blun-king-cli 9.1.587 → 9.1.589

package/CHANGELOG.md

@@ -1,188 +1,14 @@
-## 9.1.587 - 2026-09-10
+# BLUN King Changelog
 
-- Preserve the active tool catalog across buffered instructions and the following work step. Required tools remain available; retained optional schemas are reselected when the existing schema budget is exceeded.
-- Restore earlier automatic context compaction and allow another automatic compaction in the same turn after a successful shrinking summary. Smaller model limits and failure limits remain in force.
-- After a thinking-only timeout, use the existing single recovery attempt with thinking disabled so the model can answer or call a tool. Subsequent ordinary steps retain the chosen thinking setting; cancellation, approval checks and timeout bounds remain in force.
-- Set BLUN_STABLE_STEER_TOOLS=0 or BLUN_EARLY_COMPACTION=0 before starting King to restore the previous behavior for the respective feature. No existing sessions or configuration files are rewritten by this update.
+## 9.1.589
 
-## 9.1.586 - 2026-09-09
+- Bundle reviewed AgentSpine and Translate Native sources with verified update manifests.
+- Preserve the active King profile when loading agent context.
+- Keep required response-review tools available and record generated-response usage even when review rejects the response.
+- Apply mention-required group routing in the managed channel integration.
+- Show compaction activity and effective thresholds in the terminal.
+- Preserve the early-compaction working budget and request-boundary safety margin across updates.
+- Use the selected language throughout the startup update dialog, progress and queued-update messages.
+- Keep technical integration identifiers and licenses intact while neutralizing visible runtime error messages.
 
