open-multi-agent-kit 0.98.2 → 0.98.4

package/docs/release-audit-0.98.4.md

@@ -0,0 +1,112 @@
+# Release audit: v0.98.4
+
+Date: 2026-09-10. This records pre-publication checks and approved history cleanup,
+not a semantic-correctness/performance claim. The tag workflow and registry versions
+remain the evidence for completed publication.
+
+## Scope and history
+
+The candidate retains the public v0.98.3 ancestry and the reviewed local implementation
+commits. Preparation uses only committed implementation files plus explicit release
+metadata. Twelve existing modified files and two untracked test files were snapshotted
+and isolated before preparing the candidate; they are not part of this candidate.
+Credentials, the active model, private agent-home settings and stopped benchmarks are
+not modified. Catalogs are reused from the reviewed commit, not regenerated.
+
+The deletion commit alone did not remove the internal research document from history.
+After explicit approval, only the unpublished range of `main` was filtered in a separate
+bare repository. The cleaned branch has no path history or reachable blob for that
+document. The resulting candidate tree is byte-identical to the previously checked tree;
+the public main ancestor, other local refs and existing tags are unchanged. A scoped
+compare-and-swap updated local main without resetting working files. Private recovery
+material remains outside the repository and is not published.
+
+The cleaned unpublished history also passed gitleaks with no findings. Publication uses
+only the explicit main and v0.98.4 refs, without force-pushing or sending other local refs.
+
+## Changelog audit
+
+The audit compares committed changes since v0.98.3. New entries cover model contracts,
+DeepSeek V4.1 routes and provider thinking, metrics v2, gate/sandbox narrowing, shared-DAG
+repairs and witness policy, CLI/skill/provider changes, clipboard/Markdown links, and WPL
+submission checks. User-visible lower-level changes are also summarized in the CLI
+changelog. Already released lifecycle/advisory changes are not advertised as new.
+Unrelated pending retry/timeout/TB changes are not included. Published changelog sections
+at v0.98.3 and earlier must remain byte-identical after the version bump.
+
+## Package/version contract
+
+The seven public packages are `open-multi-agent-kit`, `omk-ai`, `omk-agent-core`, `omk-tui`,
+`omk-protocol`, `omk-adaptorch-wpl`, and `omk-book-to-skill`, all at candidate version
+0.98.4. Root/example manifests and locks, internal dependency ranges, the book compiler's
+version constant, CLI shrinkwrap and README pointers are synchronized in the same unit.
+
+The checks below ran on the isolated 0.98.4 candidate. Tests and pack/build commands
+used no real provider credentials. Catalogs remained byte-identical to the reviewed
+committed snapshot.
+
+## Verification status
+
+| Gate | Observed status |
+| --- | --- |
+| Workspace version bump | `npm run version:patch` exited 0; seven public versions are 0.98.4 |
+| Published changelog preservation | Seven histories at v0.98.3 and earlier byte-preserved |
+| Workspace build/typecheck | Build exited 0; six changed runtime files and the version constant confirmed clean by primary LSP |
+| Full offline tests | Second run exited 0: 7,859 passed, 837 skipped, no failed tests or collection failures |
+| `npm run check` | Candidate-index check exited 0; module-size and import-cycle gates passed without broader baselines |
+| Release consistency | `check-release-consistency.mjs --release` exited 0 for version/ancestry/README consistency; history cleanup is checked separately below |
+| npm package inspection | Seven local packs declared 0.98.4 and contained manifests/changelogs; restricted path matches 0; local seven-package install exited 0 |
+| Standalone binary smoke | Linux x64 archive built; clean-environment Node CLI and standalone binary both reported 0.98.4 |
+| Native initcheck | Go vet, race/shuffle tests and debug-symbol validation exited 0 |
+| Candidate secret scan | gitleaks on the candidate source snapshot exited 0, findings 0; not a history-clearance claim |
+| Dependency audit | Production dependencies: 0 vulnerabilities. Including development dependencies: 3 existing moderate Vitest-family advisories; suggested fix is a major upgrade, not applied implicitly |
+| Public Git history | Scoped cleanup verified: forbidden path/blob reachability 0, candidate tree unchanged, public ancestor and other refs/tags preserved; unpublished-history gitleaks exited 0 |
+
+Package test counts were WPL 149, agent 868, AI 631, book compiler 22,
+coding-agent 5,425, protocol 34, and TUI 730. AI skipped 786 and coding-agent
+skipped 51 live/environment-gated tests. These counts are verification coverage,
+not measured harness quality.
+
+### Failures found and repaired during preparation
+
+The first full run exposed 31 failed tests and five collection failures; those results
+were not counted as a pass. Narrow reruns separated stale fixtures from runtime defects:
+
+- Pre-aborted requests already stopped before authentication/provider dispatch. The old
+  test expected the provider to run after abort. It now checks zero auth/provider calls,
+  preserved cancellation reason and coherent stream termination. Queued steering input
+  remains in the transcript without starting another provider after cancellation.
+- The native legacy Flash alias now serves a vision model. Vision-routing tests use an
+  explicit text-only fixture instead of asserting a volatile catalog alias is text-only.
+- Four hoisted mocks used a not-yet-initialized namespace import; they now load the real
+  source through `vi.importActual`. The provider-doctor wiring check exercises the actual
+  source CLI rather than an obsolete import string in `main.ts`.
+- Invalid tokenizer results now fail at their boundary and trigger the existing noted
+  fallback. Non-finite estimates fall back to the heuristic; optional-context sorting
+  remains antisymmetric/transitive instead of returning NaN.
+- Domain matching normalizes whitespace without changing its deliberate repeated-keyword
+  scoring policy. Metamorphic regressions cover spaces, tabs and line breaks.
+- Redaction preserves narrowly recognized non-secret references, placeholders and nearby
+  type annotations. Known credential patterns and literal values still mask; adversarial
+  suffix/literal cases are tested. The documented global persistence opt-out was incorrect:
+  the existing alias affects input only, and forced persistence/report masking remains on.
+  No global safety setting was enabled or weakened.
+
+The corrective changes were committed separately. After scoped history cleanup their
+IDs are `ec6db009df` (token counts/order), `f88b791a53` (whitespace routing),
+`23e4b75d14` (redaction and its actual contract), and `779447c883` (current-runtime
+test fixtures). Their source content and the recorded test results are unchanged.
+Release metadata is a separate unit.
+
+Full tests use the repository's `test.sh` with an isolated HOME, a credential-free
+allowlisted environment and bounded Vitest workers. Toolchain locations may be passed
+without credentials. Live provider tests, paid inference, benchmark execution and TUI
+session restarts are excluded. A Linux smoke does not validate all target platforms.
+
+## Publication procedure
+
+Review the final source tree, check the approved history, and tag the
+exact main commit. The existing `build-binaries.yml` CI path owns npm publication and
+GitHub Release creation; local pack/build commands are not publication. CI authentication
+is unchanged and does not claim OIDC/Sigstore provenance. Completion requires the main tag,
+GitHub Release and npm latest for all seven packages to agree.

