open-multi-agent-kit 0.98.3 → 0.98.5

package/docs/providers.md

@@ -32,6 +32,41 @@ Alibaba Model Studio Token Plan is recognized as **QWEN TOKEN PLAN** and reads i
 
 With a stored native `xai` OAuth credential, OMK reads `GET https://cli-chat-proxy.grok.com/v1/billing?format=credits` and shows the weekly SuperGrok pool from `config.creditUsagePercent` plus its reset from `config.currentPeriod.end`. `XAI_API_KEY` is a separate API-billing credential and does not authorize this subscription endpoint.
 
+### Model Studio DeepSeek V4
+
+Model Studio uses `enable_thinking`, including for DeepSeek. OMK's Chat Completions
+adapter recognizes official HTTPS DashScope and `*.maas.aliyuncs.com` hosts, defaults
+to `max_tokens` and the `system` role, and omits unsupported OpenAI store/long-cache
+fields. Legacy `thinkingFormat: "deepseek"` on these hosts is translated to the
+`enable_thinking` format. Native DeepSeek endpoints keep their native format.
+
+DeepSeek V4 sends the selected `reasoning_effort` when compatibility settings permit
+it. Without a model-specific mapping, `minimal` maps to the supported `low` value.
+An explicit `supportsReasoningEffort: false` still suppresses that field; remove
+that override or enable it for the model if you intend to send `high`, `xhigh`, or
+`max`. With thinking off, OMK sends `enable_thinking: false` rather than relying on
+the server default. See [custom model configuration](models.md#openai-compatibility).
+
+Keep the key paired with its purchased product and region. These are distinct
+billing paths, not interchangeable aliases:
+
+| Product | Example OpenAI-compatible base URL |
+| --- | --- |
+| Token Plan, Singapore | `https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1` |
+| Coding Plan, China | `https://coding.dashscope.aliyuncs.com/v1` |
+| Pay-as-you-go | `https://dashscope.aliyuncs.com/compatible-mode/v1` |
+
+Protocol detection never changes the URL, credentials, model ID, or subscription.
+For a comparison run, pin the exact Flash snapshot offered by that endpoint in
+both arms; `deepseek-v4-flash-0731` and an unversioned alias are not automatically
+the same experimental condition. Apply a [model contract](model-contract.md), and
+verify the installed adapter and final request before starting a benchmark.
+
+Sources: Alibaba's [DeepSeek API](https://www.alibabacloud.com/help/en/model-studio/deepseek-api)
+and [plan endpoint separation](https://www.alibabacloud.com/help/en/model-studio/token-plan-team-quickstart),
+consulted 2026-09-08. The local tests exercise serialization, not account availability,
+provider compliance, billing, or benchmark performance.
+
 ### OpenAI Codex
 
 - Requires ChatGPT Plus or Pro subscription
@@ -94,6 +129,7 @@ omk
 | Fireworks | `FIREWORKS_API_KEY` | `fireworks` |
 | Together AI | `TOGETHER_API_KEY` | `together` |
 | Kimi For Coding | `KIMI_API_KEY` | `kimi-coding` |
+| Meta Model API | `META_API_KEY` (or `META_MODEL_API_KEY`, `MODEL_API_KEY`) | `meta` |
 | MiniMax | `MINIMAX_API_KEY` | `minimax` |
 | MiniMax (China) | `MINIMAX_CN_API_KEY` | `minimax-cn` |
 | Xiaomi MiMo | `XIAOMI_API_KEY` | `xiaomi` |
@@ -106,7 +142,38 @@ Reference for environment variables and `auth.json` keys: [`const envMap`](https
 
 #### NVIDIA NIM
 
-Set `NVIDIA_API_KEY` and select an NVIDIA model with `/model`. The built-in `nvidia/z-ai/glm-5.2` entry sends `reasoning_effort`, including the `max` level. Other NVIDIA models keep conservative compatibility defaults unless their model metadata explicitly enables reasoning effort.
+Set `NVIDIA_API_KEY` and select a currently listed NVIDIA model with `/model`.
+NIM entries are filtered against its live `/v1/models` list; historical GLM examples
+may no longer be listed. Thinking capabilities stay model-specific. See the
+[latest catalog audit](model-catalog-refresh.md) for source coverage and limits.
+
+#### Meta Model API
+
+Meta's first-party [Muse Spark](https://dev.meta.ai/docs/overview) endpoint, served over the OpenAI
+Responses API at `https://api.meta.ai/v1`:
+
+```bash
+export META_API_KEY=...
+omk --provider meta --model muse-spark-1.3
+```
+
+Two auth paths:
+
+- **Subscription:** `/login` → Use a subscription → Muse Code. Device-code sign-in at
+  `auth.meta.com`, then a mint at `https://api.meta.ai/muse-code/key`. Honors `HTTP_PROXY` /
+  `HTTPS_PROXY`. The minted key is what inference uses.
+- **Pay-as-you-go:** `META_API_KEY` (then `META_MODEL_API_KEY`, then `MODEL_API_KEY`), or paste a
+  Model API key under `/login` → Use an API key → Meta Model API. Extra keys you create on the
+  dashboard are billed [per token](https://dev.meta.ai/docs/muse-code/subscriptions), even with an
+  active Muse Code subscription.
+
+Standard tier: `muse-spark-1.3`, `muse-spark-1.2`, `muse-spark-1.1`. Contributor tier:
+`muse-spark-1.3-contributor`, `muse-spark-1.2-contributor`. All carry a 1M-token context window.
+
+Thinking levels run `minimal` → `max`. Muse Spark's own effort ceiling is `xhigh`, which its docs
+call "maximum reasoning depth", so omk's `max` level maps onto `xhigh` rather than sending an enum
+the API would reject. Thinking cannot be switched off: Muse Spark rejects `reasoning_effort: "none"`
+with HTTP 400, so omk never sends it.
 
