omnius 1.0.591 → 1.0.592

package/docs/reference/auth-map.md

@@ -1,229 +1,120 @@
-# Auth Map — Where Authentication/Authorization is Handled Across Omnius
+# Authentication And Authorization Map
 
-> Auto-generated from codebase scan. Covers all packages and apps.
+Omnius has two separate credential boundaries:
 
-## Summary
+1. provider credentials authenticate Omnius to an inference provider; and
+2. REST bearer credentials authenticate a caller to the Omnius daemon.
 
-Omnius has **no centralized auth system** (no login, no JWT, no session cookies, no OAuth). Authentication is handled **peripherally** in three ways:
+Do not reuse one boundary as the other in new deployments.
 
-1. **External provider auth** — API keys/tokens for remote inference providers (OpenAI, Anthropic, etc.)
-2. **Secret redaction** — preventing credential leaks in logs/tool output
-3. **Session-scoped permissions** — internal permission rules for sub-agent handoffs
+## Provider Credentials
 
-There is **zero auth on the REST daemon** (`apps/api`) — all routes are open.
+Upstream inference credentials resolve in this exact order:
 
----
-
-## 1. apps/api (REST Daemon) — NO AUTH
-
-| File | Finding |
-|------|---------|
-| `apps/api/src/app.ts` | Helmet, CORS, compression, morgan. **No auth middleware, no API key check, no bearer validation.** |
-| `apps/api/src/routes/sessions.ts` | In-memory Map-based session store. **No auth on any route** (POST/GET/DELETE all accept unauthenticated requests). |
-| `apps/api/src/routes/health.ts` | Health check — no auth needed. |
-| `apps/api/src/middleware/error-handler.ts` | Error handling only. |
-
-**Verdict:** The REST daemon is completely open. Any caller can create sessions, send messages, list/delete sessions.
-
----
-
-## 2. apps/worker (Background Worker) — NO AUTH
-
-| File | Finding |
-|------|---------|
-| `apps/worker/src/queue.ts` | Only references `sessionId: string` in queue job types. No auth logic. |
-
-**Verdict:** Worker processes tasks from the queue without auth checks. Trusts the API daemon to route correctly.
-
----
-
-## 3. packages/cli — Provider Auth + Secret Redaction
-
-### 3a. Provider API Key Configuration
-
-| File | Line | Finding |
-|------|------|---------|
-| `packages/cli/src/config.ts` | 32 | `/** Optional Bearer token for authenticated vLLM deployments */` — config field for vLLM auth |
-| `packages/cli/src/config.ts` | 50 | Tool-calling session opt-in logic (not auth, but session-scoped) |
-
-### 3b. Secret Redaction (preventing credential leaks)
-
-| File | Finding |
-|------|---------|
-| `packages/cli/src/redact/secret-redactor.ts` | Comprehensive regex-based secret redactor. Detects and masks: |
-| | - Known API key prefixes: `sk-`, `sk-or-`, `gsk_`, `fw_`, `cpk_`, `csk-`, `nvapi-`, `xox[baprs]-`, `hf_`, `r8_`, `npm_`, `pypi-`, `gAAAA` |
-| | - Generic patterns: `api_key`, `token`, `secret`, `password`, `access_token`, `refresh_token`, `auth_token`, `bearer` |
-| | - Short tokens (<18 chars) → fully masked (`***`). Longer → partial (`sk-..yKey`) |
-
-### 3c. Session State
-
-| File | Finding |
-|------|---------|
-| `packages/cli/src/state/store.ts` | `closeSession(sessionId, endReason)` — session lifecycle management. Token counting (input/output/cache_read/cache_write/reasoning). No auth. |
-
----
-
-## 4. packages/backend-vllm — Provider Auth (API Keys)
-
-### 4a. Provider Auth Configuration
-
-| File | Line | Provider | authRequired | keyPrefix |
-|------|------|----------|-------------|-----------|
-| `packages/backend-vllm/src/normalizeUrl.ts` | 81 | Anthropic | true | `sk-ant-` |
-| `packages/backend-vllm/src/normalizeUrl.ts` | 85 | OpenAI | true | `sk-` |
-| `packages/backend-vllm/src/normalizeUrl.ts` | 89 | Together AI | true | — |
-| `packages/backend-vllm/src/normalizeUrl.ts` | 93 | Groq | true | `gsk_` |
-| `packages/backend-vllm/src/normalizeUrl.ts` | 97 | OpenRouter | true | `sk-or-` |
-| `packages/backend-vllm/src/normalizeUrl.ts` | 101 | Fireworks AI | true | `fw_` |
-| `packages/backend-vllm/src/normalizeUrl.ts` | 105 | DeepInfra | true | — |
-| `packages/backend-vllm/src/normalizeUrl.ts` | 109 | Mistral AI | true | — |
-| `packages/backend-vllm/src/normalizeUrl.ts` | 113 | Chutes AI | true | `cpk_` |
-| `packages/backend-vllm/src/normalizeUrl.ts` | 117 | Cerebras | true | `csk-` |
-| `packages/backend-vllm/src/normalizeUrl.ts` | 121 | SambaNova | true | — |
-| `packages/backend-vllm/src/normalizeUrl.ts` | 125 | NVIDIA NIM | true | `nvapi-` |
-| `packages/backend-vllm/src/normalizeUrl.ts` | 129 | Hyperbolic | true | — |
-| `packages/backend-vllm/src/normalizeUrl.ts` | 134 | Ollama (local) | **false** | — |
-
-### 4b. Runtime Auth Headers
-
-| File | Line | Finding |
-|------|------|---------|
-| `packages/backend-vllm/src/VllmBackend.ts` | 217 | `private authHeaders(): Record<string, string>` — builds auth headers for vLLM requests |
-| `packages/backend-vllm/src/VllmBackend.ts` | 237 | Uses `authHeaders()` in fetch calls |
-
-**Verdict:** Provider auth is key-based (Bearer tokens). No OAuth flow. Keys are configured in CLI config and passed as headers.
-
----
-
-## 5. packages/orchestrator — Session-Scoped Permissions
-
-### 5a. Permission Ruleset (sub-agent authorization)
-
-| File | Finding |
-|------|---------|
-| `packages/orchestrator/src/permissionRuleset.ts` | **The only authorization logic in the codebase.** Implements: |
-| | - Parent session deny rules (cascade to sub-agents) |
-| | - Parent agent deny rules |
-| | - External directory rules forwarded to sub-agent sessions |
-| | - "Forwarding pattern" — parent agent denies + parent session denies + external_directory rules cascade |
-
-### 5b. Session Metrics
-
-| File | Finding |
-|------|---------|
-| `packages/orchestrator/src/sessionMetrics.ts` | Tracks `sessionDurationMs`, token usage, context estimates. No auth. |
-
-### 5c. Adversarial Handoffs (test data only)
-
-| File | Finding |
-|------|---------|
-| `packages/orchestrator/src/adversarialHandoffs.ts` | Contains test scenarios referencing logout/session cleanup (lines 324-369). These are **test fixtures**, not production auth code. |
+```text
+OMNIUS_PROVIDER_API_KEY
+  → OMNIUS_MODEL_API_KEY
+  → OMNIUS_UPSTREAM_API_KEY
+  → OMNIUS_API_KEY
+  → VLLM_API_KEY
+  → persisted endpoint configuration
+```
 