-- Fix Telegram receiver startup on Windows when an old bridge PID has been reused by an unrelated process. Preserve uncertain process ownership and never stop that unrelated process.
-- Keep context compaction, model settings, conversation history, and existing Telegram delivery behavior unchanged.
-
-
-## 9.1.585 - 2026-09-08
-
-- Managed WebSearch validates result envelopes and source rows even when optional search status metadata is absent.
-- Malformed successful HTTP responses no longer appear as empty searches; invalid source rows fail the whole response before results or partial-source notices are returned.
-- Valid legacy responses, empty result arrays and empty string excerpts remain supported. Cancellation, request authentication, FetchURL and Telegram behavior are unchanged.
-
-## 9.1.584 - 2026-09-08
-
-- WebSearch forwards caller cancellation through the tool and managed HTTP search request, including response-body reads.
-- Already cancelled searches do not start provider work. Cancellation during credential lookup prevents a later search request; late search results are withheld.
-- Complete, partial and empty-result handling, citation output and normal authentication fallback remain unchanged. No new timeout or Telegram routing change.
-
-## 9.1.583 - 2026-09-08
-
-- FetchURL now passes caller cancellation through the tool and both fetch providers to the HTTP request.
-- An aborted managed fetch no longer starts a local fallback, and a late provider result cannot become source evidence after cancellation.
-- Normal fetch failures still allow the existing fallback. No new timeout is introduced; Telegram routing and model requests are unchanged.
-
-
-# 9.1.582 - 2026-09-08
-
-- Stop oversized local page responses while reading their body, including responses without a reliable Content-Length header. Cancel the stream when received bytes exceed the existing ten MiB limit.
-- Apply the limit to the delivered response stream after HTTP decompression and preserve UTF-8 characters split across chunks. Transport buffers and the crossing chunk may already exist; this is not an exact process-memory ceiling.
-- Keep the research fixes from 9.1.581. Telegram delivery, incoming addressing and model timing logic are unchanged.
-
-## 9.1.581
-
-- Local HTML fetching now rejects extraction results that are empty after cleanup, instead of presenting a document title alone as page content.
-- Short genuine content, visible headings, and plain-text or Markdown responses remain available. The existing extraction error path is preserved.
-- Includes the 9.1.580 research fixes and earlier Telegram repairs unchanged. Model latency and incoming message addressing are unchanged.
-
-## 9.1.580 - 2026-09-08
-
-- Research collections reject impossible calendar dates and unparseable date-time
-  suffixes in optional historical source metadata before saving a new report.
-- Recall skips legacy snapshots containing invalid source dates and reports a
-  diagnostic without rewriting or deleting them. Separate valid snapshots remain
-  searchable; valid date strings keep their original offset and precision.
-- Includes the 9.1.579 research ordering and earlier Telegram repairs unchanged.
-  This release does not change model latency or incoming message addressing.
-
-## 9.1.579 - Research capture ordering
-
-- Saved research passages with equal relevance are ordered by their actual UTC retrieval time, including mixed second and millisecond timestamp formats.
-- Duplicate passages retain the newest capture's provenance. Equal instants retain the existing stable order; relevance still takes priority over time.
-- Existing snapshots are not rewritten or called fresh. This is a local research-recall correction, not a search ranking, model latency or Telegram routing change.
-- Includes the 9.1.578 Telegram reply repair and bounded thinking-only retry unchanged.
-
-## 9.1.578 - 2026-09-08
-
-- Bound thinking-only recovery to one additional attempt per step. A second thinking-only timeout stops that step instead of repeatedly issuing the same request. The chosen reasoning effort and existing timeout remain unchanged; this is not a promise of faster first-token response times.
-- Preserve short Telegram group presence answers when reply_to binds them to a recent same-chat input explicitly addressed to the agent, or a supported German/English presence question beginning with the agent's own configured name. Unsolicited presence and silence-only narration remain filtered; ordinary automatic group fallback stays disabled.
-- Include reply_to in outgoing reply and suppression diagnostics. Missing or ambiguous context does not grant a presence exception. This does not add general recipient recognition or prevent turns caused by legacy semantic addressing.
-- Apply the outbound repair to two exact known managed Telegram MCP revisions, including the final plugin configuration merge. The legacy sender receives a narrowly changed compatibility copy. Existing incoming bridges, access settings, profiles and registers are not rewritten; unknown/custom senders and explicit overrides are preserved. A newly started King process is required.
-
-
-## 9.1.577 - 2026-09-07
-
-- Stop automatically forwarding ordinary assistant turn-end text to Telegram groups, in both the CLI core and the standalone bridge. This prevents the automatic fallback from posting explanations that there is nothing to report or that a message addresses someone else.
-- Group replies must be sent deliberately through the Telegram reply tool. Normal input, active steering and standalone group prompts describe the same delivery rule.
-- Preserve private-chat replies, explicit reply tools, required goal results, command/status messages and media delivery. Mention rules, access settings and managed-plugin resolution are unchanged.
-- This does not guarantee that a model will never make an unnecessary explicit reply, and it does not stop unrelated group input from reaching the model. No AgentSpine or language-guard update is included.
-- Running sessions are not restarted. The updated core must be loaded by a new process. Existing user profiles and session history are retained.
-
-## 9.1.576 - 2026-09-07
-
-- Preserve standalone C++ and C# as distinct terms in local research recall,
-  including case-insensitive queries and ordinary surrounding punctuation.
-- Keep existing saved passages, hashes, source guards, Unicode normalization,
-  collection boundaries and output limits unchanged. No reindexing is required.
-- Add a frozen 20-case technical replay and explicit token-boundary regressions.
-  This is a local recall correction, not a live WebSearch quality or capacity claim.
-- Retain all public575 crawler, search, Telegram, resume and updater changes.
-
-# 9.1.575 - 2026-09-07
-
-- Cumulative release retaining all public 9.1.574 changes.
-- The bundled public-web crawler rejects responses carrying `cf-mitigated: challenge` before reading content, following redirects or treating a missing robots file as permission to continue. Case-insensitive header names, normalized values and repeated headers are checked; the response status is retained in the failure report.
-- Unmarked missing robots files and ordinary documentation continue through the existing path. Completed pages remain available when a later page is rejected, with the failure recorded as partial output.
