open-multi-agent-kit 0.79.3 → 0.80.2

package/dist/schema/evidence-bundle.schema.d.ts

@@ -7,12 +7,12 @@ export declare const EvidenceBundleArtifactSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     sha256: string;
     path: string;
-    kind?: "review" | "file" | "diff" | "log" | "custom" | "metric" | undefined;
+    kind?: "diff" | "review" | "file" | "log" | "custom" | "metric" | undefined;
     required?: boolean | undefined;
 }, {
     sha256: string;
     path: string;
-    kind?: "review" | "file" | "diff" | "log" | "custom" | "metric" | undefined;
+    kind?: "diff" | "review" | "file" | "log" | "custom" | "metric" | undefined;
     required?: boolean | undefined;
 }>;
 export declare const EvidenceBundleSchema: z.ZodObject<{
@@ -43,12 +43,12 @@ export declare const EvidenceBundleSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         sha256: string;
         path: string;
-        kind?: "review" | "file" | "diff" | "log" | "custom" | "metric" | undefined;
+        kind?: "diff" | "review" | "file" | "log" | "custom" | "metric" | undefined;
         required?: boolean | undefined;
     }, {
         sha256: string;
         path: string;
-        kind?: "review" | "file" | "diff" | "log" | "custom" | "metric" | undefined;
+        kind?: "diff" | "review" | "file" | "log" | "custom" | "metric" | undefined;
         required?: boolean | undefined;
     }>, "many">;
     verifier: z.ZodObject<{
@@ -120,7 +120,7 @@ export declare const EvidenceBundleSchema: z.ZodObject<{
     artifacts: {
         sha256: string;
         path: string;
-        kind?: "review" | "file" | "diff" | "log" | "custom" | "metric" | undefined;
+        kind?: "diff" | "review" | "file" | "log" | "custom" | "metric" | undefined;
         required?: boolean | undefined;
     }[];
     verifier: {
@@ -129,12 +129,12 @@ export declare const EvidenceBundleSchema: z.ZodObject<{
         checkedAt?: string | undefined;
     };
     commit: string;
+    changedFiles: string[];
     redaction: {
         summary: string;
         applied: boolean;
         leakedSecretPatterns?: string[] | undefined;
     };
-    changedFiles: string[];
     runtimeVersion: string;
     model?: string | undefined;
     nodeId?: string | undefined;
@@ -162,7 +162,7 @@ export declare const EvidenceBundleSchema: z.ZodObject<{
     artifacts: {
         sha256: string;
         path: string;
-        kind?: "review" | "file" | "diff" | "log" | "custom" | "metric" | undefined;
+        kind?: "diff" | "review" | "file" | "log" | "custom" | "metric" | undefined;
         required?: boolean | undefined;
     }[];
     verifier: {
@@ -171,12 +171,12 @@ export declare const EvidenceBundleSchema: z.ZodObject<{
         checkedAt?: string | undefined;
     };
     commit: string;
+    changedFiles: string[];
     redaction: {
         summary: string;
         applied: boolean;
         leakedSecretPatterns?: string[] | undefined;
     };
-    changedFiles: string[];
     runtimeVersion: string;
     model?: string | undefined;
     nodeId?: string | undefined;

package/dist/schema/proof-bundle.schema.d.ts

@@ -96,6 +96,7 @@ export declare const ProofBundleSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     runId: string;
     schemaVersion: "omk.proof-bundle.v1";
+    providerPolicy: string;
     commit: string;
     title: string;
     files: {
@@ -112,7 +113,6 @@ export declare const ProofBundleSchema: z.ZodObject<{
         inspectJson?: string | undefined;
         diffPatch?: string | undefined;
     };
-    providerPolicy: string;
     omkVersion: string;
     verdict: "failed" | "partial" | "passed";
     runtimeVersion: "v1.2";
@@ -123,6 +123,7 @@ export declare const ProofBundleSchema: z.ZodObject<{
 }, {
     runId: string;
     schemaVersion: "omk.proof-bundle.v1";
+    providerPolicy: string;
     commit: string;
     title: string;
     files: {
@@ -139,7 +140,6 @@ export declare const ProofBundleSchema: z.ZodObject<{
         inspectJson?: string | undefined;
         diffPatch?: string | undefined;
     };
-    providerPolicy: string;
     omkVersion: string;
     verdict: "failed" | "partial" | "passed";
     runtimeVersion: "v1.2";

