omnius 1.0.763 → 1.0.765

package/dist/index.js

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/dist/index.js
-size: 38690040 bytes
-sha256: e3e3e8a14ee20bc5bd5bdf2b14861e28944c61bbab0436fec33edaf764e70e11
+size: 38754141 bytes
+sha256: 8f6cc23abacc45c47703361d743118fe124f196c880cd3f05c49f8b8320609a9

package/dist/library.js

@@ -51894,6 +51894,15 @@ var init_browser_action = __esm({
   }
 });
 
+// packages/execution/dist/tools/email-verification.js
+var init_email_verification = __esm({
+  "packages/execution/dist/tools/email-verification.js"() {
+    "use strict";
+    init_network_egress_policy();
+    init_playwright_browser();
+  }
+});
+
 // packages/execution/dist/tools/autoresearch.js
 var init_autoresearch = __esm({
   "packages/execution/dist/tools/autoresearch.js"() {
@@ -297242,6 +297251,7 @@ var init_dist3 = __esm({
     init_ocr_image_advanced();
     init_browser_action();
     init_playwright_browser();
+    init_email_verification();
     init_autoresearch();
     init_scheduler();
     init_reminder();

package/docs/DISCOVERY.json

@@ -35711,6 +35711,46 @@
         }
       ]
     },
+    {
+      "id": "guide.work-orders-runtime-health-remediation-wo-54-case-theory-router-deferral-recovery-uppercase",
+      "kind": "guide",
+      "title": "WO-54: Case Theory router deferral recovery",
+      "summary": "Status: complete Priority: P0 Incident: September 26, 2026, Case Theory messages 455–456 Runtime observed: globally installed Omnius 1.0.764 Owner: current implementation session",
+      "keywords": [
+        "work",
+        "orders",
+        "runtime",
+        "health",
+        "remediation",
+        "WO",
+        "54",
+        "case",
+        "theory",
+        "router",
+        "deferral",
+        "recovery",
+        "md"
+      ],
+      "maturity": "internal",
+      "audiences": [
+        "maintainer",
+        "large-context-agent"
+      ],
+      "layer": "documentation",
+      "interfaces": [
+        {
+          "type": "file",
+          "target": "docs/work-orders/runtime-health-remediation/WO-54-case-theory-router-deferral-recovery.md"
+        }
+      ],
+      "references": [
+        {
+          "type": "documentation",
+          "target": "docs/work-orders/runtime-health-remediation/WO-54-case-theory-router-deferral-recovery.md",
+          "relation": "canonical-artifact"
+        }
+      ]
+    },
     {
       "id": "guide.work-orders-telegram-dmn-wo-22-dmn-outreach-and-learning-uppercase",
       "kind": "guide",
@@ -41528,6 +41568,62 @@
         }
       ]
     },
+    {
+      "id": "tool.email-verification",
+      "kind": "tool",
+      "title": "Email Verification",
+      "summary": "email_verification is a directly callable Omnius tool.",
+      "aliases": [
+        "email_verification"
+      ],
+      "keywords": [
+        "tool",
+        "email",
+        "verification"
+      ],
+      "maturity": "stable",
+      "layer": "execution",
+      "audiences": [
+        "coding-agent",
+        "integrator",
+        "service-agent"
+      ],
+      "use_when": [
+        "The caller needs this isolated operation and live metadata confirms direct-call availability"
+      ],
+      "avoid_when": [
+        "The live registry reports the tool unavailable or the caller lacks its required scope"
+      ],
+      "interfaces": [
+        {
+          "type": "rest-schema",
+          "target": "/v1/tools/email_verification"
+        },
+        {
+          "type": "rest-call",
+          "target": "/v1/tools/email_verification/call"
+        }
+      ],
+      "references": [
+        {
+          "type": "source",
+          "target": "packages/execution/src/tools/email-verification.ts",
+          "relation": "implementation"
+        }
+      ],
+      "direct_callable": true,
+      "live_metadata": "GET /v1/tools/email_verification",
+      "source_of_truth": [
+        "packages/execution/src/tools/email-verification.ts",
+        "GET /v1/tools/email_verification"
+      ],
+      "verification": [
+        {
+          "check": "Inspect GET /v1/tools/email_verification before use",
+          "expected": "Schema, security, exposure, and availability match the intended invocation"
+        }
+      ]
+    },
     {
       "id": "tool.embedding-store",
       "kind": "tool",

