kiokuko-dsh 0.2.1 → 0.2.3

package/migrations/036_coding_workflow.sql

@@ -0,0 +1,26 @@
+-- Old sessions remain legacy; enabled Lisp is never migrated into a task choice.
+CREATE TABLE dsh_coding_workflows (
+  workflow_id TEXT PRIMARY KEY,
+  run_id TEXT NOT NULL UNIQUE REFERENCES ledger_runs(run_id) ON DELETE CASCADE,
+  session_id TEXT NOT NULL,
+  repository_root TEXT NOT NULL,
+  request_id TEXT NOT NULL,
+  revision INTEGER NOT NULL CHECK(revision > 0),
+  snapshot_json TEXT NOT NULL CHECK(json_valid(snapshot_json)),
+  updated_at TEXT NOT NULL,
+  UNIQUE(session_id,request_id)
+);
+CREATE INDEX idx_dsh_coding_session ON dsh_coding_workflows(session_id);
+CREATE TABLE dsh_coding_operations (
+  workflow_id TEXT NOT NULL REFERENCES dsh_coding_workflows(workflow_id) ON DELETE CASCADE,
+  call_id TEXT NOT NULL,
+  request_digest TEXT NOT NULL,
+  response_json TEXT NOT NULL CHECK(json_valid(response_json)),
+  PRIMARY KEY(workflow_id,call_id)
+);
+ALTER TABLE dsh_completion_executions ADD COLUMN coding_scope INTEGER;
+ALTER TABLE dsh_completion_executions ADD COLUMN coding_goal_ready INTEGER;
+ALTER TABLE dsh_completion_executions ADD COLUMN coding_inputs_json TEXT;
+ALTER TABLE enno_verifier_runs ADD COLUMN coding_source_paths_json TEXT;
+ALTER TABLE enno_verifier_runs ADD COLUMN coding_source_digest TEXT;
+ALTER TABLE enno_verifier_runs ADD COLUMN explicit_test_cases INTEGER;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kiokuko-dsh",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Kiokuko plugin for DeepSeek Harness",
   "type": "module",
   "license": "MIT",
@@ -102,7 +102,7 @@
       ]
     },
     "permissions": {
-      "summary": "Local Kiokuko state and managed files, optional network-backed Skills, embeddings and configured provider-independent typed decisions, DSH-managed TypeSafe credentials, and protected or approved subprocesses.",
+      "summary": "Kiokuko-owned local development execution, candidate memory and host receipts; normal user environment, PATH commands and child processes. Concrete confirmation for source/data deletion and durable user database changes.",
       "readPaths": [
         "Configured Kiokuko SQLite database and embedding assets",
         "Registered project roots and their repository metadata",
@@ -117,12 +117,13 @@
         "DSH run, lease, receipt, retrieval, Deep inputs/artifacts/budgets/reports, post-completion memory-finalization, and embedding state inside that database",
         ".agenticreplay/runs and .agenticreplay/exports inside verified session workspaces, or the configured Kiokuko data directory",
         "Legacy history compatibility under DSH's native write lease: exact rejected v3 file or validated new v3 generation from retained v0, identical .bak, disposable validation artifacts, and automatic deletion of confirmed identity-mismatched native logs",
-        "Opt-in Lisp scratch, input snapshots, verified compiled bundle cache, durable operation journal, and approved file changes with host backups"
+        "Opt-in Lisp scratch, input snapshots, verified compiled bundle cache, durable operation journal, and approved file changes with host backups",
+        "Project files through owned native tools; private execution outbox beside the configured Kiokuko database"
       ],
       "commands": [
         "Restricted repository-relative verifier and backup subprocesses when explicitly requested",
         "Read-only fixed-argument Git commands for an explicitly captured Diff review",
-        "Opt-in protected SBCL and brokered subprocesses; no implicit runtime installation or VM"
+        "Owned bash/zsh, PATH commands, builds/tests and Lisp with the normal user environment; explicit protected Lisp compatibility mode remains available"
       ],
       "externalServices": [
         "GitHub or skills.sh for optional Skill discovery and source retrieval",
@@ -132,12 +133,14 @@
         "DSH-configured model provider for automatic memory review (active by default, up to 12 worker dispatches per project per UTC day), ordinary finalization and configured memory evolution",
         "Configured TypeSafe fixed endpoint or explicit Nimble HTTPS/loopback endpoint for automatic task/Skill/draft decisions, projected memory reuse after a synthetic readiness probe, and Lisp; no redirects, retries or provider substitution; exact roles.check no-tool fallback for complete draft review",
         "Explicit Laya-CoreML Unix socket for local finite decisions using the existing v1 worker or optional strict operations; no subprocess client, automatic worker startup, model downloads or provider substitution",
-        "DSH-configured admitted provider/model for default-active source-backed index reasoning: up to 8 worker dispatches per workspace per UTC day; no retrieval-time generation or automatic resend of uncertain dispatches"
+        "DSH-configured admitted provider/model for default-active source-backed index reasoning: up to 8 worker dispatches per workspace per UTC day; no retrieval-time generation or automatic resend of uncertain dispatches",
+        "User-configured AI API endpoints and vendored provider OAuth flows through Kiokuko Models"
       ],