 #### Zyloo
 

package/docs/quickstart.md

@@ -85,6 +85,10 @@ Additional built-in read-only tools (`grep`, `find`, `ls`) are available through
 
 ## Give omk project instructions
 
+For optional, portable user defaults, preview `omk init --global --dry-run`, then
+run `omk init --global`. Existing instructions and settings are preserved.
+See [User context setup](context-files.md) for migration, loading, and interoperability.
+
 OMK loads context files at startup. Add an `AGENTS.md` file to tell it how to work in a project:
 
 ```markdown

package/docs/release-audit-0.98.4.md

@@ -0,0 +1,112 @@
+# Release audit: v0.98.4
+
+Date: 2026-09-10. This records pre-publication checks and approved history cleanup,
+not a semantic-correctness/performance claim. The tag workflow and registry versions
+remain the evidence for completed publication.
+
+## Scope and history
+
+The candidate retains the public v0.98.3 ancestry and the reviewed local implementation
+commits. Preparation uses only committed implementation files plus explicit release
+metadata. Twelve existing modified files and two untracked test files were snapshotted
+and isolated before preparing the candidate; they are not part of this candidate.
+Credentials, the active model, private agent-home settings and stopped benchmarks are
+not modified. Catalogs are reused from the reviewed commit, not regenerated.
+
+The deletion commit alone did not remove the internal research document from history.
+After explicit approval, only the unpublished range of `main` was filtered in a separate
+bare repository. The cleaned branch has no path history or reachable blob for that
+document. The resulting candidate tree is byte-identical to the previously checked tree;
+the public main ancestor, other local refs and existing tags are unchanged. A scoped
+compare-and-swap updated local main without resetting working files. Private recovery
+material remains outside the repository and is not published.
+
+The cleaned unpublished history also passed gitleaks with no findings. Publication uses
+only the explicit main and v0.98.4 refs, without force-pushing or sending other local refs.
+
+## Changelog audit
+
+The audit compares committed changes since v0.98.3. New entries cover model contracts,
+DeepSeek V4.1 routes and provider thinking, metrics v2, gate/sandbox narrowing, shared-DAG
+repairs and witness policy, CLI/skill/provider changes, clipboard/Markdown links, and WPL
+submission checks. User-visible lower-level changes are also summarized in the CLI
+changelog. Already released lifecycle/advisory changes are not advertised as new.
+Unrelated pending retry/timeout/TB changes are not included. Published changelog sections
+at v0.98.3 and earlier must remain byte-identical after the version bump.
+
+## Package/version contract
+
+The seven public packages are `open-multi-agent-kit`, `omk-ai`, `omk-agent-core`, `omk-tui`,
+`omk-protocol`, `omk-adaptorch-wpl`, and `omk-book-to-skill`, all at candidate version
+0.98.4. Root/example manifests and locks, internal dependency ranges, the book compiler's
+version constant, CLI shrinkwrap and README pointers are synchronized in the same unit.
+
+The checks below ran on the isolated 0.98.4 candidate. Tests and pack/build commands
+used no real provider credentials. Catalogs remained byte-identical to the reviewed
+committed snapshot.
+
+## Verification status
+
+| Gate | Observed status |
+| --- | --- |
+| Workspace version bump | `npm run version:patch` exited 0; seven public versions are 0.98.4 |
+| Published changelog preservation | Seven histories at v0.98.3 and earlier byte-preserved |
+| Workspace build/typecheck | Build exited 0; six changed runtime files and the version constant confirmed clean by primary LSP |
+| Full offline tests | Second run exited 0: 7,859 passed, 837 skipped, no failed tests or collection failures |
