omnius 1.0.694 → 1.0.696

package/docs/work-orders/runtime-health-remediation/WO-37-browser-and-process-lifecycle.md

@@ -0,0 +1,86 @@
+# WO-37: Preserve browser ownership and process outcome truth
+
+**Status:** complete in repository; verified for user publication
+**Priority:** P1
+**Date:** 2026-09-05
+
+## Reproduced failures
+
+- Separate browser tool instances inherit a module-global session; HTTP 500
+  responses with positive JSON become successful actions. Session/action HTTP
+  calls lack deadlines, and close can terminate another client's service.
+- A video worker timing out can exit zero and be accepted, or ignore TERM and
+  leave the operation pending forever. Output buffers are unbounded.
+- A Carbonyl worker exiting nonzero is accepted when its last stdout line says
+  `ok: true`; cancellation does not reliably drain child processes.
+
+## Repair and acceptance
+
+- Own browser session state per tool instance, close only that session, and
+  validate bounded HTTP responses across session and action calls.
+- Connect browser cancellation to outstanding HTTP requests.
+- Reuse the shared process runner for deadlines, bounded output, process-group
+  termination, and exit status; preserve progress reporting and diagnostics.
+- Test ownership, transport contradictions, timeouts, cancellation, and worker
+  exit contradictions using hermetic fixtures without live models or services.
+
+## Verification
+
+- Browser session state is instance-owned. Every POST carries its session id,
+  including close; closing one session no longer kills the shared service.
+  Failed closure retains the handle for truthful recovery.
+- Browser HTTP deadlines cover response bodies, not only headers. JSON shape,
+  positive action receipts, and HTTP status are checked independently, and
+  active requests honor the tool's cancellation hook.
+- Video and Carbonyl workers use `runProcessBuffer` with bounded output and
+  process-group termination. Timeout/abort/overflow errors stay failures even
+  if a worker's shutdown handler emits exit zero or positive JSON.
+- `pnpm exec vitest run --maxWorkers=4 --minWorkers=1 tests/browser-action-lifecycle.test.ts tests/browser-action-screenshot.test.ts tests/media-worker-lifecycle.test.ts tests/video-generate.test.ts`
+  from `packages/execution`: **36 passed**.
+- `pnpm exec tsc --noEmit` from `packages/execution`: passed.
+- Worker tests use in-memory event emitters and mocked process leases; browser
+  tests use mock fetch with live subprocess setup forbidden. No model loading,
+  external requests, live browser sessions, or service changes occurred.
+- Parent owns integration and push; publication is excluded.
+
+## Ownership review follow-up
+
+Review found a remaining launch path that killed every listener on the configured browser port after a capability mismatch. Port occupancy is not proof of process ownership. The launcher now returns a clear incompatible-service failure without invoking shell cleanup or spawning a replacement. A focused regression asserts the existing service is untouched; all 10 browser lifecycle tests passed in /tmp/omnius-wo37-ownership.log.
+
+## Nested Playwright ownership and Stop follow-up
+
+Carbonyl's text fallback constructs `PlaywrightBrowserTool`. Its prior module-global browser/page/context and diagnostic buffers meant a cancellation hook could close another tool instance's flow. These handles now belong to each tool instance; stateful helpers use that instance's asynchronous scope, and event listeners capture their owning session explicitly. Events from an old closed page cannot enter the replacement page's diagnostics. Same-instance overlapping calls are rejected.
+
+`cancel()` closes only the owned page/context/browser, waits for asynchronous cleanup, and prevents a late launch or completed request from becoming successful after Stop. Every layer receives cleanup even if another layer fails. Failed closure retains the affected handle for retry and returns failure. Playwright package/browser installation now uses the shared asynchronous argv process runner with the invocation signal and process-group cleanup. The visual-click lookup receives the same signal and checks cancellation before any DOM fallback or subsequent action; its backend cancellation is implemented in the coordinated vision repair.
+
+Review also confirmed two synchronous screenshot conversion shell commands, including interpolation of caller-controlled output paths. Both use one bounded asynchronous Python argv/stdin helper now. Image bytes never enter shell or Python program text; cancellation cannot become a successful image fallback, and empty/non-JPEG conversion output preserves the original PNG instead of being labeled JPEG.
+
+Focused verification: **40 tests passed across six suites** (`audio-generation-cancellation`, `audio-generate`, `playwright-browser-cancellation`, `playwright-browser-contract`, `playwright-browser-install`, `playwright-image-conversion`). Execution `tsc --noEmit` and scoped `git diff --check` passed. Browser tests use synthetic objects and conversion stubs; no browser, inference, network, or capture operation ran. Parent owns aggregate review/push. Nested Carbonyl signal wiring is a separate coordinated commit.
+
+## Invocation and service-startup cancellation follow-up
+
+Independent review found that cancelling startup returned without draining the newly spawned server, asynchronous spawn errors had no handler, repeated readiness probes could extend a nominal 60-second wait to roughly seven minutes, and cleanup addressed a mutable global child without establishing a private process group.
+
+- A shared owned-service primitive now retains an immutable child handle, creates a private process group, handles asynchronous spawn failures, and enforces one absolute readiness deadline, including stalled probes. TERM escalates to KILL; an undrained process is reported explicitly. Any service-parent close also terminates the remaining owned group, including unexpected exit and synchronous TERM-close. Parent signal handlers are shared and removed after the final owned service closes.
+- Browser startup has one shared launch promise with separate waiting owners. Cancelling one waiter preserves another waiter's startup; cancelling the final waiter drains only the child created by that launch. Ready shared services and incompatible external listeners are not terminated by an individual tool action.
+- Browser and Carbonyl instances reject overlapping execution. Cancelled health probes retain the known browser session. Carbonyl cancellation reaches setup, Python workers, and its nested Playwright fallback. Browser vision-click passes the same owner signal through point discovery and does not dispatch a click after cancellation.
+- Five browser/service suites passed **30 tests** after the visual-point regression; the broader combined follow-up run passed **87 tests across 13 suites**. Tests use mocked services/processes and synthetic inputs; explicit regressions cover both remaining-group cleanup cases requested in independent review. Execution typecheck and scoped diff checks passed.
+
+Carbonyl nested cleanup receipt follow-up: a failed Playwright close now makes the fallback fail and retains the browser on the owning Carbonyl instance. Before admitting another action, that instance retries the retained cleanup; it clears the handle only after a successful close receipt. Cancellation preserves any cleanup error in the returned failure. The focused Carbonyl suite passed **3 tests**, including a failed close, blocked new work during retry failure, and successful ownership release.
+
+## Repository closure — September 5
+
+All confirmed findings and independent review follow-ups in this order are resolved. The [program verification ledger](TOOL-QUALITY-2026-09-05.md#verification-ledger) records the final full suites and clean build. Earlier pending integration notes above are historical and superseded by this closure.
+
+Scoped repair commits delivered to origin/main: 0d6dcc66, fe3c6487, 52cb2623, 484938c1, 72382afa, 4a072473. Publication and subsequent live acceptance remain with the user.
+
+Source and integration locations:
+
+- [packages/execution/src/tools/browser-action.ts](../../../packages/execution/src/tools/browser-action.ts)
+- [packages/execution/src/tools/carbonyl-browser.ts](../../../packages/execution/src/tools/carbonyl-browser.ts)
+- [packages/execution/src/tools/playwright-browser.ts](../../../packages/execution/src/tools/playwright-browser.ts)
+- [packages/execution/src/tools/vision.ts](../../../packages/execution/src/tools/vision.ts)
+- [packages/execution/src/owned-service-process.ts](../../../packages/execution/src/owned-service-process.ts)
+- [packages/execution/src/process-async.ts](../../../packages/execution/src/process-async.ts)
+
+The [point-localization cancellation follow-up](WO-37-point-localization-cancellation.md) closes the nested vision boundary under this same work order.