       "credentials": [
         "Optional user-provided GitHub or embedding credentials; never bundled or persisted by the plugin",
         "TYPESAFE_API_KEY resolved per explicit call; optional DSH-managed set/unset via /kioku-typesafe-key, inherited environment precedence, no worker or Kiokuko storage exposure; input visible while typing",
-        "Optional separate Nimble bearer credential reference through DSH; TYPESAFE_API_KEY is prohibited for Nimble; credentials are never persisted in decision records"
+        "Optional separate Nimble bearer credential reference through DSH; TYPESAFE_API_KEY is prohibited for Nimble; credentials are never persisted in decision records",
+        "Shared dsh-auth credentials: human Web login/key replacement/logout; logout also affects dsh-cli"
       ],
       "failureBoundaries": [
         "Repository identity, run identity, lease, revision, and integrity mismatches fail closed",
@@ -154,7 +157,7 @@
   },
   "scripts": {
     "clean:dist": "node --input-type=module --eval \"import { rmSync } from 'node:fs'; rmSync('dist', { recursive: true, force: true });\"",
-    "build": "npm run clean:dist && tsc -p tsconfig.build.json && node scripts/compile-skill-prompts.mjs && node scripts/build-dsh-client.mjs && node scripts/build-history-codecs.mjs && node scripts/build-plugin-entry.mjs",
+    "build": "npm run clean:dist && tsc -p tsconfig.build.json && node scripts/build-model-transports.mjs && node scripts/compile-skill-prompts.mjs && node scripts/build-dsh-client.mjs && node scripts/build-history-codecs.mjs && node scripts/build-plugin-entry.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "node scripts/run-tests.mjs tests/dsh",
     "test:harness": "node --import tsx scripts/run-harness-evaluation.mjs",
@@ -178,7 +181,6 @@
     "publint": "publint",
     "pack:check": "node scripts/pack-check.mjs",
     "prepare": "npm run build",
-    "prepublishOnly": "npm run typecheck && npm test && npm run build && npm run publint && npm run pack:check",
     "test:agenticreplay:package": "npm run build && node scripts/verify-agenticreplay-consumer.mjs && node scripts/verify-agenticreplay-consumer.mjs --pnpm",
     "test:memory-review": "node scripts/run-tests.mjs tests/dsh/unit/memory-review tests/dsh/integration/memory-review",
     "test:evolution": "node scripts/run-tests.mjs tests/dsh/unit/evolution tests/dsh/integration/evolution",
@@ -237,16 +239,21 @@
     "test:ci:prepare": "npm run verify:prepare",
     "test:ci:embedding": "node scripts/run-local-embedding-smoke.mjs --offline",
     "test:ci:approval:web": "npm run build && node scripts/run-ci-native.mjs browser-approval",
-    "test:ci:shortcuts:web": "npm run build && node scripts/run-ci-native.mjs browser-shortcuts"
+    "test:ci:coding:web": "npm run build && node scripts/run-ci-native.mjs browser-coding",
+    "test:ci:shortcuts:web": "npm run build && node scripts/run-ci-native.mjs browser-shortcuts",
+    "test:models:web": "npm run build && node scripts/verify-models-web.mjs",
+    "test:code-intelligence": "node scripts/run-code-intelligence.mjs",
+    "test:code-intelligence:packed": "node scripts/run-code-intelligence.mjs --packed",
+    "test:code-intelligence:benchmark": "node scripts/benchmark-code-intelligence.mjs"
   },
   "dependencies": {
     "@deepseek-ai/cosmokit": "1.8.5",
-    "@deepseek-ai/schemastery": "3.18.4",
+    "@deepseek-ai/schemastery": "3.18.5-alpha.1",
+    "agenticreplay": ">=0.1.0 <1.0.0",
     "jsonc-parser": "3.3.1",
     "semver": "7.8.5",
     "yaml": "2.9.0",
-    "zod": "4.5.4",
-    "agenticreplay": ">=0.1.0 <1.0.0"
+    "zod": "4.5.4"
   },
   "overrides": {
     "adm-zip": "0.6.1",
@@ -254,7 +261,12 @@
     "global-agent": "4.1.3"
   },
   "peerDependencies": {
+    "@ai-sdk/provider": "4.0.21",
     "@deepseek-ai/cordis": "~4.0.5-alpha.1",
+    "@deepseek-ai/dsh-agent": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-attachment": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-llm": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.2.1-alpha.2",
     "@huggingface/hub": "2.16.1",
     "@huggingface/transformers": "4.2.0",
     "sqlite-vec": "0.1.9"
@@ -268,11 +280,34 @@
     },
     "sqlite-vec": {
       "optional": true
+    },
+    "@deepseek-ai/dsh-llm": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-llm-pi-ai": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-agent": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-attachment": {
+      "optional": true
+    },
+    "@ai-sdk/provider": {
+      "optional": true
     }
   },
   "devDependencies": {
+    "@ai-sdk/anthropic": "4.0.71",
+    "@ai-sdk/google": "4.0.87",
+    "@ai-sdk/openai": "4.0.83",
+    "@ai-sdk/openai-compatible": "3.0.62",
+    "@ai-sdk/provider": "4.0.21",
     "@deepseek-ai/cordis": "4.0.5-alpha.1",
+    "@deepseek-ai/dsh-agent": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-attachment": "0.2.1-alpha.2",
     "@deepseek-ai/dsh-llm": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.2.1-alpha.2",
     "@deepseek-ai/dsh-session-format": "0.2.1-alpha.2",
     "@deepseek-ai/dsh-session-format-v0-to-v1": "0.2.1-alpha.2",
     "@deepseek-ai/dsh-session-format-v1-to-v2": "0.2.1-alpha.2",

