open-multi-agent-kit 0.98.5 → 1.0.0

package/docs/models.md

@@ -233,7 +233,7 @@ Current behavior:
 
 ### Thinking Level Map
 
-Use `thinkingLevelMap` on a model to describe model-specific thinking controls. `models.json` accepts `off`, `minimal`, `low`, `medium`, `high`, `xhigh`, and `max`. Built-in metadata can also expose the `ultra` CLI tier, but the current `models.json` schema has no `ultra` key.
+Use `thinkingLevelMap` on a model to describe model-specific thinking controls. `models.json` accepts `off`, `minimal`, `low`, `medium`, `high`, `xhigh`, and `max`. Built-in metadata can also expose the `ultra` CLI tier (GPT-6 Astra maps it to documented `max`; GPT-5.6 Sol/Terra/MoA on Codex map it to backend `xhigh`), but the current `models.json` schema has no `ultra` key.
 
 | Value | Meaning |
 | --- | --- |

package/docs/neo.md

@@ -0,0 +1,134 @@
+# Neo public skills and computer-use setup
+
+Status: locally integrated and built on 2026-09-17, not a published release. Neo names the public computer-use workflow in this change; it is not a new model or an independent agent runtime.
+
+## What changes
+
+The normal `DefaultResourceLoader` now reads six publicly authored skills from `resources/neo/skills` inside the installed package. No private agent-home content is copied. Explicit, project and user skills retain ownership of matching names; bundled skills fill only missing names. `noSkills` disables automatic bundled loading while preserving explicitly supplied skills, and `OMK_BUNDLED_SKILLS=0` disables just the bundled set. Skill overrides continue to run after resource loading.
+
+Both the npm package allowlist and the two binary asset paths include the same `resources` tree. Files remain inside the installation; startup does not write skills into the user's home. A missing bundle produces a loader diagnostic, and `omk neo list` returns a nonzero exit code if one of its required skill files is missing.
+
+| Default skill | Purpose |
+| --- | --- |
+| `omk-computeruse` | Neo target/capability routing and observe, act, verify workflow |
+| `omk-browser` | DOM/accessibility interaction, bounded retries and side-effect approval |
+| `omk-site` | Existing-project site implementation, preview and responsive validation |
+| `omk-research` | Version-aware primary documentation and evidence handling |
+| `omk-code-review` | Minimal changes, real regression checks and live-call-path review |
+| `omk-mcp-setup` | Inventory, configuration preview, explicit setup and health verification |
+
+These instructions are available independently of the selected model family. Tool calling must actually work. Image interpretation additionally requires compatible model and provider input support. Text-only models should use DOM/accessibility observations. This change does not establish Astra-equivalent performance, add a native desktop driver, or turn an incapable model into a computer-use model.
+
+## Skills and MCPs are different products
+
+| Quantity | Meaning |
+| --- | --- |
+| Packaged skill | Instruction file is present in the installation |
+| Loaded skill | Resource loader admitted the file after overrides and disable settings |
+| Offered MCP | Public configuration preset is available |
+| Configured MCP | User selected a server in a configuration file |
+| Connected MCP | The running process completed its connection/handshake |
+| Verified tool | A discovered tool succeeded against the intended target |
+
+`omk neo list` reports packaged files and offered presets. It deliberately returns `connected: null` and `connectionStatus: "not_probed"`; it does not manufacture a nonzero MCP connection count. The normal session MCP status remains the connection authority.
+
+## Curated MCP choices
+
+| Preset | Distribution | Activation | Scope |
+| --- | --- | --- | --- |
+| `playwright` | Pinned stdio recipe for `@playwright/mcp@0.0.81` | Explicit user setup | Browser actions and accessibility snapshots; compatible browser required |
+| `context7` | Pinned stdio recipe for `@upstash/context7-mcp@4.1.1` | Explicit user setup | External technical documentation queries |
+| Native CUA/desktop driver | Not installed or configured by this change | Separate reviewed setup | Host permissions and host identity must be verified |
+| Chrome personal-profile attachment | Not enabled by default | Separate explicit session approval | May expose existing authenticated state |
+| Stagehand and Browserbase cloud | Not installed or configured by this change | Separate dependency, credentials and cost approval | Optional local library or cloud browser |
+| Account-connected repository/services | Not configured by this change | Per-user authentication and scope approval | No publisher credential is shared |
+
+The recipes pin the direct package version, not an entire third-party transitive dependency graph. They do not bundle executables or browser binaries. Installation and tool behavior still need to be tested on the target platform. No remote HTTP URL is advertised as directly loadable by the current stdio-only OMK loader.
+
+## Commands
+
+```bash
+omk neo list
+omk neo setup playwright context7
+omk neo mcp-config playwright context7
+```
+
+All three are local and do not start a process, download a server or connect a browser. `setup` without `--apply` is a dry run. `mcp-config` emits disabled entries only. Existing configuration is never printed.
+
+After approving the exact target and the server execution/network effects:
+
+```bash
+# Project-local, in the intended project directory:
+omk neo setup playwright context7 --apply
+
+# Alternative: explicitly select the global configuration target:
+omk neo setup playwright context7 --global --apply
+```
+
+Project target: `<cwd>/.omk/mcp.json`. Global target: `~/.omk/mcp.json`, not `~/.omk/agent/mcp.json`. On the next ordinary OMK startup `npx` may download and execute the selected pinned servers. The command itself only creates configuration and reports `configured_not_connected`. A project entry can override a global entry with the same server name.
+
+Setup is intentionally no-overwrite. It validates all presets before filesystem changes, writes a complete temporary file with mode `0600` and publishes it through an atomic no-replace hard link. An existing target, including malformed data or a symlink, is preserved. A symlinked `.omk` directory is rejected. Filesystems that do not support hard links fail closed. This is not a defense against a hostile process concurrently replacing an ancestor directory; use a trusted user-owned configuration location. Windows ACL and power-loss durability guarantees are outside this implementation.
