omnius 1.0.876 → 1.0.877

package/dist/index.js

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/dist/index.js
-size: 38055609 bytes
-sha256: 1177d20dac77ac80829d0bfca941cfd775b5fab0069bf239a6bf22f69b19aa81
+size: 38125251 bytes
+sha256: f68cf4307aa6852b874b8dbbfcccb42c4fece40da12520fc07b29fbaf8ab7978

package/dist/tui/native/worker.js

@@ -4506,6 +4506,8 @@ var COMMAND_SIGNATURES = [
   ["/models", "List all available models"],
   ["/endpoint", "Select an endpoint or provider"],
   ["/endpoint <provider|alias|url>", "Set a provider name, alias, or backend URL"],
+  ["/provider", "Configure rate-limited inference sponsorship to the mesh"],
+  ["/provider status", "Inspect saved and active mesh provider state"],
   ["/endpoint <url> --auth <t>", "Set endpoint with Bearer auth"],
   ["/fallback", "Show remote inference fallback mode"],
   ["/fallback status", "Show remote inference fallback mode"],
@@ -5156,7 +5158,6 @@ var COMMAND_SIGNATURES = [
   ["/quit", "Exit omnius"]
 ].map(([signature, description]) => ({ signature, description }));
 var PLANNED_SIGNATURES = [
-  ["/provider", "Show or select provider profile"],
   ["/prompt", "Show or edit the active prompt template"],
   ["/reasoning", "Alias family for thinking/reasoning controls"],
   ["/statusbar", "Configure the status bar"],
@@ -5332,6 +5333,7 @@ var ALIASES = {
   platforms: ["gateway"]
 };
 var USER_ONLY = /* @__PURE__ */ new Set([
+  "provider",
   "fallback",
   "quit",
   "exit",
@@ -5425,6 +5427,7 @@ var DESTRUCTIVE = /* @__PURE__ */ new Set([
   "ollama"
 ]);
 var NETWORKED = /* @__PURE__ */ new Set([
+  "provider",
   "endpoint",
   "update",
   "upgrade",
@@ -5459,6 +5462,7 @@ var NETWORKED = /* @__PURE__ */ new Set([
   "gateway"
 ]);
 var SECRET_BEARING = /* @__PURE__ */ new Set([
+  "provider",
   "endpoint",
   "apikey",
   "key",
@@ -5469,6 +5473,7 @@ var SECRET_BEARING = /* @__PURE__ */ new Set([
   "hf"
 ]);
 var PROFILE_GATED = /* @__PURE__ */ new Set([
+  "provider",
   "destroy",
   "update",
   "upgrade",
@@ -5503,7 +5508,7 @@ var REST_BLOCKED = /* @__PURE__ */ new Set([
   "paste",
   "indicator"
 ]);
-var LOCAL_TUI_ONLY = /* @__PURE__ */ new Set(["indicator", "compacted", "gpu", "memory"]);
+var LOCAL_TUI_ONLY = /* @__PURE__ */ new Set(["indicator", "compacted", "gpu", "memory", "provider"]);
 var CANONICAL_BY_ALIAS = /* @__PURE__ */ new Map();
 for (const [canonical, aliases2] of Object.entries(ALIASES)) {
   for (const alias of aliases2) CANONICAL_BY_ALIAS.set(alias, canonical);