package/docs/work-orders/runtime-health-remediation/WO-37-point-localization-cancellation.md

@@ -0,0 +1,24 @@
+# WO-37 follow-up: Cancel the active point-localization client
+
+**Status:** complete in repository; verified for user publication
+**Parent:** [WO-37 browser and process lifecycle](WO-37-browser-and-process-lifecycle.md)
+
+## Confirmed boundary
+
+Browser visual clicks await `locateImagePoints`, which previously accepted no caller signal. Its Ollama requests used independent deadlines, its HF point worker and dependency setup blocked in synchronous subprocesses, and the Moondream 0.2 SDK exposes neither a signal nor the underlying HTTP request handle. Closing a browser could leave this work running and permit model fallback after cancellation.
+
+## Repair
+
+`LocateImagePointsOptions.signal` propagates through Station probing, Ollama generation and response-body waits, installed-model alias discovery, owned pull clients, and owned HF setup/inference processes. The shared process runner bounds output and terminates only each created process group. Abort bypasses candidate fallback and does not mark a model permanently unavailable. HF admission and worker cleanup release their exact lease, including admission that arrives after the caller has stopped. Cancellation during lease release cannot return stale coordinates.
+
+The SDK wait is bounded and reports an `AbortError` explaining that its underlying shared operation may continue. The runtime does not kill the shared model/server or alter the cached client to simulate cancellation. Late SDK settlement is observed but cannot publish a result or trigger another backend. Browser owners separately pass their active signal and check cancellation before local fallback or clicking.
+
+## Verification
+
+Hermetic coverage includes pre-dispatch abort, SDK abort/deadline, stalled HTTP headers/body/alias lookup, HF setup interruption, termination of a synthetic Node worker and a synthetic pull client, temporary-image cleanup, late broker admission, recovery without unavailable-cache poisoning, and cancellation during lease release. Existing vision, HF, desktop-click, and vision-action-loop tests remain covered. Logs: `/tmp/omnius-vision-cancel-final.log` and `/tmp/omnius-vision-cancel-types.log`.
+
+Final verification: **79 tests passed across five suites**, including 11 new cancellation cases. Execution `tsc --noEmit` and scoped `git diff --check` passed. Final review checked fallback catches, late admission/release, shared-client behavior, and owned process cleanup; the lease-release race found during review is covered by the final regression.
+
+Only synthetic child JavaScript and mocked HTTP/SDK/broker results are used. No Python model code, live inference, GPU workload, Telegram request, service restart, or publication is performed. Orchestrator source remains frozen and outside this follow-up.
+
+Repository closure: delivered in 72382afa to origin/main. The final execution aggregate includes these cases; see the [program verification ledger](TOOL-QUALITY-2026-09-05.md#verification-ledger). Source locations are [vision.ts](../../../packages/execution/src/tools/vision.ts), [browser-action.ts](../../../packages/execution/src/tools/browser-action.ts) and [playwright-browser.ts](../../../packages/execution/src/tools/playwright-browser.ts). Publication and live acceptance remain with the user.

package/docs/work-orders/runtime-health-remediation/WO-38-tool-contract-preservation.md

@@ -0,0 +1,83 @@
+# WO-38: Preserve tool contracts across adapters and policy resolution
+
+**Status:** complete in repository; verified for user publication
+**Priority:** P1
+**Date:** 2026-09-05 PDT
+
+## Observed defects
+
+The execution-to-runner adapter discarded `alreadyApplied`,
+`artifactMaterialization`, `documentExtraction`, and `runtimeSession` while
+retaining the success flag. A real already-applied file edit lost its receipt;
+a missing native PDF lost its `not_found` extraction outcome. Partial output
+could consequently pass the runner's canonical-receipt exclusion, and browser
+session changes lost their explicit boundary event.
+
+Telegram policy resolution returned shared default allowlist sets. Resolving
+one configuration expanded later policy resolutions without that configuration.
+Blocking an advertised alias also failed to block its canonical tool.
+
+The runner separately validated Zod input and discarded the parsed value.
+For `{ count: '3', extra: 'strip' }`, a schema coercing count, defaulting mode,
