omnius 1.0.846 → 1.0.848

package/docs/work-orders/WO-keyless-fallback-coverage-20261012.md

@@ -0,0 +1,125 @@
+# Keyless automatic fallback coverage and compatibility
+
+Status: implemented and verified. Publication and replacement of the running bot
+remain user-owned; the running bot has not been restarted by this work.
+
+## Requested outcome
+
+Make the automatic inference fallback chain function in the production Telegram
+and TUI backend. Add only anonymous, keyless providers. Check the whole public
+catalog at https://robit-man.github.io/inference/, find additional free providers,
+and reuse OpenCode's free-model discovery and routing, including Nemotron where
+it is actually available without credentials.
+
+The user requested "never fail." No implementation can guarantee an external
+provider's availability. This work must maximize compatible route coverage,
+preserve successful replies, and test bounded, honest failure when every remote
+route is unavailable; it must not manufacture successful inference or hide a
+failed request. This limitation does not reduce the coverage requirement.
+
+## Ordered work and acceptance evidence
+
+1. Inspect the current registry, cascade, production integration and live failure
+   evidence. Preserve unrelated worktree changes. Record all catalog families,
+   candidate URLs, protocols, anonymous authentication requirements and exclusion
+   reasons instead of counting endpoint discovery as working inference.
+2. Trace OpenCode's actual free-provider loader, catalog and wire transport from
+   primary source. Reuse its zero-cost/keyless selection behavior, not a stale
+   handpicked model list. Exclude paid entries, signup/API-key routes, unsupported
+   protocols and services that reject anonymous Omnius clients.
+3. Probe candidate routes with synthetic public data only. Check text, streaming,
+   native tools, tool-result continuation, structured output and advertised input
+   capacity. No action emitted by a probe is executed. Record observed support
+   and failures separately from catalog hints. Do not send local model requests.
+4. Implement the usable adapters and compatibility conditions, shared discovery
+   where practical, fair cascade coverage, provider/model cooldowns, cancellation
+   and local recovery. Keep whole prompt and required tool/schema contracts;
+   preserve manual approval, credential isolation and no replay after visible
+   streaming output begins. New automatic routes must require no actual keys.
+5. Test deterministic transport failures, quota/auth failures, malformed/empty
+   replies, incompatible models, catalog loss, provider retirement, tool/schema
+   constraints, all-routes failure, Stop and successful local recovery. Exercise
+   production backend plus Telegram/TUI integration rather than only a separate
+   raw HTTP harness.
+6. Rebuild workspaces, verify packaged runtime, run synthetic live checks on
+   admitted providers and save sanitized receipts. Commit and push scoped changes
+   after tests pass. Report remaining coverage, failures and activation state
+   precisely; do not claim runtime adoption before it occurs.
+
+## Current evidence
+
+Baseline: commit 57e93104. The saved Telegram run at 2026-10-13T01:03:40Z
+exhausted Hermes, OVH and LLM7 and consolidated as a timeout without any tools.
+The previous cascade allowed six model routes and three models per provider,
+with a 20-second request / 60-second remote budget.
+
+The production cascade now starts with OpenCode and Kilo's anonymous routes,
+followed by the existing Hermes, LLM7, OVH and ch.at routes. OpenCode discovery
+requires explicit zero costs and optionally intersects the gateway's live model
+IDs to remove retired entries. Kilo requires explicit zero prompt and completion
+prices and excludes non-chat models, including classifiers and music generators.
+OVH's documented anonymous tier is pinned independently of its authenticated
+catalog prices. Public registry entries cannot grant these provider-specific
+exceptions or request identities. No actual keys or new credentialed profiles
+are required by the added routes.
+
+Runtime and onboarding share OpenCode's source-derived request adapter. Original
+host tool schemas remain authoritative; compatibility-only calls are rejected.
+Full prompt and required tool/schema contracts are preserved. The parser accepts
+framed SSE and complete JSON responses to streaming requests without replaying a
+generation. Local availability failures admit fallback, cancellation and manual
+decisions remain binding, and a later request retries local inference. Provider
+quota cooldowns apply across models and respect bounded Retry-After values.
+Selection allows 16 compatible models per provider, with fair dispatch across
+admitted providers. Healthy Hermes continuation took 32 seconds; remote defaults
+are therefore 45 seconds per request and 120 seconds overall.