package/docs/DISCOVERY.json

@@ -26309,7 +26309,7 @@
       "id": "command.provider",
       "kind": "command",
       "title": "/provider",
-      "summary": "Show or select provider profile",
+      "summary": "Configure rate-limited inference sponsorship to the mesh",
       "aliases": [
         "/provider",
         "provider"
@@ -26317,9 +26317,10 @@
       "keywords": [
         "command",
         "network",
-        "provider"
+        "provider",
+        "status"
       ],
-      "maturity": "planned",
+      "maturity": "stable",
       "layer": "interface",
       "audiences": [
         "user",
@@ -26342,12 +26343,17 @@
       "signatures": [
         {
           "signature": "/provider",
-          "description": "Show or select provider profile",
-          "implementationStatus": "planned"
+          "description": "Configure rate-limited inference sponsorship to the mesh"
+        },
+        {
+          "signature": "/provider status",
+          "description": "Inspect saved and active mesh provider state"
         }
       ],
-      "subcommands": [],
-      "implementation_status": "planned",
+      "subcommands": [
+        "status"
+      ],
+      "implementation_status": "implemented",
       "surfaces": {
         "tui": true,
         "rest": false,
@@ -26355,15 +26361,15 @@
         "agentTool": false
       },
       "safety": {
-        "userOnly": false,
+        "userOnly": true,
         "destructive": false,
-        "networked": false,
-        "secretBearing": false,
-        "profileGated": false
+        "networked": true,
+        "secretBearing": true,
+        "profileGated": true
       },
       "avoid_when": [
-        "The command is planned and has no executable implementation",
-        "Calling it through the REST command proxy; this command is not REST-exposed"
+        "Calling it through the REST command proxy; this command is not REST-exposed",
+        "Allowing an autonomous agent to invoke it without an explicit user action"
       ]
     },
     {
@@ -31536,6 +31542,38 @@
         }
       ]
     },
+    {
+      "id": "guide.guides-provider-menu",
+      "kind": "guide",
+      "title": "Provider menu",
+      "summary": "/provider configures inference capacity that this host sponsors to trusted Omnius instances. /endpoint selects the inference endpoint used by your own conversation. The two controls have separate purposes.",
+      "keywords": [
+        "guides",
+        "provider",
+        "menu",
+        "md"
+      ],
+      "maturity": "stable",
+      "audiences": [
+        "user",
+        "integrator",
+        "coding-agent"
+      ],
+      "layer": "documentation",
+      "interfaces": [
+        {
+          "type": "file",
+          "target": "docs/guides/provider-menu.md"
+        }
+      ],
+      "references": [
+        {
+          "type": "documentation",
+          "target": "docs/guides/provider-menu.md",
+          "relation": "canonical-artifact"
+        }
+      ]
+    },
     {
       "id": "guide.guides-realtime",
       "kind": "guide",
@@ -41028,6 +41066,111 @@
         }
       ]
     },
+    {
+      "id": "guide.work-orders-evidence-provider-control-verification-20261017",
+      "kind": "guide",
+      "title": "Provider Control Verification 20261017",
+      "summary": "Bundled Omnius documentation artifact: docs/work-orders/evidence/provider-control-verification-20261017.json.",
+      "keywords": [
+        "work",
+        "orders",
+        "evidence",
+        "provider",
+        "control",
+        "verification",
+        "20261017",
+        "json"
+      ],
+      "maturity": "internal",
+      "audiences": [
+        "maintainer",
+        "large-context-agent"
+      ],
+      "layer": "documentation",
+      "interfaces": [
+        {
+          "type": "file",
+          "target": "docs/work-orders/evidence/provider-control-verification-20261017.json"
+        }
+      ],
+      "references": [
+        {
+          "type": "documentation",
+          "target": "docs/work-orders/evidence/provider-control-verification-20261017.json",
+          "relation": "canonical-artifact"
+        }
+      ]
+    },
+    {
+      "id": "guide.work-orders-evidence-provider-controls-delivery-20261017",
+      "kind": "guide",
+      "title": "Provider Controls Delivery 20261017",
+      "summary": "Bundled Omnius documentation artifact: docs/work-orders/evidence/provider-controls-delivery-20261017.json.",
+      "keywords": [
+        "work",
+        "orders",
+        "evidence",
+        "provider",
+        "controls",
+        "delivery",
+        "20261017",
+        "json"
+      ],
+      "maturity": "internal",
+      "audiences": [
+        "maintainer",
+        "large-context-agent"
+      ],
+      "layer": "documentation",
+      "interfaces": [
+        {
+          "type": "file",
+          "target": "docs/work-orders/evidence/provider-controls-delivery-20261017.json"
+        }
+      ],
+      "references": [
+        {
+          "type": "documentation",
+          "target": "docs/work-orders/evidence/provider-controls-delivery-20261017.json",
+          "relation": "canonical-artifact"
+        }
+      ]
+    },
+    {
+      "id": "guide.work-orders-evidence-provider-menu-verification-20261017",
+      "kind": "guide",
+      "title": "Provider Menu Verification 20261017",
+      "summary": "Bundled Omnius documentation artifact: docs/work-orders/evidence/provider-menu-verification-20261017.json.",
+      "keywords": [
+        "work",
+        "orders",
+        "evidence",
+        "provider",
+        "menu",
+        "verification",
+        "20261017",
+        "json"
+      ],
+      "maturity": "internal",
+      "audiences": [
+        "maintainer",
+        "large-context-agent"
+      ],
+      "layer": "documentation",
+      "interfaces": [
+        {
+          "type": "file",
+          "target": "docs/work-orders/evidence/provider-menu-verification-20261017.json"
+        }
+      ],
+      "references": [
+        {
+          "type": "documentation",
+          "target": "docs/work-orders/evidence/provider-menu-verification-20261017.json",
+          "relation": "canonical-artifact"
+        }
+      ]
+    },
     {
       "id": "guide.work-orders-evidence-public-review-after-20261012",
       "kind": "guide",