package/docs/DISCOVERY.md

@@ -605,6 +605,7 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.work-orders-runtime-health-remediation-wo-51-large-telegram-attachments-uppercase` | WO-51: Receive and unpack large Telegram attachments | Status: source repair complete and verified. Publication and Local Bot API live acceptance remain with the operator. |
 | `guide.work-orders-runtime-health-remediation-wo-52-steering-projection-preservation-uppercase` | WO-52: Preserve required steering instructions in the actual model request | Status: source repair complete; verified and ready for publication. Live acceptance follows the user's publication. |
 | `guide.work-orders-runtime-health-remediation-wo-53-deferred-reflection-churn-uppercase` | WO-53: Stop duplicate deferred reflection writes | Status: scoped source repair verified; publication remains with the operator. Issue: https://github.com/robit-man/open-agents/issues/3 |
+| `guide.work-orders-runtime-health-remediation-wo-54-case-theory-router-deferral-recovery-uppercase` | WO-54: Case Theory router deferral recovery | Status: complete Priority: P0 Incident: September 26, 2026, Case Theory messages 455–456 Runtime observed: globally installed Omnius 1.0.764 Owner: current implementation session |
 | `guide.work-orders-telegram-dmn-wo-22-dmn-outreach-and-learning-uppercase` | WO-22: DMN outreach, DM sharing, and outcome learning | On 2026-09-03 at 17:07 PDT the bot posted in the OMNIUS group without being addressed. The operator asked whether this was self-induced reflection. |
 | `guide.work-orders-telegram-dropbear-context-rca-workorder` | Telegram Dropbear Context Engineering RCA Work Order | Observed run: /home/roko/Documents/Projects/Adjacent/telegramtest/.omnius, run id 1782873796963-i5r7mv. |
 | `guide.work-orders-wo-am-gaps-uppercase` | Associative Memory Gap Work Orders | Generated: 2026-04-13 Source: Deep audit of multimodal associative memory systems Status: READY FOR IMPLEMENTATION |
@@ -766,6 +767,7 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `tool.desktop-describe` | Desktop Describe | desktop_describe is a directly callable Omnius tool. |
 | `tool.diagnostic` | Diagnostic | diagnostic is a directly callable Omnius tool. |
 | `tool.document` | Document | document is a directly callable Omnius tool. |
+| `tool.email-verification` | Email Verification | email_verification is a directly callable Omnius tool. |
 | `tool.embedding-store` | Embedding Store | embedding_store is a directly callable Omnius tool. |
 | `tool.enter-worktree` | Enter Worktree | enter_worktree is a directly callable Omnius tool. |
 | `tool.exit-worktree` | Exit Worktree | exit_worktree is a directly callable Omnius tool. |

package/docs/work-orders/runtime-health-remediation/TRACKER.md

@@ -4,6 +4,10 @@
 **Checked-item rule:** code, focused tests, and named evidence must all exist
 **Last reconciled:** 2026-09-05
 
+## September 26 Case Theory router deferral recovery
+
+- [x] [WO-54: Case Theory router deferral recovery](WO-54-case-theory-router-deferral-recovery.md): exact task-identity retirement, sequential mixed-domain repair, one scheduler-owned recovery with continuous typing and truthful exhaustion, plus canonical receipt-backed URLs with inference review and final fail-closed withholding. Implemented in `d6a6cb6e`; 251 focused Telegram tests and CLI build passed.
+
 ## September 5 runtime 1.0.701 rapid churn repair
 
 - [x] [WO-53: deferred reflection churn](WO-53-deferred-reflection-churn.md): persistent scoped revision receipts prevent repeated unchanged reflection appends; seven regressions and workspace build passed. [Issue #3](https://github.com/robit-man/open-agents/issues/3) retains the separate context-recovery investigation and corrected budget findings. Existing backlog and live runtime are unchanged.

