arcane-os 0.65.0 → 0.66.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 0.66.0
+
+- Add `readGitIdentity` from `arcane-os/core/repositories` for separate global,
+  repository-local and effective Git configuration observations. Preserve full
+  name/email/githubUser values, empty versus unset fields, configured includes,
+  joined cancellation and complete process/observer failures.
+- Add optional construction-time `gitIdentity: {name, email, username}` to
+  repository workspaces and bare text snapshots. Explicit author fields apply
+  only to child Git configuration/environment; omitted fields retain ordinary
+  inheritance. Username is a credential hint, not authenticated-account proof.
+- Preserve complete selected text, existing clone/pull/commit/push behavior,
+  ordered workspace operations and shared snapshot acquisition. No Git config
+  file, remote, credentials, application preferences or data is rewritten.
+- Preserve original process errors when an observer failure is already included,
+  and report non-UTF-8 Git identity output with its complete raw diagnostics
+  instead of returning substituted identity text.
+- Honor an explicit browser decision `dtype` while preserving the existing
+  Laya FP16 and Julia FP32 defaults. Share the complete tensor-record preparation
+  with the separately developing native owner; this does not deliver native Laya.
+- Keep the dependency tree unchanged. Native Laya and target-bound repository
+  publication remain separate work. Retained compatible native assets continue
+  to use matching numeric-release routes; optional NPU upload follow-through
+  remains separately tracked.
+
 ## 0.65.0
 
 - Add optional precompiled Windows x64 Intel NPU encoding for native Whisper

package/README.md

@@ -20,7 +20,7 @@ selected SDK projection or an explicit live SDK source mount. Both profiles
 share the theme, packaging, event, cancellation,
 and browser run contracts while retaining their selected application layout.
 
-This checkout defines the `0.65.0` SDK contract. Development applications declare
+This checkout defines the `0.66.0` SDK contract. Development applications declare
 `arcane-os` as `latest` and retain their lockfile. Exact SDK pins begin when Roshi
 designates a production build. Follow [Consumer updates](docs/consumer-updates.md)
 to refresh and compare the installed SDK and lockfile with the published channel;

package/browser-runtime/ai/browser-decisions.mjs

@@ -74,7 +74,8 @@ class BrowserDecisionModel {
     #error = null;
     #disposed = false;
 
-    constructor({family, model, revision = 'main', device = 'webgpu', runtime = {}} = {}) {
+    constructor({family, model, revision = 'main', device = 'webgpu',
+        dtype = family === 'laya' ? 'fp16' : 'fp32', runtime = {}} = {}) {
         if (family !== 'laya' && family !== 'julia') {
             throw new TypeError('family must be "laya" or "julia".');
         }
@@ -89,7 +90,7 @@ class BrowserDecisionModel {
             model: requiredText(model, 'model'),
             revision: requiredText(revision, 'revision'),
             device: requiredText(device, 'device'),
-            dtype: family === 'laya' ? 'fp16' : 'fp32',
+            dtype: requiredText(dtype, 'dtype'),
             runtime: {...runtime, moduleUrl: requiredText(moduleUrl, 'runtime.moduleUrl')}
         };
         this.#events = createArcaneEventSource(

package/browser-runtime/ai/decision-runtime.mjs

@@ -82,7 +82,8 @@ export function encodeDecisionRows(tokenizer, rows, family) {
     return {encoded, pad};
 }
 
-function decisionInputs(Tensor, encoded, pad) {
+/** Plain tensor records shared by browser and native ONNX execution owners. */
+export function createDecisionInputs(encoded, pad) {
     let sequenceLength = 0;
     let optionCount = 0;
     for (const row of encoded) {
@@ -108,26 +109,11 @@ function decisionInputs(Tensor, encoded, pad) {
         types[rowIndex] = BigInt(row.qtype);
     }
     return {
-        input_ids: new Tensor(
-            'int64', ids,
-            [batch, sequenceLength]
-        ),
-        attention_mask: new Tensor(
-            'int64', attention,
-            [batch, sequenceLength]
-        ),
-        marker_pos: new Tensor(
-            'int64', positions,
-            [batch, optionCount]
-        ),
-        marker_mask: new Tensor(
-            'bool', mask,
-            [batch, optionCount]
-        ),
-        qtype: new Tensor(
-            'int64', types,
-            [batch]
-        )
+        input_ids: {type: 'int64', data: ids, dims: [batch, sequenceLength]},
+        attention_mask: {type: 'int64', data: attention, dims: [batch, sequenceLength]},
+        marker_pos: {type: 'int64', data: positions, dims: [batch, optionCount]},
+        marker_mask: {type: 'bool', data: mask, dims: [batch, optionCount]},
+        qtype: {type: 'int64', data: types, dims: [batch]}
     };
 }
 
@@ -210,7 +196,8 @@ export function decodeDecisionOutputs(rows, outputs) {
 }
 
 export async function loadDecisionRuntime(configuration, report) {
-    const {family, model: repository, revision = 'main', device = 'webgpu', runtime} = configuration;
+    const {family, model: repository, revision = 'main', device = 'webgpu',
+        dtype = family === 'laya' ? 'fp16' : 'fp32', runtime} = configuration;
     report(
         {phase: 'loading-runtime'}
     );
@@ -219,7 +206,7 @@ export async function loadDecisionRuntime(configuration, report) {
         namespace.env.backends.onnx.wasm.wasmPaths = runtime.wasmPaths;
     }
     const {AutoTokenizer, AutoModel, PreTrainedModel, Tensor} = namespace;
-    const options = {revision, device, dtype: family === 'laya' ? 'fp16' : 'fp32'};
+    const options = {revision, device, dtype};
     // No progress_callback: upstream 4.3 otherwise performs file-size
     // aggregation. This owner reports actual semantic lifecycle transitions.
     report(
@@ -261,7 +248,10 @@ export async function loadDecisionRuntime(configuration, report) {
     async function evaluate(rows) {
         const {encoded, pad} = encodeDecisionRows(tokenizer, rows, family);
         if (encoded.length === 0) return {decisions: [], outputs: {}};
-        const inputs = decisionInputs(Tensor, encoded, pad);
+        const inputs = {};
+        for (const [name, record] of Object.entries(createDecisionInputs(encoded, pad))) {
+            inputs[name] = new Tensor(record.type, record.data, record.dims);
+        }
         let output;
         try {
             output = await model(inputs);

package/docs/publishing.md

@@ -116,6 +116,45 @@ tag and GitHub release title must both be the same bare numeric
 `MAJOR.MINOR.PATCH`. Prerelease versions do not get a misleading numeric
 GitHub release, and no release creates a Git branch for an npm dist-tag.
 
