kiokuko-dsh 0.2.7 → 0.2.9

package/docs/guardrail-licenses/manifest.json

@@ -0,0 +1,71 @@
+{
+  "schema": 1,
+  "scope": "Preserved upstream notices for bundled Rust standard library and conservative musl/libunwind supplements; toolchain archive hashes are in crates/guardrail-release/release-provenance.json in the repository.",
+  "files": {
+    "COPYRIGHT-library.html": {
+      "sha256": "5647be074c8edf7339fd863055923a8fc80bc5610a8d4661ec3b767b9d392c27",
+      "bytes": 1499465,
+      "provenance": "Official Rust 1.99.0 distribution notice"
+    },
+    "COPYRIGHT-Rust.txt": {
+      "sha256": "172020dbfd5b53a226dfde77616190a48dcff519b0bc0e6deb91a8450782c4af",
+      "bytes": 1571,
+      "provenance": "Official Rust 1.99.0 distribution notice"
+    },
+    "LICENSE-MIT": {
+      "sha256": "b71bd43a069ca0641a9ecfe585ca7b3c53b5cc1608f8b68321168698e28b5ea1",
+      "bytes": 1068,
+      "provenance": "Official Rust 1.99.0 distribution notice"
+    },
+    "LICENSE-APACHE": {
+      "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
+      "bytes": 9723,
+      "provenance": "Official Rust 1.99.0 distribution notice"
+    },
+    "musl-COPYRIGHT.txt": {
+      "sha256": "f9bc4423732350eb0b3f7ed7e91d530298476f8fec0c6c427a1c04ade22655af",
+      "bytes": 6204,
+      "provenance": "Conservative supplemental upstream notice from official Zig 0.17.0 distribution; not evidence of exact Rust-linked library revision"
+    },
+    "libunwind-LICENSE.txt": {
+      "sha256": "b5efebcaca80879234098e52d1725e6d9eb8fb96a19fce625d39184b705f7b6d",
+      "bytes": 16706,
+      "provenance": "Conservative supplemental upstream notice from official Zig 0.17.0 distribution; not evidence of exact Rust-linked library revision"
+    },
+    "MIT.txt": {
+      "sha256": "b85dcd3e453d05982552c52b5fc9e0bdd6d23c6f8e844b984a88af32570b0cc0",
+      "bytes": 1078,
+      "provenance": "Official Rust 1.99.0 distribution notice"
+    },
+    "Apache-2.0.txt": {
+      "sha256": "074e6e32c86a4c0ef8b3ed25b721ca23aca83df277cd88106ef7177c354615ff",
+      "bytes": 10280,
+      "provenance": "Official Rust 1.99.0 distribution notice"
+    },
+    "LLVM-exception.txt": {
+      "sha256": "e34c58338bd89d43e709e226610d8f32b3e3c47f4ad9a99a8dc1d4ac7842488e",
+      "bytes": 919,
+      "provenance": "Official Rust 1.99.0 distribution notice"
+    },
+    "NCSA.txt": {
+      "sha256": "39cb0234065c92b9e6cee3830cbb52b1aa289aa8fe9ba2e66730fec5cf05c630",
+      "bytes": 1676,
+      "provenance": "Official Rust 1.99.0 distribution notice"
+    },
+    "Unicode-3.0.txt": {
+      "sha256": "f5062c9a188d81dfe66b56db4182dcf9e4b17c0d9b0d311a8e20b3a1b075c443",
+      "bytes": 1995,
+      "provenance": "Official Rust 1.99.0 distribution notice"
+    },
+    "BSD-2-Clause.txt": {
+      "sha256": "f32fb3b417a194167cfad068223fc975ba96c5960513a10f66a3c28720aec1df",
+      "bytes": 1267,
+      "provenance": "Official Rust 1.99.0 distribution notice"
+    },
+    "ISC.txt": {
+      "sha256": "0ff61769b238634e042ab759dddfd104a8e69d091e3600ae3410e401a6164381",
+      "bytes": 730,
+      "provenance": "Official Rust 1.99.0 distribution notice"
+    }
+  }
+}

