omnius 1.0.646 → 1.0.648

package/docs/OMNIUS-RELIABILITY-LONG-HORIZON-TODO.md

@@ -0,0 +1,320 @@
+# Omnius Reliability and Long-Horizon Workboard
+
+Updated: 2026-08-28
+
+This file is the durable workboard for the current repair program.
+It records scope, dependencies, evidence, and closure rules.
+
+## Status rules
+
+- `[x]` means that code and focused tests are complete.
+- `[ ] ACTIVE` means that work is in progress.
+- `[ ] VERIFY` means that code exists, but a required gate is open.
+- `[ ] QUEUED` means that an active dependency must finish first.
+- `[ ] EXTERNAL` means that completion needs a repository or service action.
+
+## P0: Telegram reliability
+
+- [x] Trace the failing Telegram request from intake to final route.
+  - Evidence: The router aborts after two 30-second request windows.
+  - Evidence: The broker can still have an active or queued request.
+  - Evidence: The plain retry is skipped after the liveness abort.
+  - Required result: Telegram must not cancel healthy queued inference.
+- [x] Compare Telegram transport with `AgenticRunner` transport.
+  - Compare endpoint selection.
+  - Compare native Ollama transport.
+  - Compare broker admission.
+  - Compare request timeout behavior.
+  - Compare stream inactivity behavior.
+  - Compare unary fallback behavior.
+  - Compare thinking suppression.
+  - Compare context sizing.
+  - Compare usage accounting.
+- [x] Replace the 30-second router deadline.
+  - Do not count broker queue time as model failure.
+  - Use a progress-aware inactivity limit.
+  - Keep one bounded whole-request safety limit.
+  - Do not start a duplicate unary request after an abort.
+  - Preserve user cancellation.
+- [x] Prevent duplicate inference after stream failure.
+  - Retry only for a transport or protocol incompatibility.
+  - Do not retry an aborted or timed-out generation as unary inference.
+  - Release each broker slot exactly once.
+- [x] Make the host broker authoritative for capacity.
+  - Use the public broker endpoint at `http://127.0.0.1:11434`.
+  - Do not start a local Ollama pool for this endpoint.
+  - Preserve `think: false` and `num_ctx` on broker requests.
+  - Preserve host lane selection and model aliases.
+- [ ] ACTIVE — Reduce router prompt and call amplification.
+  - Measure the silent-reflection prompt.
+  - Measure the attention-router prompt.
+  - Remove duplicate context.
+  - Keep required persona, relationship, and thread evidence.
+  - Avoid repair calls when no model token was returned.
+- [x] Add Telegram timeout and retry regression tests.
+  - Test a 45-second first-token delay.
+  - Test a queued broker request.
+  - Test a slow active stream.
+  - Test an actual stalled stream.
+  - Test user cancellation.
+  - Test a protocol error that permits unary fallback.
+  - Test an abort that forbids unary fallback.
+- [x] Run focused Telegram suites.
+- [x] Build the CLI package.
+- [ ] VERIFY — Run live Telegram route inference.
+  - Endpoint: `http://127.0.0.1:11434`.
+  - Model: `robit/ornith-1.5:9b`.
+  - Required GPU: a broker-selected A100 80 GB GPU.
+  - Forbidden GPU: the GT 1030.
+  - Required result: valid visible route JSON.
+  - Required result: nonzero generated token telemetry.
+  - Required result: no 30-second abort.
+
+## P0: Router empty-content failure
+
+- [x] Separate Ollama transport detection from local pool ownership.
+- [x] Use native `/api/chat` for broker-managed Ollama control requests.
+- [x] Send `think: false` through the broker transport.
+- [x] Send `num_ctx` through the broker transport.
+- [x] Strip prior hidden-thinking blocks from model history.
+- [x] Record JSON-mode and plain-mode outcomes separately.
+- [x] Preserve exact backend errors in router diagnostics.
+- [x] Skip repair when the backend returned no visible text.