+and stripping unknown fields still executed the original input.
+
+## Scope and implementation
+
+- Preserve structured result receipts in both direct and streaming adaptation.
+- Give each policy resolution independent sets; honor blocked advertised aliases.
+- Pass parsed runner input consistently to execution, custom validation,
+  fingerprints, concurrency metadata, and path/mutation guards. A transformed
+  path must not bypass a guard previously applied to an untransformed path.
+- Keep permissive admin filesystem access and existing public/group restrictions.
+
+## Verification
+
+Hermetic audit reproduced the first two concrete native-tool losses, policy
+cross-call leakage, and discarded schema defaults/coercion with zero network
+attempts. Fixtures contain synthetic content and live only in temporary dirs.
+
+Regression coverage: `packages/cli/tests/tool-contract-preservation.test.ts`
+checks native edit/PDF results, canonical exclusion of partial results through
+both stream and direct adapters, browser-session event generation, policy
+isolation, and advertised alias blocking. Existing adapter-binding and Telegram
+media suites must remain green. Runner evidence is recorded by the parent.
+
+- 2026-09-05: **55 tests passed** across tool-contract-preservation (9),
+  tool-adapter-binding (2), telegram-admin-media-aliases (33), and
+  telegram-public-media (11), with the CLI hermetic network boundary active.
+- CLI `tsc --noEmit` and scoped `git diff --check` passed.
+- Runner preparation now occurs before response deduplication, concurrency
+  classification, guards, and dispatch. Each native call retains its parsed
+  object so non-idempotent transformations are not repeated at execution.
+  Direct API, voice-relay, and model-text calls execute parsed objects too.
+- Runner regression: **206 tests passed** across `tool-schema-execution` (7),
+  `agenticRunner` (175), and `agenticRunner-context-behavior` (24). Coverage
+  includes custom validation, concurrency metadata, normalized fingerprints,
+  rejection of non-object transform output, and a transformed path rejected by
+  the existing overwrite guard with the user fixture unchanged.
+- Orchestrator `tsc --noEmit` and scoped `git diff --check` passed.
+
+## Delivery boundary
+
+Scoped source/test/document commits only. No publication, live inference,
+Telegram requests, service restart, or runtime-state repair in this order.
+
+## Streaming wrapper and integration review
+
+Native streaming previously bypassed the adapter's execution wrapper, allowing middleware admission or result transformation to be skipped. Streaming now runs inside that same wrapper and relays native chunks through a single pending slot. Backpressure prevents unbounded buffering. Wrapper failure remains authoritative after streamed progress, and wrapper timeout or consumer closure cancels and drains the owned native generator.
+
+Independent review reproduced two cleanup defects in the initial relay: asynchronous generator cleanup could outlive consumer close, and wrapper failure could leave the producer running. Both are repaired and covered by tool-adapter-stream-lifecycle.test.ts. All 62 tests across five adapter/Telegram media suites passed in /tmp/omnius-wo38-wrapper.log. Native method binding, live shell chunks, process receipts, partial materialization, admission refusal and post-invocation failure are covered.
+
+The native edit fixture now expects a proven no-op only when the exact old anchor is present. Missing anchors remain failures even when replacement text occurs elsewhere. A synthetic idempotent receipt separately verifies alreadyApplied propagation; this preserves WO-33's removal of unsafe inferred edit success.
+
+## Repository closure — September 5
+
+All confirmed findings and independent review follow-ups in this order are resolved. The [program verification ledger](TOOL-QUALITY-2026-09-05.md#verification-ledger) records the final full suites and clean build. Earlier pending integration notes above are historical and superseded by this closure.
+
+Scoped repair commits delivered to origin/main: e4598f71, cae592bc, 48fd2410. Publication and subsequent live acceptance remain with the user.
+
+Source and integration locations:
+
+- [packages/cli/src/tui/tool-adapter.ts](../../../packages/cli/src/tui/tool-adapter.ts)
+- [packages/cli/src/tui/tool-policy.ts](../../../packages/cli/src/tui/tool-policy.ts)
+- [packages/orchestrator/src/agenticRunner.ts](../../../packages/orchestrator/src/agenticRunner.ts)

