omnius 1.0.855 → 1.0.857

package/docs/work-orders/WO-telegram-public-research-stream-progress-20261013.md

@@ -0,0 +1,100 @@
+# Public research stream recovery and meaningful progress
+
+Status: repaired and verified in the isolated installed runtime. Publication
+and the operator's bot restart are separate.
+
+## Live incident
+
+Installed Omnius 1.0.855, main PID 1141122, started at 20:10:15Z from
+`telegram_test`. OMNIUS group `chat:-1003888256865`, input 5826 asks for this
+week's biggest AI research; task `tgtask-b3b2802ea8259be5a181`, bridge run
+`telegram:8928c8a1534bdb23`, actor
+`telegram-c34a3d7d53728329-1791922362455-1`.
+
+- Attention succeeds on Muse at 20:12:41Z after guarded schema adaptation.
+- Three searches succeed. Four page fetches run: three succeed, one gets 429.
+  The final successful fetch ends at 20:13:03Z.
+- The next actor request has approximately 34,904 input tokens. Its context
+  falsely says `web_fetch:no-target` has failed 46 rounds, despite this being
+  a fresh native goal with one failed fetch.
+- At 20:15:03Z finalization commits `inference_stream_interrupted`, turn 3,
+  `retryable:false`, before any accepted final answer. This is approximately
+  120 seconds after the last request started. The old actor trace was not saved,
+  and the interruption error discarded its cause/frame categories, so the
+  precise provider failure or timer cannot be reconstructed from this receipt.
+- Message 5828 is solely the canned incomplete sentence. An absent native goal
+  assessment caused the host to append it to an empty failed result, then mark
+  intake failed after delivery. A separate empty-result branch would instead
+  wrongly consume it as a social no-reply if the appendix alone were removed.
+- The first edited progress message stores three differently worded “pulling
+  the research” paragraphs. Exact-text deduplication permits near duplicates;
+  no stage grouping replaces the stale explanation when inference waits/fails.
+
+Incident bundle SHA256:
+`1c51f6f647513d3b3f43c2ed42d9aa3ea3bb56eeb0a27aab4daf63cdd85e5625`.
+Finalization SHA256:
+`362776f300db24c47c81b32708ac11ea90151aedb1e7996c37029904e6d4e9dd`.
+Scoped log copies and hashes were preserved outside the live state. No
+historical transcript or private source content is sent by the live harness.
+
+## Repairs and constraints
+
+1. Scope persisted convergence to stable native task identity and epoch;
+   retain genuine continuations, isolate new original inputs. Hash the whole
+   normalized URL as the operation target, preserving query distinctions and
+   omitting fragments. Successful work resolves only its exact target/family.
+2. Buffer each Telegram primary generation until its complete turn validates.
+   Failed uncommitted text/tool frames may fall back without replaying prior
+   successful research tools. Use the existing configured per-attempt limit
+   within the total/caller limit, preserving time for the next route. Immediate
+   TUI streams retain their no-replay fence after actual output. Stop and manual
+   approval remain authoritative; marked auxiliary review allowances remain.
+3. Hidden reasoning/accounting alone never constitutes an irreversible answer
+   or tool effect. Discard failed hidden-only attempts before switching models.
+   Bound buffered frames/bytes, and recheck ownership before release.
+4. Save actor inference routes as well as auxiliary routes. Record only static
+   failure category, status, deadline kind, frame categories and commit policy;
+   never provider bodies, generated text, endpoints or credentials.
+5. Group public progress by actual host tool stage. Replace same-step model
+   explainers, retain factual completed stages and show waiting/paused/stopped
+   state. Counts describe successful operations, not unique sources or goal
+   fulfillment. Keep tool chronology behind Activity and explicit progress
+   available; do not add progress-only model requests or change admin behavior.
+6. Empty failed native work produces no fabricated final answer, no final
+   delivery receipt and no consumed intake. Retain the original goal/evidence
+   and make the existing progress message paused. Legitimate current accepted
+   partial answers retain their separate receipt-backed delivery path.
+7. Hand the bridge an issued, immutable source receipt directly from the
+   actual runner result, bound to the current scope/run/epoch/tool action.
+   Display projection cannot remove verified source custody. Forged, copied,
+   stale, failed or blocked event carriers confer no source evidence; legacy
+   marker parsing remains only for events without the new field.
+
+The follow-up [complete-source work order](WO-web-source-full-coverage-extraction-20261013.md)
+tracks the operator's additional requirement to remove page prefixes and
+account for every source chunk when dedicated extraction is necessary.
+
+## Verification
+
+The isolated workspace build, tarball audit (573 files, no warnings) and fresh
+compiler-free npm install pass. Isolated suites pass 137 orchestrator checks,
+133 CLI checks and 40 typed receipt/public-native checks (overlapping suites,
+not a unique total). Four broader native-transport fixture failures reproduce
+unchanged on baseline `ba291791`; they are not represented as passing.
+
+The [installed live receipt](evidence/telegram-public-research-stream-live-20261013.json)
+records nine real free-model POSTs, two actual scoped RFC page reads and real
+native goal assessment. After both reads, the harness cuts a real Step text
+delta (227 bytes forwarded). MiMo completes the same logical generation,
+without another source read. Both issued receipts reach the bridge, both source
+URLs reach the final wire text, and intake settles consumed/goal fulfilled.
+Bundle SHA256: `666eaaf77fce81bd82f2a214c0f787447af75decaafc6bd2bda65527822a7266`.
+
+Only Telegram transport/ACK is simulated in disposable state. No inference or
+catalog response is fabricated, no local inference runs, and no actual Telegram
+message is sent. Earlier fault-fixture runs completed useful research but did
+not actually inject a disconnect; they are excluded from interruption proof.
+The first fresh-install attempt hit a SQLite prebuild download timeout; the
+unchanged tarball passed on retry. Actual Telegram delivery/typing needs
+operator deployment. The separate full-source extraction work remains tracked
+in its follow-up order.