package/docs/DISCOVERY.md

@@ -361,7 +361,7 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `command.plugins` | /plugins | List or manage plugins |
 | `command.pointcloud` | /pointcloud | Open point-cloud generation model/setup menu |
 | `command.prompt` | /prompt | Show or edit the active prompt template |
-| `command.provider` | /provider | Show or select provider profile |
+| `command.provider` | /provider | Configure rate-limited inference sponsorship to the mesh |
 | `command.prune` | /prune | Shrink knowledge.db in the background: evict low-signal graph nodes (archived), then VACUUM. 'infer' = model-guided sleep consolidation. No arg shows stats + usage |
 | `command.queue` | /queue | Queue a prompt for the next turn without interrupting the current run |
 | `command.quit` | /quit | Exit omnius |
@@ -467,6 +467,7 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.guides-media-generation` | Media Generation | Omnius exposes media generation through TUI commands, tools, Telegram creative workflows, and sponsor media endpoints. |
 | `guide.guides-osint-research` | Categorized OSINT research | Omnius ships a local, searchable snapshot of the OSINT4ALL Start.me page. It uses the same compact discovery pattern as AIWG skills: |
 | `guide.guides-pdf-collections` | Large PDF collections | Ask Omnius to process the collection in ordinary language, specifying the result you need: search, ordering, original-page manipulation, summary, or extraction. For example: “Review every supplied PDF, extract each recorded duration with its source page, order the documents by the invoice date, and deliver the complete results.” A field's meaning, units, mis |
+| `guide.guides-provider-menu` | Provider menu | /provider configures inference capacity that this host sponsors to trusted Omnius instances. /endpoint selects the inference endpoint used by your own conversation. The two controls have separate purposes. |
 | `guide.guides-realtime` | Realtime Conversations | Realtime mode is for short, natural, back-and-forth spoken conversation behind ASR and TTS. |
 | `guide.guides-sponsor-and-cohere` | Sponsor And COHERE Mesh | Sponsor and COHERE let Omnius share inference capacity across peers. Sponsor mode is explicit provider/consumer sharing. COHERE is a distributed cognitive inference mesh. |
 | `guide.guides-sponsored-inference-mesh` | Sponsored inference mesh | Omnius can route generation to explicitly trusted sponsors. A sponsor enables specific models, capacity and quotas; other trusted Omnius instances can use that capacity for their main agents, delegates and helpers through the same configured inference endpoint. Tools execute at the requesting instance. The sponsor runs generation only and does not receive a  |
@@ -737,6 +738,9 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.work-orders-evidence-project-media-browser-20261016-report` | Report | Bundled Omnius documentation artifact: docs/work-orders/evidence/project-media-browser-20261016/report.json. |
 | `guide.work-orders-evidence-project-media-unification-20261016` | Project Media Unification 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/project-media-unification-20261016.json. |
 | `guide.work-orders-evidence-project-session-delete-shared-state-20261017` | Project Session Delete Shared State 20261017 | Bundled Omnius documentation artifact: docs/work-orders/evidence/project-session-delete-shared-state-20261017.json. |
+| `guide.work-orders-evidence-provider-control-verification-20261017` | Provider Control Verification 20261017 | Bundled Omnius documentation artifact: docs/work-orders/evidence/provider-control-verification-20261017.json. |
+| `guide.work-orders-evidence-provider-controls-delivery-20261017` | Provider Controls Delivery 20261017 | Bundled Omnius documentation artifact: docs/work-orders/evidence/provider-controls-delivery-20261017.json. |
+| `guide.work-orders-evidence-provider-menu-verification-20261017` | Provider Menu Verification 20261017 | Bundled Omnius documentation artifact: docs/work-orders/evidence/provider-menu-verification-20261017.json. |
 | `guide.work-orders-evidence-public-review-after-20261012` | Public Review After 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/public-review-after-20261012.json. |
 | `guide.work-orders-evidence-public-review-before-20261012` | Public Review Before 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/public-review-before-20261012.json. |
 | `guide.work-orders-evidence-public-session-live-20261017` | Public Session Live 20261017 | Bundled Omnius documentation artifact: docs/work-orders/evidence/public-session-live-20261017.json. |

