open-multi-agent-kit 0.78.0

package/docs/local-graph-memory.md

@@ -0,0 +1,102 @@
+# Project-local graph memory
+
+OMK defaults to a project-local ontology graph so open-source projects can keep memory state inside the repository without a running database or secrets.
+
+Default state file:
+
+```txt
+.omk/memory/graph-state.json
+```
+
+Readable Markdown mirrors still live under `.omk/memory/*.md` for diffs and manual review. The graph state is the source of truth; the Markdown files are human-facing mirrors.
+
+## Backend policy
+
+`omk init` and `omk sync` write this policy to `.omk/config.toml` and `~/.kimi/omk.memory.toml`:
+
+```toml
+[memory]
+backend = "local_graph"    # local_graph | kuzu
+scope = "project-session"
+strict = true
+mirror_files = true
+migrate_files = true
+
+[local_graph]
+path = ".omk/memory/graph-state.json"
+ontology = "omk-ontology-mindmap-v1"
+query = "graphql-lite"
+```
+
+`strict = true` means memory write failures are surfaced instead of silently dropping recall state. Local graph memory has no password or daemon requirement. Use `backend = "kuzu"` when you want the embedded Kuzu graph backend.
+
+## Ontology mind map
+
+Each write is decomposed into an ontology-based mind map. OMK creates nodes such as:
+
+- `Project`, `Session`, `Memory`, `MemoryVersion`
+- `Goal`, `Topic`, `Decision`, `Task`, `Risk`
+- `Command`, `File`, `Evidence`, `Constraint`
+- `Question`, `Answer`, `Concept`
+
+Relationship types include:
+
+- `HAS_SESSION`, `HAS_MEMORY`, `WROTE`, `UPDATES`
+- `HAS_GOAL`, `HAS_TOPIC`, `HAS_DECISION`, `HAS_TASK`, `HAS_RISK`
+- `HAS_COMMAND`, `HAS_FILE`, `HAS_EVIDENCE`, `HAS_CONSTRAINT`
+- `HAS_QUESTION`, `HAS_ANSWER`, `HAS_CONCEPT`, `PART_OF`, `TOUCHES_FILE`
+
+This lets the agent split long notes into a detailed project/session mind map without adding a runtime dependency.
+
+## MCP tools
+
+The built-in `omk-project` MCP server exposes graph memory tools:
+
+- `omk_read_memory`
+- `omk_write_memory`
+- `omk_read_run_memory`
+- `omk_write_run_memory`
+- `omk_search_memory`
+- `omk_memory_status`
+- `omk_memory_ontology`
+- `omk_memory_mindmap`
+- `omk_graph_query`
+
+## GraphQL-lite examples
+
+OMK intentionally uses a small GraphQL-style dialect instead of adding a GraphQL server dependency:
+
+```graphql
+query {
+  ontology { classes relationTypes }
+}
+```
+
+```graphql
+query {
+  memory(path: "project.md") { path content }
+}
+```
+
+```graphql
+query {
+  mindmap(query: "decision", limit: 30) { root nodes edges }
+}
+```
+
+```graphql
+query {
+  nodes(type: "Task", query: "release", limit: 20) { id type label }
+}
+```
+
+## Optional embedded Kuzu
+
+Kuzu is the supported embedded graph database backend for projects that want Cypher-style graph queries without an external daemon:
+
+```toml
+[memory]
+backend = "kuzu"
+```
+
+Kuzu stores its database under `.omk/memory/kuzu.db` and uses the same ontology decomposition as local graph memory.

package/docs/lsp.md

@@ -0,0 +1,48 @@
+# Built-in LSP
+
+open-multi-agent-kit ships bundled TypeScript and Python LSP launchers for open-source projects.
