omnius 1.0.694 → 1.0.695

package/docs/work-orders/runtime-health-remediation/WO-27-task-verification-authority.md

@@ -0,0 +1,140 @@
+# WO-27: Separate mutation observations from task verification
+
+**Status:** complete; implemented, verified, and pushed to origin/main
+**Priority:** P1
+**Incident date:** 2026-09-04 PDT / 2026-09-05 UTC
+**Program:** [September 4 Telegram long-haul repairs](TELEGRAM-LONGHAUL-2026-09-04.md)
+
+## Observed failure
+
+At 01:54 PDT September 4, scaffold run telegram-64ac9937dc7647a8-1788511366966-1 completed with npm install --no-audit --no-fund 2>&1 | tail -20 as its sole shell command. Its readiness had zero obligations, claims, and verifier receipts. No test/build was executed.
+
+## Evidence
+
+Paths are relative to /home/roko/Documents/Projects/Adjacent. Live files are
+observational references; sanitized deterministic fixtures must reproduce the
+failure without copying credentials or private conversation content.
+
+- `telegram_test/.omnius/completion-finalizations/telegram-64ac9937dc7647a8-1788511366966-1.json`
+- `telegram_test/.omnius/terminal-trajectories/ (matching run)`
+
+## Root cause
+
+postActionVerifier labels a filesystem mtime observation outcomeClass='verified'. The no-todo runner path accepts that as direct task validation, and completionAutoFinalize can then report that changed files were validated. Observation of a successful mutation is weaker evidence than verification of requested behavior.
+
+## Code locations
+
+- `packages/orchestrator/src/postActionVerifier.ts`
+- `packages/orchestrator/src/taskValidationEvidence.ts`
+- `packages/orchestrator/src/verificationInvocation.ts`
+- `packages/orchestrator/src/verificationCommand.ts`
+- `packages/orchestrator/src/agenticRunner.ts — no-todo validation recording and completion readiness`
+- `packages/orchestrator/src/completionAutoFinalize.ts`
+- `packages/orchestrator/tests/completionAutoFinalize.test.ts`
+- `packages/orchestrator/tests/agenticRunner-completionReadiness.test.ts`
+- `packages/orchestrator/tests/postActionVerifier.test.ts`
+
+## Repair design
+
+- Represent mutation observation and task verification distinctly at the producer/consumer boundary.
+- Prevent install/create/edit success and recent mtimes from minting task-validation authority.
+- Retain explicit declared verifiers and real successful no-todo test/build verification, scoped to the actual execution and current mutation revision.
+- Keep read-only/informational completion possible without inventing test obligations.
+- Require fresh verification after a subsequent mutation and preserve truthful terminal summaries.
+
+## Acceptance checklist
+
+- [x] Scaffold edits followed only by dependency installation do not auto-finalize as verified.
+- [x] Mutation-only verifier observations cannot satisfy no-todo validation.
+- [x] A declared verifier and a real successful no-todo test/build retain valid completion behavior.
+- [x] Failed or stale verification cannot authorize completion; a later mutation invalidates earlier verification.
+- [x] Read-only tasks do not require artificial build/test steps.
+- [x] Focused completion/verifier tests and orchestrator typecheck pass.
+
+## Implementation and verification log
+
+- Post-action audits now explicitly carry `completionAuthority: "none"`.
+  Their existing `verified` outcome remains an audit finding for telemetry;
+  it cannot establish acceptance of the user's task.
+- Added typed task-validation evidence sourced only from a successful declared
+  verifier or an assertive validation execution. The selector excludes runtime
+  replays, contradictory/mismatched receipts, masked failures, and test/build
+  keywords used only as package arguments or file paths.
+- No-todo automatic completion requires the typed evidence to match the
+  recorded command and turn. Tool-call identity invalidates a preceding pass
+  after another tool mutates files in the same turn, while preserving a build
+  that writes its own verified artifacts. Later failed checks revoke prior
+  validation even when no intervening mutation occurred.