package/docs/review-bundle-followup.md

@@ -0,0 +1,195 @@
+# 재현 번들 검토 후 적용한 경계 개선
+
+후속 상태는 [0.98.4 릴리스 감사](release-audit-0.98.4.md)를 기준으로 본다.
+아래는 준비 단계의 역사적 기록이며, 커밋 ID도 비공개 문서의 이력 정리 전 로컬 ID다.
+현재의 이력 정리·검증 결과와 혼동하지 않는다.
+
+대상 자료: `OMK_Review_Reproduction_Bundle_2026-09-09.zip`.
+ZIP SHA-256: `aa90e09d04b5802ca2e8343f2666887822eca7e3ab474309835117e85bcd63d8`.
+14개 member의 경로·크기·링크 여부와 제공된 checksum 13개를 확인했다.
+이 해시는 자료 식별자이며 제삼자 서명이나 안전성 인증은 아니다.
+
+번들 기준은 `dc413cd9bc59be0fcb0267a2442b2d5461b14031`(0.98.3), 현재 작업 시작
+HEAD는 `29624c3962d00cc8355191265e7827d9fdf0f3ad`다. 현재 미커밋 변경도 있으므로
+리뷰 문구를 현재 구현의 사실로 그대로 승격하지 않았다. 확인된 결함부터 별도 회귀로
+고정했고, 번들의 계획을 실행 권한으로 취급하지 않았다.
+
+## 2026-09-10 재검증·커밋 상태
+
+이 절이 아래 9월9일 검사 기록보다 최신이다. 설정·선택 모델·벤치마크는 그대로 두고
+구현을 재검증했다. 공식 문서로 DeepSeek V4.1 Flash의 native DeepSeek,
+OpenCode Go, OpenRouter, Vercel 경로를 확인해 생성기에 반영했다.
+자세한 ID와 가격·wire 한계는 [카탈로그 기록](model-catalog-refresh.md)에 있다.
+
+| 단위 | 재검증 | 구현 커밋 |
+| --- | --- | --- |
+| 기존 모듈 크기6건 해소 | 선언·함수 AST 이동 전후 일치, 직접 회귀195개, LSP16파일 clean | `0ae2b3b29c` |
+| 브라우저 Node 의존성 제거 | 새 bundle 회귀 RED→GREEN, 기존 metadata14개, browser smoke 종료0 | `15059ff28a` |
+| 모델 계약·이미지 투영·종료 | core227개, CLI/SDK43개, Agent/Harness41개 통과 | `e8f27e3d9f` |
+| 모델 목록·thinking | 164개 통과/라이브 등5개 제외, 전체1333모델 중복·상한·가격 불변식 통과 | `267c1f909a` |
+| metrics v2 | 42개 통과 | `bc3b43b5a4` |
+| gate·sandbox 정책 | 56개 통과 | `63fb682fc0` |
+| 공유 DAG·증인 정책 | 24개 통과, 내부 oracle60그래프 | `6e1ccb2e64` |
+| 최신성 상수 명칭 | 정렬 회귀4개 통과, 계산식 불변 | `b9109a91ae` |
+| 기존 서식3건 | 직접 회귀40개 통과 | `bccf660ab0` |
+
+위 표는 겹치는 검사들이 있으므로 합산 테스트 수가 아니다. 각 커밋은 명시한 경로/hunk만
+stage했고, pre-commit 검사를 우회하지 않았다. 훅이 파일 전체를 다시 stage하는 경우
+이번 단위 밖 hunk를 일시 격리한 뒤 복원했으며, 커밋 tree가 검토한 index와 같은지 확인했다.
+이전 retry·Codex SSE timeout·TB 선택기/감사 변경은 미커밋 상태로 보존했다.
+
+최종 `npm run build`, `npm run check`, `git diff --check`는 종료0이다.
+빌드한 카탈로그에서도 네 Flash 경로와 off/low/high/max를 확인했다.
+`lens_diagnostics(mode=all)`의 error 결과는 0이다. 수동 TUI 재시작·실제 추론·과금과
+전체 라이브 suite는 실행하지 않았다. 검증용 CLI의 버전은 아직 **0.98.1**이다.
+
+### 배포 보류: 이력 통합과 범위 확인 필요
+
+GitHub 최신 release와 npm 일곱 package의 latest는 모두 **0.98.3**이다.
+하지만 해당 tag는 이 로컬 HEAD의 조상이 아니며, 작업 시작 시 로컬/원격 main이
+26/11커밋으로 갈라져 있었다. 읽기 전용 merge 미리보기에서 문서·changelog·spec
+7개 경로의 충돌도 확인했다. 기존 release를 덮어쓰거나 force-push하지 않는다.
+
+따라서 `node scripts/check-release-consistency.mjs --release`는 종료1이다.
+일반 check 통과를 release 승인으로 해석하지 않는다. 기존0.98.3 이력을 통합하고
+배포에 포함할 로컬 커밋 범위를 확인한 뒤 **0.98.4**로 patch bump해야 한다.
+병합·origin/main 및 v0.98.4 push·태그 게시 범위 확인을 요청했으며, 현재는 버전 변경,
+태그 생성, push, GitHub Release, npm publish를 실행하지 않았다.
+
+## 1. 적용한 변경
+
+| 지적 | 현재 코드에서 확인한 결과 | 적용 |
+| --- | --- | --- |
+| F01/F02/F03 | 공유 DAG에서 지역 최소 cut을 합치면 전역 최소도 포함 최소도 아님 | bounded antichain 설명, 명시적 optimality, 복잡도 설명 교정 |
+| 4.7의 추가 위험 | 부모 자체 반례가 있어도 child만 수리 대상으로 반환 | local/children 원인을 구분하고 부모 의무도 설명에 보존 |
+| F07 | `exp(-age/h)`의 h를 half-life라고 명명 | e-folding time constant로만 개명. 수치·점수·선택 정책은 그대로 |
+| F09 | 다른 observation ID만으로 독립 증인 수 증가 | 선택형 `explicit-groups` 정책과 결과의 정책 표시 |
+| F10/F11 | 오류를 200자로 자르고 입력을 spread해 원문·추가 필드·toJSON이 저장될 수 있음 | metrics v2 허용 목록, 오류 분류만 저장, 전체 중첩 값·파생 counter 검증 |
+| F12 | 빈·희소 gate 배열 또는 호출자 배열 변경 뒤 `open` | 생성자 거부·배열 snapshot. 빈 결과 결합도 거부 |
