kiokuko-dsh 0.2.34 → 0.2.37

package/docs/model-selection.ja.md

@@ -14,7 +14,7 @@ DSHの権限判定、必要な検証を維持し、役小角の契約・WorkUnit
 
 Webプロファイルでは [Kiokuko Models](kiokuko-models.md) から接続を設定できます。DSH本体のModelsで設定する必要はありません。登録したモデルは、通常会話・Enno・Deepでネイティブ接続と併用できます。
 
-通常版・modular coreとも `modelAutoMode.mode: off` が既定です。同じDSHプロファイルでKiokuko Modelsまたはdsh-codexからCodexを認証し、JevかLayaの判定を準備したうえで、まず `observe` で選択案を確認します。
+通常版・modular coreとも `modelAutoMode.mode: off` が既定です。同じDSHプロファイルでKiokuko Modelsまたはdsh-codexからCodexを認証し、Jev・Laya・[OpenAI](typed-decisions.md#openai-credentials)のいずれかの判定を準備したうえで、まず `observe` で選択案を確認します。
 
 ```yaml
 modelAutoMode:
@@ -34,7 +34,7 @@ modelAutoMode:
 
 初期候補は `gpt-6-luna` の low・medium・high と `gpt-6-sol` の high です。`modelAutoMode.routes` には最大4件、`id`（`luna-low`、`luna-medium`、`luna-high`、`sol-high`）と `binding`（`provider`、`model`、`reasoningEffort`）を指定できます。IDは経路のラベルなので、登録済みのAstraなども正確なbindingで割り当てられます。候補はCodex由来とResponses方式を確認でき、現在のモデル一覧、文脈容量・入力形式・推論強度、要求設定の検証、token meterを通った接続に限定します。ネイティブの `openai-codex` とKiokuko所有のCodex接続が対象です。名前だけを似せた接続やOpenAI API接続は対象外です。有効なbindingが2件未満なら判定しません。
 
-新しい受付済みの通常タスクでは、現在の依頼文、タスク種別、添付の種類、経路IDと判定基準を選択中のJevかLayaへ送ります。この判定のために添付の内容、全履歴、リポジトリ全体は送信しません。Choice 1問の結果をrunに保存し、継続では同じ経路を使います。再起動時に判定結果が不明なら再送せず元のモデルを維持します。`observe`、棄権、probe失敗、metadata不足、非対応effort、timeout、入力超過でも元のモデルを維持します。取消、セッション同一性の不一致、保存の整合性エラーでは要求を止めます。認証・利用枠・モデル利用不可によるdispatch失敗を別モデルへ自動再送しません。
+新しい受付済みの通常タスクでは、現在の依頼文、タスク種別、添付の種類、経路IDと判定基準を選択中のJev・Laya・OpenAIへ送ります。この判定のために添付の内容、全履歴、リポジトリ全体は送信しません。Choice 1問の結果をrunに保存し、継続では同じ経路を使います。再起動時に判定結果が不明なら再送せず元のモデルを維持します。`observe`、棄権、probe失敗、metadata不足、非対応effort、timeout、入力超過でも元のモデルを維持します。取消、セッション同一性の不一致、保存の整合性エラーでは要求を止めます。認証・利用枠・モデル利用不可によるdispatch失敗を別モデルへ自動再送しません。
 
 状態表示では、設定・準備状態・選択案・適用したbindingと、nativeの `request/header` で確認した実モデルを区別します。初期候補は判定基準であり、品質・時間・利用枠の改善を保証しません。Enno、Deep、子、雑談、回答の再検討、保護されたLisp実行は既存の経路を使います。実装失敗後の自動昇格は初期版に含めません。
 

package/docs/model-selection.md

@@ -15,7 +15,7 @@ plan approval or automatic Enno continuation.
 
 In Web profiles, [Kiokuko Models](kiokuko-models.md) manages connections without requiring DSH's Models settings. Its registered models are available to ordinary chat, Enno and Deep alongside native connections.
 
-`modelAutoMode` is off by default in both the full plugin and modular core. To try it, authenticate Codex through Kiokuko Models or dsh-codex in the same DSH profile, configure a Jev or Laya typed-decision backend, then use `observe` before enabling automatic routing:
+`modelAutoMode` is off by default in both the full plugin and modular core. To try it, authenticate Codex through Kiokuko Models or dsh-codex in the same DSH profile, configure a Jev, Laya or [OpenAI typed-decision backend](typed-decisions.md#openai-credentials), then use `observe` before enabling automatic routing:
 
 ```yaml
 modelAutoMode:
@@ -35,7 +35,7 @@ The command changes only the current native session. `on` also clears its manual
 
 The initial preset offers `gpt-6-luna` at low, medium and high effort, plus `gpt-6-sol` at high effort. Up to four exact route bindings can be configured under `modelAutoMode.routes`; each has an `id` from `luna-low`, `luna-medium`, `luna-high`, `sol-high`, and a `binding` with `provider`, `model`, and `reasoningEffort`. These are route labels, so a registered Astra or other GPT model may be assigned explicitly. No new model ID is guessed or substituted. A candidate must have a validated Codex origin and Responses protocol, live model context and modality metadata, supported efforts, call-config validation and token meter. Both native `openai-codex` and Kiokuko-owned Codex routes qualify; an arbitrary provider name or OpenAI API connection does not. Fewer than two valid bindings skips classification.
 