package/dist/util/hash.d.ts

@@ -0,0 +1,2 @@
+export declare function sha256Hex(value: string): string;
+export declare function sha256FileSync(path: string): string | undefined;

package/dist/util/hash.js

@@ -0,0 +1,13 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+export function sha256Hex(value) {
+    return createHash("sha256").update(value, "utf-8").digest("hex");
+}
+export function sha256FileSync(path) {
+    try {
+        return createHash("sha256").update(readFileSync(path)).digest("hex");
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/util/session.js

@@ -1,6 +1,7 @@
-import { writeFile, readdir, readFile } from "fs/promises";
+import { writeFile, readdir, readFile, mkdir } from "fs/promises";
 import { join } from "path";
-import { getRunPath, getOmkPath, pathExists, ensureDir, validateRunId } from "./fs.js";
+import { getOmkPath, pathExists, validateRunId } from "./fs.js";
+import { getRunArtifactPath, getRunPath } from "./run-store.js";
 export function createOmkSessionId(prefix = "session") {
     const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
     return `${prefix}-${timestamp}-${process.pid}`;
@@ -14,7 +15,7 @@ export function createOmkSessionEnv(projectRoot, sessionId) {
 export async function ensureSessionDir(runId) {
     const sanitized = validateRunId(runId);
     const dir = getRunPath(sanitized);
-    await ensureDir(dir);
+    await mkdir(dir, { recursive: true });
     return dir;
 }
 export async function writeSessionMeta(runId, meta) {
@@ -30,7 +31,7 @@ export async function writeSessionMeta(runId, meta) {
 }
 export async function readSessionMeta(runId) {
     const sanitized = validateRunId(runId);
-    const metaPath = join(getRunPath(sanitized), "session.json");
+    const metaPath = getRunArtifactPath(sanitized, "session.json");
     if (!(await pathExists(metaPath)))
         return null;
     try {

package/docs/2026-06-16/critical-issues.md

@@ -0,0 +1,19 @@
+# 2026-06-16 Critical Issues
+
+## Critical Init Status
+
+### Missing critical artifacts
+- `.omk/hooks/pre-shell-guard.sh` — destructive shell guard
+- `.omk/hooks/protect-secrets.sh` — secret write guard
+
+
+## Critical Artifacts Present
+- ✅ `AGENTS.md` — top-level operating contract
+- ✅ `.kimi/AGENTS.md` — Kimi-specific operating rules
+- ✅ `.omk/config.toml` — OMK project runtime settings
+- ✅ `.omk/agents/root.yaml` — root coordinator agent
+- ✅ `.kimi/mcp.json` — Kimi project MCP registry
+- ✅ `.omk/memory/graph-state.json` — local ontology graph database
+
+## Escalation Rule
+- Treat missing shell/secret guards, root agent config, MCP registry, or ontology graph as critical until restored.

package/docs/2026-06-16/improvements.md

@@ -0,0 +1,15 @@
+# 2026-06-16 Improvements
+
+## Current Improvement Backlog
+### Optional init/support artifacts to add or refresh
+- None detected.
+
+### Critical init artifacts currently blocking reliable chat startup
+- `.omk/hooks/pre-shell-guard.sh` — destructive shell guard
+- `.omk/hooks/protect-secrets.sh` — secret write guard
+
+
+## Suggested Focus
+- Keep `omk chat` startup idempotent and non-destructive.
+- Prefer local graph memory for default ontology state.
+- Keep generated daily docs small, dated, and safe to edit by hand.

