kiokuko-dsh 0.2.1 → 0.2.3

package/docs/lisp.md

@@ -1,4 +1,4 @@
-For configured semantic routing, use [provider-independent decisions](typed-decisions.md) and `kioku.decisions`. The Lisp mode-choice prompt and proposal approvals are unchanged.
+For configured semantic routing, use [provider-independent decisions](typed-decisions.md) and `kioku.decisions`. Lisp coexists with normal tools; routine development is authorized and destructive changes retain concrete review.
 
 # Common Lisp tools
 
@@ -10,6 +10,8 @@ For explicit semantic decisions and `/kioku-typesafe-key` setup, see
 [TypeSafe from Lisp](typesafe.md). Answers can guide inspection and proposals;
 the existing permission and approval boundaries still apply.
 
+The default is `lisp.executionMode: development`. Old `approvalMode` values remain readable. Set `executionMode: protected` explicitly to select the legacy worker/approval/fence behavior. See [owned execution and memory evidence](owned-execution.md).
+
 ## Compose task tools
 
 Use the worker as a persistent programming environment. Before repeating primitive
@@ -72,15 +74,9 @@ chooses the type; it does not grant permission or drop other requested actions.
 Missing context, explicitly undecided alternatives, envelope/provider capacity
 rejection and model abstention defer classification. Native adapters let the
 ordinary model infer advisory intent or ask a concrete clarification; they do not
-repeat the generic category dialog merely because the classifier abstained. The host asks whether to use Lisp
-before coding begins; it resolves unclear task intent first. Both enable and decline choices
-persist for that session, including after a restart. Conversation and review
-requests do not trigger this prompt. Free text returns to conversation without
-starting Lisp; cancellation and startup failure block coding admission.
+repeat the generic category dialog merely because the classifier abstained. Classification does not authorize implementation. For an explicit coding request the agent defines the Goal, implementation items and their observable criteria, then the host asks whether to use Lisp for that task. Both yes and no persist for the task and scope across restart. Conversation, review and plan-only requests do not trigger this prompt. Closing, free text without a clear choice or a disconnected question leaves implementation pending. Cancellation preserves the prepared work. A selected Lisp startup failure remains a recoverable blocker.
 