package/docs/work-orders/runtime-health-remediation/WO-39-telegram-working-indicator.md

@@ -0,0 +1,76 @@
+# WO-39: Keep Telegram's working indicator alive through active work
+
+**Status:** complete in repository; verified for user publication
+**Priority:** P1
+**Date:** 2026-09-05 PDT
+
+## Requirement and root cause
+
+The user requires a visible working indicator throughout background work in
+Telegram DMs and public/private groups. All three private reply paths cleared
+their typing interval when the first native draft was acknowledged. A following
+silent tool call or unchanged draft had no refresh, so Telegram's short-lived
+typing action expired while work continued. Group paths already used recurring
+typing, but shutdown could not directly reach a quick-chat timer once that timer
+had transferred out of the staging map.
+
+An initial transient typing failure also returned permission to continue
+without creating a refresh timer, leaving admitted media/context preparation
+without its working heartbeat.
+
+## Implementation
+
+- Keep one run-owned 3-second heartbeat through media preparation, model/tool
+  work, native previews, and final delivery. Native draft success never retires
+  that heartbeat; terminal reply cleanup does.
+- Track active timer cleanups after staging transfers, attach the admitted
+  work's cancellation signal, and clear every active lease on bridge shutdown.
+  Cleanup removes both the timer and its abort listener.
+- Reject late initial acknowledgements from cancelled/replaced work; continue
+  refreshing after transient failures. Preserve permanent write refusals and
+  reply authorization before visible activity.
+- Coalesce refresh ticks while one transport call remains in flight and reuse
+  an active runner's lease when steering arrives.
+- Space native drafts at 1.2 seconds so draft updates and 3-second heartbeats
+  fit together within the existing shared 40-per-30-second typing budget.
+- Preserve numeric DM/group/topic routing and guest-query exclusions.
+
+Timers express an admitted live process's ownership; they are not persisted or
+revived for stale runs after restart. Visible refresh still depends on Telegram
+accepting the API request and a responsive process/transport.
+
+## Verification
+
+`packages/cli/tests/telegram-working-indicator.test.ts` exercises the real task,
+admin-chat, and quick-chat reply handlers with mocked inference/tool work and
+mocked Telegram API responses. It verifies successful first drafts followed by
+18 seconds of silence, delayed final delivery, public/private groups and topics,
+media preparation, cancellation/shutdown before completion settles, late
+acknowledgements, transient failures, coalescing, steering, and shared budget.
+
+- **220 tests passed** across eight suites: working-indicator, transport-contract,
+  attention-evidence, api-governor, write-capability, bridge-lifecycle,
+  lifecycle-leak, and bot-api-10.
+- After adding explicit permanent-refusal ownership cleanup and generation
+  failure coverage, **76 tests passed** across six affected transport/lifecycle
+  suites, including all **17 working-indicator tests**.
+- CLI `tsc --noEmit` and scoped `git diff --check` passed. All tests use the
+  CLI hermetic network boundary and synthetic temporary workspaces.
+
+## Delivery boundary
+
+Scoped source/test/document commit only. No real Telegram requests, inference,
+publication, service restart, or mutation of the running Telegram workspace.
+
+Final ownership review also routed queue-retirement cleanup through the shared typing lease cleanup, releasing its abort listener and ownership-map entry as well as the interval. All 56 tests across working-indicator, write-capability, bridge-lifecycle, and lifecycle-leak passed; /tmp/omnius-wo39-cleanup.log. The documented cadence now matches the implemented three seconds.
+
+## Repository closure — September 5
+
+All confirmed findings and independent review follow-ups in this order are resolved. The [program verification ledger](TOOL-QUALITY-2026-09-05.md#verification-ledger) records the final full suites and clean build. Earlier pending integration notes above are historical and superseded by this closure.
+
+Scoped repair commits delivered to origin/main: 53216239, c17ae247. Publication and subsequent live acceptance remain with the user.
+
+Source and integration locations:
+
+- [packages/cli/src/tui/telegram-bridge.ts](../../../packages/cli/src/tui/telegram-bridge.ts)
+- [packages/cli/tests/telegram-working-indicator.test.ts](../../../packages/cli/tests/telegram-working-indicator.test.ts)