-For a new admitted normal task, Kiokuko sends the current task text, task type, attachment kinds, route IDs and rubric to the selected Jev or Laya backend. It does not send attachment bytes, full history or repository contents for this classification. One Choice result selects a route or abstains. The route is stored against the exact run and reused for continuations; an unknown in-flight decision after restart is retained without another classifier call. `observe` records a proposal but keeps the current model. A failed probe, missing metadata, unsupported effort, timeout, oversized input or abstention also keeps the current model. Cancellation, stale session identity and storage integrity failures stop the request. Dispatch authentication, quota and unavailable-model errors remain ordinary failures; no alternate model is retried automatically.
+For a new admitted normal task, Kiokuko sends the current task text, task type, attachment kinds, route IDs and rubric to the selected Jev, Laya or OpenAI backend. It does not send attachment bytes, full history or repository contents for this classification. One Choice result selects a route or abstains. The route is stored against the exact run and reused for continuations; an unknown in-flight decision after restart is retained without another classifier call. `observe` records a proposal but keeps the current model. A failed probe, missing metadata, unsupported effort, timeout, oversized input or abstention also keeps the current model. Cancellation, stale session identity and storage integrity failures stop the request. Dispatch authentication, quota and unavailable-model errors remain ordinary failures; no alternate model is retried automatically.
 
 The status distinguishes the configured mode, readiness, proposal and selected binding from the model observed in a native `request/header`. The initial preset is a rubric, not a claim that it improves quality, elapsed time or subscription usage. Enno, Deep, children, chat, review continuation and protected Lisp execution retain their existing owners. Automatic escalation after a failed implementation pass is not enabled.
 

package/docs/store-evidence.md

@@ -17,6 +17,12 @@ permissions, and disposable-profile result independently.
 | npm lifecycle | `prepare: npm run build` |
 | Automatic size policy | intentionally exceeded; manual `user-reviewed` track |
 
+This table records the **0.1.3 review snapshot**, including its original lifecycle
+command; it is not the current package's release evidence. Current source uses
+`prepare: node scripts/prepare-build.mjs` with normal builds and an explicit CI-only
+deferral. See [current lifecycle and permissions](../PERMISSIONS.md#installation-lifecycle)
+and [CI build ownership](verification.md#consolidated-duplicate-invocations).
+
 The Commit field is filled only after the user commits and pushes the verified
 working tree. The catalog must point to that full immutable Commit, not a branch
 name or moving tag.

package/docs/typed-decisions.md

@@ -23,7 +23,7 @@ excerpted or rewritten, and classification grants no execution permission.
 The common API also accepts explicit `noul` (yes probability) and `score`
 (ordered rubric) questions. Their validated answers have `status: "measured"`;
 they grant no permission. The existing Choice request and answer shapes remain
-valid. TypeSafe can evaluate all three question types in one batch. Nimble and
+valid. TypeSafe and OpenAI can evaluate all three question types in one batch. Nimble and
 Laya accept Choice only and return `DECISION_UNSUPPORTED` before inference for
 other kinds. The separate Lisp `kioku.typesafe:evaluate` API retains its own
 wire contract.
@@ -33,6 +33,7 @@ Switch backends in DSH without a restart:
 ```text
 /kioku-decisions use jev
 /kioku-decisions use laya
+/kioku-decisions use openai
 /kioku-decisions use nimble
 /kioku-decisions use default
 ```
@@ -48,8 +49,107 @@ base configuration. A stale host cannot overwrite a selection saved by another
 host; restart it to load the latest choice. Changing the base configuration uses
 that configuration's selection, with the YAML provider as the default.
 