+
+## Commands
+
+```bash
+omk lsp --print-config   # print the default .omk/lsp.json payload
+omk lsp --check          # show the resolved bundled language-server binary for the default server
+omk lsp typescript       # start typescript-language-server over stdio
+omk lsp python           # start pyright-langserver over stdio
+```
+
+## Default project config
+
+`omk init` writes `.omk/lsp.json` with bundled TypeScript and Python server entries:
+
+```json
+{
+  "version": 1,
+  "enabled": true,
+  "defaultServer": "typescript",
+  "servers": {
+    "typescript": {
+      "command": "omk",
+      "args": ["lsp", "typescript"],
+      "languages": ["typescript", "typescriptreact", "javascript", "javascriptreact"],
+      "rootPatterns": ["tsconfig.json", "jsconfig.json", "package.json"],
+      "bundled": true
+    },
+    "python": {
+      "command": "omk",
+      "args": ["lsp", "python"],
+      "languages": ["python"],
+      "rootPatterns": ["pyproject.toml", "requirements.txt", "uv.lock", "setup.py"],
+      "bundled": true
+    }
+  }
+}
+```
+
+The launcher uses the package-local `typescript-language-server` and `pyright` dependencies, so consumers do not need maintainer-local paths or API keys.
+
+## Security notes
+
+- The LSP config contains no credentials.
+- It ships bundled TypeScript and Python LSP launchers by default.
+- Additional language servers should be added explicitly per project.

package/docs/mcp-ontology-proposal.md

@@ -0,0 +1,12 @@
+# Codex/OMK Goal + Ontology Graph MCP Proposal
+
+This proposal is superseded by the current local graph + embedded Kuzu memory policy.
+
+Current direction:
+
+- `local_graph` remains the default, daemon-free ontology graph backend.
+- `kuzu` is the supported embedded graph database backend for Cypher-style graph queries.
+- External graph database credential blocks are not part of the runtime path.
+- MCP memory tools (`omk_memory_mindmap`, `omk_graph_query`, `omk_search_memory`) should target local graph or Kuzu only.
+
+See [`docs/local-graph-memory.md`](./local-graph-memory.md) for the active configuration and query examples.

package/docs/native-root-runtime-algorithms.md

@@ -0,0 +1,402 @@
+# Native Root Runtime Algorithms and Acceptance Criteria
+
+This appendix records the algorithmic contract and acceptance criteria for the OMK native root loop and runtime router. It is intended for papers, README excerpts, and DESIGN/architecture handoffs without claiming that every adapter has reached stable release status.
+
+Implementation baseline:
+
+- Upstream reference discussed during the hardening review: `6305e2b62185c11549f59e2340936769a3027cdd`.
+- Current branch implementation target: `v1.2/native-root-runtime` after native runtime hardening.
+- The upstream reference commit mainly patched release/smoke tarball globs; the algorithms below describe the native root loop, runtime router, context-capsule conversion, secure prompt transport, and scoped worker environment contracts.
+- Safety wording is scoped to the exact adapter and evidence gates. Prompt envelopes, run artifacts, and explicit override environments remain trusted local/private data.
+
+## LaTeX preamble
+
+```latex
+\usepackage{algorithm}
+\usepackage{algpseudocode}
+\usepackage{amsmath}
+\usepackage{xspace}
+
+\newcommand{\OMK}{\textsc{OMK}\xspace}