-Choosing Lisp also selects normal execution; Enno requires choosing not to use
-Lisp. The prompt is available only when `lisp.enabled` is true. To enable Lisp
-manually or inspect its state, use these commands in the desired DSH session:
+Normal/Enno execution mode and Lisp choice are separate. The task question remains available when the Lisp module is disabled; no needs no Lisp runtime, while yes requires the enabled module and working SBCL. To explicitly change the current task's Lisp route or inspect its state, use these commands in the desired DSH session:
 
 ```text
 /kioku-lisp enable
@@ -90,10 +86,7 @@ manually or inspect its state, use these commands in the desired DSH session:
 This enables the Lisp tools and supplies the bundled `kiokuko-lisp` Skill.
 Existing DSH `read`, `glob`, `grep` and `skill` tools remain available under native
 session permissions, so project files and applicable Skills can be inspected.
-File changes still use Lisp proposals and their confirmation rules. The read
-implementations are bound when Lisp is enabled; a later same-name replacement
-does not inherit permission. Normal sessions retain their tools. Protection also blocks
-unclassified child-session execution, late registrations, and PTC bypasses.
+File changes can use owned native tools or Lisp proposals. Ordinary writes/edits do not request approval; destructive source/data deletion retains a concrete review. For a coding task with a saved yes, recover Lisp or explicitly choose another task route before continuing implementation.
 The protected agent uses native tool presentation even in a PTC deployment.
 
 `sbclPath` can point to an explicit installed SBCL launcher. Its runtime files must
@@ -143,13 +136,8 @@ not the complete worker startup or the speed of an individual Lisp computation.
   copied into the worker's read-only inputs. Files from other sessions and arbitrary
   absolute paths are refused. The original attachment store stays inaccessible to
   Lisp and its subprocesses. Limits: 64 MiB per file, 256 MiB per worker generation.
-- Direct Lisp/FFI/Python/shell access is limited by the OS to runtime files,
-  selected read-only input copies and compiled bundle, and the worker's scratch/cache.
-- Project changes use host-validated proposals. New regular files can be created
-  with necessary parent directories. Deletion and replacement require one human
-  confirmation for the evaluation's frozen batch, showing every target, diff,
-  digest and backup location. Duplicate targets are rejected; unchanged writes
-  return `UNCHANGED` without a confirmation or write.
+- Lisp/FFI/Python/shell use the normal user environment. Prefer owned tools and broker APIs for host-observed execution; direct arbitrary effects are not verification evidence.
+- Project proposals freeze targets, preserve backups and reject duplicate targets. Writes/edits are authorized; source/data deletion requires concrete confirmation. Generated/temp/disposable artifacts are routine development.
 - Refusal, skip, timeout, cancelled confirmation or unavailable UI means no change.
   File identities/content are checked again after approval. Links, directories,
   database files/sidecars, common credential paths and plugin/state data are refused.
@@ -223,11 +211,7 @@ schema-size comparisons. It makes no model calls and does not estimate token
 charges. Native integration tests separately verify confirmation counts, tool
 delivery, output validation and recovery.
 
-The host serializes conflicting target proposals. OS protection prevents the Lisp
-worker from swapping project paths while the host applies a proposal. This is not
-a filesystem transaction against unrelated host programs: an external application
-can change directory entries between host filesystem calls. Stop other writers
-when reviewing/applying sensitive changes; an uncertain outcome requires inspection.
+The host serializes conflicting target proposals and checks their captured hashes before applying them. This is not a transaction against arbitrary Lisp or unrelated programs; concurrent external changes can still race filesystem calls. Unknown outcomes require inspection and must not be replayed.
 
 ## Stop and recover
 
@@ -281,13 +265,7 @@ subprocesses use the same output limit and parent-liveness supervisor as workers
 Published bundles are limited to 256 MiB each. Concurrent first enables share one
 serialized build under the host's existing exclusive data-directory lease.
 
-The macOS sandbox denies fork inside workers and jobs. Use `kioku.process` broker APIs for
-external processes. Result helpers (`result-ok?`, `result-code`, `result-stdout`,
-`result-stderr`, `run-lines`, `python-stdout`, `shell-stdout`) and generation-local
-job helpers (`list-jobs`, `forget-job`) avoid ordinary shell plumbing.
-`run` and `start-job` accept `:directory`, relative to scratch (default `"."`);
-absolute paths, traversal and symlink directories are refused. Node uses an empty
-OpenSSL configuration, so it does not need access to host OpenSSL configuration.
+Lisp workers and processes use the normal user environment and process groups for termination. kioku.process run/start-job use the owned execution service; directory defaults to the admitted workspace and may select a real subdirectory. Collect background results rather than rerunning commands.
 `python`, `shell`, `run-lines`, `python-stdout` and `shell-stdout` also accept
 `:directory`. The output-only helpers signal an error on process failure, so a
 composed operation stops before its next step. Use `run` when the function needs
@@ -337,12 +315,7 @@ different repository is rejected.
 `vendor`. These map to fixed `npm` commands and timeouts; arbitrary executable,
 arguments, URL or shell input is not accepted. `:directory` selects a relative
 project directory under the bound workspace, or under the current worker's scratch
-with `:location :scratch`. Absolute paths, traversal and links are refused. Before
-execution, native confirmation shows the command, package script, exact directory,
-timeout and possible artifact effects. The verifier runs on the host, including npm
-lifecycle scripts, outside the worker sandbox. Directory identity and scripts are
-rechecked after approval. Refusal, cancellation or unavailable confirmation returns
-`NOT_APPLIED`; nonzero exit returns `FAILED` with bounded output. The enclosing
+with `:location :scratch`. Absolute paths, traversal and links are refused. Routine verifier execution needs no approval. The host records actual cwd, process outcome and full-output test summaries before display shortening. Register completion checks and source paths before execution. Nonzero exit is FAILED; zero exit alone is not test coverage. The enclosing
 `lisp_eval` operation ID provides replay and conflict handling.
 
 Typical flow:
@@ -385,33 +358,14 @@ For API examples see [the bundled Skill](../skills/kiokuko-lisp/SKILL.md).
 
 Verification scope and installed Web reproduction: [verification record](lisp-verification.md).
 
-Native `ask_user_question` and `exit_plan_mode` remain available in both Lisp modes. Plan approval uses the DSH review UI and does not remove Lisp protection. Run `npm run test:lisp:plan:web` for a disposable packed-package Web check without model credentials.
+Native `ask_user_question` and `exit_plan_mode` remain available in both Lisp modes. Plan approval uses the DSH review UI. Explicit human implementation instructions also request exit at the next accepted boundary. Protected compatibility mode retains its Lisp sandbox; development mode allows ordinary owned tools after Plan exits. Run `npm run test:lisp:plan:web` for a disposable packed-package Web check without model credentials.
 
 <!-- kiokuko:runtime approval-policy -->
-## Profile-wide Lisp approval policy
-
-`lisp.approvalMode` defaults to `ask`; auto-approval is never inferred from an
-unknown request or from selecting Lisp. Ordinary questions keep normal execution
-without a Lisp choice or an approval selector in the chat composer. Once a task
-is identified as coding implementation or debugging, the existing coding choice
-can offer protected Lisp or normal execution; coding plans do not require Lisp.
-Auto-approval is an explicit opt-in through General settings,
-`/kioku-lisp approval auto`, or “Auto-approve all Lisp actions for this profile and
-continue” in a Lisp approval dialog. Use `/kioku-lisp approval ask` to return to
-manual consent. Explicit configuration and saved profile settings persist across
-chats and restarts and override the default; changing the default does not revoke
-a previously saved choice.
-All Lisp permission categories are covered, including file restoration, host
-verification, public npm package operations, and shared-function changes.
-
