chati-dev 4.5.12 → 4.5.13

package/framework/config.yaml

@@ -1,8 +1,8 @@
 # chati.dev Configuration
-version: "4.5.12"
+version: "4.5.13"
 installed_at: "2026-02-07T10:00:00Z"
 updated_at: "2026-08-27T00:00:00Z"
-installer_version: "4.5.12"
+installer_version: "4.5.13"
 project_type: greenfield
 language: en
 ides: []

package/framework/constitution.md

@@ -890,11 +890,11 @@ The Tasks agent assigns the kind. When a task could be either `script` or `agent
 
 ---
 
-*Chati.dev Constitution v4.5.12: 25 Articles + Preamble*
+*Chati.dev Constitution v4.5.13: 25 Articles + Preamble*
 *v4.2.0 Amendments: Article V amended (Team Communication); Article VIII amended (Team Handoff Envelope); Article XII amended (PRISM L6 Team Roster); Article XXI added (Agent Teams Governance); Article XXII added (Fault Vector Protocol)*
 *v4.2.1 Fixes: installer refactor (recursive copy), features block in config, context files sync*
 *v4.2.2 Fixes: 10 hooks rewritten to canonical hookSpecificOutput schema; .claude/settings.json now written by installer; license enforcement 3-provider; Agent Teams default ON*
 *v4.2.3 Fixes: directory restructure (.chati.dev/ hidden + artifacts/ at root); deterministic pipeline router; Agent Teams communication validated; 3-layer integrity checking; CLI dispatch loop enforcement*
 *v4.3.0 Additions: qa-visual agent registered across all providers, model maps, artifact scopes, isolation, and entity registry; Premium Animation Standards + Visual QA Phase 5e; Article XXIII added (Reasoning Tier Governance)*
-*v4.5.12 Runtime: Planning seals a provider-neutral handoff; RAIL is the sole implementation and independent-review authority; Release Lane requires evidence and explicit human authorization.*
+*v4.5.13 Runtime: Planning seals a provider-neutral handoff; RAIL is the sole implementation and independent-review authority; Release Lane requires evidence and explicit human authorization.*
 *All agents are bound by this Constitution. Violations are enforced per article.*

package/framework/context/root.md

@@ -1,7 +1,7 @@
 # Chati.dev System Context
 
 ## Framework
-- **Version**: 4.5.12
+- **Version**: 4.5.13
 - **Agents**: Specialized discovery and planning agents feeding provider-neutral RAIL execution and a sealed release lane
 - **Constitution**: 25 Articles + Preamble
 - **Quality**: 5 pipeline gates + 3-tier verdicts + Fault Vector Protocol (Article XXII)

package/framework/data/entity-registry.yaml

@@ -3,7 +3,7 @@
 # and by the Health Check for system integrity validation.
 
 metadata:
-  version: "4.5.12"
+  version: "4.5.13"
   last_updated: "2026-08-27T00:00:00Z"
   entity_count: 109
   checksum_algorithm: sha256

package/framework/manifest.json

@@ -1,5 +1,5 @@
 {
-  "createdAt": "2026-08-27T15:44:26.707Z",
+  "createdAt": "2026-08-27T20:02:13.399Z",
   "files": {
     "agents/build/dev.md": {
       "hash": "13c2b3855c1f815154a2f4020b99fd8ee71e701b41783f5f26696222720a1466",
@@ -97,12 +97,12 @@
       "type": "md"
     },
     "config.yaml": {
-      "hash": "35917976892c5b3a929837f0193e6b08115c84134af233aba0c79f201688d193",
+      "hash": "ecdeb8f0ff8638ea702d7c6b8dfb23bf2130480fafc00767882e1cdbb97c52eb",
       "size": 2671,
       "type": "yaml"
     },
     "constitution.md": {
-      "hash": "5b617a789e63a198828398fb673dc8ae4d9ba28728ebcabb2eaa83dc21ab1402",
+      "hash": "23ca8da91b0886332fcf0f6b4965fadcb0b8a6e9a0da7f5e0346d16c27387fa9",
       "size": 66739,
       "type": "md"
     },
@@ -122,12 +122,12 @@
       "type": "md"
     },
     "context/root.md": {
-      "hash": "97f4f47c0ecb2499482401ee859512b30d9c39b53b85261c046145d4b8eeb0ae",
+      "hash": "1a3036f7c7831cea869b4273da77d4b4c3ddcbfcb9c0eea5fac6dd78b07a6016",
       "size": 1218,
       "type": "md"
     },
     "data/entity-registry.yaml": {
-      "hash": "61a4cf5f7ad94b925182040befa609dc0ed8e0598f22118891337f225081667b",
+      "hash": "9a9ad8f246a5c751bb29523d3a24d98e7b58ac9535d75e3800538c1395ae90f9",
       "size": 34606,
       "type": "yaml"
     },
@@ -1352,5 +1352,5 @@
       "type": "yaml"
     }
   },
-  "version": "4.5.12"
+  "version": "4.5.13"
 }