package/docs/2026-06-16/init-checklist.md

@@ -0,0 +1,25 @@
+# 2026-06-16 Required Init Checklist
+
+**Run ID:** chat-2026-06-15T18-37-32-586Z-3029826
+**Ontology graph:** `.omk/memory/graph-state.json`
+
+## Required Artifacts
+- ✅ `AGENTS.md` — critical; top-level operating contract
+- ✅ `.kimi/AGENTS.md` — critical; Kimi-specific operating rules
+- ✅ `DESIGN.md` — support; design/brand source of truth
+- ✅ `.omk/config.toml` — critical; OMK project runtime settings
+- ✅ `.omk/agents/root.yaml` — critical; root coordinator agent
+- ✅ `.kimi/mcp.json` — critical; Kimi project MCP registry
+- ✅ `.omk/mcp.json` — support; legacy OMK MCP fallback
+- ✅ `.omk/lsp.json` — support; bundled TypeScript/Python LSP config
+- 🚨 `.omk/hooks/pre-shell-guard.sh` — critical; destructive shell guard
+- 🚨 `.omk/hooks/protect-secrets.sh` — critical; secret write guard
+- ✅ `.omk/memory/graph-state.json` — critical; local ontology graph database
+- ✅ `.kimi/skills` — support; Kimi skill directory
+- ✅ `.agents/skills` — support; portable skill directory
+
+## Recovery Command
+```bash
+omk init
+omk doctor
+```

package/docs/2026-06-16/plan.md

@@ -0,0 +1,20 @@
+# 2026-06-16 OMK Chat Plan
+
+**Run ID:** chat-2026-06-15T18-37-32-586Z-3029826
+**Generated by:** omk chat bootstrap
+
+## Purpose
+- Start every chat with a dated workspace for planning, issue triage, and verification evidence.
+- Keep ontology-backed memory available before the root coordinator starts.
+- Make required init state visible without overwriting user-authored docs.
+
+## Today Plan
+1. Review `init-checklist.md` and resolve missing critical init artifacts first.
+2. Use `improvements.md` as the active improvement backlog.
+3. Use `critical-issues.md` for blocking defects, safety risks, and verification gaps.
+4. Record command evidence before claiming work is complete.
+
+## Stop Condition
+- Critical init artifacts are present.
+- Ontology graph exists at `.omk/memory/graph-state.json`.
+- Any new code/docs changes have explicit verification evidence.

package/docs/2026-06-17/critical-issues.md

@@ -0,0 +1,19 @@
+# 2026-06-17 Critical Issues
+
+## Critical Init Status
+
+### Missing critical artifacts
+- `.omk/hooks/pre-shell-guard.sh` — destructive shell guard
+- `.omk/hooks/protect-secrets.sh` — secret write guard
+
+
+## Critical Artifacts Present
+- ✅ `AGENTS.md` — top-level operating contract
+- ✅ `.kimi/AGENTS.md` — Kimi-specific operating rules
+- ✅ `.omk/config.toml` — OMK project runtime settings
+- ✅ `.omk/agents/root.yaml` — root coordinator agent
+- ✅ `.kimi/mcp.json` — Kimi project MCP registry
+- ✅ `.omk/memory/graph-state.json` — local ontology graph database
+
+## Escalation Rule
+- Treat missing shell/secret guards, root agent config, MCP registry, or ontology graph as critical until restored.

package/docs/2026-06-17/improvements.md

@@ -0,0 +1,15 @@
+# 2026-06-17 Improvements
+
+## Current Improvement Backlog
+### Optional init/support artifacts to add or refresh
+- None detected.
+
+### Critical init artifacts currently blocking reliable chat startup
+- `.omk/hooks/pre-shell-guard.sh` — destructive shell guard
+- `.omk/hooks/protect-secrets.sh` — secret write guard
+
+
+## Suggested Focus
+- Keep `omk chat` startup idempotent and non-destructive.
+- Prefer local graph memory for default ontology state.
+- Keep generated daily docs small, dated, and safe to edit by hand.

