dominus-sdk-nodejs 11.0.5 → 11.0.7

package/docs/atlas/2026-07-24-1231-sdk-nodejs-proof-ladder.md

@@ -1,25 +1,25 @@
-# Atlas Proof Ladder: dominus-sdk-nodejs
-
-## Local Proof
-
-| Command | Expected signal | Status |
-|---|---|---|
-| `git status -sb` | Clean production branch @ `8f41170` | Observed via gather |
-| Test / typecheck | Pass | NOT RUN this pass |
-
-## CI / Release Proof
-
-| Surface | Expected signal | Status |
-|---|---|---|
-| Repo deploy workflows | Green on production branch pushes | Not re-run this pass |
-
-## Deploy / Live Proof
-
-| Surface | Expected signal | Status |
-|---|---|---|
-| Service health / package publish | Live or published artifact | Not probed this pass |
-
-## Positive vs No-Regression
-
-- **Positive:** Atlas pack exists at HEAD `8f41170` with dated proof pointers.
-- **No-regression:** Do not “fix” docs by reverting recent behavioral commits listed in the truthmap log.
+# Atlas Proof Ladder: dominus-sdk-nodejs
+
+## Local Proof
+
+| Command | Expected signal | Status |
+|---|---|---|
+| `git status -sb` | Clean production branch @ `8f41170` | Observed via gather |
+| Test / typecheck | Pass | NOT RUN this pass |
+
+## CI / Release Proof
+
+| Surface | Expected signal | Status |
+|---|---|---|
+| Repo deploy workflows | Green on production branch pushes | Not re-run this pass |
+
+## Deploy / Live Proof
+
+| Surface | Expected signal | Status |
+|---|---|---|
+| Service health / package publish | Live or published artifact | Not probed this pass |
+
+## Positive vs No-Regression
+
+- **Positive:** Atlas pack exists at HEAD `8f41170` with dated proof pointers.
+- **No-regression:** Do not “fix” docs by reverting recent behavioral commits listed in the truthmap log.

