onto-mcp 0.4.11 → 0.4.13

package/.onto/processes/review/prompt-execution-runner-contract.md

@@ -60,7 +60,7 @@ runtime은 아래만 한다.
    - `prompt-packets/synthesis/{issue_id}.prompt.md`
 9. executor realization
    - `worker`
-   - `direct-call`
+   - `direct_call`
 10. host runtime
    - `codex`
    - `openai`
@@ -108,6 +108,9 @@ runtime은 아래만 한다.
 9. `execution-result.yaml`
 10. `review-run-manifest.yaml`
 11. `error-log.md`
+12. `dispatch-incomplete.yaml` — dispatch breaker가 켜진 배치(lens/issue-stance)의
+    end state (완료/dead-letter/미완료 집합). 트립이든 완주든 기록하며, OFF에서는
+    쓰지 않는다
 
 원칙:
 
@@ -121,6 +124,22 @@ runtime은 아래만 한다.
 - `execution-result.yaml`은 actual execution truth의 canonical seat다
 - `execution-result.yaml`과 `review-run-manifest.yaml`은 effective retry policy를 기록해야 한다
 - `lens-completion-barrier.yaml`은 downstream stage 진입 gate다
+- `review.execution.retry.dispatch_breaker`(opt-in)가 켜지면 lens/issue-stance
+  fan-out 풀의 **flat per-unit 루프**는 유닛의 최종 outcome을 계통 실패 분류
+  (rate_limit/auth/transport)로 관찰하고, 서로 다른 유닛에 걸친 연속 계통 실패가
+  임계에 닿으면 잔여 유닛을 디스패치하지 않고 halt한다 (`halt_reason` prefix
+  `dispatch_breaker:`, lens 풀은 `halt_phase=lens_dispatch_breaker`). 미완료
+  집합은 `dispatch-incomplete.yaml`이 회복 계약(재디스패치 집합 == 미완료 집합)
+  으로 영속하며, 트립 halt의 execution-result는 완료 유닛 행을 보존한다.
+  nested-workers 1차 배치가 실행된 스테이지도 breaker가 적용된다(§4-1): 배치-창
+  SUCCESS는 실 디스패치가 아니므로 완료로만 집계돼 계통 streak을 리셋하지 않고,
+  배치-창 FAILURE는 flat 경로처럼 실패로 분류된다(item-local→dead-letter, 계통→
+  회복 미완료 집합). 배치-실패 유닛의 flat 재시도가 계통 실패를 직접 관찰·구동
+  한다. lens/issue-stance 풀의 실제 dispatch width가 2 이상이면 runner가
+  breaker policy를 내부적으로 `concurrent:true`로 투영해 완료순서가 poison-vs-outage
+  회복 집합을 결정하지 못하게 한다. 이 값은 사용자 설정 키가 아니라 runtime-owned
+  execution projection이다. OFF(기본)는 현행 halt/배리어 동작이며 nested 경로도
+  무변경이다
 - degraded case / partial failure는 `error-log.md`에 기록해야 한다
 - runtime unavailable completion으로 root unit이 completed가 된 경우에도 원 실패는 child unit result로 보존하고 degradation evidence에 포함해야 한다
 - `error-log.md`는 최소 한 번 `EffectiveBoundaryState`를 기록해야 한다
@@ -168,13 +187,18 @@ evidence로 쓰지 않는다.
 
 현재 구현에서 prompt execution runner를 통해 실행되는 execution profile:
 
-- `worker + codex` (Codex CLI 경로)
-- `worker + direct-call` (API/local provider 경로)
-
-`nested-workers` mode는 현재 runner에서 pre-dispatch structured failure로
-차단한다. inner lens worker가 runtime submit-tool serialization,
-read-only sandbox, `execution-plan.max_concurrent_lenses` 기반 bounded dispatch를
-같은 방식으로 보장하기 전에는 active product path가 아니다.
+- `main-workers + codex|claude_code` (Codex CLI 또는 Claude Code CLI 경로)
+- `main-workers + direct_call` (API/local provider 경로)
+- `nested-workers + codex|claude_code` (outer OAuth worker가 ready unit batch를
+  fan-out하고, inner unit은 flat 경로와 동일한 unit-executor CLI/seat/검증 계약을
+  따른다)
+
+`nested-workers + direct_call`은 outer worker seat가 없으므로
+`nested_workers_executor_unsupported` structured failure로 fail-closed한다. raw
+provider-CLI inner bridge는 retired 경로이며, active nested path의 계약은
+`nesting-batch-worker-contract.md`가 소유한다. mock-backed nested harness는 wiring,
+schema, artifact contract, route/failure 검증 evidence이며 product semantic
+completion 또는 semantic quality evidence로 승격하지 않는다.
 