package/framework/manifest.sig

@@ -1 +1 @@
-qw0VeF2Ymm1U0meAoVLpTkcRUKiPWmv1LhJvOo6GdZYWc81BUGLHW1uMWcI84SkVRsI4skriATd7rAi2h13kAQ==
+TEzLr1bBMHjCWgycL61RoRjockr/aGq83X862GPhOxS2eibvCeceRSM/PkUcAM4OCPAUIqmoUC/t66dhwZqhDQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chati-dev",
-  "version": "4.5.12",
+  "version": "4.5.13",
   "description": "AI-Powered Multi-Agent Orchestration System - Structured vibe coding for Full Stack Development",
   "type": "module",
   "bin": {

package/src/config/framework-adapter.js

@@ -65,6 +65,30 @@ const PROVIDER_META = {
   },
 };
 
+const CODEX_CREDENTIAL_BOUNDARY = `
+## Codex external provider credential boundary
+
+Commands returned in any \`spawn_command\`, \`parallel_spawn_command\` or
+\`parallel_spawn_commands\` start another provider CLI. Codex MUST execute each
+of these commands with native escalated execution so the child CLI can access
+its existing local credentials:
+
+- Set \`sandbox_permissions\` to \`require_escalated\`.
+- Explain that Chati needs to run the selected provider CLI using its existing
+  local authentication.
+- Offer the narrow reusable prefix made from the first two command arguments:
+  \`["node", "<absolute path from the command to run-agent.js>"]\`.
+- Keep the project working directory and the router-provided command unchanged.
+
+Never test a routed provider command inside the workspace sandbox first. A
+\`PROVIDER_NOT_READY\` or \`PROVIDER_NOT_AUTHENTICATED\` result obtained inside
+that sandbox is inconclusive because the sandbox can hide OS credentials. If a
+sandboxed attempt already failed, rerun it once with native escalated execution.
+Only a failure from that escalated attempt may be reported as an authentication
+failure. Do not repeat the same sandboxed command and do not offer to skip a
+required v2 pipeline stage.
+`;
+
 // ---------------------------------------------------------------------------
 // Replacement Configuration Builder
 // ---------------------------------------------------------------------------
@@ -225,5 +249,12 @@ export function adaptFrameworkFile(content, filePath, provider) {
     result = result.replace(pattern, replacement);
   }
 
+  if (provider === 'codex' && filePath === 'orchestrator/chati.md') {
+    const routedAction = '## Action: Routed Interactive Agent';
+    result = result.includes(routedAction)
+      ? result.replace(routedAction, `${CODEX_CREDENTIAL_BOUNDARY}\n${routedAction}`)
+      : `${result.trimEnd()}\n\n${CODEX_CREDENTIAL_BOUNDARY.trimStart()}`;
+  }
+
   return result;
 }

package/src/installer/templates.js

@@ -229,12 +229,42 @@ name: chati
 description: >
   Use this skill when the user wants to start or continue a Chati.dev session.
   This activates the orchestrator which routes to the correct agent in the pipeline.
-  Invoke when the user mentions chati, /chati, wants to plan, build, or deploy a project.
+  Invoke when the user mentions chati, /chati, or wants to discover, plan, execute, or release a project.
   Do NOT use for general coding questions unrelated to the Chati.dev pipeline.
 ---
 
 # Chati.dev Orchestrator
 
+## STEP 0 — Run the deterministic router (MUST be the first action)
+
+Use the shell in the current project directory and run:
+
+\`\`\`bash
+node .chati.dev/orchestrator/chati-router.js
+\`\`\`
+
+Do not infer provider authentication, session state, model availability, or the
+next pipeline action from files or prior messages. The router output is the
+source of truth. Do not tell the user to log in unless the router or the exact
+routed spawn command returns a provider authentication error.
+
+Parse the JSON output before responding:
+
+- If \`ok\` is \`false\`, report the exact \`error\` and relevant detail, then stop.
+- If \`ok\` is \`true\`, use \`session.language\` for every response.
+- Follow the returned \`action\` in the adapted orchestrator.
+- When the action includes \`pipeline.spawn_command\`, execute that exact command.
+  Never replace it with an inferred provider check or a manually constructed command.
+- A router-provided spawn command starts an external provider CLI. Execute it
+  with native escalated execution: set \`sandbox_permissions\` to
+  \`require_escalated\`, preserve the exact command and working directory, and
+  offer the narrow reusable prefix
+  \`["node", "<absolute path from spawn_command to run-agent.js>"]\`.
+- Do not run that provider command inside the workspace sandbox first. A
+  \`PROVIDER_NOT_READY\` or \`PROVIDER_NOT_AUTHENTICATED\` result from a sandboxed
+  attempt is not proof that the user is logged out. Rerun it once with native
+  escalation before reporting an authentication failure.
+
 ## CRITICAL: Language Override
 
 Read \`.chati/session.yaml\` field \`language\` BEFORE anything else.