package/docs/guardrail-licenses/musl-COPYRIGHT.txt

@@ -0,0 +1,193 @@
+musl as a whole is licensed under the following standard MIT license:
+
+----------------------------------------------------------------------
+Copyright © 2005-2020 Rich Felker, et al.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+----------------------------------------------------------------------
+
+Authors/contributors include:
+
+A. Wilcox
+Ada Worcester
+Alex Dowad
+Alex Suykov
+Alexander Monakov
+Andre McCurdy
+Andrew Kelley
+Anthony G. Basile
+Aric Belsito
+Arvid Picciani
+Bartosz Brachaczek
+Benjamin Peterson
+Bobby Bingham
+Boris Brezillon
+Brent Cook
+Chris Spiegel
+Clément Vasseur
+Daniel Micay
+Daniel Sabogal
+Daurnimator
+David Carlier
+David Edelsohn
+Denys Vlasenko
+Dmitry Ivanov
+Dmitry V. Levin
+Drew DeVault
+Emil Renner Berthing
+Fangrui Song
+Felix Fietkau
+Felix Janda
+Gianluca Anzolin
+Hauke Mehrtens
+He X
+Hiltjo Posthuma
+Isaac Dunham
+Jaydeep Patil
+Jens Gustedt
+Jeremy Huntwork
+Jo-Philipp Wich
+Joakim Sindholt
+John Spencer
+Julien Ramseier
+Justin Cormack
+Kaarle Ritvanen
+Khem Raj
+Kylie McClain
+Leah Neukirchen
+Luca Barbato
+Luka Perkov
+M Farkas-Dyck (Strake)
+Mahesh Bodapati
+Markus Wichmann
+Masanori Ogino
+Michael Clark
+Michael Forney
+Mikhail Kremnyov
+Natanael Copa
+Nicholas J. Kain
+orc
+Pascal Cuoq
+Patrick Oppenlander
+Petr Hosek
+Petr Skocik
+Pierre Carrier
+Reini Urban
+Rich Felker
+Richard Pennington
+Ryan Fairfax
+Samuel Holland
+Segev Finer
+Shiz
+sin
+Solar Designer
+Stefan Kristiansson
+Stefan O'Rear
+Szabolcs Nagy
+Timo Teräs
+Trutz Behn
+Valentin Ochs
+Will Dietz
+William Haddon
+William Pitcock
+
+Portions of this software are derived from third-party works licensed
+under terms compatible with the above MIT license:
+
+The TRE regular expression implementation (src/regex/reg* and
+src/regex/tre*) is Copyright © 2001-2008 Ville Laurikari and licensed
+under a 2-clause BSD license (license text in the source files). The
+included version has been heavily modified by Rich Felker in 2012, in
+the interests of size, simplicity, and namespace cleanliness.
+
+Much of the math library code (src/math/* and src/complex/*) is
+Copyright © 1993,2004 Sun Microsystems or
+Copyright © 2003-2011 David Schultz or
+Copyright © 2003-2009 Steven G. Kargl or
+Copyright © 2003-2009 Bruce D. Evans or
+Copyright © 2008 Stephen L. Moshier or
+Copyright © 2017-2018 Arm Limited
+and labelled as such in comments in the individual source files. All
+have been licensed under extremely permissive terms.
+
+The ARM memcpy code (src/string/arm/memcpy.S) is Copyright © 2008
+The Android Open Source Project and is licensed under a two-clause BSD
+license. It was taken from Bionic libc, used on Android.
+
+The AArch64 memcpy and memset code (src/string/aarch64/*) are
+Copyright © 1999-2019, Arm Limited.
+
+The implementation of DES for crypt (src/crypt/crypt_des.c) is
+Copyright © 1994 David Burren. It is licensed under a BSD license.
+
+The implementation of blowfish crypt (src/crypt/crypt_blowfish.c) was
+originally written by Solar Designer and placed into the public
+domain. The code also comes with a fallback permissive license for use
+in jurisdictions that may not recognize the public domain.
+
+The smoothsort implementation (src/stdlib/qsort.c) is Copyright © 2011
+Valentin Ochs and is licensed under an MIT-style license.
+
+The x86_64 port was written by Nicholas J. Kain and is licensed under
+the standard MIT terms.
+
+The mips and microblaze ports were originally written by Richard
+Pennington for use in the ellcc project. The original code was adapted
+by Rich Felker for build system and code conventions during upstream
+integration. It is licensed under the standard MIT terms.
+
+The mips64 port was contributed by Imagination Technologies and is
+licensed under the standard MIT terms.
+
+The powerpc port was also originally written by Richard Pennington,
+and later supplemented and integrated by John Spencer. It is licensed
+under the standard MIT terms.
+
+All other files which have no copyright comments are original works
+produced specifically for use as part of this library, written either
+by Rich Felker, the main author of the library, or by one or more
+contibutors listed above. Details on authorship of individual files
+can be found in the git version control history of the project. The
+omission of copyright and license comments in each file is in the
+interest of source tree size.
+
+In addition, permission is hereby granted for all public header files
+(include/* and arch/*/bits/*) and crt files intended to be linked into
+applications (crt/*, ldso/dlstart.c, and arch/*/crt_arch.h) to omit
+the copyright notice and permission notice otherwise required by the
+license, and to use these files without any requirement of
+attribution. These files include substantial contributions from:
+
+Bobby Bingham
+John Spencer
+Nicholas J. Kain
+Rich Felker
+Richard Pennington
+Stefan Kristiansson
+Szabolcs Nagy
+
+all of whom have explicitly granted such permission.
+
+This file previously contained text expressing a belief that most of
+the files covered by the above exception were sufficiently trivial not
+to be subject to copyright, resulting in confusion over whether it
+negated the permissions granted in the license. In the spirit of
+permissive licensing, and of not having licensing issues being an
+obstacle to adoption, that text has been removed.