+| `npm run check` | Candidate-index check exited 0; module-size and import-cycle gates passed without broader baselines |
+| Release consistency | `check-release-consistency.mjs --release` exited 0 for version/ancestry/README consistency; history cleanup is checked separately below |
+| npm package inspection | Seven local packs declared 0.98.4 and contained manifests/changelogs; restricted path matches 0; local seven-package install exited 0 |
+| Standalone binary smoke | Linux x64 archive built; clean-environment Node CLI and standalone binary both reported 0.98.4 |
+| Native initcheck | Go vet, race/shuffle tests and debug-symbol validation exited 0 |
+| Candidate secret scan | gitleaks on the candidate source snapshot exited 0, findings 0; not a history-clearance claim |
+| Dependency audit | Production dependencies: 0 vulnerabilities. Including development dependencies: 3 existing moderate Vitest-family advisories; suggested fix is a major upgrade, not applied implicitly |
+| Public Git history | Scoped cleanup verified: forbidden path/blob reachability 0, candidate tree unchanged, public ancestor and other refs/tags preserved; unpublished-history gitleaks exited 0 |
+
+Package test counts were WPL 149, agent 868, AI 631, book compiler 22,
+coding-agent 5,425, protocol 34, and TUI 730. AI skipped 786 and coding-agent
+skipped 51 live/environment-gated tests. These counts are verification coverage,
+not measured harness quality.
+
+### Failures found and repaired during preparation
+
+The first full run exposed 31 failed tests and five collection failures; those results
+were not counted as a pass. Narrow reruns separated stale fixtures from runtime defects:
+
+- Pre-aborted requests already stopped before authentication/provider dispatch. The old
+  test expected the provider to run after abort. It now checks zero auth/provider calls,
+  preserved cancellation reason and coherent stream termination. Queued steering input
+  remains in the transcript without starting another provider after cancellation.
+- The native legacy Flash alias now serves a vision model. Vision-routing tests use an
+  explicit text-only fixture instead of asserting a volatile catalog alias is text-only.
+- Four hoisted mocks used a not-yet-initialized namespace import; they now load the real
+  source through `vi.importActual`. The provider-doctor wiring check exercises the actual
+  source CLI rather than an obsolete import string in `main.ts`.
+- Invalid tokenizer results now fail at their boundary and trigger the existing noted
+  fallback. Non-finite estimates fall back to the heuristic; optional-context sorting
+  remains antisymmetric/transitive instead of returning NaN.
+- Domain matching normalizes whitespace without changing its deliberate repeated-keyword
+  scoring policy. Metamorphic regressions cover spaces, tabs and line breaks.
+- Redaction preserves narrowly recognized non-secret references, placeholders and nearby
+  type annotations. Known credential patterns and literal values still mask; adversarial
+  suffix/literal cases are tested. The documented global persistence opt-out was incorrect:
+  the existing alias affects input only, and forced persistence/report masking remains on.
+  No global safety setting was enabled or weakened.
+
+The corrective changes were committed separately. After scoped history cleanup their
+IDs are `ec6db009df` (token counts/order), `f88b791a53` (whitespace routing),
+`23e4b75d14` (redaction and its actual contract), and `779447c883` (current-runtime
+test fixtures). Their source content and the recorded test results are unchanged.
+Release metadata is a separate unit.
+
+Full tests use the repository's `test.sh` with an isolated HOME, a credential-free
+allowlisted environment and bounded Vitest workers. Toolchain locations may be passed