+<a id="openai-credentials"></a>
+## OpenAI credentials
+
+Jev remains the default; OpenAI, local Laya and Nimble are alternatives. OpenAI uses the official [Decisions API](https://developers.openai.com/api/docs/guides/decisions), `POST /v1/decisions`, with `gpt-6-luna` as this checkout's default decision model. This is separate from the main chat model: ChatGPT/Codex OAuth login does not supply `OPENAI_API_KEY`, and a TypeSafe/Jev key cannot replace it.
+
+These instructions describe the current source. They do not assert that the published npm `latest` already includes OpenAI support. If `use openai` is unavailable, check the installed build's command support first.
+
+1. Create an API key for your OpenAI API project and add it to the credential store used by the running DSH. With the standard `credentials-local` provider, choose the path as follows:
+
+   | Configuration | Credential file |
+   |---|---|
+   | Default harness home | `~/.dsh/.credentials.yaml` |
+   | Custom `DSH_HOME` | `$DSH_HOME/.credentials.yaml` |
+   | Explicit `credentials.path` (the provider's `config.path`) | The configured path, overriding the home default |
+
+   `--profile web` keeps profile packages and patches under `$DSH_HOME/profiles/web`; it does **not** by itself move credentials there. A profile can override `credentials.path`, or its launcher can use another `DSH_HOME`. Use that effective file, not a guessed `profiles/web/.credentials.yaml`.
+
+2. In an existing file, add only `OPENAI_API_KEY` under `refs` and preserve all other `refs` and `records`. This is a minimal **new-file example**, with a nonfunctional placeholder:
+
+   ```yaml
+   version: 1
+   refs:
+     OPENAI_API_KEY: "OPENAI_API_KEY_EXAMPLE_ONLY"
+   records: {}
+   ```
+
+   Replace the placeholder privately with your key. On macOS/Linux, protect the actual file; for the default path:
+
+   ```sh
+   chmod 600 "$HOME/.dsh/.credentials.yaml"
+   ```
+
+   Use your configured path instead when it differs. The default `watch: true` reloads valid file edits automatically for subsequent requests; restarting DSH is unnecessary. Do not paste keys into chat, screenshots or Git.
+
+3. In DSH's command input, select OpenAI and inspect the result:
+
+   ```text
+   /kioku-decisions use openai
+   /kioku-decisions status
+   ```
+
+   `use openai` makes a real API probe, which may incur usage charges. Only a successful probe and save persist the choice for this project and new requests; failure or cancellation keeps the prior choice. Existing requests keep their binding. `status` makes no inference call. Optional `/kioku-decisions probe` makes another real probe.
+
+The standard provider resolves **saved file > launch environment > project `.env` > harness-home `.env`**. Environment variables still work when the credentials service is present, unless a saved value overrides them. For an environment-only setup, export the key **before** launching DSH from that shell:
+
+```sh
+export OPENAI_API_KEY='OPENAI_API_KEY_EXAMPLE_ONLY'
+```
+
+This is a placeholder, not a usable key. An export in another shell after DSH has started does not update its launch snapshot; use the watched file to update an already running instance. Keep credential-bearing `.env` files out of Git.
+
+## Provider configuration
+
 Configure `typedDecisions` on the full plugin or modular core:
 
+OpenAI uses the distinct official [Decisions API](https://developers.openai.com/api/docs/guides/decisions),
+`POST https://api.openai.com/v1/decisions`, rather than Responses JSON output.
+It maps Choice, Noul (predicate) and Score to the native API and validates ordered
+named answers, distributions, rubric levels and individual refusals. The default
+model is `gpt-6-luna`; probability ≥ 0.9 and margin ≥ 0.2 are required for Choice.
+Kiokuko resolves `OPENAI_API_KEY` through `ctx.credentials.resolve` when the service
+exists; the standard local provider includes the launch environment and `.env`
+fallbacks described [above](#openai-credentials). Only a composition without that
+service uses Kiokuko's direct `process.env` fallback. A different credential
+provider may have different resolution rules. TypeSafe credentials are never substituted. No redirects,
+automatic retries, or provider fallback are added. `use openai` probes before
+persisting; missing credentials, failed probes and cancellation leave selection unchanged.
+Existing Jev/Laya stored configuration digests retain their original shape.
+Current token records retain input/output totals; cached-token breakdown is not recorded.
+
+To select OpenAI in the plugin or core configuration instead of a project command:
+
+```yaml
+typedDecisions:
+  mode: auto
+  provider: openai
+  openai:
+    model: gpt-6-luna
+    timeoutMs: 5000
+```
+
+Keep keys in the credential store, not in `typedDecisions`. A configured provider
+is not evidence of a successful API call; use the command probe to verify access.
+
+The normal startup card offers the four decision/Lisp ON/OFF combinations and Cancel
+in one question before model tool assembly. It uses the currently selected backend,
+shown in the card; selection does not prove authentication or successful inference.
+Immutable existing decision bindings also retain the task choice, without granting
+tool or file authority. The same request and explicit continuation reuse the choice;
+an unrelated new request asks again. Cancel/Skip starts no task. Headless operation
+keeps the configured decision mode and explicit manual Lisp preference; an explicit
+`typedDecisions.startup: { decision: true, lisp: true }` config selects both.
+Runtime failures retain the choice and permit explicit recovery without a new question.
+
+Semantic-comparison diagnostics retain only the known criterion names
+(`action`, `reference`, `constraints`, `latest-answer`) and finite verdicts, with
+backend, elapsed time, gate outcome and existing request/decision correlation.
+They contain no source text, credentials or private reasoning. `providerDispatched`
+means the provider adapter was invoked; it does not prove a successful HTTP exchange.
+These diagnostic fields never change acceptance or native permissions.
+
 ```yaml
 typedDecisions:
   mode: auto
@@ -99,7 +199,8 @@ A live comparison requires explicit
 `TYPESAFE_API_KEY`; it sends only the checked-in synthetic fixture and must not
 be interpreted as a production accuracy estimate.
 
-Set the TypeSafe key through DSH, then inspect status:
+The following commands manage only the TypeSafe/Jev key; for OpenAI, use the
+[credential-file setup](#openai-credentials). Set the TypeSafe key through DSH, then inspect status:
 
 ```text
 /kioku-typesafe-key <key>

package/docs/typesafe.md

@@ -31,9 +31,14 @@ not verified. Invoke the same command with a new key to replace it immediately.
 