package/docs/work-orders/runtime-health-remediation/WO-54-case-theory-router-deferral-recovery.md

@@ -0,0 +1,291 @@
+# WO-54: Case Theory router deferral recovery
+
+**Status:** complete
+**Priority:** P0
+**Incident:** September 26, 2026, Case Theory messages 455–456
+**Runtime observed:** globally installed Omnius 1.0.764
+**Owner:** current implementation session
+
+## Objective
+
+Make an inference-authorized Telegram request survive typed-router repair without
+leaking completed task state, silently terminating, or losing its working
+indicator. Preserve the existing rule that the model—not keywords or a host
+claim gate—decides whether a message warrants a reply and what work it needs.
+
+Also make outbound Telegram URLs evidence-backed and cleanly rendered. A URL
+may reach a visible Telegram message only after a successful retrieval receipt
+establishes the final resolved target, followed by an inference review of
+whether that verified source actually supports the surrounding answer. This is
+a transport/source-evidence boundary, not a lexical factual-truth classifier.
+
+## Production evidence
+
+The Case Theory bot received and bundled:
+
+- message 455: `sure dig deeper`
+- message 456, replying to bot message 454: a request for deeper analysis and
+  suggestions about focus, initial construction, and later scaling
+
+The intake ledger records dispatch at `2026-09-27T02:03:15.566Z` and terminal
+deferral at `2026-09-27T02:04:25.423Z`. The Ollama broker completed three
+`POST /api/chat` calls with HTTP 200 during that interval. The bot health file
+remained in `polling` with zero consecutive poll failures. This was therefore
+not a dead bot, an unadmitted queue item, or a GPU wait.
+
+Durable conversation state retained this obsolete task after reply 454 had
+already delivered its requested links and ARR:
+
+```text
+taskId: tgtask-1a276c4b0e77fb77d696
+inputId: telegram:chat:-1003960149435:0:450
+goalText: get me links to each, and ARR for each
+state: open
+```
+
+Reply 454 also exposed the current unsafe URL fallback in visible output, for
+example `—relativity.com (unverified URL: https://www.relativity.com/)`. The
+fallback both admitted an unverified URL and mangled the intended Markdown/
+Telegram presentation. Similar entries were emitted for Reveal and Everlaw.
+
+The production intake and conversation evidence lives outside this repository
+under the `telegram_test/.omnius` runtime. Do not copy private transcripts into
+fixtures; use sanitized deterministic reproductions.
+
+## Full root-cause chain
+
+1. Message 450 created an open action task.
+2. The retry at message 453 was admitted through the quick-chat path and reply
+   454 visibly fulfilled the old request.
+3. The successful quick-chat return path consumed intake records but did not
+   retire the model-cited open task. The action-task delivery path does perform
+   retirement, so lifecycle behavior differs by delivery path.
+4. Messages 455–456 therefore received stale `active-task:*` evidence and an
+   obsolete active scope anchored to message 450.
+5. The initial router and its repairs recognized the new deeper-analysis turn,
+   but their typed fields did not converge on one accepted contract. At least
+   one repair labeled inline research as external `delivery`, contrary to the
+   action-plan prompt's read-only/observation semantics.
+6. Domain repair is brittle: repair is attempted only when every current issue
+   belongs to one domain. A mixed attention/action failure cannot be repaired
+   attention-first and then action-plan-second.
+7. After action-plan reconciliation, the final validation result is reduced to
+   `.decision`; final issue codes and the rejected repaired fragment are not
+   retained in diagnostics. The exact last rejection is consequently lost.
+8. Foreground router recovery then marks the intakes `deferred`, stops the
+   typing lease, and returns without putting the exact bounded work snapshot
+   back into the scheduler. `deferred` is therefore terminal in practice even
+   though its wording claims the unresolved task was retained.
+9. The user sees a planning card stop, no typing indication, and no reply.
+10. Separately, final Telegram delivery currently rewrites URLs lacking fetch
+    receipts into visible `unverified URL` annotations. This treats failed
+    provenance validation as presentational text instead of returning the
+    candidate to model self-review, and the rewrite can corrupt Markdown link