-Follow the current host-reported mode. In auto mode execute authorized work
-without asking whether to submit, resubmit, run tests, or apply changes. Ask only
-for missing intent that materially changes the work. In ask mode submit the
-operation directly to the host approval dialog without an extra conversational
-permission question. Earlier references to human approval describe ask mode.
-Explicit refusal, cancellation, stale inputs and unknown outcomes still stop
-execution; changing mode does not replay completed or refused operations.
-Identity checks, protected paths, backups and journal recovery remain enforced.
+## Development approval policy
+
+The legacy lisp.approvalMode ask/auto configuration and profile commands remain readable. Both authorize routine project edits, tests, helper registration and Kioku saving. Neither disables concrete confirmation for source/data deletion or durable user database mutation. A worker failure leaves normal tools available. Refusal, cancellation, changed targets and unknown outcomes cannot authorize effects.
+
+Use kioku_read/write/edit/remove/exec/result for observed work. Host receipts distinguish actual process outcome, source-bound verification and saving status. Lisp/model passed fields are advisory. Saving can be retried without repeating development effects; after restart an interrupted process remains unknown. See [owned execution](owned-execution.md).
 <!-- /kiokuko:runtime -->
 
 Pinned DSH stores this setting in the native `kiokuko-lisp` namespace, keyed by
@@ -419,3 +373,98 @@ the host-owned profile identity. Current DSH exposes `lisp.approvalMode` through
 the native `kiokuko-dsh` configuration form and saves its profile patch. This
 compatibility difference does not change the controls or scope. No separate
 preference file or database migration is used.
+
+
+## Read-only code intelligence
+
+Persistent `lisp_eval` can use an optional `CodeIntelligenceServiceV1` from
+`@askdkc/dsh-lsp-server`. Kiokuko resolves it in the calling agent's context.
+The provider owns Tree-sitter, grammars, source snapshots, coordinates, and LSP
+processes. Kiokuko does not install them or fall back to generic LSP tools.
+Core alone has no code-intelligence runtime dependency.
+
+The published provider v0.1.12 does not supply V1. The local prerequisite is kept
+as a reproducible [upstream patch](../patches/code-intelligence/README.md). A
+future compatible provider should advertise V1 and the required capabilities;
+package version alone is insufficient. Absence, an old provider, missing grammar,
+and an unready language server return explicit outcomes. They do not block the
+ordinary Lisp APIs. Node must satisfy Kiokuko's `>=24.16.0` requirement.
+
+Start with `(kioku.code:capabilities)`. Its response includes `status`, `reason`
+when relevant, `data.version`, `data.capabilities`, `data.languages`, distributed
+`data.queryIds`, and `data.semanticReady`. The last field stays false until this lease completes a semantic query: a
+server executable's presence does not establish a synchronized semantic result.
+
+```lisp
+;; One evaluation: aggregate locally, return selected source and metadata.
+(kioku.code:with-snapshot (snapshot "src/example.ts")
+  (let ((outline (kioku.code:outline snapshot :limit 20)))
+    (if (member (gethash "status" outline) '("ok" "partial") :test #'equal)
+        (let ((items (gethash "items" (gethash "data" outline))))
+          (kioku.internal:object
+            "status" (gethash "status" outline)
+            "omitted" (gethash "omitted" outline)
+            "declarationCount" (length items)
+            "selected" (if (plusp (length items))
+                           (kioku.code:span (gethash "handle" (aref items 0))
+                                            :max-chars 1000)
+                           #())))
+        outline)))
+```
+
+Check `status` before accessing `data`. `ok` with an empty array means the query
+completed with no results. `partial` preserves parse-error/truncation information.
+`unsupported`, `unavailable`, `stale`, `cancelled`, `timeout`, and `limit_exceeded`
+are separate states. Missing diagnostics publication never becomes a clean file.
+`with-snapshot` returns the opening failure unchanged and always releases an
+accepted snapshot, including on a Lisp error. For other queries, branch explicitly
+on `ok`/`partial` before using their `data`.
+
+| Lisp function | Arguments | Purpose |
+| --- | --- | --- |
+| `capabilities` | none | Negotiate V1, per-language readiness, disk sources and limits |
+| `open` | path | Pin a bounded disk source snapshot |
+| `outline` | handle, `:range`, `:limit` | Bounded declaration map |
+| `enclosing` | handle, position, `:kinds` | Nearest matching node and ancestors |
+| `query` | handle, query ID, `:range`, `:limit` | Distributed `declarations`, `calls`, `imports` captures |
+| `span` | node handle, `:max-chars` | Bounded original source span |
+| `semantic` | handle, kind, `:position`, `:limit` | `definition`, `references`, `implementation`, `hover`, `diagnostics`, `completion` |
+| `release` | handle | Idempotent release |
+
+Positions are JSON objects such as `(kioku.internal:object "line" 1 "character" 2)`:
+zero-based lines and UTF-16 character offsets. Ranges have `start` and `end` and
+are half-open. The provider performs conversion. There is no unsaved-editor
+synchronization claim: `sourceKind` is `disk`, with freshness and a snapshot version
+on every accepted source result. File/checkout changes require an explicit reopen.
+Handles and node handles expire at evaluation end; journal replay and saved
+`lisp_inspect` output are historical evidence, never live capabilities. Task workers
+retain their host-RPC prohibition. Neither `lsp` nor `lsp_extra` is added to the
+protected tool allowlist; child sessions cannot borrow admission.
+
+Each evaluation has 100 charged calls (including capabilities and failed attempts),
+100 files, 16 MiB cumulative source input, 64 KiB cumulative code responses, and a
+30-second code budget. Individual documents are at most 2 MiB; captures 200,
+outline entries 100, source spans 8,000 UTF-16 units, responses 32 KiB. Structural
+calls have a 2-second deadline and semantic calls 10 seconds, capped by the batch
+and caller deadlines. Release/disposal remain available outside exhausted budgets.
+Model presentation remains capped at 16 KiB and retains code outcome metadata;
+use bounded `lisp_inspect` pages for saved detail. Aggregate counts and chosen spans
+inside Lisp; returning full outlines can increase output instead of reducing it.
+
+The local prerequisite currently supports JavaScript/JSX/TypeScript/TSX. Its
+checkout metadata read must be allowed by the scoped host filesystem. Linked Git
+worktrees whose metadata is outside that scope return
+`unavailable` rather than read through another filesystem. This condition is
+reported independently from grammar and language-server readiness.
+
+Development verification is `npm run test:code-intelligence` after preparing the
+provider fixture. The source/native and packed paths are separate checks. The CI
+matrix runs normal development on macOS, Ubuntu 26.04, and Arch; the protected code-provider path
+is exercised on macOS; Linux protection remains a separate native-suite check. A configured job
+is not evidence that the remote job passed.
+
+Clean installation and platform status: [code intelligence setup](code-intelligence.md).
+
+## Coding task choice and recovery
+
+For a new coding task, `coding_workflow` first defines and displays the Goal, implementation items and observable conditions. The host then asks whether to use Lisp. Existing enabled settings never imply yes. Closing the question leaves it pending and `coding_workflow next` reopens the same question. Explicit continuation after a host restart restores the task choice; a new task or material scope change asks again. A saved yes followed by startup failure remains a visible blocker; recover the runtime or explicitly change the task route with `/kioku-lisp disable`. No uses ordinary tools and still requires fresh item checks followed by a final user-entry Goal check. Lisp evaluation success alone is insufficient: bind `task_completion` and collect actual host process evidence. See [coding workflow](coding-workflow.md).

package/docs/model-selection.ja.md

@@ -12,7 +12,9 @@ DSHの権限判定、必要な検証を維持し、役小角の契約・WorkUnit
 
 ## 通常実行のモデル自動選択
 
-通常版・modular coreとも `modelAutoMode.mode: off` が既定です。同じDSHプロファイルにdsh-codexを登録して認証し、JevかLayaの判定を準備したうえで、まず `observe` で選択案を確認します。
+Webプロファイルでは [Kiokuko Models](kiokuko-models.md) から接続を設定できます。DSH本体のModelsで設定する必要はありません。登録したモデルは、通常会話・Enno・Deepでネイティブ接続と併用できます。
+
+通常版・modular coreとも `modelAutoMode.mode: off` が既定です。同じDSHプロファイルでKiokuko Modelsまたはdsh-codexからCodexを認証し、JevかLayaの判定を準備したうえで、まず `observe` で選択案を確認します。
 
