open-multi-agent-kit 0.78.0

package/README.md

@@ -0,0 +1,279 @@
+<p align="center">
+  <img src="readmeasset/omk-control.webp" alt="OMK//CONTROL Night City Ops Console for routing agents, evidence gates, telemetry, MCP scope, and operator control" width="100%" />
+</p>
+
+<h1 align="center">OMK</h1>
+
+<p align="center">
+  <strong>OMK//CONTROL — provider-neutral multi-agent control plane for coding workflows.</strong>
+</p>
+
+<p align="center">
+  Models execute. OMK routes, verifies, measures, and controls.
+</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/@omk/cli"><img alt="npm version" src="https://img.shields.io/npm/v/%40omk%2Fcli?color=00D6FF"></a>
+  <a href="https://www.npmjs.com/package/@omk/cli"><img alt="npm package" src="https://img.shields.io/badge/package-%40omk%2Fcli-FF47B2"></a>
+  <a href="docs/versioning.md"><img alt="runtime" src="https://img.shields.io/badge/runtime-v1.2-9D4EDD"></a>
+  <a href="https://github.com/dmae97/open-multi-agent-kit/blob/main/proof/PROOF_INDEX.md"><img alt="proof gate" src="https://img.shields.io/badge/proof--gate-passing-00FFC2"></a>
+  <a href="LICENSE"><img alt="license" src="https://img.shields.io/badge/license-MIT-blue.svg"></a>
+</p>
+
+<p align="center">
+  <a href="#install">Install</a> ·
+  <a href="#quick-start">Quick start</a> ·
+  <a href="#current-runtime-algorithm">Runtime algorithm</a> ·
+  <a href="docs/getting-started.md">Docs</a> ·
+  <a href="readmeasset/ASSET_INDEX.md">Visual assets</a>
+</p>
+
+`OMK` (`omk`) turns a coding goal into a bounded, evidence-gated agent run.
+
+> Current package source version: `@omk/cli@0.78.0`.
+> Runtime contract family: `v1.2`.
+> Release channel: `pre-1.0`.
+> See [versioning](docs/versioning.md) and [provider maturity](docs/provider-maturity.md).
+
+## Why OMK
+
+Most coding agents optimize for a single prompt/result loop. OMK wraps agent execution with a control-plane algorithm:
+
+- compile the user goal into a DAG coordinator turn;
+- inject only scoped MCP servers, skills, hooks, memory, and tools;
+- classify task intent and route to compatible runtime adapters;
+- execute with timeout, approval, sandbox, and fallback metadata;
+- require evidence before completion claims;
+- preserve run artifacts for replay, inspection, and audit.
+
+## OMK//CONTROL visual console
+
+The GitHub visual set presents OMK as a Night City Ops Console: route status, DAG lanes, provider fallback, scoped MCP, evidence gates, and replayable run telemetry. Assets are provenance-covered in [`readmeasset/ASSET_PROVENANCE.md`](readmeasset/ASSET_PROVENANCE.md).
+
+<p align="center">
+  <img src="readmeasset/omk_tui.png" alt="OMK//CONTROL terminal dashboard — live DAG lanes, provider routing, MCP health, evidence gates, and telemetry in Night City Ops Console style" width="100%" />
+</p>
+
+| Operator TUI                                                                                                                                                                                            | Runtime flow                                                                                                                                                                                                                            |
+| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| <img src="readmeasset/omk-tui-0.78.0.webp" alt="OMK//CONTROL TUI for OMK 0.78.0 showing Codex App OAuth routing, GPT Image 2 asset lane, DAG lanes, scoped MCP, and evidence gates" /> | <img src="readmeasset/omk-runtime-flow-0.78.0.webp" alt="OMK 0.78.0 runtime flow diagram: user goal, intent classifier, DAG compiler, runtime router, parallel workers, evidence bundle, verify gate, and merge replay inspect loop" /> |
+
+| Install lane                                                                     | Provider router                                                                       | Evidence gate                                                                     |
+| -------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- |
+| <img src="readmeasset/omk-install-card.png" alt="OMK install quickstart card" /> | <img src="readmeasset/omk-provider-router-card.png" alt="OMK provider router card" /> | <img src="readmeasset/omk-evidence-gate-card.png" alt="OMK evidence gate card" /> |
+
+<p align="center">
+  <img src="readmeasset/omk-core-loop.svg" alt="OMK core loop: goal to DAG plan to evidence to verify to replay" width="100%" />
+</p>
+
+## Install
+
+Requires Node.js `>=20` and npm `>=10`.