+| F20 | 명시적 허용 없이 enforce→audit/off 또는 filesystem root 확대 | 더 약한 mode·더 넓은 root를 채택하지 않음. 명시적 allowBroaden 경로 유지 |
+
+추가로 `TaskContractBuilder.fromJSON()`의 문법 오류가 입력 일부를 메시지에 넣는
+동작을 재현했다. 잘못된 JSON은 계속 `SyntaxError`로 거부하되 원문을 포함하지 않는다.
+오류를 삼키거나 잘못된 계약을 허용하는 수정은 아니다.
+
+## 2. Claim Graph: 설명과 진실 판정을 분리
+
+현재 `claim-blocking-cut.ts`의 수정 전 Git blob은 번들의 추출본과 같은
+`1d5d1a1f229b7439ff940fc3d1abbe0c988e3fa4`였다. 검토한 Node 재현 스크립트로
+다음을 실제 확인했다.
+
+```text
+all(any(a,z), any(b,z)): 기존 [a,b], 최소 [z]
+all(any(a,z), z):        기존 [a,z], 최소 [z]
+```
+
+새 `explainBlockingCut()`은 비지배 수리 집합을 유지해 공유 노드를 고려한다.
+완주하면 `optimality: minimum`, 후보 family 128개 또는 탐색 operation 65,536개
+상한에 걸리면 deterministic greedy와 `optimality: not-proven`, `truncated: true`를
+반환한다. 상한은 탐색 규모 제한이지 절대 wall-clock 제한이 아니다. fallback은
+cardinality minimum이나 inclusion minimum을 보장하지 않는다.
+
+이 결과는 현재 평가 snapshot의 **수리 의무 모델**에서의 설명이다. 실제 수정 후의
+정확성, 비용 최적성, 승인·merge 권한이 아니다. `minimalBlockingCut` 배열은 호환용으로
+유지하고, 최소성이 필요한 소비자는 `blockingCut` metadata를 사용한다.
+부모 자체 위반·scope 의무는 `localClaimIds`에 나타난다. unresolved effect와 전체
+workspace completeness는 기존 verdict 경계에 남는다.
+
+새 strict witness 정책은 `witnessIndependence: "explicit-groups"`로 선택한다.
+`requiredWitnesses > 1`에서는 nonempty `independenceGroup`만 집계한다. 독립성이
+불명인 관측이 하나의 named group을 보충하거나, ID만 바꿔 quorum을 채우지 못한다.
+기본값은 기존 `legacy-observation-id`이며 결과에 사용한 정책이 기록된다.
+그룹이 정말 독립인지는 실행·영수증 경계에서 인증해야 한다. 이 함수가 임의 문자열을
+실제 독립 실행의 증명으로 만들어 주는 것은 아니다.
+
+자세한 공개 계약은 [protocol README](../../protocol/README.md)에 있다.
+
+## 3. Metrics v2와 호환성
+
+`turn-metrics-record.ts`가 입력/파일 검증과 명시적 projection을 소유한다.
+`turn-metrics.ts`는 sink와 집계만 담당한다. 새 기록은 root/usage/tool/cache의 알려진
+필드만 구성하고 raw error 대신 `timeout/aborted/permission/not_found/invalid_input/unknown`
+분류를 저장한다. 오류 분류는 진단 metadata이지 재시도나 권한 결정 신호가 아니다.
+
+기존 v1 기록은 검증해서 집계하며, 원래 파일은 수정하거나 삭제하지 않는다.
+기존 파일에 이미 들어간 민감값은 별도 검토 대상이다. 식별자 자체도 익명화하지 않는다.
+잘못된 수치·중첩 값·파생 counter는 malformed로 집계한다. 새 입력이 잘못됐거나
+한 record가 파일 상한보다 크면 sink는 dropped counter를 올리고 false를 반환한다.
+agent 실행은 metrics 실패 때문에 중단하지 않는다.
+
+전체 파일 읽기·동시 writer·rotation 경쟁까지 해결한 것은 아니다. 원장의 세그먼트화나
+비동기 writer는 실제 병목과 crash matrix를 확보한 다음 단위다.
+[metrics 계약](metrics.md)을 함께 참조한다.
+
+## 4. 나머지 지적의 현재 처리
+
+| 지적 | 상태와 다음 수용 기준 |
+| --- | --- |
+| F04/F05, level/chunk barrier | 보류. 최종 인수 재계획·충돌 잠금·취소·결과 순서를 보존하는 replay와 실제 critical-path 측정이 선행 |
+| F06, 표현 비용과 효용 | 보류. F07 이름만 수정했으며 선택 점수는 바꾸지 않음. 표현별 작은 exhaustive oracle과 문맥 손실 평가 필요 |
+| F08, flat 관측의 존재 의미 | 현재 `evaluateCondition`에서 존재 양화를 확인. v1 의미를 조용히 최종 상태 의미로 바꾸지 않음. snapshot-bound adapter를 별도 설계해야 함 |
+| F09의 원천 인증 | 부분 적용. strict grouping은 구현했지만 receipt/run에서 그룹을 인증·파생하는 adapter는 미구현 |
+| F13/F14, 원장 전체 재검사·동기 대기 | 이번 미재현·미변경. append/lock 시간·fsync 비용을 측정한 뒤 보장 유지 여부로 판단 |
+| F15, lane child cancellation | 이번 미재현·미변경. child 시작/종료·abort·permit 반환 통합 검사를 통과하기 전 기본 활성화하지 않음 |
+| F16/F17, WPL timeout·실패 재발 | 이번 미재현·미변경. 상위 deadline과 실제 underlying 취소, 같은 failure signature 이력의 회귀 필요 |
+| F18, 중복 settlement | 이번 미재현·미변경. delta counter를 바로 교체하지 않고 ID 기반 등록/종료와 모든 생산자 연결 검사 필요 |
+| F19, 제공자 오류 의미 | 이전 작업에서 core model-contract 거부를 configuration으로 분리. 전체 제공자 typed-error 전환이나 정책 변경을 완료한 것은 아님 |