+    structure before Telegram HTML conversion.
+11. The rewrite happened before `convertMarkdownToTelegramHTML`: an unverified
+    Markdown destination was replaced with a visible inline-code URL, then the
+    Telegram renderer faithfully emitted the mangled annotation. Domain-shaped
+    link labels such as `relativity.com` could remain auto-linkable even when
+    the `https://` destination itself was demoted.
+12. Successful `web_fetch` calls already emitted signed-shape transport
+    receipts, but the terminal metacognitive reviewer did not receive a
+    candidate-specific URL admission receipt. It could therefore judge prose
+    completion without explicitly reconciling each cited URL against the exact
+    fetched final target and source observations.
+13. Quick chat has no retrieval tools, yet its independent semantic reviewer
+    was not told that a source-bearing answer must continue into the action
+    path. Its final boundary could only mangle an unfetched link, not obtain and
+    assess the evidence needed to support it.
+14. The initial repair covered the normal action, quick-chat, and admin-agent
+    completion boundaries, but two secondary model-authored delivery paths
+    remained outside that boundary: autonomous reflection follow-ups and the
+    model-callable Telegram `send_message`/message-edit actions.
+15. Reflection follow-ups run without tools, so they cannot obtain a current-run
+    WebFetch receipt. Their discretion prompt did not make that limitation
+    explicit and their selected text was sent directly after room/evidence
+    validation.
+16. Direct Telegram send/edit actions are effects performed inside an active
+    tool loop, before the terminal metacognitive review. Their text and media
+    captions therefore cannot honestly claim the final review that normal
+    answer delivery receives, even when another tool fetched a URL earlier.
+17. A complete invariant must consequently cover every model-authored text
+    effect, not merely the normal final-answer function: no-tools inference must
+    decline link-bearing outreach, and pre-review direct-effect tools must reject
+    link-bearing text/captions and return a recoverable tool error directing the
+    model to the normal receipt-backed reviewed delivery path.
+
+## Required invariants
+
+- No deterministic keyword/direct-mention/claim gate may manufacture reply
+  authority or semantic task completion.
+- Task retirement must be based on a fresh typed model review plus exact task
+  identity evidence, never merely on text similarity or the presence of a
+  visible message.
+- Repairs may preserve independently valid model-authored fields, but must not
+  silently rewrite semantic decisions.
+- Every queued retry must be bounded, idempotent per exact intake, and use the
+  normal session scheduler; no detached inference loops.
+- A deferred foreground turn must either have scheduled continuation evidence
+  or expose a truthful terminal/blocked state. It must not look actively
+  retained while having no path to run again.
+- The Telegram typing lease must remain active across a scheduled recovery and
+  stop only on delivery, a genuine no-reply decision, cancellation, supersession,
+  or exhausted bounded recovery.
+- No live inference is required for repository acceptance. Tests use injected
+  model responses and mocked Telegram transport.
+- Every assistant-authored visible URL must bind to a successful retrieval
+  receipt for its normalized final URL. Redirects must bind the emitted link to
+  the verified final target, not merely the requested target.
+- A verified URL receipt establishes reachability and source identity only. A
+  fresh inference review must still judge whether the source supports the
+  adjacent answer claim; the host must not infer relevance from domains,
+  keywords, or URL shapes.
+- Failed/dead/invalid links must return to bounded self-review for revision.
+  They must never be surfaced as an `unverified URL` annotation, malformed
+  pseudo-link, or invented replacement.
+
+## Implementation plan and durable checklist
+
+- [x] Add a sanitized regression in which a model-cited open task is fulfilled
+      by a reviewed quick-chat reply; assert the exact task is retired.
+- [x] Add a control proving an unrelated open task is not cleared merely
+      because some quick-chat reply was delivered.
+- [x] Unify task retirement behind an exact task-identity helper used by both