+\newcommand{\Kimi}{\textsc{Kimi}\xspace}
+\newcommand{\Runtime}{\mathcal{R}}
+\newcommand{\Capsule}{\mathcal{C}}
+\newcommand{\Task}{\mathcal{T}}
+\newcommand{\Env}{\mathcal{E}}
+```
+
+## Algorithm 1: OMK Native Root Turn Execution
+
+```latex
+\begin{algorithm}[t]
+\caption{\OMK Native Root Turn Execution}
+\label{alg:omk-native-root-turn}
+\begin{algorithmic}[1]
+\Require User input stream $U$, runtime bootstrap $\beta$, task runner $\Runtime$, environment $\Env$
+\Require Scoped MCP allowlist $M$, skills $S$, hooks $H$, turn timeout $\tau$
+\Ensure Runtime output, TODO synchronization, and per-turn execution evidence
+
+\State $\tau \gets \textsc{ResolveTimeout}(\Env[\texttt{OMK\_TURN\_TIMEOUT\_MS}], 120000)$
+\State $\mathcal{Q} \gets \textsc{BuildSlashCommandTable}(\beta, \Env)$
+
+\While{\textsc{SessionActive}()}
+    \State $u \gets \textsc{ReadLine}(\texttt{omk>})$
+    \If{$u = \emptyset$}
+        \State \textbf{continue}
+    \EndIf
+
+    \If{$u \in \{\texttt{exit}, \texttt{quit}, \texttt{:q}, \texttt{/exit}, \texttt{/quit}\}$}
+        \State \textbf{break}
+    \EndIf
+
+    \If{\textsc{IsSlashCommand}$(u)$}
+        \State $(c,a) \gets \textsc{ParseCommand}(u)$
+        \If{$c \in \mathcal{Q}$}
+            \State \textsc{ExecuteCommand}$(\mathcal{Q}[c], a)$
+        \Else
+            \State \textsc{Print}(\texttt{Unknown command})
+        \EndIf
+        \State \textbf{continue}
+    \EndIf
+
+    \State $A \gets \textsc{BuildCapabilityInjection}(M,S,H)$
+    \State $P \gets \textsc{BuildPromptEnvelope}(\beta,u,A)$
+    \State $v \gets \textsc{BuildDagNode}(P,\beta,A)$
+    \Comment{$v$ is a coordinator node with provider/model routing}
+
+    \State $a \gets \textsc{NewAbortController}()$
+    \State \textsc{StartTimer}$(a,\tau)$
+
+    \Try
+        \State $r \gets \Runtime.\textsc{Run}(v,\Env,a.\textsc{Signal})$
+        \If{$r.\texttt{stdout} \neq \emptyset$}
+            \State \textsc{WriteStdout}$(r.\texttt{stdout})$
+            \State \textsc{AppendRecentOutput}$(r.\texttt{stdout})$
+            \State \textsc{SyncTodosIfPresent}$(r.\texttt{stdout})$
+        \EndIf
+        \If{$r.\texttt{stderr} \neq \emptyset \land r.\texttt{exitCode} \neq 0$}
+            \State \textsc{WriteStderr}$(r.\texttt{stderr})$
+        \EndIf
+    \Catch{$e$}
+        \If{$a.\textsc{Aborted}()$}
+            \State \textsc{ReportError}(\texttt{Turn timed out after }$\tau$)
+        \Else
+            \State \textsc{ReportError}$(e)$
+        \EndIf
+    \EndTry
+
+    \State \textsc{ClearTimer}()
+\EndWhile
+\State \Return $0$
+\end{algorithmic}
+\end{algorithm}
+```
+
+## Algorithm 2: Native Root Turn Node Construction
+
+The current hardening branch infers turn risk before assigning capabilities. This supersedes the earlier fixed `write,shell` construction. The classifier is a conservative prompt heuristic, not a full semantic planner.
+
+```latex
+\begin{algorithm}[t]
+\caption{Native Root Turn Node Construction}
+\label{alg:omk-turn-node}
+\begin{algorithmic}[1]
+\Require Bootstrap $\beta$, user prompt $u$, optional node id $i$, MCP set $M$, skill set $S$, hook set $H$
+\Require Execution policy $x \in \{\texttt{ask},\texttt{auto},\texttt{never}\}$
+\Ensure DAG node $v$ with provider-neutral prompt envelope and scoped capability routing
+
+\State $i \gets i \ \textbf{or}\ \texttt{turn-}\textsc{Now}()$