+- [x] Remove the premature Telegram liveness abort.
+- [ ] VERIFY — Confirm that the route parser receives visible JSON live.
+
+## P0: Model broker and parallel inference
+
+- [x] Confirm that the host broker is available.
+- [x] Confirm that the parallel pool is enabled.
+- [x] Confirm a maximum of three managed servers.
+- [x] Confirm one in-flight request per managed lane.
+- [x] Confirm that three A100 80 GB GPUs are selected.
+- [x] Confirm that the GT 1030 is not selected.
+- [x] Confirm that the 9B model is resident on an A100.
+- [x] Confirm that no Ollama runner is resident on the GT 1030.
+- [x] Confirm the exact model tag `robit/ornith-1.5:9b`.
+- [x] Confirm model context length `262144`.
+- [x] Confirm model capabilities for completion, vision, tools, and thinking.
+- [ ] VERIFY — Confirm that Omnius can request broker capacity without bypass.
+- [ ] VERIFY — Confirm parallel sub-agent requests on separate host lanes.
+- [ ] VERIFY — Confirm that broker queue time remains visible to Telegram.
+- [ ] EXTERNAL — Confirm the broker repository commit on `main`.
+- [ ] EXTERNAL — Confirm the required broker service restart state.
+
+## P0: Live inference hardware gate
+
+- [x] Read `/usr/local/share/ollama-unify/AGENTS.md`.
+- [x] Run `docker gpu discover`.
+- [x] Confirm public endpoint `http://127.0.0.1:11434`.
+- [x] Confirm backend endpoint `http://127.0.0.1:11436`.
+- [x] Inspect `/api/ps`.
+- [x] Inspect `/api/tags` for the exact model.
+- [x] Inspect `/api/show` for the exact model.
+- [x] Inspect `nvidia-smi` GPU inventory.
+- [x] Inspect `nvidia-smi` model process placement.
+- [x] Confirm model runner PID `2199237` on an A100.
+- [x] Confirm that no test runner uses the GT 1030.
+- [ ] VERIFY — Send the first generated-token request.
+- [ ] VERIFY — Inspect GPU placement during generation.
+- [ ] VERIFY — Record response text, usage, timing, and graph validity.
+
+## P1: Ontology long-horizon work graph
+
+- [x] Add a versioned operational-world schema.
+- [x] Add strict work-node schemas.
+- [x] Add strict relation schemas.
+- [x] Add source-binding schemas.
+- [x] Add evidence-reference schemas.
+- [x] Add structured claim schemas.
+- [x] Add first-class conflict schemas.
+- [x] Add action-contract schemas.
+- [x] Add world-patch schemas.
+- [x] Add validation-result schemas.
+- [x] Add immutable validation-receipt schemas.
+- [x] Add bounded reasoning-slice schemas.
+- [x] Export all schemas from `@omnius/schemas`.
+- [x] Add a deterministic world reducer.
+- [x] Reject stale base revisions.
+- [x] Reject reused target revisions.
+- [x] Reject duplicate patch targets.
+- [x] Reject dangling references.
+- [x] Reject duplicate semantic relations.
+- [x] Reject invalid decomposition cycles.
+- [x] Reject invalid temporal intervals.
+- [x] Require evidence for verified relations and claims.
+- [x] Preserve incompatible claims as conflicts.
+- [x] Cascade node removal when a caller requests it.
+- [x] Preserve full graph snapshots in revision history.
+- [x] Emit deterministic graph and evidence hashes.
+- [x] Persist operational-world state atomically.
+- [x] Restore valid state at a task boundary.
+- [x] Reject invalid persisted state.
+- [x] Project the active objective.
+- [x] Project todo hierarchy.
+- [x] Project requirements.
+- [x] Project acceptance criteria.
+- [x] Project features, components, modules, and tasks.
+- [x] Project source documents and sections.
+- [x] Project target paths, symbols, documents, and external systems.
+- [x] Project action nodes.
+- [x] Project mutation nodes.
+- [x] Project blocker nodes.