package/docs/work-orders/WO-web-browser-crawl-full-coverage-20261013.md

@@ -0,0 +1,65 @@
+# Complete browser and crawler reads
+
+Status: implemented and verified; follows the complete HTTP source repair.
+
+The operator's no-truncation requirement also covers browser and crawler page
+reads. The final audit found independent prefix cuts in Playwright, the legacy
+browser service and crawler formatting; preserving full HTTP responses alone
+does not repair those paths.
+
+1. Remove successful prefix cuts from browser content/DOM/element reads and
+   evaluation serialization, including predecessor service serialization.
+   Preserve valid complete JSON. Distinguish a selected element, evaluation
+   result, controls snapshot and complete returned document view.
+2. Issue a distinct immutable page-content capability with exact content hash,
+   source URL, producer/action, invocation identity, capture and session
+   provenance. A browser observation is not an HTTP fetch receipt or proof of
+   a read-only action; JavaScript evaluation can mutate the page.
+3. Remove crawler per-page/global text clipping and discarded link/metadata
+   tails. Preserve code whitespace and all static sections. Keep requested
+   page/depth scope explicit. Resource failures must not masquerade as a
+   successful complete prefix or a successful multi-page crawl.
+4. Route these complete returned views through the same capacity admission,
+   full-request source workers, exact quote checks and contiguous checkpoint
+   mechanism used by HTTP fetches. Preserve Stop, task ownership and original
+   source scope through adapters and normalization.
+5. Provide host-owned extraction resumption without replaying potentially
+   mutating JavaScript. Ordinary browser/crawl reads may be repeated to obtain
+   a new observation; an evaluation result must reopen its saved source.
+6. Verify actual large producer results, serializer boundaries, late facts,
+   copied/stale capabilities, complete-view normalization, bounded pending
+   coverage and resumption. Rebuild and validate the installed package before
+   committing and pushing the coherent repair.
+
+Bounded UI/control summaries remain observations of their explicit scope;
+they cannot establish a complete document read. This work does not widen
+Telegram tool permissions or reuse active browser sessions in acceptance tests.
+
+Depends on [complete-source extraction](WO-web-source-full-coverage-extraction-20261013.md)
+and [inference contract/output budgets](WO-fallback-contract-cooldown-20261013.md).
+
+## Verification
+
+The [installed browser receipt](evidence/browser-complete-source-live-20261013.json)
+records six successful real Playwright tool reads against isolated Chromium:
+content, DOM, innerText, textContent, innerHTML and evaluate. The complete DOM
+has 477,626 characters; evaluation retains valid JSON with all 350 rows and its
+late Unicode field. No user browser, local inference, external source site,
+runtime installation or Telegram transport was used. The exact installed
+bundle SHA256 is recorded; this covers execution tools, not a GUI benchmark or
+real Telegram delivery.
+
+The isolated producer suites pass 98 tests. Shared runner/extraction/fallback/
+budget suites pass 264 with one existing opt-in test skipped, including exact
+contiguous resumption with no browser replay,
+ownership/Stop rejection and honest unresolved facets. Telegram suites pass
+115, including genuine source receipts, actual child-page destinations beyond
+clipped event text, unsafe URL rejection and existing native settlement checks.
+Crawler Python parser/BFS fixtures run the actual implementation with a fixture
+transport; no live Crawlee service or full browser-driven Telegram conversation
+is claimed. Bounded rapid UI snapshots now explicitly report omitted frames and
+text and state that they are not complete page reads.
+
+All workspace packages rebuild, the 583-file tarball audit has zero warnings,
+and the compiler-free fresh npm install passes. The operator's publication
+directory and active runtime are unchanged by these isolated acceptance runs.