+\State $z \gets \textsc{InferNativeTurnRisk}(u)$
+\Comment{heuristic: merge/shell/write keywords, else read}
+\State $A \gets \textsc{NormalizeCapabilities}(M,S,H)$
+\State $\pi \gets \textsc{NativeTurnRoutingPolicy}(\beta.\texttt{provider},z)$
+
+\If{$\beta.\texttt{provider}=\texttt{deepseek} \land z \neq \texttt{read}$}
+    \State $\pi.\texttt{capabilities} \gets [\texttt{read},\texttt{review}]$
+    \State $\pi.\texttt{readOnly} \gets \texttt{true}$
+    \State $\pi.\texttt{sandboxMode} \gets \texttt{read-only}$
+\ElsIf{$z=\texttt{read}$}
+    \State $\pi.\texttt{capabilities} \gets [\texttt{read}]$
+    \State $\pi.\texttt{readOnly} \gets \texttt{true}$
+\ElsIf{$z=\texttt{write}$}
+    \State $\pi.\texttt{capabilities} \gets [\texttt{write},\texttt{patch}]$
+\ElsIf{$z=\texttt{merge}$}
+    \State $\pi.\texttt{capabilities} \gets [\texttt{write},\texttt{patch},\texttt{shell},\texttt{merge}]$
+\Else
+    \State $\pi.\texttt{capabilities} \gets [\texttt{write},\texttt{patch},\texttt{shell}]$
+\EndIf
+
+\State $E \gets \textsc{BuildPromptEnvelope}(\beta,u,A,\texttt{role}=\texttt{root-coordinator},\texttt{nodeId}=i,\texttt{risk}=z,\texttt{approval}=x,\texttt{sandbox}=\pi.\texttt{sandboxMode})$
+
+\State $R \gets \{$
+\Statex \hspace{\algorithmicindent}
+$\texttt{provider}: \beta.\texttt{provider},$
+\Statex \hspace{\algorithmicindent}
+$\texttt{providerModel}: \beta.\texttt{selectedModel},$
+\Statex \hspace{\algorithmicindent}
+$\texttt{providerReason}: \textsc{ExplainSelection}(\beta),$
+\Statex \hspace{\algorithmicindent}
+$\texttt{assignedProviderCapabilities}: \pi.\texttt{capabilities},$
+\Statex \hspace{\algorithmicindent}
+$\texttt{risk}: z,$
+\Statex \hspace{\algorithmicindent}
+$\texttt{approvalPolicy}: x,$
+\Statex \hspace{\algorithmicindent}
+$\texttt{sandboxMode}: \pi.\texttt{sandboxMode},$
+\Statex \hspace{\algorithmicindent}
+$\texttt{readOnly}: \pi.\texttt{readOnly}$
+\State $\}$
+
+\State $R \gets \textsc{ApplyCapabilityInjectionToRouting}(R,A)$
+\State $v \gets \textsc{DagNode}(i,\texttt{name}=\textsc{Render}(E),\texttt{role}=\texttt{coordinator},\texttt{dependsOn}=[],\texttt{routing}=R)$
+\State \Return $v$
+\end{algorithmic}
+\end{algorithm}
+```
+
+## Algorithm 3: Runtime-backed Task Runner
+
+```latex
+\begin{algorithm}[t]
+\caption{Runtime-backed Task Runner}
+\label{alg:omk-runtime-backed-runner}
+\begin{algorithmic}[1]
+\Require DAG node $v$, runtime registry $\mathbb{R}$, context broker $B$, router $\rho$, environment $\Env$
+\Ensure Task result $r$ with selected runtime metadata and fallback chain
+
+\State $s \gets \textsc{BuildRunState}(v)$
+\State $(\Capsule, q) \gets B.\textsc{BuildCapsule}(v,s)$
+\State $F \gets \textsc{ResolveFallbackChain}(\Capsule.\texttt{node.routing})$
+\State $a \gets \textsc{ResolveAbortSignal}()$
+
+\State $\Task \gets \textsc{CapsuleToTask}(\Capsule,\Env,F,a)$
+\Comment{Convert DAG context into provider-neutral AgentTask}
+
+\If{$\rho.\textsc{Execute}$ is available}
+    \State $y \gets \rho.\textsc{Execute}(\Task)$
+    \State $r \gets \textsc{AgentResultToTaskResult}(y)$
+\Else
+    \State $y \gets \rho.\textsc{RunNode}(\Capsule,a)$
+    \State $r \gets \textsc{AgentRunResultToTaskResult}(y)$
+\EndIf
+
+\State $r.\texttt{metadata.fallbackChain} \gets F$
+\State \Return $r$
+\end{algorithmic}
+\end{algorithm}
+```
+