+without credentials. Live provider tests, paid inference, benchmark execution and TUI
+session restarts are excluded. A Linux smoke does not validate all target platforms.
+
+## Publication procedure
+
+Review the final source tree, check the approved history, and tag the
+exact main commit. The existing `build-binaries.yml` CI path owns npm publication and
+GitHub Release creation; local pack/build commands are not publication. CI authentication
+is unchanged and does not claim OIDC/Sigstore provenance. Completion requires the main tag,
+GitHub Release and npm latest for all seven packages to agree.

package/docs/release-audit-0.98.5.md

@@ -0,0 +1,84 @@
+# Release audit: v0.98.5
+
+Date: 2026-09-12. This records candidate preparation and verification, not proof of
+semantic correctness, comparative performance or completed publication.
+
+## Scope and changelog audit
+
+The candidate retains the public v0.98.4 ancestry and the committed implementation
+range through `b84d0d9b8e`. The audit covers index-preserving Git checks, execution
+ownership/shared budgets, protected verified runs and candidate recovery, input
+checkpoint writer restart, static DAG retry, and TUI diagnostics. Tool timeout
+messages now distinguish requested cancellation from observed termination and use
+a monotonic teardown grace period.
+
+Preparation adds release metadata, this audit, and focused verification fixes:
+initial failure-card expansion is applied at construction, execution wrappers
+preserve lazy context-sensitive timeouts, and the commit hook handles changed-file
+status under Husky's errexit mode. Existing dirty provider, retry,
+parallel-frontier, resource-label and TB changes are excluded.
+Their working files are preserved, and their pending changelog entries stay out of
+the candidate. Published v0.98.4 and earlier changelog bodies remain unchanged.
+Model catalogs are reused rather than fetched or regenerated. Credentials, private
+agent-home configuration and the user's running TUI are not changed.
+
+## Version and artifact contract
+
+All seven public packages target 0.98.5: `open-multi-agent-kit`, `omk-ai`,
+`omk-agent-core`, `omk-tui`, `omk-protocol`, `omk-adaptorch-wpl` and
+`omk-book-to-skill`. Root/example manifests and locks, internal dependency ranges,
+the book compiler's source version constant, CLI shrinkwrap and README pointers
+are synchronized. External dependency versions and integrity values are unchanged.
+
+The release candidate is selected by path/hunk and inspected as a complete staged
+diff. Verification uses an isolated candidate, not the mixed working tree. Temporary
+homes contain no provider credentials; live inference and benchmarks are not run.
+
+## Observed verification
+
+- The diagnostics implementation passed type checking and 104 focused tests in its
+  staged snapshot. Its canonical installed launcher passed offline 120/80-column
+  inspection, save, failure, reload and quit checks without model prompts.
+- Version preparation passed 13-manifest/root-lock parity, source-version tests,
+  book metadata tests and the canonical `omk --version` check for 0.98.5.
+- The isolated candidate build and `npm run check` exited 0. Module-size and
+  import-cycle baselines were not raised.
+- The final full offline run exited 0: 8,181 passed, 837 environment/live-condition
+  skips, no failures. Package passes were WPL 149, agent 870, AI 631, book compiler
+  22, coding-agent 5,653, protocol 126 and TUI 730. Vitest workers were bounded at
+  four; the TUI package used its Node test runner.
+- Seven-package npm pack dry runs and release-surface checks passed. They checked
+  package version/file metadata without publication or lifecycle scripts.
+- Gitleaks found no leaks in the staged changes or the six implementation commits
+  since v0.98.4. Reports were redacted; this is not clearance for private histories