+
+For an existing configuration, generate disabled entries with `mcp-config`, then review a manual merge without exposing secrets. Do not replace the file to work around the refusal. This change does not alter legacy MCP config precedence or overwrite any account settings.
+
+## Browser safety and capability
+
+The Playwright recipe requests `--headless --isolated --sandbox` and bounded action/navigation timeouts. It does not attach to a personal browser, disable TLS checks or request unrestricted file access. The upstream Linux bundled-browser default can disable its sandbox; the explicit positive flag is therefore intentional. A sandbox launch failure must be diagnosed rather than bypassed.
+
+Profile isolation is not OS or network isolation. Origin allowlists are not complete redirect or SSRF boundaries. Operator-managed process/network isolation is required for stronger threat models. The workflow rejects instruction authority from pages, tool output and server descriptions. Skills guide the model; they do not independently enforce every permission boundary in the runtime.
+
+After configuration, restart the intended OMK process, inspect the actual connection status and tool roster, and perform a read-only health check. Then use an observation before each action and verify the final requested state. A timeout is not permission to repeat a non-idempotent operation. Native desktop, paid cloud and private-account actions remain separate opt-ins.
+
+## Verification and release gates
+
+Harness impact: `advance` for distributable capability discovery; `preserve` for existing skill precedence, disable behavior and configuration ownership. Baseline is `739bc6f3b6fe1c89bfe058aad7ec17ad252fb10e` (`0.99.0`).
+
+Acceptance: six valid files in the npm and each platform bundle; six default skills in an empty agent/project environment; zero writes on list/dry run; byte-identical preservation of existing MCP config; no false connected count. No performance superiority claim is made.
+
+```bash
+node --experimental-strip-types --test scripts/test/neo-distribution.test.mjs
+cd packages/coding-agent
+node ../../node_modules/vitest/dist/cli.js --run test/neo-distribution.test.ts
+cd ../..
+npm run check
+npm run build
+```
+
+The Node test covers actual catalog/CLI/setup functions, file preservation, symlinks and asset inclusion declarations. The Vitest test additionally exercises the real skill loader and `DefaultResourceLoader`; it requires the repository dependencies and a buildable base. Source inspection of binary copy commands is not a built-binary smoke test. Each final archive must be extracted and `omk neo list` checked before release.
+
+Before publishing, run the targeted tests and complete repository gates, verify a clean npm install and real MCP/browser smoke tests, then follow the existing lockstep release procedure. A green test for a leaf module cannot override a failed monorepo build. Do not tag/publish this candidate until all release surfaces agree and blockers are resolved.
+
+## Local installation verification, 2026-09-17
+
+Integrated the candidate onto `887152bc5d`. `npm run build` and `tsgo --noEmit`
+passed. Standalone source tests passed 13 checks; Neo, resource-loader and SDK skill
+Vitest suites passed 39 tests. The Neo fixture isolates HOME and the agent directory
+so personal skills cannot contaminate its six-skill assertion.
+
+The existing local launcher resolves this checkout's `dist/cli.js`; its `neo list`
+reported all six packaged skills. The built resource loader also selected six skills
+in a clean environment. `npm pack --ignore-scripts --dry-run --json` included all six.
+Run `node --test scripts/test/neo-built-cli.test.mjs` after building for subprocess
+checks of list, write-free preview, apply and no-replace behavior.
+
+No live MCP configuration was created or overwritten. The existing Playwright
+connection answered a tab-list request and opened/closed a task-owned blank tab;
+this does not verify the candidate preset's browser or sandbox flags. Existing
+Context7 returned an invalid API-key error, so documentation retrieval is blocked.
+No credentials were changed and no native desktop driver was installed.
+
+Full `npm run check` stopped at pre-existing module-size failures in `agent-session.ts`
+and `model-registry.ts`. The documentation link guard also rejects the new untracked
+`neo.md` until it is included in Git; no files were staged to bypass that gate.
+Release-surface and shrinkwrap checks passed. Platform archives, clean dependency
+installation, all-suite tests and published release verification remain unrun.
+Restart OMK to load rebuilt code; changing source does not update an active process.
+
+## Primary source check, 2026-09-16
+
+- Playwright MCP release `v0.0.81`: https://github.com/microsoft/playwright-mcp/releases/tag/v0.0.81
+- Exact documented flags: https://github.com/microsoft/playwright-mcp/blob/v0.0.81/README.md
+- Context7 release `@upstash/context7-mcp@4.1.1`: https://github.com/upstash/context7/releases/tag/%40upstash/context7-mcp%404.1.1
+- Context7 stdio CLI: https://github.com/upstash/context7/blob/master/packages/mcp/src/index.ts
+
+Upstream source/release inspection is not an installed-server integration test. Credentials, provider quality and target-host permissions are not verified by this document.

package/docs/providers.md

@@ -19,12 +19,13 @@ Use `/login` in interactive mode, then select a provider:
 - Claude Pro/Max
 - GitHub Copilot
 - xAI Grok subscription OAuth
+- Devin CLI subscription (SWE-2)
 
 Run `/login` and choose a configured subscription provider to open its account picker. Select an existing account by its ChatGPT, Claude, or Google email when available, or choose **Add another account** to sign in with a new one. OMK keeps and refreshes each account independently, pins the provider to the account you select, and does not silently fail over to another subscription. `/model` remains dedicated to model selection.
 
 Use `/logout` to clear all stored accounts for a provider. Tokens are stored in `~/.omk/agent/auth.json` and auto-refresh when expired.
 