 원칙:
 

package/.onto/processes/review/review-target-profile-contract.md

@@ -93,8 +93,8 @@ material_profile:
   target_material_kind: code
   target_material_kind_candidates:
     - code
-  support_status: partial
-  unsupported_reason: review records target material kind, but material-specific validation is not implemented yet
+  support_status: supported
+  unsupported_reason: null
   detection:
     owner: runtime_heuristic
     confidence: 0.92
@@ -157,8 +157,51 @@ This axis must stay separate from:
 - `medium`: a cross-product reference and learning frame
 
 The current runtime records material kind and detection confidence as a bounded
-heuristic. It must not claim material-specific validation until per-material
-validators or adapters are implemented.
+heuristic. Per-material review handling is implemented for **spreadsheet** through a
+**single per-ref disposition** (`computeSpreadsheetDisposition`, the SSOT): every
+spreadsheet honesty surface — `support_status`, `target_refs[].inspectable`/`.sha256`,
+the `review_goal` obligations, the prompt `material_kind_obligations`, and the render
+notes — **projects from one record computed once over the shared observation**, instead
+of each surface re-deriving its claim from a different proxy. The structural inventory is
+rendered into `materialized-input.md` with detail (formula text, named-range references,
+data-validation rules incl. operator + formula bounds, protections, risk signals) —
+**structure inspected only, not recalculated**.
+
+Two distinct axes, deliberately not coupled:
+
+- **`inspectable`** — the workbook was read (`unsupported_reason === null`) AND has
+  renderable structure, *including plain tabular data* (columns / per-column cardinality /
+  distinct-value counts). The aggregate-only rule is NARROWED, not preserved: the single
+  value-bearing field is `data_validations[].members` — bounded DECLARED type=list enum labels
+  parsed from a formula1 literal (never observed/free/high-cardinality cell values).
+  A clean CSV or a formula-free data `.xlsx` is `inspectable` and stays
+  `support_status: supported`. It is NOT coupled to whether any obligation is backed.
+- **`backed_goals`** — the POSITIVE subset of the six obligations whose specific evidence
+  exists in that ref's inventory; this drives `review_goal`. `review_goal` therefore
+  carries **only the backed subset, not always all six**: a plain-data CSV backs none
+  (and so carries no spreadsheet obligation while remaining `supported`); a macro-only or
+  protection-only workbook backs only `access_and_protection_hygiene`. `structural_risk_signals`
+  is backed by genuine structural risk only — `unreadable_sheet_part` (an observation-failure
+  marker) and the `macro_present` / `external_links_present` signals (owned by other goals)
+  do not back it.
+
+`support_status` runs the gate over the **union of resolved and materialized** spreadsheet
+refs the prompt renders — **regardless of the resolved material kind**, so a `code`-resolved
+target carrying a materialized workbook the observer could not read degrades to `partial`
+(it is not gated only when the resolved kind is spreadsheet). If **any** rendered spreadsheet
+ref is uninspectable the target is `partial`, with a reason naming each uninspected ref by
+its full resolved path and actual cause; obligations are dropped only when **no** ref is
+inspectable. A `supported`/`null` profile is never emitted for a workbook the render shows as
+`unsupported`. The render emits obligation-backing detail **before** the per-sheet bodies so
+the prompt embed cut cannot strip an obligation's evidence, and protected/hidden sheets beyond
+the render cap are disclosed by count. Observation bounds the number of sheets read
+(`max_sheets_observed`, conservatively high) and a CSV/workbook whose decode or parse throws
+degrades to an honest `unsupported` inventory rather than aborting review prep.
+
+`code`, `document`, `database`, and `unknown` retain their prior support states
+until their per-material review adapters land. A spreadsheet inside a `mixed`
+bundle does not yet receive spreadsheet obligations (a known limitation,
+consistent with the `mixed` support state).
 
 ---
 

package/.onto/processes/shared/pipeline-execution-ledger-contract.md

@@ -81,6 +81,7 @@ interface PipelineExecutionLedgerUnitEntry {
   lastFailureMessage: string | null;
   upstreamUnitIds: string[];
   downstreamUnitIds: string[];
+  resolution?: "demoted";
   executionTelemetry?: PipelineUnitExecutionTelemetry | null;
 }
 