+
+## Verification and limits
+
+Live synthetic checks used the actual production backend and executed no tools:
+
+- [Hermes](evidence/keyless-compatibility-20261012.json) passed text, streaming,
+  native tools, tool-result continuation, strict schema and a large native-tool
+  packet. ch.at passed text, streaming and the large packet but failed tool and
+  schema contracts; it is restricted to text requests without required schemas.
+- [OpenCode Nemotron 3.5 Lightning](evidence/opencode-production-compatibility-20261012.json)
+  passed all six contracts. Big Pickle passed five but rejected strict schema.
+  Retired catalog rows found by these probes are now removed through live-ID
+  discovery. Ling quota failures remain recorded, not counted as success.
+- [Kilo Nemotron 3 Super, North Mini Code and Dots 3 Note](evidence/kilo-production-compatibility-20261012.json)
+  each passed all six contracts. Lyria's authentication failure exposed a
+  non-chat metadata ambiguity; music generators are now excluded and covered by
+  regression tests. Other catalog models remain unverified.
+- [OVH](evidence/ovh-production-compatibility-20261012.json) passed text,
+  streaming and native tools before a quota response. A later
+  [structured/context check](evidence/ovh-structured-context-compatibility-20261012.json)
+  passed both contracts. LLM7 returned a one-hour quota cooldown, which was
+  honored rather than repeatedly probed.
+
+All 460 unique source regression tests passed, with one existing skip, across
+the orchestrator and CLI suites. An isolated snapshot of the staged code also
+passed a full recursive build and all 460 tests (365 orchestrator, 95 CLI),
+without depending on unrelated unstaged changes. This includes production private/public
+Telegram greeting admission and semantic review without a false incomplete
+suffix. The compatibility harness passed 26 tests. The
+[freshly installed bundle receipt](evidence/installed-fallback-verification-20261012.json)
+records 36 passing mocked transport cases, including automatic/manual fallback,
+local recovery, quota handling, more than six failed routes, OpenCode/Kilo,
+native tool/schema contracts and cancellation. These installed tests sent no
+real inference requests or Telegram messages.
+
+A full clean recursive workspace build, publish bundling, tarball audit
+(540 files, zero warnings) and fresh compiler-free npm installation passed.
+The required SQLite prebuild loaded. The prepared artifact is
+`publish/omnius-1.0.847.tgz`, SHA-256
+`5266aa7ca1845bb389f4e7470eb461837516ed99607d09673f11b9ad4fe89309`.
+Its installed `dist/index.js` hash matches the packaged receipt. No package was
+published and no running bot was replaced.
+
+The durable [provider survey](evidence/keyless-provider-survey-20261012.json)
+covers all 12 public-page families and seven additional candidates. Keyed,
+non-chat and unverified adapters are classified explicitly; discovery alone
+does not enroll a route. Every catalog model has not been live-tested, and
+external providers can still exhaust quotas or fail simultaneously. See
+[provider findings](../keyless-provider-survey.md) and
+[OpenCode source provenance](../opencode-free-model-discovery.md).

package/docs/work-orders/WO-telegram-plain-answer-and-provider-catalog-20261012.md

@@ -0,0 +1,117 @@
+# Preserve native Telegram answers and use compatible free inference routes
+
+Status: implemented and verified. The user owns publication and runtime replacement.
+
+## Anchored incident
+
+Telegram input 3363 (a backtick followed by “hey”), update activity
+`telegram:1e8af20a7e273e82`, finalization
+`telegram-64ac9937dc7647a8-1791853421483-1` ran on 1.0.846, PID 2409421,
+started 2026-10-13T00:32:14.464Z. Its bundle SHA256 matches the previous
+verified artifact:
+`f568a8a54e037eb22f21193f7f589f8769b6b94369c0e9dfa7446ca6e8a5f87b`.
+This incident is not explained by an older installed build.
+
+Turn 0 returned ordinary assistant text: “Hey! How can I assist you today?”
+The transcript and turn-1 context retain that answer. Native Telegram
+disabled text completion, so the runner demanded another generation to
+call task_complete. Turn 1 exhausted the remote routes and the usable
+answer never acquired terminal delivery authority. The Activity panel
+obscured the successful first response.
+
+The public registry at https://robit-man.github.io/inference/ also exposed
+two reproducible routing gaps: discovery lost LLM7's provider-default
+selector and chose the first catalog entry, and preferred-model
+incompatibility skipped a provider with other compatible models. The
+catalog-less ch.at chat endpoint was excluded even from tool-free requests.