-- This is a response-marker safeguard, not general challenge detection or a CAPTCHA bypass. It does not change search providers, authentication, update locking or the CLI core.
-
-
-# 9.1.574 - 2026-09-07
-
-- Cumulative release retaining every public 9.1.573 payload change.
-- Explicit updates now distinguish a blocked update, an unavailable lock check,
-  an unavailable private directory, an invalid installed version and an
-  unavailable protected installer instead of reporting them as failed package
-  verification. German and English messages are covered.
-- Update admission, locking, return reasons, exit codes and installer behavior
-  are unchanged. Running sessions are not stopped automatically.
-- Packages pinned to an old internal channel still need an explicit npm
-  installation after King is closed. This release does not remove that pin.
-
-
-## 9.1.573
-
-- Keep the input field visible and focused after the startup goal choice,
-  including Escape and a failed goal-resume request. Preserve unsent drafts.
-- Show a compact with/without-goal choice instead of the entire objective.
-- Ctrl+S leaves that choice without approving the goal and reaches the normal
-  queue shortcut. It also handles pending input while the session is idle.
-- Preserve existing Escape behavior: queued work is cleared before a subsequent
-  Escape cancels the active turn. No automatic deletion of session history.
-
-The release does not reconstruct acknowledgements lost by an older process
-before upgrading. Genuinely pending messages remain attached to their session.
-
-# Changelog
-
-## 9.1.572
-
-- Research evidence rejects source URLs containing recognized credential parameter
-  names in queries or parameter-shaped fragments, including nested names and
-  fragment routes. Rejection applies to failed sources as well as usable sources.
-- Previously saved reports with these URLs are withheld during recall with the
-  existing `partial` / `report-invalid` result. Original snapshots are not modified
-  or deleted, and source addresses are never silently stripped or rewritten.
-- Ordinary documentation queries and anchors retain their exact bytes. This is
-  a credential-name boundary, not general secret detection or a history cleanup.
-
-
-## 9.1.571
-
-- Bind Telegram queue ranges to their owning session. A new session no longer automatically consumes work left pending by an older session; resuming a known session restores only its own pending ranges.
-- Pause channel intake across session selection, creation and switching. Preserve messages arriving after the chosen boundary, local editor follow-ups, and late acknowledgements for their original owner.
-- Keep queue ownership and out-of-order acknowledgements durable across reattachment and lease handover. Reject corrupt or replaced queue state instead of silently replaying old input.
-- Preserve the original inbox and session history. Legacy pending ranges without an identifiable session are parked rather than assigned to an unrelated new session. Automatic recovery of those unowned legacy ranges is not included.
-
-This change does not diagnose or repair every model timeout, compaction stall or cancelled turn. An explicit paused-work state remains a pause. Older application versions do not understand the new session-queue checkpoint; downgrading is not a queue-migration mechanism.
-
-
-- Apply the group-chatter correction to both the Telegram plugin and the console's independent automatic reply fallback.
-- Suppress recognized acknowledgements and narrated silence even when they are longer than 200 characters. Preserve a message whenever it also contains an unrecognized or substantive clause.
-- Preserve short useful group warnings. Message length alone no longer suppresses context-only replies in the console fallback.
-- Explain that ordinary assistant text can be forwarded automatically. Group turns without a request or useful contribution should produce neither a reply tool call nor an assistant message announcing silence.
-- Preserve private replies, group access settings, mention routing, media delivery, and the existing managed-plugin installation mechanism.
-
-This is a conservative German/English delivery guard plus prompt guidance, not a guarantee that every model understands every group conversation. A new process must load the updated package; running sessions are not restarted by this release.
-
-Packages pinned to the old internal update channel still require an explicit npm installation with King closed. Windows EBUSY remains a separate installation-lock problem; do not delete the package or stop unrelated processes on assumption.
-
-All other changes from 9.1.570 remain included. This release does not activate the hosted web-search route or change AgentSpine, billing, authentication, or customer configuration.
-
-## 9.1.570
-
-### Fixed
-
-- Give each new prompt delivery a distinct hook correlation ID. Hooks for the same delivery retain the same ID; explicitly supplied IDs are preserved.
-- Pass session-specific runtime environment values to hook subprocesses and MCP connections, including reconnects, without rewriting stored plugin configuration.
-- Preserve native tool-result correlation across turns, including failed tools and duplicate calls.
-- Match canonically equivalent Unicode research queries without conflating different characters. Stored sources, dates, versions and project boundaries are preserved.
-- Keep `king --help` and `king --version` from changing Windows crash-dump registry settings.
-
-### Added
-
-- Support negotiated partial web-search results with a visible source-failure notice. Empty or incompatible partial responses remain explicit errors. This client change does not activate or guarantee a hosted search service.
-- Add the default-off `BLUN_EXPERIMENTAL_AGENT_SPINE_TIMELINE` transport. When explicitly enabled, it passes the actual persisted session-record path and protocol to the selected AgentSpine plugin, with a separate capability per session and a new capability after resume. This is transport support, not proof of recall or authorization by the receiving plugin.
-
-### Preserved
-
-- Includes the public 9.1.569 Telegram group mention routing, startup, permission persistence, research collection and crawler changes.
-- The bundled AgentSpine implementation is unchanged from public 9.1.569. No Mnemo dependency is introduced.
-- User profiles, permissions, conversations and plugin settings are not migrated or reset by this release.
-
-### Updating
-
-- Public-channel installations use `king update`.
-- Old packages explicitly pinned to the internal update channel do not discover public releases. Close the relevant King sessions, then migrate once with `npm install -g blun-king-cli@9.1.570`.
-- A Windows `EBUSY` rename failure means the installation did not complete. Identify the process holding the package before retrying; do not delete the package or terminate unrelated Node processes.
-
-## 9.1.569
-
-- Cumulative public release including Telegram group mention routing, startup and permission fixes, research collection, and crawler tooling.
-- Published artifacts are immutable. Later changes ship under a new version.
+Installation does not restart existing sessions. A running session loads the new code on its next start.