+- [x] Project completion claims.
+- [x] Project completion evidence.
+- [x] Project trusted command receipts.
+- [x] Preserve authority as explicit, adopted, or inferred.
+- [x] Build target-focused graph slices.
+- [x] Include supporting evidence.
+- [x] Include refuting evidence.
+- [x] Include open conflicts.
+- [x] Preserve parent reference closure.
+- [x] Preserve action-target closure.
+- [x] Limit model-visible graph context.
+- [x] Refresh the graph before each primary model turn.
+- [x] Refresh the graph before each brute-force model turn.
+- [x] Keep one current graph block in context.
+- [x] Gate only explicit graph obligations.
+- [x] Keep inferred graph content advisory.
+- [x] Recheck graph authority on all terminal paths.
+- [x] Document the implementation in `docs/ONTOLOGY-LONG-HORIZON-WORK-GRAPH.md`.
+- [ ] VERIFY — Run live 9B graph decomposition inference.
+- [ ] VERIFY — Parse the model patch with `WorldPatchSchema`.
+- [ ] VERIFY — Apply the model patch with the deterministic reducer.
+- [ ] VERIFY — Record a successful validation receipt.
+
+## P1: Todo ontology contract
+
+- [x] Add `workKind`.
+- [x] Add `requirementIds`.
+- [x] Add `acceptanceIds`.
+- [x] Add `sourceRefs`.
+- [x] Add `targetRefs`.
+- [x] Add typed action contracts.
+- [x] Preserve all fields in the todo store.
+- [x] Preserve all fields in todo tool input parsing.
+- [x] Preserve all fields in no-change detection.
+- [x] Export all new types.
+- [x] Add persistence and update tests.
+
+## P1: Feature and completion authority
+
+- [x] Invoke `verifyUnit` after accepted execution.
+- [x] Fail the feature unit when verification returns false.
+- [x] Fail the feature unit when verification throws.
+- [x] Contain and persist verifier errors.
+- [x] Prevent fallback completion without evidence.
+- [x] Distinguish absent delivery manifests from invalid manifests.
+- [x] Reject invalid authored delivery manifests.
+- [x] Reject incomplete authored delivery manifests.
+- [x] Require fresh verifier evidence after relevant mutations.
+- [x] Keep frontier and inferred claim feedback advisory.
+- [x] Add a bounded completion-hold escape.
+- [x] Return `incomplete_verification` after repeated authoritative holds.
+- [x] Apply the same fail-safe to alternate terminal paths.
+
+## P1: Inference visibility
+
+- [x] Add a shell-style inference block.
+- [x] Show elapsed inference time.
+- [x] Show request kind, model, and session.
+- [x] Show handling state before the first token.
+- [x] Show thinking-token regions to the operator.
+- [x] Show visible content-token regions to the operator.
+- [x] Show streamed tool argument regions.
+- [x] Show unary returned contracts before parsing.
+- [x] Read usage from structured stream chunks.
+- [x] Show an estimated generated-token count.
+- [x] Add a read-mode control.
+- [x] Expand all prior generated rows in read mode.
+- [x] Keep thinking content out of Telegram replies.
+- [x] Show broker queue admission as a separate phase.
+- [x] Show time to first byte separately from queue time.
+- [x] Stop showing successful `~0 tok` when provider usage is available.
+
+## P1: Clickable files, folders, and websites
+
+- [x] Add one shared terminal-link utility.
+- [x] Convert Markdown links to OSC 8 links.
+- [x] Convert bare `http` and `https` URLs to OSC 8 links.
+- [x] Convert absolute file paths to `file://` links.
+- [x] Convert existing relative project paths to absolute `file://` links.
+- [x] Remove line and column suffixes from the open target.
+- [x] Keep line and column suffixes in visible text.
+- [x] Link directories so the desktop file manager opens them.
+- [x] Link files so the default file handler opens them.
+- [x] Link websites so the default browser opens them.
+- [x] Apply links to completed assistant Markdown.