 The first command reports configuration, source and writability. Clear removes
 the stored key and reports any remaining source. DSH resolves `TYPESAFE_API_KEY`
-for each call. Its inherited environment takes precedence and makes changes
-read-only; the managed credential store precedes project/user environment files.
-To change an inherited key, update that launch environment and restart DSH.
+for each call. With the standard credentials-local provider, the saved file wins,
+then the launch environment, project `.env` and harness-home `.env`. Saving writes
+the higher-priority file even when an environment fallback exists. Default file
+watching applies valid edits without a restart; an environment-only change must
+be present when DSH is launched. Preserve existing `refs` and `records`.
+See [credential paths, permissions and precedence](typed-decisions.md#openai-credentials).
+Those storage rules also apply to `TYPESAFE_API_KEY`, but `/kioku-typesafe-key`
+does not set `OPENAI_API_KEY`; ChatGPT/Codex OAuth is separate from both keys.
 With no credential provider, evaluation can use the host's `TYPESAFE_API_KEY`,
 but save/clear return `TYPESAFE_STORAGE_UNAVAILABLE`. Kiokuko creates no separate
 credential file and never supplies the key to workers or their subprocesses.

package/docs/verification.md

@@ -15,9 +15,19 @@ Native fixture preparation is deferred until a selected, executable check declar
 root dependencies (`npm ci`), not the DSH runtime fixture. Missing or invalid native
 fixtures remain `prerequisite-missing` for checks that require them.
 
-The required CI `verify` aggregate waits for `verify-main`, the complete Protected
-Lisp matrix and the complete semantic platform matrix. All three dependency results
-must be `success`; failure, cancellation, skipped or missing results fail the aggregate.
+CI schedules **Linux x64** and **macOS ARM64**. Full selection has 21 jobs:
+selection, two native micro-judge builds, 17 verification lanes and the aggregate.
+Linux ARM64 is not scheduled or claimed as CI coverage. Its runtime/build support
+remains in the native target registry; this workflow does not produce its binary.
+
+The required `verify` aggregate consumes `select`, `micro-judge-native` and `checks`.
+Every selected lane and native artifact must be present, successful, fresh and
+bound to the same selected plan and source. Failure, cancellation, a missing
+selected report, an extra target or an altered artifact fails acceptance. Only
+prose-only selection can legitimately skip both executable job groups. The
+remaining Linux x64/macOS ARM64 check inventories and their deadlines are unchanged.
+The CI review bundle contains exactly its selected targets; standalone native
+bundle verification still requires the complete supported-target inventory.
 
 Output defaults to a fresh OS temporary directory. Supply an empty directory
 outside the repository with `--output`. `plan.json`, per-command logs, official
@@ -80,6 +90,21 @@ arbitrary stdout or a successful no-op process is insufficient.
 
 ## Consolidated duplicate invocations
 
+Selected CI dependency installs set `KIOKUKO_CI_DEFER_PREPARE=1` only on the root
+`npm ci` step. With `CI=true`, this defers this package's `prepare` build to the
+verifier's required clean build; it does not disable dependency lifecycle scripts.
+Ordinary npm/pnpm preparation still builds, including in CI without this explicit
+flag, and build failure remains a failed prepare. The verifier's source/build
+digests, packed-artifact receipts and stale-source rejection remain mandatory.
+
+For full coverage, Linux ARM64 removal changes the planned job count from 27 to
+21 and official DSH fixture builds from 19 to 15. Deferring prepare removes one
+redundant plugin build in each of the remaining 17 verification lanes. This is an
+execution-plan comparison, not a measured hosted-CI duration improvement. Official
+DSH still builds separately for each selected fixture lane; no OS/architecture,
+Node/ABI or native dependency is reused across platforms.
+
+
 - `skill-prompts` is covered by `native-unit`: `tests/dsh/unit/skill-compiler.test.ts`, `tests/dsh/unit/skill-snapshot.test.ts`.
 - `index-reasoning` is covered by `native-integration`: `tests/dsh/integration/index-reasoning.test.ts`, `tests/dsh/integration/index-reasoning-native.test.ts`, `tests/dsh/integration/index-reasoning-evaluation.test.ts`.
 - `index-evaluation` is covered by `native-integration`: `tests/dsh/integration/index-reasoning-evaluation.test.ts`.

package/lisp/process-identity.d.mts

@@ -0,0 +1,2 @@
+export function processIdentity(pid: number): string | undefined
+export function sameProcess(pid: number, identity: string | undefined): boolean

package/lisp/process-identity.mjs

@@ -0,0 +1,34 @@
+import { readFileSync } from 'node:fs'
+import { execFileSync } from 'node:child_process'
+import { createHash } from 'node:crypto'
+
+/** OS birth identity, not PID liveness alone. Unavailable identity stays conservative. */
+export function processIdentity(pid) {
+  if (!Number.isSafeInteger(pid) || pid < 1) throw new Error('INVALID_PROCESS_ID')
+  try {
+    let birth
+    if (process.platform === 'linux') {
+      const stat=readFileSync(`/proc/${pid}/stat`,'utf8')
+      birth=[readFileSync('/proc/sys/kernel/random/boot_id','utf8').trim(),stat.slice(stat.lastIndexOf(')')+2).split(' ')[19]]
+      if(!/^\d+$/.test(birth[1]??''))throw new Error('INVALID_PROCESS_IDENTITY')
+    } else if(process.platform === 'darwin') {
+      const started=execFileSync('/bin/ps',['-p',String(pid),'-o','lstart='],{encoding:'utf8',timeout:1000,stdio:['ignore','pipe','ignore'],env:{...process.env,LC_ALL:'C',TZ:'UTC'}}).trim()
+      if(!started)return undefined
+      birth=[started]
+    } else return undefined
+    return createHash('sha256').update(JSON.stringify([process.platform,pid,...birth])).digest('hex')
+  } catch(error) {
+    if(['ENOENT','ESRCH'].includes(error.code)||error.status===1)return undefined
+    throw error
+  }
+}
+
+export function sameProcess(pid, identity) {
+  try { process.kill(pid,0) } catch(error) { if(error.code==='ESRCH')return false;throw error }
+  if(process.platform==='linux'){
+    try{const stat=readFileSync(`/proc/${pid}/stat`,'utf8');if(['Z','X'].includes(stat.slice(stat.lastIndexOf(')')+2).split(' ')[0]))return false}
+    catch(error){if(error.code==='ENOENT')return false;throw error}
+  }
+  const current=identity?processIdentity(pid):undefined
+  return !current || !identity || current===identity
+}

