omnius 1.0.694 → 1.0.696

package/docs/work-orders/runtime-health-remediation/WO-28-task-scope-evidence-retirement.md

@@ -0,0 +1,82 @@
+# WO-28: Retire obsolete task evidence after explicit scope changes
+
+**Status:** complete; implemented, verified, and pushed to origin/main
+**Priority:** P2
+**Incident date:** 2026-09-04 PDT / 2026-09-05 UTC
+**Program:** [September 4 Telegram long-haul repairs](TELEGRAM-LONGHAUL-2026-09-04.md)
+
+## Observed failure
+
+At 20:41 PDT, current turn 21 retained 57,931 characters of previous pentest repository tool bodies (38.6% of all message content), versus 35,088 from the new boutique-services project. The model eventually followed the new focus, but old task material remained in the active frame/history and sustained raw-discovery pressure.
+
+## Evidence
+
+Paths are relative to /home/roko/Documents/Projects/Adjacent. Live files are
+observational references; sanitized deterministic fixtures must reproduce the
+failure without copying credentials or private conversation content.
+
+- `telegram_test/.omnius/context-window-dumps/2026-09-05T03-41-09-548Z-main-57e9eeba54.json`
+
+## Root cause
+
+Telegram deliberately admits normal messages as `context_only`. The typed model reconciliation had no replacement field, and an immediately following voice message overwrote the one unresolved steering slot. Even explicit transport replacements reset only part of the task state: raw messages, evidence-ledger bodies, tool-event context, and task trajectory survived. Recovery also retained an old lifecycle epoch.
+
+## Code locations
+
+- `packages/orchestrator/src/agenticRunner.ts`: grouped steering, typed replacement, exact archives, safe checkpoints, task-state reset, request/recovery integration.
+- `packages/orchestrator/src/typed-model-output.ts` and `steeringIntake.ts`: bounded typed `taskDisposition`, `replacementGoal`, retained tool IDs.
+- `packages/orchestrator/src/taskScopeBoundary.ts`: validated run/session/epoch selector and complete tool transactions.
+- `packages/orchestrator/src/interruption-lifecycle.ts`: drained, owner-checked epoch advancement with persistence rollback.
+- `packages/orchestrator/src/contentAddressedArtifactStore.ts`: explicit durable flush for transition archives.
+- `packages/orchestrator/tests/agenticRunner-task-scope.test.ts`, `taskScopeBoundary.test.ts`, `typed-model-output.test.ts`, lifecycle/artifact tests and production request replay.
+
+## Repair design
+
+- Trace and repair the typed task-replacement boundary; do not infer replacement from filenames or keyword similarity alone.
+- Retire prior-task raw tool transactions from the next model-visible request after an accepted explicit replacement, preserving their durable audit/receipt references.
+- Retain current user authority, replacement instructions, media reference evidence needed to interpret the new task, and explicitly adopted cross-task dependencies.
+- Do not treat a status question, additive instruction, or priority change as destructive task replacement.
+- Keep canonical goal and evidence selection consistent across continuation/restoration and integrate with WO-25.
+
+## Acceptance checklist
+
+- [x] A two-project replacement replay excludes obsolete raw source while preserving current task instructions and required new evidence.
+- [x] Status-only and additive steering preserve relevant active-task context.
+- [x] Retired evidence remains durably retrievable; tool call/result pairs remain valid.
+- [x] Restored continuation uses the same scope boundary without resurrecting obsolete raw history.
+- [x] Integrated compiler/projection replay proves scope retirement does not trigger useless compaction.
+- [x] Focused steering/context tests and orchestrator typecheck pass.
+
+## Implementation and verification log
+
+- Initial regression reproduced overwritten text authority, retained obsolete raw history, and unvalidated retained tool IDs (three failing cases).
+- Typed reconciliation batches unresolved text/media and advances scope only for an accepted replacement, with no lexical task classifier. Transport replacement acknowledgement cannot advance twice.
+- Exact immutable transition archives include messages, todos, workboard, completion ledger, and task state. File/directory sync precedes lifecycle epoch advancement and retirement.
+- Later safe transcripts are checkpointed separately so restart retains work performed after replacement. Early recovery selects current goal before startup analysis.
+- Reset covers secondary evidence/context caches, world facts, task trajectory, phase tree, and verifier authority. Explicitly adopted complete tool transactions remain model-visible.
+- Independent review exposed and drove repairs for cache reinjection, structured-state archive loss, restore progress loss, and identical text in later task scope. Final verification and commit evidence follow below.
+
+## Verification result
+
+- Runner scope regressions: **13 passed**; pure boundary regressions: **11 passed**.
+- Durable interruption lifecycle: **25 passed**; content-addressed archive store: **10 passed**.
+- Full mocked `runner.run()` replacement replay: **2 passed**, exercising primary and brute-force request paths, grouped text/audio, exact epoch advancement, evidence retirement, and retained core policy.
+- Existing core-policy regressions: **3 passed**, covering small, medium, and large tiers.
+- Compiler/canonical/steering integration regression set passed. Clean workspace build passed for all 11 packages/apps.
+- Final scope reset includes observation and source ledgers, contract registry, local tool cache, world facts, recovery-controller delta, phase tree, and cached prior-task retrieval. Current workspace inventory remains observable.
+- Identical later user replies survive restore: selectors recognize the original archived prefix and stop retirement at the new authority/epoch boundary.
+- Runtime policy has typed metadata and stays in separate bounded system messages. This avoids losing core rules to first-system truncation while retiring old task recall.
+- Full aggregate suite and commit evidence are recorded in the program ledger.
+
+## Delivery
+
+- Commit: `24321b30` on `origin/main`.
+- Final archive-directory sync refinement passed both scope suites (**15 tests**) and an additional workspace build. Full aggregate evidence is in the linked program ledger.
+
+## Publication boundary
+
+Repository repair and deterministic verification are this order's completion
+boundary. The user will publish the package and then perform live validation.
+No package publication, installed-package replacement, runtime-state repair,
+or service restart is authorized by this order.
+

package/docs/work-orders/runtime-health-remediation/WO-29-retired-failure-projections.md