-When the status sidebar is pinned, its **USAGE** section lists every configured subscription provider, with the active provider first. OMK reads quota windows from fixed provider endpoints for Codex, Claude, Kimi Code, GLM/ZAI Coding Plan, and native xAI SuperGrok, caches the result, and displays each percentage and reset countdown separately. Claude also passively merges the official `anthropic-ratelimit-unified-*` response headers used by Claude Code. If Anthropic's usage endpoint is rate limited and no complete recent snapshot exists, OMK mirrors Claude Code's own startup quota check with one fixed-endpoint Haiku request capped at one output token, no more than once per OAuth credential per hour. This fallback consumes a small amount of Claude plan quota.
+When the status sidebar is pinned, its **USAGE** section lists every configured subscription provider, with the active provider first. OMK reads quota windows from fixed provider endpoints for Codex, Claude, Kimi Code, GLM/ZAI Coding Plan, native xAI SuperGrok, Devin CLI, and Command Code, caches the result, and displays each percentage and reset countdown separately. Claude also passively merges the official `anthropic-ratelimit-unified-*` response headers used by Claude Code. If Anthropic's usage endpoint is rate limited and no complete recent snapshot exists, OMK mirrors Claude Code's own startup quota check with one fixed-endpoint Haiku request capped at one output token, no more than once per OAuth credential per hour. This fallback consumes a small amount of Claude plan quota.
 
 Codex streaming passively merges `x-codex-primary-*`, `x-codex-secondary-*`, and `codex.rate_limits` signals through the non-blocking `StreamOptions.onRateLimit` observer. These signals supplement missing polling windows only when the Codex service returns them; OMK does not infer a missing 5-hour value from a 7-day value.
 
@@ -32,6 +33,8 @@ Alibaba Model Studio Token Plan is recognized as **QWEN TOKEN PLAN** and reads i
 
 With a stored native `xai` OAuth credential, OMK reads `GET https://cli-chat-proxy.grok.com/v1/billing?format=credits` and shows the weekly SuperGrok pool from `config.creditUsagePercent` plus its reset from `config.currentPeriod.end`. `XAI_API_KEY` is a separate API-billing credential and does not authorize this subscription endpoint.
 
+With a configured `commandcode` API key (`models.json` or auth storage), OMK reads `GET https://api.commandcode.ai/alpha/whoami`, then `/alpha/billing/credits`, `/alpha/billing/subscriptions`, and `/alpha/usage/summary` on that same origin. The rail shows the 5-hour and weekly credit windows plus the monthly pool (`spent / remaining+spent`) and the plan name. OMK never sends the key anywhere except `api.commandcode.ai`, never reads browser cookies, and does not scrape Studio.
+
 ### Model Studio DeepSeek V4
 
 Model Studio uses `enable_thinking`, including for DeepSeek. OMK's Chat Completions
@@ -67,6 +70,135 @@ and [plan endpoint separation](https://www.alibabacloud.com/help/en/model-studio
 consulted 2026-09-08. The local tests exercise serialization, not account availability,
 provider compliance, billing, or benchmark performance.
 