package/docs/atlas/2026-07-24-1231-sdk-nodejs-truthmap.md

@@ -1,43 +1,43 @@
-# Atlas Truthmap: dominus-sdk-nodejs
-
-Generated: 2026-07-24 12:31 EDT
-
-Target repo: `C:\developer\codingroot\repos\dominus_active\dominus-sdk-nodejs`
-
-Branch/status: `## production...origin/production [behind 4]
-?? _worktrees/`
-HEAD: `8f41170dc3bf2eda08195031ab2d956c127a7a34`
-
-## Executive Truth
-
-- TypeScript/ESM SDK for Dominus platform services.
-- Production truth checked at `8f41170` on the repo's production branch after ff-pull when available.
-- Sample code surfaces: `src/index.ts`, `src/contracts/versioned-storage.ts`, `src/lib/cache.ts`, `src/lib/client.ts`, `src/lib/config.ts`, `src/lib/console-capture.ts`, `src/lib/conversation-format.ts`, `src/lib/crypto.ts`, `src/lib/errors.ts`, `src/lib/page-rules.ts`, `src/lib/schema-builder.ts`, `src/lib/trace.ts`.
-- Recent commits:
-- `8f41170 feat(db): hard-cut provisioning verify to capabilities`
-- `3d60ff8 Release SDK 7.3.0: dominus.db.verifyProvisioning (required-provisioning probe)`
-- `cd35f90 feat: browser session-capture fields on ensureRun (storageState, sessionSlotId, sessionArtifactRef)`
-- `563eca4 Release SDK 7.1.0: per-call seed/bootstrap timeouts + service-JWT force refresh`
-- `2a2d4d7 Release Node SDK Authority verdict API`
-- `ffaef8a docs: clarify routes-services.md namespace counts (#2)`
-- Agent-guide snapshot(s) 2026-06-27-0849 — verify vs HEAD commits.
-
-## Claim Map
-
-| Claim | Status | Strongest evidence | Freshness | Disproves / weakens |
-|---|---|---|---|---|
-| Repo purpose matches README/CLAUDE | PRESENT | README/CLAUDE heads | HEAD | — |
-| Agent-guide fully current vs HEAD | STALE/CHECK | dated guide vs recent log | guide dates | Prefer code |
-| Local test matrix green | UNKNOWN | not run this pass | — | Do not claim green |
-
-## Source Graph
-
-| Area | Code | Tests | Docs | Live/CI/deploy | Owner |
-|---|---|---|---|---|---|
-| Primary | code roots above | tests/ if present | README, CLAUDE, agent-guide | deploy workflows / wrangler / Cloud Run as applicable | maintainers |
-
-## Agent Read Order
-
-1. `CLAUDE.md` / `README.md`
-2. Primary entry module(s)
-3. This atlas when docs disagree with code
+# Atlas Truthmap: dominus-sdk-nodejs
+
+Generated: 2026-07-24 12:31 EDT
+
+Target repo: `C:\developer\codingroot\repos\dominus_active\dominus-sdk-nodejs`
+
+Branch/status: `## production...origin/production [behind 4]
+?? _worktrees/`
+HEAD: `8f41170dc3bf2eda08195031ab2d956c127a7a34`
+
+## Executive Truth
+
+- TypeScript/ESM SDK for Dominus platform services.
+- Production truth checked at `8f41170` on the repo's production branch after ff-pull when available.
+- Sample code surfaces: `src/index.ts`, `src/contracts/versioned-storage.ts`, `src/lib/cache.ts`, `src/lib/client.ts`, `src/lib/config.ts`, `src/lib/console-capture.ts`, `src/lib/conversation-format.ts`, `src/lib/crypto.ts`, `src/lib/errors.ts`, `src/lib/page-rules.ts`, `src/lib/schema-builder.ts`, `src/lib/trace.ts`.
+- Recent commits:
+- `8f41170 feat(db): hard-cut provisioning verify to capabilities`
+- `3d60ff8 Release SDK 7.3.0: dominus.db.verifyProvisioning (required-provisioning probe)`
+- `cd35f90 feat: browser session-capture fields on ensureRun (storageState, sessionSlotId, sessionArtifactRef)`
+- `563eca4 Release SDK 7.1.0: per-call seed/bootstrap timeouts + service-JWT force refresh`
+- `2a2d4d7 Release Node SDK Authority verdict API`
+- `ffaef8a docs: clarify routes-services.md namespace counts (#2)`
+- Agent-guide snapshot(s) 2026-06-27-0849 — verify vs HEAD commits.
+
+## Claim Map
+
+| Claim | Status | Strongest evidence | Freshness | Disproves / weakens |
+|---|---|---|---|---|
+| Repo purpose matches README/CLAUDE | PRESENT | README/CLAUDE heads | HEAD | — |
+| Agent-guide fully current vs HEAD | STALE/CHECK | dated guide vs recent log | guide dates | Prefer code |
+| Local test matrix green | UNKNOWN | not run this pass | — | Do not claim green |
+
+## Source Graph
+
+| Area | Code | Tests | Docs | Live/CI/deploy | Owner |
+|---|---|---|---|---|---|
+| Primary | code roots above | tests/ if present | README, CLAUDE, agent-guide | deploy workflows / wrangler / Cloud Run as applicable | maintainers |
+
+## Agent Read Order
+
+1. `CLAUDE.md` / `README.md`
+2. Primary entry module(s)
+3. This atlas when docs disagree with code

package/docs/atlas/2026-08-04-sdk-nodejs-blockers.md

@@ -1,12 +1,12 @@
-# Blocker map: dominus-sdk-nodejs
-
-Generated: 2026-08-04 local.
-
-| Item | Status | Interpretation |
-|---|---|---|
-| Linked worktree reconciliation | Open | Timeline v9 and secret-presence v10 branches need one explicit candidate selection. |
-| Production branch freshness | Addressed for snapshot | Docs are based on current `origin/production` tip `0e68c79`; main checkout remains preserved. |
-| Package release version | Candidate-dependent | Class D publication requires a new version not already present in the registry. |
-| Hosted service parity | Ongoing | SDK contract proof should be paired with the corresponding Gateway/worker contracts. |
-
-This is a coordination map, not a negative judgment on the feature branches.
+# Blocker map: dominus-sdk-nodejs
+
+Generated: 2026-08-04 local.
+
+| Item | Status | Interpretation |
+|---|---|---|
+| Linked worktree reconciliation | Open | Timeline v9 and secret-presence v10 branches need one explicit candidate selection. |
+| Production branch freshness | Addressed for snapshot | Docs are based on current `origin/production` tip `0e68c79`; main checkout remains preserved. |
+| Package release version | Candidate-dependent | Class D publication requires a new version not already present in the registry. |
+| Hosted service parity | Ongoing | SDK contract proof should be paired with the corresponding Gateway/worker contracts. |
+
+This is a coordination map, not a negative judgment on the feature branches.