+## Native runtime assets on numeric releases
+
+Default SDK-hosted native asset URLs use the installed SDK's version and its
+matching numeric GitHub release. Publishing npm alone does not make those
+downloads available. Every applicable numeric release therefore includes its
+compatible retained SDK-hosted assets as release follow-through:
+
+| Selected capability | Windows x64 release asset |
+| --- | --- |
+| Native application host | `arcane-native-windows-x64.tar.gz` |
+| Ordinary native Whisper helper | `arcane-whisper-windows-x64.tar.gz` |
+| Optional Intel NPU Whisper encoder | `arcane-whisper-openvino-windows-x64.tar.gz` |
+
+Attach each asset used by the selected package's default SDK-hosted download
+paths, including later releases whose native implementation is unchanged.
+Include the optional NPU asset when that release supplies `encoder:
+"openvino-npu"`; applications still opt in, and the ordinary Whisper asset
+remains available. Upstream runtime and model versions retain their separate
+upstream distribution URLs; they are not renamed to the SDK version.
+
+Reuse the producer's retained compatible archive and its recorded selected
+evidence. Do not rebuild or redownload an unchanged archive for each release.
+An actual native change belongs to its producer under the existing build and
+dependency authority. Preserve the complete runtime closure and its packaging
+notices together. Models continue through their upstream acquisition path
+unless their redistribution is separately requested.
+
+The release owner assigns each upload, observes its outcome and records the
+exact asset name and public release URL in the durable release handoff. If an
+upload result is uncertain, inspect that release's existing asset before
+retrying. Retain the exact pending operation, executing owner and last result
+until delivery finishes; reassign idle delegated work rather than treating
+delegation as completion.
+
+Source delivery, selected package verification, npm publication, native asset
+delivery, requester notices and documentation/site delivery are distinct.
+Native archive follow-through does not gate npm publication or require a new
+package build. Consumer adoption remains with each application owner.
+
 ## Documentation publication
 
 After every successful npm release and its applicable requester notices, the

package/docs/reference/README.md

@@ -54,18 +54,23 @@ alone does not make bare module names resolve in a browser.
 | Connect a browser to one Core transport | [Core browser client](core-client.md) |
 | Cancel one Core speech synthesis request without changing its payload | [Speech request lifetime](core-client.md#events-and-request-lifetime) and [Core facade](sdk-api.md#createcorefacade) |
 | Compose native Core dispatch, service lifecycle, and stdio hosting | [Native Core runtime](core-runtime.md) |
+| Compose application Core services during source development, independently of local AI | [Development Core services](core-development.md) |
+| Own an explicitly selected native Codex App Server session | [Codex App Server](codex-app-server.md) |
+| Expose application-owned tools and static resources through Node STDIO | [MCP STDIO server](mcp-stdio.md) |
 | Run application-selected llama.cpp, Ollama or ONNX through Core | [Local AI through Core](local-ai.md) |
 | Generate complete local PNG images with a retained native model | [Local image generation](local-image-generation.md) |
 | Select FLUX.2 Klein 4B and its three complementary model resources | [FLUX.2 Klein 4B through Core](local-image-flux.md) |
 | Select the complete SDXL Base 1.0 checkpoint for text-to-image generation | [SDXL Base 1.0 through Core](local-image-sdxl.md) |
 | Compose independently loaded transcription and synthesis engines | [Native speech service](native-speech.md) |
 | Keep a native Whisper model loaded across complete recordings | [Native Whisper transcription](local-whisper.md) |
+| Select the optional Intel NPU encoder with independent CUDA or CPU decoding | [Intel NPU Whisper](../guides/native-whisper-openvino.md) |
 | Edit an original PNG with a complete prompt and explicit strength | [Local image editing](local-image-editing.md) |
 | Project complete stored model files into native working files | [Model assets through Core](model-assets.md) |
 | Retain a Nemotron model and diarize caller-fed audio streams | [Native speaker diarization](diarization.md) |
 | Persist application-selected preferences through Core | [Core preferences service](core-preferences.md) |
 | Read complete selected Git text without changing a checkout | [Git text snapshots](git-text-snapshot.md) |
 | Own a native working checkout under per-user ArcaneData/Repos | [Native repository workspaces](core-repositories.md) |
+| Write, commit and push complete selected repository text | [Selected-text repository writing](core-repositories.md#write-commit-and-push-selected-text) |
 | Build an installed-SDK portable Core payload | [Portable Core packaging](core-native-packaging.md) |
 | Pass host-selected state defaults and unchanged explicit launch values to services | [Launch-time locations](core-native-packaging.md#launch-time-locations) |
 | Build a Windows executable without an OS checkout | [Windows executable packaging](core-native-packaging.md#windows-executable) |
@@ -142,7 +147,8 @@ node tools/build-reference-site.mjs --write --source-ref <documentation-commit>
 
 The same option is accepted by `createReferenceSite({sourceRef})` and
 `writeReferenceSite({sourceRef})`. It reads the selected commit's package
-version, complete reference documents and inventories, inventory-selected
+version, complete reference documents and inventories, the canonical
+`docs/guides/native-whisper-openvino.md` guide when present, inventory-selected
 runtime sources, and authored site inputs directly from Git in memory. It
 creates no checkout or export and leaves source drafts untouched. Rendering
 uses the current canonical generator and its authored semantic contracts;

package/docs/reference/ai/browser-decisions.md

@@ -1,7 +1,8 @@
 # Browser typed decisions
 
-`arcane-os/ai/browser-decisions` owns browser-local Laya typed-decisions FP16
-and Julia-1 FP32 inference. It is separate from chat and speech because these
+`arcane-os/ai/browser-decisions` owns browser-local Laya typed decisions
+and Julia-1 inference. Laya defaults to FP16 and Julia to FP32; an explicit
+`dtype` is forwarded unchanged to the selected upstream loader. It is separate from chat and speech because these
 models score caller-supplied options instead of generating conversational text.
 Applications supply the model repository, state, questions, option meanings and
 policy; the SDK owns the reusable tokenizer, tensors, inference and lifecycle.
@@ -66,6 +67,7 @@ it does not substitute a quantized graph or another model.
 | `model` | Required upstream repository/base URL accepted by Transformers.js. The application owns its selection. |
 | `revision` | Upstream revision, default `main`; select a stable revision when repeatable model selection is needed. |
 | `device` | Transformers.js backend, default `webgpu`; an explicit supported alternative is caller-owned. No automatic backend fallback. |
+| `dtype` | Exact upstream precision selection; defaults to `fp16` for Laya and `fp32` for Julia. For Laya FP32, supply `dtype: 'fp32'`. Unsupported selections fail at the selected upstream loader rather than being replaced. |
 | `runtime.moduleUrl` | Defaults to the self-contained CDN entry `https://cdn.jsdelivr.net/npm/@huggingface/transformers@4.3.0/dist/transformers.min.js`. The `.web.js` build expects a bundler to resolve its bare ONNX Runtime import and is unsuitable for a native module Worker. An explicit compatible public runtime URL may be supplied. |
 | `runtime.wasmPaths` | Optional upstream ONNX WASM location passed to the selected runtime's public environment API. |
 
@@ -75,10 +77,11 @@ network, cross-origin and backend availability still apply. WebGPU needs a
 compatible browser/device context. Unsupported precision or backend errors
 are returned, not replaced with a different model, backend or precision.
 
-Laya selects `dtype: 'fp16'`, loading `onnx/model_fp16.onnx` and its
+Laya defaults to `dtype: 'fp16'`, loading `onnx/model_fp16.onnx` and its
 `model_fp16.onnx_data` companion through Transformers.js. The published mixed
 precision graph retains selected operations/outputs in FP32; FP16 selection
-does not claim every graph operation runs in half precision.
+does not claim every graph operation runs in half precision. Explicit
+`dtype: 'fp32'` selects the repository's FP32 graph through that same loader.
 