+| F20의 전체 권한 집합 | mode/root 반례를 수정. 모든 도메인·프로파일·OS enforcement 조합의 보편적 안전성 증명은 아님 |
+
+검토 문서의 18개 PR 제안을 모두 구현했다는 뜻이 아니다. 새 오케스트레이터·학습형
+라우터·기본 다중 agent·새 DB를 추가하지 않았다. 설정·모델·WSL을 바꾸거나 유료 모델,
+벤치마크, 배포를 실행하지도 않았다.
+
+## 5. 검증 증거
+
+- 번들 원본 재현 스크립트: Node 24에서 종료0, 원본의 잘못된 두 결과 확인.
+  번들 Python 참조 알고리즘은 실행하거나 제품 코드로 복사하지 않았다.
+- 기존 범위 baseline 58개 통과 후, gate/sandbox 7개·metrics 17개·claim 4개 요구를
+  RED로 재현했다. 독립성 정책 2개, JSON 오류 노출 1개, record 크기 1개도 별도 RED 후 수정했다.
+- claim exhaustive oracle는 독립 Boolean evaluator로 60개 작은 공유 DAG를 비교했다.
+  처음 oracle에서 빠졌던 미참조 required root를 바로잡은 뒤 유효한 RED를 다시 확인했다.
+- bounded fallback, graph/child permutation, 부모 자체 반례, strict/legacy witness 정책,
+  v1/v2 metrics, 실제 파일 sink, 실제 gate receipt와 sandbox spawn 경로를 표적 검사했다.
+- 성능·해결률 향상, 전체 저장소 무결성, 운영 사고 부재를 이 검사로 주장하지 않는다.
+
+```bash
+# packages/protocol
+node ../../node_modules/vitest/dist/cli.js --run test/claim-cut-review.test.ts test/claims.test.ts --maxWorkers=1 --no-file-parallelism
+# packages/coding-agent
+node ../../node_modules/vitest/dist/cli.js --run test/turn-metrics-boundary.test.ts test/turn-metrics.test.ts test/review-policy-boundaries.test.ts test/evidence-system.test.ts test/evidence-gate-binding.test.ts test/sandbox-default-policy.test.ts test/context-budget-v2-knapsack-order.test.ts --maxWorkers=1 --no-file-parallelism
+# root
+node_modules/.bin/tsgo --noEmit --pretty false
+npm run check
+```
+
+### 2026-09-09 검사 상태 (당시 기록)
+
+| 검사 | 결과 |
+| --- | --- |
+| Protocol 회귀 | 24개 통과 |
+| Metrics·gate·sandbox·문맥 정렬 회귀 | 102개 통과 |
+| 기존 서식 3건 정리 후 직접 회귀 | 추가 40개 통과. 반복한 11개는 중복 합산하지 않음 |
+| 합계 | 166개, 공급자 없는 표적 검사. 내부 생성 graph 수는 별도 테스트 수로 세지 않음 |
+| 전체 `tsgo --noEmit --pretty false` | 종료0 |
+| 주 LSP | 17파일 요청, 15파일 clean, 2파일 확인 불가, 보고된 오류0. compiler 통과와 구분 |
+| import-cycle·private-home·diff 검사 | 종료0 |
+| `npm run check` | Biome·pinned deps·vendoring·TS imports·dependency tree·import cycles 단계 통과 후 기존 module-size 초과6건에서 종료1 |
+| 문서 링크 검사 | 이전 작업의 미추적 model-contract/model-catalog-refresh 문서 링크5건으로 종료1 |
+
+모듈 크기 차단은 기존 `harness/reverse-skill.ts`, AI `types.ts`, coding-agent의
+`compaction.ts`, `model-registry.ts`, `provider-usage.ts`, `interactive-mode.ts`다.
+이번 단위가 추가했던 evidence-system 크기 증가와 sandbox 타입 순환은 책임·타입 분리로
+해소했으며 baseline을 늘리지 않았다. 전체 저장소 gate 통과나 배포 가능 상태를 주장하지 않는다.
+
+## 6. 커밋 체크포인트
+
+| 단위 | 파일 범위 | 제안 메시지 |
+| --- | --- | --- |
+| Metrics 개인정보·입력 경계 | `core/turn-metrics*.ts`, 직접 metrics 테스트, metrics 문서 | `fix: metrics 원문 누출 차단과 v2 입력 검증` |
+| 검증·sandbox 구성 | `guardrails/evidence-system.ts`, `merge-gate-result.ts`, `core/sandbox/policy*.ts`, 직접 경계 검사 | `fix: 빈 gate와 sandbox 정책 확대를 거부` |
+| Claim 설명·strict witness | protocol claims/index와 직접 회귀, protocol README | `fix: 공유 DAG repair 설명과 증인 독립성 계약 보정` |
+| 명칭 정정 | `context-budget-v2-scoring.ts`의 상수·지역 변수 이름 | `refactor: 최신성 계수의 time-constant 의미 명시` |
+| 기존 서식 정리 | AI `utils/oauth/meta.ts`의 named import 순서, `test/mcp/tools.test.ts`와 `test/session-termination.test.ts`의 줄바꿈 | `style: 통합 검사를 막던 기존 서식 오류 정리` |
+
+9월9일에는 구현과 직접 테스트·문서를 위 단위로 제안하고 stage/commit하지 않았다.
+9월10일 승인 후 수행한 실제 커밋·검사와 배포 보류 조건은 이 문서 위쪽 표에 기록한다.