package/LIESMICH.txt

@@ -1,19 +1,57 @@
-BLUN Code 9.1.566
+BLUN King für macOS und Windows
+===============================
 
-Installation:
-  npm install -g blun-king-cli@9.1.566
+Voraussetzung
+-------------
+Node.js 24.15 oder neuer muss installiert sein.
 
-Start:
-  blun
+Installation
+------------
+Die geprüfte Version exakt global installieren:
 
-Start with the configured Telegram channel:
-  king
+  npm install -g blun-king-cli@9.1.36
 
-At the first start, use /login to connect an account. If an update is
-available, BLUN Code asks before it prepares or starts the installer.
-Automatic installation is disabled by default.
+Start
+-----
 
-Enter /help in the console for the complete command list.
+  blun    Dieselbe CLI, ohne Telegram automatisch anzubinden
+  king    Dieselbe CLI, mit automatisch angebundenem Telegram-Kanal
 
-The public package contains no model-selection dialog. /model is retained only
-as a compatibility alias for /effort.
+Beide Startbefehle verwenden dieselbe Version, dasselbe Konto, dasselbe Modell
+und dieselben Befehle.
+
+Nachweisbare Arbeitsabläufe
+---------------------------
+
+  blun proof       Prüfergebnisse und Artefakte mit SHA-256 belegen
+  blun brief       Einen versionierten Projektauftrag anlegen
+  blun handoff     Eine Sitzung zwischen CLI, Desktop und Web übergeben
+  blun replay      Einen bereinigten Arbeitsverlauf erzeugen
+  blun guard       Belegintegrität und aktuelle Artefakte prüfen
+  blun demo        Eine bereinigte statische Projektdemo erzeugen
+  blun workspace   Isolierte Git-Arbeitsbereiche verwalten
+
+Alle Befehle funktionieren identisch mit `king`.
+
+Aktualisieren
+-------------
+
+  blun update
+
+`king update` und `upgrade` sind gleichwertig. Der Updater bleibt im installierten
+Stable- oder Next-Kanal, verhindert Rückstufungen und installiert nur eine zuvor
+aufgelöste exakte Paketversion.
+
+Beim ersten Start in der Konsole /login eingeben. Der Browser öffnet den
+BLUN-OAuth-Login.
+Ein API-Schlüssel wird weder abgefragt noch in die Konfiguration geschrieben.
+
+Telegram einrichten
+--------------------
+1. Einen Bot bei BotFather anlegen.
+2. Den Bot-Token in dieser Datei eintragen:
+
+   ~/.blun/channels/telegram/.env
+
+3. `king` starten und den angezeigten Pairing-Code mit
+   /telegram:access pair CODE bestätigen.

package/README.md

@@ -1,65 +1,62 @@
-# BLUN Code
+# blun-king-cli — npm-Distribution
 
-BLUN Code is an interactive command-line agent for working with files, shells,
-web tools, MCP servers, and an optional Telegram channel.
+Dieses Verzeichnis ist das Gerüst des öffentlichen npm-Pakets `blun-king-cli`
+(Erstveröffentlichung 8.0.0, 06.07.2026, Account `blunking`).
 
