets until application
+code has verified approval and idempotency state.
 
-AICF tooling loads and validates capability manifests, builds registries,
-evaluates deterministic select, prepare, and commit decisions, exports adapter
-metadata, and scores eval fixtures. It does not execute capabilities, persist
-actions, collect approvals, or perform side effects.
+AICF tooling loads and validates capability manifests, builds registries, evaluates
+deterministic select, prepare, and commit decisions, exports adapter metadata, and
+scores eval fixtures. It does not execute capabilities, persist actions, collect
+approvals, or perform side effects.

package/docs/control-plane/overview.md

@@ -10,5 +10,5 @@ Read:
 - [Governance gate](../governance/gate.md)
 - [Evidence export](../evidence.md)
 
-The reference app does not provide production auth, production persistence,
-hosted SaaS behavior, model calls, or side-effect execution.
+The reference app does not provide production auth, production persistence, hosted SaaS
+behavior, model calls, or side-effect execution.

package/docs/control-plane.md

@@ -1,14 +1,13 @@
 # Control Plane
 
-The AICF control plane is an optional self-hostable review surface for
-capabilities and their runtime evidence. It is for local or host-owned
-governance workflows, not a hosted SaaS dashboard.
+The AICF control plane is an optional self-hostable review surface for capabilities and
+their runtime evidence. It is for local or host-owned governance workflows, not a hosted
+SaaS dashboard.
 
-The control plane does not call models, run provider SDKs, execute handlers,
-commit side effects, enforce production auth, or provide durable production
-storage. Host applications must supply real authentication, tenant/account
-authorization, approval identity, storage, retention, and side-effect
-execution.
+The control plane does not call models, run provider SDKs, execute handlers, commit side
+effects, enforce production auth, or provide durable production storage. Host
+applications must supply real authentication, tenant/account authorization, approval
+identity, storage, retention, and side-effect execution.
 
 ## What It Reviews
 
@@ -24,10 +23,10 @@ The control plane composes existing AICF evidence:
 - redacted replay metadata;
 - evidence exports made only from summaries, hashes, and redacted refs.
 
-It must not display raw prompts, raw provider payloads, raw transcripts,
-secrets, stack traces, tenant IDs, account IDs, or sensitive tool outputs.
-The evidence endpoint preserves the control-plane response shape and also
-includes the canonical evidence pack documented in [Evidence export](evidence.md).
+It must not display raw prompts, raw provider payloads, raw transcripts, secrets, stack
+traces, tenant IDs, account IDs, or sensitive tool outputs. The evidence endpoint
+preserves the control-plane response shape and also includes the canonical evidence pack
+documented in [Evidence export](evidence.md).
 
 ## TypeScript
 
@@ -56,9 +55,9 @@ const response = await routeControlPlaneRequest({
 });
 ```
 
-`routeControlPlaneRequest()` returns a JSON-serializable response with
-`status`, `headers`, and `body`. It does not start a server. Bind it to Express,
-Fastify, a Node HTTP server, a worker, or another host-owned transport.
+`routeControlPlaneRequest()` returns a JSON-serializable response with `status`,
+`headers`, and `body`. It does not start a server. Bind it to Express, Fastify, a Node
+HTTP server, a worker, or another host-owned transport.
 
 ## Local Reference App
 
@@ -71,9 +70,9 @@ node examples/control-plane/server.mjs
 
 Then open `http://localhost:4127`.
 
-The example uses a tracked synthetic seed fixture and writes local mutable state
-to `.aicf/control-plane-state.json`, which is ignored. It uses a fake local dev
-operator only to demonstrate approve/reject and kill-switch interactions.
+The example uses a tracked synthetic seed fixture and writes local mutable state to
+`.aicf/control-plane-state.json`, which is ignored. It uses a fake local dev operator
+only to demonstrate approve/reject and kill-switch interactions.
 
 ## API Paths
 
@@ -113,14 +112,12 @@ Stack traces and private diagnostics are not returned.
 `InMemoryControlPlaneStore` is for tests and examples.
 
 `FileControlPlaneStore` is for local development. It defaults to
-`.aicf/control-plane-state.json` and should not be used as production durable
-storage.
+`.aicf/control-plane-state.json` and should not be used as production durable storage.
 
-Production hosts can wire `DynamoDbControlPlaneStore` from
-`ai-capability-framework/aws` to the same service/router API when they want AWS
-backed audit, controls, approval, and replay metadata. The AWS adapter remains
-optional and does not provide production auth, deployment, tenant enforcement,
-or evidence retention policy.
+Production hosts can wire `DynamoDbControlPlaneStore` from `ai-capability-framework/aws`
+to the same service/router API when they want AWS backed audit, controls, approval, and
+replay metadata. The AWS adapter remains optional and does not provide production auth,
+deployment, tenant enforcement, or evidence retention policy.
 
-Production hosts should implement `AicfControlPlaneStore` with their own
-authorization, audit, retention, and tenant isolation.
+Production hosts should implement `AicfControlPlaneStore` with their own authorization,
+audit, retention, and tenant isolation.