+### Devin CLI
+
+Run `/login devin`, select `devin/swe-2`, and use `/think medium`, `/think high`,
+or `/think max`. For a new session after login:
+
+```bash
+omk --provider devin --model swe-2 --thinking max
+```
+
+The default is `medium`. Thinking-off and other levels are unsupported. `max`
+is a reasoning level, not a requirement to buy the Devin Max subscription tier.
+Your account's model access and quota still apply. For presets, effort guidance,
+the 1M-token context budget, and the `devin-harness` loadout, see the
+[Devin SWE-2 harness](devin-harness.md).
+
+The `devin` catalog also carries every other lane `GetCliModelConfigs`
+advertises — each wire UID is its own logical model (`claude-opus-5-high`,
+`gpt-5-6-sol-xhigh`, `gemini-3-8-flash-medium`, `kimi-k3-max`, `glm-5-3-high`,
+`grok-4-6-xhigh`, `deepseek-v4-pro-max`, `swe-1-7`, `inkling-max`, …). Flat
+models pin their declared effort lane, so `/think` is fixed per model; entries
+whose lane is a no-thinking variant report `reasoning: false`. Availability is
+account- and plan-dependent: a lane absent from your catalog fails loudly
+instead of being remapped. Image input is still text-only at the adapter.
+
+```bash
+omk --provider devin --model claude-opus-5-high
+```
+
+**Authentication.** OMK uses the CLI's PKCE flow at
+`app.devin.ai/auth/cli/continue` and `api.devin.ai/auth/cli/token`. Its callback
+binds only to `127.0.0.1:59653`, validates state, and closes after success,
+rejection, cancellation, or a five-minute deadline. If the port is occupied,
+paste the complete callback URL into OMK's local prompt. For remote sessions,
+forward this loopback port to the machine running OMK.
+
+Credentials use the existing protected `auth.json` storage and account picker.
+Expired sessions require `/login devin` again: no refresh endpoint is verified,
+and OMK does not renew the expiry locally. Use `/logout` to remove the stored
+OMK credential. Alternatively, `DEVIN_API_KEY` accepts an already-owned CLI
+session token, **not** a `cog_` REST API key. OMK does not install or invoke the
+Devin agent, read browser cookies, or import another application's credentials.
+
+**Transport and limits.** The Node-only `devin-agent` adapter uses Connect/protobuf
+at the fixed HTTPS origin `https://server.codeium.com`. It exchanges the session
+token for a user JWT and reads `GetCliModelConfigs` before each turn. The logical
+`swe-2` model resolves its effort through the server's SWE-2 family metadata;
+every other catalog model resolves by its own wire UID. OMK never invents a
+`swe-2-max` ID or downgrades an unavailable route. Disabled, internal, and
+ambiguous entries are excluded; fast-lane entries match only when their own UID
+is selected. The family's separate 1M-context entries form
+a second lane that is selected only when the model's local `contextWindow` is
+1,000,000 or more (the bundled default); a smaller budget uses the standard lane.
+
+Text, thinking, tool calls/results, and reported usage enter the normal OMK
+agent loop. Image input and enterprise-origin overrides are unsupported.
+Requests reject redirects. Malformed, oversized, or unterminated streams fail;
+remote error bodies are not copied into diagnostics. SDK `onPayload` receives
+protobuf bytes without credential metadata.
+
+The bundled 1,000,000-token context budget and 16,384-token output cap are
+local defaults, **not published SWE-2 limits**. Output is further capped against
+the authenticated catalog. If the selected lane declares a smaller context window,
+the request fails and names the window; lower `contextWindow` through
+`modelOverrides` in [models.json](models.md#per-model-overrides) rather than
+expecting a silent downgrade. Zero catalog pricing means unpriced subscription
+usage, not free inference. Quota percentages are not inferred.
+
+**Account quota.** With a Devin credential configured, the status rail's USAGE
+section calls `SeatManagementService/GetUserStatus` (session-token metadata, no
+user JWT) and renders the plan's daily and weekly quota meters with reset times.
+Accounts whose plan reports no quota windows show the plan name and credit
+balances instead. The rail mirrors the CLI's `/usage` surface; it never sends
+the session token anywhere except `server.codeium.com`.
+
+**Verification.** Local tests exercise the public stream API, real loopback
+callbacks with mocked token exchange, model selection, and protocol fixtures.
+Live login, catalog compatibility, SWE-2 inference, and billing remain unverified
+without a Devin account. Unauthenticated catalog probes returned HTTP 400.
+Live tests require `DEVIN_API_KEY` and `LIVE_E2E=1` and consume subscription quota.
+
+Sources consulted 2026-09-12 and 2026-09-13: the [SWE-2 announcement](https://cognition.com/blog/swe-2)
+(2026-09-10; CLI availability and medium/high/max; no published context window), [CLI commands](https://docs.devin.ai/cli/reference/commands),
+and the [official manifest](https://static.devin.ai/cli/current/manifest.json)
+(observed identity `3000.10.21`). Protocol fields follow the third-party
+[oh-my-pi snapshot](https://github.com/can1357/oh-my-pi/blob/942383f768c5f2f6a620fcab57326c0f59df623a/packages/catalog/src/discovery/devin-proto.ts),
+not a stable public inference contract; attribution is in `packages/ai/DEVIN-NOTICE`.
+Regenerate only the Devin models, preserving every other catalog entry, with
+`npm --prefix packages/ai run generate-models -- --devin-only`.
+
+### Cursor
+
+Run `/login cursor` (PKCE + polling against `cursor.com`/`api2.cursor.sh`), then
+select a `cursor/*` model. `cursor/default` is the Auto router; sibling slugs
+carry their effort and lane (`-low|medium|high|xhigh|max`, `-thinking-*`,
+`-fast`) in the id, mirroring the CLI's flat list. `CURSOR_API_KEY` accepts an
+already-owned access token instead of the OAuth flow.
+
+```bash
+omk --provider cursor --model default
+```
+
+**Transport and limits.** The Node-only `cursor-agent` adapter runs the
+`agent.v1.AgentService/Run` bidirectional RPC over HTTP/2 at `api2.cursor.sh`
+with Connect-framed protobuf. Each `stream()` call is one `Run`:
+`userMessageAction` for a fresh user turn or `resumeAction` otherwise; history
+is replayed through `conversationState.rootPromptMessagesJson` — SHA256-keyed
+JSON message blobs the server fetches back via the kv channel — and system
+prompts ride `requestContext.rules` in the exec handshake. For OpenAI-family
+sibling slugs the adapter splits the effort into a `reasoning` request
+parameter because the Run endpoint rejects sibling `model_id`s; other ids pass
+through whole. `tokenDelta` frames accumulate output usage; plan-specific
+model availability is enforced server-side (free plans serve Auto only).
+
+Text, thinking, and reported usage enter the normal OMK agent loop; images
+attach through `selectedContext.selectedImages`. Server exec frames that ask
+the client to run tools are answered with the protocol's `throw` failure
+channel — OMK tools are deliberately not advertised inside the provider, so a
+cursor model reports the capability gap instead of bypassing tool governance.
+Wiring exec frames through governed OMK tools is a coding-agent bridge
+feature, not provider scope. Hosted search/fetch permission queries are
+approved; interactive ones are rejected.
+
+The bundled catalog was captured from `GetUsableModels` (2026-09-18; 223
+entries). Regenerate only the Cursor section with
+`npm --prefix packages/ai run generate-models -- --cursor-only`. Protocol
+fields follow the same third-party snapshot attribution as the Devin adapter.
+Live login, plan gating, and quota behavior remain account-dependent; the
+adapter is covered by loopback HTTP/2 protocol tests.
+
 ### OpenAI Codex
 
