arcane-os 0.65.0 → 0.67.0

package/docs/reference/README.md

@@ -54,18 +54,24 @@ alone does not make bare module names resolve in a browser.
 | Connect a browser to one Core transport | [Core browser client](core-client.md) |
 | Cancel one Core speech synthesis request without changing its payload | [Speech request lifetime](core-client.md#events-and-request-lifetime) and [Core facade](sdk-api.md#createcorefacade) |
 | Compose native Core dispatch, service lifecycle, and stdio hosting | [Native Core runtime](core-runtime.md) |
+| Compose application Core services during source development, independently of local AI | [Development Core services](core-development.md) |
+| Own an explicitly selected native Codex App Server session | [Codex App Server](codex-app-server.md) |
+| Expose application-owned tools and static resources through Node STDIO | [MCP STDIO server](mcp-stdio.md) |
 | Run application-selected llama.cpp, Ollama or ONNX through Core | [Local AI through Core](local-ai.md) |
 | Generate complete local PNG images with a retained native model | [Local image generation](local-image-generation.md) |
 | Select FLUX.2 Klein 4B and its three complementary model resources | [FLUX.2 Klein 4B through Core](local-image-flux.md) |
 | Select the complete SDXL Base 1.0 checkpoint for text-to-image generation | [SDXL Base 1.0 through Core](local-image-sdxl.md) |
 | Compose independently loaded transcription and synthesis engines | [Native speech service](native-speech.md) |
 | Keep a native Whisper model loaded across complete recordings | [Native Whisper transcription](local-whisper.md) |
+| Select the optional Intel NPU encoder with independent CUDA or CPU decoding | [Intel NPU Whisper](../guides/native-whisper-openvino.md) |
 | Edit an original PNG with a complete prompt and explicit strength | [Local image editing](local-image-editing.md) |
 | Project complete stored model files into native working files | [Model assets through Core](model-assets.md) |
 | Retain a Nemotron model and diarize caller-fed audio streams | [Native speaker diarization](diarization.md) |
 | Persist application-selected preferences through Core | [Core preferences service](core-preferences.md) |
 | Read complete selected Git text without changing a checkout | [Git text snapshots](git-text-snapshot.md) |
 | Own a native working checkout under per-user ArcaneData/Repos | [Native repository workspaces](core-repositories.md) |
+| Read Git identity defaults or select child-only author and credential hints | [Git identity configuration](core-repositories.md#git-identity-configuration) |
+| Write, commit and push complete selected repository text | [Selected-text repository writing](core-repositories.md#write-commit-and-push-selected-text) |
 | Build an installed-SDK portable Core payload | [Portable Core packaging](core-native-packaging.md) |
 | Pass host-selected state defaults and unchanged explicit launch values to services | [Launch-time locations](core-native-packaging.md#launch-time-locations) |
 | Build a Windows executable without an OS checkout | [Windows executable packaging](core-native-packaging.md#windows-executable) |
@@ -142,7 +148,8 @@ node tools/build-reference-site.mjs --write --source-ref <documentation-commit>
 
 The same option is accepted by `createReferenceSite({sourceRef})` and
 `writeReferenceSite({sourceRef})`. It reads the selected commit's package
-version, complete reference documents and inventories, inventory-selected
+version, complete reference documents and inventories, the canonical
+`docs/guides/native-whisper-openvino.md` guide when present, inventory-selected
 runtime sources, and authored site inputs directly from Git in memory. It
 creates no checkout or export and leaves source drafts untouched. Rendering
 uses the current canonical generator and its authored semantic contracts;

package/docs/reference/ai/browser-decisions.md

@@ -1,7 +1,8 @@
 # Browser typed decisions
 
-`arcane-os/ai/browser-decisions` owns browser-local Laya typed-decisions FP16
-and Julia-1 FP32 inference. It is separate from chat and speech because these
+`arcane-os/ai/browser-decisions` owns browser-local Laya typed decisions
+and Julia-1 inference. Laya defaults to FP16 and Julia to FP32; an explicit
+`dtype` is forwarded unchanged to the selected upstream loader. It is separate from chat and speech because these
 models score caller-supplied options instead of generating conversational text.
 Applications supply the model repository, state, questions, option meanings and
 policy; the SDK owns the reusable tokenizer, tensors, inference and lifecycle.
@@ -66,6 +67,7 @@ it does not substitute a quantized graph or another model.
 | `model` | Required upstream repository/base URL accepted by Transformers.js. The application owns its selection. |
 | `revision` | Upstream revision, default `main`; select a stable revision when repeatable model selection is needed. |
 | `device` | Transformers.js backend, default `webgpu`; an explicit supported alternative is caller-owned. No automatic backend fallback. |
+| `dtype` | Exact upstream precision selection; defaults to `fp16` for Laya and `fp32` for Julia. For Laya FP32, supply `dtype: 'fp32'`. Unsupported selections fail at the selected upstream loader rather than being replaced. |
 | `runtime.moduleUrl` | Defaults to the self-contained CDN entry `https://cdn.jsdelivr.net/npm/@huggingface/transformers@4.3.0/dist/transformers.min.js`. The `.web.js` build expects a bundler to resolve its bare ONNX Runtime import and is unsuitable for a native module Worker. An explicit compatible public runtime URL may be supplied. |
 | `runtime.wasmPaths` | Optional upstream ONNX WASM location passed to the selected runtime's public environment API. |
 
@@ -75,10 +77,11 @@ network, cross-origin and backend availability still apply. WebGPU needs a
 compatible browser/device context. Unsupported precision or backend errors
 are returned, not replaced with a different model, backend or precision.
 