 ```yaml
 modelAutoMode:
@@ -30,7 +32,7 @@ modelAutoMode:
 
 コマンドは現在のnativeセッションだけを変更します。`on` は手動のモデル指定も解除します。DSHのpickerでモデルを手動選択すると、同じセッションで `on` を再実行するまで手動指定が優先します。変更は次の新しいタスクから反映し、送信済みの要求を途中で切り替えません。`/kioku-decisions status` にも同じ状態を表示します。設定を `off` に変更してDSHを再起動すれば、保存済みのセッション指定も無効になります。
 
-初期候補は `gpt-6-luna` の low・medium・high と `gpt-6-sol` の high です。`modelAutoMode.routes` には最大4件、`id`（`luna-low`、`luna-medium`、`luna-high`、`sol-high`）と `binding`（`provider`、`model`、`reasoningEffort`）を指定できます。IDは経路のラベルなので、登録済みのAstraなども正確なbindingで割り当てられます。候補はDSHの現在の `openai-codex` 一覧、文脈容量・入力形式・推論強度、要求設定の検証、token meterを通ったものに限定します。有効なbindingが2件未満なら判定しません。
+初期候補は `gpt-6-luna` の low・medium・high と `gpt-6-sol` の high です。`modelAutoMode.routes` には最大4件、`id`（`luna-low`、`luna-medium`、`luna-high`、`sol-high`）と `binding`（`provider`、`model`、`reasoningEffort`）を指定できます。IDは経路のラベルなので、登録済みのAstraなども正確なbindingで割り当てられます。候補はCodex由来とResponses方式を確認でき、現在のモデル一覧、文脈容量・入力形式・推論強度、要求設定の検証、token meterを通った接続に限定します。ネイティブの `openai-codex` とKiokuko所有のCodex接続が対象です。名前だけを似せた接続やOpenAI API接続は対象外です。有効なbindingが2件未満なら判定しません。
 
 新しい受付済みの通常タスクでは、現在の依頼文、タスク種別、添付の種類、経路IDと判定基準を選択中のJevかLayaへ送ります。この判定のために添付の内容、全履歴、リポジトリ全体は送信しません。Choice 1問の結果をrunに保存し、継続では同じ経路を使います。再起動時に判定結果が不明なら再送せず元のモデルを維持します。`observe`、棄権、probe失敗、metadata不足、非対応effort、timeout、入力超過でも元のモデルを維持します。取消、セッション同一性の不一致、保存の整合性エラーでは要求を止めます。認証・利用枠・モデル利用不可によるdispatch失敗を別モデルへ自動再送しません。
 
@@ -74,7 +76,6 @@ npm run test:evaluation:model-routing -- --live --provider laya --config PATH
 | OpenRouter・DeepSeek V4.1 Flash | `deepseek/deepseek-v4.1-flash` | `deepseek/deepseek-v4.1-flash` | `deepseek/deepseek-v4.1-flash` | `deepseek/deepseek-v4.1-flash` |
 | OpenRouter・GLM | `z-ai/glm-5.3` | `z-ai/glm-5.3` | `z-ai/glm-5.3-flash` | `z-ai/glm-5.3` |
 | OpenRouter・Qwen | `qwen/qwen3.8-max-0902` | `qwen/qwen3.8-max-0902` | `qwen/qwen3.8-flash` | `qwen/qwen3.8-max-0902` |
-| OrcaRouter・DeepSeek V4.1 Flash | `deepseek/deepseek-v4.1-flash` | `deepseek/deepseek-v4.1-flash` | `deepseek/deepseek-v4.1-flash` | `deepseek/deepseek-v4.1-flash` |
 | Ollama・ローカル標準 | `qwen3-coder:30b` | `qwen3-coder:30b` | `qwen3-coder:30b` | `qwen3-coder:30b` |
 
 これらは版1の構成候補です。適用時にDSHの登録モデルと正確なIDで照合します。
@@ -84,13 +85,11 @@ npm run test:evaluation:model-routing -- --live --provider laya --config PATH
 DeepSeek系の推奨は全5役を **V4.1 Flash** に統一しています。IDは提供元ごとに、
 [DeepSeek公式API](https://www.deepseek.com/en/news/deepseek-v4-1-flash/)、
 [OpenCode Go](https://opencode.ai/docs/go/)、
-[OpenRouter](https://openrouter.ai/deepseek/deepseek-v4.1-flash)、
-[OrcaRouter](https://www.orcarouter.ai/models/deepseek/deepseek-v4.1-flash)で確認しています。
+[OpenRouter](https://openrouter.ai/deepseek/deepseek-v4.1-flash)で確認しています。
 公式APIの専用テンプレートはDSHの`deepseek-official`接続を使います。
 V4.1 Flashが未登録の場合、V4 Proや旧FlashのIDには置き換えません。
 2026-09-11に[OpenCodeのモデル一覧](https://models.opencode.ai/api.json)も確認しています。
 `opencode-go`にはV4.1 Flashが掲載されていますが、Zenに相当する`opencode`にはありません。
-この一覧のOrcaRouter欄にも未掲載で、OrcaRouter公式モデルページの更新と差があります。
 Zen・Ollamaで推奨テンプレートにないモデルを使う場合は、以下の登録済みモデル選択を使います。
 
 [dsh-codex](https://github.com/askdkc/dsh-codex)を使う場合は、
@@ -100,7 +99,7 @@ Zen・Ollamaで推奨テンプレートにないモデルを使う場合は、
 [OpenAIのモデルガイド](https://developers.openai.com/api/docs/models)を基にした推奨で、
 タスク別の速度・利用枠消費を実測して最適化したものではありません。
 
-この専用テンプレートは、[dsh-codexの登録・接続実装](https://github.com/askdkc/dsh-codex/blob/e2e61b6d8f3b511cf2dac99688e97b8728cb122c/src/index.ts)
+このテンプレートはKiokuko ModelsのCodex接続にも対応し、Codex由来とResponses方式を確認して、安定した `kiokuko-…` 登録IDを保存します。ネイティブ接続は [dsh-codexの登録・接続実装](https://github.com/askdkc/dsh-codex/blob/e2e61b6d8f3b511cf2dac99688e97b8728cb122c/src/index.ts)
 に合わせて`openai-codex` / `codex` / `responses`を使用します。接続先や通信方式を
 重ねて質問せず、選択した構成に保存します。DSH本体のモデル検証を優先し、
 旧`modelRoutes`の値を再入力させません。プラグイン設定ファイルは変更しません。モデルはDSH経由の現在の登録一覧に存在する正確なIDだけを割り当て、
@@ -114,9 +113,8 @@ DSHの設定を使い、重ねて質問しません。Kiokukoは認証情報を
 
 モデル名から選ぶ場合は、**「DSHに設定済みのモデルから選ぶ」→役割を変更→接続を選択→
 モデル名で検索・選択→構成を確認して開始**と進みます。
-**OpenCode Go、OpenCode Zen、OpenRouter、Ollama、OrcaRouter**の登録済み接続を選べます。
+**OpenCode Go、OpenCode Zen、OpenRouter、Ollama**の登録済み接続を選べます。
 一覧は現在のDSHプロファイルから取得し、接続名・モデル名と正確なIDを表示します。
-同じモデル名でもOpenRouterとOrcaRouterの割り当ては別々に保持します。
 接続が表示されない場合はDSHに登録し、「一覧を再取得」で更新してください。
 公開モデル一覧は推奨IDの参照元で、DSHへのモデル登録は行いません。
 公開一覧の`ollama-cloud`と、ローカルOllamaのインストール済みモデルは別の一覧です。

package/docs/model-selection.md

@@ -13,7 +13,9 @@ plan approval or automatic Enno continuation.
 