+- Added a mocked runner fixture with no subprocess or network execution. The
+  initial integration run reproduced both installation commands minting
+  `_lastBuildSuccessTurn=0`, and a subsequent same-turn edit leaving that
+  validation intact. These three assertions failed before runner integration.
+- The explicit custom verifier fixture also exposed an existing producer gap:
+  `test -f ...` matched the declared verifier but the generic classifier
+  dismissed it as a read-only command. Its successful execution must reach the
+  completion ledger as declared verification; read-only tasks themselves gain
+  no new test obligation.
+- Runner integration now routes explicit declared verifiers into the assertion
+  evidence ledger, carries typed authority into both automatic finalization
+  boundaries, and invalidates stale authority after mutations or failed checks.
+- Verification completed September 5, 2026 UTC, from `packages/orchestrator`:
+  - `pnpm exec vitest run tests/taskValidationEvidence.test.ts tests/completionAutoFinalize.test.ts tests/postActionVerifier.test.ts tests/agenticRunner-taskValidationAuthority.test.ts tests/agenticRunner-completionReadiness.test.ts tests/verificationCommand.test.ts tests/completion-provenance-visual-evidence.test.ts` — **92 passed across 7 files**.
+  - `pnpm exec vitest run tests/agenticRunner.test.ts -t 'synthesizes truth-based completion when final-turn validation passes'` — **1 passed; 174 unrelated cases skipped**.
+  - `pnpm exec tsc --noEmit` — passed.
+- The runner regressions use mock backends and mock shell tools. No live model
+  request, package installation, service mutation, or installed-package change
+  was performed. Git delivery is recorded by the parent work-order owner.
+
+### Independent-review followup after ce40bfca
+
+- Review found that using the filesystem-audit intent parser also rejected real
+  commands with launcher options or executable paths, including `pnpm --filter
+  @omnius/cli build`, `npm --prefix app run build`, a local `.bin/vitest`, and
+  `npx --package typescript tsc --noEmit`. It also treated help/version and
+  collection modes as validation.
+- Added a literal, quote-aware stage parser on the verification receipt
+  boundary and a separate invocation classifier. Launcher options consume
+  their values before action classification; executable basenames and inert
+  reporting suffixes are handled structurally. Unknown shell expansion stays
+  unclassified. Existing historical command matching remains unchanged.
+- A matched declared command now has to verify the final state. For example,
+  `pnpm test && touch src/example.ts` cannot reuse the earlier test as proof of
+  the subsequent edit. `pnpm test && echo done` remains valid; redirected
+  reporting that writes a file does not count as an inert suffix.
+- An untrusted later check or contradictory execution receipt revokes an
+  earlier pass even when the outer success flag is true. Positive protocol
+  text cannot override a nonzero exit receipt or restore that stale evidence.
+- Final followup verification, from `packages/orchestrator`:
+  - `pnpm exec vitest run tests/taskValidationEvidence.test.ts tests/verificationInvocation.test.ts tests/completionAutoFinalize.test.ts tests/postActionVerifier.test.ts tests/agenticRunner-taskValidationAuthority.test.ts tests/agenticRunner-completionReadiness.test.ts tests/verificationCommand.test.ts tests/completion-provenance-visual-evidence.test.ts` — **168 passed across 8 files**, including **25 runner cases**.
+  - `pnpm exec tsc --noEmit` — passed.
+- All review examples have deterministic regressions. Followup Git delivery is
+  pending the parent owner's scoped commit; no runtime publication is implied.
+
+### Full-suite compatibility followup
+
+- The stale-review reconciliation fixture depended on the removed generic
+  completion heuristic despite declaring no verifier or edited artifact. It
+  now supplies a completed todo with `pnpm test` and a coherent execution
+  receipt, asserts declared verification authority, and disables automatic
+  finalization only to reach the explicit terminal boundary under test.
+- Independent review also reproduced rejected valid Vitest `--run` and
+  `--coverage` invocations. Vitest mode options now use their own arity table,
+  separate from package-launcher options. Collection still remains inspection
+  when mode flags precede `list`; a config file named `list` remains a value.