package/docs/guides/provider-menu.md

@@ -0,0 +1,25 @@
+# Provider menu
+
+`/provider` configures inference capacity that this host sponsors to trusted Omnius instances. `/endpoint` selects the inference endpoint used by your own conversation. The two controls have separate purposes.
+
+The menu uses the existing native terminal modal: keyboard or pointer selection, nested sections, terminal colors, and scrollable content. Configuration and runtime diagnostics stay inside the menu; they are not added to the conversation.
+
+## Configure capacity
+
+Add a source under sponsored models. Choose the managed local Ollama endpoint or an explicitly authorized remote HTTPS provider, then enter its exact model, protocol and endpoint. This operation does not download/load models or deploy a GPU service. Local inference remains subject to the broker and verified accelerator placement.
+
+Set each source's context ceiling, maximum output, concurrent capacity, requests per minute and daily reserved-token budget. A source can be disabled without deleting its policy. Secrets are entered through a masked input or an environment-variable reference and retained in owner-private configuration. Editing an endpoint/protocol clears its previous credential scope.
+
+Requests per minute apply to the source across all allowed requesters over a sliding60-second window. The token budget uses UTC days and conservatively reserves input plus maximum output before dispatch. Cancelled or failed calls can still consume their reservation. Editing limits or restarting does not erase this accounting or the replay ledger.
+
+Configure allowed requester peer IDs separately from outbound sponsor peers. Listen addresses control where this instance accepts encrypted peer connections; relay addresses select explicit circuit relays. The local inference gateway remains authenticated and loopback-only. Only configured models are advertised; endpoint URLs and provider credentials stay on this host.
+
+## Save and run
+
+Changes remain a draft until reviewed and saved. Cancelling discards the draft. If another editor has changed the saved configuration, a stale save is rejected rather than replacing that work.
+
+The overview distinguishes saved configuration from the active runtime revision. Saving does not stop or change a running sponsor. Start, Stop and Apply are deliberate operations; Apply performs a controlled restart after active ownership settles. A runtime started by this terminal is stopped when the terminal exits or hands off an update. An externally started runtime continues after merely closing the menu or terminal; stopping it requires the explicit authenticated Stop action.
+
+Runtime status shows actual state and bounded policy/accounting metadata. Offline, unavailable and pending changes are distinct. `/provider status` opens a separate diagnostic report without printing credentials. `/provider` is a local user control and is not exposed as a REST, gateway or agent-tool mutation.
+
+The [mesh guide](sponsored-inference-mesh.md) describes identity exchange, privacy boundaries, private storage and the equivalent foreground CLI workflow. Provider access restrictions and quotas remain authoritative; denied requests are not retried across sponsor IP addresses.