package/skills/coding-ideal-routine-skill/SKILL.md

@@ -18,6 +18,12 @@ description: バグ修正・機能追加・挙動に関わる設定や配布物
 
 ## 2. 部品ではなく、つながった利用経路を見る
 
+DSH の実装タスクでは、初回の変更前に `coding_workflow status` を読み、`propose` で Goal・依存関係付きの全項目・各項目の観測可能な条件・別の最終 Goal 条件を原子的に登録する。先に必要な読取調査を行ってよい。元依頼の権限と対象を広げない。Enno では既存 ideal・plan を提出し、その共通表示を使う。別の Goal を提案しない。
+
+ホストが Goal・項目・条件を示し、そのタスクで Lisp を使うか人間に確認する。未回答・閉じる・切断は pending。モデルは回答を代行せず、選択前に変更・プロセス・Lisp を起動しない。`next` は再表示と依存達成済みの項目の確認に使う。no では通常ツールで同じ条件を進め、Lisp を勧め直さない。yes の起動失敗はブロッカーとして扱う。
+
+選択後は各項目を自律的に進める。実行前に `task_completion bind` でチェックを対応付け、owned tools または Lisp の実子プロセスから host receipt を得る。全項目が達成済みになった後、最新成果物で通常の利用入口を確かめる最終 Goal チェックを実行する。状態と未達理由は `coding_workflow status` で確認し、自己申告で完了にしない。
+
 変更に関連する通常の操作を、入口から観測可能な結果までたどる。該当する場合は、配布・インストール → 読み込まれる指示／設定 → 公開ツールや UI → 実処理 → ユーザーの成果物までを対象にする。
 
 - 各部品の成功を、連結した経路の成功に置き換えない。生産側が実際に出す値を、消費側がそのまま受け取れるか確かめる。

package/skills/kiokuko-lisp/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: kiokuko-lisp
-description: Compose reusable Common Lisp task tools in protected disposable workers or use the legacy persistent session.
+description: Compose reusable Common Lisp task tools alongside owned development tools, in disposable or persistent workers.
 ---
 
 <!-- KIOKUKO MANAGED STANDARD SKILL: kiokuko-lisp -->
@@ -10,22 +10,23 @@ description: Compose reusable Common Lisp task tools in protected disposable wor
 