package/docs/2026-06-17/init-checklist.md

@@ -0,0 +1,25 @@
+# 2026-06-17 Required Init Checklist
+
+**Run ID:** chat-2026-06-16T16-55-04-572Z-1984054
+**Ontology graph:** `.omk/memory/graph-state.json`
+
+## Required Artifacts
+- ✅ `AGENTS.md` — critical; top-level operating contract
+- ✅ `.kimi/AGENTS.md` — critical; Kimi-specific operating rules
+- ✅ `DESIGN.md` — support; design/brand source of truth
+- ✅ `.omk/config.toml` — critical; OMK project runtime settings
+- ✅ `.omk/agents/root.yaml` — critical; root coordinator agent
+- ✅ `.kimi/mcp.json` — critical; Kimi project MCP registry
+- ✅ `.omk/mcp.json` — support; legacy OMK MCP fallback
+- ✅ `.omk/lsp.json` — support; bundled TypeScript/Python LSP config
+- 🚨 `.omk/hooks/pre-shell-guard.sh` — critical; destructive shell guard
+- 🚨 `.omk/hooks/protect-secrets.sh` — critical; secret write guard
+- ✅ `.omk/memory/graph-state.json` — critical; local ontology graph database
+- ✅ `.kimi/skills` — support; Kimi skill directory
+- ✅ `.agents/skills` — support; portable skill directory
+
+## Recovery Command
+```bash
+omk init
+omk doctor
+```

package/docs/2026-06-17/plan.md

@@ -0,0 +1,20 @@
+# 2026-06-17 OMK Chat Plan
+
+**Run ID:** chat-2026-06-16T16-55-04-572Z-1984054
+**Generated by:** omk chat bootstrap
+
+## Purpose
+- Start every chat with a dated workspace for planning, issue triage, and verification evidence.
+- Keep ontology-backed memory available before the root coordinator starts.
+- Make required init state visible without overwriting user-authored docs.
+
+## Today Plan
+1. Review `init-checklist.md` and resolve missing critical init artifacts first.
+2. Use `improvements.md` as the active improvement backlog.
+3. Use `critical-issues.md` for blocking defects, safety risks, and verification gaps.
+4. Record command evidence before claiming work is complete.
+
+## Stop Condition
+- Critical init artifacts are present.
+- Ontology graph exists at `.omk/memory/graph-state.json`.
+- Any new code/docs changes have explicit verification evidence.

package/docs/ARCHITECTURE_ANALYSIS_CODEGRAPH.md

@@ -2,7 +2,8 @@
 
 > 분석일: 2026-05-25
 > 도구: CodeGraph (SQLite 기반 코드 의존성 그래프)
-> 대상: /home/yu/open_multi-agent_kit (open-multi-agent-kit v1.1.18)
+> 대상: /home/yu/open_multi-agent_kit (open-multi-agent-kit@0.79.3, runtime contract family v1.2, pre-1.0)
+> 최신화: 2026-06-15 — release truth, authority/evidence gates, health-aware routing, and spec-kit docs refreshed.
 
 ---
 

package/docs/GSTACK_MIGRATION.md

@@ -1,7 +1,7 @@
 # External Multi-Agent Stack → OMK Migration Guide
 
 > Generic migration path from any external multi-agent orchestration stack (e.g., gstack, custom frameworks) to OMK.
-> OMK v1.1.18+ with externalized skill presets.
+> OMK `open-multi-agent-kit@0.79.3` (`v1.2` runtime contract family, `pre-1.0`) with externalized skill presets, scoped MCP/skills/hooks, evidence gates, and provider-neutral runtime routing.
 