package/docs/atlas/2026-08-04-sdk-nodejs-proof-ladder.md

@@ -1,9 +1,9 @@
-# Proof ladder: dominus-sdk-nodejs
-
-| Layer | Evidence | Audit result / next proof |
-|---|---|---|
-| Source map | README, package entry, namespaces, tests, publish workflow | Production snapshot mapped at `0e68c79`. |
-| Build/type proof | `npm run build`; `npm run test:types` | Passed on the production snapshot with the temporary release version. |
-| Runtime suite | `npm test` | 106 Node tests passed after `npm ci` in the isolated snapshot. Linked worktree feature lines were not merged in this pass. |
-| Registry publish | `publish-production.yml` | Production push targets new package version 10.0.1; registry check found that version absent. |
-| Service behavior | Gateway/worker contract evidence | SDK tests do not establish current hosted server behavior. |
+# Proof ladder: dominus-sdk-nodejs
+
+| Layer | Evidence | Audit result / next proof |
+|---|---|---|
+| Source map | README, package entry, namespaces, tests, publish workflow | Production snapshot mapped at `0e68c79`. |
+| Build/type proof | `npm run build`; `npm run test:types` | Passed on the production snapshot with the temporary release version. |
+| Runtime suite | `npm test` | 106 Node tests passed after `npm ci` in the isolated snapshot. Linked worktree feature lines were not merged in this pass. |
+| Registry publish | `publish-production.yml` | Production push targets new package version 10.0.1; registry check found that version absent. |
+| Service behavior | Gateway/worker contract evidence | SDK tests do not establish current hosted server behavior. |

package/docs/atlas/2026-08-04-sdk-nodejs-truthmap.md

@@ -1,21 +1,21 @@
-# Atlas truth map: dominus-sdk-nodejs
-
-Generated: 2026-08-04 local. Production snapshot: `0e68c79`.
-
-| Concern | Strongest source | Current truth |
-|---|---|---|
-| Package contract | `package.json`, `src/index.ts` | ESM package version 10.0.0 in the production snapshot, root export only, Node >=18. |
-| Namespace surface | `src/` and public export tests | Broad typed facades for gateway-first Dominus services. |
-| Workflow | workflow namespace and tests | Authority-backed `ensure` lifecycle is preferred over the retired saved-workflow chain. |
-| Timeline/archive | Authority and Logs namespaces | Timeline truth, archive status, bounded archive/repair/verify/prune helpers. |
-| Secret/admin | secret and admin namespaces | Safe presence grids/previews and persisted root-role reads without secret values. |
-| Gateway contracts | client/transport helpers and contract tests | Base64/text envelope, route transforms, typed errors, actor/per-call controls. |
-| Release | `publish-production.yml` | Production branch publishes the package to the configured registry. |
-
-## Preserved local work
-
-Repo-local worktrees cover a timeline contract v9 line that retires the company
-query option after adding a target filter, and a secret-presence-grid v10 line
-that adds safe presence data, persisted root-role exposure, and code-point-aware
-preview counting. Reconciled/release branches carry those changes, while the
-main checkout was left untouched for this docs pass.
+# Atlas truth map: dominus-sdk-nodejs
+
+Generated: 2026-08-04 local. Production snapshot: `0e68c79`.
+
+| Concern | Strongest source | Current truth |
+|---|---|---|
+| Package contract | `package.json`, `src/index.ts` | ESM package version 10.0.0 in the production snapshot, root export only, Node >=18. |
+| Namespace surface | `src/` and public export tests | Broad typed facades for gateway-first Dominus services. |
+| Workflow | workflow namespace and tests | Authority-backed `ensure` lifecycle is preferred over the retired saved-workflow chain. |
+| Timeline/archive | Authority and Logs namespaces | Timeline truth, archive status, bounded archive/repair/verify/prune helpers. |
+| Secret/admin | secret and admin namespaces | Safe presence grids/previews and persisted root-role reads without secret values. |
+| Gateway contracts | client/transport helpers and contract tests | Base64/text envelope, route transforms, typed errors, actor/per-call controls. |
+| Release | `publish-production.yml` | Production branch publishes the package to the configured registry. |
+
+## Preserved local work
+
+Repo-local worktrees cover a timeline contract v9 line that retires the company
+query option after adding a target filter, and a secret-presence-grid v10 line
+that adds safe presence data, persisted root-role exposure, and code-point-aware
+preview counting. Reconciled/release branches carry those changes, while the
+main checkout was left untouched for this docs pass.