 ## Admission and tools
 
-Persistent mode: coding choice or `/kioku-lisp enable`. Task mode: separate session
-via `/kioku-lisp enable-task`, fresh protected workers per definition/call. Missing
-runtime or failed protection blocks admission.
-Never spoof host-bound session/agent/directory/generation. Native read/glob/grep/skill retain
-DSH permissions; ordinary bash/mutation/delegation stay blocked. Lisp/FFI/programs:
-runtime files, declared read-only copies, scratch only; no private host files, project
-writes, database, network or host sockets. Helpers cannot expand permissions. Use
-proposals/audited brokers, never escape protection.
+Coding: coding_workflow defines Goal/items/checks before the task Lisp choice. Pending blocks effects; next reopens. Resume saved choice; new task/scope asks again. No uses ordinary tools. Verify items, then the user entry with fresh host results.
+
+
+
+Persistent mode: coding choice or /kioku-lisp enable. Task mode uses /kioku-lisp enable-task with fresh workers per definition/call. Lisp and ordinary tools coexist. Coding-task startup failure blocks until recovery or explicit route change; legacy ordinary tools remain available. Never spoof host-bound session/agent/directory/generation.
+
+Use kioku_read, kioku_write, kioku_edit, kioku_remove, kioku_exec and kioku_result for observed development. PATH commands, bash/zsh, builds/tests, coding-needed external investigation and project edits need no routine confirmation. Source/data deletion and existing durable user database mutation need a concrete review; generated/temp/disposable artifacts and routine Kioku saving are authorized. Declare destructiveTargets when executing commands with destructive intent. The host does not attempt to classify every side effect of arbitrary code.
+
+Lisp uses the normal user environment and child processes. Prefer kioku.tools:call-tool with the owned tools or kioku.process broker APIs to obtain host receipts. Direct Lisp/FFI effects are not independently observed and cannot establish successful verification. Bind task_completion conditions/source paths before executing checks, including subdirectory checks. Collect asynchronous final receipts with kioku_result. A model/Lisp passed field is never process evidence. Plan, goal, cancellation and execution ownership remain authoritative. During Plan use read/search/status; explicit human implementation instructions or Plan approval exit at the next accepted boundary.
 
 Schemas define arguments; never guess. `lisp_describe` without a symbol gives the
 API/verifier map, even during recovery. Persistent `lisp_eval`: declared inputs;
 `lisp_describe`: functions; `lisp_inspect`: paged evidence; `lisp_status`: state;
 `lisp_cancel`: stop; `lisp_reset`: healthy, confirmed-stopped worker only, no recovery bypass.
-Task `lisp_define`: protected example-checked lambda; `lisp_call`: inline input/inputRef;
+Task `lisp_define`: compiled, schema/example-checked lambda; `lisp_call`: inline input/inputRef;
 `lisp_observe`: workspace capture without bodies; `lisp_stage`: freeze against observed
-baseRef; `lisp_verify`: private-scratch check; `lisp_apply`: host approval/frozen-target
+baseRef; `lisp_verify`: private-scratch check; `lisp_apply`: frozen-target
 recheck; `lisp_compare`: no execution. Status/inspection read refs/receipts. Unknown
 test status or generated `passed` fields never prove host verification.
 
@@ -40,13 +41,15 @@ remain owner-bound until expiry. Never replay effects.
 
 Common Lisp/CL-PPCRE/CL-CSV/YASON via `kioku.tools`, `kioku.data`,
 `kioku.files`, `kioku.process`, `kioku.objects`, `kioku.environment`, `kioku.ci`,
-`kioku.decisions`, `kioku.typesafe`; no Quicklisp/network downloads. First enable
+`kioku.decisions`, `kioku.typesafe`, `kioku.code`; no Quicklisp/network downloads. First enable
 compiles; later starts reuse verified code, not session state. Compile/cache failure
 blocks startup: report `/kioku-lisp recover`; never modify compiled files or replay effects.
 Task mode: bounded JSON schemas, exact dependency toolRefs, no heap/worker refs
 between calls. Disposable `lisp_eval`; workspace inputs use `lisp_observe`, never
 legacy inputs/proposals. Expired refs never read current files; persistent mode owns shared heap.
 