 Julia selects `dtype: 'fp32'`, loading root `model.onnx` with the exact
 `model.onnx.data` external-data name. Its custom five-input graph is loaded

package/docs/reference/core-repositories.md

@@ -46,7 +46,7 @@ const status = await repository.status({signal});
 await repository.close();
 ```
 
-`createRepositoryWorkspace({name,directory,dataRoot,remote,branch,onEvent,run}={})`
+`createRepositoryWorkspace({name,directory,dataRoot,remote,branch,gitIdentity,onEvent,run}={})`
 returns `{directory,open,status,pull,push,write,close,drain,dispose}`. The `directory`
 property is the absolute selected working path.
 
@@ -87,6 +87,124 @@ A failed or cancelled clone reports the actual failure; any remaining directory
 is retained for application-owned inspection. There is no automatic deletion or
 destructive retry. Filesystem failures and complete Git diagnostics propagate.
 
+## Git identity configuration
+
+```javascript
+import {readGitIdentity, createRepositoryWorkspace} from 'arcane-os/core/repositories';
+
+const defaults = await readGitIdentity({signal});
+const observations = await readGitIdentity({directory: existingRepositoryDirectory, signal});
+const repository = createRepositoryWorkspace({
+    name: 'moon-cheese-dispatches',
+    remote: applicationConnection.remote,
+    gitIdentity: {name: 'Moon Dispatcher', email: 'moon@example.invalid', username: 'moon-account'}
+});
+```
+
+`readGitIdentity({directory,signal,onEvent,run=runProcess}={})` reads only
+`user.name`, `user.email` and `github.user`. It returns:
+
+```text
+{
+    global: {name, email, githubUser},
+    local: {name, email, githubUser} | null,
+    effective: {name, email, githubUser} | null
+}
+```
+
+Every observed field is the complete UTF-8 Git configuration string, including
+an empty string, leading U+FEFF and embedded newlines, or `null` when unset.
+Git can store values outside UTF-8; those produce
+`ARCANE_GIT_IDENTITY_NOT_TEXT` instead of replacement characters. Global and
+local observations select Git's corresponding file scopes and honor configured
+includes. With an existing
+repository `directory`, `effective` reads ordinary Git configuration in that
+repository context, including system, global, local, worktree and command
+configuration where applicable. Equal local and global values remain separate
+observations; the SDK does not infer who wrote or owns a setting. The last
+configured scalar value wins within each observation.
+
+Without `directory`, only global configuration is read and `local`/`effective`
+are `null`. Relative directories resolve from the process working directory.
+Git retains its normal environment and conditional-include context; when no
+directory is supplied, that context is the process working directory. These
+are independent configuration observations, not a transaction or a claim about
+the identity of a prior commit, environment-derived author, or authenticated
+GitHub account. `github.user` is a non-secret configured default, not proof of
+authentication.
+
+One targeted Git command reads each requested scope. Independent observations
+start concurrently and all accepted commands finish their process cleanup
+before the reader settles. `signal` uses the existing process owner; the shared
+SDK event queue serializes `onEvent` delivery with its usual backpressure.
+The reader consumes raw stdout through the existing process contract; stdout
+is parsed as configuration rather than emitted as text events. Process
+lifecycle and stderr events retain their ordinary route. A supplied `run`
+adapter must honor that raw-output contract.
+Git's no-match result produces unset fields; other process,
+configuration, observer and cancellation failures remain complete. A single
+failure retains its original object, code, cause and process `details`; the
+reader adds complete captured stdout as the `rawStdout` Buffer on that error.
+If the error already has that property or cannot accept it, a new error retains
+the original as `cause`, preserves its code, process details and exit code, and
+holds this observation's `rawStdout`. Original causal failures stay on that
+original error; an attachment exception is retained as `attachmentError`.
+An existing `rawStdout` property is never overwritten or invoked to read its value.
+The process result's `stdout` remains `null` in raw mode, and its stderr and
+other diagnostics remain intact. A decoding failure likewise carries its
+original decoding `cause`, complete process `details` and `rawStdout`.
+An observer failure already represented by a process error is not added again;
+genuinely separate failures use `AggregateError.errors`, each retaining its
+own diagnostics.
+No configuration file is written and no credential helper is queried by this
+reader. The application owns any saved non-secret defaults and repository
+overrides through its existing preferences.
+
+Both this workspace factory and
+[`createGitTextSnapshot`](git-text-snapshot.md) accept optional
+`gitIdentity:{name?,email?,username?}`. They capture supplied strings once during
+I/O-free construction. Later edits to that object or a UI selection do not
+change accepted work. Omitted or `undefined` fields preserve ordinary inherited
+behavior; removing an application override means omitting that field on the
+next owner, not changing unmanaged repository configuration. Empty strings are
+passed explicitly to Git. Non-string values, NUL and text that cannot be
+represented by the native process transport report `TypeError` without silently
+rewriting the input.
+
+An application's explicit "global author" choice differs from ordinary Git
+inheritance. Pass the observed global `name` and `email` as selected strings to
+override repository-local author values for those fields. A global `null` means
+that field is unset, not a selected value: passing `null` reports `TypeError`,
+and omitting the field allows normal inheritance, including repository-local
+configuration. The application must describe that partial/inherited choice
+accurately or obtain the missing value before presenting an all-global author
+selection. An empty string is a distinct explicit value that Git may reject.
+Changed application choices apply to future owners; accepted operations retain
+their original selection and may finish without being discarded.
+
+Each supplied name/email becomes command-local `-c user.name=...` or
+`-c user.email=...` and the corresponding child-only `GIT_AUTHOR_*` and
+`GIT_COMMITTER_*` fields. Those selected fields take precedence over inherited
+author/committer settings and environment values; omitted fields, dates and
+unrelated environment remain inherited. Git retains its ordinary commit
+identity formatting and may reject an unusable identity. The SDK changes
+neither `process.env` nor global/local Git files.
+
+`username` supplies only command-local `credential.username`. Git's existing
+credential helper and remote protocol still own actual authentication. A
+URL-embedded username or helper behavior can affect the selected credential;
+this option neither rewrites the remote nor selects an SSH account or proves a
+GitHub login. No account enumeration, secret storage or `gh` dependency is added.
+See Git's [configuration](https://git-scm.com/docs/git-config),
+[author environment](https://git-scm.com/docs/git#_git_commits) and
+[credential username](https://git-scm.com/docs/gitcredentials) contracts.
+
+The selected settings accompany every workspace Git command, including clone,
+pull, commit and push, and every bare-snapshot Git command, including init and
+fetch. Existing arguments, content, output, errors, queue and cancellation
+semantics remain unchanged. Other repository helpers and CLI cwd defaults keep
+their existing behavior.
+
 ## Write, commit and push selected text
 
 ```javascript
@@ -122,8 +240,9 @@ One `git --literal-pathspecs add -- <paths>` stages only those exact names.
 One `git --literal-pathspecs commit --only --cleanup=verbatim --file - -- <paths>`
 commits only those paths, leaving unrelated staged paths staged. The original
 message is streamed unchanged through standard input. One ordinary `git push`
-then uses that repository's existing remote/ref configuration, identity,
-credentials and hooks. There is no implicit pull, branch switch, forced push,
+then uses that repository's existing remote/ref configuration, the optional
+process-local identity selection above, existing credentials and hooks.
+There is no implicit pull, branch switch, forced push,
 hook bypass, automatic retry, rollback or reset. If Git reports no changes to
 commit, that actual failure is returned; the SDK creates no empty commit.
 These are Git's documented [selected-path commit](https://git-scm.com/docs/git-commit#Documentation/git-commit.txt---only)

package/docs/reference/git-text-snapshot.md

@@ -33,12 +33,26 @@ policy stable for the lifetime of its snapshot owner.
 
 ## API and lifecycle
 
-`createGitTextSnapshot({cacheDirectory,remote,ref,selectPath,onEvent,run})`
+`createGitTextSnapshot({cacheDirectory,remote,ref,selectPath,gitIdentity,onEvent,run})`
 returns `{refresh,close,drain,dispose}`. `run` defaults to the SDK's existing
 `runProcess`; applications normally omit it. It is the same process adapter
 contract, not a second process supervisor. `onEvent` is the ordinary SDK event
 callback and follows its asynchronous completion/error contract.
 