package/lisp/repository-owner.d.mts

@@ -0,0 +1 @@
+export function claimRepository(root: string): { recordRuntime(pid: number): string | null; close(): void }

package/lisp/repository-owner.mjs

@@ -0,0 +1,58 @@
+// The existing supervisor holds this OS-backed SQLite lock until its runtime exits.
+// The user directory is independent of DSH's DB, session and worker TMPDIR.
+import { DatabaseSync } from 'node:sqlite'
+import { createHash } from 'node:crypto'
+import { lstatSync, mkdirSync, realpathSync, readFileSync, writeFileSync, renameSync, unlinkSync } from 'node:fs'
+import { randomUUID } from 'node:crypto'
+import { processIdentity, sameProcess } from './process-identity.mjs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+export function claimRepository(root) {
+  const canonical = realpathSync(root)
+  const directory = join(process.platform === 'win32' ? tmpdir() : '/tmp', `kiokuko-lisp-owners-${process.getuid?.() ?? 'user'}`)
+  mkdirSync(directory, { recursive: true, mode: 0o700 })
+  const info = lstatSync(directory)
+  if (!info.isDirectory() || info.isSymbolicLink() || (process.getuid && info.uid !== process.getuid()) || (info.mode & 0o077))
+    throw new Error('REPOSITORY_LOCK_DIRECTORY')
+  const path = join(directory, `${createHash('sha256').update(canonical).digest('hex')}.sqlite3`)
+  try { const file=lstatSync(path);if (!file.isFile() || file.isSymbolicLink()) throw new Error('REPOSITORY_LOCK_FILE') }
+  catch(error) { if(error.code !== 'ENOENT') throw error }
+  const db = new DatabaseSync(path)
+  const metadata=path+'.owner.json',token=randomUUID()
+  try {
+    // Opening a new SQLite file briefly takes reader locks in *both* contenders.
+    // A zero busy timeout can make both exclusive acquisitions fail before
+    // either owns the repository. Allow those short initialization reads to
+    // drain; an existing owner's lifetime transaction still rejects in 250ms.
+    db.exec('PRAGMA busy_timeout=250; BEGIN EXCLUSIVE; CREATE TABLE IF NOT EXISTS repository_owner(root TEXT NOT NULL)')
+    try {
+      const owner=JSON.parse(readFileSync(metadata,'utf8'))
+      if(!Number.isSafeInteger(owner.pid)||owner.pid<1||owner.root!==canonical||typeof owner.token!=='string'
+        ||owner.identity!==null&&!/^[a-f0-9]{64}$/.test(owner.identity))throw new Error('REPOSITORY_LOCK_METADATA')
+      // A supervisor killed before cleanup must not donate its still-live runtime.
+      if(sameProcess(owner.pid,owner.identity??undefined))throw new Error('REPOSITORY_IN_USE')
+    } catch(error) { if(error.code!=='ENOENT')throw error }
+    db.prepare('DELETE FROM repository_owner').run()
+    db.prepare('INSERT INTO repository_owner VALUES(?)').run(canonical)
+    let recorded=false
+    return {
+      recordRuntime(pid){
+        const temporary=metadata+'.'+token
+        const identity=processIdentity(pid)??null
+        writeFileSync(temporary,JSON.stringify({root:canonical,pid,identity,token})+'\n',{flag:'wx',mode:0o600})
+        renameSync(temporary,metadata);recorded=true
+        return identity
+      },
+      close(){
+        // Called only after runtime exit. A crash leaves evidence for the next owner.
+        if(recorded){const owner=JSON.parse(readFileSync(metadata,'utf8'));if(owner.token===token)unlinkSync(metadata)}
+        db.close()
+      },
+    } // Transaction stays uncommitted; the OS releases it when this supervisor dies.
+  } catch(error) {
+    db.close()
+    if(error.errcode === 5 || error.code === 'SQLITE_BUSY') throw new Error('REPOSITORY_IN_USE')
+    throw error
+  }
+}