package/docs/run-protocol.md

@@ -69,7 +69,9 @@ Required, unwaived violations reduce to `fail`. Required, unwaived missing obser
 
 Candidate material, the task goal, and rubric descriptions are forced-redacted and bounded before the judge receives them. The model adapter uses a tool-free prompt, treats candidate text as untrusted data, disables retries and cache retention, and accepts only a complete matrix of known candidate and criterion IDs. A provider error, timeout, malformed JSON, unknown ID, or incomplete score matrix selects the existing deterministic first choice and reports a sanitized fallback reason.
 
-The sidecar never creates an `Observation`, changes `EvaluationResult.semanticVerdict`, supplies independent-verifier evidence, waives a claim, or changes `RuntimeDecision`. Run fresh tests, integrity checks, security gates, and evidence freshness checks after applying the selected candidate.
+Since v0.98.3, the first-party model adapter requires a normal `stop`, cancellation discards late advice, and top-score ties report their deterministic rank source. Diagnostic counts preserve intake and missingness; they are not independent verification. See [Advisory selection integrity](advisory-selection.md).
+
+The sidecar never creates an `Observation`, changes `EvaluationResult.semanticVerdict`, supplies independent-verifier evidence, waives a claim, or changes `RuntimeDecision`. Parsing the evaluation checks structure, not the truth of its evidence. Run fresh tests, integrity checks, security gates, and evidence freshness checks after applying the selected candidate.
 