+Optional `gitIdentity:{name?,email?,username?}` uses the shared
+[Git identity configuration contract](core-repositories.md#git-identity-configuration).
+Supplied strings are captured during construction and accompany every Git
+command, including bare initialization and fetch, without changing the remote,
+ref, config files or process environment. Explicit name/email use command-local
+configuration and child-only author/committer fields; omitted fields remain
+inherited. `username` is only Git's credential username hint, not authenticated
+account proof or SSH account selection. Read separate global/local/effective
+configuration through `readGitIdentity` from `arcane-os/core/repositories`;
+the reader also accepts an existing bare cache directory. Applications retain
+saved non-secret choices and per-connection overrides. Identity selection adds
+no process or query to refresh and does not attach a caller's abort to shared
+acquisition.
+
 - `refresh({signal}={})` fetches the selected ref and returns
   `{revision,files:[{path,content}]}`. `revision` is Git's opaque selected commit
   name, not an SDK integrity record. Every file comes from that exact revision,

package/docs/reference/inventory/package-api.json

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
-  "sdkVersion": "0.64.0",
+  "sdkVersion": "0.65.0",
   "environment": {
     "runtime": "Node.js for Node entrypoints; browser for browser-only entrypoints",
     "minimumVersion": "22.23.2 for Node entrypoints",
     "moduleSystem": "ESM"
   },
-  "memberCount": 288,
+  "memberCount": 290,
   "runtimeSubpathPatterns": {
     "arcane-os/modules/*": "./runtime/arcane/modules/*",
     "arcane-os/entities/*": "./runtime/arcane/entities/*"
@@ -54,6 +54,20 @@
       "protocol": "Owned configure/build/install process lifecycle",
       "normalization": "Returns platform/architecture/root/executable/runtimeDirectory and complete configure/compile/install diagnostics; preserves cancellation and process failures, installs no model or toolchain, performs no inference"
     },
+    {
+      "id": "local-ai-whisper-openvino-build:buildWhisperOpenVinoRuntime",
+      "name": "buildWhisperOpenVinoRuntime",
+      "displayName": "buildWhisperOpenVinoRuntime()",
+      "kind": "function",
+      "signature": "async buildWhisperOpenVinoRuntime({sourceDirectory,openvinoDirectory,cudaDirectory,outputRoot,cmake='cmake',generator,cmakeArgs=[],env,signal,onEvent}={})",
+      "entrypoints": ["arcane-os/local-ai/whisper/openvino-build"],
+      "primaryImport": "arcane-os/local-ai/whisper/openvino-build",
+      "group": "Core native speech",
+      "summary": "Produces the optional Intel NPU encoder runtime from installed matching Whisper/OpenVINO sources and an existing Windows x64 toolchain.",
+      "availability": "Windows x64 Node with Whisper 1.9.4 source, OpenVINO 2026.3.1 development tree and compatible CMake/MSVC; other platform distributions require separate native producers",
+      "protocol": "Owned configure/build process lifecycle and complete native runtime assembly",
+      "normalization": "Returns version/openvinoVersion/platform/architecture/encoder/backend/backends/root/directory/libraryDirectory/copied sourceDirectory and complete configure/compile diagnostics; retains NPU/CPU and optional supplied CUDA libraries plus notices, preserves process failures and cancellation, installs no model, driver or toolchain"
+    },
     {
       "id": "codex-app-server:createCodexAppServerSession",
       "name": "createCodexAppServerSession",
@@ -143,14 +157,28 @@
       "name": "createRepositoryWorkspace",
       "displayName": "createRepositoryWorkspace()",
       "kind": "function",
-      "signature": "createRepositoryWorkspace({name,directory,dataRoot,remote,branch,onEvent,run=runProcess}={})",
+      "signature": "createRepositoryWorkspace({name,directory,dataRoot,remote,branch,gitIdentity,onEvent,run=runProcess}={})",
       "entrypoints": ["arcane-os/core/repositories"],
       "primaryImport": "arcane-os/core/repositories",
       "group": "Native repository workspaces",
       "summary": "Owns one selected native working checkout with ArcaneData/Repos defaults and existing Git/process lifecycle.",
       "availability": "Node with Git on Windows, Linux and macOS; Android requires host process adaptation",
       "protocol": "Git working repository and SDK process adapter",
-      "normalization": "Returns directory, open, status, pull, push, write and identical close/drain/dispose hooks. Only missing or empty destinations clone; existing roots are inspected without rewriting, resetting or pulling. Explicit paths remain selected. Same-directory operations serialize within the process; cancellation and shutdown join accepted process work. write snapshots exact selected text and paths, writes files, stages/commits only literal owned paths and non-force pushes, preserving unrelated staged files and ordinary Git filters. Complete outputs and causal failures retain confirmed local/committed/pushed and uncertain outcomes."
+      "normalization": "Returns directory, open, status, pull, push, write and identical close/drain/dispose hooks. Only missing or empty destinations clone; existing roots are inspected without rewriting, resetting or pulling. Explicit paths remain selected. Same-directory operations serialize within the process; cancellation and shutdown join accepted process work. write snapshots exact selected text and paths, writes files, stages/commits only literal owned paths and non-force pushes, preserving unrelated staged files and ordinary Git filters. Complete outputs and causal failures retain confirmed local/committed/pushed and uncertain outcomes. Optional gitIdentity captures name/email/username for child Git operations only; omitted fields remain inherited and no config file is written."
+    },
+    {
+      "id": "core-repositories:readGitIdentity",
+      "name": "readGitIdentity",
+      "displayName": "readGitIdentity()",
+      "kind": "function",
+      "signature": "readGitIdentity({directory,signal,onEvent,run=runProcess}={})",
+      "entrypoints": ["arcane-os/core/repositories"],
+      "primaryImport": "arcane-os/core/repositories",
+      "group": "Native repository workspaces",
+      "summary": "Reads separate global, repository-local and effective non-secret Git identity configuration.",
+      "availability": "Node with Git on Windows, Linux and macOS; Android requires host process adaptation",
+      "protocol": "Git config NUL-delimited transport through the SDK process adapter",
+      "normalization": "Returns {global,local,effective} observations with complete name/email/githubUser strings or null when unset. Empty strings and configured includes are preserved. Without directory only global is observed and local/effective are null. Concurrent scope reads join process cleanup; complete failures propagate singly or through AggregateError. Changes no config files and claims no authenticated account or environment-resolved author."
     },
     {
       "id": "core-speech:createSpeechService",
@@ -311,14 +339,14 @@
       "name": "createGitTextSnapshot",
       "displayName": "createGitTextSnapshot()",
       "kind": "function",
-      "signature": "createGitTextSnapshot({cacheDirectory,remote,ref,selectPath,onEvent,run=runProcess}={})",
+      "signature": "createGitTextSnapshot({cacheDirectory,remote,ref,selectPath,gitIdentity,onEvent,run=runProcess}={})",
       "entrypoints": ["arcane-os"],
       "primaryImport": "arcane-os",
       "group": "Workspace, doctor, repository, and server",
       "summary": "Reads complete selected text from one fetched revision using a dedicated bare Git object cache and batched retrieval.",
       "availability": "Node with Git; Android requires a host supplying Git/process capability",
       "protocol": "Git tree and batched blob transport through the shared process owner",
-      "normalization": "Returns {refresh,close,drain,dispose}; refresh yields {revision,files:[{path,content}]}, shares concurrent work, reuses unchanged revisions, preserves exact UTF-8 text, isolates caller cancellation and drains accepted work. See git-text-snapshot.md."
+      "normalization": "Returns {refresh,close,drain,dispose}; refresh yields {revision,files:[{path,content}]}, shares concurrent work, reuses unchanged revisions, preserves exact UTF-8 text, isolates caller cancellation and drains accepted work. Optional gitIdentity captures name/email/username for child Git commands including bare init and fetch, without changing config files, payloads or shared acquisition lifetime. See git-text-snapshot.md."
     },
     {
       "id": "diarization:createDiarization",