package/docs/work-orders/runtime-health-remediation/WO-40-web-content-and-crawl-receipts.md

@@ -0,0 +1,44 @@
+# WO-40: Preserve retrieved content and validate crawler responses
+
+**Status:** complete in repository; verified for user publication
+**Priority:** P1
+**Date:** 2026-09-05
+
+## Reproduced failures
+
+- `web_fetch` strips HTML from every MIME type. A plain-text comparison becomes
+  different code, and JSON containing `<Widget />` loses that value. Short
+  plain text also produces misleading advice that JavaScript rendering is needed.
+- `web_crawl` reports success for exit-zero workers emitting empty or malformed
+  output instead of the promised result JSON.
+
+## Repair and acceptance
+
+- Strip markup only from declared HTML/XHTML; preserve other textual bodies,
+  whitespace, and characters in both fresh responses and cached retrievals.
+- Apply the requested output limit before any short-page hint.
+- Require a successful, structurally valid crawler payload and retrieved pages;
+  malformed worker output is an execution diagnostic, not source evidence.
+- Bound crawler numeric options and preserve existing network egress policy.
+- Verify with mocked fetch/process boundaries; no live requests or services.
+
+## Verification
+
+- `pnpm exec vitest run tests/web-fetch.test.ts tests/web-crawl-contract.test.ts tests/web-download.test.ts tests/web-search.test.ts`
+  from `packages/execution`: **45 passed**.
+- `pnpm exec tsc --noEmit` from `packages/execution`: passed.
+- Fetch regressions preserve comparisons, JSX, whitespace, and JSON on fresh
+  and cached reads. Crawl regressions reject empty, malformed, zero-page and
+  contradictory worker outcomes while retaining valid attribution.
+- Parent owns integration and push; publication is excluded.
+
+## Repository closure — September 5
+
+All confirmed findings and independent review follow-ups in this order are resolved. The [program verification ledger](TOOL-QUALITY-2026-09-05.md#verification-ledger) records the final full suites and clean build. Earlier pending integration notes above are historical and superseded by this closure.
+
+Scoped repair commits delivered to origin/main: 9f96cfcb. Publication and subsequent live acceptance remain with the user.
+
+Source and integration locations:
+
+- [packages/execution/src/tools/web-fetch.ts](../../../packages/execution/src/tools/web-fetch.ts)
+- [packages/execution/src/tools/web-crawl.ts](../../../packages/execution/src/tools/web-crawl.ts)

package/docs/work-orders/runtime-health-remediation/WO-41-completion-evidence-consistency.md