+
+```bash
+npm install -g @omk/cli
+omk --help
+```
+
+No global install:
+
+```bash
+npx -p @omk/cli omk doctor
+```
+
+## Quick start
+
+```bash
+omk init                         # scaffold AGENTS.md, DESIGN.md, .omk/
+omk doctor                       # check runtime, providers, MCP, skills, hooks
+omk codex auth --choice plus-pro # prefer official Codex app/CLI OAuth for Codex lanes
+omk chat --provider codex --mode agent
+omk orchestrate "ship feature" --workers 4 --dry-run
+```
+
+## Current runtime algorithm
+
+The canonical algorithm definitions live in [Native Root Runtime Algorithms](docs/native-root-runtime-algorithms.md). README summary:
+
+### 1. Native root turn execution
+
+```text
+Read user input
+  → dispatch slash commands locally
+  → build scoped MCP/skills/hooks capability injection
+  → build prompt envelope
+  → materialize a DAG coordinator node
+  → run selected runtime with timeout/abort handling
+  → stream output, sync TODOs, attach evidence
+```
+
+This is the interactive root loop used by `omk chat`. It treats shell exits, slash commands, prompt envelopes, TODO sync, and recent output as controlled runtime state instead of loose chat text.
+
+### 2. Native root turn node construction
+
+```text
+User prompt
+  → infer risk: read | write | shell | merge
+  → normalize scoped capabilities
+  → choose provider-neutral routing policy
+  → attach approval/sandbox metadata
+  → produce coordinator DAG node
+```
+
+Read-only turns stay read-only. Write, shell, and merge turns get explicit capability metadata. DeepSeek-style advisory lanes are kept read/review when the risk is not safe for write authority.
+
+### 3. Runtime-backed task runner
+
+```text
+DAG node
+  → run state
+  → context capsule
+  → provider-neutral AgentTask
+  → RuntimeRouter.execute(task)
+  → TaskResult with selected runtime + fallback chain
+```
+
+OMK converts DAG context into an adapter-neutral task so Codex, MiMo, Kimi API/print lanes, DeepSeek, Qwen, OpenRouter, local adapters, or future runtimes can participate through the same contract.
+
+### 4. Intent-aware runtime routing and fallback
+
+```text
+Classify intent
+  → filter compatible runtimes
+  → score by quality, evidence pass rate, and recent failures
+  → execute best runtime
+  → fallback in ranked order when a runtime fails
+  → record selected runtime, intent, scores, and fallback chain
+```
+
+Provider routing is evidence-aware, not just provider-name matching. Failed or low-evidence lanes are penalized; compatible healthy lanes can take over.
+
+### 5. Secure worker transport and scoped environment
+
+```text
+Worker prompt
+  → stdin transport where supported, not process argv
+  → scoped agent file when needed
+  → sanitized child environment
+  → OMK_RUN_ID / OMK_NODE_ID / OMK_NODE_ROLE metadata
+```
+
+Kimi worker prompts use stdin with `--input-format text` where that adapter path applies. All worker environment claims are scoped to the exact adapter and evidence gates; private prompt envelopes and run artifacts remain trusted local data.
+
+## Core loop
+
+```text
+Goal → DAG plan → parallel lanes → evidence bundle → verify gate → merge / replay / inspect
+```
+
+## What OMK controls
+
+| Surface            | What OMK does                                                                                           |
+| ------------------ | ------------------------------------------------------------------------------------------------------- |
+| DAG orchestration  | Plans, routes, executes, merges, replays, and inspects agent work.                                      |
+| Evidence gates     | Requires command output, diff, artifact, metric, or review proof before “done”.                         |
+| Provider routing   | Selects compatible runtimes with intent, capability, evidence, and fallback metadata.                   |
+| MCP scope          | Keeps project MCP, skills, hooks, and graph memory scoped instead of importing global secrets silently. |
+| Worktree isolation | Keeps parallel lanes bounded, reviewable, and recoverable.                                              |
+| Operator telemetry | Exposes route, status, blockers, TODOs, run health, and evidence state through CLI/HUD/TUI surfaces.    |
+| Security boundary  | Sanitizes child env, protects secrets, and makes workspace-write routes explicit.                       |
+
+## Provider lanes
+
+OMK is provider-neutral. The configured runtime decides which adapters are available, but the control plane is the same:
+
+- **Codex app / CLI OAuth lanes** for Codex-backed coding sessions;
+- **MiMo** as the default provider path when configured;
+- **Kimi API / print lanes** as explicit provider adapters, not the root identity;
+- **DeepSeek, Qwen, OpenRouter, local adapters** for advisory or execution lanes when capability contracts match;
+- **GPT Image 2 asset lane** for visual assets when the image workflow is explicitly selected.