package/docs/reference/inventory/runtime-modules.json

@@ -1013,13 +1013,14 @@
       "kind": "esm",
       "exports": [
         "isOllamaModelIdentifier",
-        "normalizeOllamaModelIdentifier"
+        "normalizeOllamaModelIdentifier",
+        "sameOllamaModelIdentifier"
       ],
-      "summary": "Validates and canonicalizes the syntax of Ollama model identifiers without granting model admission.",
+      "summary": "Recognizes Ollama model identifier syntax and compares ordinary resident-model aliases without changing requests.",
       "availability": "Cross-host",
       "protocol": "In-process only",
-      "normalization": "Fully normalized string/boolean result.",
-      "surface": "`normalizeOllamaModelIdentifier()`, `isOllamaModelIdentifier()`."
+      "normalization": "Exact identifier/null or boolean results; alias comparison applies Ollama's default registry, namespace and tag without changing either input.",
+      "surface": "`normalizeOllamaModelIdentifier()`, `isOllamaModelIdentifier()`, `sameOllamaModelIdentifier(left, right)`."
     },
     {
       "file": "runtime/arcane/modules/OllamaSettings.js",

package/docs/reference/local-ai.md

@@ -70,6 +70,13 @@ assembly compose it through the shared speech service without changing the
 browser's selected STT route. See [native Whisper](local-whisper.md) for the
 complete configuration, platform, media and shutdown contracts.
 
+Adding `encoder: 'openvino-npu'` selects the optional Intel NPU audio encoder
+with a separately selected CUDA or CPU decoder. The Windows x64 precompiled
+runtime uses paired GGML/XML/BIN model resources and the computer's installed
+compatible Intel NPU driver. See the [Intel NPU Whisper guide](../guides/native-whisper-openvino.md)
+for preparation, observed initialization, cancellation/reload and custom
+runtime production. Omitting the encoder retains ordinary Whisper preparation.
+
 The selected model stays loaded across recordings. An eligible native
 accelerated failure may drain that helper and retry the same complete recording
 once on the prepared CPU backend. That accepted request retains its actual

package/docs/reference/local-whisper.md

@@ -7,6 +7,12 @@ the model or recording files are reused. The browser's existing
 `AI.fetchSTT(audioFile, signal)` and Core `speech.transcribe` routes retain the
 application's selected model and cancellation signal.
 
+For the optional Intel NPU encoder, add `encoder: "openvino-npu"` to the
+runtime record. The [Intel NPU guide](../guides/native-whisper-openvino.md)
+covers the Windows x64 precompiled distribution, paired GGML/XML/BIN model
+resources, independent CUDA/CPU decoding and joined cancellation. Omitting
+`encoder` preserves the ordinary runtime and model selection below.
+
 ## Select the runtime and model
 
 An application's `arcane-app.json` selects native speech alongside its other
@@ -130,7 +136,7 @@ prepared descriptor returned by `ensureLocalAIRuntimes`; alternatively,
 
 | Member | Contract |
 | --- | --- |
-| `current()` | Returns `providerId`, selected `modelId`, lifecycle `state`, `loaded`, `busy`, correlated `requestId` or null, requested/observed backend, evidence and any error. |
+| `current()` | Returns `providerId`, selected `modelId`, lifecycle `state`, `loaded`, `busy`, correlated `requestId` or null, `requestedBackend`, `observedBackend`, `backendEvidence`, `requestedEncoder`, `observedEncoder`, `encoderEvidence` and any error. Encoder initialization evidence is separate from decoder evidence. |
 | `subscribe(listener, {replay = true, signal} = {})` | Immediately replays current state by default and returns an unsubscribe function. |
 | `load({modelId, signal} = {})` | Prepares the runtime if necessary, then waits for actual native model readiness. With no selected model it remains unloaded. |
 | `transcribe(request, {signal, onProgress, requestId} = {})` | Consumes the complete `audioBase64` recording. Optional `language` defaults to native automatic detection; `translate: true` selects Whisper's translation operation. `model` must match the loaded model. Optional `requestId` carries the caller's existing operation identity through lifecycle snapshots as separate control information; it does not alter the recording or request payload. |

package/docs/reference/mcp-stdio.md

@@ -216,7 +216,7 @@ normal close or EOF and rejects with an `AggregateError` when transport or
 diagnostic delivery failed. Observe it even when the initiating caller continues
 other work. Request failures alone do not close the session.
 
-## MCP_PROTOCOL_VERSION
+## `MCP_PROTOCOL_VERSION`
 
 `MCP_PROTOCOL_VERSION` is exactly `'2025-11-25'`. Initialization always returns
 that supported version. A client proposing another version must accept this

package/docs/reference/native-speech.md

@@ -26,6 +26,12 @@ selection, supported formats, and native process ownership remain with the
 selected engine and its host composition. Browser-only operation remains
 independent of this native service.
 
+The SDK's [retained Whisper engine](local-whisper.md) supplies native STT.
+Its optional [Intel NPU encoder](../guides/native-whisper-openvino.md) uses the
+same service, readiness events, complete request/result contract and cancellation
+path. The host selects that encoder and its paired model resources; the browser
+continues calling `speech.transcribe` without loading native libraries itself.
+
 ## Startup and status
 