@@ -0,0 +1,85 @@
+# WO-29: Exclude retired failures from active diagnostics
+
+**Status:** complete; implemented, verified, and pushed to origin/main
+**Priority:** P2
+**Incident date:** 2026-09-04 PDT / 2026-09-05 UTC
+**Program:** [September 4 Telegram long-haul repairs](TELEGRAM-LONGHAUL-2026-09-04.md)
+
+## Observed failure
+
+Current transcription and shell-timeout recovery cards were retired at 19:58 PDT with supersededBy='failure-expired:turn-19', yet unresolved-failure diagnostics still appeared at 20:35. This is contradictory active recovery context; it was not proven to be a terminal blocker.
+
+## Evidence
+
+Paths are relative to /home/roko/Documents/Projects/Adjacent. Live files are
+observational references; sanitized deterministic fixtures must reproduce the
+failure without copying credentials or private conversation content.
+
+- `telegram_test/.omnius/workboards/telegram-64ac9937dc7647a8-1788572475259-1/active.json`
+
+## Root cause
+
+Failure retirement preserves status for audit and marks `supersededBy`.
+Workboard active diagnostic derivation checked failure card ID/status but
+ignored supersession. The same omission affected compact card counts and
+selection, synthesis blockers and verified evidence, and the diagnostics tool
+view. Cached snapshots could retain the old derived warnings even after a
+runtime upgrade.
+
+## Code locations
+
+- `packages/execution/src/tools/workboard.ts — active-card selection, diagnostic derivation, projections`
+- `packages/execution/tests/workboard.test.ts`
+- `packages/orchestrator/tests/workboard-run-continuity.test.ts`
+
+## Repair design
+
+- Use consistent active-card lifecycle semantics in derived workboard diagnostics and active projections.
+- Exclude superseded/expired obligations from unresolved counts and actionable warnings while preserving historical cards and diagnostic records where explicitly historical.
+- Do not relabel expiration as successful verification.
+- Ensure a genuinely new recurrence creates/activates the correct obligation without resurrecting retired state accidentally.
+
+## Acceptance checklist
+
+- [x] An expired/superseded in-progress failure no longer emits active unresolved-failure diagnostics.
+- [x] A current unresolved failure still emits its bounded warning.
+- [x] Retirement preserves the original failure and its audit trail without fabricating verification.
+- [x] Fresh recurrence is represented correctly and legacy cards without supersession retain behavior.
+- [x] Focused workboard/lifecycle tests and execution typecheck pass.
+
+## Implementation and verification log
+
+- A single active-card predicate now excludes `supersededBy` cards from compact
+  counts, card limits, hidden-card counts, synthesis, and newly derived failure
+  and dependency diagnostics. The existing ownership-frontier check uses the
+  same predicate.
+- Active diagnostic projection filters recorded or cached historical warnings
+  for retired cards before model-output limits are applied. Full JSON, raw
+  cards, status, evidence, and append-only events preserve the audit history.
+  An explicitly returned compact card includes its supersession marker.
+- Retirement supplies no verification evidence. A live card depending on a
+  retired but unverified card remains blocked; the dependent obligation must
+  be explicitly reconciled. A new recurrence receives its own active warning.
+- Before the repair, regression fixtures reproduced retired-card
+  `unresolved_failure_card`/`repeated_worker_failure` warnings and a board
+  containing only retired cards failing to report its empty active frontier.
+- Hermetic verification on 2026-09-05 UTC:
+  - `pnpm --filter @omnius/execution exec vitest run tests/workboard.test.ts`:
+    **37 tests passed**, including cached-snapshot projections, replay/reload,
+    preserved failed evidence, fresh recurrence, and dependency safety.
+  - `pnpm --filter @omnius/orchestrator exec vitest run tests/workboard-run-continuity.test.ts`:
+    **10 tests passed**.
+  - `pnpm --filter @omnius/execution typecheck`: **passed**.
+- Repository delivery commit will be recorded by the parent repair task.
+
+## Delivery
+
+- Commits: `3a1731ad` on `origin/main`.
+- Clean `pnpm -r build` passed for all 11 workspace packages/apps. Final aggregate suite evidence is in the linked program ledger.
+
+## Publication boundary
+
+Repository repair and deterministic verification are this order's completion
+boundary. The user will publish the package and then perform live validation.
+No package publication, installed-package replacement, runtime-state repair,
+or service restart is authorized by this order.

package/docs/work-orders/runtime-health-remediation/WO-30-structured-tool-invocation.md