package/docs/work-orders/evidence/provider-control-verification-20261017.json

@@ -0,0 +1,76 @@
+{
+  "task": "Native provider backend control and private revisioned configuration",
+  "status": "frozen verified source",
+  "base": "dd0bd9658fa763e89866e01807c0384b6b2e2535",
+  "tree": "666a37621fd55230bdcac20f588257e8efc8408c",
+  "worktree": "/tmp/omnius-provider-control-resume-20261017",
+  "patch": "/tmp/omnius-provider-control-resume-20261017.patch",
+  "patchSha256": "18fdd2a88fe472704e43c19a7f7dd3251d86a8c5f4833826622f380654024636",
+  "files": {
+    "packages/cli/src/commands/mesh.ts": "ebeff3dbc23ca6a4a190618c6e8b3c007ae542a54f7b0d30427cd04326280204",
+    "packages/cli/src/mesh/config.ts": "628f06fa20b8818bd77ec92ad45bd7a4f8992edd644868b65e1cccb7d21375d4",
+    "packages/cli/src/mesh/gateway.ts": "2ed1ffe1aaa44a7d9cab4a4aa698612ddec88b85defe608dde01a02b25af955f",
+    "packages/cli/src/mesh/provider-control.ts": "0df1a19d3a683d6259f149caaad6f36ac98ad880de1d4e8366c953ed13a117a4",
+    "packages/cli/src/mesh/runtime.ts": "f6610078abe1814bab5062bf86f8725db21b4f9d91dbe09c70c832f45bff0116",
+    "packages/cli/src/mesh/sponsor.ts": "d4e278c82fd603b823bbb7587660e418fbc6625677d5c7b40fbed8484c3bd2b0",
+    "packages/cli/tests/mesh-config-transaction.test.ts": "46d1b9b916b860cd286c00ee1d61c0f4b3934959575595aefeeb57695cf91b8f",
+    "packages/cli/tests/mesh-gateway.test.ts": "1e5b0fb76d68ff2cb49f047f41599586aed69f88de3ef78193375dfbf97c34bd",
+    "packages/cli/tests/mesh-provider-control.test.ts": "92c6a4af451d6d602c57582446ed827fbbb2f07c467fe906f165725903786e02",
+    "packages/cli/tests/mesh-runtime-control.test.ts": "48598d462f8f48d68d0bd6eff1e40203d0387f922d3a0a8e427b6a8a47e2bd69",
+    "packages/cli/tests/mesh-sponsor.test.ts": "c75b2c16f67fb6cecbc4acb9e10526124339aa876dac32784f3376e77bee06b2"
+  },
+  "verification": {
+    "runtime": "Node22.22.1",
+    "backend": {
+      "passed": true,
+      "tests": 114,
+      "files": 8,
+      "log": "/tmp/omnius-provider-control-resume-final-20261017.log",
+      "note": "All eight backend suites passed. Initial ninth optional-startup suite lacked private checkout dependency links; see separate successful retry."
+    },
+    "optionalStartup": {
+      "passed": true,
+      "tests": 2,
+      "files": 1,
+      "log": "/tmp/omnius-provider-control-resume-optional-startup-20261017.log",
+      "meaning": "Production-style bundled CLI help/mesh help remain usable with all optional mesh dependencies denied; exported transport factories defer imports until explicit opt-in."
+    },
+    "uniqueTests": 116,
+    "sourceNoEmit": {
+      "passed": true,
+      "log": "/tmp/omnius-provider-control-resume-noemit-20261017.log",
+      "config": "/tmp/omnius-provider-control-resume-tsconfig.json"
+    },
+    "diffCheck": true
+  },
+  "startupHotfixPreserved": {
+    "packages/cli/src/mesh/libp2p-transport.ts": "30da153a247418d09d367ff6771390be924603f2a610480f9a88f9600e9db11b",
+    "scripts/build-publish.mjs": "97c813e72bb4b073b5787d09b95e7d5cc2e346f44a3f16f1c3202685c392616e",
+    "scripts/publish-shrinkwrap.mjs": "52464550be0ffdbcaef1df391c0c3e26b28748dee73dbf96e1b29bc6f2fda4b6"
+  },
+  "guarantees": [
+    "Atomic private config CAS; passive read does not initialize config or identity.",
+    "Config and active runtime revisions distinguished; external control URL/token cannot be changed before a positive Stop.",
+    "Inline keys remain only in private config; key/env-source exclusive and status fields whitelisted/bounded, redirects forbidden.",
+    "Enabled known provider protocol/retirement/credential checks precede transport and offer advertisement; this is configuration validation, not availability verification.",
+    "Gateway and sponsor admission fence starts before asynchronous drains; Stop receipt follows actual settlement and foreground runtime.closed notification.",
+    "Controller dispose stops owned runtime only.",
+    "RPM/minute and daily token usage retain durable reservations through cancellation/restart; per-offer rather than account-global."
+  ],
+  "limits": [
+    "External runtime whose configuration is removed outside this controller cannot be identified without its former private control credentials.",
+    "Configured endpoints and models are not health-checked or loaded by passive menu/status/Start readiness validation.",
+    "Rate counters report reserved conservative token budgets, not measured provider billing.",
+    "Source tests use fake generation backends and owned loopback transports; no real provider inference, GPU/model load, host services, installed config/package changes, build or publication."
+  ],
+  "priorFailures": [
+    {
+      "phase": "before startup interruption",
+      "detail": "Oversized-response HTTP fixture triggered late Undici reconnect blocked by hermetic guard; fixture corrected, final backend tests have no unhandled errors."
+    },
+    {
+      "phase": "rebase verification",
+      "detail": "Optional CLI help initially could not resolve ignore because isolated checkout lacked indexer/execution node_modules links. Added verification-only links to existing workspace dependency closure; both startup cases then passed. No production change."
+    }
+  ]
+}