+- [x] Apply links to streamed assistant lines.
+- [x] Apply links to Telegram diagnostics and sub-agent output.
+- [x] Apply links to tool Markdown output that enters natural-language rendering.
+- [x] Do not alter code blocks, commands, JSON, logs, or machine payloads.
+- [x] Add terminal-link unit tests.
+- [x] Add streaming-link regression tests.
+- [x] Add Telegram-link regression tests.
+
+## P1: ASD-STE100 communication policy
+
+- [x] Review ASD-STE100 Issue 9.
+- [x] Add one shared STE communication policy.
+- [x] Apply the policy to normal agent tiers.
+- [x] Apply the policy to router prompts.
+- [x] Apply the policy to Nexus requests.
+- [x] Preserve code, JSON, commands, paths, identifiers, and quotations.
+- [x] Preserve logs, tool output, and required machine formats.
+- [x] Add prompt policy tests.
+- [x] Update stale Nexus prompt tests.
+- [ ] VERIFY — Review remaining dynamically generated tool instructions.
+- [ ] VERIFY — Review remaining Telegram public prompts.
+- [ ] VERIFY — Run a qualified human conformance review before certification.
+
+## P2: 2026 reliability practices
+
+- [x] Use bounded intervention replay checkpoints.
+- [x] Use evidence-grounded completion.
+- [x] Use fresh post-mutation verification.
+- [x] Use explicit authority boundaries.
+- [x] Keep inferred scope advisory.
+- [x] Use target-focused context slices.
+- [x] Preserve contradictions instead of overwriting them.
+- [x] Use deterministic reducers for model-proposed state.
+- [x] Record immutable validation receipts.
+- [x] Use bounded repeated-hold escape behavior.
+- [ ] VERIFY — Recheck current 2026 primary literature before the final audit.
+- [ ] VERIFY — Add exact citations to the final engineering review.
+
+## Verification record
+
+- [x] Schema tests: 230 passed.
+- [x] Todo-store tests: 39 passed.
+- [x] Operational reducer tests: 9 passed.
+- [x] Operational controller tests: 6 passed.
+- [x] Operational runner test: 1 passed.
+- [x] Feature-node tests: 7 passed.
+- [x] Delivery coverage focused tests passed.
+- [x] Workspace TypeScript builds passed.
+- [x] Targeted Nexus tests passed.
+- [x] Two full-suite timeout cases passed when run without worker contention.
+- [x] Telegram transport, observability, link, and Bot API suites: 161 passed.
+- [x] Native Ollama transport suite: 19 passed.
+- [x] Model-broker focused suite: 6 passed.
+- [x] Rerun Telegram focused suites after the timeout repair.
+- [x] Rerun CLI typecheck and build after link support.
+- [x] Rerun all workspace TypeScript builds after the transport repair.
+- [ ] VERIFY — Run live Telegram inference.
+- [ ] VERIFY — Run live ontology patch inference.
+
+## Closure rule
+
+Do not close this workboard after a code-only result.
+
+Close it only when these conditions are true:
+
+1. Telegram returns a valid route through the selected broker model.
+2. No healthy broker request fails at 30 seconds.
+3. Generated contract tokens are visible in the inference block.
+4. The operator can expand the complete inference transcript.
+5. Files, folders, and websites are clickable in natural-language output.
+6. The 9B model produces a valid ontology patch.
+7. The reducer accepts the patch and emits a receipt.
+8. Focused tests and workspace builds pass.

package/docs/ONTOLOGY-LONG-HORIZON-WORK-GRAPH.md

@@ -0,0 +1,351 @@
+# Ontology Long-Horizon Work Graph
+
+Date: 2026-08-28
+
+## Objective
+
+Use an ontological graph to control large and long tasks.
+Make each work item, relation, claim, and evidence item addressable.
+Keep one canonical graph across planning, execution, verification, and completion.
+
+## Reference boundary
+
+The [Ontology Workbench](https://robit-man.github.io/ontology/) is the documentation and reference implementation.