-Laya selects `dtype: 'fp16'`, loading `onnx/model_fp16.onnx` and its
+Laya defaults to `dtype: 'fp16'`, loading `onnx/model_fp16.onnx` and its
 `model_fp16.onnx_data` companion through Transformers.js. The published mixed
 precision graph retains selected operations/outputs in FP32; FP16 selection
-does not claim every graph operation runs in half precision.
+does not claim every graph operation runs in half precision. Explicit
+`dtype: 'fp32'` selects the repository's FP32 graph through that same loader.
 
 Julia selects `dtype: 'fp32'`, loading root `model.onnx` with the exact
 `model.onnx.data` external-data name. Its custom five-input graph is loaded

package/docs/reference/core-native-packaging.md

@@ -261,10 +261,17 @@ service exposes retained worker sessions through `onnx.load/run/unload/status`;
 model files remain caller-selected application resources. See
 [native ONNX sessions](local-ai.md#native-onnx-sessions).
 
-Selected `stable-diffusion.cpp` additionally composes
-`createLocalImageService` from `arcane-os/core/image` and one shared
-`createModelAssetService` from `arcane-os/core/model-assets`. The image factory
-receives the full authored selection plus that same model-assets instance.
+Selecting ONNX, image generation, or both composes one shared
+`createModelAssetService` from `arcane-os/core/model-assets`. Native application
+services obtain that same definition with `await context.getService('model-assets')`.
+They obtain the selected local-AI owner with `await context.getService('local-ai')`
+and its current native ONNX handle with `getONNXRuntime()`. These lookups await
+only their selected service startup, independently of renderer readiness. See
+[native service ownership and cleanup](local-ai.md#native-service-owners).
+
+Selected `stable-diffusion.cpp` additionally composes `createLocalImageService`
+from `arcane-os/core/image`. The image factory receives the full authored
+selection plus that same model-assets instance.
 Library, Koffi binding and variant paths resolve from the artifact root;
 ordinary browser imports use `arcane-os/ai/core-image` and
 `arcane-os/ai/core-model-assets` through the managed import map.

package/docs/reference/core-repositories.md

@@ -24,7 +24,8 @@ The Android host also supplies Git/process execution through the existing
 process-adapter contract; this module does not install Git or choose shared
 Android storage.
 