+- Verification from `packages/orchestrator`:
+  - `pnpm exec vitest run tests/verificationInvocation.test.ts tests/run-observability.test.ts tests/agenticRunner-taskValidationAuthority.test.ts` — **93 passed across 3 files** (57 invocation, 10 observability, 26 runner cases).
+  - `pnpm exec tsc --noEmit` — passed.
+- This followup uses mocked execution and adds no live inference or runtime
+  state changes. Parent work-order owner handles the scoped commit and push.
+
+## Delivery
+
+- Commits: `ce40bfca, cf966ea3, dc60e5bf` on `origin/main`.
+- Clean `pnpm -r build` passed for all 11 workspace packages/apps. Final aggregate suite evidence is in the linked program ledger.
+
+## Publication boundary
+
+Repository repair and deterministic verification are this order's completion
+boundary. The user will publish the package and then perform live validation.
+No package publication, installed-package replacement, runtime-state repair,
+or service restart is authorized by this order.

package/docs/work-orders/runtime-health-remediation/WO-28-task-scope-evidence-retirement.md

@@ -0,0 +1,82 @@
+# WO-28: Retire obsolete task evidence after explicit scope changes
+
+**Status:** complete; implemented, verified, and pushed to origin/main
+**Priority:** P2
+**Incident date:** 2026-09-04 PDT / 2026-09-05 UTC
+**Program:** [September 4 Telegram long-haul repairs](TELEGRAM-LONGHAUL-2026-09-04.md)
+
+## Observed failure
+
+At 20:41 PDT, current turn 21 retained 57,931 characters of previous pentest repository tool bodies (38.6% of all message content), versus 35,088 from the new boutique-services project. The model eventually followed the new focus, but old task material remained in the active frame/history and sustained raw-discovery pressure.
+
+## Evidence
+
+Paths are relative to /home/roko/Documents/Projects/Adjacent. Live files are
+observational references; sanitized deterministic fixtures must reproduce the
+failure without copying credentials or private conversation content.
+
+- `telegram_test/.omnius/context-window-dumps/2026-09-05T03-41-09-548Z-main-57e9eeba54.json`
+
+## Root cause
+
+Telegram deliberately admits normal messages as `context_only`. The typed model reconciliation had no replacement field, and an immediately following voice message overwrote the one unresolved steering slot. Even explicit transport replacements reset only part of the task state: raw messages, evidence-ledger bodies, tool-event context, and task trajectory survived. Recovery also retained an old lifecycle epoch.
+
+## Code locations
+
+- `packages/orchestrator/src/agenticRunner.ts`: grouped steering, typed replacement, exact archives, safe checkpoints, task-state reset, request/recovery integration.
+- `packages/orchestrator/src/typed-model-output.ts` and `steeringIntake.ts`: bounded typed `taskDisposition`, `replacementGoal`, retained tool IDs.
+- `packages/orchestrator/src/taskScopeBoundary.ts`: validated run/session/epoch selector and complete tool transactions.
+- `packages/orchestrator/src/interruption-lifecycle.ts`: drained, owner-checked epoch advancement with persistence rollback.
+- `packages/orchestrator/src/contentAddressedArtifactStore.ts`: explicit durable flush for transition archives.
+- `packages/orchestrator/tests/agenticRunner-task-scope.test.ts`, `taskScopeBoundary.test.ts`, `typed-model-output.test.ts`, lifecycle/artifact tests and production request replay.
+
+## Repair design
+
+- Trace and repair the typed task-replacement boundary; do not infer replacement from filenames or keyword similarity alone.
+- Retire prior-task raw tool transactions from the next model-visible request after an accepted explicit replacement, preserving their durable audit/receipt references.
+- Retain current user authority, replacement instructions, media reference evidence needed to interpret the new task, and explicitly adopted cross-task dependencies.
+- Do not treat a status question, additive instruction, or priority change as destructive task replacement.