+Its [raw source](https://github.com/robit-man/ontology/blob/main/index.html) defines the contracts and behavior.
+
+Use the implementation as a contract reference.
+Do not copy its browser and IndexedDB monolith into Omnius.
+
+## Implementation result
+
+Omnius now has one versioned operational work graph across planning,
+execution, evidence, and completion.
+
+The implementation projects the existing todo and completion stores.
+It does not add an independent planner or evidence store.
+
+Implemented components:
+
+- `packages/schemas/src/operational-world.ts` defines strict, versioned graph,
+  source, evidence, claim, conflict, action, patch, receipt, and reasoning-slice
+  contracts.
+- `packages/orchestrator/src/operational-world/reducer.ts` validates and applies
+  immutable, revision-bound graph transactions.
+- `packages/orchestrator/src/operational-world/workGraphProjection.ts` projects
+  objectives, requirements, work hierarchy, source documents and sections,
+  actions, mutations, targets, acceptance criteria, blockers, claims, and
+  completion evidence.
+- `packages/orchestrator/src/operational-world/reasoningSlice.ts` selects a
+  bounded target neighborhood and preserves all required references.
+- `packages/orchestrator/src/operational-world/persistence.ts` writes atomic
+  task-epoch snapshots with revision history and validation receipts.
+- `packages/orchestrator/src/operational-world/controller.ts` owns projection,
+  persistence, model context, and explicit completion blockers.
+- `AgenticRunner` refreshes the graph before each primary and brute-force model
+  turn. It exposes one current reasoning slice and rechecks explicit graph
+  closure at every terminal path.
+
+The graph must join this chain:
+
+```text
+objective
+  -> requirement
+    -> feature
+      -> component or module
+        -> task
+          -> artifact or mutation
+            -> claim
+              -> verification
+                -> evidence
+```
+
+Relations must also represent dependencies, blockers, contradictions, and supersession.
+
+## Useful Ontology Workbench contracts
+
+The reference separates four concerns:
+
+- Type and schema definitions
+- Mutable runtime instances
+- Claims, evidence, and conflicts
+- Objectives, plans, actions, approvals, and executions
+
+The model proposes a revision-bound patch.
+Deterministic code validates and applies the patch.
+The code records an immutable revision receipt.
+
+The reference also uses target-focused evidence collection.
+It scans all target occurrences before it selects evidence.
+It keeps varied semantic roles and document positions.
+It also keeps supporting and contradicting evidence.
+
+These contracts are more valuable than its first chunking algorithm.
+Omnius already has stronger basic chunking, content hashes, staleness checks, and PDF coverage receipts.
+
+## Strong Omnius foundations
+
+### Work decomposition
+
+- `todo-store.ts` has stable identifiers, parents, blockers, owners, dependencies, verifiers, and artifacts.
+- `todoTruth.ts` derives hierarchy, open leaves, dependency state, and parent completion.
+- `featurePlanner.ts` records paths, symbols, tests, evidence, questions, units, and return contracts.
+- `featureNode.ts` provides recursive survey, plan, split, execute, verify, and eviction stages.
+
+### Completion and closure
+
+- `completionLedger.ts` records claims, evidence roles, risks, critiques, unresolved items, and terminal receipts.
+- `deliveryCoverage.ts` has versioned manifests and deterministic coverage evaluation.
+- `integrationClosure.ts` already projects requirements, claims, paths, contracts, evidence, and blockers into a graph.
+- `completion-evidence-gate.ts` requires independent evidence for high-risk claims.
+
+### Evidence and memory
+
+- `evidenceLedger.ts` records content hashes, revisions, ranges, fidelity, mutations, and staleness.
+- `contextMemoryLedger.ts` records authority, trust, temporal validity, relations, and dependency-closed transactions.
+- `evidenceBranch.ts` validates selected ranges against presented windows and original source text.
+- PDF receipts distinguish absence, incomplete coverage, truncation, and omitted pages.