 ## Automatic model selection
 
-`modelAutoMode` is off by default in both the full plugin and modular core. To try it, install and authenticate dsh-codex in the same DSH profile, configure a Jev or Laya typed-decision backend, then use `observe` before enabling automatic routing:
+In Web profiles, [Kiokuko Models](kiokuko-models.md) manages connections without requiring DSH's Models settings. Its registered models are available to ordinary chat, Enno and Deep alongside native connections.
+
+`modelAutoMode` is off by default in both the full plugin and modular core. To try it, authenticate Codex through Kiokuko Models or dsh-codex in the same DSH profile, configure a Jev or Laya typed-decision backend, then use `observe` before enabling automatic routing:
 
 ```yaml
 modelAutoMode:
@@ -31,7 +33,7 @@ modelAutoMode:
 
 The command changes only the current native session. `on` also clears its manual model pin; a model selected in DSH's picker pins that session until `on` is run again. Changes apply at the next new task boundary, without changing a request already sent. `/kioku-decisions status` includes the same session projection. To reset session overrides after a configuration change, restart DSH; changing `modelAutoMode.mode` to `off` and restarting disables routing.
 
-The initial preset offers `gpt-6-luna` at low, medium and high effort, plus `gpt-6-sol` at high effort. Up to four exact route bindings can be configured under `modelAutoMode.routes`; each has an `id` from `luna-low`, `luna-medium`, `luna-high`, `sol-high`, and a `binding` with `provider`, `model`, and `reasoningEffort`. These are route labels, so a registered Astra or other GPT model may be assigned explicitly. No new model ID is guessed or substituted. DSH's live `openai-codex` catalog, model context and modality metadata, supported efforts, call-config validation and token meter must all confirm a candidate. Fewer than two valid bindings skips classification.
+The initial preset offers `gpt-6-luna` at low, medium and high effort, plus `gpt-6-sol` at high effort. Up to four exact route bindings can be configured under `modelAutoMode.routes`; each has an `id` from `luna-low`, `luna-medium`, `luna-high`, `sol-high`, and a `binding` with `provider`, `model`, and `reasoningEffort`. These are route labels, so a registered Astra or other GPT model may be assigned explicitly. No new model ID is guessed or substituted. A candidate must have a validated Codex origin and Responses protocol, live model context and modality metadata, supported efforts, call-config validation and token meter. Both native `openai-codex` and Kiokuko-owned Codex routes qualify; an arbitrary provider name or OpenAI API connection does not. Fewer than two valid bindings skips classification.
 
 For a new admitted normal task, Kiokuko sends the current task text, task type, attachment kinds, route IDs and rubric to the selected Jev or Laya backend. It does not send attachment bytes, full history or repository contents for this classification. One Choice result selects a route or abstains. The route is stored against the exact run and reused for continuations; an unknown in-flight decision after restart is retained without another classifier call. `observe` records a proposal but keeps the current model. A failed probe, missing metadata, unsupported effort, timeout, oversized input or abstention also keeps the current model. Cancellation, stale session identity and storage integrity failures stop the request. Dispatch authentication, quota and unavailable-model errors remain ordinary failures; no alternate model is retried automatically.
 
@@ -63,8 +65,8 @@ above nine, type consecutive digits (`1`, `2`, Enter selects option 12); Backspa
 corrects the number. Digits typed in the search field remain search text, and Enter
 submits the search. IME composition and repeated key events do not select or submit.
 
-Enno offers twelve versioned templates across **OpenAI, DeepSeek, OpenCode Go,
-OpenCode Zen, OpenRouter, OrcaRouter and Ollama**, plus a custom configured-model selector. The complete
+Enno offers eleven versioned templates across **OpenAI, DeepSeek, OpenCode Go,
+OpenCode Zen, OpenRouter and Ollama**, plus a custom configured-model selector. The complete
 [template table and configuration reference](model-selection.ja.md) lists exact
 model IDs. OpenAI assigns Astra to ideal/Zenki/check, Sol to the Goki head and
 Luna to workers. Go and OpenRouter provide GLM and Qwen variants; Zen uses GLM.
@@ -74,14 +76,12 @@ downloads models. Reasoning uses model defaults; reflection uses the check model
 All DeepSeek recommendations use **V4.1 Flash for all five roles**. Exact IDs differ:
 `deepseek-flash` on [DeepSeek's API](https://www.deepseek.com/en/news/deepseek-v4-1-flash/),
 `deepseek-v4.1-flash` on [OpenCode Go](https://opencode.ai/docs/go/), and
-`deepseek/deepseek-v4.1-flash` on [OpenRouter](https://openrouter.ai/deepseek/deepseek-v4.1-flash)
-and [OrcaRouter](https://www.orcarouter.ai/models/deepseek/deepseek-v4.1-flash).
+`deepseek/deepseek-v4.1-flash` on [OpenRouter](https://openrouter.ai/deepseek/deepseek-v4.1-flash).
 The direct DeepSeek template uses DSH's `deepseek-official` connection. These templates
 never substitute V4 Pro or an older Flash ID when V4.1 Flash is unavailable.
 The [OpenCode model registry](https://models.opencode.ai/api.json) was also checked
 on 2026-09-11. Its `opencode-go` entry includes V4.1 Flash; its Zen entry (`opencode`)
-does not. Its OrcaRouter entry also lacks V4.1 Flash, although OrcaRouter's own model
-page lists the ID above. Registry entries can lag provider changes. Zen and Ollama
+does not. Registry entries can lag provider changes. Zen and Ollama
 use the configured-model selector for models without a verified template ID.
 
 For [dsh-codex](https://github.com/askdkc/dsh-codex), choose **OpenAI Codex・推奨（dsh-codex）**
@@ -89,8 +89,10 @@ from the template menu, then confirm the configuration. It assigns Astra to