+      quick-chat and action delivery paths.
+- [x] Partition mixed validation issues and reconcile attention and action-plan
+      domains sequentially while keeping all semantic fields model-authored.
+- [x] Revalidate after every repair and retain final repair-stage issue codes
+      plus bounded output previews in operator diagnostics.
+- [x] Add mixed-domain, successful sequential repair, and still-invalid final
+      repair regression tests.
+- [x] Add a bounded scheduler-owned router recovery attempt to the queued work
+      record. Preserve exact intake identity and causal bundle; do not create a
+      new visible activity card for each attempt.
+- [x] Keep the typing lease alive while that recovery remains scheduled.
+- [x] On recovery exhaustion, persist a truthful terminal diagnostic including
+      the final validation issues and stop typing exactly once.
+- [x] Add retry-success, retry-exhaustion, no-duplicate-reply, no-runaway-card,
+      cancellation, and restart/persisted-intake coverage.
+- [x] Trace `enforceTelegramReplyLinkEvidence` and Markdown-to-Telegram HTML
+      ordering against the exact message-454 corruption; record the complete
+      receipt/rewrite/review root cause here.
+- [x] Replace visible `unverified URL` rewriting with a bounded self-review
+      contract supplied with exact successful/failed URL receipts. Require the
+      model to retain only supported verified links or revise the prose without
+      a URL; never manufacture a replacement link.
+- [x] Enforce the final send boundary so an inference-review failure cannot
+      leak an unverified URL. Preserve useful prose while withholding the
+      unsupported link and retain a truthful diagnostic receipt.
+- [x] Add regressions for live 2xx receipts, redirects to a canonical final
+      URL, 404/5xx/network failure, a syntactically invalid URL, Markdown links,
+      bare URLs, punctuation adjacency, duplicate URLs, and Telegram HTML
+      escaping/rendering. Assert zero visible `unverified URL` annotations.
+- [x] Verify that URL self-review is bounded, cannot recursively trigger its
+      own link review, and cannot duplicate a visible Telegram reply.
+- [x] Run focused Telegram routing, intake, task lifecycle, working-indicator,
+      verified-link, Markdown rendering, and delivery suites.
+- [x] Run CLI typecheck/build and the complete CLI test suite if focused tests
+      pass.
+- [x] Independently review the resulting diff for forced-reply behavior,
+      unbounded retries, stale scope leakage, and typing ownership regressions.
+- [x] Update this work order with exact verification evidence, commit hash, and
+      delivery state; then mark the tracker item complete.
+
+### Post-closeout all-path URL audit
+
+- [x] State in the reflection discretion prompt that the no-tools path has no
+      URL receipts and must choose silence when a useful follow-up requires a
+      destination.
+- [x] Fail closed on the complete reflection message when its typed decision
+      nevertheless contains an external URL/domain; do not strip a destination
+      and send semantically damaged prose.
+- [x] Reject link-bearing `send_message`, `edit_message_text`, and
+      `edit_message_caption` tool effects before dry-run or Telegram API I/O,
+      because those effects occur before terminal source-support review.
+- [x] Apply the same rejection to captions supplied through model-callable
+      Telegram file/media delivery tools.
+- [x] Return a recoverable tool error that tells the agent to fetch, inspect,
+      and allow the normal terminal reviewer/final-response path to deliver the
+      canonical receipt-bound URL; do not invent or silently rewrite a link.
+- [x] Add regressions proving no Telegram API call occurs for bypass attempts,
+      ordinary link-free tool effects remain available, and a reflection
+      decision cannot leak or mangle an unverified URL.
+- [x] Re-run the focused URL, reflection, Telegram-tool, and build gates; commit
+      and push the scoped follow-up without touching publish-version files.
+
+## Implemented behavior
+
+- A fulfilled typed review now retires a prior open task only when the admitted
+  decision cites that exact `active-task:*` identity (or owns the exact original
+  input). Unrelated tasks survive.
+- Mixed router issues are partitioned. Attention is repaired and revalidated
+  first; a still-invalid action plan is then repaired without reopening reply