+
+## Codex app / OAuth first
+
+For Codex lanes, OMK delegates auth to the official Codex app/CLI and never reads or prints `~/.codex/auth.json` tokens.
+
+```bash
+codex login
+omk codex auth --choice plus-pro --run
+omk provider doctor codex --soft
+```
+
+Codex/ChatGPT OAuth is for Codex CLI sessions. `omk image generate/edit --model gpt-image-2` remains an OpenAI Images API call and requires a separate OpenAI Platform project API key. See [Codex OAuth setup](docs/codex-oauth-setup.md) and [OpenAI image keys](docs/openai-platform-image-keys.md).
+
+## CLI and package contract
+
+The npm package is intentionally package-safe:
+
+| Contract          | Value                                                                                                                                                                                                                          |
+| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Package           | [`@omk/cli`](https://www.npmjs.com/package/@omk/cli)                                                                                                                                                                           |
+| Version           | `0.78.0`                                                                                                                                                                                                                       |
+| Runtime family    | `v1.2`                                                                                                                                                                                                                         |
+| Bins              | `omk`, `omk-project-mcp`, `omk-acp`, `omk-mcp-host`                                                                                                                                                                            |
+| Packaged docs     | `README.md`, `docs/`, `SECURITY.md`, `ROADMAP.md`, `MATURITY.md`, `DESIGN.md`                                                                                                                                                  |
+| Packaged branding | Canonical hero/social/TUI/runtime images plus the curated derivative gallery documented in [`readmeasset/ASSET_INDEX.md`](readmeasset/ASSET_INDEX.md) and [`readmeasset/ASSET_PROVENANCE.md`](readmeasset/ASSET_PROVENANCE.md) |
+| Excluded          | source-only tests, scripts, local state, logs, secrets, private runtime directories                                                                                                                                            |
+
+Release checks:
+
+```bash
+npm run version:check
+npm run proof:check
+npm run pack:dry
+npm run audit:package
+```
+
+## Contract versions
+
+Machine-readable contracts currently include:
+
+- `omk.contract.v1`
+- `omk.evidence.v1`
+- `omk.decision.v1`
+- `omk.run-manifest.v1`
+- `omk.provider.v1`
+- `omk.version.v1`
+- `omk.proof-bundle.v1`
+
+Schemas live in the source-tree `schemas/` directory and are checked with:
+
+```bash
+npm run schema:check
+```
+
+## Known implementation caveats
+
+The runtime algorithms are the current contract target, with adapter-specific hardening still tracked in docs and tests:
+
+- `/provider` is restart-only in the native root loop.
+- `/model` is UX debt until live mutation or restart-only behavior is enforced consistently.
+- Approval and sandbox metadata are preserved in task contracts; enforcement depends on the adapter path.
+- Provider health probes do not yet uniformly separate binary/API presence, auth, model support, and quota state across every adapter.
+- Safety claims are scoped to exact adapter, command, evidence, and package-audit results.
+
+## Brand system
+
+Public copy stays OMK-owned: **OMK//CONTROL**, **NEON GRID ONLINE**, route/evidence/loop/control language, and the **Night City Ops Console** palette. The README/NPM hero, social preview, TUI mock, runtime-flow diagram, and derivative gallery are package-safe brand assets with provenance in [`readmeasset/ASSET_PROVENANCE.md`](readmeasset/ASSET_PROVENANCE.md).