package/docs/atlas/INDEX.md

@@ -1,26 +1,26 @@
-# Atlas Index
-
-Last updated: 2026-08-04 local
-
-Latest snapshot:
-[truthmap](2026-08-04-sdk-nodejs-truthmap.md),
-[proof ladder](2026-08-04-sdk-nodejs-proof-ladder.md), and
-[blockers](2026-08-04-sdk-nodejs-blockers.md).
-
-## Current Truth Owners
-
-| Area | Strongest source | Notes |
-|---|---|---|
-| Public package | `package.json`, `src/index.ts`, `dist/` build | One root export: `dominus-sdk-nodejs`; no subpath exports. |
-| Namespace APIs | `src/` | Auth, DB/DDL, files/stash, AI/runtime, browser, jobs, workflow, Authority, logs, platform, publisher, admin, and control-plane facades. |
-| Workflow lifecycle | `src/namespaces/workflow*`, Authority namespace | Authority-backed `workflow.ensure` is preferred; saved-workflow legacy chain is retired. |
-| Secret/admin surfaces | `src/namespaces/secrets*`, admin namespace | Safe presence/preview and persisted root-role surfaces avoid returning secret values. |
-| Runtime transport | shared gateway/client helpers in `src/` | Gateway-first route transforms, typed error/wire contracts, and per-call controls. |
-| Publish | `.github/workflows/publish-production.yml` | Registry package publication on the `production` lane. |
-
-## Preserved local work
-
-The main checkout is clean in tracked files but has four repo-local linked
-worktrees: Authority timeline contract v9 and three secret-presence-grid
-reconciled/release lines. The high-level path for that work is in the pending
-summary; the implementation was not merged or modified here.
+# Atlas Index
+
+Last updated: 2026-08-04 local
+
+Latest snapshot:
+[truthmap](2026-08-04-sdk-nodejs-truthmap.md),
+[proof ladder](2026-08-04-sdk-nodejs-proof-ladder.md), and
+[blockers](2026-08-04-sdk-nodejs-blockers.md).
+
+## Current Truth Owners
+
+| Area | Strongest source | Notes |
+|---|---|---|
+| Public package | `package.json`, `src/index.ts`, `dist/` build | One root export: `dominus-sdk-nodejs`; no subpath exports. |
+| Namespace APIs | `src/` | Auth, DB/DDL, files/stash, AI/runtime, browser, jobs, workflow, Authority, logs, platform, publisher, admin, and control-plane facades. |
+| Workflow lifecycle | `src/namespaces/workflow*`, Authority namespace | Authority-backed `workflow.ensure` is preferred; saved-workflow legacy chain is retired. |
+| Secret/admin surfaces | `src/namespaces/secrets*`, admin namespace | Safe presence/preview and persisted root-role surfaces avoid returning secret values. |
+| Runtime transport | shared gateway/client helpers in `src/` | Gateway-first route transforms, typed error/wire contracts, and per-call controls. |
+| Publish | `.github/workflows/publish-production.yml` | Registry package publication on the `production` lane. |
+
+## Preserved local work
+
+The main checkout is clean in tracked files but has four repo-local linked
+worktrees: Authority timeline contract v9 and three secret-presence-grid
+reconciled/release lines. The high-level path for that work is in the pending
+summary; the implementation was not merged or modified here.