package/docs/guardrail.md

@@ -0,0 +1,33 @@
+# kiokuko-dsh bundled Rust guardrail
+
+The opt-in `bounded-tdd-v1` recipe restricts an existing kiokuko-dsh coding unit to write-tests → verify-red → implement → verify-green → report. Completion bindings follow the existing host approval policy, which may approve automatically; enrollment is not a new human-confirmation step or a grant of filesystem/task authority. A unit may span several files. One fresh RED opens its bounded implementation phase; GREEN requires a net source change and closes that phase. Tests stay frozen after RED. Broadening the unit requires the existing coding-scope amendment flow and fresh evidence.
+
+The host binds receipts to the current task lease, recipe generation, completion binding, separate source/test manifests, exact selected command, Node/runner/supervisor/engine/protocol bytes, and a bounded environment. Tests receive fresh HOME/TMP/XDG directories and a fixed PATH/LANG/TZ, not inherited credentials or arbitrary environment variables. Node's private structured event channel supplies observations; stdout, JSON claims and a nonzero exit cannot issue receipts. Assertion-shaped events require structured assertion fields. Model-written tests can still fabricate assertion semantics or test the wrong behavior; this is not proof of semantic correctness or hostile same-user process attestation.
+
+Each owned write and test launch receives final transactional lease reauthorization. Cancellation committed before that boundary prevents the effect; a later cancellation must stop an already-started process. File staging and replacement are synchronous within the checked write boundary. SQLite and filesystem effects are not one atomic transaction: a crash may leave changed files with a pending operation. Such operations remain blocked for inspection, stop confirmation, explicit task resume and fresh rebinding instead of automatic replay or rollback. A database retry cannot repeat an already-entered effect callback; an uncertain launch stays pending even when the caller changes its call ID.
+
+Completion status exposes separate capability metadata for bounded protocol validation, lease-checked owned effects, process-only Node tests, and protected-required Lisp effects; rollback and heap restoration are false. Selected Node tests are ordinary JavaScript: the runner is not an OS sandbox against undeclared filesystem or network effects.
+
+The bounded CL-like language is declarative, without arbitrary Common Lisp evaluation or heap restoration. Existing workflow metadata and task authority remain the only state authority. Enrolled Lisp effects require the protected owned-tool route; unrestricted development Lisp is unavailable while enrolled. The guardrail is not an OS sandbox or global permission system. Hashes identify inputs and ordinary integrity, not malicious same-user filesystem races. Non-enrolled work retains its existing behavior.
+
+## Installation and checks
+
+The full package and core module include precompiled artifacts, protocol, Node runner and resolver. Engine selection uses no Cargo, SBCL, download, PATH fallback or install-time compilation. The normal build, including Git-install prepare, verifies bundled assets.
+
+- `npm run verify:guardrail`: verify all bundled hashes, modes, ELF/Mach-O structure and recorded native-execution status without running cross-built binaries.
+- `npm run check:guardrail`: verify availability and integrity for the current host; missing or invalid assets fail closed.
+
+`package.json` pins `guardrail/manifest.json`, which binds protocol bytes, each executable and its original release manifest. Manifests include source/build inputs and compiler/linker provenance. Product and engine versions are independently metadata-derived. The resolver rejects symlinks, non-regular/non-executable files, malformed or truncated executables, wrong architectures and identity mismatches.
+
+## Target status
+
+- Linux x64: static musl ELF; native CLI smoke and reproducible-build checks passed on Linux x64.
+- Linux ARM64: static musl ELF, cloud cross-built; native execution not run.
+- macOS Intel and Apple Silicon: cloud cross-built Mach-O, minimum macOS 13; native execution not run. ARM64 ad-hoc signature structure was checked.
+- Other hosts: unsupported; no substitute architecture is selected.
+
+Cross-build, format and hash checks do not establish native compatibility, arbitrary runtime behavior, notarization or developer signing. Package smoke execution applies only to its actual host. Linux musl binaries have no dynamic ELF interpreter.
+
+## Repository source and maintenance
+
+The repository includes the actual dependency-free Rust library/CLI at [crates/guardrail](../crates/guardrail/README.md), including the restricted-language/evidence-wire specification, protocol, Cargo lockfile and tests. [Build and release instructions](../crates/guardrail-release/BUILDING.md) accompany the pinned official-source toolchain inputs and portable offline recipe. This source/build layer is excluded from npm runtime tarballs; runtime [third-party notices](guardrail-licenses/README.md) remain included. Original recorded repeat-build evidence does not mean an adapted wrapper has reproduced every target.