+
+### Retrieval
+
+- Hybrid retrieval combines lexical, vector, and graph candidates.
+- The context assembler supports rank fusion, graph expansion, snippet packing, and request budgets.
+- The memory ledger supports temporal and source-aware retrieval with explicit abstention.
+
+## Closed gaps
+
+### Canonical work identity
+
+The projector gives each source record a stable content-derived graph identity.
+Todo identifiers, completion evidence identifiers, claim identifiers, source
+references, target references, and receipt references remain traceable in node
+attributes or typed references.
+
+### Requirement identity
+
+Todos now carry `workKind`, `requirementIds`, `acceptanceIds`, `sourceRefs`,
+`targetRefs`, and a typed action contract. The todo tool schema, persistence,
+no-op comparison, and exports preserve these fields.
+
+### Feature verification
+
+`featureNode` now invokes `verifyUnit` after the final accepted executor result.
+A false result or exception fails the node. The fallback path never changes an
+unverified unit to complete.
+
+### Authoritative completion evidence
+
+The active completion gate and final terminal fail-safe now reject open,
+explicit requirements, acceptance criteria, blockers, and explicit claim
+conflicts. They also reject invalid authored delivery manifests and stale
+post-mutation verifier evidence.
+
+Keep inferred work advisory.
+Make explicit requirements and acceptance paths authoritative.
+
+### World transaction boundary
+
+`WorldPatch` includes a graph identifier, base revision, target revision,
+typed operations, author, rationale, and creation time. The reducer rejects
+stale or reused revisions and emits an immutable validation receipt with graph
+and referenced-evidence hashes.
+
+### First-class conflict objects
+
+Structured claims include subject, predicate, object, valid time, authority,
+confidence, evidence, and dependencies. The reducer deterministically
+preserves overlapping incompatible claims in an open conflict group.
+
+### Target-focused reasoning slices
+
+The graph slice starts from exact or lexical targets, expands a bounded
+neighborhood, includes supporting and refuting evidence roles, retains claims
+and conflicts, and restores parent and action-target closure after trimming.
+
+### Shared source bindings
+
+The shared schema supports URI fragments, line and character ranges, pages,
+sheets and rows, headings, tables, JSON pointers, fields, and temporal ranges.
+It records source revision, optional hash, authority, freshness, read policy,
+observation time, confidence, and evidence role.
+
+## Canonical WorkGraph contract
+
+Use these node kinds:
+
+- `objective`
+- `requirement`
+- `feature`
+- `component`
+- `module`
+- `task`
+- `acceptance`
+- `symbol`
+- `artifact`
+- `mutation`
+- `claim`
+- `verification`
+- `evidence`
+- `conflict`
+- `blocker`
+
+Use these core relations:
+
+- `decomposes_to`
+- `part_of`
+- `depends_on`
+- `satisfies`
+- `implements`
+- `modifies`
+- `produces`
+- `verified_by`
+- `evidenced_by`
+- `contradicts`
+- `blocked_by`
+- `supersedes`
+
+Each node and relation must have a stable identifier.
+Each inferred item must record its authority.
+An inferred item remains advisory until code or a user adopts it.
+
+Each action node must define these fields when they apply:
+
+- Target references
+- Inputs
+- Preconditions
+- Expected mutations
+- Side effects
+- Required authority
+- Required approval
+- Risk
+- Verification contract
+
+## Shared evidence contract
+
+`SourceBinding` and `EvidenceRef` are implemented under `packages/schemas`.
+
+The schema must include these fields:
+
+- Evidence identifier
+- Source identifier and URI
+- Content hash and source revision
+- Observation time and freshness
+- Authority and confidence
+- Typed locator and locator value
+- Supporting or refuting polarity
+- Coverage and truncation status
+- State epoch
+
+Use the same evidence identifier in retrieval, memory, claims, completion, and groundedness.
+Validate each reference against the current source revision.
+
+## Revisioned world reducer
+
+The pure reducer is implemented under
+`packages/orchestrator/src/operational-world/`.