+  outside that range.
+
+## Verification repairs
+
+The isolated candidate exposed a two-line module-size overrun that the mixed tree
+hid. Passing initial expansion to the failure-card constructor avoids a redundant
+rebuild and keeps the existing size baseline; both initial states are tested.
+
+The full suite exposed an execution wrapper spreading a tool's dynamic timeout
+getter into a fixed value. The wrapper now projects tool metadata and forwards
+that getter lazily. Regression checks cover no eager evaluation, timeout changes,
+stale-context rejection and retained execution metadata.
+
+The commit hook had only been tested under plain `sh`, while Husky invokes `sh -e`.
+A changed-file `git diff --quiet` status of 1 therefore stopped valid release
+commits. Capturing that status in an OR-list preserves errexit for real failures;
+all six hook fixtures now run under `sh -e`, including changed paths with spaces,
+index preservation and a fatal git-diff error.
+
+An initial test launch resolved to the wrong checkout and was cancelled, not counted
+as candidate evidence. Subsequent launches fix both process cwd and npm prefix.
+An isolated HOME also hid the installed Rust toolchain: explicitly supplying its
+location restored the real cargo diagnostic check without changing the test or
+copying credentials. Neither fixture failure was treated as a product pass.
+
+A source-file fingerprint is not an executed-build attestation. Linux observations
+do not establish behavior on every target platform. CI must validate the exact tag,
+build the six platform archives, run checks/tests, publish all seven npm packages
+and create the GitHub Release. Existing token-based CI authentication is unchanged;
+OIDC/Sigstore provenance is not claimed. Publication is complete only when the main
+tag, GitHub Release and seven npm `latest` values agree.

package/docs/review-bundle-followup.md

@@ -0,0 +1,195 @@
+# 재현 번들 검토 후 적용한 경계 개선
+
+후속 상태는 [0.98.4 릴리스 감사](release-audit-0.98.4.md)를 기준으로 본다.
+아래는 준비 단계의 역사적 기록이며, 커밋 ID도 비공개 문서의 이력 정리 전 로컬 ID다.
+현재의 이력 정리·검증 결과와 혼동하지 않는다.
+
+대상 자료: `OMK_Review_Reproduction_Bundle_2026-09-09.zip`.
+ZIP SHA-256: `aa90e09d04b5802ca2e8343f2666887822eca7e3ab474309835117e85bcd63d8`.
+14개 member의 경로·크기·링크 여부와 제공된 checksum 13개를 확인했다.
+이 해시는 자료 식별자이며 제삼자 서명이나 안전성 인증은 아니다.
+
+번들 기준은 `dc413cd9bc59be0fcb0267a2442b2d5461b14031`(0.98.3), 현재 작업 시작
+HEAD는 `29624c3962d00cc8355191265e7827d9fdf0f3ad`다. 현재 미커밋 변경도 있으므로
+리뷰 문구를 현재 구현의 사실로 그대로 승격하지 않았다. 확인된 결함부터 별도 회귀로
+고정했고, 번들의 계획을 실행 권한으로 취급하지 않았다.
+
+## 2026-09-10 재검증·커밋 상태
+
+이 절이 아래 9월9일 검사 기록보다 최신이다. 설정·선택 모델·벤치마크는 그대로 두고
+구현을 재검증했다. 공식 문서로 DeepSeek V4.1 Flash의 native DeepSeek,
+OpenCode Go, OpenRouter, Vercel 경로를 확인해 생성기에 반영했다.
+자세한 ID와 가격·wire 한계는 [카탈로그 기록](model-catalog-refresh.md)에 있다.
+
+| 단위 | 재검증 | 구현 커밋 |
+| --- | --- | --- |
+| 기존 모듈 크기6건 해소 | 선언·함수 AST 이동 전후 일치, 직접 회귀195개, LSP16파일 clean | `0ae2b3b29c` |
+| 브라우저 Node 의존성 제거 | 새 bundle 회귀 RED→GREEN, 기존 metadata14개, browser smoke 종료0 | `15059ff28a` |
+| 모델 계약·이미지 투영·종료 | core227개, CLI/SDK43개, Agent/Harness41개 통과 | `e8f27e3d9f` |
+| 모델 목록·thinking | 164개 통과/라이브 등5개 제외, 전체1333모델 중복·상한·가격 불변식 통과 | `267c1f909a` |
+| metrics v2 | 42개 통과 | `bc3b43b5a4` |
+| gate·sandbox 정책 | 56개 통과 | `63fb682fc0` |
+| 공유 DAG·증인 정책 | 24개 통과, 내부 oracle60그래프 | `6e1ccb2e64` |
+| 최신성 상수 명칭 | 정렬 회귀4개 통과, 계산식 불변 | `b9109a91ae` |
+| 기존 서식3건 | 직접 회귀40개 통과 | `bccf660ab0` |
+
+위 표는 겹치는 검사들이 있으므로 합산 테스트 수가 아니다. 각 커밋은 명시한 경로/hunk만
+stage했고, pre-commit 검사를 우회하지 않았다. 훅이 파일 전체를 다시 stage하는 경우
+이번 단위 밖 hunk를 일시 격리한 뒤 복원했으며, 커밋 tree가 검토한 index와 같은지 확인했다.
+이전 retry·Codex SSE timeout·TB 선택기/감사 변경은 미커밋 상태로 보존했다.
+
+최종 `npm run build`, `npm run check`, `git diff --check`는 종료0이다.
+빌드한 카탈로그에서도 네 Flash 경로와 off/low/high/max를 확인했다.
+`lens_diagnostics(mode=all)`의 error 결과는 0이다. 수동 TUI 재시작·실제 추론·과금과
+전체 라이브 suite는 실행하지 않았다. 검증용 CLI의 버전은 아직 **0.98.1**이다.