+
+## Docs
+
+- [Getting started](docs/getting-started.md)
+- [Runtime versioning](docs/versioning.md)
+- [Provider maturity](docs/provider-maturity.md)
+- [Native root runtime algorithms](docs/native-root-runtime-algorithms.md)
+- [Codex OAuth setup](docs/codex-oauth-setup.md)
+- [Security policy](SECURITY.md)
+
+## Security
+
+Safe by default: child env is sanitized, ambient secrets are dropped, and workspace-write routes require approval. OS-level sandboxing is planned, not claimed; see [SECURITY.md](SECURITY.md).
+
+## Links
+
+- GitHub: <https://github.com/dmae97/open-multi-agent-kit>
+- NPM: <https://www.npmjs.com/package/@omk/cli>
+- Releases: <https://github.com/dmae97/open-multi-agent-kit/releases>
+
+## License
+
+[MIT](LICENSE)

package/ROADMAP.md

@@ -0,0 +1,130 @@
+# Roadmap
+
+Current source version: v0.78.0 (`v1.2` runtime contract family)
+Last updated: 2026-06-07
+
+## Historical 2026-05-31 v1.2 RC status
+
+At the 2026-05-31 RC checkpoint, the source tree was aligned to package version `1.2.0-rc.0`, runtime version `v1.2`, and release channel `rc`. The architecture direction is OMK-as-root with providers as adapters. Kimi remains the most mature authority path in this RC line; other providers have narrower or advisory maturity unless tests and contracts say otherwise.
+
+- Version contract details: `docs/versioning.md`.
+- Provider status and limitations: `docs/provider-maturity.md`.
+- Public proof index: `proof/PROOF_INDEX.md`.
+- Active native-runtime backlog: `docs/native-root-runtime-hardening.md`, `docs/native-root-runtime-algorithms.md`, and `.omk/specs/native-orchestrator-phase1/`.
+- Do not claim stable `v1.2` until release gates pass on the exact target commit and the stable package/tag is published.
+
+## Historical v1.1.9 reality
+
+Provider routing and graph viewing are no longer purely future work:
+
+- `omk run`, `omk parallel`, and DAG replay expose `--provider auto|kimi`.
+- `omk provider` / `omk deepseek` manage DeepSeek enablement, key setup, availability checks, and default fallback to the most mature adapter.
+- DeepSeek is an opportunistic read-only/advisory worker; Kimi remains the most mature authority adapter in this historical line, while v1.2 RC moves orchestration ownership into OMK.
+- `omk graph view` generates an HTML view from `.omk/memory/graph-state.json`.
+- `omk goal` has a persisted lifecycle, continue loop, generated plan/evidence criteria, and verification flow.
+
+## v1.2 RC — Native Orchestrator Decoupling
+
+### Phase 0: Foundation & Spec
+
+- Coupling map: identify every Kimi-only assumption in runtime, harness, agent loop, and subagent spawning.
+- Produce Speckit artifacts (`spec.md`, `plan.md`, `tasks.md`) for the decoupling milestone.
+- Define provider-adapter contract so Kimi, DeepSeek, and future workers plug into a unified `AgentRuntime`.
+
+### Phase 1: Unified Runtime Bridge
+
+- Implement `AgentRuntime.execute` as the single entrypoint for all worker execution (chat, DAG node, inline tool call).
+- Model chat as a DAG: user message → IntentFrame → ActionAtom → worker node → evidence gate.
+- Ensure Kimi adapter remains the mature default while the bridge is provider-agnostic.
+- Use `docs/native-root-runtime-algorithms.md` Algorithms 3-5 as the
+  acceptance reference for context-capsule conversion, task execution, and
+  router fallback.
+
+### Phase 2: Worker Capability Assignment
+
+- Allow per-DAG-node MCP, skills, hooks, and provider selection.
+- Move capability flag resolution from Kimi prompt scaffolding into OMK harness metadata.
+- Add preflight health checks and fallback chains for non-Kimi workers.
+- Make native chat turn capability default-safe: read-only for advisory/review prompts, write/patch for edit prompts, and shell only when command execution is intended and approval policy allows it.
+- Keep DeepSeek as read/review/advisory unless a future contract explicitly grants write/shell authority.
+- Use Algorithm 2 and Algorithm 7 as the acceptance reference for per-turn
+  capabilities and scoped worker environment construction.