package/docs/janitor/2026-06-27-0849-sdk-orient-cleanup-audit.md

@@ -1,102 +1,102 @@
-# Janitor Cleanup Audit: dominus-sdk-nodejs
-
-Generated: 2026-06-27 08:49 local
-Target repo: C:\developer\codingroot\repos\dominus_active\dominus-sdk-nodejs
-Git root: C:\developer\codingroot\repos\dominus_active\dominus-sdk-nodejs
-Branch/status: `production` — clean before this pass (no tracked or untracked changes).
-
-## Summary
-
-Wrote a source-backed agent-guide pack and wired it into `README.md` and
-`CLAUDE.md`. Corrected one proven-stale fact ("no committed automated tests")
-in three places. Auto-cleaned generated `dist/` (gitignored, reproducible).
-Everything left uncommitted per instructions. No tracked source, branches,
-worktrees, plans, or release artifacts deleted.
-
-## Executive Actions Applied
-
-| Action | Path | Why safe | Verification |
-|---|---|---|---|
-| Wrote agent-guide pack | `docs/agent-guide/**` | New docs only; no source touched. | Files present; INDEX/current point at snapshot. |
-| Wrote cleanup audit | `docs/janitor/2026-06-27-0849-sdk-orient-cleanup-audit.md` | New doc only. | This file. |
-| Wired guide into README | `README.md` | Added small "Agent Guide" section near top; no other content changed. | `git diff README.md` is the one added block. |
-| Wired guide into CLAUDE | `CLAUDE.md` | Added "Agent Guide Pack" pointer near top. | `git diff CLAUDE.md`. |
-| Fixed stale tests fact | `CLAUDE.md`, `docs/architecture.md` | `tests/` has 24 committed files run by `npm test`; old "no committed tests" claim was provably false. | `ls tests` (24 files); `package.json scripts.test` lists them. |
-| Auto-clean generated build | `dist/` | Gitignored, untracked, reproducible via `npm run build`; `prepublishOnly` rebuilds it. | `git check-ignore dist` = ignored; `git ls-files dist` empty; post-delete `git status` shows no tracked change. |
-
-## Docs Written
-
-| File | Purpose | Source-backed by |
-|---|---|---|
-| `docs/agent-guide/INDEX.md` | Stable entrypoint + snapshot history. | repo layout. |
-| `docs/agent-guide/current.md` | Latest snapshot pointer + top-5 refresh facts. | `package.json`, `src/index.ts`, `tests/`. |
-| `.../00-reading-order.md` | Read order + per-task source map + stale flags. | existing docs, `src/`. |
-| `.../01-purpose-and-boundaries.md` | Purpose, ownership, runtime class, boundary. | `package.json`, `CLAUDE.md`, workflows. |
-| `.../02-repo-map-and-entrypoints.md` | Directory map + entrypoints. | `find src`, `package.json`, `.github/workflows`. |
-| `.../03-api-surface.md` | 27 namespaces + auth/scope map. | `src/index.ts` wiring, `routes-services.md`. |
-| `.../04-data-state-and-storage.md` | Storage surfaces + in-process caches. | `docs/architecture.md` §2a, `src/lib/*`. |
-| `.../05-integrations-and-runtime.md` | Deps, gateway routing, env categories. | `package.json`, `CLAUDE.md`, `src/lib/config.ts`. |
-| `.../06-workflows-commands-and-ci.md` | Commands + CI lanes. | `package.json scripts`, `.github/workflows`. |
-| `.../07-operations-release-and-live-proof.md` | npm release lane + proof. | `publish-production.yml`, `package.json`, `workflow-hard-cut-release.md`. |
-| `.../08-security-privacy-and-secrets.md` | Auth boundaries, secret resolution. | `CLAUDE.md`, `src/lib/config.ts`, `.gitignore`. |
-| `.../09-known-risks-and-debt.md` | Stale docs, doc-drift, generated residue. | this audit, `docs/*`. |
-| `.../10-agent-playbook.md` | If-changing-X-read-Y + Kyle routing. | `CLAUDE.md`, `src/`. |
-
-## Drift Findings
-
-| Finding | Evidence | Risk | Recommendation | Approval needed |
-|---|---|---|---|---|
-| "No committed automated tests" claim stale | `tests/` has 24 files; `package.json scripts.test` runs them | Low (misleads agents) | Fixed in CLAUDE.md + architecture.md §10 | Done |
-| Hand-maintained counts may drift | `routes-services.md` says "450 commands / 29 surfaces"; actual `src/namespaces/` = 27 files | Low | Noted in 09 + architecture §10; re-derive from source before quoting | No |
-
-## Stale Or Conflicting Docs
-
-| Doc | Problem | Stronger source | Proposed action |
-|---|---|---|---|
-| `docs/architecture.md` §10 | claimed no committed tests | `tests/` + `package.json` | Fixed (replaced with count-drift note). |
-| `CLAUDE.md` Validation | "If tests are absent" framing | `tests/` (24 files) | Fixed to state tests are committed. |
-| `routes-services.md` counts | "29 namespace surfaces" vs 27 top-level files | `src/namespaces/` | Left as-is (counts include `ai.*` sub-namespaces + `auth` local helpers; not provably wrong). Flagged for re-derivation. |
-
-## Orphan / Generated / Scratch Candidates
-
-| Path | Evidence | Proposed action | Safe now? |
-|---|---|---|---|
-| `dist/` | gitignored build output (~1.6 MB) | Deleted | Yes (done) |
-| `node_modules/` | gitignored installed deps | Leave; not in the auto-apply allowlist; reproducible via `npm ci` but may be in use by a dev session | Not auto-deleted |
-
-## Auto-Cleanup Performed
-
-| Path | Evidence | Action | Verification |
-|---|---|---|---|
-| `dist/` | `git check-ignore dist` = ignored; `git ls-files dist` empty; reproducible via `npm run build` | `rm -rf dist` | Post-delete `git status` shows no tracked change; rebuild with `npm run build`. |
-
-## Expert Review Queue
-
-| Candidate | Why expert should view it first | Suggested expert | First review question |
-|---|---|---|---|
-| `routes-services.md` "450 commands / 29 surfaces" reconciliation | Authoritative re-count of public commands vs. the maintained matrix touches the platform client contract surface | dominus-expert | Are the documented counts accurate against current `src/namespaces/*.ts`, and should they be regenerated by a script instead of hand-maintained? |
-
-## Worktree / Branch / Plan Residue
-
-| Item | Evidence | Proposed action | Owner |
-|---|---|---|---|
-| None | Single repo dir; no `.git/worktrees` scratch, no stray plans found | None | — |
-
-## Approval Queue
-
-- [ ] Delete `node_modules/` (reproducible via `npm ci`) — only if no dev session is using it — validate with `npm ci && npm test`.
-
-## Not Touching
-
-- `dist/` rebuild — left for the developer to regenerate via `npm run build`.
-- `node_modules/` — installed deps; outside the granted auto-clean allowlist.
-- `docs/usage-reference.md` (~98 KB) — large reference, not rewritten; only flagged for count drift.
-- All tracked source, `CHANGELOG.md` history, CI workflows, branches.
-
-## Follow-Up Skills
-
-| Need | Skill | First action |
-|---|---|---|
-| Reconcile documented command counts | dominus-expert | Re-count public commands against `src/namespaces/`. |
-| If truth scatters across code/docs/CI | kyle-atlas | Build `docs/atlas/INDEX.md`. |
-| Durable cross-repo facts | kyle-learn | Promote to `.claude/knowledge` if reused. |