+Persistent `kioku.code`: negotiate V1 with capabilities; use with-snapshot; check status/freshness. Handles expire per evaluation. Missing V1 returns unavailable, with no tool/parser fallback. Aggregate before returning. Fixed DTOs and budgets: docs/lisp.md.
+
 Persistent: define/test/use cohesive `defun` tools in one `lisp_eval`, reuse on new
 inputs. Batch known work/compact evidence; split at decisions/approvals/limits. Never
 preprogram guesses or eval data. Definitions last one generation; `lisp_describe`
@@ -57,19 +60,15 @@ identity/size/digest and read-only copies; other absolute paths fail. Limits: 64
 256 MiB/generation. `kioku.files:input`: read; `kioku.files:scratch`: write/unzip. Reimport
 applied files for comparison; export only when authorized. `kioku.files:propose-write`:
 relative paths, successful evaluation, durable recording.
-Deletion/replacement: profile policy on frozen targets/diffs. Duplicate targets fail;
+Development mode: ordinary replacement is authorized; deletion of source/data requires concrete confirmation. Protected compatibility mode retains its frozen-target profile policy. Duplicate targets fail;
 unchanged writes do nothing. Refusal/skip/UI failure/cancellation never authorizes.
 Trust APPLIED/UNCHANGED/NOT_APPLIED/UNKNOWN receipts; partial failure stops later writes.
-Never retry unknown effects. Refuse protected paths/databases/links, recursive deletion
-and database mutation. Independent backups never auto-prune. RUNNING lasts until
+Never retry unknown effects. Use owned tools for ordinary project files and confirmed durable DB changes; protected compatibility mode refuses its protected paths/databases/links and recursive deletion. Independent backups never auto-prune. RUNNING lasts until
 receipts save; restart repairs finalization without reapplying effects.
 
 ## Programs, verification and packages
 
-`kioku.process:run`/`start-job`: program/args/timeout/scratch-relative directory, no
-links/traversal; job-status/cancel-job manage bounded credential-free jobs. macOS:
-no fork, use Lisp/direct brokers, not shell/npm/multiprocessing. Node (22.8+):
-`--test --experimental-test-isolation=none` avoids children. Linux: Bubblewrap PID namespaces.
+`kioku.process:run`/`start-job` use project-relative or absolute directories in development mode, normal PATH/environment and child processes. Use job-status/cancel-job and inspect final receipts. Explicit protected mode retains scratch-only directories, sandboxed environment and its OS child/network restrictions; never escape protection.
 
 `kioku.ci:list-runs :limit 10`/`failed-log`: bound-repo host gh/auth, no Lisp credentials.
 `verify`: only `:typecheck`, `:lisp`, `:test`, `:build`, `:package`, `:vendor`, never shell
@@ -82,23 +81,8 @@ ok=true is not process success: check result-code/verifier state/code. Report ob
 results; partial reads cannot prove byte equality. Separate scratch/applied-file
 checks; validate custom checkers on known cases.
 
-`kioku.packages`: separately approved public npm host broker, never arbitrary URLs,
-registry credentials or shell args; workers remain network-denied:
-- `metadata "sharp"`: latest metadata, or one exact canonical `:version`; verify advisory ranges.
-- `audit versions`: hash table of at most ten names/exact versions sent to npm bulk
-  advisories. Empty results cover only those versions, not the whole project.
-- `update-lockfiles versions`: capture root manifest and existing npm/pnpm locks,
-  add explicit security overrides; installed managers generate locks in private
-  OS-protected scratch. `:directory`: workspace-relative root. Refuse Local/Git deps
-  and multi-project workspaces; exclude scripts/hooks/original npm config/inherited
-  credentials. Separate sandbox allows networking/children, unchanged worker protection.
-Updates: persistent eval, one call, no unrelated proposals; ordinary review/backups/
-journal. Recheck captures before generation returns and before application. Generation
-approval never authorizes writes. SUCCEEDED/generatedOnly means generation; only host
-`changes` receipts establish APPLIED/UNCHANGED. Refusal/failure/cancellation: no proposals;
-exact replay sends nothing. HTTP: 30 seconds/256 KiB; each fixed package-manager command:
-90 seconds/256 KiB output. No retries/runtime downloads/dependency installation/
-profile changes/auto-reload. New host APIs need plugin build/reload, never just worker reset.
+`kioku.packages` remains a bounded public npm broker: metadata (latest/exact version), audit (at most ten exact names/versions), update-lockfiles (persistent eval, one call, root npm/pnpm manifests/locks and security overrides). No arbitrary URLs, credentials, shell arguments, Local/Git dependencies or multi-project workspaces. Managers generate frozen proposals in separate network scratch; scripts/hooks and inherited config/credentials are excluded. Recheck captured inputs before returning and applying. Generation
+approval never authorizes writes; only host changes receipts establish APPLIED/UNCHANGED. SUCCEEDED/generatedOnly is generation. Failure/refusal/cancellation returns no proposals; exact replay sends nothing. HTTP: 30s/256KiB; manager: 90s/256KiB. No retries, runtime downloads, installs, profile changes or reloads. New host APIs require plugin build/reload, not worker reset.
 