package/docs/work-orders/evidence/provider-controls-delivery-20261017.json

@@ -0,0 +1,71 @@
+{
+  "base": "dd0bd9658fa763e89866e01807c0384b6b2e2535",
+  "sourceHashes": {
+    "packages/cli/src/commands/mesh.ts": "ebeff3dbc23ca6a4a190618c6e8b3c007ae542a54f7b0d30427cd04326280204",
+    "packages/cli/src/mesh/config.ts": "628f06fa20b8818bd77ec92ad45bd7a4f8992edd644868b65e1cccb7d21375d4",
+    "packages/cli/src/mesh/gateway.ts": "2ed1ffe1aaa44a7d9cab4a4aa698612ddec88b85defe608dde01a02b25af955f",
+    "packages/cli/src/mesh/runtime.ts": "f6610078abe1814bab5062bf86f8725db21b4f9d91dbe09c70c832f45bff0116",
+    "packages/cli/src/mesh/sponsor.ts": "d4e278c82fd603b823bbb7587660e418fbc6625677d5c7b40fbed8484c3bd2b0",
+    "packages/cli/src/tui/command-registry.ts": "a0822a7ff86a8beb87e9530b8d66ee51fbf3fcbac0f04275dfe8a6ad1d89f6a2",
+    "packages/cli/src/tui/commands.ts": "dd5424d094097a191baa1b462e39c6403c9e82ea0d5735a69ddca48d04416fb9",
+    "packages/cli/src/tui/interactive.ts": "a53241806ac1016db704666644196533814e55cdb671cf5d3182f86b58a129c4",
+    "packages/cli/src/tui/native/command-reports.ts": "6f6f56c6f229bcf773d1fcca81f8f7e11c3223ac368a72355afd58fc5ce81420",
+    "packages/cli/src/tui/telegram-bridge.ts": "00d3d4ff70121c4b6ff2d1793637fba1de46ca62844620ac463860cf66d5a157",
+    "packages/cli/tests/command-registry.test.ts": "8443a1c0bc9fd5a75a0d6d7c5fc071d58722594b290541607057fc8cc54dfbf8",
+    "packages/cli/tests/mesh-gateway.test.ts": "1e5b0fb76d68ff2cb49f047f41599586aed69f88de3ef78193375dfbf97c34bd",
+    "packages/cli/tests/mesh-sponsor.test.ts": "c75b2c16f67fb6cecbc4acb9e10526124339aa876dac32784f3376e77bee06b2",
+    "docs/guides/provider-menu.md": "a87e993b1d4c3211be5571b4b6e37e0259284dffd9c7cd4a270cb0fe195b8408",
+    "docs/work-orders/evidence/provider-menu-verification-20261017.json": "8fb0c504254c9a9486dca4a3cd288b362ef05859b440310db9b76ad01e022580",
+    "packages/cli/src/mesh/provider-control.ts": "0df1a19d3a683d6259f149caaad6f36ac98ad880de1d4e8366c953ed13a117a4",
+    "packages/cli/src/tui/provider-controller.ts": "29c23aeed0557ac87fe43f7bbf3fc978a9a716d06f2c7d8713f0ad55eff2c697",
+    "packages/cli/src/tui/provider-menu.ts": "4593c7337cd3130002217f558fa4a8c621aa0af95a0f0f8e12762b04c1078e42",
+    "packages/cli/tests/mesh-config-transaction.test.ts": "46d1b9b916b860cd286c00ee1d61c0f4b3934959575595aefeeb57695cf91b8f",
+    "packages/cli/tests/mesh-provider-control.test.ts": "92c6a4af451d6d602c57582446ed827fbbb2f07c467fe906f165725903786e02",
+    "packages/cli/tests/mesh-runtime-control.test.ts": "48598d462f8f48d68d0bd6eff1e40203d0387f922d3a0a8e427b6a8a47e2bd69",