@@ -170,6 +171,16 @@ Execution telemetry rules:
   competency-question assessment) so batching changes stay attributable.
 - Units that made no LLM call carry no telemetry field; absence is not a
   failure signal.
+- `resolution: "demoted"` marks terminal resolution outside the trusted-output
+  path (bounded resubmit exhausted, complete-with-failure): the downstream
+  stage product consumed and disclosed the gap (review: issue-stance-matrix
+  `validation.missing_stances`), so the unit owes no further dispatch — it
+  must not reappear on the frontier, block convergence, or block downstream
+  upstream-trust. `status`/`lastFailureMessage` keep the audit truth
+  (typically `failed`); a resolved unit contributes no preserved artifacts.
+  Frontier/convergence consumers use `isResolvedLedgerUnit`
+  (trusted-or-resolved); artifact-preservation consumers keep
+  `isTrustedLedgerUnit`.
 - Current population status: `reconstruct` populates telemetry from its run
   manifest steps. `review` does not populate it yet.
 

package/.onto/processes/shared/target-material-kind-contract.md

@@ -81,7 +81,7 @@ the lexicon.
 
 | Process | Required alignment |
 |---|---|
-| `review` | `review-target-profile.yaml` records `target_material_kind`; review must not claim material-aware validation before per-material validators exist. |
+| `review` | `review-target-profile.yaml` records `target_material_kind` and provides a per-material review adapter for `spreadsheet` via a **single per-ref disposition** (`computeSpreadsheetDisposition`): every honesty surface (`support_status`, `target_refs[].inspectable`, `review_goal`, prompt obligations, render notes) projects from one record. `inspectable` (the workbook was read and has renderable structure, *including plain tabular data*) drives `support_status`; the **positive** `backed_goals` subset drives `review_goal`, so `review_goal` carries only the backed obligations — a plain CSV is `supported`/`inspectable` yet backs none, and a macro/protection-only workbook backs only `access_and_protection_hygiene`. `support_status` degrades to `partial` when **any** rendered ref across the resolved∪materialized union is uninspectable (unsupported format .xls/.xlsb/.ods, unreadable/oversized/empty, or a corrupt shell), and the gate runs regardless of the resolved kind (a code target carrying a materialized uninspectable workbook also degrades). `code` stays `supported`, `document`/`database` stay `partial`, `mixed` stays `partial_composite`, and `unknown` stays `unknown` until their adapters land (precise per-kind states owned by `review-target-profile-contract.md` §6). Review `support_status` and reconstruct `runtime_implementation_status` are **independent per-process axes over the same shared inventory backing**: review `supported` does not imply the reconstruct seed pipeline is fully wired (it remains `partially_wired`). |
 | `reconstruct` | Source profiles, source adapters, source observations, and directive validation must be keyed by `target_material_kind`. |
 | `evolve` | Future adapters must not assume code-product inputs; adapter selection should start from `target_material_kind` as defined in `.onto/processes/evolve/material-kind-adapter-contract.md`. |
 

package/README.md

@@ -55,7 +55,19 @@ only host-owned config; it never writes onto runtime data. Override the
 launched command or server name with `--command <cmd>` / `--name <id>`.
 