+Asynchronous jobs, disabled relays, and non-chat services require distinct
+adapters; their presence in the page does not establish native tool support.
+
+## Ordered work
+
+1. Admit an exact current native assistant candidate through host semantic
+   assessment and real effect checks. Avoid a redundant task_complete
+   generation. Preserve run, epoch, turn, owner, steering, candidate and
+   physical evidence fences, terminal receipts and the actual Telegram ACK.
+   No executable completion tool call may be synthesized from prose.
+2. Continue actual work when a promise lacks required mutation, observation,
+   verification or delivery. An unavailable auxiliary assessment may permit
+   delivery of current useful text under existing unavailable-review policy;
+   it must leave the native goal unresolved and never forge fulfillment.
+3. Preserve known selector and transport hints while merging discovered
+   provider capabilities. Enumerate bounded, compatible catalog alternatives
+   deterministically, deduplicate actual routes, preserve whole-input capacity
+   checks, deadlines, manual approval, Stop and provider-specific credentials.
+4. Support catalog-less ch.at only for tool-free chat using its documented
+   omitted-model request. Do not invent a model identifier on the wire or
+   advertise tools, images, or unsupported job protocols.
+5. Test ordinary native text through the actual backend/runner/bridge path,
+   including unavailable assessment, real missing effects, stale ownership,
+   cancellation and provider ACK failure. Exercise registry selector and
+   catalog alternative regressions without live inference or Telegram sends.
+6. Rebuild the workspaces and actual CLI artifact, verify bundle markers and
+   package gates, then commit and push only task-owned changes. Preserve
+   unrelated dirty work and user-owned release versions. The user owns npm
+   publication and runtime replacement.
+
+No service restart, local model request, CUDA workload change or external
+Telegram message is part of this repair's verification.
+
+## Result and verification
+
+Native private and public replies now submit exact current plain text for
+host review and terminal delivery custody without another completion
+generation. Rejected candidates carry bounded missing-effect feedback into
+the next primary request. Stop, steering reconciliation, stale candidate
+rejection, ordinary prose-loop limits and actual provider acknowledgements
+remain enforced. The host neither executes a synthetic task_complete nor
+marks an unknown native goal fulfilled when auxiliary inference is unavailable.
+Selected/generated artifacts retain their explicit delivery boundary.
+
+The runtime merges known provider selector/auth/transport hints with page
+capabilities, tries bounded compatible catalog alternatives after giving
+providers their first attempt, and reads nested context/tool metadata.
+Explicit non-chat, moderation and paid-only catalog entries are excluded.
+ch.at's text-only route omits the model on the wire and needs no catalog;
+onboarding also supports it while retaining a synthetic readiness probe.
+
+Verification:
+
+- 136 registry, routing and existing fallback checks passed.
+- 18 host-admission/model-wire checks and 69 existing completion/steering
+  authority checks passed.
+- 12 new actual backend/runner/Telegram bridge integration cases passed with
+  mocked network responses, including public topic-bound ACK, unavailable
+  assessment, real file mutation, review feedback, Stop and stale ownership.
+- 89 existing Telegram/fallback checks, 11 header route checks and 61
+  onboarding checks passed. Total: 396 regression cases.
+- Two live synthetic requests through the production backend succeeded:
+  streaming text via ch.at in 4821 ms, and streaming native function calling
+  via Hermes in 1764 ms. Both recorded zero local dispatches and executed no
+  generated action. These probes contained only synthetic public test text.
+- Full workspace rebuild and staging audit passed. The tarball audit passed
+  with 531 files and zero warnings. Fresh isolated global npm installation
+  with lifecycle scripts enabled and compilers blocked passed, including
+  SQLite, CLI/library, companion install and PATH checks.
+- All 12 mocked transport scenarios passed against the exact installed
+  tarball bundle. Installed and staged runtime SHA256 match:
+  `f5581b26f6b472a9af893e906670aabb393bc4c63944d2daeadbec245809eb01`.