-## Requirements
+## Installation
 
-- Node.js 24.15.0 or newer
-- Windows, macOS, or Linux on x64 or arm64
+Voraussetzung ist Node.js 24.15 oder neuer. Die geprüfte Version wird exakt
+installiert:
 
-## Install
-
-```sh
-npm install -g blun-king-cli@9.1.566
-```
-
-Start the local console with:
-
-```sh
-blun
+```powershell
+npm install -g blun-king-cli@9.1.36
 ```
 
-Use `king` to start the same console with the configured Telegram channel
-attached. On first use, `/login` opens the account sign-in flow.
+## Reproduzierbares Staging und Packen
 
-## Updates
+Der Schritt baut nichts, installiert nichts und veröffentlicht nichts. Vorher müssen
+`apps/blun-king/dist/main.mjs`, `dist-web`, die Darwin- und Windows-Natives sowie
+`plugins/telegram/dist` bereits frisch gebaut sein.
 
-When an update is available, BLUN Code asks what to do before preparing or
-starting an installer. Choose one of these actions:
+Das Staging landet standardmäßig
+unter `.stage/package`, das Tarball unter `.stage/artifacts`.
+`BLUN_NPM_STAGE_DIR` und `BLUN_NPM_ARTIFACT_DIR` können beide Ziele überschreiben;
+beim direkten Skriptaufruf stehen zusätzlich `--output` und `--artifacts` bereit.
 
-- Update now
-- Skip this start
-- Wait for the next release
-
-Unattended updates are opt-in. They can be enabled in `tui.toml`:
-
-```toml
-[upgrade]
-auto_install = true
-```
+Der Schritt validiert alle Pflichtartefakte vor dem Leeren des alten Stagings. Er
+kopiert nur die Paket-Hülle, `blun.mjs`, `dist-web`, `native`, Telegrams
+`dist`/Manifest/Commands und die Repo-Skills.
 
-## Commands
+## Startmodi
 
-Enter `/help` in the console to see the available commands. Common commands
-include `/login`, `/usage`, `/mcp`, `/telegram:access`, and `/effort`.
+`blun` startet die lokale Konsole, ohne Telegram automatisch anzubinden. `king`
+startet dieselbe Konsole und bindet den eingerichteten Telegram-Kanal automatisch
+an. Version, Konto, Modell und Befehle sind ansonsten identisch. Der Unterschied
+gilt nur für den laufenden Prozess; die gespeicherte
+Plugin-Konfiguration wird nicht umgeschrieben.
 
-`/model` remains a compatibility alias for `/effort`; the public package does
-not expose a model-selection dialog.
+Beim ersten Start werden das Telegram-Plugin und die mitgelieferten Skills
+eingerichtet. Die Anmeldung erfolgt anschließend in der
+Konsole mit `/login` über den BLUN-OAuth-Server. Das Paket erzeugt keine
+statische Anbieter- oder API-Key-Konfiguration.
 
-## Telegram
+## Nachweisbare Arbeitsabläufe
 
-Run `/telegram:access connect` in the console to create a short-lived pairing
-code. Send `/connect CODE` in the intended private chat or group. Pairing codes
-expire after ten minutes and can be used once.
+Version 9.1.0 enthält sieben zusätzliche, getrennt nutzbare Befehlsgruppen:
 
-## MCP servers
+- `proof` belegt Prüfungen und Artefakte mit SHA-256.
+- `brief` erstellt einen versionierten Projektauftrag.
+- `handoff` übergibt eine Sitzung zwischen CLI, Desktop und Web.
+- `replay` erzeugt einen bereinigten Arbeitsverlauf.
+- `guard` prüft Belegintegrität und aktuelle Artefakte.
+- `demo` erzeugt eine bereinigte statische Projektdemo.
+- `workspace` verwaltet isolierte Git-Arbeitsbereiche.
 
-Use `/mcp` to inspect connected servers. Command-line management is available
-through `blun tools list`, `blun tools enable NAME`, and
-`blun tools disable NAME`.
+Sie stehen unter `blun` und `king` identisch zur Verfügung.
 
-## Privacy
+## Aktualisieren
 
-The package contains no account credentials or private channel identifiers.
-Local profiles, sessions, and configuration remain in the user's BLUN home.
+`blun update`, `king update` und die jeweilige Variante `upgrade` verwenden
+denselben abgesicherten Updater. Er bleibt im installierten Stable- oder
+Next-Kanal, verhindert Rückstufungen und übergibt npm ausschließlich eine zuvor
+aufgelöste exakte Paketversion.

package/agent-spine-plugin/.codex-plugin/plugin.json

@@ -9,22 +9,34 @@
   "homepage": "https://github.com/Maykbiletti/AgentSpine",
   "repository": "https://github.com/Maykbiletti/AgentSpine",
   "license": "Apache-2.0",
-  "keywords": ["identity", "memory", "mcp", "agents"],
+  "keywords": [
+    "identity",
+    "memory",
+    "mcp",
+    "agents"
+  ],
   "skills": "./skills/",
   "hooks": "./hooks/codex.json",
   "mcpServers": {
     "agent-spine": {
       "command": "node",
-      "args": ["${PLUGIN_ROOT}/src/mcp.js"]
+      "args": [
+        "${PLUGIN_ROOT}/src/mcp.js"
+      ]
     }
   },
   "interface": {
     "displayName": "AgentSpine",
     "shortDescription": "Identity and memory without rewriting your files.",
     "longDescription": "Maps existing rules, soul, memory, and linked Markdown into a verifiable context spine while preserving every source byte.",
-    "developerName": "Mayk Biletti",
+    "developerName": "BLUN",
     "category": "Developer Tools",
-    "capabilities": ["Read", "MCP", "Hooks", "Worker"],
+    "capabilities": [
+      "Read",
+      "MCP",
+      "Hooks",
+      "Worker"
+    ],
     "websiteURL": "https://github.com/Maykbiletti/AgentSpine",
     "defaultPrompt": [
       "Map this project's existing agent identity.",

package/agent-spine-plugin/CHANGELOG.md

@@ -6,6 +6,17 @@ All notable changes to AgentSpine will be documented here. The project follows [
 
 ### Added
 
+- Added provider-native pre-answer delivery binding. Codex receipts use its supported string `turn_id` and bind any accompanying exact event ID; hosts without a supported turn ID receive a process-local hook-invocation capability, so identical legitimate prompts are distinct without reviving the old prompt-digest replay collision. Unsupported numeric turn claims remain rejected.
+- Added source-verified objective-result continuation advancement for one exact private task/thread. A pre-existing source-bound outcome contract fixes the measured step and success transition; failures update only the last verified step without retrying, successes apply only the contracted successor or completion, and stale/postdated/conflicting contracts or newer user corrections prevent automatic advancement.
+- Development only: one source-bound interpretation or exact-set clarification for two to three natural user messages survives restart/compaction. Multi-session ambiguity reopens each source and binds provider, session, message and digests. Pre-answer envelopes omit redundant absolute paths so fixed budgets remain platform-neutral. Candidates stay `model-suggestion` assumptions with `completionVerified:false`; continuation, authority, completion and semantic acceptance are unchanged. A real new-session model acceptance is still required.
+- Added a source-verified timeline correction path for an existing task continuation. Only an enrolled native user message with the exact `Correction: next step:` or `Korrektur: nächster Schritt:` prefix can replace the next step, and only inside the authenticated portal/thread route; ordinary chat and model text remain excluded.
+- Added an explicit timeline-to-world capture path. One exact objective event from a bound search is reopened, byte-verified and recorded in the existing world model with host-derived task, portal/thread, source, message and time provenance; archived chat and caller interpretations are never promoted to facts.
+- Extended the authenticated opaque portal/thread binding from session-timeline recall through the existing structured knowledge and task-continuation path. The exact current thread now receives its confirmed correction, last verified step, and next step across restart and compaction; deliberately portable project knowledge remains portable.