@@ -0,0 +1,65 @@
+# WO-30: Tool execution must come from structured calls
+
+**Status:** complete in repository; verified for user publication
+**Priority:** P1
+**Program:** [September 5 tool-quality and live-behavior follow-up](TOOL-QUALITY-2026-09-05.md)
+
+## Observed failure
+
+Live descriptive text containing “shell tool interface” triggered two escalating call corrections. Source review additionally found automatic execution of bash/sh/shell/zsh response fences through a direct shellTool.execute path, bypassing normal tool validation, interruption receipts, and mutation accounting.
+
+## Evidence and code locations
+
+- Installed runtime: Omnius 1.0.695, active run telegram-64ac9937dc7647a8-1788593533269-1.
+- Observation window: 2026-09-05 00:32–00:41 PDT.
+- Live evidence: sibling telegram_test/.omnius/context-window-dumps/ and context/steering-ledger.jsonl; sanitized reproductions must avoid private conversation bodies.
+- packages/orchestrator/src/agenticRunner.ts; packages/orchestrator/tests/edit-transport-guidance.test.ts
+
+## Root repair
+
+Remove prose/fence-to-execution and tool-name keyword coercion. Keep ordinary assistant prose and examples as text. Execute only actual structured tool calls through the existing admission path. Update the advertised protocol.
+
+## Acceptance
+
+- [x] A documentation fence executes no shell; descriptive tool names cause no coercion; genuine structured calls still execute and receive ordinary receipts.
+- [x] Reproduce before repair with deterministic tests.
+- [x] Focused regressions, affected typechecks, and workspace build pass.
+- [x] Independent review is resolved and scoped commits delivered to origin/main.
+
+## Implementation and verification ledger
+
+Removed the entire response-fence execution path, the keyword narration classifier, its escalation counter and obsolete file-write heuristic. Updated the runtime protocol. Added structured-tool-authority.test.ts with four shell-language fences, descriptive tool discussion, and a genuine structured-call control. Replaced the obsolete source assertion in edit-transport-guidance.test.ts.
+
+Baseline replay: five of six behavioral tests failed against 835fda0f (all four fences executed; descriptive text caused a coercive correction); structured execution passed. After repair: nine tests across both files passed. Logs: /tmp/omnius-wo30-before.log and /tmp/omnius-wo30-test.log. Aggregate build/review and final delivery are recorded in the program ledger.
+
+## Runtime boundary
+
+Repair the repository. Preserve live Telegram state, installed package, existing publish/ and docs/DISCOVERY.* changes. No live inference, GPU workloads, service restart, package publication, or external messaging. The user owns publication and later live validation.
+
+### Independent review: XML protocol admission
+
+Review reproduced a second bypass: parseTextToolCalls promoted XML examples from arbitrary prose into actions, including for native Qwen requests. The parser now requires explicit host opt-in and a complete standalone envelope sequence. Fenced/prose examples remain intact and inert, malformed batches reject as a whole, and each accepted call receives a unique transaction ID. Thirteen model-profile tests pass (/tmp/omnius-wo30-xml.log). Runner provider/stream and explicit JSON text-mode integration is recorded below.
+
+### Runner protocol integration
+
+Provider adapters now normalize only actual wire `tool_calls`. Canonical runner dispatch selects XML from the host's Hermes profile, or JSON from explicit text mode/the individual tools-unsupported retry. Whole standalone envelopes enter ordinary argument validation, tool accounting, interruption, steering, and completion handling. Native transactions take precedence. Code fences, prose, malformed sequences, and structured-output contracts do not grant text-call authority.
+
+Removed the retry's fenced-JSON extraction and direct execution branch. Restored the constructor's omitted `textToolMode` option; explicit text mode advertises the standalone JSON grammar and keeps API tools disabled after exposure refreshes. Streaming uses the same admission rules and preserves inert XML examples. A chunk-ending newline no longer becomes an empty internal-marker prefix, preserving fenced output across arbitrary chunk widths.
+
+**110 tests passed across seven suites**, including 38 production/provider authority cases, 34 typed-output tests, 22 evidence-steering tests (primary/brute and crash-point recovery), 13 model-profile tests, and three guidance tests. Orchestrator typecheck passed. Logs: `/tmp/omnius-wo30-final.log` and `/tmp/omnius-wo30-types-final.log`. The final explicit-mode exposure-refresh assertion is checked separately in `/tmp/omnius-wo30-json-final.log`. All tests use synthetic workspaces and mocked transports; no live inference or Telegram requests.
+
+Final independent review confirmed whole-payload admission and native-call precedence, and found that text catalogs omitted argument schemas. Both text surfaces now serialize host-prepared definitions with full public parameters and a final profile filter. The updated **40 authority cases passed**, including allowed-schema/denied-tool assertions for both explicit mode and the unsupported-tools retry; final orchestrator typecheck passed. Log: `/tmp/omnius-wo30-schema-final.log`. Review findings are resolved; parent owns aggregate clean build and delivery.
+
+Aggregate follow-up: keep hidden think blocks out of the visible provider answer while leaving XML tool examples inert. Removing content-derived invocation had also removed the older incidental reasoning strip; the provider boundary now applies only the dedicated reasoning-strip helper. All 67 tests across provider pool/recovery and the 40-case structured-tool authority matrix passed; /tmp/omnius-wo30-think-recovery.log.
+
+## Repository closure — September 5
+
+All confirmed findings and independent review follow-ups in this order are resolved. The [program verification ledger](TOOL-QUALITY-2026-09-05.md#verification-ledger) records the final full suites and clean build. Earlier pending integration notes above are historical and superseded by this closure.
+
+Scoped repair commits delivered to origin/main: d2cbec82, e0da0aa6, 4465c9b2, 49f34183. Publication and subsequent live acceptance remain with the user.
+
+Source and integration locations:
+
+- [packages/orchestrator/src/agenticRunner.ts](../../../packages/orchestrator/src/agenticRunner.ts)
+- [packages/orchestrator/src/modelProfile.ts](../../../packages/orchestrator/src/modelProfile.ts)
+- [packages/orchestrator/src/typed-model-output.ts](../../../packages/orchestrator/src/typed-model-output.ts)

package/docs/work-orders/runtime-health-remediation/WO-31-complete-runtime-policy.md