+Keep `AgenticRunner`, context systems, and the TUI as consumers.
+
+The model can propose only a `WorldPatch`.
+The patch must include `patchId`, `baseRevision`, and typed operations.
+
+The reducer must do these checks:
+
+1. Verify the base revision.
+2. Validate every runtime schema.
+3. Verify every node, relation, claim, and evidence reference.
+4. Verify expected file hashes and read versions.
+5. Reject duplicate identifiers and dangling relations.
+6. Reject invalid cycles and temporal intervals.
+7. Preserve incompatible claims as a conflict.
+8. Apply operations in a deterministic order.
+9. Emit an immutable patch and revision receipt.
+
+Use `integrationClosure.ts` as the first graph adapter.
+Do not make its bounded display neighborhood the authoritative validation universe.
+
+## Large-document evidence pipeline
+
+Use a source-aware decomposition tree.
+Each child shard must retain its parent and exact locator.
+
+Select shard boundaries by content type:
+
+- Keep prose headings with their paragraphs.
+- Keep JSON paths and array ranges.
+- Repeat table headers for each table shard.
+- Keep PDF page markers.
+- Keep spreadsheet sheet and row markers.
+
+If one extraction fails, subdivide only that shard.
+Preserve the failed shard as unresolved evidence.
+Do not discard it.
+
+For a named target, use this retrieval sequence:
+
+1. Resolve exact target entities.
+2. Scan all target occurrences.
+3. Build section-bounded evidence windows.
+4. Classify each window by semantic role and polarity.
+5. Keep earliest and latest relevant evidence.
+6. Keep early, middle, and late document coverage.
+7. Expand one hop to co-referenced entities.
+8. Include supporting and contradicting evidence.
+9. Trim background evidence before target evidence.
+10. Emit a typed coverage receipt.
+
+Pass one validated `ReasoningSlice` to the reasoner and critic.
+Reject unknown citations and omitted requested targets before model criticism.
+
+## Completion invariant
+
+Use this rule for authoritative work:
+
+> Complete an objective only when every explicit requirement and acceptance path reaches fresh successful evidence after the last relevant mutation.
+
+Do not let a model-created node silently expand the user's required scope.
+Keep each inferred edge advisory until adoption.
+
+## Completed correctness repairs
+
+- `verifyUnit` runs during the feature-node verification stage.
+- Exceptions and false verification results cannot create completion.
+- Feature decomposition fields survive in the todo store and tool contract.
+- Exact verifier commands require trusted receipts after relevant mutations.
+- Explicit completion gaps hold `task_complete` and alternate terminal paths.
+- Repeated holds terminate as `incomplete_verification`; they never report a
+  false success.
+- Model context contains one current bounded reasoning slice instead of a full
+  unbounded graph dump.
+
+## Deployment state
+
+### Phase 1: Shared identity — complete
+
+Add shared work, relation, source-binding, evidence, conflict, and revision schemas.
+Project current stores into stable graph identifiers.
+
+### Phase 2: Revisioned world — complete
+
+Patches, validation results, revisions, full snapshots, and receipts are
+persisted atomically for each task epoch.
+
+### Phase 3: Retrieval and document evidence — integrated
+
+The graph consumes current completion evidence and source references. Reasoning
+slices include counterevidence, structural locators, coverage metadata, and
+target neighborhoods without replacing the existing retrieval stores.
+
+### Phase 4: Authoritative explicit closure — complete
+
+Gate only explicit requirement and acceptance paths.
+Keep inferred paths advisory.
+Require fresh evidence after each relevant mutation.
+
+### Phase 5: Parallel long-horizon execution
+
+Schedule ready leaves whose dependency paths are satisfied.
+Assign ownership and authority to each leaf.
+Commit graph patches through the revisioned reducer.
+Reconcile conflicts before dependent work begins.
+
+This design lets Omnius decompose extreme complexity into durable ontological work.
+It also keeps progress, evidence, and completion lossless across long sessions.