+- Added an authenticated, opaque portal/thread continuity binding to the existing session-timeline lifecycle. Prior-session hints and evidence searches now stay inside the exact channel route that created the enrollment; unbound historical records remain valid but cannot enter a route-bound search.
+- Added an explicit group-response contract to the gateway worker: silent completion creates no outbox or delivery claim, and scoped exact-content contribution deduplication survives restart. Direct answers and legacy host replies remain compatible; live King addressing and adoption are not implied.
+- Added action-time recall for currently valid, outcome-gated behavior learning whose stored task scope exactly matches the authenticated runtime task. Claude, Codex and King-compatible lifecycle hooks receive the bounded context before tool use without creating permissions or a second application receipt.
+- Added a local, command-free artifact evaluator that derives pass rates and blocking defects from at most sixteen precommitted file checks and submits actual observations to the existing learning-measurement contract. It is one evaluator principal, not a source of independent aliases, authorization, completion or automatic promotion.
+- Added a disabled-by-default cross-provider objective-evidence handoff across separately enrolled Claude, Codex and King sources. It requires a protected local host capability plus an explicit prior-provider search, ranks the bounded index first, opens at most one immutable snapshot and returns provider/session/message provenance.
 - Added a native King agent-wire history adapter with an explicit protected source/protocol mapping, provider-separated lifecycle binding, bounded objective `tool.result` extraction, and stable session/message references. It never scans `BLUN_HOME`, reuses Codex rollout parsing, or changes King permissions.
 - Added an explicitly enrolled native Codex rollout adapter for bounded same-task historical tool-result recall, with project/session header verification, native message references, unchanged source bytes and independent provider contracts. Live-host acceptance remains open.
 
@@ -18,6 +29,12 @@ All notable changes to AgentSpine will be documented here. The project follows [
 
 ### Security
 
+- Explicit next-step corrections preserve the existing objective, status, open questions and last verified step, retain superseded history, reject completed/conflicting/missing or newer continuations, and use an active-set compare-and-swap so concurrent different corrections cannot fork the current checkpoint. The sidecar stores no correction text or content-derived search terms; they remain context-only and grant no action or send authority.
+- Timeline capture has its own one-use `PreToolUse` invocation and derives the assertion ID, subject, predicate, evidence class, evidence digest, source references and private route scope internally. Direct MCP, replay, foreign/group scope, wrong event IDs, changed sources and caller-supplied provenance write nothing; contradictory measurements remain uncertainty instead of becoming a selected fact.
+- Task-subject knowledge written or read through a portal-bound MCP process takes project, group, task, portal, and thread from authenticated gateway context. Tool-supplied route claims, partial pairs, foreign task reads, and cross-thread supersession fail closed; unbound readers cannot see route-bound task knowledge.
+- Portal and thread references are derived inside the gateway from the authenticated provider, tenant, account, binding, chat, thread, session, agent and project route. Raw route IDs are not stored in timeline state; model-supplied route claims, partial bindings and foreign threads return no recall and create no authority.
+- Action-time learning excludes generic, foreign-task, foreign-tenant, group, stale, revoked and rolled-back candidates. Learning-state failures degrade this advisory recall without blocking normal host work, while existing source lessons remain separately bounded and user-owned source bytes stay unchanged.
+- Cross-provider recall requires exact private entity, user, tenant, project, task and compatible-goal continuity. The current provider keeps its own transport binding while the selected source is revalidated with its original signed provider enrollment and profile root; missing opt-in, foreign/group scope, expiry, mutation and replay return no content or authority.
 - Task recall opens no source, grants no authority, excludes unsafe state, and returns at most six entries.
 - Task continuation is context-only and derived only from current, confirmed, conflict-free, exactly scoped checkpoints. Proposed, stale, conflicting, foreign and malformed checkpoints are never resumable; completed checkpoints require a passed verified step and no remaining work.
 - Structured knowledge remains context-only: repeated model suggestions stay assumptions, unresolved conflicting values cannot enter facts, foreign project/group/private records remain excluded, and secret-shaped values or rationales fail both ingestion and persisted-state validation.
@@ -26,6 +43,13 @@ All notable changes to AgentSpine will be documented here. The project follows [
 
 ### Tests
 
+- Native Claude hook processes now accept two identical prompt submissions (1/2 before, 2/2 after); Codex accepts two distinct native turns and rejects reuse of one turn. Cross-turn receipt verification, copied-input reconstruction, unsupported numeric IDs, restart state, and instruction-source byte preservation are covered. These are lifecycle tests, not model application.
+- A three-provider parser probe admits only strictly prefixed native user corrections and excludes assistant claims, ordinary chat, multiline content, secrets and instruction overrides. A real Claude hook/MCP multi-session comparison changes the same-thread next step from the obsolete plan to the explicit correction, keeps a foreign thread empty, rejects a stale correction, deduplicates a concurrent capture across fresh processes and preserves source bytes; no model or token benefit is claimed.
+- A multi-session Claude Before/After starts with zero structured entries despite a verified historical `FAIL 0/15`, then records exactly one source-derived entry visible after an MCP restart only in the same BLUN thread. Concurrent capture, duplicate restart, conflict preservation, direct calls, wrong events, source mutation, group/route isolation and source bytes are covered; native Codex and King histories exercise the same capture tool without implying live-host or model performance.
+- A two-thread continuation comparison holds user, tenant, project, and task constant: the prior unbound view yields zero resumable checkpoints because the states conflict, while the authenticated view yields exactly one current correction and next step. MCP write/read, `SessionStart`, `PostCompact`, a fresh process, terminal foreign work, portable project learning, race, tamper, service failure, source bytes, and the 9,500-byte hook budget are covered; model/token improvement is not claimed.
+- Product and documentation growth before this release-evidence line measured 1,953 packed and 6,913 unpacked bytes. The finite ceilings move by 2 KiB packed and 7 KiB unpacked; file-count, required-file, forbidden-source and safety checks are unchanged.
+- A three-session portal comparison fixes the task, user, tenant and project while varying only the thread: the legacy binding admits two prior candidates, whereas the authenticated route admits exactly one and retrieves its sourced FAIL 0/15. Restart, compaction, self-claims, partial routes, transcript bytes and route-boundary changes are covered; no model or token improvement is claimed.