 - Requires ChatGPT Plus or Pro subscription
@@ -78,6 +210,14 @@ provider compliance, billing, or benchmark performance.
 omk --provider openai-codex --model gpt-5.6-moa --thinking ultra
 ```
 
+### GPT-6 Astra
+
+OpenAI-shaped Astra routes (`openai`, `azure-openai-responses`, `opencode`, `github-copilot`, OpenRouter) expose OMK `ultra` in the selector and send `reasoning.effort: "max"`. Official Astra effort values remain `low`, `medium`, `high`, `xhigh`, and `max`; there is no native `ultra` wire value. ChatGPT/Codex account catalogs may still reject `gpt-6-astra`.
+
+```bash
+omk --provider openai --model gpt-6-astra --thinking ultra
+```
+
 ### Claude Pro/Max
 
 Anthropic subscription auth is active for Claude Pro/Max accounts. Third-party harness usage draws from [extra usage](https://claude.ai/settings/usage) and is billed per token, not against Claude plan limits.
@@ -111,6 +251,8 @@ omk
 | Azure OpenAI Responses | `AZURE_OPENAI_API_KEY` | `azure-openai-responses` |
 | OpenAI | `OPENAI_API_KEY` | `openai` |
 | DeepSeek | `DEEPSEEK_API_KEY` | `deepseek` |
+| Devin CLI session token | `DEVIN_API_KEY` | `devin` |
+| Cursor subscription | `CURSOR_API_KEY` | `cursor` |
 | NVIDIA NIM | `NVIDIA_API_KEY` | `nvidia` |
 | Google Gemini | `GEMINI_API_KEY` | `google` |
 | Mistral | `MISTRAL_API_KEY` | `mistral` |

package/docs/release-audit-0.98.5.md

@@ -76,6 +76,23 @@ An isolated HOME also hid the installed Rust toolchain: explicitly supplying its
 location restored the real cargo diagnostic check without changing the test or
 copying credentials. Neither fixture failure was treated as a product pass.
 
+## CI environment recovery
+
+The first v0.98.5 tag run built the binaries, but its test step could not find
+`/usr/bin/bwrap`. npm publication was not attempted and GitHub Release creation
+was skipped. The default-branch CI workflows now install `bubblewrap` and run an
+unprivileged namespace probe before the suite. Ubuntu 24.04 subsequently refused
+loopback setup inside the namespace. The runtime-test jobs are pinned to Ubuntu
+22.04 LTS, with the same namespace and capability-drop checks. They do not skip
+verified-run tests, disable host security controls or enable a sandbox fallback.
+The older distribution `fd` lacked `--no-require-git`; CI installs the official
+fd 10.4.2 static archive with SHA-256 verification before extraction and probes
+that option before tests. File-search behavior and tests are not weakened.
+
+Recovery dispatches the official workflow from `main` with both `tag` and
+`source_ref` fixed to `v0.98.5`. The release tag and its source commit stay unchanged;
+the existing source/tag equality checks remain mandatory.
+
 A source-file fingerprint is not an executed-build attestation. Linux observations
 do not establish behavior on every target platform. CI must validate the exact tag,
 build the six platform archives, run checks/tests, publish all seven npm packages

package/docs/release-audit-0.99.0.md

@@ -0,0 +1,68 @@
+# Release audit: v0.99.0
+
+기준일: 2026-09-13. 사용자가 배포 준비 결과를 확인한 뒤 즉시 배포를 요청했다.
+이 기록은 후보의 검증 근거이며 GitHub/npm 게시 완료를 미리 선언하지 않는다.
+
+## 범위와 변경 로그
+
+이전 공개 릴리스 `v0.98.5`는 main의 조상이며, 준비 시점의 GitHub Release와 공개 npm
+`latest` 7개도 0.98.5로 일치했다. 원격 `v0.99.0`이 없음을 확인한 뒤 준비했다.
+
+`decee7f157`부터 `ca75f4e5cc`까지의 frontier·Devin·Codex SSE·재시도·TUI·설계 문서와,
+이번에 확정한 `3c7d3b4613`(TB 선택 v2), `b21daf1a76`(TB 감사 v2),
+`003f7b081a`(문서·변경 로그·로컬 캡처 제외)을 포함한다. 마지막 세 단위는 각각
+pre-commit 전체 검사를 통과했고, 선택기 40개·감사기 66개 CLI 검사를 통과했다.
+
+TB 출력 계약 변경은 minor 증가로 처리했다. `selectionVersion: 2`의 nullable 예상
+시간·총량과 `omk-tb21-audit-report-2`의 필수 완료시각을 Breaking Changes에 기록했다.
+입력 manifest는 v1을 유지한다. 이전 버전 changelog 본문은 바꾸지 않았으며 다음
+작업용 `[Unreleased]`는 비워 두었다. 새로운 벤치마크 성능이나 SOTA 우위는 주장하지 않는다.
+
+## 버전·의존성
+
+공개 7개 패키지, root/example manifests, 내부 의존 범위, lockfiles, CLI shrinkwrap,
+book compiler의 `PACKAGE_VERSION`, README 버전 링크와 릴리스 노트를 0.99.0에 맞춘다.
+외부 의존성의 버전·resolved URL·integrity 값은 변경하지 않았다. 모델 카탈로그도
+재생성하지 않았다. 운영자 설정·인증·MCP·스킬 활성 목록은 변경하지 않았다.
+
+첫 `version:minor` 실행은 manifest 증가 뒤 아직 이전 버전을 가리키는 내부 의존성을
+npm 출시일 제한에 대조하다 중단됐다. 버전 증가를 재실행하지 않고, 기존
+`sync-versions.js`와 lockfile/설치 동기화 단계만 이어갔다. 제한을 완화하거나 기존
+태그를 이동하지 않았다. 추가적인 registry 패키지 버전 변경은 없음을 대조했다.
+
+## 관측한 로컬 검증
+
+- 환경: Linux, Node.js 24.19.0, npm 11.14.1.
+- 새 버전의 `npm run build`가 7개 workspace 전체에서 종료 0이었다.
+- `test.sh`를 인증 없는 별도 HOME·최소 환경에서 실행했다. 실제 운영자 auth 파일은
+  건드리지 않았다. `taskset`으로 네 CPU에 제한했고 `LIVE_E2E=0`,
+  `OMK_NO_LOCAL_LLM=1`, `OMK_OFFLINE=1`을 사용했다.
+- 전체 테스트: **8,279 통과, 852 환경·실계정 조건 skip, 실패 0, 종료 0**.
+  WPL 149, agent 870, AI 676, book compiler 22, coding-agent 5,695,
+  protocol 137, TUI 730개가 통과했다. 이 수치는 CI 실행 결과가 아니다.
+- 준비 단계의 TB 106개와 전체 guard 378개 통과를 전체 제품 테스트 수에 다시 더하지 않는다.
+- 최종 후보 확인 중 공유 트리에 Devin 요청 코드·테스트·문서와 그 변경 로그가 별도로
+  바뀐 것을 발견했다. 이 4개 파일의 후속 변경은 제외하고 `003f7b081a`와 릴리스
+  메타데이터만 별도 detached worktree에 옮겼다. 변경 로그의 같은 파일에 섞인 후속
+  항목도 원래 커밋의 본문과 대조해 분리했다. 운영자의 변경·인증은 덮어쓰지 않는다.
+- 격리 후보에서도 전체 테스트 8,279개 통과·852개 조건 skip·실패 0을 재확인했다.
+  공유 트리 실행과 같은 검사를 중복 합산하지 않았다.
+- 격리 후보의 `npm run check`(Node guard 378개 포함), 7개 pack dry-run·공개 entrypoint
+  import, 빌드 CLI의 `--version`·`--help`·`run --help`가 모두 종료 0이었다.
+  모든 pack의 버전은 0.99.0이고, 필수 진입점 누락·비공개 상태 경로는 없었다.
+- 후보 diff의 Gitleaks 검사는 완전 redaction과 기존 규칙으로 종료 0, 탐지 0건이었다.
+- `--release`의 stale-worktree guard는 별도 최종 배포 gate다. 후보를 main에 연결하고
+  이 작업의 임시 체크아웃을 제거한 뒤 기본 checkout에서 실행한다. guard나 이름을
+  바꿔 검사를 피하지 않는다.
+
+## 배포 완료 조건
+
+기존 `build-binaries.yml`의 태그 기반 경로만 사용한다. 로컬 `npm publish`, 인증 변경,
+새로운 실행 권한·모델 호출은 없다. release source와 tag의 동일 SHA 검사를 유지한다.
+후보는 검토한 명시 경로만 stage하고 staged diff 전체를 확인한 뒤 commit·tag·push한다.
+
+공식 workflow가 6개 플랫폼 바이너리 빌드, 검사·테스트, npm 7개 패키지 게시,
+GitHub Release 생성을 완료해야 한다. 최종 판정은 태그의 main 포함,
+GitHub `v0.99.0` Release와 7개 npm `latest`의 일치다. 기존 token 기반 인증을 사용하며
+OIDC/Sigstore provenance는 주장하지 않는다. 실패 시 원인을 확인하고 기존 배포의
+무결성 경계를 유지하며, 완료 전에는 배포 성공이라고 보고하지 않는다.

package/docs/run-protocol.md

@@ -41,7 +41,8 @@ Recovery commands share command IDs and the generation cap; none resets budgets.
 
 `linux-command-dag-v1` adds `RunDagWriter` / `RunDagTask` with 1–16 nodes, explicit
 artifact dependencies, disjoint write scopes and 1–2 preapproved command attempts per
-node. `orderRunDag()` provides deterministic FIFO topological order and