 `start(context)` subscribes to each configured engine and starts their loads

package/docs/reference/sdk-api.md

@@ -60,7 +60,7 @@ runtime layouts.
 | `arcane-os/core/host` | Node-only reusable Core host lifecycle with explicitly supplied services. |
 | `arcane-os/codex/app-server` | Explicit native Codex App Server session, complete live turns, server requests and recovery. |
 | `arcane-os/mcp/stdio` | Node MCP STDIO server for app-owned tools and static resources. |
-| `arcane-os/core/repositories` | Native persistent ArcaneData paths and explicitly selected connected working repositories. |
+| `arcane-os/core/repositories` | Native persistent ArcaneData paths, connected working repositories and scoped non-secret Git identity configuration. |
 | `arcane-os/core/packaged-web` | Core-owned packaged web listener with a persisted loopback origin and ready/failure events. |
 | `arcane-os/core/preferences` | Existing preference RPC methods with an application-selected file, ordered writes and owned drain. |
 | `arcane-os/core/diarization` | Lazy native speaker-diarization service, explicit stream methods and lifecycle/result events. |
@@ -74,6 +74,9 @@ runtime layouts.
 | `arcane-os/ai/core-image` | Browser image lifecycle and complete PNG Blobs through an available Core service. |
 | `arcane-os/core/image` | Native image Core service with independent runtime preparation and retained model ownership. |
 | `arcane-os/core/speech` | Independent injected STT/TTS engine loading, request cancellation and joined Core service lifetime. |
+| `arcane-os/local-ai/whisper` | Retained native Whisper model, complete recordings and joined helper lifetime. |
+| `arcane-os/local-ai/whisper/build` | First-party persistent helper build against selected installed Whisper headers and libraries. |
+| `arcane-os/local-ai/whisper/openvino-build` | Optional Windows x64 Intel NPU encoder runtime producer using selected installed sources and toolchain. |
 | `arcane-os/ai/core-model-assets` | Complete stored browser model members projected through Core into native working files. |
 | `arcane-os/core/model-assets` | Native working-file preparation, engine retain handles and joined cleanup. |
 | `arcane-os/integrated-provider` | Fixed integrated shared-development provider. |
@@ -405,6 +408,7 @@ The remaining data-only subpaths are eight JSON Schemas and package metadata.
 | `readCoreLaunchContext()` | function | `arcane-os/core/host` | Native Core host composition | Node; reads explicitly selected launch JSON |
 | `resolveArcaneDataPaths()` | function | `arcane-os/core/repositories` | Native repository workspaces | Node on Windows, Linux and macOS; Android supplies its data root |
 | `createRepositoryWorkspace()` | function | `arcane-os/core/repositories` | Native repository workspaces | Node with Git; Android requires host process adaptation |
+| `readGitIdentity()` | function | `arcane-os/core/repositories` | Native repository workspaces | Node with Git; Android requires host process adaptation |
 | `createWindowsNativeProvider()` | function | `arcane-os/native/windows-provider` | Windows native provider | Node assembly; Windows x64/WebView2 execution |
 | `arcaneNativeBuilderProvider` | singleton | `arcane-os/native/windows-provider` | Windows native provider | Node assembly; Windows x64/WebView2 execution |
 | `arcaneNativeBuilderProvider default export` | singleton | `arcane-os/native/windows-provider` | Windows native provider | Node assembly; Windows x64/WebView2 execution |
@@ -430,6 +434,7 @@ The remaining data-only subpaths are eight JSON Schemas and package metadata.
 | `createWhisperRuntime()` | function | `arcane-os/local-ai/whisper` | Core native speech | Node with a prepared matching helper, runtime, decoder and selected model |
 | `createWhisperRuntime default export` | function | `arcane-os/local-ai/whisper` | Core native speech | Same retained native engine factory |
 | `buildWhisperHelper()` | function | `arcane-os/local-ai/whisper/build` | Core native speech | Node with installed CMake/C++17 toolchain and matching Whisper source/runtime |
+| `buildWhisperOpenVinoRuntime()` | function | `arcane-os/local-ai/whisper/openvino-build` | Core native speech | Windows x64 Node with installed matching Whisper/OpenVINO sources and CMake/MSVC toolchain |
 | `createSpeechService default export` | function | `arcane-os/core/speech` | Core native speech | Same shared speech service factory |
 | `prepareCoreModelAssets()` | function | `arcane-os/ai/core-model-assets` | Core model assets | Browser with complete Blob/File members and available Core service |
 | `createModelAssetService()` | function | `arcane-os/core/model-assets` | Core model assets | Node Core with an application-selected working directory |
@@ -5209,7 +5214,7 @@ a dedicated bare Git cache. It does not create or alter a working checkout.
 ### Signature, lifecycle, and result
 
 ```text
-createGitTextSnapshot({cacheDirectory,remote,ref,selectPath,onEvent,run=runProcess}={})
+createGitTextSnapshot({cacheDirectory,remote,ref,selectPath,gitIdentity,onEvent,run=runProcess}={})
 ```
 
 Import from `arcane-os`. The application owns the cache location, remote, ref,
@@ -5221,6 +5226,11 @@ await accepted refresh/process cleanup. Errors remain observable instead of
 returning stale or partial success. See [Git text snapshots](git-text-snapshot.md)
 for complete inputs, text semantics, errors, events and Core service composition.
 
+Optional `gitIdentity:{name?,email?,username?}` captures a child-process-only
+selection for init/fetch and subsequent Git commands, preserving shared refresh
+cancellation and complete content. See [Git identity configuration](core-repositories.md#git-identity-configuration)
+for author precedence, scoped defaults and credential username semantics.
+
 ### Example
 
 ```js
@@ -7881,7 +7891,7 @@ explicit existing path. The application owns the remote, branch and Core API.
 ### Signature and result
 
 ```text
-createRepositoryWorkspace({name,directory,dataRoot,remote,branch,onEvent,run=runProcess}={})
+createRepositoryWorkspace({name,directory,dataRoot,remote,branch,gitIdentity,onEvent,run=runProcess}={})
 ```
 
 Returns `{directory,open,status,pull,push,write,close,drain,dispose}`. Construction does
@@ -7892,6 +7902,12 @@ work and preserves the checkout. No CLI cwd, launch state, preference, snapshot
 cache or existing user-data location changes. See the [complete inputs, results,
 errors and lifecycle](core-repositories.md#one-connected-working-checkout).
 
+Optional `gitIdentity:{name?,email?,username?}` captures explicit non-secret
+settings for child Git operations without writing global/local configuration.
+Selected author fields override inherited child author/committer fields;
+omitted fields remain inherited. Username remains a credential hint, with
+authentication owned by ordinary Git and its configured helper.
+
 `write({files:[{path,content}],message,signal})` snapshots the exact selected
 strings, writes those repository-relative files, commits only their literal
 paths and performs an ordinary non-force push. It retains unrelated staged
@@ -7911,6 +7927,45 @@ await repository.open({signal});
 await repository.close();
 ```
 
+## readGitIdentity()
+
+### Overview
+
+Reads non-secret global, repository-local and effective Git configuration
+without changing files or querying credentials.
+
+### Signature and result
+
+```text
+readGitIdentity({directory,signal,onEvent,run=runProcess}={})
+```
+
+Import from `arcane-os/core/repositories`. Returns a promise for
+`{global,local,effective}`, each observed scope containing `{name,email,githubUser}`.
+Fields preserve complete UTF-8 strings, including empty values, leading U+FEFF
+and newlines; unset fields are `null`. Git values outside UTF-8 fail with
+`ARCANE_GIT_IDENTITY_NOT_TEXT` instead of replacement characters.
+With no directory, only global configuration is read and local/effective
+are `null`. Existing repository directories, including bare caches, select the
+context for all three observations. Configured includes and ordinary Git
+precedence remain in effect. These are config observations, not authenticated
+accounts or environment-resolved commit identities.
+
+Independent scope queries run concurrently and join cleanup before settlement.
+Raw stdout is parser-owned rather than emitted as text events; an injected
+`run` must honor the existing raw-output process contract. Lifecycle and stderr
+events retain their ordinary route. Errors preserve their original object,
+code, cause and process diagnostics, with complete captured output added as
+`rawStdout` (a Buffer). The raw-mode process result retains `stdout:null`.
+If that property already exists or cannot be attached, a wrapper retains the
+original as `cause`, its code/details/exit code and this observation's raw
+output; original causal failures remain on the cause. An attachment exception
+is retained as `attachmentError`. Existing property values remain untouched.
+Decoding failures include their cause, complete process details and raw output.
+Already-represented observer errors appear once; separate failures use
+`AggregateError`. See the [complete contract and
+per-process selection example](core-repositories.md#git-identity-configuration).
+
 ## createCoreLocalAIProvider()
 
 ### Overview
@@ -8141,7 +8196,7 @@ Whisper backend libraries, decoder and model files; see the complete
 
 | Member | Contract |
 | --- | --- |
-| `current()` | Returns `providerId`, `modelId`, `state`, `loaded`, `busy`, `requestId`, `requestedBackend`, `observedBackend`, `backendEvidence` and `error`. State reports actual helper/model readiness. |
+| `current()` | Returns `providerId`, `modelId`, `state`, `loaded`, `busy`, `requestId`, `requestedBackend`, `observedBackend`, `backendEvidence`, `requestedEncoder`, `observedEncoder`, `encoderEvidence` and `error`. State reports actual helper/model readiness; encoder and decoder initialization evidence remain separate. |
 | `subscribe(listener,{replay=true,signal}={})` | Observes the current snapshot immediately by default, then each state change; returns the unsubscribe closure. |
 | `load({modelId,signal}={})` | Prepares the selected runtime if necessary and retains its initialized helper/model. Same-model loading is shared; replacement remains explicit. |
 | `transcribe(request,{signal,onProgress,requestId}={})` | Accepts the complete `{audioBase64,mimeType?,model?,language?,translate?}` recording for the loaded model and returns `{text,language,duration,segments}`. `audioBase64` transports the original media; the decoder recognizes its actual format. Progress is ordered; control metadata stays outside the request. |
@@ -8205,6 +8260,43 @@ includes the selected compiler's redistributable runtime closure. Use a
 toolchain and prepared runtime matching the target platform/architecture; a
 source package alone is not a compiled helper. See the [helper build procedure](local-whisper.md).
 