 ## Why Migrate to OMK
 

package/docs/algorithm-hardening-playbook.md

@@ -0,0 +1,219 @@
+# OMK Algorithm Hardening Playbook
+
+> How to evolve OMK's runtime algorithms safely, contract-first, and with evidence.
+
+## 1. Principles
+
+### 1.1 Change contracts before code
+
+When hardening an algorithm, start with:
+
+1. Type/interface changes (e.g., `AgentTask.safety`, `RuntimeHealthVectorV2`).
+2. Unit tests that express the new contract in isolation.
+3. Adapter updates to satisfy the compiler.
+4. Integration tests.
+5. Documentation updates.
+
+This order catches contract violations at compile time rather than at runtime.
+
+### 1.2 Declare, observe, then verify
+
+For evidence gates:
+
+- **Declare**: node/task says what evidence kinds are required.
+- **Observe**: after execution, extract actual observations from stdout, metadata, artifacts.
+- **Verify**: compare observations against declarations.
+
+A declaration is never proof.
+
+### 1.3 Runtime-mode authority
+
+Authority is not provider identity. It is `(provider, runtimeMode)`:
+
+```text
+kimi:api   → read, review (advisory)
+kimi:cli   → read, write, patch, shell, merge, review (authority)
+deepseek:api → read, review (advisory)
+codex:cli  → read, plan, review (advisory unless explicit policy)
+```
+
+Any code path that selects a runtime must consult this matrix.
+
+### 1.4 Fail-closed defaults
+
+- Unknown health → route with penalty or block.
+- Missing evidence → exit 78.
+- Advisory runtime asked to write/shell/merge → exit 78.
+- Low-confidence risk → downgrade to `ask`.
+
+### 1.5 Preserve backward compatibility
+
+- Do not remove old fields until the full phase is released.
+- Use optional/new fields first, then deprecate.
+- Keep existing smoke tests passing.
+
+## 2. Step-by-step hardening loop
+
+### Step 0 — Isolate the concern
+
+Pick one algorithm concern per phase:
+
+- evidence semantics
+- health probes
+- authority matrix
+- prompt privacy
+- audit graph
+
+Do not mix two concerns in one diff.
+
+### Step 1 — Specify the contract
+
+Write the LaTeX/TypeScript contract first. Example:
+
+```ts
+// Before changing implementations, add the new contract.
+export interface AgentTaskSafety {
+  readonly risk: string;
+  readonly approvalPolicy: string;
+  readonly sandboxMode: string;
+  readonly evidenceRequired: boolean;
+  readonly authorityMode: string;
+}
+```
+
+### Step 2 — Add isolated tests
+
+Create a new test file that fails before implementation:
+
+```text
+test/evidence-v2-declared-vs-observed.test.mjs
+test/health-vector-tri-state.test.mjs
+test/authority-matrix-kimi-api-advisory.test.mjs
+```
+
+### Step 3 — Implement behind a flag when possible
+
+For large changes, use an environment flag:
+
+```ts
+const evidenceModelV2 = process.env.OMK_EVIDENCE_MODEL === "v2";
+```
+
+This lets you merge incrementally without breaking existing paths.
+
+### Step 4 — Update adapters incrementally
+
+For each runtime adapter:
+
+1. Make it compile with the new contract.
+2. Add a focused test for that adapter.
+3. Move to the next adapter.
+
+### Step 5 — Integrate and remove flag
+
+Once all adapters and tests pass:
+
+1. Default the flag to the new behavior.
+2. Add a revert path.
+3. Run full quality gates.
+
+### Step 6 — Document and release-gate
+
+- Update `docs/provider-maturity.md`, `docs/native-root-runtime-hardening.md`.
+- Add the new behavior to `release:check` or a dedicated smoke script.
+- Update `CHANGELOG.md`.
+
+## 3. Parallel subagent orchestration
+
+When spawning parallel workers (when the tool is available):
+
+### 3.1 Decompose by concern, not by file
+