 ideal/planning/check, Sol to the Goki head and Luna to workers, following the
 [OpenAI model guide](https://developers.openai.com/api/docs/models). This is a
 quality/workload recommendation, not a measured per-task latency or quota optimum.
-The plugin-specific template binds the exact `openai-codex` / `codex` / `responses`
-contract from [dsh-codex's implementation](https://github.com/askdkc/dsh-codex/blob/e2e61b6d8f3b511cf2dac99688e97b8728cb122c/src/index.ts)
+The template also accepts a Kiokuko Models Codex connection with verified origin
+and Responses metadata, storing its stable `kiokuko-…` registration ID. The native
+route retains the `openai-codex` / `codex` / `responses` contract from
+[dsh-codex's implementation](https://github.com/askdkc/dsh-codex/blob/e2e61b6d8f3b511cf2dac99688e97b8728cb122c/src/index.ts)
 without asking for the connection again. Native DSH model validation takes
 precedence over legacy `modelRoutes` declarations; the plugin configuration file
 remains untouched. Recommended models must exist in the current DSH catalog;
@@ -116,9 +118,9 @@ than requested again. Back and cancel retain confirmed model assignments.
 
 To choose by model name, select **DSHに設定済みのモデルから選ぶ**, edit a role,
 select its connection, then search or select a model name and confirm the configuration.
-This works with configured **OpenCode Go, OpenCode Zen, OpenRouter, Ollama and OrcaRouter**
+This works with configured **OpenCode Go, OpenCode Zen, OpenRouter and Ollama**
 connections. Every entry displays its name and exact ID; the same model on OpenRouter
-and OrcaRouter remains a distinct binding. Lists come from the current DSH profile.
+Each connection remains a distinct binding. Lists come from the current DSH profile.
 Register a missing connection in DSH and select **一覧を再取得** to refresh it.
 The public registry is a recommendation reference; it does not register models in
 DSH. Its `ollama-cloud` catalog is separate from a local Ollama installation.

package/docs/owned-execution.md

@@ -0,0 +1,99 @@
+# Kiokuko-owned development execution
+
+Kiokuko registers native `kioku_read`, `kioku_write`, `kioku_edit`,
+`kioku_remove`, `kioku_exec`, and `kioku_result` tools. They use Node filesystem
+and process services directly; stock DSH filesystem/shell sandbox settings do
+not control this executor. Native presentation and PTC transport both remain
+supported. Plan, goal, cancellation, admitted identity, and Enno delegation
+scope still apply.
+
+Ordinary project reads, edits, builds, tests, PATH commands and investigation
+needed for development require no additional confirmation. Bash/zsh inherit
+the user's environment and may start child processes. Source/data deletion and
+existing durable user database mutation require confirmation of concrete
+targets. Generated artifacts and temporary/disposable data do not. Declare
+`destructiveTargets` for destructive commands: arbitrary shell/Lisp/FFI code
+cannot be completely classified in advance. An unknown side effect does not
+justify refusing execution or treating its result as verification.
+
+## Tools and replay
+
+- `kioku_read({path})` returns content and its SHA256.
+- `kioku_write({path,content,expectedHash?})` and
+  `kioku_edit({path,oldText,newText,expectedHash?})` compare the actual file with
+  the requested result. An edit requires exactly one matching occurrence.
+  `expectedHash:null` requires a new file; changed hashes reject a stale edit.
+- `kioku_remove({path,expectedHash?})` removes a single file.
+- `kioku_exec({command,cwd?,shell?,background?,timeoutMs?,destructiveTargets?})`
+  executes in the canonical cwd, including project subdirectories.
+- `kioku_result({operationId,cancel?})` retrieves or cancels the existing
+  process. It never starts the command again. Collect background operations
+  until their receipt is terminal.
+
+Each tool returns a host-generated receipt with operation/run/session/generation
+identity, actual cwd/command, file hashes, process exit/signal/cancellation/timeout,
+and verification and persistence states. Process output is bounded at 32 MiB;
+the host parses complete output before returning a 24,000-character preview.
+Observed/displayed byte counts and an output digest distinguish the two scopes.
+Environment variables and full command output are not persisted in execution receipts or passed as supervisor command-line arguments. Secret-bearing
+commands and previews are redacted.
+
+Operation identity is tied to the native call. Replaying it with another
+run/generation or changed arguments conflicts. SQLite receipts and a private
+local journal beside the configured database survive restart. A failed SQLite
+save leaves `persistence:pending`; retrieving the result retries storage without
+repeating edits/tests. If the outbox is unavailable, execution can use a database reservation; failure of both stores is reported as pending and cannot promise durable replay protection. A started receipt after a crash becomes unknown, and
+its effect is never automatically retried. Loss of both durable stores cannot
+be reconstructed from a model's success report. After restart, saved receipts restore terminal metadata and verification summaries; full output previews and read contents are not restored from the journal. Use a new read operation to inspect current file contents.
+
+## Verification and memory
+
+Register conditions and source/test/configuration paths with `task_completion`
+before running the check. Memory application reviews may specify a repository-relative `cwd`; omitted values retain the historical repository-root meaning. Actual directory, command, source digest, run and generation must match. Owned shell and Lisp process calls feed the existing
+completion and memory-application records. Exit zero alone does not establish
+test success: complete Node TAP and Cargo harness summaries distinguish passed,
+failed, cancelled, ignored/skipped, filtered and zero/incomplete test runs.