@@ -0,0 +1,62 @@
+# WO-31: Preserve complete typed runtime policy
+
+**Status:** complete in repository; verified for user publication
+**Priority:** P1
+**Program:** [September 5 tool-quality and live-behavior follow-up](TOOL-QUALITY-2026-09-05.md)
+
+## Observed failure
+
+The published main prompt is cut at exactly 8,000 characters, mid-sentence. The later medium-model controller and appended agent operating contract never reach the model, despite roughly 80% free context. The separate core reference contract survives.
+
+## Evidence and code locations
+
+- Installed runtime: Omnius 1.0.695, active run telegram-64ac9937dc7647a8-1788593533269-1.
+- Observation window: 2026-09-05 00:32–00:41 PDT.
+- Live evidence: sibling telegram_test/.omnius/context-window-dumps/ and context/steering-ledger.jsonl; sanitized reproductions must avoid private conversation bodies.
+- packages/orchestrator/src/agenticRunner.ts; packages/orchestrator/src/context-compiler.ts; packages/orchestrator/src/artifactContract.ts
+
+## Root repair
+
+Preserve runtime-owned policy bodies as complete bounded structural sections through both compiler modes and final projection. Continue bounding untrusted/dynamic system material. Use actual request budgeting; do not silently sever invariant tool instructions.
+
+## Acceptance
+
+- [x] Large invariant policy reaches final requests intact with headroom; untrusted dynamic blocks remain bounded; tight budgets return an explicit capacity outcome; existing small/medium/large contract tests pass.
+- [x] Reproduce before repair with deterministic tests.
+- [x] Focused regressions, affected typechecks, and workspace build pass.
+- [x] Independent review is resolved and scoped commits delivered to origin/main.
+
+## Implementation and verification ledger
+
+Runtime-owned policyScope metadata now takes priority over textual controller/receipt examples. Policy bodies split into complete sections (at most 8,000 characters) without losing text. Legacy compaction reserves their full capacity, emits an explicit error if policy alone exceeds its budget, and neither GC nor the signal distiller can trim/drop their content. Active compilation retains final canonical request-budget admission, including protected-overflow refusal. Dynamic project state remains independently bounded.
+
+Added runtime-policy-delivery.test.ts: exact section reconstruction, both compiler modes, actual medium-tier backend requests, explicit impossible capacity, and untrusted textual-marker control. Task-replacement production tests also require the full operating contract after retirement. Updated controller selectors to recognize actual envelope lines rather than quoted examples in the newly visible policy.
+
+Baseline replay of the actual active backend request test failed against d2cbec82 (operating policy missing); fixed focused set passes 33 distinct tests across five files. Orchestrator typecheck passes. Logs: /tmp/omnius-wo31-before.log, /tmp/omnius-wo31-test.log, /tmp/omnius-wo31-artifact.log, /tmp/omnius-wo31-types.log. Aggregate verification and independent review remain tracked by the program.
+
+### Final admission follow-up
+
+Independent aggregate testing exposed another downstream loss boundary in `context-admission.ts`: policy metadata was ignored, a trailing system message stopped latest-tool protection, and the emergency projection clipped policy or discarded tool transactions to manufacture an admissible request. Four deterministic admission regressions failed before this repair.
+
+Final admission now preserves every typed runtime policy section and matches the latest complete tool batch by transaction IDs across trailing system messages. Emergency admission removes only discardable history and retains protected authority, full source results and their metadata. When that complete payload cannot fit, it returns an explicit rejection with zero admitted output tokens. It no longer clips the current user request or replaces it with invented recovery instructions.
+
+The small-source headroom fixture now reserves space for the complete policy: synthetic resident noise was reduced from 1,000 to 300 repetitions, and both actual outbound admission budgets are asserted at or below the 16,000-token window. The explicit 9 KB full read remains intact. Updated admission, policy-delivery and evidence-branch suites pass all 34 tests, including both compiler modes through the final admission method, impossible policy/full-read capacity, and emergency tool-batch preservation. Orchestrator typecheck and scoped diff checks pass. All backends are mocked; no live inference or runtime changes were used.
+
+## Runtime boundary
+
+Repair the repository. Preserve live Telegram state, installed package, existing publish/ and docs/DISCOVERY.* changes. No live inference, GPU workloads, service restart, package publication, or external messaging. The user owns publication and later live validation.
+
+Aggregate recovery fixture reconciliation: the prior synthetic learned ceiling left less capacity than the complete policy itself, so the repaired boundary correctly rejected it. The successful-recovery fixture now supplies a ceiling that can fit the complete policy and asserts byte-for-byte policy preservation, changed request identity, reduced output/prefix and total request fit. Impossible capacities retain separate rejection coverage. All 25 context recovery/admission/runtime-policy tests passed; /tmp/omnius-wo31-recovery.log.
+
+## Repository closure — September 5
+
+All confirmed findings and independent review follow-ups in this order are resolved. The [program verification ledger](TOOL-QUALITY-2026-09-05.md#verification-ledger) records the final full suites and clean build. Earlier pending integration notes above are historical and superseded by this closure.
+
+Scoped repair commits delivered to origin/main: 8f3134f0, 08577d79, c6ec5040. Publication and subsequent live acceptance remain with the user.
+
+Source and integration locations:
+
+- [packages/orchestrator/src/agenticRunner.ts](../../../packages/orchestrator/src/agenticRunner.ts)
+- [packages/orchestrator/src/context-compiler.ts](../../../packages/orchestrator/src/context-compiler.ts)
+- [packages/orchestrator/src/context-admission.ts](../../../packages/orchestrator/src/context-admission.ts)
+- [packages/orchestrator/src/artifactContract.ts](../../../packages/orchestrator/src/artifactContract.ts)

package/docs/work-orders/runtime-health-remediation/WO-32-evidence-dependent-steering.md