@@ -0,0 +1,45 @@
+# WO-41: Expose verification coverage and preserve typed completion authority
+
+**Status:** complete in repository; verified for user publication
+**Priority:** P1
+**Program:** [September 5 follow-up](TOOL-QUALITY-2026-09-05.md)
+
+## Observed failure and architecture boundary
+
+The monitored 1.0.695 run ended at 00:58:09 PDT on September 5. Its terminal record has status=completed and completionDisposition=ready, while ledgerStatus=incomplete_verification and the ledger contains verification_missing after two code mutations. Several check commands ended with a reporting echo; their final shell status alone cannot establish the check's success.
+
+Completion obligations and observed verification coverage are separate dimensions. A generic mutation does not create a mandatory verifier requirement. Explicit expected-outcome, todo, workboard, or configured verifier requirements govern readiness. Prose claims and critic assertions do not manufacture completion obligations. The repair must make coverage visible without restoring a generic completion veto.
+
+## Code repair
+
+- packages/orchestrator/src/completionLedger.ts: derive stable observed verification facts from execution evidence, separately from the authority projection. Preserve negative typed receipts even when a wrapper reports success; only later matching successful verification discharges the failure.
+- packages/orchestrator/src/completionFinalization.ts: persist verificationAudit status and gaps independently of terminal disposition; reject a completed record when supplied readiness explicitly denies successful completion.
+- packages/orchestrator/src/agenticRunner.ts: expose audit coverage in terminal receipt text and preserve the existing explicit-obligation authority projection. Reconcile expected-outcome verification assessment with typed readiness facts.
+- packages/orchestrator/tests/completion-observed-authority.test.ts: exercise real runner admission and finalization using mocked mutation/check tools, including masked shell success, explicit verifier obligations, and generic mutation without a mandatory verifier.
+
+## Acceptance
+
+- [x] Generic mutation without an explicit verifier may complete while retaining an unverified audit.
+- [x] Missing or masked verification cannot satisfy an explicitly required verifier.
+- [x] A fresh successful assertion-bearing check satisfies the corresponding typed expected effect.
+- [x] Speculative prose claims and controller bookkeeping do not manufacture coverage gaps.
+- [x] Later failed/timed-out/negative declared verification remains observable despite a positive wrapper result.
+- [x] Focused and aggregate regression suites, independent review, clean build, scoped commits and delivery recorded.
+
+## Verification and delivery
+
+All reproductions use temporary state and mocked inference. Live workspace, installed package, and publication are outside this repair's execution boundary. Aggregate results and final delivery references are recorded in the program workorder.
+
+Focused verification: 48 tests passed across observed completion authority, completion ledger, finalization, and readiness. The production cases cover explicit requirements versus generic audit coverage. Broader architecture regressions: 234 passed; two remaining context-admission failures belong to WO-31 and are tracked separately. Logs: /tmp/omnius-wo41-revised.log and /tmp/omnius-tool-quality-regressions.log.
+
+## Repository closure — September 5
+
+All confirmed findings and independent review follow-ups in this order are resolved. The [program verification ledger](TOOL-QUALITY-2026-09-05.md#verification-ledger) records the final full suites and clean build. Earlier pending integration notes above are historical and superseded by this closure.
+
+Scoped repair commits delivered to origin/main: 6ee251c3. Publication and subsequent live acceptance remain with the user.
+
+Source and integration locations:
+
+- [packages/orchestrator/src/completionLedger.ts](../../../packages/orchestrator/src/completionLedger.ts)
+- [packages/orchestrator/src/completionFinalization.ts](../../../packages/orchestrator/src/completionFinalization.ts)
+- [packages/orchestrator/src/agenticRunner.ts](../../../packages/orchestrator/src/agenticRunner.ts)

package/docs/work-orders/runtime-health-remediation/WO-42-media-execution-and-configuration.md