-The factory's first actual operation creates necessary parent directories.
+The factory's first operation that prepares a checkout creates necessary parent
+directories. The read-only `configuration` operation never prepares one.
 No existing data is moved, copied, deleted, renamed or migrated. `appRoot`,
 `stateRoot`, preferences, OPFS and the existing CLI/workspace defaults remain
 independent and unchanged.
@@ -46,8 +47,8 @@ const status = await repository.status({signal});
 await repository.close();
 ```
 
-`createRepositoryWorkspace({name,directory,dataRoot,remote,branch,onEvent,run}={})`
-returns `{directory,open,status,pull,push,write,close,drain,dispose}`. The `directory`
+`createRepositoryWorkspace({name,directory,dataRoot,remote,branch,gitIdentity,onEvent,run}={})`
+returns `{directory,open,status,configuration,pull,push,write,close,drain,dispose}`. The `directory`
 property is the absolute selected working path.
 
 - Omit `directory` to select `<repositoriesRoot>/<name>`. The application supplies
@@ -67,15 +68,17 @@ property is the absolute selected working path.
   authentication remain with Git and the native host. The SDK adds no download,
   credential store, polling, network retry or process supervisor.
 
-The open/status/pull/push methods accept `{signal}={}` and return promises;
+The open/status/configuration methods accept `{signal}={}` and return promises;
+pull/push accept `{target,signal}={}` with an optional captured destination.
 `write` accepts the complete file/message request described below:
 
 | Method | Result and side effect |
 |---|---|
 | `open` | For a missing/empty destination, runs one clone and returns `{directory,cloned:true,stdout,stderr}` with complete process output. For an existing working repository root, returns `{directory,cloned:false}` after read-only inspection. Later opens on that owner reuse preparation. |
 | `status` | Prepares the checkout if needed, then returns the existing `repositoryStatus` result unchanged. |
-| `pull` | Prepares the checkout if needed, then runs the existing clean-checkout, fast-forward-only `repositoryPull` operation unchanged. |
-| `push` | Prepares the checkout if needed, then runs the existing `repositoryPush` operation unchanged, preserving its support for unrelated uncommitted working files. |
+| `configuration` | Observes the existing working root, symbolic HEAD, origin and configured upstream. It never clones, initializes or fetches. |
+| `pull` | Prepares the checkout if needed, then runs clean-checkout, fast-forward-only `repositoryPull`, optionally using the operation's selected target. |
+| `push` | Prepares the checkout if needed, then runs `repositoryPush`, optionally using the operation's selected target, preserving support for unrelated uncommitted working files. |
 | `write` | Writes exact caller-selected text files, stages and commits only their literal paths, then performs one ordinary non-force push. Returns confirmed operation outcomes; see below. |
 | `close`, `drain`, `dispose` | The same idempotent operation: stop accepting new calls and await accepted work and its process/event cleanup. They retain the repository on disk. |
 
@@ -87,6 +90,201 @@ A failed or cancelled clone reports the actual failure; any remaining directory
 is retained for application-owned inspection. There is no automatic deletion or
 destructive retry. Filesystem failures and complete Git diagnostics propagate.
 
+## Existing checkout configuration and selected targets
+
+`configuration({signal}={})` observes an existing checkout without invoking
+`open`, creating directories, cloning, initializing, fetching or changing Git
+configuration. A missing repository reports the actual Git failure. A bare
+cache or nested checkout directory reports `ARCANE_REPOSITORY_DIRECTORY_INVALID`.
+Its result is:
+
+```text
+{
+    repositoryRoot,
+    headRef: fullSymbolicRef | null,
+    origin: {urls: [...], pushUrls: [...]},
+    upstream: {remoteNames: [...], mergeRefs: [...], urls: [...], pushUrls: [...]} | null
+}
+```
+
+`repositoryRoot` is this owner's absolute selected working root. `headRef` is
+the complete symbolic HEAD, including an unborn branch, or `null` for detached
+HEAD. `upstream` is `null` when HEAD does not name a local branch. Otherwise its
+arrays contain that branch's configured `remote` and `merge` values; `urls` and
+`pushUrls` observe the effective last configured remote name. A `.` remote
+means the local repository and has no remote URL arrays. Origin is observed
+independently, even when it is not the upstream.
+
+Arrays retain configured order, repeated values, complete UTF-8 strings and
+empty strings. `[]` means unset; `['']` means an explicit empty value. The
+reader honors configured includes and ordinary Git configuration precedence.
+Unset push URLs do not imply that Git cannot push: Git retains its normal URL
+fallback and rewrite behavior. These are configuration observations, not
+resolved endpoints, authentication, account identity or ownership proof.
+The SDK neither queries a credential helper nor changes configuration here.
+
+Metadata uses the shared raw-Git-text reader. Lifecycle/stderr events remain
+with the process owner, raw stdout remains parser-owned, and undecodable text
+reports `ARCANE_GIT_CONFIGURATION_NOT_TEXT`. Failures retain complete raw
+stdout, process diagnostics and causal errors using the identity reader's
+documented attachment behavior. One observation uses four read-only Git
+commands for an attached local branch, or three otherwise. Results are not a
+transaction with later work or external Git activity. The app owns any decision
+that the current checkout corresponds to its selected repository and branch.
+
+The optional `target:{remote,ref}` on `pull`, `push` and `write` selects that
+operation's Git destination. Both fields are nonempty strings representable by
+the native process transport. The SDK captures their exact strings when the
+call is accepted; later edits to the target object or UI selection cannot
+redirect queued or active work. Git owns ref parsing, URL interpretation,
+credentials, hooks and remote outcomes. This target is independent of the
+factory's `remote`/`branch`, which remain initial-clone inputs only.
+
+```javascript
+const observed = await repository.configuration({signal});
+// The app decides whether observed.headRef and configured URLs match its choice.
+const target = {remote: connection.locator, ref: connection.ref};
+await repository.pull({target, signal});
+const result = await repository.write({files: selectedFiles, message, target, signal});
+```
+
+A targeted pull uses `git pull --ff-only -- <remote> <ref>:`. The trailing colon
+is Git's source-only fetch framing; the fetched history is integrated into the
+current branch. It does not switch branches or reset files/history. The existing
+clean-checkout requirement remains. A targeted push uses
+`git push --no-follow-tags -- <remote> HEAD:<ref>`: current HEAD is published to
+the selected ref, without force or implicit configured tag following. Existing
+history is still sent when Git needs it. Ordinary conflicting Git settings or
+remote rejection remain actual failures; no settings are rewritten.
+
+Omitting `target` preserves ordinary configured pull/push behavior and its
+existing result shape. Targeted pull/push results add the captured `target` and