@@ -0,0 +1,55 @@
+# WO-32: Resolve task scope after referenced evidence arrives
+
+**Status:** complete in repository; verified for user publication
+**Priority:** P1
+**Program:** [September 5 tool-quality and live-behavior follow-up](TOOL-QUALITY-2026-09-05.md)
+
+## Observed failure
+
+The latest explicit switch request was reconciled before its referenced audio was transcribed. Transcription succeeded and subsequent reads switched to boutique-agent-services, but taskEpoch stayed 1, no boundary archive was created, the canonical goal remained the old task projection, and old raw source stayed active. Persisted lifecycle entries omit parsed reconciliation fields, so omitted disposition versus explicit continue cannot be distinguished.
+
+## Evidence and code locations
+
+- Installed runtime: Omnius 1.0.695, active run telegram-64ac9937dc7647a8-1788593533269-1.
+- Observation window: 2026-09-05 00:32–00:41 PDT.
+- Live evidence: sibling telegram_test/.omnius/context-window-dumps/ and context/steering-ledger.jsonl; sanitized reproductions must avoid private conversation bodies.
+- packages/orchestrator/src/{agenticRunner,steeringIntake,typed-model-output}.ts; task scope production tests
+
+## Root repair
+
+Make scope decisions explicit and auditable, supporting a bounded evidence-read phase before final reconciliation when the new objective depends on referenced media/source. Preserve the current user request and relevant tool result; prevent unrelated old-plan mutations until scope is resolved. No lexical replacement classifier.
+
+## Acceptance
+
+- [x] A replacement referring to untranscribed audio can read that evidence and then retire old scope exactly once; additive/status requests remain continuation; reconciliation decisions are persisted and recovery-safe.
+- [x] Reproduce before repair with deterministic tests.
+- [x] Focused regressions, affected typechecks, and workspace build pass.
+- [x] Independent review is resolved and scoped commits delivered to origin/main.
+
+## Implementation and verification ledger
+
+- Added `resolve_after_evidence` with 1–4 exact registered read-call declarations per phase, at most 3 phases. Names, IDs, raw arguments, parsed read modes, profiles, and single-use tickets constrain admission. Unrelated effects and completion stay gated. The canonical `transcribe_file` exception admits only local-file extraction parameters; general tool metadata remains conservative.
+- Applied reconciliations require explicit disposition. The protected user-authority slot and completion obligation remain unresolved through evidence reads. Final replacement adopts the declared evidence transactions and uses the existing durable scope boundary exactly once; explicit additive continuation keeps the epoch.
+- Parsed decisions are persisted with run/epoch/input correlation for both primary and related inputs. A flushed artifact plus atomic selector stores exact authority, goal, evidence tickets, and transcript even before the first scope boundary.
+- Ticket claims are durable before dispatch. Recovery validates identities and normalized transaction arguments, reports interrupted reads without replay, restores the original goal, and preserves the admission gate. Persistence failures cannot grant in-memory continuation.
+- WO35 integration supplies the full scope to file-exploration notes and rebinds tool state at initial run admission and task epoch changes.
+- **77 tests passed** across steering, typed-output, and scope suites before final durability tightening. **22 tests passed** afterward, including primary/brute evidence→replacement and real mocked `runner.run()` crash-point recovery. Orchestrator `tsc --noEmit` passed.
+- Independent review found two defects in the draft: claim persistence occurred too late, and restored receipt anchors lacked argument matching. Both were repaired and covered by the durability tests. Final parent review confirmed argument matching, epoch-before-checkpoint ordering, fail-closed persistence, and exact ticket admission; no additional concrete defect remained in those paths. No live inference or Telegram requests were used.
+- Parent owns final workspace clean build, aggregate checks, and push.
+
+## Runtime boundary
+
+Repair the repository. Preserve live Telegram state, installed package, existing publish/ and docs/DISCOVERY.* changes. No live inference, GPU workloads, service restart, package publication, or external messaging. The user owns publication and later live validation.
+
+## Repository closure — September 5
+
+All confirmed findings and independent review follow-ups in this order are resolved. The [program verification ledger](TOOL-QUALITY-2026-09-05.md#verification-ledger) records the final full suites and clean build. Earlier pending integration notes above are historical and superseded by this closure.
+
+Scoped repair commits delivered to origin/main: 5276b844. Publication and subsequent live acceptance remain with the user.
+
+Source and integration locations:
+
+- [packages/orchestrator/src/agenticRunner.ts](../../../packages/orchestrator/src/agenticRunner.ts)
+- [packages/orchestrator/src/steeringIntake.ts](../../../packages/orchestrator/src/steeringIntake.ts)
+- [packages/orchestrator/src/steeringEvidence.ts](../../../packages/orchestrator/src/steeringEvidence.ts)
+- [packages/orchestrator/src/typed-model-output.ts](../../../packages/orchestrator/src/typed-model-output.ts)

package/docs/work-orders/runtime-health-remediation/WO-33-file-mutation-transactions.md