+## buildWhisperOpenVinoRuntime()
+
+`buildWhisperOpenVinoRuntime({sourceDirectory,openvinoDirectory,cudaDirectory,
+outputRoot,cmake='cmake',generator,cmakeArgs=[],env,signal,onEvent}={})` from
+`arcane-os/local-ai/whisper/openvino-build` produces the optional native Intel
+NPU encoder runtime on Windows x64. This producer uses an already installed
+compatible CMake/MSVC environment, Whisper 1.9.4 source and OpenVINO 2026.3.1
+development tree. Required `sourceDirectory`, `openvinoDirectory` and
+`outputRoot` name those inputs and the producer-owned output. It installs no
+driver, toolchain or model and performs no inference.
+
+The producer copies Whisper source into `outputRoot/source`, applies its
+encoder-failure propagation and stderr diagnostic corrections there, and runs
+CMake configure/build into `outputRoot/build`. The original source stays
+unchanged. It assembles the runtime under `outputRoot/runtime`, retaining
+OpenVINO/NPU, CPU, TBB, import libraries and packaging notices. Optional
+`cudaDirectory` names the matching upstream b5130 CUDA library directory;
+its selected precompiled backend libraries add CUDA alongside CPU. Omission
+produces the NPU-plus-CPU tree. `cmake`, `generator`, `cmakeArgs` and `env`
+configure the existing build environment.
+
+The result is `{version,openvinoVersion,platform,architecture,encoder,backend,
+backends,root,directory,libraryDirectory,sourceDirectory,diagnostics}`.
+`directory` equals `root`; the returned `sourceDirectory` is the copied source.
+`diagnostics` retains complete `configure` and `compile` process results.
+`signal` and `onEvent` use the existing process cancellation and diagnostic
+contract. Missing required strings produce a `TypeError`; an unsupported
+producer host or unmatched source correction reports an error. Filesystem,
+process, cancellation and observer failures remain observable, with partial
+producer output left for its owner.
+
+Build the matching first-party helper separately with `buildWhisperHelper`,
+then retain its complete installed `bin` alongside this runtime. The
+[complete producer example](../guides/native-whisper-openvino.md#produce-the-optional-native-runtime)
+covers that composition. Applications normally select the precompiled asset
+through `encoder: 'openvino-npu'`; they do not run this producer at startup.
+
 ## createSpeechService()
 
 ### Overview and usage

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.65.0",
+  "version": "0.66.0",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",

package/src/core/repositories.mjs

@@ -5,6 +5,9 @@ import Is from 'strong-type';
 import {ArcaneError, throwIfAborted} from '../errors.mjs';
 import {runProcess} from '../process.mjs';
 import {repositoryPull, repositoryPush, repositoryStatus} from '../repository.mjs';
+import {createGitIdentityRunner} from '../git-identity.mjs';
+
+export {readGitIdentity} from '../git-identity.mjs';
 
 const is = new Is(false);
 const directoryOperations = new Map();
@@ -41,7 +44,7 @@ export function resolveArcaneDataPaths({dataRoot} = {}) {
 
 /** One connected checkout, composed into an application's own Core service. */
 export function createRepositoryWorkspace(
-    {name, directory, dataRoot, remote, branch, onEvent, run = runProcess} = {}
+    {name, directory, dataRoot, remote, branch, gitIdentity, onEvent, run = runProcess} = {}
 ) {
     let selected = directory;
     if (selected === undefined) {
@@ -55,12 +58,13 @@ export function createRepositoryWorkspace(
     if (remote !== undefined) requireString(remote, 'remote');
     if (branch !== undefined) requireString(branch, 'branch');
     if (!is.function(run)) throw new TypeError('run must implement the SDK process adapter.');
+    const execute = createGitIdentityRunner(run, gitIdentity);
     const repositoryDirectory = path.resolve(selected);
     const pending = new Set();
     let opened = false;
     let closing = null;
 
-    async function prepare(signal, execute = run) {
+    async function prepare(signal, prepareRun = execute) {
         throwIfAborted(signal);
         if (opened) return {directory: repositoryDirectory, cloned: false};
         let entries;
@@ -74,7 +78,7 @@ export function createRepositoryWorkspace(
         if (entries.length) {
             // A parent checkout or a bare object cache is not this connection's
             // working root. Inspection never changes an existing destination.
-            const result = await execute(
+            const result = await prepareRun(
                 'git',
                 ['rev-parse', '--is-inside-work-tree', '--show-prefix'],
                 {cwd: repositoryDirectory, signal, onEvent}
@@ -97,7 +101,7 @@ export function createRepositoryWorkspace(
         const arguments_ = ['clone', '--progress'];
         if (branch !== undefined) arguments_.push('--branch', branch);
         arguments_.push('--', remote, repositoryDirectory);
-        const result = await execute(
+        const result = await prepareRun(
             'git',
             arguments_,
             {cwd: path.dirname(repositoryDirectory), signal, onEvent}
@@ -142,7 +146,7 @@ export function createRepositoryWorkspace(
         return accept(
             async function readRepositoryStatus() {
                 await prepare(signal);
-                return repositoryStatus({workspaceRoot: repositoryDirectory, signal, onEvent, run});
+                return repositoryStatus({workspaceRoot: repositoryDirectory, signal, onEvent, run: execute});
             },
             signal
         );
@@ -152,7 +156,7 @@ export function createRepositoryWorkspace(
         return accept(
             async function pullRepository() {
                 await prepare(signal);
-                return repositoryPull({workspaceRoot: repositoryDirectory, signal, onEvent, run});
+                return repositoryPull({workspaceRoot: repositoryDirectory, signal, onEvent, run: execute});
             },
             signal
         );
@@ -162,7 +166,7 @@ export function createRepositoryWorkspace(
         return accept(
             async function pushRepository() {
                 await prepare(signal);
-                return repositoryPush({workspaceRoot: repositoryDirectory, signal, onEvent, run});
+                return repositoryPush({workspaceRoot: repositoryDirectory, signal, onEvent, run: execute});
             },
             signal
         );
@@ -260,7 +264,7 @@ export function createRepositoryWorkspace(
                     }
 
                     try {
-                        const result = await run(
+                        const result = await execute(
                             'git',
                             args,
                             {cwd: options.cwd ?? repositoryDirectory, signal, onEvent: observeEvent,