+    "packages/cli/tests/native-provider-menu.bun.ts": "a1b7353283161e6bc516b61fbf83516e56fc9fd03e3d0c827f62aeeddebe8ab1",
+    "packages/cli/tests/native-provider-menu.test.ts": "82d5555d26492794b5778a767fb4a39cf58e5ac9c3205cf25506cf615e08bac3",
+    "packages/cli/tests/provider-command.test.ts": "ed4a95d436bbc156d1044fe891aef598c801829cd462a882f77ac675b5a0cb70",
+    "packages/cli/tests/provider-controller-lifecycle.test.ts": "48ce28d425c4351d7040cab7ffcbb02af684ac2e24e42815e04d4ffc4f8288ad",
+    "packages/cli/tests/provider-exit-wiring.test.ts": "4b050ba71603ea5c996d391ff9090532cc7ad4f9f2aa362e96d223076b220fee",
+    "packages/cli/tests/provider-menu-lazy-startup.test.ts": "958c03985374fd9dce03e93facee77717996e645ae108e1082fc22864ef55055",
+    "packages/cli/tests/provider-menu.test.ts": "63b7fe9522641fe04bb7e24ae8248eacddb33970a33b253793643596604ddc12",
+    "docs/work-orders/evidence/provider-control-verification-20261017.json": "434be71b4ade53d6fdca5dc741d46e601154ee02a4e52cd8a64b4fd883e47926"
+  },
+  "verification": {
+    "node": "22.22.1",
+    "focusedUniqueTestsPassed": 154,
+    "vitestFiles": 15,
+    "nativeSizes": [
+      "60x20",
+      "80x24",
+      "100x30",
+      "120x36",
+      "160x48"
+    ],
+    "sourceNoEmit": "PASS",
+    "allWorkspaceBuild": "PASS",
+    "logs": [
+      "/tmp/omnius-provider-complete-tests-final.log",
+      "/tmp/omnius-provider-complete-native-final.log",
+      "/tmp/omnius-provider-complete-noemit.log",
+      "/tmp/omnius-provider-complete-build.log"
+    ],
+    "interpretation": "Initial combined run passed153 and failed only the native wrapper because ignored lifecycle scripts left the Bun stub. After dependency-only Bun setup, the12-test native/command/actual-exit gate passed, completing154 unique cases against unchanged production source."
+  },
+  "independentReview": {
+    "reviewer": "instrument_widgets",
+    "findingsFixed": [
+      "Typed quit and fallback exit await owned runtime settlement before teardown. Failed custody holds exit and remains retryable.",
+      "Telegram/noninteractive passthrough is rejected before controller access; provider is absent from bot registration and remote help."
+    ],
+    "startup": "Optional mesh and parser graph remains deferred; production-style bundled startup checks pass."
+  },
+  "scope": {
+    "sourceOnly": true,
+    "realInferenceRequests": 0,
+    "modelLoads": 0,
+    "cudaWorkloads": 0,
+    "hostServicesChanged": false,
+    "published": false
+  }
+}