+
+### Phase 3: Root Coordinator Mode
+
+- Introduce native OMK agent loop with `IntentFrame` parsing and `ActionAtom` dispatch.
+- OMK becomes the root orchestrator; Kimi becomes one worker provider adapter among many.
+- Preserve D-Mail checkpoints and Okabe-compatible context management across provider handoffs.
+- Treat ActionAtom/Novelty Guard language as contract-level until concrete
+  runtime implementation and tests land.
+
+### Phase 4: Docs & GA
+
+- Update `AGENTS.md`, `DESIGN.md`, init templates, and skill docs to reflect OMK-as-root narrative.
+- Deprecate Kimi-only subagent language where OMK `ParallelOrchestrator` is the actual spawn surface.
+- Mark v1.2.x stable only after provider fallback, evidence gates, DAG replay, version contracts, and provider-maturity docs are green across supported adapters.
+
+## v1.3 — Hardening the current surface
+
+### P0: release and contract gates
+
+- Done: YAML validation now runs in local `verify` plus CI/smoke workflows.
+- Done: package dry-pack, package audit, tarball smoke, native safety build, and release matrix gates were re-verified during the v1.1.x release-prep line; v1.2 RC publish/tag claims now depend on `npm run release:check` on the exact target commit.
+- Required before stable v1.2 publish/tag: regenerate the native safety binary, pass package audit, pass smoke-pack/tarball install smoke, and pass `npm run release:check` on the exact intended release diff.
+- Required before stable v1.2 publish/tag: CI and smoke checks must pass on the exact intended commit.
+- Done: provider/deepseek and screenshot JSON command contracts gained hermetic regression tests.
+- Done: proof bundle schema/check/index scaffolding exists, with ten scoped RC hardening bundles covering no-Kimi smoke, doctor-provider, fallback-route, native-safety, contract-version, evidence-block, replay/inspect, graph-audit, deeper no-Kimi verification, and provider fallback-routing gates.
+- Done: proof integrity now enforces artifact linkage plus per-bundle `sha256sums.txt` hash validation.
+- Done: current AGENTS/init templates and packaged workflow skills were aligned with the active skills/MCP/agents/harness surface, including all generated agent MCP/skills/hooks flags and parallel subagent orchestration guidance.
+- Remaining: lock runtime safety gates for native turn risk, approval/sandbox propagation, authority-provider resolution, provider health probes, and DeepSeek read-only routing.
+- Remaining: lock broader provider fallback metadata with tests for rate limit, timeout, and default fallback variants.
+- Remaining: define minimum machine-readable CLI envelopes for the rest of the automation-critical commands.
+- Remaining: promote additional real proof bundles beyond the RC ten-bundle baseline, especially provider fallback variants for rate limit, timeout, and default route behavior.
+
+### P1: observability and diagnostics
+
+- Done: provider route/fallback counts are now emitted in run summaries/reports and summary terminal output.
+- Done: invalid MCP JSON is reported as a visible diagnostic without leaking secret-like config values.
+- Done: `omk mcp doctor --json` exposes structured server status, command resolution, timeout, permission, and config-source fields.
+- Expand JSON output for DAG, summary, and workflow commands where CI or agents consume results.
+- Link live graph nodes back to runs, goals, providers, and evidence so `omk graph audit` can validate real project graph memory, not only compact proof fixtures.
+
+### P2: execution depth and planner quality
+
+- Deepen `omk team` runtime reporting: worker state, pane/session health, artifacts, and verification handoff.
+- Done: replace the `omk goal plan` stub with a planner that emits steps, acceptance criteria, risks, and evidence gates.
+- Add provider-quality gates before broader non-Kimi worker pools.
+- Keep Kimi execution as the safe fallback path for every run.
+
+## Later tracks
+
+### Provider routing maturity
+
+- Keep Kimi as the most mature authority adapter and default fallback until another provider has tested write/merge/MCP authority contracts.
+- Use provider hints for explorer, reviewer, QA, planner, and documentation roles only when preflight is healthy and task risk is low.
+- Record provider attempts, route confidence, fallback reason, and final authority in run evidence.
+
+### Graph and memory maturity
+
+- Materialize provider routes, fallback events, goals, evidence gates, and run artifacts in the local graph/Kuzu ontology.