@@ -0,0 +1,55 @@
+# WO-33: Truthful file mutation transactions
+
+**Status:** complete in repository; verified for user publication
+**Priority:** P1
+**Scope:** file_write, file_edit, file_patch, batch_edit, notebook_edit, structured_file
+
+## Reproduced failures
+
+- A second batch destination with denied write permission caused an exception after the first file changed, without a mutation receipt.
+- Two file_edit calls using the same starting hash both succeeded and lost one edit in 8/8 isolated trials.
+- A target and its symlink alias were staged separately; the second write erased the first edit.
+- file_write continued after an existing-file read error and overwrote a writable, unreadable file without overwrite or hash authorization.
+- Invalid supplied hashes were interpreted as absent. Missing old anchors plus replacement text elsewhere falsely produced already-applied success.
+
+## Implementation
+
+The shared file-mutation boundary resolves symlink targets and serializes cooperating tool instances by canonical path. Every destination is read and validated before committing. Complete UTF-8 bodies and original-content rollback copies are staged beside each destination. Existing files are replaced by rename; new files use exclusive linking of their complete staged body. Hashes and aliases are checked again before each commit.
+
+If a later commit fails, previous writes are rolled back when their current bytes still match this transaction. The returned result reports partial mutation and the exact unrestored paths when rollback fails; original-content recovery files are retained and named in the error. Invalid UTF-8, unreadable preimages, invalid hash arguments and unsupported hard links fail closed. All six mutation tools use the same boundary and strict hash guard.
+
+An absent old anchor now requires fresh inspection even if replacement text occurs elsewhere. True content-preserving edits still return no-op, and cancelling batch edits no longer emit APPLIED lines.
+
+## Guarantees and limits
+
+- Serialization covers cooperating calls in this Node process, including different tool instances and symlink aliases. It does not lock independent processes or arbitrary external writers.
+- Individual replacements are atomic. A multi-file batch is staged and rollback-capable, **not crash-atomic**. The process can stop between renames; there is no durable transaction recovery journal.
+- A final pre-commit check reduces external-writer races but cannot provide an operating-system compare-and-swap against unrelated writers.
+- Multiply linked existing files are rejected instead of silently breaking hard-link semantics. Parent directories created for a new file can remain after a failed transaction.
+- Ordinary permission bits are explicitly restored after staging so umask cannot silently narrow an existing mode. Special set-id/sticky bits are rejected. Atomic replacement does not promise preservation of external ACLs, extended attributes or original file ownership.
+- A supplied hash requires an existing preimage; file_write and structured_file cannot recreate a deleted file under its stale hash, including during dry runs.
+
+## Verification
+
+Hermetic tests exercise concurrent tools, symlink aliases, staging failure, second-rename failure, rollback failure with retained recovery bytes, read-denied overwrite refusal, exclusive creation races, invalid hashes across all six tools, invalid UTF-8 and hard links, and cancelling no-ops.
+
+- Final focused run: **112 tests passed** across file-mutation, file-edit/write/patch, batch-edit, notebook-edit and structured-file suites.
+- `pnpm --filter @omnius/execution typecheck`: **passed**.
+- No live inference, service mutation, installed runtime changes or package publication.
+
+## Repository closure — September 5
+
+All confirmed findings and independent review follow-ups in this order are resolved. The [program verification ledger](TOOL-QUALITY-2026-09-05.md#verification-ledger) records the final full suites and clean build. Earlier pending integration notes above are historical and superseded by this closure.
+
+Scoped repair commits delivered to origin/main: a12d6bd2, be0b126b. Publication and subsequent live acceptance remain with the user.
+
+Source and integration locations:
+
+- [packages/execution/src/tools/file-mutation.ts](../../../packages/execution/src/tools/file-mutation.ts)
+- [packages/execution/src/tools/edit-metadata.ts](../../../packages/execution/src/tools/edit-metadata.ts)
+- [packages/execution/src/tools/file-write.ts](../../../packages/execution/src/tools/file-write.ts)
+- [packages/execution/src/tools/file-edit.ts](../../../packages/execution/src/tools/file-edit.ts)
+- [packages/execution/src/tools/file-patch.ts](../../../packages/execution/src/tools/file-patch.ts)
+- [packages/execution/src/tools/batch-edit.ts](../../../packages/execution/src/tools/batch-edit.ts)
+- [packages/execution/src/tools/notebook-edit.ts](../../../packages/execution/src/tools/notebook-edit.ts)
+- [packages/execution/src/tools/structured-file.ts](../../../packages/execution/src/tools/structured-file.ts)

package/docs/work-orders/runtime-health-remediation/WO-34-shell-authority-and-results.md