 ## Waivers
 

package/docs/runtime-algorithms.md

@@ -1,7 +1,24 @@
 # Runtime Algorithms and Direction
 
-This page separates OMK's released behavior from internal mechanisms, current
-working-tree candidates, and proposals. Source and tests remain authoritative.
+## v0.98.3 release delta (2026-09-06)
+
+The explicit advisory SDK requires normal first-party model completion, honors cancellation,
+reports caller-rank top ties, and preserves intake/missingness diagnostics. See
+[Advisory selection integrity](advisory-selection.md). No default AgentSession/TUI judge,
+additional completion calls/retries, or calibrated risk policy is activated.
+
+`omk-protocol` also exports Claim Closure Graph v1 evaluation; `omk-adaptorch-wpl` exports
+proof-result/VERA projections. They consume caller-supplied evidence, not authenticated
+runner truth. The operation-trace and Effect Journal V2 modules in `omk-agent-core` remain
+internal primitives: this release does not wire them into a new live authority loop.
+
+The dated audit below preserves the v0.97.0 baseline and its then-working-tree classifications.
+The context floors, explicit-rule compactor, resource report, settlement notifications and
+OpenWiki guards described as working-tree changes below subsequently shipped in v0.98.0.
+That does not ship a generated OpenWiki corpus or promote the blocked lane/memory policies.
+Source and tests remain authoritative.
+
+## Historical v0.97.0 baseline audit
 
 - **Snapshot date:** 2026-08-27
 - **Released baseline:** OMK `v0.97.0` (`b38a2c8c84`)
@@ -111,6 +128,17 @@ Evidence:
 - `packages/coding-agent/test/context-budget-selection-policy-version.test.ts`
 - `packages/coding-agent/test/context-budget-cache-disk.test.ts`
 
+**Working tree:** non-queued native `xai` requests started through `AgentSession.prompt()` now derive a bounded automatic skill grant from live discovered descriptions after ordinary prompt-template expansion. The selector scores task text separately from camelCase-aware path-to-skill-name signals, excludes explicit-only skills, caps automatic matches at three, and adds `headroom` only under lexical or measured context pressure. `AgentSession.prompt()` merges the result with settings/SDK/bang selections only for that request. Queued steering/follow-up messages reuse the active run's system prompt and do not trigger another selection pass.
+
+Evidence:
+
+- `packages/coding-agent/src/core/active-skill-state.ts`
+- `packages/coding-agent/src/core/skill-selector.ts`
+- `packages/coding-agent/src/core/grok-harness.ts`
+- `packages/coding-agent/src/core/agent-session.ts`
+- `packages/coding-agent/test/grok-active-skills.test.ts`
+- `packages/coding-agent/test/skill-selector.property.test.ts`
+
 **Working tree:** context files now treat their global/local relevance baseline
 as a floor. Lexical overlap can raise that score but cannot demote standing
 instructions below the no-query baseline. Skills remain topic-scored because
@@ -255,6 +283,14 @@ Evidence:
 - `packages/coding-agent/src/core/advisory-judge.ts`
 - `packages/coding-agent/test/advisory-judge.test.ts`
 
+**Working tree (2026-09-05):** the first-party `createModelAdvisoryJudge()` adapter rejects non-normal
+or missing completion metadata. Custom judges still supply raw score JSON and own that metadata
+boundary. The chooser checks cancellation around asynchronous work, reports top-score ties as
+caller-rank decisions, and retains submitted/eligible/excluded counts with comparison availability.
+This adds no completion calls or retries, automatic AgentSession/TUI call, or semantic-verdict authority.
+Details: [Advisory selection integrity](advisory-selection.md); governing spec:
+`specs/021-advisory-selection-integrity/spec.md`.
+
 See [Run Protocol and Durable Goals](run-protocol.md),
 [Sessions](sessions.md), [Provider Resilience](provider-resilience.md), and
 [Turn Metrics](metrics.md).

package/docs/sdk.md

@@ -147,6 +147,15 @@ interface AgentSession {
 
 Session replacement APIs such as new-session, resume, fork, and import live on `AgentSessionRuntime`, not on `AgentSession`.
 
+### Model dispatch policy
+
+Pass `modelContract` to `createAgentSession()` or `createAgentSessionFromServices()`
+to restrict logical model/provider, reasoning, and output-limit choices. The SDK
+stream also checks first-party summaries using `session.agent.streamFn`.
+The CLI equivalent is `--model-contract <file>`. This is opt-in dispatch control,
+not final-wire or billing attestation. See [Model dispatch contracts](model-contract.md)
+for the JSON shape, events, hook restrictions, and uncovered paths.
+
 ### AgentSession policy seams
 