+- Keep canonical goal and evidence selection consistent across continuation/restoration and integrate with WO-25.
+
+## Acceptance checklist
+
+- [x] A two-project replacement replay excludes obsolete raw source while preserving current task instructions and required new evidence.
+- [x] Status-only and additive steering preserve relevant active-task context.
+- [x] Retired evidence remains durably retrievable; tool call/result pairs remain valid.
+- [x] Restored continuation uses the same scope boundary without resurrecting obsolete raw history.
+- [x] Integrated compiler/projection replay proves scope retirement does not trigger useless compaction.
+- [x] Focused steering/context tests and orchestrator typecheck pass.
+
+## Implementation and verification log
+
+- Initial regression reproduced overwritten text authority, retained obsolete raw history, and unvalidated retained tool IDs (three failing cases).
+- Typed reconciliation batches unresolved text/media and advances scope only for an accepted replacement, with no lexical task classifier. Transport replacement acknowledgement cannot advance twice.
+- Exact immutable transition archives include messages, todos, workboard, completion ledger, and task state. File/directory sync precedes lifecycle epoch advancement and retirement.
+- Later safe transcripts are checkpointed separately so restart retains work performed after replacement. Early recovery selects current goal before startup analysis.
+- Reset covers secondary evidence/context caches, world facts, task trajectory, phase tree, and verifier authority. Explicitly adopted complete tool transactions remain model-visible.
+- Independent review exposed and drove repairs for cache reinjection, structured-state archive loss, restore progress loss, and identical text in later task scope. Final verification and commit evidence follow below.
+
+## Verification result
+
+- Runner scope regressions: **13 passed**; pure boundary regressions: **11 passed**.
+- Durable interruption lifecycle: **25 passed**; content-addressed archive store: **10 passed**.
+- Full mocked `runner.run()` replacement replay: **2 passed**, exercising primary and brute-force request paths, grouped text/audio, exact epoch advancement, evidence retirement, and retained core policy.
+- Existing core-policy regressions: **3 passed**, covering small, medium, and large tiers.
+- Compiler/canonical/steering integration regression set passed. Clean workspace build passed for all 11 packages/apps.
+- Final scope reset includes observation and source ledgers, contract registry, local tool cache, world facts, recovery-controller delta, phase tree, and cached prior-task retrieval. Current workspace inventory remains observable.
+- Identical later user replies survive restore: selectors recognize the original archived prefix and stop retirement at the new authority/epoch boundary.
+- Runtime policy has typed metadata and stays in separate bounded system messages. This avoids losing core rules to first-system truncation while retiring old task recall.
+- Full aggregate suite and commit evidence are recorded in the program ledger.
+
+## Delivery
+
+- Commit: `24321b30` on `origin/main`.
+- Final archive-directory sync refinement passed both scope suites (**15 tests**) and an additional workspace build. Full aggregate evidence is in the linked program ledger.
+
+## Publication boundary
+
+Repository repair and deterministic verification are this order's completion
+boundary. The user will publish the package and then perform live validation.
+No package publication, installed-package replacement, runtime-state repair,
+or service restart is authorized by this order.
+

package/docs/work-orders/runtime-health-remediation/WO-29-retired-failure-projections.md

@@ -0,0 +1,85 @@
+# WO-29: Exclude retired failures from active diagnostics
+
+**Status:** complete; implemented, verified, and pushed to origin/main
+**Priority:** P2
+**Incident date:** 2026-09-04 PDT / 2026-09-05 UTC
+**Program:** [September 4 Telegram long-haul repairs](TELEGRAM-LONGHAUL-2026-09-04.md)
+
+## Observed failure
+
+Current transcription and shell-timeout recovery cards were retired at 19:58 PDT with supersededBy='failure-expired:turn-19', yet unresolved-failure diagnostics still appeared at 20:35. This is contradictory active recovery context; it was not proven to be a terminal blocker.