 **Claude Code profiles.** Claude Code stores MCP servers per config directory
-(`CLAUDE_CONFIG_DIR`). If you run multiple profiles, target one explicitly:
+(`CLAUDE_CONFIG_DIR`). To register every profile in one command, let `onto`
+discover them — it scans `~/.claude` and `~/.claude-*` for real config dirs
+(those carrying `settings.json`, `.credentials.json`, `.claude.json`, or
+`projects/`) plus any ambient `CLAUDE_CONFIG_DIR`, and registers each:
+
+```bash
+onto register --hosts claude-code --all-claude-profiles --yes  # every profile
+onto register --all --all-claude-profiles --yes                # profiles + other hosts
+onto register --all-claude-profiles --list                     # preview discovered profiles
+```
+
+To target a single profile instead, name it explicitly (mutually exclusive with
+`--all-claude-profiles`):
 
 ```bash
 onto register --hosts claude-code --claude-config-dir ~/.claude-1 --yes
@@ -284,6 +296,57 @@ LLM switcher axes:
 
 Unsupported settings stop during profile resolution.
 
+### provider·model 전환 (권장: `onto configure-provider`)
+
+`settings.json`을 손으로 고치는 대신 `onto configure-provider`가 actor LLM 블록을
+라우트 검증 후 기록합니다(units 등 다른 설정은 보존). 라우팅 불가능한 조합은 기록
+전에 fail-loud 합니다.
+
+```sh
+# Codex (OpenAI) OAuth
+onto configure-provider --provider openai --model gpt-5.5 --auth oauth \
+  --effort medium --service-tier fast
+
+# Claude Code (Anthropic) OAuth
+onto configure-provider --provider anthropic --model claude-opus-4-8 --auth oauth \
+  --effort high
+```
+
+- `--service-tier`는 `openai`+`oauth`(Codex) 경로 전용입니다 — anthropic에 주면
+  profile 해석 단계에서 거부됩니다.
+- `--auth`를 주면 reconstruct actor 블록(`semantic_author`/`confirmation_provider`)도
+  함께 기록합니다. 생략하면 review actor만 기록하고 loader가 provider 기본 auth를 파생합니다.
+- `--timeout-ms <ms>`는 각 actor `llm` 블록에 per-actor `timeout_ms`(양의 정수)를
+  함께 기록합니다 — codex/claude direct-call worker 호출 타임아웃(아래 [타임아웃](#타임아웃)
+  참고). api_key SDK 경로에는 적용되지 않습니다.
+- `--project`는 프로젝트 seat(`.onto/settings.json`)에, 생략하면 사용자 seat
+  (`~/.onto/settings.json`)에 기록합니다.
+- 지원 model id는 [`.onto/authority/supported-models.yaml`](.onto/authority/supported-models.yaml)가
+  authority입니다(현재 anthropic: `claude-opus-4-8`; `claude-sonnet-5`는
+  `semantic_map_synthesize` 역할 전용).
+- 이 명령은 actor 블록만 기록합니다. `units[].llm.model`로 unit별 model을 고정해
+  두었다면(위 정적 프로필 예시가 그렇습니다) 같은 model로 바꾸거나 그 `model` 키를
+  지워 actor 값을 상속하게 하세요.
+
+### 타임아웃
+
+| 경로 | 기본값 | 조절 knob (우선순위) |
+|---|---|---|
+| review unit worker (codex/claude) | 240s (짧은 응답 단계 180s, `issue_stance_matrix` 120s) | `units[].timeout_ms` |
+| direct-call CLI worker (codex/claude) — reconstruct·inline review | 600s | actor `llm.timeout_ms` → 없으면 `ONTO_LLM_TIMEOUT_MS` |
+| SDK direct call (`api_key`) | 120s | `ONTO_LLM_TIMEOUT_MS` (ms) |
+
+`llm.timeout_ms`(ms)는 actor `llm` 블록에 넣는 per-actor 값으로, codex/claude CLI worker
+경로(reconstruct의 `semantic_author`/`confirmation_provider`, inline review actor)의 호출
+타임아웃을 그 값으로 고정합니다. 없으면 env `ONTO_LLM_TIMEOUT_MS`, 그것도 없으면 기본값을
+씁니다(api_key SDK 경로에는 적용되지 않고 `ONTO_LLM_TIMEOUT_MS`만 반영). 이 knob은 review의
+`units[].timeout_ms`(worker 프로세스 bound)와 구분되는 별개 계층입니다.
+
+`ONTO_LLM_TIMEOUT_MS`(ms)는 direct-call/CLI-worker와 SDK 경로 기본값을 전역으로 덮어씁니다.
+opus 같은 프론티어 모델의 긴 단일-turn authoring도 600s worker 기본값으로 완료되므로 지원
+모델에는 override가 필요 없습니다. 특정 review unit이 오래 걸리면 그 unit의
+`units[].timeout_ms`만 키우면 됩니다(모든 unit에 큰 값을 박을 필요 없음).
+
 ## Documentation
 
 | Document | Contents |

package/dist/cli.js

@@ -40,6 +40,8 @@ function printHelp() {
         "  mcp            Start the MCP stdio tool server",
         "  register       Register the onto MCP server into supported hosts",
         "  configure-provider  Write LLM provider settings into the settings.json chain",
+        "  seats          List every LLM model seat, resolved (--json for machine output)",
+        "  watch          Live read-only TUI for review/reconstruct sessions",
         "",
         "Available MCP tools:",
         "  onto_review",
@@ -63,7 +65,7 @@ function printHelp() {
 function unsupportedCommandMessage(subcommand) {
     return [
         `[onto] Unsupported public CLI subcommand: ${subcommand}`,
-        "Active public commands: onto mcp, onto register, onto configure-provider",
+        "Active public commands: onto mcp, onto register, onto configure-provider, onto seats, onto watch",
     ].join("\n");
 }
 async function main() {
@@ -80,10 +82,18 @@ async function main() {
             const { runRegister } = await import("./core-runtime/onboard/register.js");
             return runRegister(argv.slice(1));
         }
+        case "watch": {
+            const { runWatch } = await import("./tui/index.js");
+            return runWatch(argv.slice(1));
+        }
         case "configure-provider": {
             const { runConfigureProvider } = await import("./core-runtime/onboard/configure-provider.js");
             return runConfigureProvider(argv.slice(1));
         }
+        case "seats": {
+            const { runSeats } = await import("./core-runtime/cli/run-seats.js");
+            return runSeats(argv.slice(1));
+        }
         case "--version":
         case "-v": {
             const version = await readOntoVersion();