+- Keep `omk graph view` local-first and safe for private repositories.
+
+### Historical milestones
+
+| Version | Focus |
+|---------|-------|
+| v0.1 | init / doctor / chat, P0 skills, AGENTS.md / DESIGN.md generation, quality gate hooks |
+| v0.2 | wire controller, HUD, run state, worker logs |
+| v0.3 | worktree team, merge queue, reviewer / QA / integrator agents |
+| v0.4 | Google DESIGN.md integration, Stitch skills installer, screenshot UI review, Spec Kit planning + DAG execution, agent registry, project index, run summary |
+| v0.5 | MCP project server, plugin pack, CI agent mode |
+| v1.1.6 | provider/deepseek commands, provider policy flags, graph view, goal lifecycle, expanded run history and update JSON |
+| v1.1.9 | chat harness manifest, capability DAG lanes, Rust native safety loader, Windows clipboard screenshot bridge, release native matrix |
+| v1.1.12 | Replay system, skill assigner, decision trace coverage, evidence gates, and repair policy |
+| v1.1.13 | Bundled MCP server entrypoints, ACP/host transport groundwork, deployment-ready package metadata |
+| v1.1.14 | Current harness docs, external-inspired workflow skills, and release-safe public wording |
+| v1.1.15 | Isolated HOME MCP shell-profile hotfix and persistent fetch MCP entrypoint |
+| v1.1.16 | Deterministic IntentFrame/ActionAtom orchestration, chat schema preflight, MCP duplicate policy, agent capability propagation, and doctor/init/pack smoke fixes |
+| v1.1.17 | Full generated-agent MCP/skills/hooks enablement, parallel subagent orchestration emphasis, and v1.1.17 release docs |
+| v1.1.18 | Historical Kimi-wrapper dominant release-prep line: package source version alignment, native safety package gate, typed doctor repair plans, startup update prompt UX, and parallel subagent orchestration release-doc alignment |
+| v1.2.0-rc.0 | Package RC for the `v1.2` runtime contract family, provider-neutral docs alignment, version contract docs, and provider maturity limits |

package/SECURITY.md

@@ -0,0 +1,83 @@
+# Security Policy
+
+## Reporting Vulnerabilities
+
+Please report security issues via GitHub Issues with the `security` label.
+
+## Built-in Protections
+
+open-multi-agent-kit includes scoped default hooks to block destructive commands and secret leakage when the active runtime/harness enables them.
+
+## Native Runtime Safety Gates
+
+Canonical algorithm references: Algorithm 2 covers native turn
+risk/capability routing, Algorithm 5 covers runtime fallback/authority
+selection, and Algorithms 6-7 cover Kimi prompt transport and scoped worker
+environments in
+[`docs/native-root-runtime-algorithms.md`](./docs/native-root-runtime-algorithms.md).
+
+- Root `omk` startup must keep MCP AutoConnect offline/read-only: it may
+  summarize active MCP configs and the virtual `omk-project` mount, but it must
+  not spawn stdio servers, call remote MCP endpoints, run OAuth, or prewarm
+  package managers. Use explicit `omk mcp connect --all`, `omk mcp check --all`,
+  or `omk mcp test <server>` for active validation.
+- Native chat turns should be default-safe: read/review prompts request read-only capability, edit prompts request write/patch, and shell capability is reserved for explicit command execution under the active approval policy.
+- `--execution ask|auto|never` must propagate into runtime routing and provider adapters. Do not treat `ask` as equivalent to provider-level `never`.
+- Provider policies such as `authority`, `primary`, and `omk` must resolve to a concrete healthy provider before execution; unresolved authority is a hard diagnostic, not an advisory-only fallback.
+- DeepSeek is read/review/advisory unless a future contract explicitly grants write/shell authority.
+- CLI provider bootstrap must not treat binary existence as authentication. Provider health should distinguish runtime availability, auth/session state, selected model support, and quota/rate-limit status.
+- Kimi/provider failure previews must be redacted and gated behind explicit debug mode such as `OMK_DEBUG=1`; any adapter path that still emits previews without that gate remains a release-blocking hardening gap.
+- MCP, skills, and hooks parse/read failures should be visible in tool-plane diagnostics. Required runtime MCP failures should block execution rather than silently dropping all servers.