----
+The first defined value wins. `OMNIUS_API_KEY` is retained as a legacy
+provider and REST fallback; prefer the explicit provider namespace.
 
-## 6. packages/execution — Session Key Reservation + Secret Detection
+The resolved value is applied according to the registered provider protocol:
 
-### 6a. Model Broker (session key reservation)
+| Protocol/provider | Authentication |
+| --- | --- |
+| `ollama` | none by default |
+| local `openai-chat` | optional `Authorization: Bearer` |
+| cloud `openai-chat` | `Authorization: Bearer <provider-key>` |
+| Gemini | Bearer plus `x-goog-api-client: omnius/<version>` |
+| `anthropic-messages` | `x-api-key: <provider-key>` plus `anthropic-version` |
+| sponsor/COHERE | peer/session policy; upstream secrets stay provider-side |
 
-| File | Line | Finding |
-|------|------|---------|
-| `packages/execution/src/model-broker.ts` | 205-207 | `sessionKey?: string` — reserved per-chat session key for guaranteed slots |
-| `packages/execution/src/model-broker.ts` | 361-362 | `_reservedBySession: Map<string, string>` — reserved slots per sessionKey |
-| `packages/execution/src/model-broker.ts` | 1271-1277 | Reserved slot path: per-session, one outstanding slot per sessionKey |
+Provider credentials must never appear in endpoint URLs, discovery documents,
+logs, process output, sponsor metadata, or client-visible errors.
 