+complete `stdout`/`stderr` alongside the existing `action`, `repositoryRoot`,
+`branch` and compatibility `output` field. Writer results and failure outcomes
+add that same captured `target`. There is no hidden pre-write pull, branch
+selection, retry, reset, force, reversal or recommit. The app decides when to
+observe, refresh, write and publish. See Git's [pull](https://git-scm.com/docs/git-pull),
+[push](https://git-scm.com/docs/git-push) and [configuration](https://git-scm.com/docs/git-config)
+contracts.
+
+## Git identity configuration
+
+```javascript
+import {readGitIdentity, createRepositoryWorkspace} from 'arcane-os/core/repositories';
+
+const defaults = await readGitIdentity({signal});
+const observations = await readGitIdentity({directory: existingRepositoryDirectory, signal});
+const repository = createRepositoryWorkspace({
+    name: 'moon-cheese-dispatches',
+    remote: applicationConnection.remote,
+    gitIdentity: {name: 'Moon Dispatcher', email: 'moon@example.invalid', username: 'moon-account'}
+});
+```
+
+`readGitIdentity({directory,signal,onEvent,run=runProcess}={})` reads only
+`user.name`, `user.email` and `github.user`. It returns:
+
+```text
+{
+    global: {name, email, githubUser},
+    local: {name, email, githubUser} | null,
+    effective: {name, email, githubUser} | null
+}
+```
+
+Every observed field is the complete UTF-8 Git configuration string, including
+an empty string, leading U+FEFF and embedded newlines, or `null` when unset.
+Git can store values outside UTF-8; those produce
+`ARCANE_GIT_IDENTITY_NOT_TEXT` instead of replacement characters. Global and
+local observations select Git's corresponding file scopes and honor configured
+includes. With an existing
+repository `directory`, `effective` reads ordinary Git configuration in that
+repository context, including system, global, local, worktree and command
+configuration where applicable. Equal local and global values remain separate
+observations; the SDK does not infer who wrote or owns a setting. The last
+configured scalar value wins within each observation.
+
+Without `directory`, only global configuration is read and `local`/`effective`
+are `null`. Relative directories resolve from the process working directory.
+Git retains its normal environment and conditional-include context; when no
+directory is supplied, that context is the process working directory. These
+are independent configuration observations, not a transaction or a claim about
+the identity of a prior commit, environment-derived author, or authenticated
+GitHub account. `github.user` is a non-secret configured default, not proof of
+authentication.
+
+One targeted Git command reads each requested scope. Independent observations
+start concurrently and all accepted commands finish their process cleanup
+before the reader settles. `signal` uses the existing process owner; the shared
+SDK event queue serializes `onEvent` delivery with its usual backpressure.
+The reader consumes raw stdout through the existing process contract; stdout
+is parsed as configuration rather than emitted as text events. Process
+lifecycle and stderr events retain their ordinary route. A supplied `run`
+adapter must honor that raw-output contract.
+Git's no-match result produces unset fields; other process,
+configuration, observer and cancellation failures remain complete. A single
+failure retains its original object, code, cause and process `details`; the
+reader adds complete captured stdout as the `rawStdout` Buffer on that error.
+If the error already has that property or cannot accept it, a new error retains
+the original as `cause`, preserves its code, process details and exit code, and
+holds this observation's `rawStdout`. Original causal failures stay on that
+original error; an attachment exception is retained as `attachmentError`.
+An existing `rawStdout` property is never overwritten or invoked to read its value.
+The process result's `stdout` remains `null` in raw mode, and its stderr and
+other diagnostics remain intact. A decoding failure likewise carries its
+original decoding `cause`, complete process `details` and `rawStdout`.
+An observer failure already represented by a process error is not added again;
+genuinely separate failures use `AggregateError.errors`, each retaining its
+own diagnostics.
+No configuration file is written and no credential helper is queried by this
+reader. The application owns any saved non-secret defaults and repository
+overrides through its existing preferences.
+
+Both this workspace factory and
+[`createGitTextSnapshot`](git-text-snapshot.md) accept optional
+`gitIdentity:{name?,email?,username?}`. They capture supplied strings once during
+I/O-free construction. Later edits to that object or a UI selection do not
+change accepted work. Omitted or `undefined` fields preserve ordinary inherited
+behavior; removing an application override means omitting that field on the
+next owner, not changing unmanaged repository configuration. Empty strings are
+passed explicitly to Git. Non-string values, NUL and text that cannot be
+represented by the native process transport report `TypeError` without silently
+rewriting the input.
+
+An application's explicit "global author" choice differs from ordinary Git
+inheritance. Pass the observed global `name` and `email` as selected strings to
+override repository-local author values for those fields. A global `null` means
+that field is unset, not a selected value: passing `null` reports `TypeError`,
+and omitting the field allows normal inheritance, including repository-local
+configuration. The application must describe that partial/inherited choice
+accurately or obtain the missing value before presenting an all-global author
+selection. An empty string is a distinct explicit value that Git may reject.
+Changed application choices apply to future owners; accepted operations retain
+their original selection and may finish without being discarded.
+
+Each supplied name/email becomes command-local `-c user.name=...` or
+`-c user.email=...` and the corresponding child-only `GIT_AUTHOR_*` and
+`GIT_COMMITTER_*` fields. Those selected fields take precedence over inherited
+author/committer settings and environment values; omitted fields, dates and
+unrelated environment remain inherited. Git retains its ordinary commit
+identity formatting and may reject an unusable identity. The SDK changes
+neither `process.env` nor global/local Git files.
+
+`username` supplies only command-local `credential.username`. Git's existing
+credential helper and remote protocol still own actual authentication. A
+URL-embedded username or helper behavior can affect the selected credential;
+this option neither rewrites the remote nor selects an SSH account or proves a
+GitHub login. No account enumeration, secret storage or `gh` dependency is added.
+See Git's [configuration](https://git-scm.com/docs/git-config),
+[author environment](https://git-scm.com/docs/git#_git_commits) and
+[credential username](https://git-scm.com/docs/gitcredentials) contracts.
+
+The selected settings accompany every workspace Git command, including clone,
+pull, commit and push, and every bare-snapshot Git command, including init and
+fetch. Existing arguments, content, output, errors, queue and cancellation
+semantics remain unchanged. Other repository helpers and CLI cwd defaults keep
+their existing behavior.
+
 ## Write, commit and push selected text
 