@@ -0,0 +1,46 @@
+# WO-34: Shell authority and trustworthy process outcomes
+
+**Status:** complete in repository; verified for user publication
+**Priority:** P1
+
+## Reproduced failures
+
+`find . -delete`, `git branch -D topic` and a `pwd; python3 ...` writer were classified as read-only/concurrency-safe by command-prefix matching. The runner converts that classification into read-only interruption effect tickets.
+
+Printing `exit_code: 0` and then exiting 7 produced a failed tool result with structured `primaryExitCode: 0` and `runnerExitCode: 0`. Those fields were reconstructed from rendered command/stdout text. Displayed SIGPIPE markers could similarly override an unrelated real process failure.
+
+The legacy process registry marked recovered PID-only sessions killed without sending any signal. Its remote adapter ignored cwd and attempted to obtain exit status with `wait` from a different shell; its stated wait clamp was not applied.
+
+## Repair
+
+- Read authority requires one literal command with known read-only semantics. Compound syntax, expansion, interpreter programs, executable rg/find options, unknown options and relevant shell/preprocessor configuration stay effectful. This affects classification, not permission to execute the command.
+- Raw exit code, cwd and timeout state come from spawn callbacks. Exact trailing `echo EXIT=$?` / `EXIT_CODE=$?` forms capture the primary status into the wrapper's private file before emitting display output. Literal single-quoted reporters are ordinary output. Truncation and quoted receipt fields cannot alter primary status.
+- Policy outcomes remain distinct from actual process outcomes. SIGPIPE preview treatment requires an actual observed 141. Tool routing and recovery paths do not invent successful process exits. Elevation uses the actual current cwd.
+- The unused legacy registry is explicitly deprecated toward process-lifecycle/process-async. The environment adapter refuses launch because its API cannot establish owned process and exit receipts. Recovered or remote PID-only sessions cannot be terminated without an owned handle. Owned signals return termination_requested; only observed process exit changes terminal state. Waits now honor their configured clamp.
+
+## Scope and limits
+
+The classifier deliberately treats git and interpreter commands as effectful because hooks/configuration/code can execute additional commands. It is not a general shell parser and does not claim unknown commands are safe. The private trailing-reporter capture is implemented for the existing POSIX reporter form; unavailable primary observations remain unknown. Elevated exact reporter forms cannot establish the primary subcommand's status and do not receive a fabricated primary success.
+
+Repository searches found no production source imports or root public export of tools/process-registry; its local inspection methods remain for compatibility/tests. Its unsupported environment launch path now fails explicitly instead of pretending to supervise remote work.
+
+## Verification
+
+- Combined shell/classifier/receipt/soft-failure/registry run: **115 tests passed across five suites**.
+- Final classifier expansion: **34 tests passed**, including glob expansion and literal double-quote escaping.
+- Execution package typecheck passed.
+- Regression coverage includes real temporary-file deletion classified effectful, receipt-field collisions, false SIGPIPE, private reporter status, literal reporters, routing without execution, recovered termination refusal, termination request versus observed exit, disabled remote launch and fake-timer wait clamping.
+- Reporter capture beyond the stdout cap passed in the combined run.
+- No live inference, installed runtime changes, service changes or publication.
+
+## Repository closure — September 5
+
+All confirmed findings and independent review follow-ups in this order are resolved. The [program verification ledger](TOOL-QUALITY-2026-09-05.md#verification-ledger) records the final full suites and clean build. Earlier pending integration notes above are historical and superseded by this closure.
+
+Scoped repair commits delivered to origin/main: a6b6e149. Publication and subsequent live acceptance remain with the user.
+
+Source and integration locations:
+
+- [packages/execution/src/tools/shell-authority.ts](../../../packages/execution/src/tools/shell-authority.ts)
+- [packages/execution/src/tools/shell.ts](../../../packages/execution/src/tools/shell.ts)
+- [packages/execution/src/tools/process-registry.ts](../../../packages/execution/src/tools/process-registry.ts)

package/docs/work-orders/runtime-health-remediation/WO-35-search-and-exploration-isolation.md