+
+## MCP and Harness Secret Handling
+
+- Fresh init uses project scope by default: `omk-core-verified` treats project-local `omk-project` MCP as the baseline hint, while generated `.omk/mcp.json` / `.kimi/mcp.json` may stay minimal or empty until runtime materializes managed entries. User/global MCP and skills are runtime-only unless explicitly imported by a trusted local user.
+- `--local-user`, `mcp_scope = "all"`, `skills_scope = "all"`, and `hooks_scope = "all"` are trusted local-user modes, not public fresh-init defaults.
+- `.kimi` is the agent-facing runtime surface for provider-specific skills, MCP, and hooks; `.omk` is OMK runtime/evidence state. Do not treat the two generated trees as interchangeable.
+- Never print, commit, or summarize MCP `env`, headers, tokens, or provider keys.
+- Kimi child execution and default native worker spawn paths inherit a minimal allowlist from the parent process and drop inherited secret-like keys. External CLI adapters may have adapter-specific environment contracts; explicit `env` / DAG `nodeEnv` remains trusted local input so runtime variables such as `KIMI_BIN`, `PATH`, `HOME`, and non-secret `OMK_*` values keep working. Secret-like explicit keys emit warnings. Set `OMK_STRICT_KIMI_EXPLICIT_ENV=1` to drop secret-like explicit keys unless the local trusted session also sets `OMK_TRUST_KIMI_EXPLICIT_SECRET_ENV=1`.
+- `omk image generate/edit` requires an OpenAI Platform project API key supplied as an ephemeral runtime env var such as `OPENAI_API_KEY`; Codex/ChatGPT OAuth tokens are never accepted as Images API credentials.
+- Isolated agent HOME shell-profile bridging is off by default because sourcing user profiles can re-export secrets; enable it only in trusted local sessions with `OMK_ISOLATED_HOME_BRIDGE_SHELL_PROFILES=1`.
+- Treat `chat-agent-harness.json`, prompt envelopes, DAG node names, and run artifacts as private run metadata: use them for inventory/gates, but do not paste large inventories, prompts, or secret-like values into memory or reports.
+- Prefer sanitized `omk mcp doctor --json`, `omk verify --json`, test summaries, and secret scans as shareable evidence.
+- Run `npm run secret:scan:runtime` before release/demo when local `.omk` or `.kimi` trust-boundary files may contain user-added MCP wrappers or hook edits.
+
+## Child Runtime Isolation
+
+OMK currently provides environment hardening for child runtimes.
+
+By default, child runtimes do not inherit the full parent process environment.
+OMK passes an allowlisted environment and drops common secret-bearing variables
+such as cloud provider credentials, GitHub/NPM tokens, SSH agent sockets,
+Kubernetes config, and dotenv/env-file references.
+
+This is not a full OS-level sandbox. Filesystem, process, and network isolation
+are future hardening work and must not be assumed unless explicitly provided by
+the selected runtime or host environment.
+
+Current security claims:
+
+- OMK prevents ambient secret leakage into child runtimes by default.
+- OMK sanitizes child runtime environments.
+- OMK routes tasks according to declared runtime capabilities.
+- OMK forces approval for write-capable Codex workspace runs.
+- OMK exposes sandbox intent/profile metadata for future enforcement.
+
+Non-claims:
+
+- OMK does not fully sandbox child CLIs.
+- OMK does not prevent all filesystem access outside the workspace.
+- OMK does not prevent network exfiltration.
+- OMK does not enforce OS-level process isolation.
+
+## Public Asset Provenance
+
+- Treat `public/assets/**` as source-only reference material until license, source URL/origin, usage rights, reviewer, and review date are recorded.
+- Do not move unlicensed or unprovenanced public assets into `readmeasset/`, `docs/assets/`, templates, `dist/`, or npm package contents.
+- Package audit forbids `public/assets/**`; keep documentation assets in `readmeasset/` or `docs/assets/` only after provenance review.
+
+## Best Practices
+
+- Review hooks before running in production repositories.
+- Use `--print` mode only in disposable worktrees.
+- Never commit secrets into agent memory files.