 ```javascript
@@ -97,7 +295,7 @@ const result = await repository.write({
 });
 ```
 
-`write({files:[{path,content}],message,signal}={})` requires at least one explicit
+`write({files:[{path,content}],message,target,signal}={})` requires at least one explicit
 file, a nonempty commit message and string content (including an empty string).
 Paths name working files relative to this repository, not its root, outside
 paths or Git-owned `.git` metadata. Strings must be representable as UTF-8;
@@ -121,9 +319,11 @@ native host.
 One `git --literal-pathspecs add -- <paths>` stages only those exact names.
 One `git --literal-pathspecs commit --only --cleanup=verbatim --file - -- <paths>`
 commits only those paths, leaving unrelated staged paths staged. The original
-message is streamed unchanged through standard input. One ordinary `git push`
-then uses that repository's existing remote/ref configuration, identity,
-credentials and hooks. There is no implicit pull, branch switch, forced push,
+message is streamed unchanged through standard input. Without `target`, one
+ordinary `git push` then uses that repository's existing remote/ref configuration, the optional
+process-local identity selection above, existing credentials and hooks.
+With `target`, the final push uses the selected current-HEAD mapping above.
+There is no implicit pull, branch switch, forced push,
 hook bypass, automatic retry, rollback or reset. If Git reports no changes to
 commit, that actual failure is returned; the SDK creates no empty commit.
 These are Git's documented [selected-path commit](https://git-scm.com/docs/git-commit#Documentation/git-commit.txt---only)
@@ -133,7 +333,8 @@ Existing Git attributes, clean filters, EOL settings and hooks continue to apply
 when Git stages/commits content. The filesystem write preserves the original
 text; this API does not claim that repository-configured filters leave Git blob
 text identical. It preserves those settings. A push may also send existing history or other
-refs selected by the repository's ordinary push configuration.
+refs selected by the repository's ordinary push configuration when no explicit
+target is supplied.
 
 ### Result and failure outcomes
 
@@ -156,6 +357,8 @@ Successful completion returns:
 
 Each output record retains complete stdout/stderr. `code` and the process
 termination `signal` are included when a completed process result is available.
+When supplied, `target:{remote,ref}` is included in the result or failure outcome
+with the original accepted strings.
 An in-progress write also records its current `path` on a failure outcome.
 `writtenPaths` records successful filesystem writes in input order; `written`
 becomes true only after every requested write succeeds. The other booleans

package/docs/reference/core-runtime.md

@@ -66,11 +66,34 @@ service's startup before invoking its handler. State errors use the shared
 complete diagnostic serialization; the startup promise retains its original
 rejection value.
 
-Each lifecycle hook receives `{application, service, emit}`. Each request handler
-receives `(parameters, {application, service, emit, requestId, signal})`, with
+Each lifecycle hook receives `{application, service, emit, getService}`. Each request handler
+receives `(parameters, {application, service, emit, getService, requestId, signal})`, with
 `this` bound to its service definition. A hook or handler may publish a complete
 service-owned event through `emit(event, data)`.
 
+### Native service composition
+
+`await runtime.getService(name)` and `await context.getService(name)` return the
+actual registered service definition after that service's shared startup
+promise. A lookup can start its selected dependency before `runtime.start()`;
+it waits for that dependency alone, with no renderer, transport request or
+all-service readiness barrier. Concurrent lookups reuse the same startup and
+return the same object. Applications keep their service dependencies acyclic.
+
+Use the returned service's documented native members, such as
+[`getONNXRuntime()`](local-ai.md#native-service-owners), for same-process
+composition. RPC handlers remain owned by the dispatcher; calling entries in
+`service.methods` directly does not supply request tracking or cancellation.
+No service lookup is exposed over the browser protocol.
+
+An unregistered name rejects with `CORE_SERVICE_UNAVAILABLE`. Startup failure
+rejects with the original error. New lookups reject with `CORE_CLOSING` once
+shutdown begins; an already accepted lookup still settles with its startup.
+Lookup provides readiness, not a lifetime lease or ownership transfer. Retain
+each acquired native owner according to its own documented cleanup contract,
+and use that retained handle during disposal rather than requesting a new one.
+Independent services still dispose concurrently.
+
 ## State and frames
 
 `runtime.current()` returns dispatcher state, application, version, per-service
@@ -133,9 +156,13 @@ the handler runs. A service that does not finish or respond to cancellation is