-### 6b. Secret Detector (MCP)
+## REST Daemon Credentials
 
-| File | Finding |
-|------|---------|
-| `packages/execution/src/mcp/secret-detector.ts` | `matchType: "auth-header"` — detects auth header prefixes in strings. Sensitive field name tracking. |
+Preferred environment variables:
 
----
+```text
+OMNIUS_REST_API_KEY
+OMNIUS_REST_API_KEYS
+```
 
-## 7. packages/indexer — Auth Domain Classification (metadata only)
+Compatibility variables:
 
-| File | Line | Finding |
-|------|------|---------|
-| `packages/indexer/src/fileSummarizer.ts` | 30 | `ownershipArea` field: "Logical ownership area (e.g. 'auth', 'api', 'db', 'frontend')" |
-| `packages/indexer/src/fileSummarizer.ts` | 54 | Path regex: `/\/(auth|authentication|login|session|jwt|oauth|passport)/` → classifies as "auth" domain |
-| `packages/indexer/src/fileSummarizer.ts` | 80 | Domain keyword `/auth/i` in file content |
-| `packages/indexer/src/fileSummarizer.ts` | 119 | `if (domain === "auth") return "high"` — auth domain files get high priority |
+```text
+OMNIUS_API_KEY
+OMNIUS_API_KEYS
+```
 
-**Verdict:** The indexer classifies files as "auth" domain for indexing priority, but this is metadata, not auth enforcement.
+Multi-key format:
 
----
+```text
+key:scope:owner:rpm:tpd:max_jobs
+```
 
-## 8. packages/memory — Session-Scoped Memory
+The daemon also accepts persistent runtime keys stored under
+`~/.omnius/keys.json` by default and a local bootstrap key under
+`~/.omnius/api.key`. Runtime keys are minted, listed in masked form, and
+revoked through `/v1/keys`.
 
-| File | Finding |
-|------|---------|
-| `packages/memory/src/selfModel.ts` | `DECAY_CLASSES: ["session", "daily", "procedural", "permanent"]` — session-scoped memory decay |
-| `packages/memory/src/toolOutcomes.ts` | `Reset (e.g., on session start before restoring from store)` |
-| `packages/memory/src/predictionStore.ts` | `tokenSimilarity()` — token-based string comparison (not auth tokens) |
+Send daemon credentials only in:
 
----
+```text
+Authorization: Bearer <key>
+```
 
-## 9. packages/schemas — Session Schema
+Query-string credentials are rejected because URLs leak into browser history,
+logs, and telemetry.
 
-| File | Finding |
-|------|---------|
-| `packages/schemas/src/messages.ts` | `sessionId: z.string().uuid()` — session ID schema |
-| `packages/schemas/src/index.ts` | `export { SessionSchema, type Session }` |
-| `packages/schemas/src/memory.ts` | `ownershipArea` field: "Logical ownership area (e.g. 'auth', 'api', 'db', 'frontend')" |
+## Scopes
 
----
+| Scope | Typical authority |
+| --- | --- |
+| `read` | health/version, discovery, models, config summaries, tools/skills metadata, memory search, usage, events |
+| `run` | chat, runs, permitted tool calls, allowed memory writes |
+| `admin` | config/key/profile mutation, high-risk controls, admin tools |
 
-## 10. packages/retrieval — No Auth
+Scope is necessary but not sufficient for a tool call. Tool security metadata,
+the selected profile, request origin, off-device policy, network policy, and
+risk classification are enforced after bearer authentication.
 
-| File | Finding |
-|------|---------|
-| `packages/retrieval/src/semanticSearch.ts` | "auth" appears only as an example query term: `Example: "auth middleware +api -test ~service"` |
-| `packages/retrieval/src/snippetPacker.ts` | Token budget logic (not auth tokens) |
+## Profiles And External Tools
 
----
+Runtime keys may bind a named tool profile. A run key with a bookkeeping
+profile can update todos and notes without receiving filesystem, shell, or
+network tools.
 
-## 11. packages/prompts — No Auth
+HTTP- and MCP-backed external tools use the same daemon auth, policy, audit,
+and direct-call metadata as built-in tools. Registration requires run scope
+locally and admin scope for remote callers.
 