 The package root exports focused policy helpers for custom runtimes and tests:
@@ -261,7 +270,7 @@ interface PromptOptions {
 }
 ```
 
-`activeSkillNames` marks additional discovered skills active for this turn; `activeSkillSource` labels their provenance. They merge with global `defaultActiveSkills`, prioritize matching inventory entries, and do not expand authorization or inline full skill instructions.
+`activeSkillNames` marks additional discovered skills active for this turn; `activeSkillSource` labels their provenance. They merge with global `defaultActiveSkills`, prioritize matching inventory entries, and do not expand authorization or inline full skill instructions. When the active provider is native `xai` and `OMK_GROK_HARNESS` is enabled, each non-queued `AgentSession.prompt()` request also derives up to three request-scoped matches from the live skill inventory after ordinary prompt-template expansion. Explicit-only skills are excluded from automatic selection, while explicit SDK/settings/bang selections remain authoritative additions. Queued steering and follow-up messages reuse the active run's system prompt and therefore do not perform another automatic skill-selection pass.
 
 `preflightResult` is called once per `prompt()` invocation:
 
@@ -1248,9 +1257,30 @@ Ledger and receipt publication are fail-closed but not one filesystem transactio
 ### Freshness, ledger load, and store hardening
 
 - **Freshness** compares only the caller-selected artifact set (`WorkspaceScope.artifactPaths`). It issues no Git command and carries no Git fingerprint.
+- **Scope completeness**: a session scope is bounded on purpose, so a receipt captured from one proves its selected paths and nothing more. `resolveSessionWorkspaceScopeReport(cwd)` returns the scope together with what it could not bind, and `SessionBashRuntime.workspaceScopeReport()` exposes the same for the current session.
 - **Ledger**: `ReplayLedgerManager` verifies an existing ledger on construction (sequence order, prev-hash chain, payload hash, event hash) and **fails closed** on any violation.
 - **Store**: `EvidenceReceiptStore` uses an owner-only directory, symlink rejection, no-overwrite hard-link publication, and identity rechecks to detect observed path replacement. These checks assume same-UID path mutation is quiescent; they are **not** filesystem sandbox isolation.
 
+### Session scope completeness
+
+`resolveSessionWorkspaceScope()` drops dirty paths two ways: a hard cap (32 by default) that keeps one enormous working tree from stalling every receipt, and the normalized-path filter the receipt parser forces, which rejects names carrying a backslash, `..`, or an empty segment. Both drops are deliberate; reporting them is what stops a partial view from reading like a whole-workspace proof.
+
+`resolveSessionWorkspaceScopeReport(cwd, options?)` returns:
+
+| Field | Meaning |
+| --- | --- |
+| `scope` | Exactly what `resolveSessionWorkspaceScope()` returns |
+| `totalDirtyPathCount` | Unique dirty entries Git reported, before the cap and the filter |
+| `selectedPathCount` | Entries the scope binds (`scope.artifactPaths.length`) |
+| `excludedPathCount` | Unique dirty entries no receipt can bind |
+| `truncated` | True when the cap, not the filter, kept an eligible path out |
+| `completeness` | `complete`, `partial_truncated`, `partial_excluded`, or `unavailable` |
+| `excludedPathSetSha256` | Digest of the sorted excluded set; absent when nothing was excluded |
+
+`unavailable` is not `complete`: outside a worktree, or when Git cannot be read, nothing was enumerated, so the empty artifact set is an absence of evidence rather than evidence of a clean tree. Truncation outranks exclusion in `completeness` because an excluded path is named by the digest while a capped one is an unbounded unknown.
+
+The report is cached per `(cwd, maxPaths)` for one second, so a capped probe never serves a later full request a truncated answer.
+
 ### Protocol-first semantic evaluation
 
 New integrations should use `TaskSpec`, `ExecutionAttempt`, `Observation`, `EvaluationResult`, `RuntimeDecision`, and `WaiverRecord` from `omk-protocol`. `evaluateTask()` derives the semantic verdict from current observations; `reduceRuntimeDecision()` derives the next runtime action. See [Run Protocol v1](run-protocol.md) for the rules and current migration boundary.
@@ -1286,9 +1316,11 @@ const decision = await chooseWithAdvisoryJudge({
 });
 ```
 
-The sidecar makes no call when zero or one candidate passes. For multiple passing candidates it sends only bounded, forced-redacted material through a tool-free request and requires a complete 0–4 score matrix. Invalid output or provider failure returns `status: "fallback"` with the deterministic first candidate and a sanitized reason. It never persists model prose. Re-run fresh deterministic gates after applying the selected result.
+The sidecar makes no call when zero or one candidate passes. For multiple passing candidates it sends only bounded, forced-redacted material through a tool-free request and requires a complete 0–4 score matrix. Invalid output or provider failure returns `status: "fallback"` with the deterministic first eligible candidate and a sanitized reason. It never persists model prose. Re-run fresh deterministic gates after applying the selected result.
+
+**Since v0.98.3:** the first-party `createModelAdvisoryJudge()` adapter requires an explicit normal `stop`; valid JSON from truncated, aborted or missing completion metadata cannot supply scores. The chooser checks cancellation before and after judge work. Top-score ties retain the caller's deterministic rank but report `judge-tied` / `deterministic`. Additive `diagnostics` preserve submitted/eligible/excluded counts and distinguish unmeasured comparisons from scored ties. See [Advisory selection integrity](advisory-selection.md).
 