+
+Logs:
+`/tmp/omnius-keyless-routing-tests-20261012.log`,
+`/tmp/omnius-host-text-admission-focused.log`,
+`/tmp/omnius-host-text-admission-regressions.log`,
+`/tmp/omnius-native-plain-text-admission-20261012.log`,
+`/tmp/omnius-plain-answer-cli-regressions-20261012.log`,
+`/tmp/omnius-plain-answer-route-header-20261012.log`,
+`/tmp/omnius-onboarding-catalogless-tests-20261012.log`,
+`/tmp/omnius-plain-answer-live-remote-text-20261012.json`,
+`/tmp/omnius-plain-answer-live-remote-tools-20261012.json`,
+`/tmp/omnius-plain-answer-publish-build-final-20261012.log`,
+`/tmp/omnius-plain-answer-tarball-audit-20261012.log`,
+`/tmp/omnius-plain-answer-fresh-install-20261012.log` and
+`/tmp/omnius-plain-answer-installed-verification-20261012.json`.
+
+The already running 1.0.846 bot still uses the earlier f568a8a5 bundle.
+The next user-owned patch publication/update and restart must load this repair;
+the isolated package retained the user's staging version without publishing it.

package/docs/work-orders/evidence/installed-fallback-verification-20261012.json

@@ -0,0 +1,311 @@
+{
+  "schema": "omnius.packaged-fallback-verification.v1",
+  "status": "passed",
+  "bundlePath": "/tmp/omnius-fresh-install-MTjD5A/prefix/lib/node_modules/omnius/dist/index.js",
+  "bundleSha256": "37a3ab095098dc3fa67ce548b2544da462eca85a06e9f9ad49f8ba06eeae7e8c",
+  "transport": "mock-http-and-dns",
+  "realInferenceRequests": 0,
+  "telegramMessagesSent": 0,
+  "checks": [
+    {
+      "mode": "auto",
+      "stream": false,
+      "localDispatches": 1,
+      "remoteDispatches": 1,
+      "approvals": 0,
+      "requestedOutputTokens": 218406,
+      "remoteOutputTokens": 61542,
+      "status": "passed"
+    },
+    {
+      "mode": "auto",
+      "stream": true,
+      "localDispatches": 1,
+      "remoteDispatches": 1,
+      "approvals": 0,
+      "requestedOutputTokens": 218406,
+      "remoteOutputTokens": 61542,
+      "status": "passed"
+    },
+    {
+      "mode": "manual-allow",
+      "stream": false,
+      "localDispatches": 1,
+      "remoteDispatches": 1,
+      "approvals": 1,
+      "requestedOutputTokens": 218406,
+      "remoteOutputTokens": 61542,
+      "status": "passed"
+    },
+    {
+      "mode": "manual-allow",
+      "stream": true,
+      "localDispatches": 1,
+      "remoteDispatches": 1,
+      "approvals": 1,
+      "requestedOutputTokens": 218406,
+      "remoteOutputTokens": 61542,
+      "status": "passed"
+    },
+    {
+      "mode": "manual-deny",
+      "stream": false,
+      "localDispatches": 1,
+      "remoteDispatches": 0,
+      "approvals": 1,
+      "requestedOutputTokens": 218406,
+      "status": "passed"
+    },
+    {
+      "mode": "manual-deny",
+      "stream": true,
+      "localDispatches": 1,
+      "remoteDispatches": 0,
+      "approvals": 1,
+      "requestedOutputTokens": 218406,
+      "status": "passed"
+    },
+    {
+      "mode": "manual-missing",
+      "stream": false,
+      "localDispatches": 1,
+      "remoteDispatches": 0,
+      "approvals": 0,
+      "requestedOutputTokens": 218406,
+      "status": "passed"
+    },
+    {
+      "mode": "manual-missing",
+      "stream": true,
+      "localDispatches": 1,
+      "remoteDispatches": 0,
+      "approvals": 0,
+      "requestedOutputTokens": 218406,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-review-throttle-and-local-recovery",
+      "stream": false,
+      "localDispatches": 2,
+      "remoteDispatches": 3,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-review-throttle-and-local-recovery",
+      "stream": true,
+      "localDispatches": 2,
+      "remoteDispatches": 3,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-unknown-selector-output",
+      "stream": false,
+      "selectorDispatches": 1,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-unknown-selector-output",
+      "stream": true,
+      "selectorDispatches": 1,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-json-response-to-stream-without-finish",
+      "stream": true,
+      "localDispatches": 1,
+      "remoteDispatches": 1,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-split-crlf-sse-and-terminal-buffer",
+      "stream": true,
+      "localDispatches": 1,
+      "remoteDispatches": 1,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-empty-tools-omitted-for-text-and-schema",
+      "stream": false,
+      "localDispatches": 1,
+      "remoteDispatches": 2,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-empty-tools-omitted-for-text-and-schema",
+      "stream": true,