+- A synthetic Claude-to-Codex Before/After proves that provider history is absent by default and exactly one measured `FAIL 0/15` becomes available after both opt-ins and restart/compaction. Provider provenance, source bytes, invocation replay, scope/group isolation and changed-source rejection are covered.
 - Synthetic King sessions A/B prove measured `FAIL 0/15` recall after restart and compaction while exact gateway binding, wrong protocol/path/scope/provider, replay/race, source mutation, unknown records, and source-byte preservation remain enforced.
 - A CSS-archive Before/After restores its sourced backup lesson after restart and `PostCompact`; boundary tests remain green.
 - Synthetic Before/After probes show that a legacy task-state cannot reconstruct work, while the structured checkpoint restores exactly one sourced next step after a separate-process restart and `PostCompact`. Correction, completion, MCP, scope, conflict, proposal, tamper, bounds and source-byte tests prevent false continuation.
@@ -34,6 +58,8 @@ All notable changes to AgentSpine will be documented here. The project follows [
 
 ### Fixed
 
+- The portal/thread lifecycle probe that starts a fresh process now runs outside the shared Windows I/O pool. Its existing assertions and process deadlines are unchanged.
+- The hermetic runner isolates the real host-origin source-attestation probe from concurrent Windows filesystem pressure, preserving its existing fail-closed result and timing boundaries without increasing a timeout.
 - Reuse host-verified, assignment-bound briefing observations in MCP delivery preparation without a second content fetch; keep missing proof advisory and document provider-specific history limits.
 
 - Integrated the preserved attention refactoring: six modules (each below 500 lines), unchanged function bodies and public API, and removal of its legacy line-budget exception. Package allowance grows by 4 KiB for explicit module boundaries.
@@ -41,8 +67,14 @@ All notable changes to AgentSpine will be documented here. The project follows [
 
 ### Evidence limits
 
-- The King repository adapter is pinned to public BLUN Code `1.0.109` commit `fbb97459` and vendored King SDK `0.12.1` format evidence. Fredrik's actual source/protocol mapping, installed format, live A/B recall, and host block enforcement remain unverified; no live configuration was changed.
-- Public BLUN Code 1.0.109 naming evidence and synthetic hook/MCP tests establish the repository contract only. The separate King host bug that ignores a returned `{decision:"block"}` and Fredrik's live installation remain unverified external boundaries.
+- Product and documentation growth for explicit next-step correction measured about 2.6 KiB packed and 11.6 KiB unpacked. Existing headroom plus an 11 KiB unpacked-ceiling increase contains the change; packed, file-count, required-file, forbidden-source, timeout and safety gates are unchanged.
+- Product and documentation growth for timeline-to-world capture measured 2,901 packed and 13,132 unpacked bytes. The finite ceilings move by 4 KiB packed and 13 KiB unpacked; file-count, required-file, forbidden-source, timeout and safety checks are unchanged, and the new production module is now required in the package.
+- Product and documentation growth before this release-evidence note measured 2,070 packed and 8,682 unpacked bytes. The finite ceilings move by 3 KiB packed and 9 KiB unpacked; file-count, required-file, forbidden-source, timeout, and safety checks are unchanged.
+- The pre-adjustment dry run exceeded the prior ceiling by 616 packed bytes and 1,492 unpacked bytes. The finite ceilings grow by 2 KiB packed and 3 KiB unpacked; file-count, required-file and forbidden-source gates are unchanged.
+- MemPalace `v3.9.0` commit `d9f05907` (MIT) and Claude-Mem commit `3939fbb2` (Apache-2.0), inspected 2026-09-06, informed only the separate-adapter and progressive-retrieval architecture. No external code or script was copied or executed. Repository tests do not establish an ExampleOperator or ExampleAgent live handoff.
+- The finite release ceiling grows by 4 KiB packed and 8 KiB unpacked for the provider-handoff implementation, provenance fields and contract; file-count and forbidden-source gates are unchanged.
+- The King repository adapter is pinned to public BLUN Code `1.0.109` commit `fbb97459` and vendored King SDK `0.12.1` format evidence. ExampleAgent's actual source/protocol mapping, installed format, live A/B recall, and host block enforcement remain unverified; no live configuration was changed.
+- Public BLUN Code 1.0.109 naming evidence and synthetic hook/MCP tests establish the repository contract only. The separate King host bug that ignores a returned `{decision:"block"}` and ExampleAgent's live installation remain unverified external boundaries.
 
 ## [0.73.0] - 2026-09-05
 
@@ -70,7 +102,7 @@ All notable changes to AgentSpine will be documented here. The project follows [
 ### Security and evidence limits
 
 - Synthetic install/update/restart verifies exact skill bytes, four listed tools, a real source read, existing-session continuity and bound briefing/knowledge/premortem calls. Foreign skills, foreign Codex configuration, project sources and unknown external state remain byte-identical.
-- Unmanaged skill directories, symlinked destinations, tampering, staged crashes and parallel updates are rejected or recovered without clearing state. Repository checks do not prove native `skills/list`, `mcpServerStatus/list`, host trust or an Otto restart; no live profile or CodexLink configuration was changed.
+- Unmanaged skill directories, symlinked destinations, tampering, staged crashes and parallel updates are rejected or recovered without clearing state. Repository checks do not prove native `skills/list`, `mcpServerStatus/list`, host trust or an ExampleOperator restart; no live profile or CodexLink configuration was changed.
 
 ## [0.72.6] - 2026-09-05
 
@@ -82,7 +114,7 @@ All notable changes to AgentSpine will be documented here. The project follows [
 ### Security and evidence limits
 
 - Synthetic install/update/restart exercises a 0.72.5 cache followed by 0.72.6, removes the old cache, lists tools, reads an existing session source and performs the bound briefing, knowledge and premortem calls. A wrong `PLUGIN_ROOT` is ignored; foreign Codex configuration, unknown external state and source bytes remain unchanged.
-- Unmanaged duplicate registrations, malformed managed blocks, symlinked homes/configuration/package roots, tampered registrations, staged crashes and parallel updates are rejected or recovered without deleting state. This is repository evidence only: no live Codex profile, Otto session, trust decision or CodexLink configuration was changed.
+- Unmanaged duplicate registrations, malformed managed blocks, symlinked homes/configuration/package roots, tampered registrations, staged crashes and parallel updates are rejected or recovered without deleting state. This is repository evidence only: no live Codex profile, ExampleOperator session, trust decision or CodexLink configuration was changed.
 
 ## [0.72.5] - 2026-09-05
 
@@ -93,7 +125,7 @@ All notable changes to AgentSpine will be documented here. The project follows [
 
 ### Evidence limits
 
-- The probes reproduce the documented Codex hook wire contract and measured Work tool result shape. They do not claim a live Otto restart, installation or state migration. CodexLink remains outside AgentSpine.