package/src/git-identity.mjs

@@ -0,0 +1,132 @@
+import path from 'node:path';
+import Is from 'strong-type';
+import {ArcaneError, throwIfAborted} from './errors.mjs';
+import {runProcess} from './process.mjs';
+import {createEventQueue} from './event-queue.mjs';
+
+const is = new Is(false);
+
+/** Read only non-secret identity configuration through ordinary Git scopes. */
+export async function readGitIdentity({directory, signal, onEvent, run = runProcess} = {}) {
+    const cwd = directory === undefined ? undefined : path.resolve(directory);
+    throwIfAborted(signal);
+    const events = createEventQueue(onEvent);
+
+    async function observeScope(scope) {
+        const args = ['config'];
+        if (scope !== 'effective') args.push(`--${scope}`);
+        args.push('--includes', '--null', '--get-regexp', '^(user[.](name|email)|github[.]user)$');
+        const chunks = [];
+        try {
+            const result = await run('git', args, {
+                cwd, signal, onEvent: events.send, allowNonzero: true,
+                outputEncoding: {stdout: null},
+                captureOutput: {stdout: false},
+                emitOutputEvents: {stdout: false},
+                // Git configuration may contain non-UTF-8 values. Keep its raw
+                // output until close rather than silently replacing characters.
+                onOutput: function observeOutput({stream, chunk}) {
+                    if (stream === 'stdout') chunks.push(chunk);
+                }
+            });
+            try { throwIfAborted(signal); }
+            catch (error) { error.details = result; throw error; }
+            const identity = {name: null, email: null, githubUser: null};
+            if (result.code === 1) return identity;
+            if (result.code !== 0) {
+                throw new ArcaneError('ARCANE_OPERATION_FAILED',
+                    `Git ${scope} identity lookup exited with code ${String(result.code)}.`, {details: result});
+            }
+            let output;
+            try { output = new TextDecoder('utf-8', {fatal: true, ignoreBOM: true}).decode(Buffer.concat(chunks)); }
+            catch (cause) {
+                throw new ArcaneError('ARCANE_GIT_IDENTITY_NOT_TEXT',
+                    `Git ${scope} identity configuration cannot be represented as UTF-8 text.`, {cause, details: result});
+            }
+            const fields = {'user.name': 'name', 'user.email': 'email', 'github.user': 'githubUser'};
+            // Git's NUL record framing preserves complete values, including newlines
+            // and empty strings. The last occurrence is the effective scalar value.
+            for (const record of output.split('\0')) {
+                if (record === '') continue;
+                const separator = record.indexOf('\n');
+                const key = separator === -1 ? record : record.slice(0, separator);
+                if (Object.hasOwn(fields, key)) {
+                    identity[fields[key]] = separator === -1 ? '' : record.slice(separator + 1);
+                }
+            }
+            return identity;
+        } catch (error) {
+            // Keep the process error and its native details intact. Raw stdout
+            // belongs to this reader because the process owner did not decode it.
+            const rawStdout = Buffer.concat(chunks);
+            let attached = false;
+            let attachmentError;
+            try {
+                if (error !== null && (is.object(error) || is.function(error)) && !('rawStdout' in error)) {
+                    Object.defineProperty(error, 'rawStdout', {
+                        value: rawStdout, writable: true, enumerable: true, configurable: true
+                    });
+                    attached = true;
+                }
+            } catch (cause) { attachmentError = cause; }
+            if (attached) throw error;
+            const failure = new ArcaneError(error?.code ?? 'ARCANE_OPERATION_FAILED',
+                error instanceof Error ? error.message : String(error),
+                {cause: error, details: error?.details, exitCode: error?.exitCode});
+            failure.rawStdout = rawStdout;
+            if (attachmentError) failure.attachmentError = attachmentError;
+            throw failure;
+        }
+    }
+
+    const scopes = cwd === undefined ? ['global'] : ['global', 'local', 'effective'];
+    const observations = await Promise.allSettled(scopes.map(observeScope));
+    const failures = observations.filter(function failed(result) {
+        return result.status === 'rejected';
+    }).map(function cause(result) { return result.reason; });
+    try { await events.drain(); }
+    catch (error) {
+        const visited = new Set();
+        function containsObserverFailure(failure) {
+            if (failure === error) return true;
+            if (failure === null || failure === undefined || visited.has(failure)) return false;
+            visited.add(failure);
+            return containsObserverFailure(failure.cause)
+                || (is.array(failure.errors) && failure.errors.some(containsObserverFailure));
+        }
+        const represented = failures.some(containsObserverFailure);
+        if (!represented) failures.push(error);
+    }
+    if (failures.length === 1) throw failures[0];
+    if (failures.length) throw new AggregateError(failures, 'Git identity observations failed.');
+    const result = {global: null, local: null, effective: null};
+    for (const [index, scope] of scopes.entries()) result[scope] = observations[index].value;
+    return result;
+}
+
+/** Capture one factory's selection without changing Git files or process.env. */
+export function createGitIdentityRunner(run, {name, email, username} = {}) {
+    const configuration = [];
+    const environment = {};
+    for (const [field, value] of Object.entries({name, email, username})) {
+        if (value === undefined) continue;
+        if (!is.string(value) || !value.isWellFormed() || value.includes('\0')) {
+            throw new TypeError(`gitIdentity.${field} must be text representable as a native process argument.`);
+        }
+        configuration.push('-c', `${field === 'username' ? 'credential.username' : `user.${field}`}=${value}`);
+        if (field === 'name') {
+            environment.GIT_AUTHOR_NAME = value;
+            environment.GIT_COMMITTER_NAME = value;
+        } else if (field === 'email') {
+            environment.GIT_AUTHOR_EMAIL = value;
+            environment.GIT_COMMITTER_EMAIL = value;
+        }
+    }
+    if (!configuration.length) return run;
+    const selectsAuthor = name !== undefined || email !== undefined;
+    return function runSelectedGit(command, args, options = {}) {
+        return run(command, [...configuration, ...args], selectsAuthor
+            ? {...options, env: {...options.env, ...environment}}
+            : options);
+    };
+}

package/src/git-text-snapshot.mjs

@@ -4,6 +4,7 @@ import path from 'node:path';
 import {runProcess} from './process.mjs';
 import {ArcaneError, ERROR_CODES, throwIfAborted} from './errors.mjs';
 import {createEventQueue} from './event-queue.mjs';
+import {createGitIdentityRunner} from './git-identity.mjs';
 
 const is = new Is(false);
 const snapshotRef = 'refs/arcane/text-snapshot';
@@ -13,11 +14,12 @@ const snapshotRef = 'refs/arcane/text-snapshot';
  * One application service owns each dedicated cache directory. Construction
  * performs no I/O; refresh coalesces callers and close drains accepted work.
  */
-export function createGitTextSnapshot({cacheDirectory, remote, ref, selectPath, onEvent, run = runProcess} = {}) {
+export function createGitTextSnapshot({cacheDirectory, remote, ref, selectPath, gitIdentity, onEvent, run = runProcess} = {}) {
     for (const [name, value] of Object.entries({cacheDirectory, remote, ref})) {
         if (!is.string(value) || value === '') throw new TypeError(`${name} must be a nonempty string.`);
     }
     if (!is.function(selectPath)) throw new TypeError('selectPath must be a function.');
+    const execute = createGitIdentityRunner(run, gitIdentity);
     const directory = path.resolve(cacheDirectory);
     let prepared = false;
     let retained = null;
@@ -34,7 +36,7 @@ export function createGitTextSnapshot({cacheDirectory, remote, ref, selectPath,
             };
         }
         try {
-            return await run('git', ['--git-dir', directory, ...args], execution);
+            return await execute('git', ['--git-dir', directory, ...args], execution);
         } catch (error) {
             // runProcess first drains its child and preserves complete transport
             // failures. Keep the Git parser's public code with that full cause.
@@ -50,7 +52,7 @@ export function createGitTextSnapshot({cacheDirectory, remote, ref, selectPath,
         if (prepared) return;
         await mkdir(directory, {recursive: true});
         if ((await readdir(directory)).length === 0) {
-            await run('git', ['init', '--bare', directory], {onEvent: events.send});
+            await execute('git', ['init', '--bare', directory], {onEvent: events.send});
         }
         const result = await git(['rev-parse', '--is-bare-repository'], {onEvent: events.send});
         // This is the selected cache's functional role: never reinterpret an