package/docs/lifecycle-memory.md

@@ -0,0 +1,25 @@
+# Local lifecycle memory
+
+Kiokuko DSH records bounded public observations in its existing configured SQLite database. No HTTP server, extra model call, credential, global installation or external scheduler is required.
+
+Both full and core entry points observe explicit model selections, successful compaction summaries, committed task completion, human feedback and native message ratings. Private reasoning blocks and raw compaction output are excluded. Public text passes the existing secret and path redaction policy. Capture refusal prevents further capture and reference delivery for that session.
+
+The native tools `memory_observe`, `memory_context` and `memory_improve` use the common memory contract. Supply the absolute repository `cwd`; `memory_context` also accepts `query`, `tags`, `sessionId` and `limit`. Requests outside the configured repository are rejected. Responses always allow work to continue. `recorded` describes persistence; it is separate from input acceptance. Failed recording is never reported as a saved observation.
+
+Context includes project cautions, procedure candidates, bounded recent task history, same-session continuation, eligible Global principles/references, source references and diagnostics. Every project reference retains producer, event ID, source revision, content digest and verification provenance; Global references retain entry identity/revision and opaque evidence links. Context is untrusted data; it cannot grant permissions or override the current request, host or OS. The native pre-step re-reads current same-repository cautions and temporary session context on every step, including a new task. Durable candidate sources are checked beyond the recent 512-event window. Retrieval is bounded to 128 candidates and a 15 KB excerpt; it is not an unlimited history dump.
+
+Every projected snapshot also tells the model to call `memory_context` with relevant keywords/tags when the procedure is unclear, while following normal task preparation and permission checks. Project candidates and Global references participate in that lookup; Global keyword searches use the existing hybrid retrieval lanes and eligibility gates.
+
+Feedback replacements append a source revision. Deletions append a tombstone. Previous revisions remain auditable but no longer support new context. Native pre-steps check persistent memory revisions and reuse the existing snapshot when its data is unchanged and still present in the active context. They do not re-derive history or append duplicate snapshot audit records on unchanged steps. A changed or expired view replaces the previous snapshot; prior-turn memory lookup results are retired when their memory revisions change. A missing snapshot is delivered again after compaction/context loss. The original log remains intact.
+
+Context caching is limited to 32 query views per SQLite connection, keyed by workspace, session, query, tags and limit. Observation, evaluation, source-policy and Global content/eligibility revisions invalidate the cache. Continuation expires at the earliest supporting observation's 24-hour deadline, even without a database write. The cache returns independent plain JSON values; model/tool output carries no private cache metadata. Ordinary ledger sequence, recorder and audit traffic does not invalidate memory revisions. A reattached host checks and reuses a matching existing native snapshot.
+
+Routine candidates require independently sourced repeated completions. Only fresh host-bound completion evidence establishes verification. Human praise, ordinary task termination and silence do not prove success. Complaints and failed matching executions reduce confidence; withdrawn sources immediately invalidate old candidate projections. Observation boundaries improve candidates immediately. A shared, unreferenced host timer checks for pending source revisions every 60 seconds and stops when the last module owner releases it. A persistent processing watermark skips extraction when those revisions have already been handled; the bounded aggregation window is re-derived only when new input exists or a larger extraction limit is requested. Candidate/Global writes and the watermark commit together. A failed extraction leaves the revision pending for retry, including after a process restart. There is no paid-model improvement pass.
+
+Improvement creates untrusted Global principle candidates in the same configured database. These contain fixed portable preventive/verification rules and opaque evidence hashes; project text, commands, paths, personal profiles and raw logs are not copied. They never become verified or adopted automatically. Current-source hashes, capture policy and ordinary memory eligibility gates govern their visibility, including ordinary Global search outside these lifecycle tools.
+
+When praise refers to the current public answer or its completed run, the observer resolves exact repository/session/run links to AgenticReplay. With a bound full-host recorder, a completed trace supplies at most 64 events/64 KB of public result metadata; only tool names, result classification and trace event IDs are retained. Payloads, reasoning and blobs are excluded. Unbound, missing, incomplete or refused traces cannot justify verification. Core remains independent of the recorder and retains local public observations and available trace links.
+
+Optional memory failure leaves coding available. Context reads have a 50 ms foreground bound; unavailable context is omitted. Optional SQLite operations fail immediately on a writer lock rather than borrowing the normal host's lock wait/retry budget; the host setting is restored before returning. After a terminal run and its pending finalization have committed, cache or worker notification failures cannot prevent owner release. The pending job remains available to the existing startup retry mechanism.
+
+The connected surface is the native DSH lifecycle and three native tools. This change does not add a permanent HTTP API or a memory-management UI. It does not modify the running installation/configuration or require an external Kiokuko server.

package/docs/lisp.md

@@ -12,6 +12,29 @@ the existing permission and approval boundaries still apply.
 
 The default is `lisp.executionMode: development`. Old `approvalMode` values remain readable. Set `executionMode: protected` explicitly to select the legacy worker/approval/fence behavior. See [owned execution and memory evidence](owned-execution.md).
 
+## Task state at execution boundaries
+
+Managed Lisp effects require the session's current `Working` task. The host pins
+the task ID, session, repository, revision and execution generation when an
+invocation starts. It checks that same identity again after approval, before
+effects, and inside successful journal/evidence writes. Waiting, stopping,
+ignoring or resuming a task invalidates old executions; resuming does not grant
+an older background job new authority. Failed, cancelled and interrupted runs
+retain their recorded outcomes and require explicit resume.
+
+| Lisp path | Task-state behavior |
+| --- | --- |
+| Saved reads, status, cancellation, observe/stage/compare, pure eval and function calls | Remain available without a Working task; any managed effect reached inside a call is checked separately. |
+| Proposals/apply/restore, CI verification, package updates, artifact publication, shared-function changes, reset/recover | Require a Working task at the actual effect boundary. An unavailable validator denies the effect. |
+| `run`, `start-job`, owned-tool RPC and compiled `run_code` dispatch | Carry the host-pinned identity through native dispatch; old generations cannot publish a success receipt. `start-job` may outlive the evaluation's cancellation signal, but cannot acquire a newer task lease. |
+| CI list and failed-log reads | Remain read-only and do not need task execution authority. |
+
+These checks cover the managed host adapters. Development mode runs Common Lisp
+with normal process permissions: arbitrary Common Lisp filesystem or process
+calls can bypass those adapters. Task state is not an OS sandbox, and enabling it
+does not change the user's permissions. Choose the existing protected mode when
+its filesystem/process isolation is required.
+
 ## Compose task tools
 
 Use the worker as a persistent programming environment. Before repeating primitive
@@ -383,12 +406,12 @@ The provider owns Tree-sitter, grammars, source snapshots, coordinates, and LSP
 processes. Kiokuko does not install them or fall back to generic LSP tools.
 Core alone has no code-intelligence runtime dependency.
 