package/lisp/supervisor.mjs

@@ -2,7 +2,16 @@
 // pipe. It stays outside the worker sandbox so arbitrary Lisp cannot disable it.
 import { spawn } from 'node:child_process'
 import { openSync, closeSync, writeSync } from 'node:fs'
+import { claimRepository } from './repository-owner.mjs'
 const launch = JSON.parse(process.argv[2])
+let repositoryLease
+if (launch.repositoryRoot) {
+  try { repositoryLease = claimRepository(launch.repositoryRoot) }
+  catch(error) {
+    writeSync(4, JSON.stringify({ type: 'error', code: error.message === 'REPOSITORY_IN_USE' ? 'REPOSITORY_IN_USE' : 'REPOSITORY_LOCK_FAILED' })+'\n')
+    process.exit(73)
+  }
+}
 let child, closing = false, terminationSent = false
 const kill = () => {
   if (!child?.pid || terminationSent) return
@@ -28,10 +37,18 @@ child = spawn(launch.command, launch.args, { cwd: launch.cwd, env: launch.env, s
 if (filter !== undefined) closeSync(filter)
 // Stream one JSON object: older readers still consume the complete terminal
 // object, while current readers observe the prefix only after actual spawn.
-child.once('spawn',()=>{if(launch.report){try{writeSync(4,'{"processStarted":true,')}catch{/* host already stopped */}}})
+child.once('spawn',()=>{
+  if(launch.repositoryRoot){
+    try{const identity=repositoryLease.recordRuntime(child.pid);writeSync(4,JSON.stringify({type:'runtime',pid:child.pid,identity})+'\n')}
+    catch{try{writeSync(4,JSON.stringify({type:'error',code:'REPOSITORY_LOCK_FAILED'})+'\n')}finally{stop()}}
+  }
+  if(launch.report){try{writeSync(4,'{"processStarted":true,')}catch{/* host already stopped */}}
+})
 child.once('error', error => { process.stderr.write(`LISP_LAUNCH_ERROR: ${error.message}\n`); process.exit(70) })
 child.once('exit', (code, signal) => {
   if(launch.report){try{writeSync(4,JSON.stringify({exitCode:code,signal}).slice(1)+'\n')}catch{/* host already stopped */}}
-  if (launch.group) kill(); process.exit(signal ? 128 : code ?? 70)
+  if (launch.group) kill()
+  repositoryLease?.close()
+  process.exit(signal ? 128 : code ?? 70)
 })
 if (closing) kill()

package/lisp/tools.lisp

@@ -20,6 +20,7 @@
 (defvar *generation* (uiop:getenv "KIOKU_GENERATION"))
 (defvar *counter* 0)
 (defvar *request* nil)
+(defvar *task-scratch* nil)
 (defun object (&rest pairs)
   (let ((h (make-hash-table :test 'equal)))
     (loop for (key value) on pairs by #'cddr do (setf (gethash key h) value)) h))
@@ -68,7 +69,7 @@
                           (if (< (length (sb-ext:string-to-octets json :external-format :utf-8)) 524288) (kioku.data:parse-json json) nil))
                       (error () nil)))))
 (defun compile-task (code)
-  (let ((*package* (find-package :kioku.user)) (*read-eval* nil))
+  (let ((*read-eval* nil))
     (let ((form (with-input-from-string (stream code)
                   (let ((value (read stream nil stream)))
                     (when (or (eq value stream) (not (eq (read stream nil stream) stream)))
@@ -78,7 +79,7 @@
       (compile nil form))))
 (defun evaluate-task (code input-path)
   "Run one generated function with JSON data; leave the full result in scratch."
-  (let ((*package* (find-package :kioku.user)) (*read-eval* nil))
+  (let ((*read-eval* nil))
       (let* ((function (compile-task code))
              (input (kioku.data:parse-json (uiop:read-file-string input-path)))
              (result (funcall function input))
@@ -88,6 +89,18 @@
           (error "TASK_RESULT_LIMIT"))
         (kioku.files:write-text path json)
         (object "path" "task-result.json" "bytes" (length (sb-ext:string-to-octets json :external-format :utf-8))))))
+(defun task-request (request)
+  ;; Fresh unqualified symbols and object refs; the same owner's process remains.
+  ;; Arbitrary Common Lisp is not a heap security boundary.
+  (let* ((*package* (make-package (symbol-name (gensym "KIOKU.TASK.")) :use '(:cl)))
+         (*objects* (make-hash-table :test 'equal))
+         (*task-scratch* (let ((scratch (gethash "scratch" request)))
+                          (when scratch (uiop:ensure-directory-pathname scratch)))))
+    (unwind-protect
+        (if (equal "task-compile" (gethash "method" request))
+            (progn (compile-task (gethash "code" request)) (object "compiled" yason:true))
+            (evaluate-task (gethash "code" request) (gethash "input" request)))
+      (delete-package *package*))))
 (defun serve ()
   (setf *wire* (sb-sys:make-fd-stream 3 :input t :output t :element-type 'character :external-format :utf-8 :buffering :line))
   (emit (object "version" 1 "type" "ready"))
@@ -95,8 +108,7 @@
     (let ((*request* (gethash "id" request)) (*proposals* nil) (*inputs* (gethash "inputs" request #())))
       (handler-case
           (let ((value (cond ((equal "eval" (gethash "method" request)) (evaluate-code (gethash "code" request)))
-                             ((equal "task" (gethash "method" request)) (evaluate-task (gethash "code" request) (gethash "input" request)))
-                             ((equal "task-compile" (gethash "method" request)) (progn (compile-task (gethash "code" request)) (object "compiled" yason:true)))
+                             ((member (gethash "method" request) '("task" "task-compile") :test #'equal) (task-request request))
                              ((equal "describe" (gethash "method" request)) (kioku.tools:describe-symbol (gethash "symbol" request "")))
                              ((equal "inspect" (gethash "method" request)) (kioku.objects:inspect-ref (gethash "ref" request)))
                              (t (error "UNKNOWN_METHOD")))))
@@ -129,7 +141,7 @@
 (defun regex-matches (pattern text) (cl-ppcre:all-matches-as-strings pattern text))
 (defun regex-replace (pattern text replacement) (cl-ppcre:regex-replace-all pattern text replacement))
 (in-package :kioku.files)
-(defun scratch () (pathname (uiop:getenv "KIOKU_SCRATCH")))
+(defun scratch () (or kioku.internal::*task-scratch* (pathname (uiop:getenv "KIOKU_SCRATCH"))))
 (defun %scratch-path (name &key must-exist)
   "Resolve NAME below scratch without accepting absolute paths, traversal, or links."
   (let* ((root (truename (scratch)))