+Include every relevant input in the registered source set.
+
+Finalization receives structured observations and source-bound checks. Candidate
+memories cite stored receipts from the same run/session and retain conditions
+and source versions. Existing transactions, leases and effect deduplication own
+memory saving; memory retries do not rerun development tools. A staged, secret-scanned extraction is reused after adoption fails only when its run, source log, evidence manifest and entry revisions still match. Retrieval exposes
+execution provenance and recomputes source freshness. Historical results are
+explicitly `currentTaskVerification:false`; they do not complete a new task.
+Unrelated generated files and ordinary reads do not invalidate declared source checks. Unknown side effects mark affected verification unknown without rejecting execution. Tool responses return work, verification, receiptPersistence and memoryStorage separately; not_scheduled is not a successful memory save.
+
+## Lisp and Plan
+
+`lisp.executionMode` defaults to `development`, including when an old profile
+omits it or has `approvalMode:ask`. Ordinary tools and Lisp coexist. Process RPC
+and workspace proposals use the owned executor; helper toolsets still compile
+and validate their schemas/examples. Worker failures leave ordinary tools
+available. `executionMode:protected` explicitly selects the legacy isolated
+worker/approval/fence behavior for compatibility; it is not the default.
+
+Lisp source can directly call filesystem/FFI APIs in development mode. Such
+effects are not independent process/test proof. Prefer `kioku.tools:call-tool`
+and `kioku.process` for observed results. Plan blocks effectful owned/Lisp
+operations. An explicit human implementation instruction or plan approval
+requests Plan exit at the next accepted native boundary; merely presenting a
+plan does not exit it.
+
+## Local acceptance
+
+```sh
+npm run typecheck
+KIOKUKO_REQUIRE_DSH_NATIVE=1 KIOKUKO_DSH_PACKAGE_ROOT="$PWD/tests/fixtures/dsh-runtime/node_modules" node scripts/run-tests.mjs tests/dsh/integration/owned-native-lifecycle.test.ts
+KIOKUKO_REQUIRE_CARGO_RUNTIME=1 node scripts/run-tests.mjs tests/dsh/integration/owned-execution.test.ts
+KIOKUKO_REQUIRE_LISP_RUNTIME=1 KIOKUKO_DSH_PACKAGE_ROOT="$PWD/tests/fixtures/dsh-runtime/node_modules" npm run test:lisp
+npm run build
+npm run test:skill-delivery
+npm run test:modules
+npm run pack:check
+```
+
+The runtime tests use disposable profiles/databases and scripted provider
+responses. They establish local/native execution, persistence and retrieval;
+they do not prove a live provider or the user's installed profile. The test
+runner bounds concurrent Lisp compilation to two files. Set
+`KIOKUKO_TEST_CONCURRENCY` (1–64) to override it.

package/lisp/supervisor.mjs

@@ -1,7 +1,7 @@
 // Trusted host helper, never evaluated inside Lisp. stdin is a parent-liveness
 // pipe. It stays outside the worker sandbox so arbitrary Lisp cannot disable it.
 import { spawn } from 'node:child_process'
-import { openSync, closeSync } from 'node:fs'
+import { openSync, closeSync, writeSync } from 'node:fs'
 const launch = JSON.parse(process.argv[2])
 let child, closing = false
 const kill = () => {
@@ -21,6 +21,12 @@ const stdio = ['ignore', 'inherit', 'inherit', launch.protocol ? 3 : 'ignore']
 if (filter !== undefined) stdio.push(filter)
 child = spawn(launch.command, launch.args, { cwd: launch.cwd, env: launch.env, stdio, detached: !!launch.group })
 if (filter !== undefined) closeSync(filter)
+// Stream one JSON object: older readers still consume the complete terminal
+// object, while current readers observe the prefix only after actual spawn.
+child.once('spawn',()=>{if(launch.report){try{writeSync(4,'{"processStarted":true,')}catch{/* host already stopped */}}})
 child.once('error', error => { process.stderr.write(`LISP_LAUNCH_ERROR: ${error.message}\n`); process.exit(70) })
-child.once('exit', (code, signal) => { if (launch.group) kill(); process.exit(signal ? 128 : code ?? 70) })
+child.once('exit', (code, signal) => {
+  if(launch.report){try{writeSync(4,JSON.stringify({exitCode:code,signal}).slice(1)+'\n')}catch{/* host already stopped */}}
+  if (launch.group) kill(); process.exit(signal ? 128 : code ?? 70)
+})
 if (closing) kill()

package/lisp/tools.lisp

@@ -9,6 +9,7 @@
 (defpackage :kioku.decisions (:use :cl) (:export :status :evaluate :assess-relevance :classify-failure :assess-change :service-error :error-code))
 (defpackage :kioku.typesafe (:use :cl) (:export :status :evaluate :service-error :error-code))
 (defpackage :kioku.tools (:use :cl) (:export :describe-tools :describe-symbol :available-tools :call-tool))
+(defpackage :kioku.code (:use :cl) (:shadow :open) (:export :capabilities :open :outline :enclosing :query :span :semantic :release :with-snapshot :service-error :error-code))
 (defpackage :kioku.user (:use :cl))
 (in-package :kioku.internal)
 (defvar *wire*)
@@ -40,6 +41,8 @@
       (unless (and reply (equal id (gethash "id" reply))) (error "RPC_MISMATCH"))
       (unless (eq yason:true (gethash "ok" reply))
         (let ((code (gethash "code" reply "")))
+          (when (and (stringp code) (alexandria:starts-with-subseq "CODE_" code))
+            (error 'kioku.code:service-error :code code :message (gethash "error" reply)))
           (when (and (stringp code) (alexandria:starts-with-subseq "DECISION_" code))
             (error 'kioku.decisions:service-error :code code :message (gethash "error" reply)))
           (when (and (stringp code) (alexandria:starts-with-subseq "TYPESAFE_" code))
@@ -275,7 +278,7 @@
     (vector (question "change" "Does the change satisfy the requirement without an evident regression?"
       (vector (choice "yes" "Satisfies requirement") (choice "no" "Missing requirement or regression") (choice "abstain" "Insufficient evidence"))))))
 (in-package :kioku.environment)