+# Janitor Cleanup Audit: dominus-sdk-nodejs
+
+Generated: 2026-06-27 08:49 local
+Target repo: C:\developer\codingroot\repos\dominus_active\dominus-sdk-nodejs
+Git root: C:\developer\codingroot\repos\dominus_active\dominus-sdk-nodejs
+Branch/status: `production` — clean before this pass (no tracked or untracked changes).
+
+## Summary
+
+Wrote a source-backed agent-guide pack and wired it into `README.md` and
+`CLAUDE.md`. Corrected one proven-stale fact ("no committed automated tests")
+in three places. Auto-cleaned generated `dist/` (gitignored, reproducible).
+Everything left uncommitted per instructions. No tracked source, branches,
+worktrees, plans, or release artifacts deleted.
+
+## Executive Actions Applied
+
+| Action | Path | Why safe | Verification |
+|---|---|---|---|
+| Wrote agent-guide pack | `docs/agent-guide/**` | New docs only; no source touched. | Files present; INDEX/current point at snapshot. |
+| Wrote cleanup audit | `docs/janitor/2026-06-27-0849-sdk-orient-cleanup-audit.md` | New doc only. | This file. |
+| Wired guide into README | `README.md` | Added small "Agent Guide" section near top; no other content changed. | `git diff README.md` is the one added block. |
+| Wired guide into CLAUDE | `CLAUDE.md` | Added "Agent Guide Pack" pointer near top. | `git diff CLAUDE.md`. |
+| Fixed stale tests fact | `CLAUDE.md`, `docs/architecture.md` | `tests/` has 24 committed files run by `npm test`; old "no committed tests" claim was provably false. | `ls tests` (24 files); `package.json scripts.test` lists them. |
+| Auto-clean generated build | `dist/` | Gitignored, untracked, reproducible via `npm run build`; `prepublishOnly` rebuilds it. | `git check-ignore dist` = ignored; `git ls-files dist` empty; post-delete `git status` shows no tracked change. |
+
+## Docs Written
+
+| File | Purpose | Source-backed by |
+|---|---|---|
+| `docs/agent-guide/INDEX.md` | Stable entrypoint + snapshot history. | repo layout. |
+| `docs/agent-guide/current.md` | Latest snapshot pointer + top-5 refresh facts. | `package.json`, `src/index.ts`, `tests/`. |
+| `.../00-reading-order.md` | Read order + per-task source map + stale flags. | existing docs, `src/`. |
+| `.../01-purpose-and-boundaries.md` | Purpose, ownership, runtime class, boundary. | `package.json`, `CLAUDE.md`, workflows. |
+| `.../02-repo-map-and-entrypoints.md` | Directory map + entrypoints. | `find src`, `package.json`, `.github/workflows`. |
+| `.../03-api-surface.md` | 27 namespaces + auth/scope map. | `src/index.ts` wiring, `routes-services.md`. |
+| `.../04-data-state-and-storage.md` | Storage surfaces + in-process caches. | `docs/architecture.md` §2a, `src/lib/*`. |
+| `.../05-integrations-and-runtime.md` | Deps, gateway routing, env categories. | `package.json`, `CLAUDE.md`, `src/lib/config.ts`. |
+| `.../06-workflows-commands-and-ci.md` | Commands + CI lanes. | `package.json scripts`, `.github/workflows`. |
+| `.../07-operations-release-and-live-proof.md` | npm release lane + proof. | `publish-production.yml`, `package.json`, `workflow-hard-cut-release.md`. |
+| `.../08-security-privacy-and-secrets.md` | Auth boundaries, secret resolution. | `CLAUDE.md`, `src/lib/config.ts`, `.gitignore`. |
+| `.../09-known-risks-and-debt.md` | Stale docs, doc-drift, generated residue. | this audit, `docs/*`. |
+| `.../10-agent-playbook.md` | If-changing-X-read-Y + Kyle routing. | `CLAUDE.md`, `src/`. |
+
+## Drift Findings
+
+| Finding | Evidence | Risk | Recommendation | Approval needed |
+|---|---|---|---|---|
+| "No committed automated tests" claim stale | `tests/` has 24 files; `package.json scripts.test` runs them | Low (misleads agents) | Fixed in CLAUDE.md + architecture.md §10 | Done |
+| Hand-maintained counts may drift | `routes-services.md` says "450 commands / 29 surfaces"; actual `src/namespaces/` = 27 files | Low | Noted in 09 + architecture §10; re-derive from source before quoting | No |
+
+## Stale Or Conflicting Docs
+
+| Doc | Problem | Stronger source | Proposed action |
+|---|---|---|---|
+| `docs/architecture.md` §10 | claimed no committed tests | `tests/` + `package.json` | Fixed (replaced with count-drift note). |
+| `CLAUDE.md` Validation | "If tests are absent" framing | `tests/` (24 files) | Fixed to state tests are committed. |
+| `routes-services.md` counts | "29 namespace surfaces" vs 27 top-level files | `src/namespaces/` | Left as-is (counts include `ai.*` sub-namespaces + `auth` local helpers; not provably wrong). Flagged for re-derivation. |
+
+## Orphan / Generated / Scratch Candidates
+
+| Path | Evidence | Proposed action | Safe now? |
+|---|---|---|---|
+| `dist/` | gitignored build output (~1.6 MB) | Deleted | Yes (done) |
+| `node_modules/` | gitignored installed deps | Leave; not in the auto-apply allowlist; reproducible via `npm ci` but may be in use by a dev session | Not auto-deleted |
+
+## Auto-Cleanup Performed
+
+| Path | Evidence | Action | Verification |
+|---|---|---|---|
+| `dist/` | `git check-ignore dist` = ignored; `git ls-files dist` empty; reproducible via `npm run build` | `rm -rf dist` | Post-delete `git status` shows no tracked change; rebuild with `npm run build`. |
+
+## Expert Review Queue
+
+| Candidate | Why expert should view it first | Suggested expert | First review question |
+|---|---|---|---|
+| `routes-services.md` "450 commands / 29 surfaces" reconciliation | Authoritative re-count of public commands vs. the maintained matrix touches the platform client contract surface | dominus-expert | Are the documented counts accurate against current `src/namespaces/*.ts`, and should they be regenerated by a script instead of hand-maintained? |
+
+## Worktree / Branch / Plan Residue
+
+| Item | Evidence | Proposed action | Owner |
+|---|---|---|---|
+| None | Single repo dir; no `.git/worktrees` scratch, no stray plans found | None | — |
+
+## Approval Queue
+
+- [ ] Delete `node_modules/` (reproducible via `npm ci`) — only if no dev session is using it — validate with `npm ci && npm test`.
+
+## Not Touching
+
+- `dist/` rebuild — left for the developer to regenerate via `npm run build`.
+- `node_modules/` — installed deps; outside the granted auto-clean allowlist.
+- `docs/usage-reference.md` (~98 KB) — large reference, not rewritten; only flagged for count drift.
+- All tracked source, `CHANGELOG.md` history, CI workflows, branches.
+
+## Follow-Up Skills
+
+| Need | Skill | First action |
+|---|---|---|
+| Reconcile documented command counts | dominus-expert | Re-count public commands against `src/namespaces/`. |
+| If truth scatters across code/docs/CI | kyle-atlas | Build `docs/atlas/INDEX.md`. |
+| Durable cross-repo facts | kyle-learn | Promote to `.claude/knowledge` if reused. |