package/docs/work-orders/WO-web-source-full-coverage-extraction-20261013.md

@@ -0,0 +1,135 @@
+# Complete web sources and request-bound extraction
+
+Status: implemented and verified in the isolated installed runtime. Added by
+the operator during the OMNIUS research stream/progress repair. Publication and
+restart of the active session remain with the operator.
+
+## Requirement
+
+Do not silently truncate web pages. When a complete page cannot fit the main
+agent's context, use a dedicated isolated extraction pass that accounts for the
+whole source and preserves the requested information's depth and breadth.
+An archive containing the full bytes is necessary, but is not proof that the
+agent or extractor read the complete requested material.
+
+## Gaps found and repaired
+
+- Native HTTP bytes were already complete, content-addressed and hash-bound.
+- `web_fetch` nevertheless returned a default 5,000-character prefix, including
+  on cache hits, with a 100,000-character display ceiling.
+- The pending HTML evidence implementation selected the first article and capped
+  article text; supplementary rendering clips other material.
+- The runner could admit that short projection without any extraction call.
+- The existing evidence branch remains useful targeted discovery, but samples at
+  most six windows/220 lines/24,000 characters and two semantic rounds. It
+  clips long lines, excerpts and the request brief. It is not a full-source
+  extraction mechanism and must not be presented as one.
+
+## Ordered work
+
+1. Return the full requested textual/raw source view on fresh and cached
+   fetches. Keep legacy `max_length` accepted without silently clipping the
+   source. Retain explicit size failures, immutable raw bytes and native hash
+   receipts. Capacity management belongs to the runner.
+2. Traverse the complete static document in order, including all articles,
+   tables, code/pre whitespace and captions. Distinguish non-rendered code and
+   bounded supplementary metadata from the complete semantic source. Sparse
+   or JavaScript-dependent pages must explicitly require GUI/rendered evidence
+   rather than claiming rendered-page coverage from static HTML.
+3. Capacity-admit the complete semantic view when it fits. Otherwise archive
+   that complete semantic document separately from raw HTML and dispatch a
+   source-wide extraction coordinator through the existing configured backend.
+4. Partition every source character into contiguous lossless hash-bound
+   ranges, including long minified lines and Unicode. Every worker receives
+   the full accepted original request and requested facets, never a clipped
+   replacement. Validate quoted findings against exact chunk/source ranges.
+5. Track real completed chunk coverage and exact resumable source/request
+   identity. Budget, ownership, Stop, invalid response or unavailable inference
+   leaves explicit remaining coverage/cursor. Do not infer absence from an
+   unread region or declare the source complete because a few excerpts look
+   relevant. Worker judgments do not grant objective fulfillment.
+6. Preserve all extraction findings in the owned artifact/state. Give the
+   parent a complete request-focused result only after coverage is accounted
+   for and it fits; otherwise require an explicit reduction/read/resume step,
+   retaining the full findings rather than clipping the main view silently.
+7. Verify full-content tails, multiple articles, code/tables/captions, fresh
+   and cache paths, request clauses beyond old limits, chunk coverage, Stop,
+   resume identity, invalid model evidence and true budget exhaustion. Run
+   actual remote extraction on synthetic documents with late and distributed
+   requested facts; no invented inference replies count as live acceptance.
+8. Rebuild and test the isolated installed package, then make scoped commits
+   and push. Preserve unrelated changes and the operator's publication files.
+9. Repair invalid returned worker replies within the dedicated pass using
+   existing finite calls/attempt/deadline budgets. Record static validation
+   reasons and reply hashes, reserve correction-prompt capacity in advance,
+   and keep exact quote validation. An invalid chunk earns no coverage credit.
+
+Installed acceptance exposed a separate [request-contract/budget repair](WO-fallback-contract-cooldown-20261013.md)
+needed before the low-context public path could finish. Keep these dependencies
+explicit; a successful isolated worker alone does not certify the final path.
+The final scope audit also opened the [browser/crawler work order](WO-web-browser-crawl-full-coverage-20261013.md)
+for independent prefix cuts in those producers.
+
+Dependencies: the existing native web-source custody, source artifacts,
+configured branch backend, capacity admission and Stop/owner fences. Reuse
+them; do not add a separate completion-approval workflow.
+
+## Verification receipts
+
+The [live coordinator receipt](evidence/web-source-wide-coordinator-live-20261013.json)
+records eight real Muse HTTP 200 generations in 40.4 seconds. Five contiguous
+workers cover all 99,981 characters of a synthetic HTML semantic document;
+three cover all 54,551 characters of single-line JSON. Every requested field
+is recovered with exact host-validated source quotes, including later sections,
+table values, code, Unicode, captions and an attribute-only API destination.
+Full original request/facets survive the actual wire adaptation unchanged.
+
+This receipt covers the compiled coordinator and production remote backend.
+Installed public Telegram source routing, parent capacity and goal settlement
+are covered by the separate final acceptance below. No local inference, fake
+model/catalog replies or actual Telegram sends are involved.
+
+The [installed worker diagnostic](evidence/web-source-worker-validation-before-20261013.json)
+captures two distinct returned-reply problems: Step normalized whitespace inside
+quotes, while Muse returned literal quotes but marked the compound request
+uncertain because only part of it appeared in the chunk. Exact quotes remain
+mandatory. Valid quoted findings may coexist with an unresolved facet; neither
+chunk support nor processing coverage establishes whole-task fulfillment.
+
+The [parent-capacity diagnostic](evidence/web-source-parent-capacity-before-20261013.json)
+then records five valid workers covering all 109,910 RFC characters, followed
+by completed-extraction resumption and primary turns with only 662/882 output
+tokens. The latter returned an incomplete provider response before the
+fixture's 20-request cap. This is a main-turn reservation/reduction problem,
+not an invalid source worker or an artifact-query helper. Primary turns now
+reserve at least 4,096 output tokens, subject to an explicit lower user ceiling,
+and completed findings have a compact complete artifact that reopens without
+another worker pass. Runtime timeouts remain bounded and unchanged.
+
+The [final installed public-path receipt](evidence/web-source-installed-public-live-20261013.json)
+records nine actual model requests in 65.8 seconds, with real catalog, inference
+and RFC source responses. The first schema rejection is repaired on the same
+model; the remaining eight HTTP requests succeed. Three workers account for
+all 109,910 source characters, preserve the complete original request and
+produce exact host-validated quotes. The final reply contains all three
+requested details, including the late appendix, and preserves mandatory versus
+advisory wording. The native host goal is fulfilled and intake is consumed
+after the scratch Telegram ACK. The installed bundle SHA256 is
+`546ad34240141d7597b979bb298a7381ae3ab4c8356c28a95a9c7955ddcf51ef`.
+
+This run uses a 65,536-token configured context. The separate
+[32k capacity receipt](evidence/web-source-installed-capacity-guard-20261013.json)
+records complete source processing followed by a typed before-transport pause:
+the intact request, safety margin and required output reserve exceed capacity.
+It is a successful capacity-guard check, not a successful final-answer run.
+No source prefix or fabricated completion is substituted, and automatic replay
+stops. Complete extraction cannot guarantee a final reply when the essential
+request itself cannot fit the selected model's context.
+
+Execution suites pass 98 tests; runner/extraction/fallback/budget suites pass
+264 with one existing opt-in test skipped; Telegram suites pass 115. All
+workspace packages rebuild. The 583-file tarball audit has zero warnings and
+the compiler-free fresh npm installation passes. Browser producer acceptance
+uses the same installed bundle and is recorded in the dependent work order.
+Telegram transport acknowledgments are simulated; actual delivery/typing,
+historical group transcripts and web-search availability are outside this run.