package/migrations/050_auxiliary_recovery.sql

@@ -0,0 +1,11 @@
+-- Payload-free quarantine. These rows never grant execution or adopt memory.
+CREATE TABLE dsh_auxiliary_recovery (
+ id TEXT PRIMARY KEY, session_id TEXT NOT NULL, native_turn INTEGER NOT NULL,
+ origin TEXT NOT NULL CHECK(origin IN ('answer-context','intent-assessment')),
+ source_digest TEXT NOT NULL, context_digest TEXT NOT NULL,
+ state TEXT NOT NULL CHECK(state IN ('pending','running','retry_wait','verified','rejected','stale')),
+ attempts INTEGER NOT NULL DEFAULT 0 CHECK(attempts BETWEEN 0 AND 3),
+ lease_nonce TEXT, lease_until INTEGER, next_at INTEGER NOT NULL DEFAULT 0,
+ last_reason TEXT NOT NULL, updated_at INTEGER NOT NULL
+);
+CREATE INDEX dsh_auxiliary_recovery_session ON dsh_auxiliary_recovery(session_id,native_turn);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kiokuko-dsh",
-  "version": "0.2.34",
+  "version": "0.2.37",
   "description": "Kiokuko plugin for DeepSeek Harness",
   "type": "module",
   "license": "MIT",
@@ -24,6 +24,7 @@
     "skills/",
     "dsh/cordis.patch.yml",
     "docs/",
+    "scripts/prepare-build.mjs",
     "scripts/backfill-akinator-memory.mjs",
     "scripts/setup-dsh.mjs",
     "scripts/repair-session-log.mjs",
@@ -147,7 +148,7 @@
         "DSH-configured model providers for explicitly started Deep planning and its budgeted memory extraction",
         "The explicitly selected DSH model provider for a user-started Diff review without tools",
         "DSH-configured model provider for automatic memory review (active by default, up to 12 worker dispatches per project per UTC day), ordinary finalization and configured memory evolution",
-        "Configured TypeSafe fixed endpoint or explicit Nimble HTTPS/loopback endpoint for automatic task/Skill/draft decisions and independent original-source/candidate comparison, projected memory reuse after a synthetic readiness probe, and Lisp; no redirects, retries or provider substitution; exact roles.check no-tool fallback for complete draft review",
+        "Configured TypeSafe or explicitly selected OpenAI Decisions fixed endpoint, or explicit Nimble HTTPS/loopback endpoint, for automatic task/Skill/draft decisions and independent original-source/candidate comparison, projected memory reuse after a synthetic readiness probe, and Lisp; no redirects, retries or provider substitution; exact roles.check no-tool fallback for complete draft review",
         "Explicit Laya-CoreML Unix socket for local finite decisions using the existing v1 worker or optional strict operations; no subprocess client, automatic worker startup, model downloads or provider substitution",
         "DSH-configured admitted provider/model for default-active source-backed index reasoning: up to 8 worker dispatches per workspace per UTC day; no retrieval-time generation or automatic resend of uncertain dispatches",
         "User-configured AI API endpoints and vendored provider OAuth flows through Kiokuko Models"
@@ -155,6 +156,7 @@
       "credentials": [
         "Optional user-provided GitHub or embedding credentials; never bundled or persisted by the plugin",
         "TYPESAFE_API_KEY resolved per explicit call; optional DSH-managed set/unset via /kioku-typesafe-key, inherited environment precedence, no worker or Kiokuko storage exposure; input visible while typing",
+        "OPENAI_API_KEY resolved separately through DSH credentials, or inherited environment only without a credentials service; never stored in decision records or substituted with a TypeSafe key",
         "Optional separate Nimble bearer credential reference through DSH; TYPESAFE_API_KEY is prohibited for Nimble; credentials are never persisted in decision records",
         "Shared dsh-auth credentials: human Web login/key replacement/logout; logout also affects dsh-cli"
       ],
@@ -167,7 +169,7 @@
         "Enabled source-candidate assessment distinguishes unavailable and incomplete checks from proof; the micro judge is native-verified on Apple Silicon macOS only, unsupported platforms report unavailable, and explicit typed-decision OFF records no assessment"
       ],
       "lifecycleEvidence": [
-        "prepare runs only npm run build",
+        "prepare builds by default; selected CI installs defer to the verifier clean build",
         "Git installs use repository-scoped pnpm allowBuilds approval on a supporting pnpm version; source revision pinning is optional and separate",
         "Disposable-profile install, Web start, and uninstall evidence is recorded by CI"
       ]
@@ -200,7 +202,7 @@
     "publint": "publint",
     "pack:check": "node scripts/pack-check.mjs",
     "prepublishOnly": "node scripts/prepublish.mjs",
-    "prepare": "npm run build",
+    "prepare": "node scripts/prepare-build.mjs",
     "test:agenticreplay:package": "npm run build && node scripts/verify-agenticreplay-consumer.mjs && node scripts/verify-agenticreplay-consumer.mjs --pnpm",
     "test:memory-review": "node scripts/run-tests.mjs tests/dsh/unit/memory-review tests/dsh/integration/memory-review",
     "test:evolution": "node scripts/run-tests.mjs tests/dsh/unit/evolution tests/dsh/integration/evolution",