@@ -0,0 +1,56 @@
+# WO-35: Search truth, exploration isolation and source coverage
+
+**Status:** complete in repository; verified for user publication
+**Priority:** P1
+
+## Reproduced failures
+
+- grep_search and file_explore appended regex text as positional command arguments. Searching for `--version` returned the utility version as successful search evidence.
+- file_explore converted invalid regexes, unavailable paths and failed fallback commands into successful no-match results. It also silently truncated search context.
+- Module-global exploration notes crossed tool instances, working directories and tasks; the runner's unscoped compaction getter could import unrelated findings.
+- file_read admitted fractional ranges and emitted inverted canonical ranges beyond EOF. Requested ends could exceed the actual source while the body was shorter.
+- list_directory omitted entries after 100 without marking incomplete coverage or providing a continuation offset. Failed metadata reads became fabricated zero-byte sizes.
+- find_files advertised path globs, but GNU find's basename-only `-name` treated `**/*.ts` as an impossible basename. During repair, a hermetic fixture also confirmed native Node glob silently treats an unreadable subtree as an empty match set.
+
+## Repair
+
+1. File exploration delegates text search to GrepSearchTool. Both rg and grep delimit pattern data with `-e` and paths with `--`. Only an unavailable rg executable permits fallback. Invalid regexes, inaccessible paths, stderr overflow and process failures remain failures. Context counts are validated. Configured rg preprocessors are disabled. Explicit large files are no longer silently excluded at 2 MiB; timeout and output caps remain bounded. Partial stdout is marked incomplete, and timeout classification uses process fields rather than pattern text in an error message.
+2. Exploration notes are keyed by canonical working directory and host-bound session, task epoch and owner. Unbound instances have private notes; unscoped export calls return no notes and cannot clear other tasks. Snapshots are defensive copies. A read already in flight keeps its original note collection when the tool is rebound. The latest 128 notes are retained per active scope, with weak registry references allowing abandoned scopes to be collected.
+3. Canonical reads and exploration chunks validate integer ranges before reading; beyond-EOF requests fail without canonical receipts or saved findings. Headers and receipts report the actual selected end. UTF-8 decoding is strict and preserves BOM bytes in source hashes.
+4. Directory inventories sort visible entries and accept validated offset/limit pagination. Capped, selected or grouped inventories carry partial materialization metadata and continuation information. Links are identified as links; missing metadata remains unknown.
+5. File discovery uses strict directory reads with minimatch for actual path/globstar semantics. Unreadable directories fail instead of becoming negative evidence. Directory symlinks and named runtime/dependency directories are skipped. Match, traversal-entry and elapsed-time limits are explicit. A direct minimatch dependency reuses the existing locked 10.2.5 package; installation succeeded offline with a frozen lockfile.
+6. The tool discovery catalog now describes batch edits as staged writes with rollback receipts, removing its stronger atomicity claim.
+
+## Runner API
+
+`getExploreNotes({ workingDir, sessionId, taskEpoch, ownerId })` and `clearExploreNotes` require the same identity used by `FileExploreTool.bindExecutionScope`. The runner must rebind registered tools on task-epoch transitions. Existing no-argument callers are inert for conservative compatibility. Parent integration handles this consumer and epoch binding; this workorder changes no runner code.
+
+## Scope and limits
+
+Searches and directory pagination are observations of a live filesystem, not a filesystem snapshot. External changes can move entries between pages. Traversal limits fail with incomplete coverage rather than asserting no files. Search excludes the declared generated/runtime directories, and grep fallback uses extended regex semantics rather than claiming full ripgrep compatibility. File discovery applies full relative-path globs while filename-only patterns match recursively. Working notes are ephemeral, bounded navigation state; normal tool history remains the durable record.
+
+Multi-file mutation crash atomicity, cross-process CAS and metadata limits are documented in WO-33. This work does not strengthen those guarantees through discovery text.
+
+## Verification
+
+- Five focused suites: **115 tests passed** across search, exploration, glob discovery, canonical file reads and directory inventory.
+- Final timeout-text regression: **24 grep tests passed**.
+- Execution package typecheck and scoped diff checks passed.
+- Behavioral fixtures cover literal option-like searches on rg and grep, a disabled executable rg preprocessor, stderr overflow, large-file search, invalid regexes and paths, partial search coverage, concurrent scope rebinding, defensive note snapshots, fractional and beyond-EOF ranges, exact BOM hashes, paginated coverage without duplicates, symlink inventory, globstar/path matching, unreadable subtrees and capped discovery.
+- No inference, network downloads, live runtime changes, service changes or publication.
+
+## Repository closure — September 5
+
+All confirmed findings and independent review follow-ups in this order are resolved. The [program verification ledger](TOOL-QUALITY-2026-09-05.md#verification-ledger) records the final full suites and clean build. Earlier pending integration notes above are historical and superseded by this closure.
+
+Scoped repair commits delivered to origin/main: 8be70469, 5276b844. Publication and subsequent live acceptance remain with the user.
+
+Source and integration locations:
+
+- [packages/execution/src/tools/grep-search.ts](../../../packages/execution/src/tools/grep-search.ts)
+- [packages/execution/src/tools/glob-find.ts](../../../packages/execution/src/tools/glob-find.ts)
+- [packages/execution/src/tools/file-explore.ts](../../../packages/execution/src/tools/file-explore.ts)
+- [packages/execution/src/tools/explore-tools.ts](../../../packages/execution/src/tools/explore-tools.ts)
+- [packages/execution/src/tools/file-read.ts](../../../packages/execution/src/tools/file-read.ts)
+- [packages/execution/src/tools/list-directory.ts](../../../packages/execution/src/tools/list-directory.ts)
+- [packages/orchestrator/src/agenticRunner.ts](../../../packages/orchestrator/src/agenticRunner.ts)

package/docs/work-orders/runtime-health-remediation/WO-36-media-evidence-integrity.md

@@ -0,0 +1,44 @@
+# WO-36: Preserve transcription evidence and requested capabilities
+
+**Status:** complete in repository; verified for user publication
+**Priority:** P1
+**Date:** 2026-09-05
+
+## Reproduced failures
+
+- Different recordings with the same basename transcribed within one second
+  overwrite the same artifacts; an earlier receipt then reads the later text.
+- A backend error object becomes successful `no_speech` evidence. A valid
+  segments-only response displays speech while returning empty model content
+  and `no_speech` status.
+- The managed Whisper branch ignores a requested `diarize: true` option.
+
+## Repair and acceptance
+
+- Give each accepted transcription its own artifacts and preserve earlier receipts.
+- Validate backend result shape before persisting or classifying silence; derive
+  transcript text from valid segments when needed.
+- Reject unsupported managed diarization before model admission, and do not
+  silently use that backend as a diarization fallback.
+- Preserve argv literally when invoking the CLI fallback.
+- Exercise all boundaries with mocked backends and temporary files only.
+
+## Verification
+
+- `pnpm exec vitest run tests/transcribe-tool-artifacts.test.ts tests/transcribe-python-runtime.test.ts`
+  from `packages/execution`: **18 passed**.
+- `pnpm exec tsc --noEmit` from `packages/execution`: passed.
+- The new artifact cases freeze time and verify that each receipt still reads
+  its own original text. Failed/malformed results create no evidence artifacts;
+  segments-only results preserve speech in model content and storage.
+- No live inference, package installation, service changes, or publication.
+
+## Repository closure — September 5
+
+All confirmed findings and independent review follow-ups in this order are resolved. The [program verification ledger](TOOL-QUALITY-2026-09-05.md#verification-ledger) records the final full suites and clean build. Earlier pending integration notes above are historical and superseded by this closure.
+
+Scoped repair commits delivered to origin/main: 8d4e5ce5. Publication and subsequent live acceptance remain with the user.
+
+Source and integration locations:
+
+- [packages/execution/src/tools/transcribe-tool.ts](../../../packages/execution/src/tools/transcribe-tool.ts)