package/docs/work-orders/evidence/automatic-capacity-before-source-route-20261013.json

@@ -0,0 +1,72 @@
+{
+  "schema": "omnius.live-telegram-public-research.v1",
+  "bundleSha256": "5ec7e474ca581ce61f1773bec7a8723167d31ad74223e1711c4233968cf1b2dc",
+  "startedAt": "2026-10-14T00:56:45.290Z",
+  "finishedAt": "2026-10-14T01:01:33.584Z",
+  "bounds": {
+    "physicalGenerations": 32,
+    "contextWindowTokens": 32768,
+    "lifecycleMs": 300000,
+    "sourceUrls": [
+      "https://www.rfc-editor.org/rfc/rfc9112.txt"
+    ],
+    "sourceStorage": "file-backed host storage policy"
+  },
+  "result": {
+    "intakeLifecycle": "failed",
+    "runnerStatus": "incomplete",
+    "terminalReplyDisposition": null,
+    "admittedWebFetchReceiptCount": 1,
+    "sourceUrlsRead": [
+      "https://www.rfc-editor.org/rfc/rfc9112.txt"
+    ]
+  },
+  "physicalGenerations": 32,
+  "attemptedGenerations": 33,
+  "passed": false,
+  "state": "failed_acceptance",
+  "blocked": [
+    "Generation budget exhausted"
+  ],
+  "httpStatuses": [
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200
+  ],
+  "completeSource": {
+    "chars": 109910,
+    "sha256": "e4f426bac6206b67fdf9e0da826154f70588db2133a0a86b15cde4ff725d8937",
+    "processedChunks": 6,
+    "totalChunks": 6
+  },
+  "diagnosis": "Actual successful nonprepared remote fallback did not expose its capacity to the source-read guard. Full source coverage still ended in parent reduction/reopen loops and exhausted the unchanged generation budget. This candidate failed acceptance."
+}