+node. Optional `maxConcurrentTasks` accepts only 1 or 2; omission preserves legacy
+serialization and serial execution. `orderRunDag()` provides deterministic FIFO topological order and
 `runDagAncestors()` includes the full transitive input closure. `RunTaskRetryCommand`
 / `parseRunTaskRetryCommand()` pins a task selection to the original input and exact
 run revision/generation. These pure contracts never authorize dispatch or authenticate
@@ -53,8 +54,8 @@ then supplies authenticated checks to the existing claim-closure reducer.
 This does not replace the task/attempt/evaluation contracts or add execution to
 this package. See [Verified Run](verified-run.md) for the implemented CLI/SDK
 path, candidate recovery and checkpoint-based local writer restart, plus the
-serial command DAG and selective retry, plus remaining live-model, parallel frontier,
-plan amendment and control-surface work.
+bounded command DAG, eager frontier and selective retry, plus remaining live-model,
+verification-edge, plan amendment and control-surface work.
 
 ## Durable goal lifecycle
 

package/docs/run-usage-ledger.md

@@ -0,0 +1,56 @@
+# Run usage ledger
+
+Status: implemented as an in-memory accounting module and explicit operation adapter.
+Not automatically connected to AgentSession, provider HTTP retries, MCP, or child CLI.
+Existing `RunBudget` request/concurrency/deadline behavior is unchanged.
+
+Source: `src/core/run-usage-ledger.ts` and `src/core/run-usage-operation.ts`.
+
+## Contract
+
+- `reserve(attemptId, requestId, reservation)` admits an operation only when reported
+  consumption + held reservation + proposed reservation fits each supplied cap.
+  Retry attempts may share a logical request ID. IDs cannot be reused for attempts.
+- `recordTransport(transportId, attemptId)` records a transport start observed by the
+  caller. An application dispatch does not automatically count as an HTTP attempt.
+- `recordUsage(eventId, attemptId, usage)` accepts one cumulative report per attempt.
+  Identical redelivery is idempotent; changed payloads and second reports are rejected.
+  Reports arriving after settlement or closure still bind to the original attempt.
+- `settle(attemptId)` requires observed operation settlement, not a cancellation request.
+  Unknown usage retains its reservation after settlement and blocks new capped admission.
+- `close()` seals admission and transport starts but retains ownership and reservations.
+- Snapshots distinguish the accounted subtotal from `total: null` when usage is missing.
+  `estimatedUsd` is an estimate in USD, never invoice-confirmed spending. Token figures
+  are caller-normalized reports; the ledger cannot detect provider zero-filled missing usage.
+- Counts and amounts reject negative, non-finite and unsafe arithmetic. Maps are bounded
+  by `maxEntries` (default 10,000); there is no automatic eviction of deduplication state.
+
+`runUsageOperation` reserves before invoking the callback and settles in `finally`.
+The adapter captures the admitted attempt ID before invoking the callback, so later
+input mutation cannot redirect settlement. Usage reporters must still supply the correct
+attempt ID themselves. The callback promise must represent the operation lifetime. Do not pass a timeout race
+that returns before the underlying work settles. No AbortSignal is treated as proof
+of termination. Failed operations still count as requests/attempts.
+
+## Verification and limits
+
+From `packages/coding-agent`:
+
+```sh
+node ../../node_modules/vitest/dist/cli.js run test/run-usage-ledger.test.ts test/run-usage-ownership.test.ts test/run-budget.test.ts test/run-budget-scope.test.ts
+```
+
+The local fixture records main work with two transport retries, continuation, summary,
+and child-labelled work: four logical requests, six transports, eight input tokens.
+These are explicit local adapter events, not real provider, process, or billing evidence.
+Tests cover 6 consumed + 3 reserved + 2 proposed against cap 10, delayed settlement,
+late usage, duplicate/conflicting events, missing usage, bounded input/state, and the
+ownership boundary: denied admission never runs the operation, cancellation retains
+the reservation until observed settlement, and settlement attribution survives caller
+input mutation.
+
+No durable replay/restart support, price-table revision binding, invoice corrections,
+work/verification/cleanup partitioning, or automatic whole-run transport instrumentation
+is provided. Actual usage can exceed its reservation: it is recorded honestly and blocks
+later capped admissions rather than being clipped. This is not a hard financial limit.
+R08 end-to-end product integration remains incomplete.

package/docs/runtime-algorithms.md

@@ -1,5 +1,49 @@
 # Runtime Algorithms and Direction
 
+## Current feature status (audit §19.3)
+
+"Implemented", "wired", "enabled", "verified in CI", "released", and
+"measured benefit" are different gates. A pure function passing unit tests is
+not a live product path, and a live path is not a measured improvement. This
+table records each mechanism's actual gate at the pinned commit; the dated
+baseline below is history, not current truth.
+
+| Mechanism | Implemented | Wired into live path | Enabled by default | Verified in CI | Released | Measured benefit |
+| --- | --- | --- | --- | --- | --- | --- |
+| DAG claim scheduler (`tool-dag-scheduler`) | yes | `agent-loop` frontier executor | `toolScheduler: "dag-v2"` | unit + integration tests | v0.99.x line | not measured |
+| Ready-frontier admission (`runDagFrontier`) | yes | `agent-loop` | same | `tool-dag-ready-frontier`, `tool-dag-hook-replan` tests | working tree | not measured |
+| Dynamic-claim conflict check (`conflictsWithUnsettledClaim`) | yes | `agent-loop` | same | `tool-dag-dependencies` + hook tests | working tree | not measured |
+| ECRAF admission planner (`tool-dag-ecraf`) | yes | **no** — no call path wires it | n/a | unit tests only | unreleased | not measured |
+| Context Budget V2 | yes | system-prompt assembly | opt-in policy | planner/selection/cache tests | working tree | not measured |
+| Tier floor reservation | yes | context-budget-v2 planner | when V2 enabled | `context-budget-v2-tier-floor` tests | working tree | not measured |
+| Reasoning router v4 | yes | `/think auto` lane | opt-in | router tests | released | classification only, not success-probability calibration |