package/docs/janitor/2026-08-04-sdk-nodejs-cleanup-audit.md

@@ -1,14 +1,14 @@
-# Janitor cleanup audit: dominus-sdk-nodejs
-
-Generated: 2026-08-04 local.
-
-Refreshed the README and guide/atlas indexes, added a current reading-order
-pack, and mapped the root package surface, namespace ownership, lifecycle
-truth, secret/admin surfaces, and registry release path. Added a neutral
-pending-work summary for the preserved linked worktrees.
-
-No implementation branch or linked worktree was merged, rebased, deleted, or
-modified. Historical docs remain available. The Class D release metadata was
-bumped from 10.0.0 to 10.0.1 after verifying 10.0.1 was absent from the npm
-registry. After `npm ci` in the isolated snapshot, build, type tests, and the
-full 106-test runtime suite passed. `git diff --check` was run before commit.
+# Janitor cleanup audit: dominus-sdk-nodejs
+
+Generated: 2026-08-04 local.
+
+Refreshed the README and guide/atlas indexes, added a current reading-order
+pack, and mapped the root package surface, namespace ownership, lifecycle
+truth, secret/admin surfaces, and registry release path. Added a neutral
+pending-work summary for the preserved linked worktrees.
+
+No implementation branch or linked worktree was merged, rebased, deleted, or
+modified. Historical docs remain available. The Class D release metadata was
+bumped from 10.0.0 to 10.0.1 after verifying 10.0.1 was absent from the npm
+registry. After `npm ci` in the isolated snapshot, build, type tests, and the
+full 106-test runtime suite passed. `git diff --check` was run before commit.