-No auth-related code found.
+## Routes Without Work Authority
 
----
+Health, version, help, OpenAPI, and discovery remain accessible for
+compatibility diagnosis according to daemon binding/auth configuration.
+Reading capability metadata does not grant authority to execute it.
 
-## Consolidated Auth Architecture
+The optional `X-Omnius-Min-Version` header is a package compatibility
+precondition, not authentication. A valid bearer key does not bypass a stale
+service rejection, and satisfying the version gate does not grant a scope.
 
-```
-┌─────────────────────────────────────────────────────────────────┐
-│                     AUTH IN OMNIUS                              │
-│                                                                 │
-│  1. PROVIDER AUTH (API Keys)                                   │
-│     ├── CLI config → bearer tokens for remote providers        │
-│     ├── backend-vllm → authHeaders() for vLLM requests         │
-│     ├── 14 remote providers configured (all require API keys)  │
-│     └── Ollama (local) → no auth required                     │
-│                                                                 │
-│  2. SECRET REDACTION                                             │
-│     ├── CLI secret-redactor.ts — regex-based masking           │
-│     ├── MCP secret-detector.ts — auth header detection         │
-│     └── Covers: sk-, gsk_, hf_, npm_, pypi-, etc.            │
-│                                                                 │
-│  3. SESSION-SCOPED PERMISSIONS (internal)                       │
-│     ├── orchestrator/permissionRuleset.ts — deny cascade       │
-│     ├── execution/model-broker.ts — sessionKey slot reservation│
-│     └── memory/selfModel.ts — session-scoped decay             │
-│                                                                 │
-│  4. REST DAEMON — NO AUTH                                       │
-│     ├── apps/api — helmet + cors only                          │
-│     ├── sessionsRouter — in-memory, no auth                    │
-│     └── healthRouter — open                                    │
-│                                                                 │
-│  5. WORKER — NO AUTH                                            │
-│     └── Trusts API daemon for routing                          │
-└─────────────────────────────────────────────────────────────────┘
-```
+## Network Deployment Rules
 
-## Key Gaps
+- Keep the default loopback binding for personal use.
+- Require scoped bearer keys before binding to LAN or public interfaces.
+- Put internet-facing daemons behind TLS and a narrow reverse-proxy allowlist.
+- Use a distinct key and narrow tool profile for each agent/service.
+- Strip REST key variables before spawning model-facing subprocesses.
+- Redact provider and REST credentials before sending context to remote
+  inference, sponsor, COHERE, Telegram, or MCP peers.
 
-1. **REST daemon has zero authentication** — anyone can create sessions, send messages, and read responses
-2. **No OAuth flows** — all provider auth is static API keys
-3. **No rate limiting** — no rate-limit middleware in the API
-4. **No CSRF protection** — CORS is enabled but no CSRF tokens
-5. **No session validation** — sessions are in-memory Map, no persistence or validation
-6. **No admin/auth endpoints** — no login, logout, or user management
+See [Auth And Scopes](../rest/auth-and-scopes.md) for request examples and
+[Security And Remote Access](../operations/security-and-remote-access.md) for
+deployment hardening.

package/docs/reference/configuration.md

@@ -11,6 +11,7 @@ Configuration is layered from environment, global user settings, project setting
 | `OMNIUS_REST_API_KEYS` | Multi-key REST auth: `key:scope:owner:rpm:tpd:max_jobs` |
 | `OMNIUS_PROVIDER_API_KEY` | Upstream model-provider bearer token |
 | `OMNIUS_MODEL_API_KEY` | Alternate upstream model-provider bearer token |
+| `OMNIUS_UPSTREAM_API_KEY` | Compatibility upstream provider token |
 | `OMNIUS_API_KEY` | Legacy fallback for provider auth and legacy REST auth |
 | `OMNIUS_API_KEYS` | Legacy multi-key REST auth |
 | `OMNIUS_ACCESS` | Network access policy for the daemon |
@@ -18,6 +19,32 @@ Configuration is layered from environment, global user settings, project setting
 | `OMNIUS_FORCE_NO_THINK` | Force `think: false` for Qwen-style backends |
 | `OMNIUS_THINK_AUTO` | Enable opt-in automatic thinking mode trigger |
 