 ## Evidence, recovery and adapters
 
@@ -149,7 +133,7 @@ DSH guards/registry, refuses others/recursive eval. Bounded stdout/stderr. See l
 
 <!-- kiokuko:runtime prototype-driven-planning -->
 For Lisp coding, plans or reviews, settle testable doubts with current evidence or authorized target-runtime probes. Choose controls and counterexamples first; record commands, failures, observations and refs in one reasoned plan. Stop when evidence suffices or budgets expire; ask only for needed intent or authority.
-ask_user_question/exit_plan_mode keep Lisp guards.
+ask_user_question/exit_plan_mode preserve ownership, cancellation and the selected execution mode.
 
 <!-- /kiokuko:runtime -->
 
@@ -157,7 +141,7 @@ ask_user_question/exit_plan_mode keep Lisp guards.
 ## Project-shared functions
 
 Project-shared functions work in both Lisp modes without a mode switch after the
-coding choice. They execute in separate protected workers, preserving the persistent
+coding choice. They execute in separate workers under the selected execution mode, preserving the persistent
 worker's APIs and heap. `lisp_hot_contract` applies the profile approval policy to
 schemas and 1–32 finite input/expected cases. Only the host grants approval. `lisp_hot_install` validates against that immutable contract and replaces
 the active version only at the expected revision. Dependency code is snapshotted.
@@ -176,7 +160,7 @@ Native tool schemas remain authoritative for exact arguments.
 - `lisp_define`: `{operationId, name, description, source, inputSchema,
   outputSchema, dependencies?: [{binding,toolRef}], examples?: [{input,expected}],
   firstInput?}`. Source is one Lisp lambda. The host saves an immutable toolRef
-  only after protected compilation and declared examples pass.
+  only after compilation and declared examples pass.
 - `lisp_call`: `{operationId, toolRef, input}` or `{operationId, toolRef, inputRef}`.
   Select bounded `fields` with JSON pointers when the full body is unnecessary;
   pass its resultRef to later calls without sending that body through the model.
@@ -189,14 +173,13 @@ Native tool schemas remain authoritative for exact arguments.
   captured bytes in private scratch and runs an approved host verifier. Observe
   all required files, including `package.json`; missing dependencies/scripts
   fail or return NOT_APPLIED. `testStatus:unknown` is not a passing test.
-- `lisp_apply`: `{operationId, candidateRef, verificationRef?}` requires host
-  approval, rechecks the read set and frozen targets, and accepts only a successful
+- `lisp_apply`: `{operationId, candidateRef, verificationRef?}` uses owned execution in development mode and concrete approval for destructive changes; it rechecks the read set and frozen targets, and accepts only a successful
   verification receipt for the same candidate. Without one, it reports `not-run`.
 - `lisp_compare`: `{operationId, leftRef, rightRef}` compares saved bases and
   operation/content hashes without executing either candidate.
 
 The task worker recompiles saved source for each call. Global variables and
-process RPC cannot carry state between calls. Saved resultRefs remain owner-bound
+process RPC cannot carry heap state between calls. Development mode can invoke owned host tools; protected compatibility task workers deny host RPC. Saved resultRefs remain owner-bound
 for up to 30 days across worker/host restart; expired refs do not read live files.
 `lisp_status` lists recent refs and unresolved attempts; `lisp_inspect` reads
 receipts without replay. Persistent `lisp_inspect` accepts a current-generation
@@ -352,32 +335,35 @@ shortlist order for selection; source and test for diagnosis. Define `obj` first
 <!-- /kiokuko:documentation -->
 
 <!-- kiokuko:documentation approval-help -->
-## Profile-wide Lisp approval policy
-
-`lisp.approvalMode` defaults to `ask`; auto-approval is never inferred from an
-unknown request or from selecting Lisp. Ordinary questions keep normal execution
-without a Lisp choice or an approval selector in the chat composer. Once a task
-is identified as coding implementation or debugging, the existing coding choice
-can offer protected Lisp or normal execution; coding plans do not require Lisp.
-Auto-approval is an explicit opt-in through General settings,
-`/kioku-lisp approval auto`, or “Auto-approve all Lisp actions for this profile and
-continue” in a Lisp approval dialog. Use `/kioku-lisp approval ask` to return to
-manual consent. Explicit configuration and saved profile settings persist across
-chats and restarts and override the default; changing the default does not revoke
-a previously saved choice.
-All Lisp permission categories are covered, including file restoration, host
-verification, public npm package operations, and shared-function changes.
-
-Follow the current host-reported mode. In auto mode execute authorized work
-without asking whether to submit, resubmit, run tests, or apply changes. Ask only
-for missing intent that materially changes the work. In ask mode submit the
-operation directly to the host approval dialog without an extra conversational
-permission question. Earlier references to human approval describe ask mode.
-Explicit refusal, cancellation, stale inputs and unknown outcomes still stop
-execution; changing mode does not replay completed or refused operations.
-Identity checks, protected paths, backups and journal recovery remain enforced.
+## Development approval policy
+
+Project edits, verification, helper compilation/registration and ordinary Kioku storage are authorized. Source/data deletion and durable user DB mutations need a concrete review, regardless of the legacy lisp.approvalMode ask/auto value. Old profile settings still load. Do not request conversational permission before a required host review. Refusal, cancellation, stale targets and uncertain outcomes remain authoritative; never replay effects.
 