+- The probes reproduce the documented Codex hook wire contract and measured Work tool result shape. They do not claim a live ExampleOperator restart, installation or state migration. CodexLink remains outside AgentSpine.
 
 ## [0.72.4] - 2026-09-05
 

package/agent-spine-plugin/README.md

@@ -92,9 +92,9 @@ claude --plugin-dir .
 
 Claude Code discovers the bundled skill, hooks, and MCP server. Review and trust executable components when the host asks.
 
-Version `0.73.0` keeps the managed common Codex skill, stable reader verification, assignment continuation and structured completion from `0.72.2`–`0.72.7`, and adds bounded long-session evidence recall without duplicating a host transcript. Claude, Codex, and King use separate deny-by-default source/format adapters; matching tool names never substitute for native provider evidence. A verified `UserPromptSubmit` creates an opaque receipt; only a local owner can consume it with `timeline-enroll --receipt … --confirm-local-timeline` for one immutable private snapshot. Groups stay excluded. After compaction, an agent asks only for one exact UTC time or at least two concrete terms through `session_timeline_search`; `includePriorSessions` can select an already indexed immutable snapshot from the exact same private task after restart. The sidecar is ranked before at most one source is opened, and every returned card carries stable session/message references. A matching real `PreToolUse` provides the one-use binding, so raw MCP, reuse, changed scope, or a changed source returns no history. Redacted results are untrusted context and grant no authority. See [bounded session timeline](docs/session-timeline.md).
+Version `0.73.0` keeps the managed common Codex skill, stable reader verification, assignment continuation and structured completion from `0.72.2`–`0.72.7`, and adds bounded long-session evidence recall without duplicating a host transcript. Claude, Codex, and King use separate deny-by-default source/format adapters; matching tool names never substitute for native provider evidence. A verified `UserPromptSubmit` creates an opaque receipt; only a local owner can consume it with `timeline-enroll --receipt … --confirm-local-timeline` for one immutable private snapshot. Groups stay excluded. After compaction, an agent asks only for one exact UTC time or at least two concrete terms through `session_timeline_search`; `includePriorSessions` can select an already indexed immutable snapshot from the exact same private task after restart. Provider mixing stays off unless the local host sets `AGENTSPINE_TIMELINE_CROSS_PROVIDER=1` and the bounded call also sets `includePriorProviders: true`; every selected snapshot is revalidated with its own provider enrollment and returned with provider provenance. The sidecar is ranked before at most one source is opened, and every returned card carries stable session/message references. A matching real `PreToolUse` provides the one-use binding, so raw MCP, reuse, changed scope, or a changed source returns no history. `session_timeline_capture` can then reverify one exact returned objective result and mechanically place only its measured fields in the existing thread-bound world model. It can also apply a native user message beginning exactly with `Correction: next step:` or `Korrektur: nächster Schritt:` to an existing same-thread continuation; ordinary chat, model text and caller interpretations are ignored. Redacted results and captured knowledge remain context-only and grant no authority. See [bounded session timeline](docs/session-timeline.md).
 
-The current structured world view also supports a bounded normal-task continuation checkpoint. It restores the exact confirmed objective, last verified step, open questions and next step after restart or compaction, with source references and without loading transcript history. Proposed, conflicting, foreign and completed work is never presented as resumable. See [provenance-bound world model](docs/world-model.md).
+The current structured world view also supports a bounded normal-task continuation checkpoint. It restores the exact confirmed objective, last verified step, open questions and next step after restart or compaction, with source references and without loading transcript history. In an authenticated portal task, the checkpoint and task-subject corrections additionally stay on the exact opaque portal/thread route; another thread with the same task ID cannot read or supersede them. Proposed, conflicting, foreign and completed work is never presented as resumable. See [provenance-bound world model](docs/world-model.md).
 
 Version `0.72.0` keeps the durable provenance-bound world model and decomposes the complete outcome-bound learning runtime into bounded contract domains. The current unreleased world view additionally separates facts, user preferences, decisions with rationale, task state, and error lessons. Every typed entry retains evidence, time, scope and optional session/message references; model suggestions remain assumptions, conflicts withhold facts, and explicit corrections preserve superseded history without bloating briefing.
 
@@ -349,7 +349,7 @@ flowchart LR
 - `shared_context` reads only locally reviewed shared memory. MCP intentionally cannot initialize adapters, publish, pull, inspect the pending inbox, review imports, roll back, or delete.
 - `record_delivery_premortem` records the exact three context-only failure checks for one hook-issued requirement before mutation. Its sealed receipt is bound to the session and active goal step and grants no permissions or tool access.
 - `record_world_assertion` stores one immutable measured, explicitly user-confirmed, or model-proposed assertion outside source files; optional typed knowledge distinguishes facts, user preferences, decisions, task state, and error lessons. `world_context` returns only unexpired, non-conflicting established facts while exposing assumptions, stale evidence, contradictions, and opt-in correction history separately. An exact resumable task adds at most six matching confirmed entries with source references.
-- `session_timeline_index` and `session_timeline_search` provide explicitly enrolled, scope-bound bounded indexing and time-or-two-term recall of redacted structured transcript evidence. An explicit same-task prior-session query ranks only the signed sidecar before verifying one immutable source and returns stable session/message references. The tools never register arbitrary paths, return raw transcript bytes, or add authority. See [bounded session timeline](docs/session-timeline.md).
+- `session_timeline_index`, `session_timeline_search`, and `session_timeline_capture` provide explicitly enrolled, scope-bound bounded indexing, time-or-two-term recall, and explicit structured capture of one reverified objective result or strictly prefixed native user next-step correction. An explicit same-task prior-session query ranks only the signed sidecar before verifying one immutable source and returns stable session/message references. Capture derives provenance and exact portal/thread/task scope from that source and the authenticated host rather than tool claims. The tools never register arbitrary paths, return raw transcript bytes, infer ordinary chat as facts, or add authority. See [bounded session timeline](docs/session-timeline.md).
 - `audit` runs the same ten gates available through the CLI.
 
 Relationship updates supersede the active view but retain the previous observation in append-only graph history. Permission-like and credential-like attributes are rejected recursively. See [relationships and learning](docs/relationships.md).