package/docs/work-orders/evidence/provider-menu-verification-20261017.json

@@ -0,0 +1,95 @@
+{
+  "schemaVersion": 1,
+  "date": "2026-10-17",
+  "baseCommit": "dd0bd965",
+  "feature": "Native /provider private drafts, scoped sponsorship configuration and observed runtime status",
+  "passed": true,
+  "runtime": {
+    "node": "22.22.1",
+    "bun": "1.3.14",
+    "openTui": "0.6.6"
+  },
+  "verification": {
+    "vitest": {
+      "passed": 20,
+      "failed": 0,
+      "files": 3,
+      "log": "/tmp/omnius-provider-menu-dd0-tests.json",
+      "counting": "20 Vitest cases include one wrapper for the five actual-native scenarios; those five are not five additional Vitest cases."
+    },
+    "native": {
+      "passed": true,
+      "checks": [
+        "actual native main menu remains bounded, default-colored and keyboard accessible at five terminal sizes without losing the underlying draft",
+        "real keyboard invalid numeric input remains in its editor; outside dismissal preserves the original limit and private draft",
+        "native secret typing stays masked; review renders exact model and explicit pointer Save persists privately without starting",
+        "measured status uses actual controller metadata in named rows with no raw JSON or credential projection",
+        "closing the provider menu restores the exact main draft/cursor and releases input ownership; every captured frame/spec omits secrets"
+      ],
+      "count": 5,
+      "sizes": 5,
+      "inferenceRequests": 0,
+      "saveCount": 1,
+      "starts": 0
+    },
+    "viewports": [
+      [
+        60,
+        20
+      ],
+      [
+        80,
+        24
+      ],
+      [
+        100,
+        30
+      ],
+      [
+        120,
+        36
+      ],
+      [
+        160,
+        48
+      ]
+    ],
+    "sourceAndNodeTestNoEmit": {
+      "exitCode": 0,
+      "log": "/tmp/omnius-provider-menu-dd0-focused-noemit.log"
+    },
+    "diffCheck": "PASS"
+  },
+  "contracts": [
+    "Passive opening/cancellation creates no configuration, identity, runtime, provider request or model load.",
+    "Nested drafts include exact local/authorizedHTTPS scope, model, protocol, per-offer enablement, credentials, per-source rate/capacity/token limits, requester trust, pinned peers, listeners/relays and gateway port.",
+    "Invalid input remains editable. Stored secrets use an empty masked native editor; old/new keys and gateway token never enter modal specs or paint buffers. Endpoint/protocol/admission edits clear the previous credential.",
+    "Only explicit Review and Save persists through captured revision CAS. Passive polling/runtime status cannot silently advance that editing base. Start/apply operate on saved configuration; unsaved drafts are retained.",
+    "Status uses observed controller fields, bounded800ms polling with one request in flight, cleanup and late-receipt guards. Missing credentials/readings remain missing/unknown; env presence is explicitly unchecked by this menu.",
+    "Start/apply Stop requests are labelled as pending until startup settles and actual stop completes; the menu does not claim immediate cancellation.",
+    "Mesh parsers use dynamic external imports only inside openProviderMenu. A real bundled module imports safely when mesh parser resolution is forbidden."
+  ],
+  "scope": {
+    "controller": "Fixture controller only; backend validation/runtime is verified and owned separately.",
+    "native": "Actual OpenTUI renderers, keyboard/pointer editing, five viewport sizes, same editor draft/cursor retained.",
+    "terminalDefaults": true,
+    "inferenceRequests": 0,
+    "hostServiceChanges": 0,
+    "modelLoads": 0,
+    "cudaWork": 0,
+    "globalInstallOrPublish": false
+  },
+  "sourceHashes": {
+    "packages/cli/src/tui/provider-menu.ts": "4593c7337cd3130002217f558fa4a8c621aa0af95a0f0f8e12762b04c1078e42",
+    "packages/cli/tests/provider-menu.test.ts": "63b7fe9522641fe04bb7e24ae8248eacddb33970a33b253793643596604ddc12",
+    "packages/cli/tests/native-provider-menu.bun.ts": "a1b7353283161e6bc516b61fbf83516e56fc9fd03e3d0c827f62aeeddebe8ab1",
+    "packages/cli/tests/native-provider-menu.test.ts": "82d5555d26492794b5778a767fb4a39cf58e5ac9c3205cf25506cf615e08bac3",
+    "packages/cli/tests/provider-menu-lazy-startup.test.ts": "958c03985374fd9dce03e93facee77717996e645ae108e1082fc22864ef55055"
+  },
+  "excluded": [
+    "Copied backend mesh source files used only for private type/integration verification",
+    "Private configs/node_modules",
+    "Command/registry/controller binding owned by parent",
+    "All unrelated root changes"
+  ]
+}

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "omnius",
-  "version": "1.0.876",
+  "version": "1.0.877",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omnius",
-      "version": "1.0.876",
+      "version": "1.0.877",
       "bundleDependencies": [
         "image-to-ascii"
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnius",
-  "version": "1.0.876",
+  "version": "1.0.877",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/library.js",