-The published provider v0.1.12 does not supply V1. The local prerequisite is kept
-as a reproducible [upstream patch](../patches/code-intelligence/README.md). A
-future compatible provider should advertise V1 and the required capabilities;
-package version alone is insufficient. Absence, an old provider, missing grammar,
-and an unready language server return explicit outcomes. They do not block the
-ordinary Lisp APIs. Node must satisfy Kiokuko's `>=24.16.0` requirement.
+The released `@askdkc/dsh-lsp-server` v0.1.14 provides V1. Follow the
+[installation guide](code-intelligence.md); the local patch is only a historical
+test fixture. `kiokuko-dsh` checks the service contract and capabilities at runtime,
+not just the package version. Missing providers, grammars and unready language
+servers return explicit outcomes without blocking ordinary Lisp APIs.
+Node must satisfy `kiokuko-dsh`'s `>=24.16.0` requirement.
 
 Start with `(kioku.code:capabilities)`. Its response includes `status`, `reason`
 when relevant, `data.version`, `data.capabilities`, `data.languages`, distributed
@@ -459,9 +482,10 @@ reported independently from grammar and language-server readiness.
 
 Development verification is `npm run test:code-intelligence` after preparing the
 provider fixture. The source/native and packed paths are separate checks. The CI
-matrix runs normal development on macOS, Ubuntu 26.04, and Arch; the protected code-provider path
-is exercised on macOS; Linux protection remains a separate native-suite check. A configured job
-is not evidence that the remote job passed.
+matrix configures development checks on macOS, Ubuntu 26.04 and Arch, plus
+protected checks on macOS. Linux protected acceptance is separate. A configured
+job is not evidence that the current package passed; see the setup guide for
+verification limits.
 
 Clean installation and platform status: [code intelligence setup](code-intelligence.md).
 

package/docs/memory-evolution.md

@@ -1,6 +1,6 @@
 # Episode / evolution
 
-一つの Kiokuko run を一つの経験（episode）として残し、条件が揃った経験から検索用の教訓候補を作ります。既存の終了後要約に構造化抽出を加え、検索本文は従来の `entries` に保存します。
+一つの Kiokuko run の確定した実行区間を一つの経験（episode）として残し、条件が揃った経験から検索用の教訓候補を作ります。明示的な再開やセッション間の引き継ぎでは `source_epoch` で区間を区別し、過去の経験も保持します。既存の終了後要約に構造化抽出を加え、検索本文は従来の `entries` に保存します。
 
 **初期設定の `active` では、根拠が有効な episode 概要・教訓・失敗回避策を検索と自動注入に使います。** 新しいセッションでも同じ workspace の候補を参照できます。全候補は未検証のまま扱い、独立した支持・証拠・revision の検査を満たす必要があります。実モデルでの改善率は未測定です。評価結果の有無によって設定を強制的に `observe` へ変換する処理はありません。
 
@@ -28,16 +28,16 @@ DSH の Kiokuko プラグイン設定に追加します。設定変更後は DSH
 
 状態表示は、要求／実効モード、episode 数、生成ジョブの待機・処理中・完了・保留・失敗、見送り理由、追加呼び出し数、報告された token 使用量、生成時間を含みます。未報告の使用量はゼロ扱いしません。状態表示とジョブの失敗理由には候補本文・モデルのエラーメッセージ・秘密情報を出しません。
 
-上限は引き下げ可能です。1 run あたり追加呼び出し1回、UTC 日付単位で workspace あたり8回、入力6 episode / 32 KiB、出力2,048 tokens、60秒、ホスト内同時実行1件を超えません。モデルは終了後要約の provider / model を保持し、代替モデルへ切り替えません。コンテキスト容量が不明、または容量内で支持条件を満たせなければ保留します。
+上限は引き下げ可能です。1 run の1 source epoch あたり追加呼び出し1回、全世代を合算して UTC 日付単位で workspace あたり8回、入力6 episode / 32 KiB、出力2,048 tokens、60秒、ホスト内同時実行1件を超えません。モデルは終了後要約の provider / model を保持し、代替モデルへ切り替えません。コンテキスト容量が不明、または容量内で支持条件を満たせなければ保留します。
 