 still unfinished; the SDK does not report a forced timeout as successful cleanup.
 
 Use `lifetime:'service'` for accepted work, such as a save, that must survive a
-renderer cancellation or disconnect. These operations are not aborted by the
-request cancellation controls or by normal Core shutdown. The service still
-owns its persistence, queueing and failure semantics.
+renderer cancellation or disconnect. The dispatcher does not abort these
+operations through request cancellation controls or its own shutdown. The
+service still owns its persistence, queueing and failure semantics. A composing
+host or native service can abort its own lifetime signal during shutdown;
+in-flight native inference can therefore be cancelled even when the dispatcher
+retains a service-lifetime response. Service lifetime does not promise survival
+of native host shutdown.
 
 `runtime.close()` is idempotent and retains the same completion promise. It stops
 accepting new requests, cancels request-lifetime operations, waits for accepted

package/docs/reference/git-text-snapshot.md

@@ -33,12 +33,26 @@ policy stable for the lifetime of its snapshot owner.
 
 ## API and lifecycle
 
-`createGitTextSnapshot({cacheDirectory,remote,ref,selectPath,onEvent,run})`
+`createGitTextSnapshot({cacheDirectory,remote,ref,selectPath,gitIdentity,onEvent,run})`
 returns `{refresh,close,drain,dispose}`. `run` defaults to the SDK's existing
 `runProcess`; applications normally omit it. It is the same process adapter
 contract, not a second process supervisor. `onEvent` is the ordinary SDK event
 callback and follows its asynchronous completion/error contract.
 
+Optional `gitIdentity:{name?,email?,username?}` uses the shared
+[Git identity configuration contract](core-repositories.md#git-identity-configuration).
+Supplied strings are captured during construction and accompany every Git
+command, including bare initialization and fetch, without changing the remote,
+ref, config files or process environment. Explicit name/email use command-local
+configuration and child-only author/committer fields; omitted fields remain
+inherited. `username` is only Git's credential username hint, not authenticated
+account proof or SSH account selection. Read separate global/local/effective
+configuration through `readGitIdentity` from `arcane-os/core/repositories`;
+the reader also accepts an existing bare cache directory. Applications retain
+saved non-secret choices and per-connection overrides. Identity selection adds
+no process or query to refresh and does not attach a caller's abort to shared
+acquisition.
+
 - `refresh({signal}={})` fetches the selected ref and returns
   `{revision,files:[{path,content}]}`. `revision` is Git's opaque selected commit
   name, not an SDK integrity record. Every file comes from that exact revision,

package/docs/reference/inventory/package-api.json

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
-  "sdkVersion": "0.64.0",
+  "sdkVersion": "0.66.0",
   "environment": {
     "runtime": "Node.js for Node entrypoints; browser for browser-only entrypoints",
     "minimumVersion": "22.23.2 for Node entrypoints",
     "moduleSystem": "ESM"
   },
-  "memberCount": 288,
+  "memberCount": 290,
   "runtimeSubpathPatterns": {
     "arcane-os/modules/*": "./runtime/arcane/modules/*",
     "arcane-os/entities/*": "./runtime/arcane/entities/*"
@@ -54,6 +54,20 @@
       "protocol": "Owned configure/build/install process lifecycle",
       "normalization": "Returns platform/architecture/root/executable/runtimeDirectory and complete configure/compile/install diagnostics; preserves cancellation and process failures, installs no model or toolchain, performs no inference"
     },
+    {
+      "id": "local-ai-whisper-openvino-build:buildWhisperOpenVinoRuntime",
+      "name": "buildWhisperOpenVinoRuntime",
+      "displayName": "buildWhisperOpenVinoRuntime()",
+      "kind": "function",
+      "signature": "async buildWhisperOpenVinoRuntime({sourceDirectory,openvinoDirectory,cudaDirectory,outputRoot,cmake='cmake',generator,cmakeArgs=[],env,signal,onEvent}={})",
+      "entrypoints": ["arcane-os/local-ai/whisper/openvino-build"],
+      "primaryImport": "arcane-os/local-ai/whisper/openvino-build",
+      "group": "Core native speech",
+      "summary": "Produces the optional Intel NPU encoder runtime from installed matching Whisper/OpenVINO sources and an existing Windows x64 toolchain.",
+      "availability": "Windows x64 Node with Whisper 1.9.4 source, OpenVINO 2026.3.1 development tree and compatible CMake/MSVC; other platform distributions require separate native producers",
+      "protocol": "Owned configure/build process lifecycle and complete native runtime assembly",
+      "normalization": "Returns version/openvinoVersion/platform/architecture/encoder/backend/backends/root/directory/libraryDirectory/copied sourceDirectory and complete configure/compile diagnostics; retains NPU/CPU and optional supplied CUDA libraries plus notices, preserves process failures and cancellation, installs no model, driver or toolchain"