-(defun status () (kioku.internal:object "generation" kioku.internal:*generation* "sbcl" (lisp-implementation-version) "os" (software-type) "architecture" (machine-type) "scratch" (namestring (kioku.files:scratch)) "network" yason:false "hostWrites" "proposals only" "libraries" #("yason" "cl-ppcre" "cl-csv")))
+(defun status () (kioku.internal:object "generation" kioku.internal:*generation* "sbcl" (lisp-implementation-version) "os" (software-type) "architecture" (machine-type) "scratch" (namestring (kioku.files:scratch)) "executionMode" (or (uiop:getenv "KIOKU_EXECUTION_MODE") "protected") "network" (if (equal (uiop:getenv "KIOKU_EXECUTION_MODE") "development") "normal user environment" yason:false) "hostWrites" (if (equal (uiop:getenv "KIOKU_EXECUTION_MODE") "development") "owned tools and direct Lisp; only host receipts prove observed effects" "proposals only") "libraries" #("yason" "cl-ppcre" "cl-csv")))
 (in-package :kioku.tools)
 (defun available-tools () (kioku.internal:rpc "tools-list" (kioku.internal:object)))
 (defun call-tool (name &optional (arguments (kioku.internal:object)))
@@ -296,7 +299,7 @@
       (kioku.internal:object "package" "kioku.user" "generation" kioku.internal:*generation*
                             "symbols" (coerce (task-functions) 'vector))))
   (let ((package (find-package (string-upcase name))))
-    (when (and package (member (package-name package) '("KIOKU.TOOLS" "KIOKU.PROCESS" "KIOKU.FILES" "KIOKU.DATA" "KIOKU.OBJECTS" "KIOKU.ENVIRONMENT" "KIOKU.CI" "KIOKU.PACKAGES" "KIOKU.TYPESAFE") :test #'equal))
+    (when (and package (member (package-name package) '("KIOKU.TOOLS" "KIOKU.PROCESS" "KIOKU.FILES" "KIOKU.DATA" "KIOKU.OBJECTS" "KIOKU.ENVIRONMENT" "KIOKU.CI" "KIOKU.PACKAGES" "KIOKU.TYPESAFE" "KIOKU.CODE") :test #'equal))
       (return-from describe-symbol
         (kioku.internal:object "package" (string-downcase (package-name package))
           "symbols" (coerce (sort (loop for symbol being the external-symbols of package
@@ -306,7 +309,7 @@
         (multiple-value-bind (symbol end) (read-from-string name)
           (unless (and (symbolp symbol) (symbol-package symbol) (fboundp symbol)
                        (zerop (length (string-trim '(#\Space #\Tab #\Newline #\Return) (subseq name end))))
-                       (member (package-name (symbol-package symbol)) '("KIOKU.USER" "KIOKU.TOOLS" "KIOKU.PROCESS" "KIOKU.FILES" "KIOKU.DATA" "KIOKU.OBJECTS" "KIOKU.ENVIRONMENT" "KIOKU.CI" "KIOKU.PACKAGES" "KIOKU.TYPESAFE") :test #'equal))
+                       (member (package-name (symbol-package symbol)) '("KIOKU.USER" "KIOKU.TOOLS" "KIOKU.PROCESS" "KIOKU.FILES" "KIOKU.DATA" "KIOKU.OBJECTS" "KIOKU.ENVIRONMENT" "KIOKU.CI" "KIOKU.PACKAGES" "KIOKU.TYPESAFE" "KIOKU.CODE") :test #'equal))
             (error "UNKNOWN_SYMBOL"))
           (kioku.internal:object "symbol" name "arguments" (kioku.internal::printed (sb-introspect:function-lambda-list symbol)) "documentation" (or (documentation symbol 'function) "No function documentation."))))))
 
@@ -521,3 +524,28 @@
         (list (loop for line in lines while (< (length out) cap) do (visit line)))
         (vector (loop for line across lines while (< (length out) cap) do (visit line)))))
     (coerce out 'simple-vector)))
+
+(in-package :kioku.code)
+(define-condition service-error (error)
+  ((code :initarg :code :reader error-code) (message :initarg :message :reader service-message))
+  (:report (lambda (condition stream) (format stream "~A: ~A" (error-code condition) (service-message condition)))))
+(defun %request (method &rest pairs)
+  (let ((args (make-hash-table :test 'equal)))
+    (loop for (key value) on pairs by #'cddr when value do (setf (gethash key args) value))
+    (kioku.internal:rpc method args)))
+(defun capabilities () (%request "code-capabilities"))
+(defun open (path) (%request "code-open" "path" path))
+(defun outline (handle &key range limit) (%request "code-outline" "handle" handle "range" range "limit" limit))
+(defun enclosing (handle position &key kinds) (%request "code-enclosing" "handle" handle "position" position "kinds" (and kinds (coerce kinds 'vector))))
+(defun query (handle query-id &key range limit) (%request "code-query" "handle" handle "queryId" query-id "range" range "limit" limit))
+(defun span (node-handle &key max-chars) (%request "code-span" "nodeHandle" node-handle "maxChars" max-chars))
+(defun semantic (handle kind &key position limit) (%request "code-semantic" "handle" handle "kind" kind "position" position "limit" limit))
+(defun release (handle) (%request "code-release" "handle" handle))
+(defmacro with-snapshot ((handle path) &body body)
+  "Bind HANDLE only for an accepted snapshot; always release, including errors."
+  (let ((response (gensym "SNAPSHOT")))
+    `(let ((,response (open ,path)))
+       (if (member (gethash "status" ,response) '("ok" "partial") :test #'equal)
+           (let ((,handle (gethash "handle" (gethash "data" ,response))))
+             (unwind-protect (progn ,@body) (release ,handle)))
+           ,response))))

package/migrations/035_owned_execution.sql

@@ -0,0 +1,19 @@
+CREATE TABLE dsh_owned_operations (
+  operation_id TEXT PRIMARY KEY,
+  run_id TEXT NOT NULL REFERENCES ledger_runs(run_id) ON DELETE CASCADE,
+  session_id TEXT NOT NULL,
+  generation TEXT NOT NULL,
+  request_digest TEXT NOT NULL,
+  state TEXT NOT NULL CHECK(state IN ('started','completed','unknown')),
+  receipt_json TEXT NOT NULL CHECK(json_valid(receipt_json)),
+  updated_at TEXT NOT NULL
+);
+CREATE INDEX idx_dsh_owned_operations_run ON dsh_owned_operations(run_id, generation);
+CREATE TABLE memory_execution_links (
+  entry_id TEXT NOT NULL REFERENCES entries(id) ON DELETE CASCADE,
+  revision INTEGER NOT NULL,
+  operation_id TEXT NOT NULL REFERENCES dsh_owned_operations(operation_id),
+  PRIMARY KEY(entry_id, revision, operation_id)
+);
+ALTER TABLE dsh_memory_finalizations ADD COLUMN staged_capsule_json TEXT CHECK(staged_capsule_json IS NULL OR json_valid(staged_capsule_json));
+ALTER TABLE dsh_memory_finalizations ADD COLUMN staged_binding_hash TEXT;