package/docs/plans/2026-08-04-pending-work-fruition-summary.md

@@ -1,46 +1,46 @@
-# Pending work fruition summary: dominus-sdk-nodejs
-
-Generated: 2026-08-04 local. This note analyzes existing linked work without
-changing it.
-
-## What is present
-
-The repository has four local linked worktrees around two related themes. The
-timeline contract v9 line adds a target query filter and retires the older
-company query option. The secret-presence-grid v10 lines add safe presence
-data, persisted root-role exposure, and preview code-point counting; reconciled
-and release branches carry the latest versions of that work. The main checkout
-was not modified and the current production snapshot is separate from those
-feature branches.
-
-## Likely path to completion
-
-1. Compare the timeline and secret-presence branches with current `production`
-   and choose one coherent SDK contract candidate. Preserve backward
-   compatibility only where the server contract still requires it.
-2. Trace the timeline query change through Authority methods, generated/public
-   types, tests, and README examples; confirm the retired company option is
-   absent where intended and target filtering is consistently shaped.
-3. Trace the secret-presence change through admin/secrets namespaces, preview
-   counting, root-role projections, public types, and server endpoints. Keep
-   all responses value-safe and avoid implying secret availability from
-   indeterminate provider state.
-4. Run build, type tests, the full Node test suite, and focused contract tests
-   on the reconciled candidate. Then bump the package version once for the
-   actual release candidate and verify the new version is absent from the
-   registry.
-5. Push the exact `production` candidate and use the publish workflow plus
-   registry/version verification to establish package completion. Pair that
-   with downstream Gateway/worker contract proof where the SDK behavior is
-   load-bearing.
-
-## Open questions
-
-- Whether timeline v9 and secret-presence v10 should ship together or as two
-  independently versioned SDK releases.
-- Whether persisted root-role data is already available in every targeted
-  server environment or needs a typed unavailable state in the SDK.
-- Which release branch is canonical among the reconciled and release worktrees.
-
-These questions are intentionally left for contract/release review; the
-existing implementation remains untouched.
+# Pending work fruition summary: dominus-sdk-nodejs
+
+Generated: 2026-08-04 local. This note analyzes existing linked work without
+changing it.
+
+## What is present
+
+The repository has four local linked worktrees around two related themes. The
+timeline contract v9 line adds a target query filter and retires the older
+company query option. The secret-presence-grid v10 lines add safe presence
+data, persisted root-role exposure, and preview code-point counting; reconciled
+and release branches carry the latest versions of that work. The main checkout
+was not modified and the current production snapshot is separate from those
+feature branches.
+
+## Likely path to completion
+
+1. Compare the timeline and secret-presence branches with current `production`
+   and choose one coherent SDK contract candidate. Preserve backward
+   compatibility only where the server contract still requires it.
+2. Trace the timeline query change through Authority methods, generated/public
+   types, tests, and README examples; confirm the retired company option is
+   absent where intended and target filtering is consistently shaped.
+3. Trace the secret-presence change through admin/secrets namespaces, preview
+   counting, root-role projections, public types, and server endpoints. Keep
+   all responses value-safe and avoid implying secret availability from
+   indeterminate provider state.
+4. Run build, type tests, the full Node test suite, and focused contract tests
+   on the reconciled candidate. Then bump the package version once for the
+   actual release candidate and verify the new version is absent from the
+   registry.
+5. Push the exact `production` candidate and use the publish workflow plus
+   registry/version verification to establish package completion. Pair that
+   with downstream Gateway/worker contract proof where the SDK behavior is
+   load-bearing.
+
+## Open questions
+
+- Whether timeline v9 and secret-presence v10 should ship together or as two
+  independently versioned SDK releases.
+- Whether persisted root-role data is already available in every targeted
+  server environment or needs a typed unavailable state in the SDK.
+- Which release branch is canonical among the reconciled and release worktrees.
+
+These questions are intentionally left for contract/release review; the
+existing implementation remains untouched.