package/scripts/prepare-build.mjs

@@ -0,0 +1,13 @@
+// CI dependency installation may defer only this package's duplicate build.
+// Dependency lifecycle scripts still run; the selected verifier builds from source.
+import { spawnSync } from 'node:child_process'
+
+if (process.env.CI === 'true' && process.env.KIOKUKO_CI_DEFER_PREPARE === '1') {
+  console.log('Deferring package prepare build to the selected verifier clean build.')
+} else {
+  const runner=process.env.npm_execpath
+  if (!runner) throw new Error('Run prepare through npm or pnpm.')
+  const result=spawnSync(process.execPath,[runner,'run','build'],{stdio:'inherit'})
+  if (result.error) throw result.error
+  process.exitCode=result.status ?? 1
+}

package/scripts/setup-dsh.mjs

@@ -1,14 +1,19 @@
 import { parseArgs } from 'node:util'
-import { setupDsh } from '../dist/dsh/setup.js'
+import { removeDshSetup, setupDsh } from '../dist/dsh/setup.js'
 
 try {
   const { values } = parseArgs({ options: {
     cwd: { type: 'string' }, home: { type: 'string' },
     check: { type: 'boolean', default: false }, json: { type: 'boolean', default: false },
+    remove: { type: 'boolean', default: false },
   } })
-  const result = await setupDsh({ cwd: values.cwd, homeDirectory: values.home, check: values.check })
+  const result = await (values.remove ? removeDshSetup : setupDsh)({ cwd: values.cwd, homeDirectory: values.home, check: values.check })
   if (values.json) console.log(JSON.stringify(result, null, 2))
-  else {
+  else if (values.remove) {
+    console.log(values.check ? result.current ? 'Removal is current.' : 'Removal is needed; run again without --check.' : 'Removal complete.')
+    console.log(`Skills: ${result.skills.directory} (${result.skills.removed} ${values.check ? 'removable' : 'removed'}, ${result.skills.preserved} preserved)`)
+    console.log(`Project instructions: ${result.instructions.path} (${result.instructions.status})`)
+  } else {
     console.log(values.check ? result.current ? 'Setup is current.' : 'Setup needs updating; run again without --check.' : 'Setup complete. Reload existing sessions to refresh their instructions.')
     console.log(`Skills: ${result.skills.directory} (${result.skills.created} ${values.check ? 'missing' : 'created'}, ${result.skills.updated} ${values.check ? 'stale' : 'updated'}, ${result.skills.unchanged} unchanged)`)
     console.log(`Project instructions: ${result.instructions.path} (${result.instructions.status})`)

package/skills/kiokuko-lisp/SKILL.md

@@ -145,8 +145,10 @@ Clear native implementation requests offer Lisp before model generation. A task
 ## Project-shared functions
 
 Project-shared functions work in both Lisp modes without a mode switch after the
-coding choice. They execute in separate workers under the selected execution mode, preserving the persistent
-worker's APIs and heap. `lisp_hot_contract` applies the profile approval policy to
+coding choice. The exact session/agent/repo owner reuses its resident worker, preserving
+PID, generation and definitions. Each call uses a fresh package, object table and result scratch;
+this is not heap security isolation. Use pure functions with explicit dependencies. Other owners
+cannot borrow that worker. Without a resident worker, task mode uses disposable workers. `lisp_hot_contract` applies the profile approval policy to
 schemas and 1–32 finite input/expected cases. Only the host grants approval. `lisp_hot_install` validates against that immutable contract and replaces
 the active version only at the expected revision. Dependency code is snapshotted.
 `lisp_hot_call` pins the active version by name; input/result refs stay owner-local.
@@ -154,7 +156,7 @@ the active version only at the expected revision. Dependency code is snapshotted
 uses the same profile approval policy. Approving new conditions preserves the old active
 version until a candidate passes; old conditions cannot authorize a new install.
 Finite cases are not a proof for every input. Active code/dependencies do not
-expire; retired versions may be collected after 30 days. No shared heap or RPC.
+expire; retired versions may be collected after 30 days. Resident shared-function requests deny host RPC.
 Use `/kioku-lisp hot [NAME]` for human inspection. Never rerun UNKNOWN operations.
 
 ## Task-mode API details