+## Algorithm 4: Context Capsule to AgentTask Conversion
+
+```latex
+\begin{algorithm}[t]
+\caption{Context Capsule to AgentTask Conversion}
+\label{alg:omk-capsule-to-task}
+\begin{algorithmic}[1]
+\Require Context capsule $\Capsule$, execution options $O$
+\Ensure Provider-neutral agent task $\Task$
+
+\State $v \gets \Capsule.\texttt{node}$
+\State $R \gets v.\texttt{routing}$
+
+\State $C \gets \{$
+\Statex \hspace{\algorithmicindent}
+$\texttt{runId}: \Capsule.\texttt{runId},$
+\Statex \hspace{\algorithmicindent}
+$\texttt{nodeId}: \Capsule.\texttt{nodeId},$
+\Statex \hspace{\algorithmicindent}
+$\texttt{role}: v.\texttt{role},$
+\Statex \hspace{\algorithmicindent}
+$\texttt{goal}: \Capsule.\texttt{goal},$
+\Statex \hspace{\algorithmicindent}
+$\texttt{system}: \Capsule.\texttt{system},$
+\Statex \hspace{\algorithmicindent}
+$\texttt{files}: \textsc{Paths}(\Capsule.\texttt{relevantFiles}),$
+\Statex \hspace{\algorithmicindent}
+$\texttt{memory}: \textsc{Summaries}(\Capsule.\texttt{graphMemory}),$
+\Statex \hspace{\algorithmicindent}
+$\texttt{abortSignal}: O.\texttt{signal},$
+\Statex \hspace{\algorithmicindent}
+$\texttt{cwd}: O.\texttt{cwd},$
+\Statex \hspace{\algorithmicindent}
+$\texttt{env}: O.\texttt{env},$
+\Statex \hspace{\algorithmicindent}
+$\texttt{risk}: R.\texttt{risk},$
+\Statex \hspace{\algorithmicindent}
+$\texttt{approvalPolicy}: R.\texttt{approvalPolicy},$
+\Statex \hspace{\algorithmicindent}
+$\texttt{sandboxMode}: R.\texttt{sandboxMode}$
+\State $\}$
+
+\State $T \gets R.\texttt{tools} \cup R.\texttt{assignedCapabilities.tools}$
+\State $M \gets R.\texttt{mcpServers} \cup R.\texttt{assignedCapabilities.mcpServers}$
+\State $S \gets R.\texttt{skills} \cup R.\texttt{assignedCapabilities.skills}$
+\State $H \gets R.\texttt{hooks} \cup R.\texttt{assignedCapabilities.hooks}$
+
+\State $P \gets \textsc{BuildProviderPolicy}(R.\texttt{provider},R.\texttt{candidateProviders},O.\texttt{fallbackChain})$
+\State $K \gets \textsc{InferCapabilities}(v,R,\Capsule.\texttt{budget})$
+
+\State $\Task \gets \langle \texttt{prompt}=\Capsule.\texttt{task},\texttt{context}=C,\texttt{tools}=(T,M,S,H),\texttt{providerPolicy}=P,\texttt{capabilities}=K \rangle$
+\State \Return $\Task$
+\end{algorithmic}
+\end{algorithm}
+```
+
+## Algorithm 5: Intent-aware Runtime Routing and Fallback
+
+```latex
+\begin{algorithm}[t]
+\caption{Intent-aware Runtime Routing and Fallback}
+\label{alg:omk-runtime-routing}
+\begin{algorithmic}[1]
+\Require Agent task $\Task$, runtime set $\mathbb{R}$, evidence history $\mathcal{H}$
+\Ensure Agent result $y$ with selected runtime and fallback metadata
+
+\State $z \gets \textsc{ClassifyIntent}(\Task)$
+\State $P \gets \textsc{RuntimePreferencesFromTask}(\Task)$
+
+\If{$P \neq \emptyset$}
+    \State $\mathbb{C} \gets \{r \in \mathbb{R} \mid r.\texttt{id} \in P\}$
+\Else
+    \State $\mathbb{C} \gets \mathbb{R}$
+\EndIf
+
+\State $\mathbb{S} \gets \{r \in \mathbb{C} \mid r.\textsc{Execute} \neq \emptyset \land \textsc{Supports}(r,\Task)\}$
+
+\If{$\mathbb{S} = \emptyset$}
+    \State \textbf{raise} \texttt{NoRuntimeSupportsTask}
+\EndIf
+
+\ForAll{$r \in \mathbb{S}$}
+    \State $q_r \gets \textsc{ComputeQualityScore}(r,z,\mathcal{H})$
+    \State $e_r \gets \textsc{EvidencePassRate}(r,z,\mathcal{H})$
+    \State $p_r \gets \textsc{RecentFailurePenalty}(r,\mathcal{H})$