@@ -0,0 +1,79 @@
+# WO-42: Media execution and configuration boundaries
+
+**Status:** complete in repository; verified for user publication
+**Priority:** P1
+
+## Confirmed problems
+
+- Microphone capture joins device/output arguments into synchronous shell commands. Shell metacharacters are executable, paths with spaces split, and a recording blocks the event loop for its requested duration. Recording is intentionally finite (up to 300 seconds); its deadline must allow that duration rather than impose an unrelated short limit.
+- Transcription temporarily assigns the entire environment around an awaited shared Node bridge, and permanently assigns its Python/PATH selection. A hermetic overlapping-call reproduction observed request A using B's environment, request B using the parent's environment, and the parent left with A's environment.
+- ComfyUI HTTP deadlines end when headers arrive. A hermetic headers-only response left the body pending beyond the configured deadline with its signal un-aborted. Video mux/thumbnail subprocesses have no deadline, output bound, or termination escalation.
+- Web search advertises fully on-device execution while submitting queries to DuckDuckGo.
+
+## Accepted repair
+
+Use argument-vector asynchronous capture with duration-aware deadlines, cancellation, typed arguments and actual output validation. Keep interpreter/device configuration in a dedicated transcription child process, including bridge shutdown and bounded process lifetime. Keep Comfy response consumption inside its deadline with bounded bodies, and reuse the shared process lifecycle for video postprocessing. Describe search's network destination truthfully.
+
+## Verification and scope
+
+Use stubbed child processes, fake response bodies and temporary synthetic modules/files only. Do not capture live audio, perform inference, send network traffic, start services, or alter the installed runtime. Record focused test/typecheck results and scoped delivery below.
+
+## Implementation and verification ledger
+
+- Capture now supplies literal argv to asynchronous processes, including Pulse devices advertised by enumeration. Deadlines include the requested recording duration plus five seconds; cancellation reaches the shared process-group termination/escalation boundary. Numeric inputs are validated before dispatch. Fresh staging output is required before replacing the final recording; failed/empty captures preserve existing output and do not request ingestion. Level sampling removes temporary files and rejects empty/incomplete PCM. Enumeration distinguishes unavailable probes from a successful empty list.
+- Transcribe-cli is resolved without importing its bridge into the parent. A dedicated Node worker receives a copied environment with its selected interpreter and device configuration, writes a typed result payload, shuts its bridge down, and is bounded to five minutes with process-group cleanup. Synthetic concurrent child modules prove both environment selections remain private and the parent's interpreter/PATH stay unchanged.
+- Comfy response deadlines cover headers, success/error body consumption and cancellation. JSON bodies and downloaded video sizes are bounded; missing prompt IDs and empty video downloads fail explicitly. Mux and thumbnail processes have 120-second/30-second deadlines, bounded output and termination escalation; a late zero exit cannot erase a timeout.
+- Search descriptions now disclose that queries are sent to DuckDuckGo over the network.
+
+Before-repair hermetic reproductions captured the unquoted synchronous shell command, observed A/B/parent environment cross-contamination, and proved a Comfy headers-only response clears its deadline before body completion. No shell metacharacters were executed and no real capture, inference, network request or service launch occurred.
+
+Focused verification: 81 tests passed across audio-capture-lifecycle, transcribe-cli-worker, comfy-response-lifecycle, media-worker-lifecycle, video-generate, transcribe-tool-artifacts, transcribe-python-runtime and web-search. Execution package `tsc --noEmit` and scoped `git diff --check` passed. New worker tests execute only temporary synthetic JavaScript modules, never Python or model code. The parent coordinates aggregate review and pushing the scoped commit.
+
+## Nested audio generation Stop follow-up
+
+Video's optional audio generation used `AudioGenerateTool`, which had no cancellation hook and a separate worker implementation that returned on timeout before its child had drained. Audio generation now owns an invocation controller and exposes `cancel()`. The signal reaches Python import/runtime compatibility probes, environment creation, package installation, prewarm, and generation. The shared process runner bounds output, terminates the owned process group, escalates resistant workers, and waits for closure. A timeout or output overflow stays a failure even when shutdown exits zero.
+
+The same controller remains active through resource admission and lease release. Stop ends both generation/prewarm fallback ladders, releases an admission that completes after cancellation, and prevents another worker from starting. A second call on the same tool instance is rejected while this cleanup is pending. Existing deadline/download-stall fallback behavior is retained for ordinary backend failures; user cancellation ends the invocation.
+
+Focused verification: **40 tests passed across six audio/Playwright suites**, including real synthetic Node workers that resist TERM (never Python/model workers), pre-aborted dispatch, zero-exit overflow, both canceled fallback ladders, delayed admission cleanup, browser isolation, and screenshot conversion boundaries. Execution `tsc --noEmit` and scoped `git diff --check` passed. Parent owns aggregate review/push; VideoGenerateTool's nested signal binding is delivered separately by its owner.
+
+## Invocation cancellation follow-up
+
+Independent review found that several bounded worker helpers accepted an abort signal while their tool entrypoints never supplied one. Stop therefore did not reach an isolated transcription process, a video worker, or Comfy polling.
+
+- File and URL transcription now own an invocation controller, reject overlapping use of the same instance, propagate cancellation through interpreter selection, package commands, isolated bridge/CLI/managed workers, URL body consumption and nested transcription, and prevent fallback dispatch after cancellation. Temporary URL inputs use a UUID to keep cleanup scoped to their owner.