+Each worker owns one concern end-to-end:
+
+- evidence worker: contract + tests + runtime-backed + DAG executor
+- health worker: vector v2 + adapters + scoring
+- authority worker: matrix + resolver + docs + smoke
+
+### 3.2 Grant least privilege
+
+| Worker | Authority | Allowed paths | Blocked paths |
+|--------|-----------|---------------|---------------|
+| evidence | write-scoped | `src/runtime/contracts/evidence.ts`, `src/runtime/runtime-backed-task-runner.ts`, `src/orchestration/executor.ts`, `test/evidence-*.mjs` | secrets, env files |
+| health | write-scoped | `src/runtime/contracts/shared.ts`, `src/runtime/runtime-router.ts`, `src/runtime/*-runtime.ts`, `test/health-*.mjs` | secrets, env files |
+| authority | write-scoped | `src/runtime/authority-matrix.ts`, `src/runtime/runtime-bootstrap.ts`, `src/runtime/runtime-router.ts`, `docs/provider-maturity.md`, `test/authority-*.mjs` | secrets, env files |
+
+### 3.3 Shared read-only reviewers
+
+Run reviewer/QA/security lanes in parallel after implementation lanes:
+
+- `omk-reviewer`: diff review, type safety
+- `omk-tester`: test matrix, release gate
+- `omk-security`: secret exposure, authority boundary
+
+### 3.4 Synthesis gate
+
+Do not merge until:
+
+1. Every lane produced evidence.
+2. `npm run check` passes.
+3. `npm run release:check` passes.
+4. New negative tests pass.
+5. Documentation is updated.
+
+## 4. Regression prevention
+
+### 4.1 Test hierarchy
+
+1. **Contract tests**: pure functions, no IO.
+2. **Adapter tests**: runtime mocks, no live provider calls.
+3. **Integration tests**: local CLI with `--dry-run`.
+4. **Smoke tests**: real provider only in CI with ephemeral keys.
+
+### 4.2 Required negative tests
+
+For every new gate, add a negative test:
+
+- Evidence declared but not observed → blocked.
+- Health fail → runtime excluded or penalized.
+- Advisory runtime asked for write → exit 78.
+- Private prompt leaked to public node → redaction/failure.
+
+### 4.3 Durable checkpoints
+
+Before each phase:
+
+```bash
+git branch phase-<N>-<concern>
+npm run check
+npm run test
+```
+
+After each phase:
+
+```bash
+npm run check
+npm run release:check
+git commit -m "feat(<concern>): <phase N> hardening"
+```
+
+## 5. When to stop
+
+Stop a phase and ask for guidance when:
+
+- A contract change would break public CLI behavior.
+- A runtime adapter cannot satisfy the new contract without a large refactor.
+- `npm run check` fails and the fix is not local.
+- A lane would need to write files outside its granted scope.
+
+## 6. Checklist
+
+- [ ] Contract specified in TypeScript/LaTeX
+- [ ] Isolated failing tests added
+- [ ] Implementation behind flag or in isolated file
+- [ ] All adapters updated incrementally
+- [ ] Negative tests added
+- [ ] Documentation updated
+- [ ] Quality gates pass
+- [ ] Evidence artifacts recorded
+- [ ] Result artifact written

package/docs/claims.md

@@ -66,7 +66,7 @@ Evidence:
 
 ## Claim: OMK is a stable 1.x release
 
-Status: not claimed. Current source version is `0.78.9` (`pre-1.0`); `v1.2` is a runtime contract family.
+Status: not claimed. Current source version is `0.80.2` (`pre-1.0`); `v1.2` is a runtime contract family.
 
 Evidence:
 - [versioning](versioning.md)

package/docs/getting-started.md

@@ -1,6 +1,6 @@
 # Getting Started
 
-Source release target: `open-multi-agent-kit@0.79.3`. Treat npm latest claims as valid only after registry verification and release gates pass.
+Source release target: `open-multi-agent-kit@0.80.2`. Treat npm latest claims as valid only after registry verification and release gates pass.
 
 ## Prerequisites