package/WORKER_MANIFEST.md

@@ -0,0 +1,35 @@
+# Integration Manifest
+
+## Merged Workers
+
+| Worker | Branch | Status |
+|--------|--------|--------|
+| B Engine | `work/engine` | Merged |
+| C Platform | `work/platform` | Merged |
+
+## Files Added
+
+### Contracts (Phase 0)
+- `src/contracts/orchestration.ts`
+- `src/contracts/safety.ts`
+- `src/contracts/hud.ts`
+
+### Engine (Worker B)
+- `src/orchestration/executor.ts`
+- `src/orchestration/scheduler.ts`
+- `src/orchestration/state-persister.ts`
+- `src/safety/guard-hooks.ts`
+
+### Platform (Worker C)
+- `src/util/worktree.ts`
+- `src/util/run-dir.ts`
+- `src/util/kimi-runner.ts` — combined with existing `runKimiInteractive`
+
+### Modified
+- `src/kimi/wire-client.ts` — `createKimiTaskRunner`
+- `src/safety/approval-policy.ts` — `createPolicyEngine`
+- `src/util/shell.ts` — `runShellStreaming`
+- `src/util/git.ts` — `removeWorktree`
+- `src/util/fs.ts` — `getRunPath`
+- `src/memory/memory-store.ts` — `readRunMemory`, `writeRunMemory`
+- `src/mcp/omk-project-server.ts` — `omk_list_worktrees`, `omk_run_quality_gate`

package/dist/adapters/commandcode/commandcode-cli-adapter.d.ts

@@ -0,0 +1,10 @@
+/**
+ * CommandCodeCliAdapter — wraps the `cmd` CLI as an AgentRuntime.
+ */
+export interface CommandcodeCliAdapterOptions {
+    bin?: string;
+    cwd?: string;
+    env?: Record<string, string>;
+    trust?: boolean;
+}
+export declare function createCommandcodeCliAdapter(options?: CommandcodeCliAdapterOptions): import("../../runtime/agent-runtime.js").AgentRuntime;

package/dist/adapters/commandcode/commandcode-cli-adapter.js

@@ -0,0 +1,57 @@
+/**
+ * CommandCodeCliAdapter — wraps the `cmd` CLI as an AgentRuntime.
+ */
+import { createExternalCliAdapter } from "../../runtime/external-cli-adapter.js";
+export function createCommandcodeCliAdapter(options = {}) {
+    const bin = options.bin ?? process.env.COMMANDCODE_BIN ?? "commandcode";
+    return createExternalCliAdapter({
+        id: "commandcode-cli",
+        displayName: "Command Code",
+        bin,
+        cwd: options.cwd,
+        env: options.env,
+        priority: 80,
+        capabilities: {
+            read: true,
+            write: true,
+            shell: true,
+            mcp: false,
+            patch: true,
+            review: true,
+            merge: false,
+            vision: false,
+        },
+        promptTransport: "tempfile",
+        buildArgs(capsule, prompt) {
+            const promptText = prompt.promptFile
+                ? `Read the prompt file at ${prompt.promptFile} exactly and execute the user request it contains. Do not treat this argv text as the user request. Enforce OMK_TASK_RISK, OMK_APPROVAL_POLICY, and OMK_SANDBOX_MODE from the environment before any write or shell action.`
+                : "Prompt file transport was unavailable; stop and report OMK prompt transport failure.";
+            const args = ["-p", promptText, "--skip-onboarding"];
+            if (options.trust === true)
+                args.push("--trust");
+            const maxTurns = capsule.node.maxTurns;
+            if (maxTurns != null && maxTurns > 0) {
+                args.push("--max-turns", String(maxTurns));
+            }
+            return args;
+        },
+        buildEnv() {
+            const nested = parseInt(process.env.OMK_NESTED_LEVEL ?? "0", 10);
+            return {
+                OMK_NESTED_LEVEL: String(nested + 1),
+            };
+        },
+        parseResult(shellResult) {
+            return {
+                success: shellResult.exitCode === 0,
+                exitCode: shellResult.exitCode,
+                stdout: shellResult.stdout,
+                stderr: shellResult.stderr,
+                metadata: {
+                    runtime: "commandcode-cli",
+                    aborted: shellResult.exitCode === 130,
+                },
+            };
+        },
+    });
+}