+- Video cancellation reaches Diffusers setup/import/install/generation, ffmpeg mux/thumbnail work, Comfy startup/request/body/polling, and nested audio generation. Cancelled candidate attempts release their broker lease and do not start the next model. A completed video remains in the mutation receipt when later audio work is cancelled.
+- The shared process runner refuses already-aborted requests before spawn. Newly created Comfy services reuse the owned-service startup primitive; startup cancellation and failure drain only their owned process group.
+- Cancellation of a client request does **not** establish cancellation of a workflow already accepted by an external/shared Comfy server. No global interrupt or service-wide kill is issued. If submission may have reached that server, the cancellation result states that server work may continue. This preserves other clients' ownership.
+
+Verification: **87 tests passed across 13 combined browser/media suites**; the final URL download and nested-worker regressions expanded transcription invocation coverage to **4 passing tests**. Execution typecheck and scoped diff checks passed. Tests use mocked transport/processes and temporary synthetic JavaScript modules; no Python/model execution, live services, network downloads or publication occurred.
+
+## Managed Whisper synchronous preparation closure
+
+The final review found that managed Whisper still called `ensureCudaPythonVenvSync` on the daemon thread before its readiness check. That unchanged CUDA helper can perform synchronous 60-second probes, 120-second venv creation and 20-minute package installations. An AbortSignal checked around that call cannot be delivered while the event loop is blocked.
+
+Managed Whisper now invokes the exact existing preparation module in an owned asynchronous Node child. Its copied environment preserves CUDA selection and preparation policy; options travel through stdin, and the child/descendant process group is bounded and canceled through `runProcessBuffer`. The result receipt contains only the interpreter and protected-Torch pip constraint. The parent reconstructs the environment locally, validates the receipt, preserves bounded setup failure diagnostics, and checks Stop before any subsequent import, package install or inference. No CUDA policy or broker rule was rewritten.
+
+Verification: **27 tests passed across five transcription suites**, including a synthetic preparation module blocked in synchronous work while the parent timer delivers Stop, worker drain, pre-aborted dispatch, a preparation deadline, configuration preservation, failure receipts and the real `TranscribeFileTool` cancellation boundary. Execution typecheck and scoped diff checks passed. Temporary bundled-helper fixtures independently verified default sibling-module resolution for both `execution/dist/transcribe-cuda-preparation.js` and published `dist/index.js`.
+
+The parent added the standalone `python-cuda-runtime.js` publish entry and both artifact audits. Its actual build configuration produced a 20,494-byte temporary module exporting the preparation function without invoking it or emitting a sourcemap; all 16 publish-policy tests passed (`/tmp/omnius-cuda-worker-package.log`, `/tmp/omnius-cuda-worker-package-tests.log`). Packaging changes are committed separately by the parent. No live Python/CUDA preparation, model loading, network request, installed runtime change or modification of the dirty publish staging directory occurred during this verification.
+
+## Repository closure — September 5
+
+All confirmed findings and independent review follow-ups in this order are resolved. The [program verification ledger](TOOL-QUALITY-2026-09-05.md#verification-ledger) records the final full suites and clean build. Earlier pending integration notes above are historical and superseded by this closure.
+
+Scoped repair commits delivered to origin/main: 7bc9106d, 52cb2623, b82f88a9, ed341587, 793c5302. Publication and subsequent live acceptance remain with the user.
+
+Source and integration locations:
+
+- [packages/execution/src/tools/audio-capture.ts](../../../packages/execution/src/tools/audio-capture.ts)
+- [packages/execution/src/tools/audio-generate.ts](../../../packages/execution/src/tools/audio-generate.ts)
+- [packages/execution/src/tools/transcribe-tool.ts](../../../packages/execution/src/tools/transcribe-tool.ts)
+- [packages/execution/src/tools/video-generate.ts](../../../packages/execution/src/tools/video-generate.ts)
+- [packages/execution/src/tools/web-search.ts](../../../packages/execution/src/tools/web-search.ts)
+- [packages/execution/src/transcribe-cli-worker.ts](../../../packages/execution/src/transcribe-cli-worker.ts)
+- [packages/execution/src/transcribe-cuda-preparation.ts](../../../packages/execution/src/transcribe-cuda-preparation.ts)
+- [packages/execution/src/transcribe-python-runtime.ts](../../../packages/execution/src/transcribe-python-runtime.ts)
+- [scripts/build-publish.mjs](../../../scripts/build-publish.mjs)
+- [scripts/audit-publish-artifacts.mjs](../../../scripts/audit-publish-artifacts.mjs)
+- [scripts/tarball-audit.mjs](../../../scripts/tarball-audit.mjs)

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "omnius",
-  "version": "1.0.694",
+  "version": "1.0.696",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omnius",
-      "version": "1.0.694",
+      "version": "1.0.696",
       "bundleDependencies": [
         "image-to-ascii"
       ],
@@ -5161,9 +5161,9 @@
       }
     },
     "node_modules/jose": {
-      "version": "6.2.11",
-      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.11.tgz",
-      "integrity": "sha512-A5NPn7g8EAzGU3IzRs+Yiq8K5n3ypYS75M5+KKiVHdUexfpWK1kP4ZMq7QnTGDoMj6TJ1dtcEJjW60yZDXS4hg==",
+      "version": "6.2.12",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.12.tgz",
+      "integrity": "sha512-9NiFmJEex0sy2Dk58j2UGBSHgUs2ypF9eZSu4L6vjOX3Dp96Sw1F3uL+H+D1sx02jZZdzUT0HgvCy59CuvXcWw==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/panva"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnius",
-  "version": "1.0.694",
+  "version": "1.0.696",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/library.js",