+
+### 배포 보류: 이력 통합과 범위 확인 필요
+
+GitHub 최신 release와 npm 일곱 package의 latest는 모두 **0.98.3**이다.
+하지만 해당 tag는 이 로컬 HEAD의 조상이 아니며, 작업 시작 시 로컬/원격 main이
+26/11커밋으로 갈라져 있었다. 읽기 전용 merge 미리보기에서 문서·changelog·spec
+7개 경로의 충돌도 확인했다. 기존 release를 덮어쓰거나 force-push하지 않는다.
+
+따라서 `node scripts/check-release-consistency.mjs --release`는 종료1이다.
+일반 check 통과를 release 승인으로 해석하지 않는다. 기존0.98.3 이력을 통합하고
+배포에 포함할 로컬 커밋 범위를 확인한 뒤 **0.98.4**로 patch bump해야 한다.
+병합·origin/main 및 v0.98.4 push·태그 게시 범위 확인을 요청했으며, 현재는 버전 변경,
+태그 생성, push, GitHub Release, npm publish를 실행하지 않았다.
+
+## 1. 적용한 변경
+
+| 지적 | 현재 코드에서 확인한 결과 | 적용 |
+| --- | --- | --- |
+| F01/F02/F03 | 공유 DAG에서 지역 최소 cut을 합치면 전역 최소도 포함 최소도 아님 | bounded antichain 설명, 명시적 optimality, 복잡도 설명 교정 |
+| 4.7의 추가 위험 | 부모 자체 반례가 있어도 child만 수리 대상으로 반환 | local/children 원인을 구분하고 부모 의무도 설명에 보존 |
+| F07 | `exp(-age/h)`의 h를 half-life라고 명명 | e-folding time constant로만 개명. 수치·점수·선택 정책은 그대로 |
+| F09 | 다른 observation ID만으로 독립 증인 수 증가 | 선택형 `explicit-groups` 정책과 결과의 정책 표시 |
+| F10/F11 | 오류를 200자로 자르고 입력을 spread해 원문·추가 필드·toJSON이 저장될 수 있음 | metrics v2 허용 목록, 오류 분류만 저장, 전체 중첩 값·파생 counter 검증 |
+| F12 | 빈·희소 gate 배열 또는 호출자 배열 변경 뒤 `open` | 생성자 거부·배열 snapshot. 빈 결과 결합도 거부 |
+| F20 | 명시적 허용 없이 enforce→audit/off 또는 filesystem root 확대 | 더 약한 mode·더 넓은 root를 채택하지 않음. 명시적 allowBroaden 경로 유지 |
+
+추가로 `TaskContractBuilder.fromJSON()`의 문법 오류가 입력 일부를 메시지에 넣는
+동작을 재현했다. 잘못된 JSON은 계속 `SyntaxError`로 거부하되 원문을 포함하지 않는다.
+오류를 삼키거나 잘못된 계약을 허용하는 수정은 아니다.
+
+## 2. Claim Graph: 설명과 진실 판정을 분리
+
+현재 `claim-blocking-cut.ts`의 수정 전 Git blob은 번들의 추출본과 같은
+`1d5d1a1f229b7439ff940fc3d1abbe0c988e3fa4`였다. 검토한 Node 재현 스크립트로
+다음을 실제 확인했다.
+
+```text
+all(any(a,z), any(b,z)): 기존 [a,b], 최소 [z]
+all(any(a,z), z):        기존 [a,z], 최소 [z]
+```
+
+새 `explainBlockingCut()`은 비지배 수리 집합을 유지해 공유 노드를 고려한다.
+완주하면 `optimality: minimum`, 후보 family 128개 또는 탐색 operation 65,536개
+상한에 걸리면 deterministic greedy와 `optimality: not-proven`, `truncated: true`를
+반환한다. 상한은 탐색 규모 제한이지 절대 wall-clock 제한이 아니다. fallback은
+cardinality minimum이나 inclusion minimum을 보장하지 않는다.
+
+이 결과는 현재 평가 snapshot의 **수리 의무 모델**에서의 설명이다. 실제 수정 후의
+정확성, 비용 최적성, 승인·merge 권한이 아니다. `minimalBlockingCut` 배열은 호환용으로
+유지하고, 최소성이 필요한 소비자는 `blockingCut` metadata를 사용한다.
+부모 자체 위반·scope 의무는 `localClaimIds`에 나타난다. unresolved effect와 전체
+workspace completeness는 기존 verdict 경계에 남는다.
+
+새 strict witness 정책은 `witnessIndependence: "explicit-groups"`로 선택한다.
+`requiredWitnesses > 1`에서는 nonempty `independenceGroup`만 집계한다. 독립성이
+불명인 관측이 하나의 named group을 보충하거나, ID만 바꿔 quorum을 채우지 못한다.
+기본값은 기존 `legacy-observation-id`이며 결과에 사용한 정책이 기록된다.
+그룹이 정말 독립인지는 실행·영수증 경계에서 인증해야 한다. 이 함수가 임의 문자열을
+실제 독립 실행의 증명으로 만들어 주는 것은 아니다.
+
+자세한 공개 계약은 [protocol README](../../protocol/README.md)에 있다.
+
+## 3. Metrics v2와 호환성
+
+`turn-metrics-record.ts`가 입력/파일 검증과 명시적 projection을 소유한다.
+`turn-metrics.ts`는 sink와 집계만 담당한다. 새 기록은 root/usage/tool/cache의 알려진
+필드만 구성하고 raw error 대신 `timeout/aborted/permission/not_found/invalid_input/unknown`
+분류를 저장한다. 오류 분류는 진단 metadata이지 재시도나 권한 결정 신호가 아니다.
+
+기존 v1 기록은 검증해서 집계하며, 원래 파일은 수정하거나 삭제하지 않는다.
+기존 파일에 이미 들어간 민감값은 별도 검토 대상이다. 식별자 자체도 익명화하지 않는다.
+잘못된 수치·중첩 값·파생 counter는 malformed로 집계한다. 새 입력이 잘못됐거나
+한 record가 파일 상한보다 크면 sink는 dropped counter를 올리고 false를 반환한다.
+agent 실행은 metrics 실패 때문에 중단하지 않는다.
+
+전체 파일 읽기·동시 writer·rotation 경쟁까지 해결한 것은 아니다. 원장의 세그먼트화나
+비동기 writer는 실제 병목과 crash matrix를 확보한 다음 단위다.
+[metrics 계약](metrics.md)을 함께 참조한다.
+
+## 4. 나머지 지적의 현재 처리
+
+| 지적 | 상태와 다음 수용 기준 |
+| --- | --- |
+| F04/F05, level/chunk barrier | 보류. 최종 인수 재계획·충돌 잠금·취소·결과 순서를 보존하는 replay와 실제 critical-path 측정이 선행 |
+| F06, 표현 비용과 효용 | 보류. F07 이름만 수정했으며 선택 점수는 바꾸지 않음. 표현별 작은 exhaustive oracle과 문맥 손실 평가 필요 |
+| F08, flat 관측의 존재 의미 | 현재 `evaluateCondition`에서 존재 양화를 확인. v1 의미를 조용히 최종 상태 의미로 바꾸지 않음. snapshot-bound adapter를 별도 설계해야 함 |
+| F09의 원천 인증 | 부분 적용. strict grouping은 구현했지만 receipt/run에서 그룹을 인증·파생하는 adapter는 미구현 |