+
+## Evidence
+
+Paths are relative to /home/roko/Documents/Projects/Adjacent. Live files are
+observational references; sanitized deterministic fixtures must reproduce the
+failure without copying credentials or private conversation content.
+
+- `telegram_test/.omnius/workboards/telegram-64ac9937dc7647a8-1788572475259-1/active.json`
+
+## Root cause
+
+Failure retirement preserves status for audit and marks `supersededBy`.
+Workboard active diagnostic derivation checked failure card ID/status but
+ignored supersession. The same omission affected compact card counts and
+selection, synthesis blockers and verified evidence, and the diagnostics tool
+view. Cached snapshots could retain the old derived warnings even after a
+runtime upgrade.
+
+## Code locations
+
+- `packages/execution/src/tools/workboard.ts — active-card selection, diagnostic derivation, projections`
+- `packages/execution/tests/workboard.test.ts`
+- `packages/orchestrator/tests/workboard-run-continuity.test.ts`
+
+## Repair design
+
+- Use consistent active-card lifecycle semantics in derived workboard diagnostics and active projections.
+- Exclude superseded/expired obligations from unresolved counts and actionable warnings while preserving historical cards and diagnostic records where explicitly historical.
+- Do not relabel expiration as successful verification.
+- Ensure a genuinely new recurrence creates/activates the correct obligation without resurrecting retired state accidentally.
+
+## Acceptance checklist
+
+- [x] An expired/superseded in-progress failure no longer emits active unresolved-failure diagnostics.
+- [x] A current unresolved failure still emits its bounded warning.
+- [x] Retirement preserves the original failure and its audit trail without fabricating verification.
+- [x] Fresh recurrence is represented correctly and legacy cards without supersession retain behavior.
+- [x] Focused workboard/lifecycle tests and execution typecheck pass.
+
+## Implementation and verification log
+
+- A single active-card predicate now excludes `supersededBy` cards from compact
+  counts, card limits, hidden-card counts, synthesis, and newly derived failure
+  and dependency diagnostics. The existing ownership-frontier check uses the
+  same predicate.
+- Active diagnostic projection filters recorded or cached historical warnings
+  for retired cards before model-output limits are applied. Full JSON, raw
+  cards, status, evidence, and append-only events preserve the audit history.
+  An explicitly returned compact card includes its supersession marker.
+- Retirement supplies no verification evidence. A live card depending on a
+  retired but unverified card remains blocked; the dependent obligation must
+  be explicitly reconciled. A new recurrence receives its own active warning.
+- Before the repair, regression fixtures reproduced retired-card
+  `unresolved_failure_card`/`repeated_worker_failure` warnings and a board
+  containing only retired cards failing to report its empty active frontier.
+- Hermetic verification on 2026-09-05 UTC:
+  - `pnpm --filter @omnius/execution exec vitest run tests/workboard.test.ts`:
+    **37 tests passed**, including cached-snapshot projections, replay/reload,
+    preserved failed evidence, fresh recurrence, and dependency safety.
+  - `pnpm --filter @omnius/orchestrator exec vitest run tests/workboard-run-continuity.test.ts`:
+    **10 tests passed**.
+  - `pnpm --filter @omnius/execution typecheck`: **passed**.
+- Repository delivery commit will be recorded by the parent repair task.
+
+## Delivery
+
+- Commits: `3a1731ad` on `origin/main`.
+- Clean `pnpm -r build` passed for all 11 workspace packages/apps. Final aggregate suite evidence is in the linked program ledger.
+
+## Publication boundary
+
+Repository repair and deterministic verification are this order's completion
+boundary. The user will publish the package and then perform live validation.
+No package publication, installed-package replacement, runtime-state repair,
+or service restart is authorized by this order.

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "omnius",
-  "version": "1.0.694",
+  "version": "1.0.695",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omnius",
-      "version": "1.0.694",
+      "version": "1.0.695",
       "bundleDependencies": [
         "image-to-ascii"
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnius",
-  "version": "1.0.694",
+  "version": "1.0.695",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/library.js",