+  authority. Final stage, issue codes, and bounded raw preview remain available
+  in diagnostics.
+- A foreground inference-unavailable result gets one normal-scheduler replay of
+  the same input and causal bundle. The original completion promise and typing
+  lease survive the handoff. A new activity card is not registered. Success
+  delivers once; exhaustion records a failed terminal intake with exact issue
+  codes. Authenticated admin DMs retain their existing task-safe direct
+  admission instead of entering this public-group recovery path.
+- Terminal action review receives a candidate URL admission receipt, the exact
+  current-run WebFetch receipts bound to those URLs, and explicit instructions
+  to assess source identity, relevance, and adjacent-claim support. Missing
+  evidence selects model-authored continuation, not host-authored completion.
+- Quick-chat review knows it has no retrieval receipts and must select a typed
+  action continuation when a source is needed.
+- The final transport boundary emits only canonical final URLs from successful
+  current-run receipts. It withholds unfetched, dead, malformed, alternate-
+  scheme, domain-shaped, and auto-linkable destinations without exposing the
+  old `unverified URL` annotation. A typed receipt and operator count preserve
+  the failure evidence.
+
+## Verification evidence
+
+- `pnpm --filter omnius build` — passed.
+- Seven focused Telegram files — 251 tests passed, including Case Theory mixed
+  repair, scheduled recovery success/exhaustion, task retirement, typing,
+  terminal metacognition, quick chat, canonical URL delivery, and observability.
+- `telegram-intake-presentation.test.ts` — 7 tests passed after preserving the
+  authenticated-admin degraded admission path.
+- Complete CLI suite was executed: 2,902 tests passed. Three unrelated existing
+  UI assertions remain red (`brand-palette`, `live-media-status`, and
+  `tui-resize-stability`); the one initially affected Telegram presentation test
+  was corrected and passes focused. No live model inference, Telegram replay,
+  npm publication, global-package mutation, or daemon restart was performed.
+- Implementation commit: `d6a6cb6e` (`fix telegram router recovery and link
+  evidence`).
+- Post-closeout all-path audit: 217/217 focused tests passed across the complete
+  Telegram bridge suite, verified-link delivery, terminal/streamed delivery,
+  and observability. `pnpm --filter omnius build` passed. The audit additionally
+  covers public live previews, private native drafts, no-tools reflection,
+  direct message/edit/button effects, and media captions. No live inference,
+  Telegram write, npm publication, installed-package mutation, or daemon
+  restart was performed.
+- The complete CLI suite was rerun after the all-path audit: 2,906/2,909 tests
+  passed. The only failures are the same three unrelated pre-existing TUI
+  assertions (`brand-palette`, `live-media-status`, and
+  `tui-resize-stability`); no new failure was introduced.
+- All-path URL audit implementation commit: `61070db4` (`fix telegram URL
+  review bypasses`).
+
+## Primary source targets
+
+- `packages/cli/src/tui/telegram-bridge.ts`
+  - quick-chat delivery lifecycle
+  - open-task identity/retirement
+  - typed decision validation and domain reconciliation
+  - router-recovery scheduling and typing ownership
+  - bounded diagnostics
+  - verified URL receipt collection, self-review, and final HTML delivery
+- `packages/cli/tests/telegram-bot-api-10.test.ts`
+- `packages/cli/tests/telegram-working-indicator.test.ts`
+- Additional focused test file only if isolation materially improves clarity.
+
+## Publication and runtime boundary
+
+Repository implementation, tests, a scoped commit, and push to `origin/main`
+are authorized by the repository policy. Do not publish npm, edit the installed
+global package, restart the live Telegram instance, mutate its conversation
+state, or replay a live message as part of this work order. The user retains
+publication and field-acceptance authority.

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "omnius",
-  "version": "1.0.763",
+  "version": "1.0.765",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omnius",
-      "version": "1.0.763",
+      "version": "1.0.765",
       "bundleDependencies": [
         "image-to-ascii"
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnius",
-  "version": "1.0.763",
+  "version": "1.0.765",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/library.js",