+## Provider Key Precedence
+
+For an upstream inference request, Omnius resolves one credential in this
+exact order:
+
+```text
+OMNIUS_PROVIDER_API_KEY
+  → OMNIUS_MODEL_API_KEY
+  → OMNIUS_UPSTREAM_API_KEY
+  → OMNIUS_API_KEY
+  → VLLM_API_KEY
+  → persisted endpoint configuration
+```
+
+The first defined value wins. `OMNIUS_REST_API_KEY` and
+`OMNIUS_REST_API_KEYS` authenticate callers to the Omnius daemon; they are not
+upstream provider credentials.
+
+## Provider Protocol
+
+Known provider presets select one of `ollama`, `openai-chat`, or
+`anthropic-messages`. Custom endpoint configuration must include an explicit
+protocol. If a legacy endpoint can be identified unambiguously from its known
+provider or saved backend type, Omnius migrates it; otherwise the endpoint
+remains saved but disabled until a protocol is selected.
+
 ## Runtime State
 
 Project runtime state:

package/docs/reference/rest-api.md

@@ -37,6 +37,13 @@ pnpm docs:check
 | `GET` | `/v1/cost` | Cost tracker |
 | `GET` | `/v1/system` | CPU, RAM, GPU, and system snapshot |
 
+## Discovery
+
+| Method | Path | Purpose |
+| --- | --- | --- |
+| `GET` | `/v1/discovery` | Search or list the capability catalog |
+| `GET` | `/v1/discovery/{id}` | Expand one stable capability entry |
+
 ## Inference And Chat
 
 | Method | Path | Purpose |

package/docs/reference/slash-commands.md

@@ -14,13 +14,13 @@ Command metadata drives the TUI, REST command proxy, gateway exposure, and agent
 
 | Category | Commands |
 | --- | ---: |
-| Core | 26 |
+| Core | 30 |
 | Models And Endpoints | 2 |
 | Sessions And Control | 14 |
 | Runtime | 12 |
 | Media | 11 |
 | Network And P2P | 10 |
-| Memory And Context | 1 |
+| Memory And Context | 3 |
 | Tools And Skills | 6 |
 | External Gateways | 2 |
 | Secrets | 2 |
@@ -48,6 +48,26 @@ Signatures:
 
 - `/bruteforce` - Toggle brute-force mode (auto re-engage on turn limit)
 
+### /camera
+
+Open compact camera preset menu shared with /live
+
+| Field | Value |
+| --- | --- |
+| Category | Core |
+| Status | implemented |
+| Surfaces | tui, rest, gateway, agentTool |
+| Safety | none |
+| Aliases | - |
+| Args | - |
+| Subcommands | status |
+
+Signatures:
+
+- `/camera` - Open compact camera preset menu shared with /live
+- `/camera status` - Show selected camera and per-device presets
+- `/camera select\|preview\|resolution\|fps\|rotate` - Manage camera source, preview, resolution, FPS, and orientation
+
 ### /clear
 
 Clear the screen
@@ -298,6 +318,54 @@ Signatures:
 
 - `/insights` - Show historical session insights
 
+### /live
+
+Open live sensor stream menu for video/audio context
+
+| Field | Value |
+| --- | --- |
+| Category | Core |
+| Status | implemented |
+| Surfaces | tui, rest, gateway, agentTool |
+| Safety | none |
+| Aliases | - |
+| Args | - |
+| Subcommands | status, run, chat, camera, resolution, fps, rotate, infer, clip, stop |
+
+Signatures:
+
+- `/live` - Open live sensor stream menu for video/audio context
+- `/live status` - Show live sensor devices, selected streams, and latest snapshot
+- `/live run [agent]` - Start low-latency video/audio feedback; agent enables background PFC review
+- `/live chat` - Start low-latency voicechat with live audio/video context and async agent review
+- `/live camera <device>` - Select a camera and render an ASCII preview
+- `/live resolution [camera] 720p\|1080p\|1440p\|4k\|native` - Set per-camera live stream resolution (default 1080p)
+- `/live fps [camera] 1\|2\|4\|8\|12\|15\|24\|30` - Set per-camera live stream FPS (default 8)
+- `/live camera-on\|camera-off [camera]` - Enable or disable an individual live camera stream
+- `/live rotate auto\|cw\|ccw\|180\|none [camera]` - Detect or set persistent camera orientation correction
+- `/live infer [now\|on\|off]` - Toggle or run camera object/location inference
+- `/live clip [on\|off]` - Toggle CLIP visual-memory recognition on live frames
+- `/live audio\|asr\|sounds on\|off` - Toggle live audio context streams
+- `/live stop` - Disable all live sensor streams
+
+### /livechat
+
+Alias for /live chat, used by the top live button
+
+| Field | Value |
+| --- | --- |
+| Category | Core |
+| Status | implemented |
+| Surfaces | tui, rest, gateway, agentTool |
+| Safety | none |
+| Aliases | - |
+| Args | - |
+| Subcommands | - |
+
+Signatures:
+
+- `/livechat` - Alias for /live chat, used by the top live button
+
 ### /music
 