+| Workload permit pool | yes | resource admission | default | pool tests | released | not measured |
+| Provider retry/failover classification | yes | `provider-retry`, `session-failure-cause` | default | resilience/classification tests | released | not measured |
+| MCP descriptor injection screen | yes | `mcp/manager` import path | default | quarantine tests | released | pattern rule score, not calibrated risk |
+| verified-run coordinator + evidence | yes | verified-run paths | opt-in command | coordinator/evidence tests | working tree | scope-limited binding, not general correctness |
+
+Gates are reported per row so a green "implemented" never upgrades itself to
+"released" or "measured".
+
+## ECRAF arithmetic boundary (2026-09-17)
+
+The internal `planEcrafAdmissions()` planner rejects non-finite derived density
+denominators, scores, and reserved usage with `RangeError`, even when each input
+number is finite. Scores are computed once per candidate before sorting or
+calling the conflict predicate; singleton and zero-slot batches receive the same
+validation. A bounded resource overflow still defers the candidate and allows
+later feasible candidates. An unbounded resource has no capacity limit, but its
+usage must remain representable as a finite number. Failed passes return no
+partial admission plan and do not mutate caller input.
+
+Regression coverage is in
+`packages/agent/test/tool-dag-ecraf-arithmetic.test.ts`; existing numeric and
+property tests remain in `packages/agent/test/tool-dag-ecraf.test.ts`.
+This is local pure-planner validation, not live frontier wiring, CI confirmation,
+a release, or evidence of latency/quality improvement. Resource normalization,
+slot-aware ranking, fairness, and equal-budget runtime comparisons remain separate
+work.
+
 ## Working-tree shared run budgets
 
 The SDK `prompt(..., { runBudget })` path now shares a monotonic deadline and
@@ -154,15 +198,18 @@ Evidence:
 - `packages/coding-agent/test/context-budget-selection-policy-version.test.ts`
 - `packages/coding-agent/test/context-budget-cache-disk.test.ts`
 
-**Working tree:** non-queued native `xai` requests started through `AgentSession.prompt()` now derive a bounded automatic skill grant from live discovered descriptions after ordinary prompt-template expansion. The selector scores task text separately from camelCase-aware path-to-skill-name signals, excludes explicit-only skills, caps automatic matches at three, and adds `headroom` only under lexical or measured context pressure. `AgentSession.prompt()` merges the result with settings/SDK/bang selections only for that request. Queued steering/follow-up messages reuse the active run's system prompt and do not trigger another selection pass.
+**Working tree:** non-queued native `xai` and `devin` requests started through `AgentSession.prompt()` now derive a bounded automatic skill grant from live discovered descriptions after ordinary prompt-template expansion. The selector scores task text separately from camelCase-aware path-to-skill-name signals, excludes explicit-only skills, caps automatic matches at three, and adds `headroom` only under lexical or measured context pressure. `AgentSession.prompt()` merges the result with settings/SDK/bang selections only for that request. Queued steering/follow-up messages reuse the active run's system prompt and do not trigger another selection pass.
 
 Evidence:
 
 - `packages/coding-agent/src/core/active-skill-state.ts`
 - `packages/coding-agent/src/core/skill-selector.ts`
+- `packages/coding-agent/src/core/harness-skills.ts`
 - `packages/coding-agent/src/core/grok-harness.ts`
+- `packages/coding-agent/src/core/devin-harness.ts`
 - `packages/coding-agent/src/core/agent-session.ts`
 - `packages/coding-agent/test/grok-active-skills.test.ts`
+- `packages/coding-agent/test/devin-active-skills.test.ts`
 - `packages/coding-agent/test/skill-selector.property.test.ts`
 
 **Working tree:** context files now treat their global/local relevance baseline

package/docs/sdk.md

@@ -161,7 +161,8 @@ for the JSON shape, events, hook restrictions, and uncovered paths.
 `planVerifiedRun()` and `createRunCoordinator()` provide three experimental profiles:
 `linux-command-v1` executes an approved command, `linux-scripted-agent-v1` drives
 approved steps through the real `AgentSession` and the offline Faux adapter, and
-`linux-command-dag-v1` executes a bounded command DAG serially.
+`linux-command-dag-v1` executes a bounded command DAG, serially by default or with
+an explicitly approved `writer.maxConcurrentTasks: 2`.
 Commands run in private sandboxes; native EvidenceReceipt v3 cores and a supervisor
 attestation bind the checked candidate before artifact retrieval.
 
@@ -183,13 +184,16 @@ interrupted tasks. `RunTaskRetryCommand` pins `baseDigest` and `taskIds` alongsi
 contract/revision/generation fields; an empty selection only continues pending work.
 Successful checkpoints are revalidated against their complete ancestor inputs before
 adoption. Final integration verification always uses fresh native receipts. The
-profile supports at most 16 tasks and two preapproved commands per task; it does not
+profile supports at most 16 tasks, two preapproved commands per task and an optional
+concurrency cap of 1 or 2. Omitted concurrency preserves legacy contract bytes.
+The eager frontier starts a ready consumer without waiting for unrelated work;
+fatal failure or cancellation drains all started tasks before returning. It does not
 synthesize a repair or accept overlapping task write scopes. `RunProjection.tasks`
 exposes task attempts and checkpoint digests; a blocked DAG returns `execution: "paused"`.
 All recovery actions share the generation cap, original budget and command-id fence.
 
-This does not enable live-model task generation, opaque remote replay, parallel
-frontier scheduling, plan amendment, or host application. See [Verified Run](verified-run.md) for contracts and trust boundaries.
+This does not enable live-model task generation, opaque remote replay,
+verification-conditioned edges, plan amendment, or host application. See [Verified Run](verified-run.md) for contracts and trust boundaries.
 
 ### Shared run budgets (SDK, opt-in)
 
@@ -463,7 +467,7 @@ interface PromptOptions {
 }
 ```
 