+    },
     {
       "id": "codex-app-server:createCodexAppServerSession",
       "name": "createCodexAppServerSession",
@@ -143,14 +157,28 @@
       "name": "createRepositoryWorkspace",
       "displayName": "createRepositoryWorkspace()",
       "kind": "function",
-      "signature": "createRepositoryWorkspace({name,directory,dataRoot,remote,branch,onEvent,run=runProcess}={})",
+      "signature": "createRepositoryWorkspace({name,directory,dataRoot,remote,branch,gitIdentity,onEvent,run=runProcess}={})",
       "entrypoints": ["arcane-os/core/repositories"],
       "primaryImport": "arcane-os/core/repositories",
       "group": "Native repository workspaces",
       "summary": "Owns one selected native working checkout with ArcaneData/Repos defaults and existing Git/process lifecycle.",
       "availability": "Node with Git on Windows, Linux and macOS; Android requires host process adaptation",
       "protocol": "Git working repository and SDK process adapter",
-      "normalization": "Returns directory, open, status, pull, push, write and identical close/drain/dispose hooks. Only missing or empty destinations clone; existing roots are inspected without rewriting, resetting or pulling. Explicit paths remain selected. Same-directory operations serialize within the process; cancellation and shutdown join accepted process work. write snapshots exact selected text and paths, writes files, stages/commits only literal owned paths and non-force pushes, preserving unrelated staged files and ordinary Git filters. Complete outputs and causal failures retain confirmed local/committed/pushed and uncertain outcomes."
+      "normalization": "Returns directory, open, status, configuration, pull, push, write and identical close/drain/dispose hooks. Only missing or empty destinations clone; existing roots are preserved. configuration observes the existing root, symbolic HEAD, origin URL/pushURL arrays and branch remote/merge/upstream URL arrays without clone/init/fetch, preserving unset, empty and repeated values. Explicit paths remain selected. Same-directory operations serialize within the process; cancellation and shutdown join accepted process work. pull/push/write accept a captured target {remote,ref} for current-branch fast-forward pull or non-force current-HEAD selected-ref push; omission retains ordinary configured behavior. write snapshots exact text and paths, stages/commits only literal owned paths and preserves unrelated staged files and Git filters. Complete outputs and causal failures retain confirmed local/committed/pushed and uncertain outcomes plus the supplied target. Optional gitIdentity captures name/email/username for child Git operations only; omitted fields remain inherited and no config file is written."
+    },
+    {
+      "id": "core-repositories:readGitIdentity",
+      "name": "readGitIdentity",
+      "displayName": "readGitIdentity()",
+      "kind": "function",
+      "signature": "readGitIdentity({directory,signal,onEvent,run=runProcess}={})",
+      "entrypoints": ["arcane-os/core/repositories"],
+      "primaryImport": "arcane-os/core/repositories",
+      "group": "Native repository workspaces",
+      "summary": "Reads separate global, repository-local and effective non-secret Git identity configuration.",
+      "availability": "Node with Git on Windows, Linux and macOS; Android requires host process adaptation",
+      "protocol": "Git config NUL-delimited transport through the SDK process adapter",
+      "normalization": "Returns {global,local,effective} observations with complete name/email/githubUser strings or null when unset. Empty strings and configured includes are preserved. Without directory only global is observed and local/effective are null. Concurrent scope reads join process cleanup; complete failures propagate singly or through AggregateError. Changes no config files and claims no authenticated account or environment-resolved author."
     },
     {
       "id": "core-speech:createSpeechService",
@@ -311,14 +339,14 @@
       "name": "createGitTextSnapshot",
       "displayName": "createGitTextSnapshot()",
       "kind": "function",
-      "signature": "createGitTextSnapshot({cacheDirectory,remote,ref,selectPath,onEvent,run=runProcess}={})",
+      "signature": "createGitTextSnapshot({cacheDirectory,remote,ref,selectPath,gitIdentity,onEvent,run=runProcess}={})",
       "entrypoints": ["arcane-os"],
       "primaryImport": "arcane-os",
       "group": "Workspace, doctor, repository, and server",
       "summary": "Reads complete selected text from one fetched revision using a dedicated bare Git object cache and batched retrieval.",
       "availability": "Node with Git; Android requires a host supplying Git/process capability",
       "protocol": "Git tree and batched blob transport through the shared process owner",
-      "normalization": "Returns {refresh,close,drain,dispose}; refresh yields {revision,files:[{path,content}]}, shares concurrent work, reuses unchanged revisions, preserves exact UTF-8 text, isolates caller cancellation and drains accepted work. See git-text-snapshot.md."