+| F13/F14, 원장 전체 재검사·동기 대기 | 이번 미재현·미변경. append/lock 시간·fsync 비용을 측정한 뒤 보장 유지 여부로 판단 |
+| F15, lane child cancellation | 이번 미재현·미변경. child 시작/종료·abort·permit 반환 통합 검사를 통과하기 전 기본 활성화하지 않음 |
+| F16/F17, WPL timeout·실패 재발 | 이번 미재현·미변경. 상위 deadline과 실제 underlying 취소, 같은 failure signature 이력의 회귀 필요 |
+| F18, 중복 settlement | 이번 미재현·미변경. delta counter를 바로 교체하지 않고 ID 기반 등록/종료와 모든 생산자 연결 검사 필요 |
+| F19, 제공자 오류 의미 | 이전 작업에서 core model-contract 거부를 configuration으로 분리. 전체 제공자 typed-error 전환이나 정책 변경을 완료한 것은 아님 |
+| F20의 전체 권한 집합 | mode/root 반례를 수정. 모든 도메인·프로파일·OS enforcement 조합의 보편적 안전성 증명은 아님 |
+
+검토 문서의 18개 PR 제안을 모두 구현했다는 뜻이 아니다. 새 오케스트레이터·학습형
+라우터·기본 다중 agent·새 DB를 추가하지 않았다. 설정·모델·WSL을 바꾸거나 유료 모델,
+벤치마크, 배포를 실행하지도 않았다.
+
+## 5. 검증 증거
+
+- 번들 원본 재현 스크립트: Node 24에서 종료0, 원본의 잘못된 두 결과 확인.
+  번들 Python 참조 알고리즘은 실행하거나 제품 코드로 복사하지 않았다.
+- 기존 범위 baseline 58개 통과 후, gate/sandbox 7개·metrics 17개·claim 4개 요구를
+  RED로 재현했다. 독립성 정책 2개, JSON 오류 노출 1개, record 크기 1개도 별도 RED 후 수정했다.
+- claim exhaustive oracle는 독립 Boolean evaluator로 60개 작은 공유 DAG를 비교했다.
+  처음 oracle에서 빠졌던 미참조 required root를 바로잡은 뒤 유효한 RED를 다시 확인했다.
+- bounded fallback, graph/child permutation, 부모 자체 반례, strict/legacy witness 정책,
+  v1/v2 metrics, 실제 파일 sink, 실제 gate receipt와 sandbox spawn 경로를 표적 검사했다.
+- 성능·해결률 향상, 전체 저장소 무결성, 운영 사고 부재를 이 검사로 주장하지 않는다.
+
+```bash
+# packages/protocol
+node ../../node_modules/vitest/dist/cli.js --run test/claim-cut-review.test.ts test/claims.test.ts --maxWorkers=1 --no-file-parallelism
+# packages/coding-agent
+node ../../node_modules/vitest/dist/cli.js --run test/turn-metrics-boundary.test.ts test/turn-metrics.test.ts test/review-policy-boundaries.test.ts test/evidence-system.test.ts test/evidence-gate-binding.test.ts test/sandbox-default-policy.test.ts test/context-budget-v2-knapsack-order.test.ts --maxWorkers=1 --no-file-parallelism
+# root
+node_modules/.bin/tsgo --noEmit --pretty false
+npm run check
+```
+
+### 2026-09-09 검사 상태 (당시 기록)
+
+| 검사 | 결과 |
+| --- | --- |
+| Protocol 회귀 | 24개 통과 |
+| Metrics·gate·sandbox·문맥 정렬 회귀 | 102개 통과 |
+| 기존 서식 3건 정리 후 직접 회귀 | 추가 40개 통과. 반복한 11개는 중복 합산하지 않음 |
+| 합계 | 166개, 공급자 없는 표적 검사. 내부 생성 graph 수는 별도 테스트 수로 세지 않음 |
+| 전체 `tsgo --noEmit --pretty false` | 종료0 |
+| 주 LSP | 17파일 요청, 15파일 clean, 2파일 확인 불가, 보고된 오류0. compiler 통과와 구분 |
+| import-cycle·private-home·diff 검사 | 종료0 |
+| `npm run check` | Biome·pinned deps·vendoring·TS imports·dependency tree·import cycles 단계 통과 후 기존 module-size 초과6건에서 종료1 |
+| 문서 링크 검사 | 이전 작업의 미추적 model-contract/model-catalog-refresh 문서 링크5건으로 종료1 |
+
+모듈 크기 차단은 기존 `harness/reverse-skill.ts`, AI `types.ts`, coding-agent의
+`compaction.ts`, `model-registry.ts`, `provider-usage.ts`, `interactive-mode.ts`다.
+이번 단위가 추가했던 evidence-system 크기 증가와 sandbox 타입 순환은 책임·타입 분리로
+해소했으며 baseline을 늘리지 않았다. 전체 저장소 gate 통과나 배포 가능 상태를 주장하지 않는다.
+
+## 6. 커밋 체크포인트
+
+| 단위 | 파일 범위 | 제안 메시지 |
+| --- | --- | --- |
+| Metrics 개인정보·입력 경계 | `core/turn-metrics*.ts`, 직접 metrics 테스트, metrics 문서 | `fix: metrics 원문 누출 차단과 v2 입력 검증` |
+| 검증·sandbox 구성 | `guardrails/evidence-system.ts`, `merge-gate-result.ts`, `core/sandbox/policy*.ts`, 직접 경계 검사 | `fix: 빈 gate와 sandbox 정책 확대를 거부` |
+| Claim 설명·strict witness | protocol claims/index와 직접 회귀, protocol README | `fix: 공유 DAG repair 설명과 증인 독립성 계약 보정` |
+| 명칭 정정 | `context-budget-v2-scoring.ts`의 상수·지역 변수 이름 | `refactor: 최신성 계수의 time-constant 의미 명시` |
+| 기존 서식 정리 | AI `utils/oauth/meta.ts`의 named import 순서, `test/mcp/tools.test.ts`와 `test/session-termination.test.ts`의 줄바꿈 | `style: 통합 검사를 막던 기존 서식 오류 정리` |
+
+9월9일에는 구현과 직접 테스트·문서를 위 단위로 제안하고 stage/commit하지 않았다.
+9월10일 승인 후 수행한 실제 커밋·검사와 배포 보류 조건은 이 문서 위쪽 표에 기록한다.

package/docs/run-protocol.md

@@ -6,7 +6,7 @@ The OMK Run Protocol defines one versioned contract for task execution and evalu
 TaskSpec -> ExecutionAttempt -> Observation -> EvaluationResult -> RuntimeDecision
 ```
 