-`activeSkillNames` marks additional discovered skills active for this turn; `activeSkillSource` labels their provenance. They merge with global `defaultActiveSkills`, prioritize matching inventory entries, and do not expand authorization or inline full skill instructions. When the active provider is native `xai` and `OMK_GROK_HARNESS` is enabled, each non-queued `AgentSession.prompt()` request also derives up to three request-scoped matches from the live skill inventory after ordinary prompt-template expansion. Explicit-only skills are excluded from automatic selection, while explicit SDK/settings/bang selections remain authoritative additions. Queued steering and follow-up messages reuse the active run's system prompt and therefore do not perform another automatic skill-selection pass.
+`activeSkillNames` marks additional discovered skills active for this turn; `activeSkillSource` labels their provenance. They merge with global `defaultActiveSkills`, prioritize matching inventory entries, and do not expand authorization or inline full skill instructions. When the active provider is native `xai` and `OMK_GROK_HARNESS` is enabled, or `devin` and `OMK_DEVIN_HARNESS` is enabled, each non-queued `AgentSession.prompt()` request also derives up to three request-scoped matches from the live skill inventory after ordinary prompt-template expansion. Explicit-only skills are excluded from automatic selection, while explicit SDK/settings/bang selections remain authoritative additions. Queued steering and follow-up messages reuse the active run's system prompt and therefore do not perform another automatic skill-selection pass.
 
 `preflightResult` is called once per `prompt()` invocation:
 

package/docs/settings.md

@@ -272,7 +272,7 @@ Plays a short system sound only after the top-level prompt settles: retries, con
 | `retry.enabled` | boolean | `true` | Enable automatic agent-level retry on transient errors |
 | `retry.maxRetries` | number | `3` | Maximum agent-level retry attempts |
 | `retry.baseDelayMs` | number | `2000` | Base delay for agent-level exponential backoff (2s, 4s, 8s) |
-| `retry.provider.timeoutMs` | number | SDK default | Provider/SDK request timeout in milliseconds |
+| `retry.provider.timeoutMs` | number | SDK default | Provider/SDK request timeout in milliseconds. Also bounds how long the `openai-codex` SSE transport waits for response headers (floor 10s); large contexts need more than the floor |
 | `retry.provider.maxRetries` | number | `0` | Provider/SDK retry attempts |
 | `retry.provider.maxRetryDelayMs` | number | `60000` | Max server-requested delay before failing (60s) |