+      "localDispatches": 1,
+      "remoteDispatches": 2,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-forced-native-tool-choice-wire",
+      "stream": false,
+      "localDispatches": 1,
+      "remoteDispatches": 2,
+      "toolsExecuted": 0,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-forced-native-tool-choice-wire",
+      "stream": true,
+      "localDispatches": 1,
+      "remoteDispatches": 2,
+      "toolsExecuted": 0,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-six-failed-routes-before-keyless",
+      "stream": false,
+      "localDispatches": 1,
+      "configuredDispatches": 6,
+      "keylessDispatches": 1,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-six-failed-routes-before-keyless",
+      "stream": true,
+      "localDispatches": 1,
+      "configuredDispatches": 6,
+      "keylessDispatches": 1,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-six-cooling-routes-before-keyless",
+      "stream": false,
+      "localDispatches": 2,
+      "configuredDispatches": 6,
+      "keylessDispatches": 1,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-six-cooling-routes-before-keyless",
+      "stream": true,
+      "localDispatches": 2,
+      "configuredDispatches": 6,
+      "keylessDispatches": 1,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-compatible-registry-provider-beyond-six-rows",
+      "stream": false,
+      "localDispatches": 1,
+      "unusableDispatches": 7,
+      "successfulDispatches": 1,
+      "toolsExecuted": 0,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-compatible-registry-provider-beyond-six-rows",
+      "stream": true,
+      "localDispatches": 1,
+      "unusableDispatches": 7,
+      "successfulDispatches": 1,
+      "toolsExecuted": 0,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-opencode-after-older-provider-failures-plain",
+      "stream": false,
+      "localDispatches": 1,
+      "olderProviderDispatches": 4,
+      "openCodeDispatches": 2,
+      "toolsExecuted": 0,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-opencode-after-older-provider-failures-plain",
+      "stream": true,
+      "localDispatches": 1,
+      "olderProviderDispatches": 4,
+      "openCodeDispatches": 2,
+      "toolsExecuted": 0,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-opencode-after-older-provider-failures-native",
+      "stream": false,
+      "localDispatches": 1,
+      "olderProviderDispatches": 3,
+      "openCodeDispatches": 2,
+      "toolsExecuted": 0,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-opencode-after-older-provider-failures-native",
+      "stream": true,
+      "localDispatches": 1,
+      "olderProviderDispatches": 3,
+      "openCodeDispatches": 2,
+      "toolsExecuted": 0,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-opencode-after-older-provider-failures-schema",
+      "stream": false,
+      "localDispatches": 1,
+      "olderProviderDispatches": 3,
+      "openCodeDispatches": 2,
+      "toolsExecuted": 0,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-opencode-after-older-provider-failures-schema",
+      "stream": true,
+      "localDispatches": 1,
+      "olderProviderDispatches": 3,
+      "openCodeDispatches": 2,
+      "toolsExecuted": 0,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-opencode-after-older-provider-failures-unregistered-core",
+      "stream": false,
+      "localDispatches": 1,
+      "olderProviderDispatches": 4,
+      "openCodeDispatches": 2,
+      "toolsExecuted": 0,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-opencode-after-older-provider-failures-unregistered-core",
+      "stream": true,
+      "localDispatches": 1,
+      "olderProviderDispatches": 4,
+      "openCodeDispatches": 2,
+      "toolsExecuted": 0,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-kilo-free-catalog-native",
+      "stream": false,
+      "localDispatches": 1,
+      "kiloDispatches": 1,
+      "toolsExecuted": 0,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-kilo-free-catalog-native",
+      "stream": true,
+      "localDispatches": 1,
+      "kiloDispatches": 1,
+      "toolsExecuted": 0,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-kilo-free-catalog-schema",
+      "stream": false,
+      "localDispatches": 1,
+      "kiloDispatches": 1,
+      "toolsExecuted": 0,
+      "status": "passed"
+    },
+    {
+      "mode": "auto-kilo-free-catalog-schema",
+      "stream": true,
+      "localDispatches": 1,
+      "kiloDispatches": 1,
+      "toolsExecuted": 0,
+      "status": "passed"
+    }
+  ]
+}