 <!-- /kiokuko:documentation -->
 <!-- kiokuko:runtime approval-policy -->
-Follow the live host approval mode. Profile auto-approve covers every Lisp permission: execute authorized actions without permission or resubmission questions. Ask only for materially missing intent. Ask mode uses host dialogs without an extra conversational permission request. Refusal, cancellation, stale inputs and unknown outcomes still stop work; never replay effects because mode changed.
+Routine development and helper registration are authorized. Concrete destructive review remains required. Lisp failure does not block ordinary tools. Report execution, verification and saving separately; retry saving without replaying effects.
 <!-- /kiokuko:runtime -->
+
+
+<!-- kiokuko:documentation code-intelligence -->
+## Read-only code intelligence
+
+Persistent evaluations may use `kioku.code` when the calling agent has a V1
+provider. Call `capabilities` first; absence/old version returns `unavailable`.
+There is no generic LSP/tool/parser fallback. Task workers cannot use host RPC.
+Use `with-snapshot` around `open`/`outline`/`enclosing`/fixed `query`/`span`/read-only
+`semantic`; it releases accepted snapshots with `unwind-protect`. Check `status`
+before `data`: preserve partial, unsupported, unavailable, stale, cancelled,
+timeout and limit-exceeded results. Unready diagnostics are not clean diagnostics.
+Queries are only `declarations`, `calls`, `imports`; semantic kinds are definition,
+references, implementation, hover, diagnostics, completion. Never request writes,
+rename, commands, arbitrary query text, or arbitrary RPC.
+Aggregate/filter in Lisp and return counts plus chosen spans and outcome metadata.
+Do not return an entire large corpus just because the worker can hold it. Positions
+are zero-based UTF-16; ranges half-open; snapshots are disk-only. Reopen after a
+file/checkout change. Handles expire at evaluation end and saved results are not
+live authority. Keep 100 calls, 16 MiB input, 64 KiB responses, 30 seconds per code
+batch; per response 32 KiB, document 2 MiB, captures 200, outline 100, span 8000.
+Release stays available after limits. Check `lisp_describe` for exact arguments.
+
+<!-- /kiokuko:documentation -->

package/skills/kiokuko-soul/SKILL.md

@@ -8,39 +8,18 @@ description: Kiokuko's entry router for non-trivial DSH work. Read it before any
 <!-- kiokuko:runtime contract -->
 # SOUL router
 
-## Authority
+Read first. Host owns intake/session/capabilities/routing/delegation. No model task_prepare/task_answer; their absence is normal. Require ready/exhausted, permissive nextAction; invent no profile.
 
-Read first. Host owns intake/session/capability binding/routing/delegation. Host-only `task_prepare`/`task_answer`: never call/emulate/stop for absence. Require `ready`/`exhausted` intake and permissive `nextAction`; invent no profile fields.
-
-User instructions outrank Skill preferences, never host safety/authorization/identity/revision/lease/state/integrity checks. Resolve routine choices from authorization/evidence; ask about unclear intent/effects. Optional intake/enrichment failures degrade guidance, not native work.
-
-Complete authorized work with focused evidence; report blockers. Recheck only changed conditions. Never guess budgets or auto-retry/continue.
-
-## Shared credo
+User instructions outrank Skill preferences. Preserve identity/revisions/leases/integrity and Plan/goal/cancellation/ownership. Optional enrichment never vetoes ordinary work. Resolve routine choices from authorization/evidence; clarify unclear intent/destruction. Complete work, report blockers, recheck changes; no invented budgets/effect replay.
 
 **本当に、それを全部計算・保存・検索する必要があるのか？**
+Preserve required results; remove needless computation/storage/search, narrow the rest, then optimize. Exhaustive work needs evidence. Never silently approximate/delete data or waive required validation, recovery or audit. No extra approval/artifact.
 