+      "normalization": "Returns {refresh,close,drain,dispose}; refresh yields {revision,files:[{path,content}]}, shares concurrent work, reuses unchanged revisions, preserves exact UTF-8 text, isolates caller cancellation and drains accepted work. Optional gitIdentity captures name/email/username for child Git commands including bare init and fetch, without changing config files, payloads or shared acquisition lifetime. See git-text-snapshot.md."
     },
     {
       "id": "diarization:createDiarization",
@@ -465,14 +493,14 @@
       "name": "createBrowserDecisionModel",
       "displayName": "createBrowserDecisionModel()",
       "kind": "function",
-      "signature": "createBrowserDecisionModel({family,model,revision,device,runtime})",
+      "signature": "createBrowserDecisionModel({family,model,revision,device,dtype,runtime}={})",
       "entrypoints": ["arcane-os/ai/browser-decisions"],
       "primaryImport": "arcane-os/ai/browser-decisions",
       "group": "Browser typed decisions",
-      "summary": "Explicit-load Laya FP16 and Julia-1 FP32 decisions with complete inputs and graph results.",
+      "summary": "Explicit-load Laya and Julia-1 decisions with caller-selected precision, complete inputs and graph results.",
       "availability": "Browser module Workers and the selected Transformers.js backend; import/construction starts no model load",
       "protocol": "Caller-owned state/question/options rows; five-input decision graph; native Worker request/result lifecycle",
-      "normalization": "Full field tokenization, raw logits and unrounded softmax; no policy thresholds, storage or precision fallback"
+      "normalization": "Full field tokenization, raw logits and unrounded softmax; dtype defaults to fp16 for Laya and fp32 for Julia, with explicit values forwarded unchanged to the upstream loader; no policy thresholds, storage or precision fallback"
     },
     {
       "id": "root:acceptWebSocket",
@@ -2078,13 +2106,13 @@
       "name": "repositoryPull",
       "displayName": "repositoryPull()",
       "kind": "function",
-      "signature": "async repositoryPull({ workspaceRoot=process.cwd(), signal, onEvent, run=runProcess }={})",
+      "signature": "async repositoryPull({ workspaceRoot=process.cwd(), target, signal, onEvent, run=runProcess }={})",
       "entrypoints": [
         "arcane-os"
       ],
       "primaryImport": "arcane-os",
       "group": "Workspace, doctor, repository, and server",
-      "summary": "Runs one fast-forward-only pull after proving the selected repository worktree is clean.",
+      "summary": "Runs one fast-forward-only pull into the selected clean worktree, optionally from a captured remote/ref target.",
       "availability": "Node; network-assisted Git",
       "protocol": "Node ESM",
       "normalization": "SDK-normalized inputs, errors, events, and documented result"
@@ -2094,13 +2122,13 @@
       "name": "repositoryPush",
       "displayName": "repositoryPush()",
       "kind": "function",
-      "signature": "async repositoryPush({ workspaceRoot=process.cwd(), signal, onEvent, run=runProcess }={})",
+      "signature": "async repositoryPush({ workspaceRoot=process.cwd(), target, signal, onEvent, run=runProcess }={})",
       "entrypoints": [
         "arcane-os"
       ],
       "primaryImport": "arcane-os",
       "group": "Workspace, doctor, repository, and server",
-      "summary": "Pushes the selected attached branch through the repository's configured remote and credentials.",
+      "summary": "Pushes the attached branch through ordinary configured Git or an explicit captured current-HEAD destination without force.",
       "availability": "Node; network-assisted Git",
       "protocol": "Node ESM",
       "normalization": "SDK-normalized inputs, errors, events, and documented result"

package/docs/reference/inventory/runtime-modules.json

@@ -1013,13 +1013,14 @@
       "kind": "esm",
       "exports": [
         "isOllamaModelIdentifier",
-        "normalizeOllamaModelIdentifier"
+        "normalizeOllamaModelIdentifier",
+        "sameOllamaModelIdentifier"
       ],
-      "summary": "Validates and canonicalizes the syntax of Ollama model identifiers without granting model admission.",
+      "summary": "Recognizes Ollama model identifier syntax and compares ordinary resident-model aliases without changing requests.",
       "availability": "Cross-host",
       "protocol": "In-process only",
-      "normalization": "Fully normalized string/boolean result.",
-      "surface": "`normalizeOllamaModelIdentifier()`, `isOllamaModelIdentifier()`."
+      "normalization": "Exact identifier/null or boolean results; alias comparison applies Ollama's default registry, namespace and tag without changing either input.",
+      "surface": "`normalizeOllamaModelIdentifier()`, `isOllamaModelIdentifier()`, `sameOllamaModelIdentifier(left, right)`."
     },
     {
       "file": "runtime/arcane/modules/OllamaSettings.js",