-`omk-protocol` owns these records and the pure reducers that connect them. Tool execution, persistence, scheduling, routing, and topology remain outside the package.
+`omk-protocol` owns these records and the pure reducers that connect them. Tool execution, persistence, runtime scheduling, routing, and topology selection remain outside the package.
 
 ## Implemented scope
 
@@ -24,6 +24,38 @@ The first v1 slice is available under `packages/protocol` with schema version `o
 
 Every top-level record carries `schemaVersion`. Parsers reject unsupported versions, malformed timestamps, duplicate claim IDs, invalid JSON facts, and empty logical conditions.
 
+## Isolated command-run profile
+
+`RunContract` and `RunStartCommand` add strict, immutable parsers for the opt-in
+`linux-command-v1` and `linux-scripted-agent-v1` profiles. They pin the input digest,
+write scope, commands, stdout assertions and finite phase/snapshot limits. The
+scripted profile also pins 1–16 approved steps and a 1–32 logical request cap for
+an offline AgentSession reference adapter. Unknown authority/provider fields are
+rejected; the host must separately authorize the exact contract digest.
+`RunResumeCommand` / `parseRunResumeCommand()` pin the contract, candidate and exact
+expected revision/generation. The host may acquire at most three generations under
+`MAX_VERIFIED_RUN_GENERATIONS`; a resume command does not authorize replay of a writer.
+The separate `RunWriterRestartCommand` / `parseRunWriterRestartCommand()` binds
+`baseDigest` to a durable input checkpoint for an explicit local writer restart.
+Recovery commands share command IDs and the generation cap; none resets budgets.
+
+`linux-command-dag-v1` adds `RunDagWriter` / `RunDagTask` with 1–16 nodes, explicit
+artifact dependencies, disjoint write scopes and 1–2 preapproved command attempts per
+node. `orderRunDag()` provides deterministic FIFO topological order and
+`runDagAncestors()` includes the full transitive input closure. `RunTaskRetryCommand`
+/ `parseRunTaskRetryCommand()` pins a task selection to the original input and exact
+run revision/generation. These pure contracts never authorize dispatch or authenticate
+cached output; the Coordinator checks stored material and records adoption before reuse.
+
+The coding-agent's `RunCoordinator` owns execution and its separate v2 journal.
+It binds native v3 receipt cores to the candidate through a supervisor attestation,
+then supplies authenticated checks to the existing claim-closure reducer.
+This does not replace the task/attempt/evaluation contracts or add execution to
+this package. See [Verified Run](verified-run.md) for the implemented CLI/SDK
+path, candidate recovery and checkpoint-based local writer restart, plus the
+serial command DAG and selective retry, plus remaining live-model, parallel frontier,
+plan amendment and control-surface work.
+
 ## Durable goal lifecycle
 
 A durable goal is working-directory state, not a session-file field or a `TaskSpec`. `/goal <objective>` creates or edits `.omk/goals/current.json`; `/goal` without arguments shows its status and round count.

package/docs/runtime-algorithms.md

@@ -1,5 +1,31 @@
 # Runtime Algorithms and Direction
 
+## Working-tree shared run budgets
+
+The SDK `prompt(..., { runBudget })` path now shares a monotonic deadline and
+logical request/concurrency limits across the active prompt's main stream,
+retries, continuations, and first-party summaries using that stream. Exhaustion
+is a non-retryable `budget_exhausted` termination; snapshots keep outstanding
+streams until terminal metadata arrives. No request/time budget is imposed by
+default. Preflight is now owned even for unbounded prompts; unresolved streams
+block a later prompt instead of being discarded when their budget scope closes.
+See [Shared run budgets](sdk.md#shared-run-budgets-sdk-opt-in) for units, zero
+semantics, cancellation, and uncovered paths. This is not billing enforcement,
+a persisted budget, or a hard process-termination deadline.
+
+## Working-tree execution ownership (2026-09-10)
+
+The live session now retains registered tool-promise ownership after timeout or
+abort, defers prompt settlement/resource-lease release until actual termination,
+and rejects overlapping prompt admission. Shared permits capture request values,
+honor zero capacity, and wake FIFO followers after head cancellation/expiry.
+The internal lane launcher forwards cancellation and respects zero/heavy caps.
+Independent bash calls now own separate cancellation controllers, and one call's
+completion cannot hide another active call. Core teardown waits use a monotonic
+clock, preserving the existing grace interval across wall-clock changes.
+See [Prompt settlement](sdk.md#prompt-settlement) for tests, compatibility, and
+uncovered paths. These changes do not implement a durable verified-run product.
+
 ## v0.98.3 release delta (2026-09-06)
 
 The explicit advisory SDK requires normal first-party model completion, honors cancellation,
@@ -128,6 +154,17 @@ Evidence:
 - `packages/coding-agent/test/context-budget-selection-policy-version.test.ts`
 - `packages/coding-agent/test/context-budget-cache-disk.test.ts`
 
+**Working tree:** non-queued native `xai` requests started through `AgentSession.prompt()` now derive a bounded automatic skill grant from live discovered descriptions after ordinary prompt-template expansion. The selector scores task text separately from camelCase-aware path-to-skill-name signals, excludes explicit-only skills, caps automatic matches at three, and adds `headroom` only under lexical or measured context pressure. `AgentSession.prompt()` merges the result with settings/SDK/bang selections only for that request. Queued steering/follow-up messages reuse the active run's system prompt and do not trigger another selection pass.
+
+Evidence:
+
+- `packages/coding-agent/src/core/active-skill-state.ts`
+- `packages/coding-agent/src/core/skill-selector.ts`
+- `packages/coding-agent/src/core/grok-harness.ts`
+- `packages/coding-agent/src/core/agent-session.ts`
+- `packages/coding-agent/test/grok-active-skills.test.ts`
+- `packages/coding-agent/test/skill-selector.property.test.ts`
+
 **Working tree:** context files now treat their global/local relevance baseline
 as a floor. Lexical overlap can raise that score but cannot demote standing
 instructions below the no-query baseline. Skills remain topic-scored because
@@ -272,6 +309,14 @@ Evidence:
 - `packages/coding-agent/src/core/advisory-judge.ts`
 - `packages/coding-agent/test/advisory-judge.test.ts`
 
+**Working tree (2026-09-05):** the first-party `createModelAdvisoryJudge()` adapter rejects non-normal
+or missing completion metadata. Custom judges still supply raw score JSON and own that metadata
+boundary. The chooser checks cancellation around asynchronous work, reports top-score ties as
+caller-rank decisions, and retains submitted/eligible/excluded counts with comparison availability.
+This adds no completion calls or retries, automatic AgentSession/TUI call, or semantic-verdict authority.
+Details: [Advisory selection integrity](advisory-selection.md); governing spec:
+`specs/021-advisory-selection-integrity/spec.md`.
+
 See [Run Protocol and Durable Goals](run-protocol.md),
 [Sessions](sessions.md), [Provider Resilience](provider-resilience.md), and
 [Turn Metrics](metrics.md).