-Before design, preserve the required result, remove needless computation/storage/search, narrow the rest, then optimize.
-
-Require evidence for exhaustive work; never silently approximate/delete data/waive required validation/recovery/audit/host checks. No extra approval/artifact.
-
-## Capabilities and routes
-
-Use request/directive-matched Skills for conversation/research/writing/organization/memory/coding. Never impose code contracts/execution choices/runtime startup on unrelated work.
-
-Read selected Skill indexes, then risk-selected references. Resources grant no execution authority; the host owns configuration/permissions.
-
-Modules own roles/tools/execution/recovery. Preserve host exclusions/identity/lease/outcome. Missing required modules/unresolved requests stay blocked: never switch paths/replay effects to bypass them. Optional gaps cannot block unrelated work.
-
-Normal execution: current model/memory/Skills/native permissions; no orchestration contract/extra approval. Never invent run/role/revision/WorkUnit/state transitions or bypass routing by provider changes/agents. Respect directives/scope.
-
-## Availability and trust
-
-Unavailable Skills: use current evidence unless host safety/authorization/identity/integrity blocks. Never substitute similar/namespaced/fetched/reference-only Skills for required bundled Skills or auto-install/execute external Skills. Never claim unread Skills/unrun checks; availability is not use.
+Match Skills to the request/directive; non-code needs no coding startup. Read selected indexes and risk-selected references. Preserve roles/exclusions/recovery and host outcomes/model/effort; optional gaps never block work.
 
-Before diagnostics, confirm supported file types via status/capabilities. Unsupported Markdown/documents: read, verify structure/requirements/whitespace. Unavailable diagnostics: unverified, not clean.
+Normal execution uses current model/memory/Skills and kioku_read/write/edit/remove/exec/result. Project work, PATH/bash/zsh, Lisp, builds/tests and routine Kioku saving need no routine approval; review source/data deletion and durable user DB changes concretely. Lisp failure needs recovery or explicit route change. Bind source/test/config checks before execution and collect final background receipts. Receipts prove observations, not generalized lessons; check recalled candidates against current sources. Report work/verification/saving separately; retry saving only. Human implementation instructions or Plan approval request exit at the next accepted boundary; a plan-only answer does not exit.
 
-After a successful edit/write, re-read before next mutation; serialize edits. If stale, re-read and reconcile; never force overwrite/disable freshness checks. Never repeat unsupported diagnostics unchanged.
+Unavailable Skills: use current evidence unless required host identity/authority/integrity prevents it. Never substitute required Skills or auto-install/execute fetched Skills. Never claim unread Skills or unrun checks. Before diagnostics check supported file types; For Markdown and unsupported documents, read and check structure, requirements and whitespace manually. Unavailable diagnostics remain unverified, not clean. After a successful edit or write, re-read before the next mutation. Serialize changes; on stale content re-read and reconcile, never force overwrite or repeat unsupported diagnostics unchanged.
 
-Select `kiokuko-{investigate,architecture,review,benchmark,verification,skill-authoring,technical-writing}` as needed; use `coding-ideal-routine-skill` for code changes. Inherit host model/effort.
+Select kiokuko-{investigate,architecture,review,benchmark,verification,skill-authoring,technical-writing} as needed. Coding: coding-ideal-routine-skill owns coding_workflow and fresh Goal evidence.
 <!-- /kiokuko:runtime -->

package/skills/one-shot-software-completion/SKILL.md

@@ -16,12 +16,9 @@ defaults never override intent, permissions or host integrity checks.
 
 **本当に、それを全部計算・保存・検索する必要があるのか？**
 
-Complete the required outcome with only the computation, persistence and search
-it needs. Before implementation, eliminate unnecessary work and narrow the rest;
-justify exhaustive processing or retention with a concrete requirement. Search
-for missing evidence and stop when it is sufficient. Verify that omitted work
-does not change required behavior or weaken integration, recovery or checks.
-Completion means meeting the user's requirements, not processing everything.
+Before implementation, remove unnecessary computation, persistence and search;
+justify exhaustive work by a required outcome. Stop when evidence suffices.
+Verify that omissions preserve behavior, integration, recovery and checks.
 
 ## Read economically
 
@@ -41,6 +38,8 @@ failures or lost context. Token budgets use host usage, not bytes or capacity.
 
 ## Completion contract
 
+Coding: coding_workflow binds Goal/items/checks before the task Lisp choice. Verify items, then the user entry with fresh host evidence. Pending checks prevent completion; resume exact task/operation IDs.
+
 Bind behavior, required method, preserved contracts and evidence before editing.
 No unapproved proxy: raster for required geometry, hardcoded output, mocks or
 disconnected helpers. Tests are evidence, not specification; expectation changes