+    \State $c_r \gets \textsc{CompositeScore}(q_r,e_r,p_r,P,r.\texttt{id})$
+\EndFor
+
+\State Sort $\mathbb{S}$ by $c_r$ in descending order
+\State $r^\star \gets \mathbb{S}[0]$
+\State $F \gets \mathbb{S}[1:]$
+\State $\mathbb{A} \gets [r^\star] \mathbin{+\!\!+} F$
+
+\State \textsc{RecordDecisionTrace}$(\Task,z,r^\star,F,\{c_r\})$
+
+\ForAll{$r \in \mathbb{A}$}
+    \If{$\Task.\texttt{context.abortSignal.aborted}$}
+        \State \Return $\textsc{AbortedResult}(r)$
+    \EndIf
+
+    \Try
+        \State $y \gets r.\textsc{Execute}(\Task)$
+        \If{$y.\texttt{exitCode}=0$}
+            \State $y.\texttt{metadata.selectedRuntime} \gets r.\texttt{id}$
+            \State $y.\texttt{metadata.intent} \gets z$
+            \State $y.\texttt{metadata.fallbackChain} \gets \textsc{Ids}(\mathbb{A})$
+            \State $y.\texttt{metadata.scores} \gets \{c_r\}$
+            \State \Return $y$
+        \EndIf
+        \State $y_{\mathrm{last}} \gets y$
+    \Catch{$e$}
+        \State $y_{\mathrm{last}} \gets \textsc{ErrorResult}(r,e)$
+    \EndTry
+\EndFor
+
+\State \Return $y_{\mathrm{last}} \ \textbf{or}\ \textsc{NoRuntimeAvailableResult}(\mathbb{A})$
+\end{algorithmic}
+\end{algorithm}
+```
+
+## Algorithm 6: Secure Worker Prompt Transport for Kimi Runtime
+
+```latex
+\begin{algorithm}[t]
+\caption{Secure Worker Prompt Transport for Kimi Runtime}
+\label{alg:omk-secure-kimi-transport}
+\begin{algorithmic}[1]
+\Require DAG node $v$, merged environment $\Env$, prompt prefix $\pi$, Kimi binary $b$
+\Ensure Kimi execution result without exposing prompt text through process arguments
+
+\State $p \gets \textsc{BuildNodeMessage}(v,\Env,\pi)$
+\State $A \gets [\texttt{--print}, \texttt{--input-format}, \texttt{text}]$
+\Comment{Do not append $p$ to argv}
+
+\If{$v$ has scoped agent file}
+    \State $f \gets \textsc{WriteScopedAgentFile}(v,\Env)$
+    \State $A \gets [\texttt{--agent-file}, f] \mathbin{+\!\!+} A$
+\EndIf
+
+\State $b \gets \textsc{ResolveKimiBinary}(\Env)$
+\If{$\neg \textsc{CommandExists}(b)$}
+    \State \Return \textsc{Failure}(\texttt{Primary provider not found})
+\EndIf
+
+\State $r \gets \textsc{RunShellStreaming}(b,A,\texttt{cwd}=v.\texttt{worktree},\texttt{env}=\Env,\texttt{input}=p,\texttt{timeout}=v.\texttt{timeout})$
+\State \Return $r$
+\end{algorithmic}
+\end{algorithm}
+```
+
+## Algorithm 7: Scoped Worker Environment Construction
+
+```latex
+\begin{algorithm}[t]
+\caption{Scoped Worker Environment Construction}
+\label{alg:omk-worker-env}
+\begin{algorithmic}[1]
+\Require Capability context $C$, optional provider policy $P$, optional capabilities $K$
+\Require Parent environment $\Env_{\mathrm{parent}}$, run id $\rho$, node id $\nu$, role $\omega$
+\Ensure Sanitized child environment $\Env_{\mathrm{child}}$
+
+\State $\Env_{\mathrm{worker}} \gets C.\texttt{env}$
+
+\If{$P \neq \emptyset$}
+    \State $\Env_{\mathrm{worker}}[\texttt{OMK\_NODE\_PROVIDER\_POLICY}] \gets \textsc{JsonEncode}(P)$
+\EndIf
+
+\If{$K \neq \emptyset$}
+    \State $\Env_{\mathrm{worker}}[\texttt{OMK\_NODE\_CAPABILITIES}] \gets \textsc{JsonEncode}(K)$
+\EndIf
+
+\State $\Delta \gets \Env_{\mathrm{worker}} \cup \{$
+\Statex \hspace{\algorithmicindent}
+$\texttt{OMK\_RUN\_ID}: \rho,$
+\Statex \hspace{\algorithmicindent}
+$\texttt{OMK\_NODE\_ID}: \nu,$
+\Statex \hspace{\algorithmicindent}
+$\texttt{OMK\_NODE\_ROLE}: \omega$