 Open music-generation model/setup menu
@@ -503,6 +571,25 @@ Signatures:
 
 - `/think` - Toggle thinking/reasoning mode (Qwen3, DeepSeek-R1, etc.)
 
+### /tree
+
+Switch between the action waterfall and an explorable action tree
+
+| Field | Value |
+| --- | --- |
+| Category | Core |
+| Status | implemented |
+| Surfaces | tui, rest, gateway, agentTool |
+| Safety | none |
+| Aliases | - |
+| Args | - |
+| Subcommands | - |
+
+Signatures:
+
+- `/tree` - Switch between the action waterfall and an explorable action tree
+- `/tree on\|off\|status` - Show, hide, or inspect the action-tree presentation
+
 ### /usage
 
 Show current session token count and cost
@@ -1555,6 +1642,42 @@ Signatures:
 - `/memory concepts` - Show concept clusters view
 - `/memory timeline` - Show temporal timeline view
 
+### /metabolize
+
+Run memory maintenance: import deferred memory, prune episodes, compact graph stores
+
+| Field | Value |
+| --- | --- |
+| Category | Memory And Context |
+| Status | implemented |
+| Surfaces | tui, rest, gateway, agentTool |
+| Safety | none |
+| Aliases | /metab |
+| Args | [--dry-run] [--verbose] [--min-score <n>] |
+| Subcommands | - |
+
+Signatures:
+
+- `/metabolize [--dry-run] [--verbose] [--min-score <n>]` - Run memory maintenance: import deferred memory, prune episodes, compact graph stores
+
+### /prune
+
+Shrink knowledge.db in the background: evict low-signal graph nodes (archived), then VACUUM. 'infer' = model-guided sleep consolidation. No arg shows stats + usage
+
+| Field | Value |
+| --- | --- |
+| Category | Memory And Context |
+| Status | implemented |
+| Surfaces | tui, rest, gateway, agentTool |
+| Safety | none |
+| Aliases | - |
+| Args | [now\|dry\|infer\|aggressive\|stats] [--target <n>] |
+| Subcommands | - |
+
+Signatures:
+
+- `/prune [now\|dry\|infer\|aggressive\|stats] [--target <n>]` - Shrink knowledge.db in the background: evict low-signal graph nodes (archived), then VACUUM. 'infer' = model-guided sleep consolidation. No arg shows stats + usage
+
 
 ## Tools And Skills
 

package/docs/research/_archived/README.md

@@ -0,0 +1,18 @@
+# Archived design notes — unwired
+
+Documents in this directory describe design proposals that were never wired
+into the runtime. They are kept for historical context only.
+
+| File | Status | Superseded by |
+|---|---|---|
+| `context_window_attention_spec.md` | Step 4 ("scale QK dot products by item weight") is physically impossible against API-served LLMs (Anthropic / OpenAI / Ollama). The rest was unwired. | `OA_WEIGHTED_MEMORY_PLAN.md` (repo root) |
+| `context_window_attention_weights.json` | No loader in any package. Pure documentation. | `.omnius/config/memory-weighting.yaml` (per the new plan) |
+| `context_window_attention_model.py` | Python module never imported by the Node.js runtime. | `packages/orchestrator/src/memory/composite-scorer.ts` (per the new plan) |
+
+The current canonical design is `OA_WEIGHTED_MEMORY_PLAN.md` at the repo root,
+which replaces the theater with real KV-cache-affecting wiring (Anthropic
+`cache_control` markers, Ollama `memoryPrefix` prefix-cache exploitation) and
+score-driven materialization tiers.
+
+If you came here looking for "how attention weighting works in omnius," the
+answer was: it didn't, until the new plan. Read that instead.