 ## 抽出と採用条件
 
-- 対象は `completed` と、native checkpoint 後の開始・終了 seq が確定した `failed`。`cancelled` / `interrupted` は対象外です。failed の範囲が欠けるときは理由を残して見送ります。
+- 対象は通常の `completed` / `failed` と、停止確認が保存された明示 wait / ignore、および明示再開・引き継ぎで閉じた source 区間です。native checkpoint 後の開始・終了 seq と所有セッションが確定した区間だけを扱います。完了・失敗・中止・中断の outcome を区間ごとに保持し、範囲が欠けるときは理由を残して見送ります。中止・中断を成功として記録しません。単に native run が `cancelled` になった全ケースを自動採用するものではありません。
 - capsule v2 は通常記憶と episode を同じ要約呼び出しで返します。全体64 KiB、重要な出来事は最大6件です。既存の v1 ジョブは v1 のまま処理します。episode だけが不正なら、通常記憶の保存は続行します。
 - 証拠は対象 run の native ログからホストが提示した seq のみに限定します。ツール結果は同じ範囲内の call ID と結び付けます。plugin 由来メッセージ、記憶・制御ツール、assistant の成功宣言を根拠にしません。
 - 成功の判定には、操作後に観測されたツール結果の明示的な数値 `exitCode` / `exit_code = 0` が必要です。標準 bash のように表示本文へ終了コードを出さないツールでは、ホストが最終 `tools/result` の構造化値を読み、本文を含まない観測記録を Kiokuko の SQLite に保存します。独自イベントは native ログに追加しません。run・workspace・session・call seq・最終表示内容 hash を照合し、timeout / abort を成功扱いしません。汎用の自然言語出力だけのツールは成功未確認になります。ツールごとの結果形式を広げる場合は、その native 形式を固定したテストを追加してください。
 - 永続化する証拠は seq・種類・結果区分・正規化内容 hash です。観測本文は抽出時だけ使い、別の詳細ログとして複製しません。構造化 episode と短い検索概要は残ります。
-- signature は workspace とエラー・ツール・対象・バージョンの正規化値で決定します。`unknown` を含むものは教訓生成へ進めません。同じ run、同一 session の重複範囲、同じ正規化根拠は独立した支持に数えません。
+- signature は workspace とエラー・ツール・対象・バージョンの正規化値で決定します。`unknown` を含むものは教訓生成へ進めません。同じ run の複数世代、同一 session の重複範囲、同じ正規化根拠は独立した支持に数えません。同じ run では有効な最新世代を使います。
 - 通常の教訓には独立した3 episode と、うち2件以上の観測された成功が必要です。生成を予約した後は、新しい独立 episode がさらに3件増えるまで再生成しません。
 - 失敗回避策には具体的な発生条件・避ける操作・観測済みの代替または診断手順・確認方法が必要です。具体的なユーザー訂正、または失敗→代替操作→再検証の順序が揃えば1 episode から採用可能です。それ以外は独立した失敗2件以上が必要です。
 
@@ -47,13 +47,13 @@ DSH の Kiokuko プラグイン設定に追加します。設定変更後は DSH
 
 ## 永続化・復旧・検索
 
-migration 012 だけを追加しています。過去の migration や entry を書き換えず、既存データの一括再要約もしません。episode、派生 revision の出典、生成ジョブ、呼び出し予算を既存 SQLite に保持します。
+episode、派生 revision の出典、生成ジョブ、呼び出し予算を既存 SQLite に保持します。migration 042 は既存の episode・関連 entry・ジョブ・呼び出し・見送り記録を source epoch 1 として保持し、後続世代と共存できる複合キーへ移行します。保存済み JSON・派生 manifest・呼び出し実績は書き換えず、既存データの一括再要約もしません。忘却した元記憶を含む世代の本文と staged 要約は消去し、その処理を再採用できないよう claim を失効させます。
 
 派生 revision は、元 entry の revision / 内容 hash、episode、アルゴリズム版と結び付きます。元記憶や episode 概要の変更・削除・supersede、該当 revision の `stale` / `conflicting` feedback により、派生記憶は検索時に不適格になります。設定と適格性は context の状態 hash に含め、選択後の変更も注入前に検出します。
 
 生成は通常の記憶保存がコミットした後に実行する別ジョブです。モデル呼び出しは transaction の外、予算予約と採用は transaction の中で行います。採用直前に claim token・attempt・有効期限・設定世代・根拠 revision を再確認します。
 
-一つのジョブは最大2回 claim できますが、**既に送信したモデル要求は再送しません**。送信後のクラッシュや timeout では結果が不明になり得るため、1 run あたり1呼び出しという上限を優先して保留／失敗にします。未送信の期限切れ claim は再取得できます。応答が遅れて戻っても、期限切れや設定変更後に候補を保存しません。
+一つのジョブは最大2回 claim できますが、**既に送信したモデル要求は再送しません**。送信後のクラッシュや timeout では結果が不明になり得るため、1 run の1 source epoch あたり1呼び出しという上限を優先して保留／失敗にします。未送信の期限切れ claim は再取得できます。応答が遅れて戻っても、期限切れや設定変更後に候補を保存しません。
 
 字句検索・意味検索・連合検索・自動注入は同じ派生記憶の適格性判定を使います。検索時の追加 LLM 呼び出しはありません。自動注入は同じ episode 由来を原則2件までにし、空いた枠は他の経験で埋めます。同じ根拠の教訓と episode 概要が両方ヒットした場合は、教訓を残して概要の重複を省きます。概要が先に枠を埋めて教訓を排除しないための処理で、支持数による検索スコアの加点は行いません。完全一致の識別子検索と通常の明示検索にはこの件数制限を適用しません。
 

package/docs/owned-execution.md

@@ -51,8 +51,8 @@ be reconstructed from a model's success report. After restart, saved receipts re
 Register conditions and source/test/configuration paths with `task_completion`
 before running the check. Memory application reviews may specify a repository-relative `cwd`; omitted values retain the historical repository-root meaning. Actual directory, command, source digest, run and generation must match. Owned shell and Lisp process calls feed the existing
 completion and memory-application records. Exit zero alone does not establish
-test success: complete Node TAP and Cargo harness summaries distinguish passed,
-failed, cancelled, ignored/skipped, filtered and zero/incomplete test runs.
+test success: complete Node TAP summaries distinguish passed, failed, cancelled,
+skipped/todo and zero/incomplete test runs.
 Include every relevant input in the registered source set.
 
 Finalization receives structured observations and source-bound checks. Candidate
@@ -84,7 +84,7 @@ plan does not exit it.
 ```sh
 npm run typecheck
 KIOKUKO_REQUIRE_DSH_NATIVE=1 KIOKUKO_DSH_PACKAGE_ROOT="$PWD/tests/fixtures/dsh-runtime/node_modules" node scripts/run-tests.mjs tests/dsh/integration/owned-native-lifecycle.test.ts
-KIOKUKO_REQUIRE_CARGO_RUNTIME=1 node scripts/run-tests.mjs tests/dsh/integration/owned-execution.test.ts
+node scripts/run-tests.mjs tests/dsh/integration/owned-execution.test.ts
 KIOKUKO_REQUIRE_LISP_RUNTIME=1 KIOKUKO_DSH_PACKAGE_ROOT="$PWD/tests/fixtures/dsh-runtime/node_modules" npm run test:lisp
 npm run build
 npm run test:skill-delivery

package/docs/replay-memory-review.md

@@ -0,0 +1,26 @@
+# Optional replay memory review
+
+Memory lookup and saving never authorize tools or block ordinary work or task completion. Native permissions, current task evidence, explicit Stop, and durable user holds remain authoritative. Ordinary native work does not need a Goal or a memory-preparation call.
+
+## Save a completed experience
+
+1. Finish the actual task. For unowned native work, the completed final response triggers a question asking whether the request is finished and whether to organize its experience. Failed owned tasks may also offer review; cancelled work does not.
+2. Choose whether to organize. Declining performs no replay extraction and creates no derived memory.
+3. Review the full, ephemeral JSON proposal, including request, languages, commands, results, key points, tags, keywords, source references and coverage gaps.
+4. Approve the exact shown revision to save it. Comments create a revised preview requiring another approval. Declining saves nothing. A new request, native Stop, changed task generation or shutdown invalidates pending approval.
+
+Recorded tool payloads/results are read with exact call identities and source hashes. Missing or truncated evidence remains unknown. A successful process exit is an observed command result, not proof that the overall task is correct. Secrets are redacted on a best-effort basis; uncaptured reasoning is not reconstructed. Replay capture must be available for source-backed organization.
+
+## Recall and maintenance
+
+`memory_context` searches approved SQLite memories with request-derived keywords and optional tags. Automatic contextual lookup is bounded and advisory. Stored content is untrusted reference data, never executable instructions or permission.
+
+`memory_review_status` only reconciles uncertain saves whose exact approval remains in this process's bounded in-memory cache. It cannot approve or retry a write. Restart does not revive an unapproved draft or an unresolved save.
+
+`/kioku-memory explain ENTRY_ID` inspects indexed evidence. `/kioku-memory forget ENTRY_ID --revision N` removes the approved memory and its replay projection, including dependent indexed content; original native logs, external copies and backups remain. These native commands use the current project without requiring Goal enrollment.
+
+## Legacy compatibility
+
+Automatic observation, finalization, evolution, semantic index derivation and globalization no longer create new memories. Old configuration flags do not re-enable them. Legacy model-facing review/checkpoint calls are non-writing compatibility responses. Existing memories and historical proof records remain available for inspection; their missing or stale application status cannot veto native execution or completion.
+
+The full preview is transported through native user questions. Very large previews may be difficult to inspect in a particular browser or TUI; presentation at the maximum proposal size is not verified by the source-level and native transport tests.

package/docs/semantic-compaction.md

@@ -31,6 +31,8 @@ semanticCompaction:
 
 Successful native `read`, `glob`, `grep` and foreground `bash` results containing a single plain text block larger than 10 KiB remain full for two completed native model calls after their result event. Failed attempts and interrupted assistant messages do not count. Before a later request, packing replaces the display with its original byte count, digest, stable session-bound handle and complete head/tail lines totaling at most 1 KiB. The envelope adds metadata beyond that excerpt budget. ObservationPack makes no Jev call.
 
+If no complete source line fits that excerpt, the result stays full: no new pack or automatic read-back is created. Existing v1 packs with empty excerpts remain readable and can still be restored. This preserves source material rather than promising savings for oversized single lines.
+
 Failures, unknown success, background execution, Lisp and execution-control results are excluded. Bash additionally requires a captured structured foreground exit status of zero, without interruption or sandbox failure, and an exact match to the logged presentation. `isError: false` alone is insufficient. After reload, Bash results without that live proof remain untouched.
 
 The auxiliary native tool is separate from Enno business operations:

package/guardrail/aarch64-apple-darwin/manifest.json

@@ -0,0 +1,71 @@
+{
+  "artifacts": {
+    "README.md": {
+      "bytes": 10748,
+      "sha256": "4b5d7c785121c865945f6379de31565c6aa9218f9d4333519ce3d450e85d0c55"
+    },
+    "bin/kiokuko-guardrail": {
+      "bytes": 384672,
+      "sha256": "c60cb16daa7a536d876017da01815fce3719bae16fc6cd42ea74df04f3e53af4"
+    },
+    "protocols/coding-routine.lisp": {
+      "bytes": 948,
+      "sha256": "82b56af81d12a8cab8352b0825c913f00f73708b2339a9b567cc6f4d4e52da49"
+    }
+  },
+  "build_inputs": {
+    "cargo_sha256": "e951141cc55a6cd7b9876d187bd30a3720e6086b99413af95e3b8de1cdd72f14",
+    "cargo_version": "cargo 1.99.0 (5f94df478 2026-08-27)",
+    "command": [
+      "env",
+      "SOURCE_DATE_EPOCH=0",
+      "MACOSX_DEPLOYMENT_TARGET=13.0",
+      "LD_LIBRARY_PATH=RUST_TOOLCHAIN/lib",
+      "RUSTFLAGS=--remap-path-prefix=SOURCE=kiokuko-guardrail --remap-path-prefix=TEMP=build",
+      "LINKER=zig-0.17.0-cc-strip-target-aarch64-macos.13.0.0",
+      "cargo",
+      "build",
+      "--manifest-path",
+      "Cargo.toml",
+      "--locked",
+      "--offline",
+      "--release",
+      "--target",
+      "aarch64-apple-darwin"
+    ],
+    "rustc_sha256": "f3834d26669b03f6855fa54bd2381443123e860167bc0c7a8dd137e5cf6e5e4f",
+    "rustc_version": "rustc 1.99.0 (b940084d7 2026-09-28)\nbinary: rustc\ncommit-hash: b940084d7eb6a299eb4bfeb8e34901bc051e7ac4\ncommit-date: 2026-09-28\nhost: x86_64-unknown-linux-gnu\nrelease: 1.99.0\nLLVM version: 23.1.1",
+    "source_date_epoch": 0,
+    "target": "aarch64-apple-darwin"
+  },
+  "package": "kiokuko-guardrail",
+  "schema": 1,
+  "scope": "Declared source/compiler/build inputs and artifact identity. This is not a signature, sandbox, or a claim of deterministic model inference or identical binaries across target operating systems.",
+  "source_sha256": "c835782d88444f03f9bce01106b75b9c071fa18543d51e7fcb754f403ba6deab",
+  "sources": {
+    "BOOTSTRAP.md": "b9d0db4c38561d6173e2396bfca979743c66fe64dc15f8c10931d5ae02800a95",
+    "Cargo.lock": "16f51b3ffc20349a69b4b580ea59d2354c9d496911c7e530509492d9b46ecb3a",
+    "Cargo.toml": "1cc0b8df18413f925841e6acddfe14a49f7e8dd4236660eb9d822f1ccdcc9d4e",
+    "README.md": "4b5d7c785121c865945f6379de31565c6aa9218f9d4333519ce3d450e85d0c55",
+    "examples/coding-routine.lisp": "82b56af81d12a8cab8352b0825c913f00f73708b2339a9b567cc6f4d4e52da49",
+    "scripts/package.py": "159b8cdda58b422a60aee95554eb0febc3b520d7ef5d5a4bac1cdd046a514e16",
+    "scripts/test.py": "d8ed547d0943f8b23838b146c6e1d31ad9004c525868d19a2fffafef67e6b6c9",
+    "src/digest.rs": "a46aa8ac0ba3f8e29e268a495723b6d49a4741399bb595c34a3d021dc295c800",
+    "src/eval.rs": "7742caeeac426783647363242d93845369c018b00528312573f1cdc668c22ec3",
+    "src/host.rs": "de9f34ad6ce8246e6f80cbf3d4f56bb07ed8043b17232135755a5e3ee5602cf5",
+    "src/lib.rs": "2f591de0e7520a313da9668491da106d904bb19ef2384c717e87cd06bac665a3",
+    "src/main.rs": "16a3a42d8338ca20e66173648c0a407b24724eeb1a4b3710c8a3b90b5aade10f",
+    "src/protocol.rs": "d9009f5977707141f3547902a07f2f2c5455e4b9516b01a9ba4eb22a82af2a39",
+    "src/reader.rs": "7bc1ff7aece72fc44ac43d5a207a3c8f2fd009eae41cb4b4dadb4eb9436d15f3",
+    "tests/cli.rs": "22955ba315007b4a18409b31439345eb84ce0a62b88658cf440d513b10811357",
+    "tests/digest.rs": "63a3a1b4963ef03260cae4ff9bfeed3596a445dc8df74ecc91b5750d3a6fa28d",
+    "tests/edge_contract.rs": "4f9c7b068db44e9beceb811ceac4a5e8d6cf7cda51eee5a2449f29ab0fa6ade9",
+    "tests/evaluator.rs": "a09c811494615b01e19ccef78491b8bbfee07fede8dcbee59f384fe59e145401",
+    "tests/packaging.rs": "61ae1bfed0d4f31748ce2af58953387045f4231370d46cb809f26e93aea1e033",
+    "tests/protocol.rs": "8f6b7ad5842f5b596efe8da01bba84f39fcd8d6426fde6932cb2a5cbb44d589f",
+    "tests/reader.rs": "249092f56768a6511dbb15825be55f4cf0105269cb9dba1d6f8169ff66d44ab5",
+    "tests/robustness.rs": "464c26addcf5188128d2e6eedd97cccccdb82ada0bc94a0648b77c8043118ba9"
+  },
+  "target": "aarch64-apple-darwin",
+  "version": "0.1.0"
+}