+\State $\}$
+
+\State $\Env_{\mathrm{child}} \gets \textsc{BuildChildEnv}(\texttt{parentEnv}=\Env_{\mathrm{parent}},\texttt{overrideEnv}=\Delta)$
+\State \Return $\Env_{\mathrm{child}}$
+\end{algorithmic}
+\end{algorithm}
+```
+
+## Paper-ready summary paragraphs
+
+```latex
+\paragraph{Provider-neutral native orchestration.}
+OMK implements a provider-neutral runtime architecture under active hardening. For each interactive root turn, OMK constructs a prompt envelope, injects scoped capabilities such as MCP servers, skills, and hooks, and materializes the turn as a DAG coordinator node. The node is converted into a context capsule and then into a provider-neutral AgentTask. A runtime router classifies the task intent, filters runtimes by capability compatibility, scores them using evidence history and preference priors, and executes the selected runtime with an explicit fallback chain. This design keeps the configured authority provider as the mature authority runtime while allowing Kimi API, Codex, DeepSeek, OpenCode, and CommandCode to participate as typed worker runtimes when adapter health, approval policy, sandbox behavior, and capability contracts match the task.
+
+\paragraph{Secure prompt and environment transport.}
+Recent OMK revisions harden worker execution by removing prompt payloads from process arguments. Kimi DAG prompts are transmitted through standard input with \texttt{--input-format text}, reducing process-list leakage risk. Kimi child execution and default native worker spawn paths receive scoped metadata through sanitized child environments. External CLI adapters and explicit override environments remain trusted local inputs and must be reviewed per adapter.
+```
+
+## Placement guide
+
+| Target | Recommended algorithms |
+| --- | --- |
+| Main paper / README excerpt | Algorithm 1, Algorithm 5, Algorithm 6 |
+| Architecture appendix | Algorithm 2, Algorithm 3, Algorithm 4 |
+| Security section | Algorithm 6, Algorithm 7 |
+| Release hardening checklist | Algorithm 2, Algorithm 5, Algorithm 7 |
+
+## Current implementation caveats
+
+- `/provider` is restart-only in the native root loop; it does not live-switch the active runtime in-place.
+- `/model` currently reports the requested model but should be treated as UX debt until live state mutation or a restart-only message is enforced consistently.
+- Approval and sandbox routing are preserved in the native root task contract and consumed by Codex/external adapters; Kimi print runtime currently receives limited hints rather than a fully enforced sandbox contract.
+- Kimi worker prompt payloads are sent through stdin, but prompt envelopes, DAG node names, and run artifacts may still contain private user prompt content and must be treated as private.
+- Provider stderr diagnostics still require continued redaction/debug-gating work; safety claims depend on the exact adapter path and tests.
+- Provider health probes are improving, but binary/API presence, auth state, model support, and quota state are not yet uniformly separated across every adapter; Algorithm 5 routes by available registry/capability/evidence metadata, not by universal quota-aware health.
+- ActionAtom, Novelty Guard, and provider-lane fanout language in prompt/harness surfaces remains contract-level unless backed by a concrete runtime implementation and tests.