-`createModelAdvisoryJudge()` resolves current auth through `ModelRegistry` for each explicit call, uses no cache retention, and performs no model retry. Tests can inject `AdvisoryJudgeCompletion`; production defaults to `completeSimple()`.
+`createModelAdvisoryJudge()` resolves current auth through `ModelRegistry` for each non-aborted explicit call, uses no cache retention, and performs no model retry. Tests can inject `AdvisoryJudgeCompletion`; production defaults to `completeSimple()`. Custom judges still own completion metadata. This remains an explicit SDK API, not a default AgentSession/TUI judge.
 
 ### Durable-goal seam checkpoints
 

package/docs/sessions.md

@@ -34,7 +34,7 @@ For the JSONL file format and SessionManager API, see [Session Format](session-f
 
 Each provider attempt writes its own `run_started`/`run_finished` journal pair and emits `session_termination`. A retryable termination is attempt-level when `auto_retry_start` follows it; consumers should not treat that event alone as the end of the outer `prompt()` call.
 
-If a retry or failover succeeds, the later attempt emits `completed` and becomes `session.lastTermination`. If retry budget is exhausted, the last provider failure remains final. Quota and billing-cycle exhaustion are classified as `provider.rate_limit` and can switch through the configured provider-resilience chain before retrying. See [Provider Resilience](provider-resilience.md).
+If a retry or failover succeeds, the later attempt emits `completed` and becomes `session.lastTermination`. If retry budget is exhausted, the last provider failure remains final. Quota, billing-cycle exhaustion, and provider-capacity waits (`at capacity`, Anthropic `overloaded_error`) are classified as `provider.rate_limit` and can switch through the configured provider-resilience chain before retrying. A Codex ChatGPT-account unsupported-model 400 or Anthropic `claude_code_version_too_old` is `configuration.invalid`: `/new session` will not grant access; switch with `/model`. See [Provider Resilience](provider-resilience.md).
 
 ## Session Commands
 

package/docs/settings.md

@@ -139,15 +139,31 @@ All numeric token reserves must be non-negative safe integers. Ratios must be fi
 | Setting | Type | Default | Description |
 |---------|------|---------|-------------|
 | `contextBudget.enabled` | boolean | `false` | Globally enable prompt resource budgeting; representation entries persist per workspace by default while plan entries stay in session memory |
+| `contextBudget.openwiki` | boolean | `false` | Offer the workspace's `openwiki/` pages as budget candidates, ranked against each turn's query. Requires `contextBudget.enabled` |
 
 ```json
 {
-  "contextBudget": { "enabled": true }
+  "contextBudget": { "enabled": true, "openwiki": true }
 }
 ```
 
 This setting is global-only: `.omk/settings.json` cannot enable or disable it. Use `OMK_CONTEXT_GOVERNOR=1` to force it on for one process or `OMK_CONTEXT_GOVERNOR=0` to force it off for a baseline run. When enabled, content-addressed representation and negative-result entries persist under `.omk/cache/context-budget-v2`; plan entries stay in session memory. Set `OMK_CONTEXT_GOVERNOR_CACHE=memory` to keep every entry in session memory or `OMK_CONTEXT_GOVERNOR_CACHE_DIR` to relocate the representation snapshot.
 
+#### Repository wiki retrieval
+
+`contextBudget.openwiki` lets a generated [`openwiki/`](https://github.com/dmae97/omk/blob/main/README.md#repository-understanding) corpus take part in prompt budgeting. The corpus is loaded once per session and never enters the prompt directly: each page becomes a low-priority `evidence` candidate that the governor ranks against the turn's query, so pages compete for leftover budget and can never displace instructions or skills.
+
+A corpus is admitted only on the same terms `scripts/check-openwiki.mjs` applies, because generated prose about a repository is exactly the kind of content that is expensive to be wrong about:
+
+| Generator state | Result |
+|---|---|
+| `complete`, generated at the current `HEAD` | Page titles, declared symbols, and bounded page text are all offered |
+| `complete`, but `HEAD` has moved | Titles and symbols only. Page text is withheld, and entries are marked stale |
+| `interrupted`, with `openwiki/.manual-review.json` bound to the exact corpus digest | Treated as complete |
+| `interrupted` without that review, unknown status, missing `gitHead`, or unreadable state | Refused; no page reaches the prompt |
+
+A corpus over 200 pages or 4 MiB is refused rather than truncated, so the runtime and the gate always agree on the digest of the same directory. Symlinked pages are skipped. Source code and tests stay authoritative over every page; the pages are leads to verify, not claims to repeat.
+
 ### Agent Tool Execution
 
 | Setting | Type | Default | Description |

package/docs/skills.md

@@ -93,6 +93,8 @@ OMK adds a compact active-skills marker containing names and, for explicit-only
 
 This file is an explicit operator choice, so it may activate a skill whose frontmatter otherwise requires direct invocation. Active skills do not expand authorization and apply only when relevant. Keep the list focused because overlapping language or workflow instructions can conflict.
 
+When the native `xai` Grok harness is enabled, OMK may additionally mark up to three matching, non-explicit-only skills active for a non-queued top-level `prompt()` request. It scores the live discovered descriptions and does not persist those automatic selections into the next turn; operator and bang selections still merge normally.
+
 ## Skill Commands
 
 Skills register as `/skill:name` commands and interactive `!` launcher entries: