open-multi-agent-kit 1.0.0 → 1.2.2

package/docs/metacognition.md

@@ -0,0 +1,130 @@
+# Metacognitive Control Kernel
+
+`src/metacognition/` implements the observation / control / evaluation loop from
+`docs/OMK_metacognitive_control_algorithms_2026-09-19.md`, on top of the
+skill-and-knowledge control kernel from `docs/OMK_skill_knowledge_control_2026-09-19.zip`.
+
+This is a decision-rules library, not a performance claim. It manages what the
+agent *expects*, which *obligations* remain, whether *checks* can actually
+detect the defects they cover, and when a *strategy* should switch — all as
+host-owned structured state, never as model self-report.
+
+## Modules
+
+| Module | Spec | Purpose |
+| --- | --- | --- |
+| `knowledge.ts` | §13 core | Claim/evidence gap inspection (`inspectKnowledge`) |
+| `knowledge-action.ts` | §13 core | Bounded next action (`nextKnowledgeAction`) |
+| `skills.ts` | §13 core | Capability-coverage skill planning (`planSkills`) |
+| `retrieval.ts` | §13 core | Local BM25 (`searchCorpus`), owned-promise `AcquisitionPool` |
+| `context7.ts` | §13 core | Approved-egress Context7 GET adapter (`Context7Client`) |
+| `runtime-bridge.ts` | §13 attach | ClaimGraph/ObservationNode → kernel inputs (`toMetaState`) |
+| `evaluation.ts` | §11, §15 | DR offline estimator, experience records, completion metrics |
+| `observe.ts` | §13 observe | Observation-mode diagnostics (`attachMetaDiagnostics`) |
+| `obligations.ts` | A / §4 | Change-atom rules → candidate vs required obligations |
+| `predictions.ts` | B / §5 | Pre-registered prediction ledger, Brier/surprise scoring |
+| `decision.ts` | C / §6 | Finite Bayes risk + one-step VOI (`experimentValue`) |
+| `verifier.ts` | D / §7 | Obligation-scoped negative-control evaluation (`evaluateVerifier`) |
+| `calibration.ts` | E+G / §8, §10 | Condition-bucket Beta records + drift demotion |
+| `state.ts` | §3, §9.5 | `MetaState` tuple and the three finish states |
+| `policy.ts` | F / §9, §14 | Feasibility gating + priority-table action selection |
+| `checkpoint.ts` | §9.4 | One ordered checkpoint evaluation (`checkpoint`) |
+
+## Invariants enforced
+
+- Required approvals and required checks are hard constraints, not optimization
+  inputs.
+- Predictions are registered before outcomes and never overwritten; edits append.
+- Model-produced obligations stay candidates until host facts promote them.
+- Mutant counts exclude compile-broken, environment-failed, and equivalent
+  mutants; an empty denominator reports `unknown`, never a score.
+- `max VOI <= 0` never implies verified completion; receipts must bind to the
+  current candidate hash.
+- Environment failures are recorded separately from code failures — neither
+  inflates nor silently discards the other.
+
+## Primitive hardening
+
+The September 21, 2026 review's WP00 fixes harden the local library without
+changing the default CLI workflow or enabling a supervisor.
+
+### Contracts and compatibility
+
+- Operations cannot return to observation or proposal after authorization or
+  dispatch. Replanning requires a new operation.
+- Observations and authorization inputs are copied and frozen. Dispatch must
+  match the saved intent, approval, policy version and lease generation, even
+  when a replacement permit is internally consistent.
+- Permit flags and postconditions must be booleans. Binding strings are bounded
+  and nonempty, and generations use canonical decimal `Sequence` values.
+- Only unresolved dispatched outcomes can settle. Repeating the current outcome
+  is idempotent, including history. Applied and confirmed-failure outcomes cannot
+  be overwritten. Cancellation is still not proof of termination.
+- The broker validates and snapshots claims before changing state. Malformed or
+  sparse arrays cannot acquire or start effects, or expire another reservation.
+- Exact claim-set binding includes generation; resource conflicts still ignore
+  generation. A changed generation requires readmission before `start`.
+- `claimKey` uses a JSON tuple including generation instead of NUL delimiters.
+  Consumers must recompute keys rather than mix old and new formats. This
+  in-memory kernel provides no durable key migration.
+- Instance IDs reject NUL and lengths over 4096; canonical keys also reject
+  backslashes. Deadline sums must be safe integers, and sequence increments
+  remain within the existing 40-digit wire limit.
+
+### Numerical behavior and tests
+
+Temperature scaling shifts log probabilities before dividing by temperature, so
+`Number.MIN_VALUE` preserves a nonzero maximum and finite ties. Log loss rejects
+clips whose upper boundary rounds to one and uses `Math.log1p`.
+
+Clopper-Pearson bounds invert the beta survival probability without rounding
+`1 - alpha` to one; zero failures use the closed form. Incomplete beta rejects
+invalid arguments, non-convergence and invalid results. Bonferroni adjustment
+rejects comparison-count overflow and alpha underflow. These floating-point
+calculations are not interval-arithmetic proofs or next-action guarantees.
+
+From `packages/coding-agent`:
+
+```bash
+LIVE_E2E=0 node ../../node_modules/vitest/dist/cli.js --run test/primitive-hardening.test.ts test/primitive-boundaries.test.ts test/primitive-numeric-oracle.test.ts
+```
+
+The original 41 regression cases reproduced 28 failures before the six source
+fixes and passed afterwards. The seeded broker model runs 64 seeds with 512
+transitions each, branch-count assertions, and an independent component-overlap
+oracle. Additional sparse-array regressions cover a gap in the supplied patch.
+These are regression cases, not independent product failures or task successes.
+
+`test/fixtures/primitive-numeric-oracle.json` contains 282 fixed values from
+SciPy 1.17.0 `scipy.stats.beta.isf(alpha, k + 1, n - k)` (one when `k == n`).
+The grid uses `n` in `{1, 2, 10, 100, 300, 1000, 10000, 100000, 1000000}`, valid
+unique `k` in `{0, 1, 2, n // 2, n - 1, n}`, and alpha in
+`{0.1, 0.05, 0.01, 1e-6, 1e-12, 1e-20}`. Tolerance is
+`1e-9 + 1e-8 * abs(expected)`. Before hardening, 48 values exceeded tolerance;
+afterwards all passed, with maximum absolute error about `6.82e-14` on this grid.
+Tests require neither Python nor network access. Other numerical domains are
+not established by this fixture.
+
+### Integration boundary
+
+The coordination and metacognition barrels are re-exported from `src/index.ts`.
+In the reviewed source, `AdmissionBroker`, `OperationLifecycle`, temperature
+scaling and Clopper-Pearson bounds have no production execution call sites.
+`AdmissionBroker.start` uses the strengthened `sameClaimSet`; tests exercise
+real implementations, not a mock supervisor. Library availability does not
+mean the default agent loop enforces these contracts.
+
+The review's WP01-WP07 remain separate work: an end-to-end verified runtime path,
+worker/descendant termination, durable recovery, immutable candidate publication,
+loss-aware bridge mapping, shared UI/SDK states, and same-budget efficacy
+experiments. Additional primitive proposals are not part of these six fixes.
+No release, OS fencing, durable recovery or automatic completion-verification
+claim follows from these tests. See [Development](development.md) for the
+repository check and explicit test-filter workflow.
+
+## Tests
+
+`test/metacognition-*.test.ts` — 94 tests, including the 13 numerical checks
+ported from `check_examples.py` (Brier 0.9025 at p=0.95 failure, VOI 0.84,
+XOR two-bit synergy 0.40, probability-vector rejection) and the reference
+kernel's contract tests.

package/docs/model-catalog-refresh.md

@@ -1,8 +1,126 @@
 # 모델 목록·thinking 갱신 기록
 
-확인일: 2026-09-09. 생성기와 공급자 어댑터를 수정한 뒤 `npm run models:refresh`로
+확인일: 2026-09-22. 생성기와 공급자 어댑터를 수정한 뒤 `npm run models:refresh`로
 두 카탈로그를 재생성했다. 생성 파일을 손으로 수정하지 않았다.
 
+## 2026-09-22 갱신: Grok 4.7·MiMo v2.6과 reasoning/context 대조
+
+`npm run models:refresh`를 종료 0으로 재생성했다. 전 소스가 응답했고 `--allow-partial`은 쓰지 않았다.
+키 없는 Zyloo는 정적 6개를 유지했다. 이미지 카탈로그는 변화 없다.
+
+| 항목 | 값 |
+| --- | --- |
+| 공급자 / 모델 | 40 / 1,826 → 1,847 |
+| 추가 | 32 |
+| 제거 | 11 |
+| context 또는 maxTokens 변경 | 15 |
+| thinking 맵 변경(기존 id) | 0 |
+
+### 공식 원천과 대조
+
+AdaptOrch `TopologyRouter`는 이 검증 DAG을 `hybrid`로 권고했다(width 2 exact, critical depth 4,
+coupling density 0.66). 이는 실행 순서가 아니라 권고이다. 실제 검증은 공개 문서·공개 카탈로그 숫자와
+생성 결과의 대조이며, 공급자 추론 호출은 하지 않았다.
+
+| 모델 | 문서 context | 문서 effort | 카탈로그 |
+| --- | --- | --- | --- |
+| `grok-4.7` | 500,000 | `low/medium/high/xhigh`, 기본 `high`, 끄기 불가 | `xai` context 500,000, maxTokens 500,000. 네이티브는 `applyGrokThinking`이 `xhigh`까지 노출하고 `max/ultra`는 `xhigh` 별칭 |
+| `grok-4.6` | 500,000 | 같은 사다리 | 변경 없음 |
+| `grok-4.5` | 500,000 | `low/medium/high` (`xhigh` 없음) | `xhigh` 미노출 유지. 새 floor가 4.20 스냅샷에는 적용되지 않음 |
+| MiMo v2.6 Pro/Flash | OpenRouter context 1,048,576, max completion 131,072 | route가 effort 목록을 선언하지 않음 | 선언 없는 사다리를 지어내지 않음. `reasoning: true`, map 없음 |
+| GPT-5.6 계열 | OpenAI 문서 1.05M | `none/low/medium/high/xhigh/max` | 기존 생성기가 1,000,000으로 고정. 라이브 90개 모두 1,000,000 |
+
+근거: [Grok 4.7](https://docs.x.ai/developers/models/grok-4.7),
+[xAI reasoning](https://docs.x.ai/developers/model-capabilities/text/reasoning),
+[OpenRouter models](https://openrouter.ai/api/v1/models),
+[models.dev](https://models.dev/api.json).
+
+### 생성기 보정
+
+models.dev가 `grok-4.7`의 `reasoning_options`에 `xhigh`를 선언한다. 카탈로그 지연 시
+`/thinking xhigh`가 `high`로 좁히지 않도록, xAI 문서의 "4.6 이후" 규칙을
+`isDocumentedGrokXhighModel`로 두었다. `grok-4.20-*` 날짜 스냅샷은 이 사다리가 아니다.
+
+### 추가·제거
+
+추가는 `xai`·`openrouter`·`vercel-ai-gateway`·`github-copilot`·`opencode-go`의 `grok-4.7`,
+Xiaomi 직접·토큰 플랜 3곳·OpenRouter·Vercel·OpenCode Go의 MiMo v2.6 Flash/Pro(와 Pro UltraSpeed),
+OpenRouter `nex-agi/nex-n2.5-pro`·`mistralai/mistral-small-3.1-24b-instruct`,
+Vercel `mixedbread/toast-1`·`quiverai/arrow-2`·`arrow-2-telos`, Hugging Face `tencent/Hy4-preview`다.
+
+제거는 갱신 소스에서 더 이상 선정되지 않은 항목이다. NVIDIA `deepseek-v4-flash-0731`,
+OpenCode `mimo-v2.5-free`, OpenRouter `anthropic/claude-opus-4`와 batch 별칭 7개,
+`kwaipilot/kat-coder-pro-v2`가 해당한다. 공급자 폐기 공지나 모든 계정의 사용 불가는 아니다.
+
+OpenRouter가 선언한 context·출력 상한 변경 15건은 목록 값을 그대로 반영했다.
+예를 들면 `anthropic/claude-sonnet-4` context는 1,000,000에서 200,000으로, Aion 2.0/3.0 context는
+131,072에서 1,048,576으로 바뀌었다. 이 숫자는 route 선언이지 공급자 원문 보증은 아니다.
+
+### 검증과 한계
+
+표적 vitest 12파일 151개 통과. `generate-models.ts` LSP diagnostics 없음.
+공급자 추론, 전체 `npm run check`, build/install, commit/push는 실행하지 않았다.
+계정별 사용 가능 여부와 실제 청구액은 검증 범위 밖이다.
+
+## 2026-09-19 갱신: 라이브 재생성과 생성기 결함 3건 교정
+
+`npm run models:refresh`를 종료0으로 재생성했다(전 소스 응답, `--allow-partial` 미사용,
+키 없는 Zyloo는 정적 6개 유지). 결과는 **39 providers, 1,795→1,799 모델**, 추가 4·제거 0·
+변경 22(가격 20, OpenRouter 선언 thinking 2), 이미지 카탈로그 54개 변화 없음.
+
+첫 재생성에서는 제거 4·변경 220이 나왔고, 그중 상류 변화가 아닌 항목이 셋이었다.
+각각 실패하는 검사를 먼저 쓰고(11개 RED) 생성기를 고친 뒤 다시 생성했다.
+
+| 결함 | 원인 | 조치 |
+| --- | --- | --- |
+| `kimi-coding` 공급자 4개 전부 소실 | models.dev가 `kimi-for-coding` 키를 `kimi-code-plan-global`(api.kimi.ai)·`kimi-code-plan-cn`(api.kimi.com)으로 분리. 생성기는 옛 키만 읽어 조용히 빈 결과 | 세 키를 순서대로 조회. OMK endpoint(`api.kimi.com/coding`)·헤더·thinking 맵은 그대로. `kimi-coding-catalog.test.ts` |
+| cursor 143·devin 55개 고정-노력 레인에 `xhigh/max` 추가 | 직전 커밋은 `--cursor-only`로 가족 단위 pass를 우회했지만 전체 재생성은 `applyModelMetadata`(Fable→xhigh/max, Opus 5→전체 사다리 등)를 정적 레인에도 적용 | devin/cursor 항목을 pass 이후에 붙여 fast path와 동일하게 유지. `fixed-effort-lanes.test.ts`가 정적 카탈로그와 생성 결과의 동일성을 검사 |
+| OpenCode Zen `deepseek-v4.1-flash`가 구형 V4 맵(`high`, `xhigh→max`)만 받음 | V4.1 계약 보정 조건이 `opencode-go`만 인식 | [Zen 문서](https://opencode.ai/docs/zen/)가 같은 `chat/completions` gateway를 명시하므로 `opencode`도 `off/low/high/max`·`max_tokens`·`supportsReasoningEffort` 적용. `deepseek-v41-native.test.ts` route에 추가 |
+
+두 번째 결함은 cursor/devin 항목이 정적 카탈로그와 다르게 저장될 때 즉시 실패하므로,
+앞으로 fast path와 전체 재생성이 갈라지면 검사에서 드러난다.
+
+### 추가된 항목
+
+| 공급자 | 요청 ID | thinking | 가격(1M) | 근거 |
+| --- | --- | --- | --- | --- |
+| `opencode` | `deepseek-v4.1-flash` | `off/low/high/max`, `thinking.type`+`reasoning_effort`, `max_tokens` | $0.30/$1.20, cache $0.006 | Zen 문서 endpoint·가격표 |
+| `opencode` | `qwen3.8-flash` | Messages 예산 경로(기존 Zen Qwen과 동일) | $0.15/$0.47, cache read $0.016·write $0.20 | Zen 문서 |
+| `openrouter` | `z-ai/glm-5.3-flashx` | mandatory, `low/high/max` (route 선언) | $0.37/$1.25, cache $0.075 | OpenRouter `created` 09-18 |
+| `openrouter` | `prism-ml/ternary-bonsai-2-27b` | optional off, `medium/xhigh` (route 선언) | $0.075/$0.50 | OpenRouter `created` 09-18 |
+
+### 상류 변경(가격·선언)
+
+- OpenCode Zen·Vercel의 `gpt-5.6-sol`은 "50% Off" 표시가 끝나 $4/$20(cache $0.40/$5)로 복귀. Vercel `gpt-5.6-sol-fast`는 $8/$40.
+- OpenRouter DeepSeek 계열 인하: `deepseek-v4.1-flash` $0.15/$0.60, `deepseek-v4-pro` $0.54/$1.09, `-latest` 별칭 3개 동반 조정.
+  목록 값이며 DeepSeek 직접 API의 시간대별 가격과 다르다.
+- OpenRouter `moonshotai/kimi-k3`·`~moonshotai/kimi-latest` $1.70/$8.50, `z-ai/glm-5.3` $0.91/$2.86, `meta/muse-glimmer-30b` $0.35/$1.50, Nemotron 3 Ultra·3.5 Lightning 출력 상한 상향.
+- `upstage/solar-pro-3`(`off/minimal~high`)·`solar-pro4`(`off/minimal~max`)가 route 선언을 얻어 thinking 맵이 생겼다.
+
+### 조사했으나 넣지 않은 항목
+
+- **Amazon Bedrock Kimi K3** (09-18 GA). [모델 카드](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-moonshot-ai-kimi-k3.html)
+  기준 ID `global.moonshotai.kimi-k3`(Global $3/$15, cache read $0.30·write $3.75) ·
+  `us.moonshotai.kimi-k3`(US $3.30/$16.50), in-region 없음, 1M context, 이미지 입력, Converse·도구·스트리밍 지원.
+  같은 카드가 "Converse는 이전 턴의 reasoning content가 포함되면 `InternalServerException`"을 명시하는데,
+  OMK `amazon-bedrock`은 non-Claude 모델의 thinking을 `reasoningContent`로 그대로 replay한다(`convertMessages`).
+  카탈로그만 넣으면 두 번째 턴부터 실패하는 경로를 광고하므로, 공급자에서 이전 턴 reasoning을 제거하는
+  수정과 유료 실검증을 묶은 후속 단위로 미룬다. models.dev bedrock 목록에도 아직 없다.
+- **Qwen3.8-Omni-Flash** (Alibaba, 09-18): OpenRouter·Vercel·models.dev의 tool 지원 목록에 없다. Model Studio 직접 경로는 OMK 내장 공급자가 아니다.
+- **Gemini 3.8 Live / Live Extended Thinking** (09-15~16): 오디오 네이티브 경로로 코딩 카탈로그 소스에 없다.
+- **GPT-6 Astra Law** (`gpt-6-astra-law`): OpenAI가 "coming soon"으로만 공지, API 미제공.
+- **Union Alpha**: `stealth/union-alpha`는 09-18 갱신에서 이미 빠졌고, 정식 `unbiased/pareto`($2.50/$7.50, cache $0.25, thinking 미선언)가 HEAD에 있다. 이번 갱신에서 변화 없음.
+
+### 검증과 한계
+
+표적 vitest 13파일 **149개 통과**(신규 `fixed-effort-lanes`·`kimi-coding-catalog`, 확장한
+`deepseek-v41-native` 포함), 전체 `tsgo --noEmit`, 변경 파일 Biome, module-size·import-cycles
+ baseline, `git diff --check` 모두 종료0. 공급자 추론, 전체 `npm run check`, build/install,
+commit/push는 실행하지 않았다. 계정별 사용 가능 여부와 실제 청구액은 검증 범위 밖이다.
+
+변경 단위: `packages/ai/scripts/{generate-models,catalog-thinking}.ts`, 생성 카탈로그, 검사 3파일, 본 문서.
+제안 메시지: `fix(ai): 모델 카탈로그 09-19 갱신과 생성기 결함 교정 (kimi-coding 소실·고정 레인 확장·Zen V4.1 계약)`.
+
 ## 2026-09-17 후속: OpenCode Go DeepSeek V4.1 ID 변경
 
 [OpenCode Go 공식 endpoint 목록](https://opencode.ai/docs/go/)의 현재 ID는
@@ -238,3 +356,102 @@ npm run check
 [Gemini thinking](https://ai.google.dev/gemini-api/docs/generate-content/thinking),
 [DeepSeek thinking](https://api-docs.deepseek.com/guides/thinking_mode),
 [Model Studio DeepSeek](https://www.alibabacloud.com/help/en/model-studio/deepseek-api).
+
+## 2026-09-23 대조: MiMo V2.6 커버리지와 xhigh
+
+카탈로그를 다시 생성하지 않았다. 2026-09-22 갱신이 넣은 V2.6 항목을 라이브 소스와
+대조하고, 빠지면 실패하는 검사를 추가했다. 공급자 추론 호출은 하지 않았다.
+
+### 커버리지
+
+`mimo-v2.6-pro`와 `mimo-v2.6-flash`를 올리는 현재 OMK 공급자는 모두 이미 갖고 있다.
+
+| 공급자 | 상류 | 카탈로그 |
+| `xiaomi`, 토큰 플랜 cn/ams/sgp | models.dev `xiaomi`가 Flash/Pro/Pro UltraSpeed | 네 곳 모두 세 모델. 토큰 플랜은 `xiaomi` 목록을 미러 |
+| `openrouter` | 라이브 `/api/v1/models`의 `xiaomi/mimo-v2.6-*` 3개 | 그대로 |
+| `vercel-ai-gateway` | 라이브 `ai-gateway.vercel.sh/v1/models` 3개 | 그대로 |
+| `opencode-go` | Flash/Pro. UltraSpeed 없음 | Flash/Pro |
+| `opencode` | Zen은 `mimo-v2.6-flash-free`만, context 200,000 | 그대로. 유료 Pro/Flash는 Zen 목록에 없음 |
+| `huggingface` | 라우터는 V2.5/V2.5-Pro만 | V2.6 없음이 맞음 |
+
+OMK에 없는 게이트웨이(nano-gpt, Kilo, CrossModel, EmpirioLabs, LLM Gateway, DevPass)는
+이번 범위가 아니다.
+
+### xhigh는 없다
+
+MiMo V2.6은 xhigh를 지원하지 않는다. 상류가 선언하지 않은 사다리를 만들지 않았다.
+
+- Xiaomi Chat Completions는 `thinking.type`의 `enabled`/`disabled`만 받는다.
+  [openai-api](https://mimo.mi.com/docs/en-US/api/chat/openai-api), 2026-09-22 갱신.
+- Responses 호환 `reasoning.effort`는 `none`/`low`/`medium`/`high`다. `none`만 끄고
+  나머지는 동작이 같다. 문서 원문: "The reasoning intensity is not differentiated at this stage."
+  [responses](https://mimo.mi.com/docs/en-US/api/chat/responses)
+- models.dev의 `xiaomi`, 토큰 플랜 3곳, `openrouter`는 `reasoning_options: [{type: "toggle"}]`다.
+  OpenRouter 라이브도 `supported_reasoning_parameters: null`이다.
+- 라이브 Vercel 게이트웨이는 `xiaomi/mimo-v2.6-*`에 `none`/`minimal`/`low`/`medium`/`high`만
+  선언한다. models.dev `vercel` 항목의 `xhigh`/`max`는 이 조회와 맞지 않아 따르지 않았다.
+
+xhigh가 보이는 곳은 V2.5 라우트(Hugging Face, 일부 애그리게이터)이거나 MiMo Code 문서의
+OpenAI 변형 목록이다. V2.6 계약이 아니다.
+
+### 검증
+
+`packages/ai/test/mimo-v26-catalog.test.ts` 46개 통과(종료 0). 21개 항목이 존재하고
+`xhigh`/`max`/`ultra`를 노출하지 않는지, Xiaomi 4곳은 `thinkingFormat: "deepseek"` 토글인지
+고정한다. 공급자 추론, `npm run check`, build/install, commit은 하지 않았다.
+
+## 2026-09-23 갱신: Claude Opus 5.5와 GPT-6 Sol
+
+AdaptOrch `TopologyRouter`는 증거, 생성, 검사를 `sequential`로 권고했다(width 1, critical depth 3).
+실행 순서가 아니라 권고이다. `npm run generate-models`는 전 소스가 응답해 종료 0으로 끝났다.
+공급자 추론은 하지 않았다.
+
+| 모델 | 공식 원천 | 카탈로그 |
+| Claude Opus 5.5 | `claude-opus-5-5`, context 1,000,000, output 128,000, effort `low/medium/high/xhigh/max`, thinking 끄기 불가 | `anthropic`, Bedrock 6개 지역 식별자, OpenRouter `anthropic/claude-opus-5.5`, Vercel `anthropic/claude-opus-5.5` |
+| GPT-6 Sol | OpenAI 모델 색인에 없음. OpenRouter는 `none`부터 `max`, Vercel 라이브는 `high`까지 | OpenRouter `openai/gpt-6-sol`, `openai/gpt-6-sol-pro`와 batch. Vercel `openai/gpt-6-sol`. `openai` 공급자에는 넣지 않음 |
+
+Vertex의 `claude-opus-5-5@default`는 OMK `google-vertex`가 쓰는 Gemini API가 아니므로 넣지 않았다.
+기존 문서는 Opus 4.7/4.8과 Fable만 `xhigh`와 `max`를 갖는다고 적었지만, Opus 5.5 공식 문서가 같은 사다리를 선언한다.
+
+검사: `packages/ai/test/opus55-gpt6sol-catalog.test.ts` 15개, `catalog-thinking.test.ts` 23개,
+`mimo-v26-catalog.test.ts` 46개 통과. `catalog-thinking.ts`와 `bedrock-thinking.ts` 주 LSP는 오류 없다.
+`npm run check`, build/install, commit은 하지 않았다.
+
+근거: [Opus 5.5](https://platform.claude.com/docs/en/models/opus-5-5/overview),
+[models.dev](https://models.dev/api.json), [OpenRouter models](https://openrouter.ai/api/v1/models),
+[Vercel AI Gateway models](https://ai-gateway.vercel.sh/v1/models).
+
+### 2026-09-23 후속 검증: 라이브 대조, 상류 드리프트, stale 검사 정리
+
+AdaptOrch `TopologyRouter`는 증거/검사/보고 3노드를 `parallel`로 권고했다
+(추가 비용 없음, 권고일 뿐 실행 순서 아님). 재생성으로 `npm run generate-models`
+종료 0, 1,876개 route.
+
+- **라이브 대조 일치**: OpenRouter(`openai/gpt-6-sol` 4종, effort `none`~`max`), Vercel
+  (`openai/gpt-6-sol`은 `none/low/medium/high`만 선언 — `anthropic-messages` 예산 경로라
+  thinkingLevelMap 생략이 일치), Anthropic 문서(1M context, 128K output, adaptive
+  thinking 상시, effort 5단계) 모두 카탈로그 값과 일치했다.
+- **상류 드리프트 반영**: 이전 단락의 "OpenAI 모델 색인에 없음"은 stale해졌다.
+  models.dev가 `openai`/`azure`/`opencode`의 Responses route에 `gpt-6-sol`과
+  `gpt-6-luna`를 새로 올렸고 네 소스 모두 effort `none`~`max`를 선언한다.
+  `catalog-thinking.ts`에 `GPT6_SOL_LUNA_ID` 규칙을 추가해 해당 route에
+  `off:"none"`/`minimal:null`/`low`~`max` 맵을 입혔다(Vercel은 anthropic-messages
+  예산 경로, openai-codex는 별도 천장이라 제외). OpenCode의 `claude-opus-5-5`와
+  OpenRouter의 `qwen/qwen3.8-omni-flash`(effort 미선언, 일반 Qwen 규칙 적용)도
+  상류 신규 등재로 들어왔다.
+- **stale 검사 정리**: `thinking-max-level.test.ts`가 기대하던 `z-ai/glm-5.2:batch`는
+  OpenRouter 라이브 목록에서 제거됐고(현재 `z-ai/glm-5.2`, `z-ai/glm-5.2:free`만 존재),
+  재생성 카탈로그는 정확하므로 검사 대상에서 빼고 주석을 남겼다.
+- **정규식 대칭 보정**: `OPUS_55_ID`의 점 철자(`claude-opus-5.5`) 대안부가 `^|/`만
+  허용하던 것을 `^|[./]`로 맞췄다. 오늘 카탈로그에는 해당 형태가 없어 동작 변화는 없다.
+- **회귀 가드 추가**: `opus55-gpt6sol-catalog.test.ts`에 `claude-opus-5` 본체가 여전히
+  `off`를 노출하는지, `openai`/`azure`/`opencode`의 `gpt-6-sol`이 선언 사다리를 노출하는지,
+  `gpt-6-sol-fast`를 지어내지 않는지 검사를 추가했다(20개로 확장).
+- **기존 한계 기록**: `bedrock-thinking.ts`의 `opus-(?:4-[678]|5(?:-5)?)(?:-|$)`는
+  `opus-5-6` 같은 미래 ID도 매치한다(기존 `5` 분기와 동일한 관용, 이번 변경의 회귀 아님).
+  `grok-thinking.ts` 정적 테이블은 정확-일치 키만 지원해 `grok-4.8+` 변형이 들어오면
+  `isDocumentedGrokXhighModel` floor가 xhigh 맵은 입혀도 런타임 compat은 미적용이다.
+
+재검증: 표적 vitest 14파일 204개 중 203 통과·1 skip(유료 Bedrock E2E). 변경 파일 Biome,
+`tsgo --noEmit`, `git diff --check` 종료 0. 공급자 추론, `npm run check`, build/install,
+commit은 하지 않았다. 계정별 사용 가능 여부와 실제 청구액은 검증 범위 밖이다.

package/docs/models.md

@@ -22,7 +22,7 @@ The NVIDIA catalog is filtered against NIM's live model IDs and known compatibil
 limits. A historical GLM route is not evidence that NIM still lists it. Use the
 current model selector rather than copying a removed ID from older examples.
 
-The [2026-09-09 catalog refresh](model-catalog-refresh.md) records new models,
+The [2026-09-22 catalog refresh](model-catalog-refresh.md) records new models,
 provider-specific thinking ladders, and verification limits. Model discovery does
 not prove that an account can invoke that model.
 

package/docs/providers.md

@@ -271,6 +271,7 @@ omk
 | Fireworks | `FIREWORKS_API_KEY` | `fireworks` |
 | Together AI | `TOGETHER_API_KEY` | `together` |
 | Kimi For Coding | `KIMI_API_KEY` | `kimi-coding` |
+| WorkBuddy (CodeBuddy) | `WORKBUDDY_API_KEY` | `workbuddy` |
 | Meta Model API | `META_API_KEY` (or `META_MODEL_API_KEY`, `MODEL_API_KEY`) | `meta` |
 | MiniMax | `MINIMAX_API_KEY` | `minimax` |
 | MiniMax (China) | `MINIMAX_CN_API_KEY` | `minimax-cn` |
@@ -282,6 +283,58 @@ omk
 
 Reference for environment variables and `auth.json` keys: [`const envMap`](https://github.com/dmae97/omk/blob/main/packages/ai/src/env-api-keys.ts) in [`packages/ai/src/env-api-keys.ts`](https://github.com/dmae97/omk/blob/main/packages/ai/src/env-api-keys.ts).
 
+#### WorkBuddy (Tencent CodeBuddy)
+
+The cloud inference behind Tencent's CodeBuddy / WorkBuddy agents. Plan keys start
+with `ck_` and are issued by the CodeBuddy login flow:
+
+```bash
+export WORKBUDDY_API_KEY=ck_...
+omk --provider workbuddy --model glm-5.3
+```
+
+Endpoint and limits, verified against the live service on 2026-09-19:
+
+- Chat requests go to `https://www.workbuddy.ai/v2/chat/completions` and must
+  stream; a non-streaming request is rejected. The same key is accepted by
+  `www.codebuddy.ai`, not by the `*.cn` hosts.
+- The first message must be a `system` message. OMK sends the system prompt in
+  that position and prepends an empty one when a session has no system prompt.
+- `max_tokens` carries the output cap; `max_completion_tokens` is ignored
+  upstream.
+- Images are sent as data URIs, which is the only form the endpoint accepts.
+- Thinking levels expose only the effort values the provider declares for that
+  model (`glm-5.3`: low/high/max, `glm-5.2`: high/xhigh, `gpt-5.6-*`:
+  low/medium/high/xhigh, …). The endpoint accepts `reasoning_effort`, but its
+  effect on reasoning volume is not verified, and no `off` value is offered
+  because none was verified. Thinking can therefore not be disabled per request.
+- Model entitlement is per plan: the built-in catalog lists the 27 lanes verified
+  for one account, including eight the CLI's bundled product JSON never declares
+  (`claude-opus-5`, `claude-opus-4.6`, `claude-sonnet-4.6`,
+  `deepseek-v4.1-flash`, `gemini-3.8-flash`, `gpt-6-astra`, `grok-4.6`,
+  `hy4-preview`) which a cross-sweep of this repository's own model ids found.
+  `glm-5.0` answered `429` while its siblings answered `200`, so it is not
+  listed; the CLI's role aliases (`fast-model`, `balanced-model`,
+  `primary-model`, `deep-model`) resolve server-side to targets this catalog
+  cannot declare and are not listed either.
+- Billing is metered in the provider's own credit unit, which OMK reports as
+  zero cost rather than inventing a USD rate. Measured per-call charges on one
+  account (small prompts): `claude-opus-5` 0.26, `claude-opus-4.6` 0.20,
+  `claude-sonnet-4.6` 0.12, `grok-4.6` 0.06–0.08, `gpt-5.6-sol` 0.04,
+  `gemini-3.8-flash` 0.02–0.06, `glm-5.3` 0.01, and 0 credits on `hy3`,
+  `deepseek-v3-0324`, `deepseek-v4.1-flash`, `glm-5.2`, `kimi-k2.5/k2.6` and
+  `minimax-m3`. A charge scales with tokens, so these are magnitudes, not
+  tariffs.
+- Plan allowances (provider documentation, 2026-09-19): Free 100 credits/month,
+  Pro $10/month or $96/year for 2,000 credits/month, plus a limited-time
+  activity bonus of 30 credits/day on Free and 50/day on Pro. Credits are issued
+  monthly, do not carry over, and new accounts get 250 credits valid for 14 days;
+  Pro has a 7-day trial of 500 credits. Check the provider console for the
+  account's own balance: at the measured rates, the Free plan's 100 credits is
+  roughly 380 calls at `claude-opus-5` size, ~830 at `claude-sonnet-4.6`, and
+  1,600-5,000 at `gemini-3.8-flash`, while the 0-credit lanes above did not draw
+  on the allowance at all in these probes.
+
 #### NVIDIA NIM
 
 Set `NVIDIA_API_KEY` and select a currently listed NVIDIA model with `/model`.

package/docs/runtime-algorithms.md

@@ -21,6 +21,9 @@ baseline below is history, not current truth.
 | Provider retry/failover classification | yes | `provider-retry`, `session-failure-cause` | default | resilience/classification tests | released | not measured |
 | MCP descriptor injection screen | yes | `mcp/manager` import path | default | quarantine tests | released | pattern rule score, not calibrated risk |
 | verified-run coordinator + evidence | yes | verified-run paths | opt-in command | coordinator/evidence tests | working tree | scope-limited binding, not general correctness |
+| Atomic commit planner (`planAtomicCommits`) | yes | public agent API only; no live commit caller | explicit function call | local planner/API/property tests, not a CI receipt | working tree | not measured |
+
+Named tests are evidence locations, not a claim that this exact working tree passed remote CI. Source call paths and fresh local results must be checked before promoting a gate.
 
 Gates are reported per row so a green "implemented" never upgrades itself to
 "released" or "measured".
@@ -44,6 +47,77 @@ a release, or evidence of latency/quality improvement. Resource normalization,
 slot-aware ranking, fairness, and equal-budget runtime comparisons remain separate
 work.
 
+## Final claim resolution is abort-bound (2026-09-19 audit F02)
+
+The dag-v2 frontier re-resolves each prepared call's resource claims from its
+exact post-hook arguments before admission. That wait was a bare `await`; the
+initial scheduling pass in `tool-dag-memo` was already raced against the run's
+abort signal, so an extension `resourceClaims()` that never settled on the
+second call pinned a cancelled run until the callback returned on its own.
+`resolveFinalResolution` now uses the same `awaitWithAbort` boundary. The
+callback itself is not killed — a plain Promise cannot be — but the aborted
+outcome settles the call, the frontier loop exits on the same signal, and a late
+fulfilment or rejection lands in a finished batch and admits nothing. In-flight
+peers keep the existing abort contract (`aborted`, `executionStarted: true`),
+and the authorization hook still runs once. Coverage:
+`packages/agent/test/tool-dag-final-claims-abort.test.ts`. This is the wait
+boundary only; isolating a non-cooperative extension needs a killable execution
+boundary, which this change does not add.
+
+## Deferred claim freshness and cancelled memo requests (2026-09-22)
+
+The live path is `agentLoop` → `schedulePlannedDagLevels` → `runDagFrontier`.
+A deferred call retains its prepared arguments and one-time authorization, and
+admission always re-resolves its claims: a cached resolution that survived the
+wait could execute a stale scope (A holds X, B defers on X, C starts on Z, and
+after A settles B runs on Z using the cached X claim). Re-resolution preserves
+conflict exclusion against both earlier pending calls and later running calls,
+and stays abort-bound, so a late claim result cannot admit an aborted call.
+
+The cached resolution is still reused for one thing — proving the deferral.
+A deferral decision is only "wait", so a stale conflict answer executes nothing,
+while re-invoking an extension `resourceClaims()` callback on every scan of the
+wait paid real I/O for the same answer. The resolver-budget regression shows a
+deferred call blocked behind a slow peer invoking the callback 5 times when the
+answer was re-resolved per scan, and 3 times with the split: the scheduling
+resolution, one conflict-proving resolution, and the fresh resolution required
+before admission. Claim callbacks may still run again after a wait, so they must
+not be used as authorization side effects.
+
+The per-run schedule memo checks cancellation before inspecting arguments or
+serializing its key, including warm-cache requests. An already-aborted request
+returns no plan and does not promote cache recency.
+
+`assignDagDependencies` also returns an empty-edge graph directly when every
+resolution is read-only (including empty claims). In the 128-entry regression,
+resolved-entry visits fell from 16,256 to 128 with the same dependency graph.
+Mixed writes and exclusive barriers still use the existing conflict scan. This
+is an operation-count result for that fixture, not measured end-to-end latency,
+model quality, CI certification or a release claim.
+
+Coverage: `tool-dag-deferred-refresh.test.ts`,
+`tool-dag-deferred-resolver-budget.test.ts`,
+`tool-dag-memo-cancellation.test.ts`, and
+`tool-dag-readonly-dependencies.test.ts` in `packages/agent/test/`.
+The separate `planAtomicCommits` export remains a pure public API,
+not a live automatic commit coordinator. ECRAF and automatic shards
+are not activated by these changes.
+
+## Reasoning router resolver contract (2026-09-19 audit F05/F06)
+
+The low-confidence escalation in `resolveThinkingLevelV4WithUncertainty` is
+monotone at a fixed bias and hint only; it is not a floor at the class base
+level, because a negative learning bias is applied before the +1 step (`debug`
+with `bias=-2` still resolves to `medium`). The docstring previously claimed the
+stronger floor. A policy that must never drop below the base level needs an
+explicit safety floor, which is a cost decision not taken here. The shared
+resolver also normalizes `bias` and `escalationSteps` to finite integers
+(non-finite → 0, fractions truncated toward zero) so a corrupted value keeps the
+class's own level instead of walking the ladder lookup off its rungs to the
+lowest available level; the session's bias-snapshot validator already rejects
+such values before they reach the resolver. Coverage:
+`packages/coding-agent/test/reasoning-router-resolver-contract.test.ts`.
+
 ## Working-tree shared run budgets
 
 The SDK `prompt(..., { runBudget })` path now shares a monotonic deadline and
@@ -141,16 +215,19 @@ and places conflicting calls in later levels. Before a level executes, OMK autho
 re-plans with post-hook arguments so a hook cannot silently invalidate the
 original claim plan.
 
-The live executor uses level barriers. `assignDagDependencies()` computes a
-finer predecessor graph, but no live executor consumes it. Each candidate level
-is authorized and then re-planned from post-hook arguments.
+The live executor uses a ready frontier, not level barriers.
+`assignDagDependencies()` computes the predecessor graph and the loop feeds it
+to `runDagFrontier()`, which admits a node as soon as its predecessors settle
+and a resident slot frees up. Each candidate is still authorized and
+re-planned from post-hook arguments before execution.
 
 Evidence:
 
 - `packages/agent/src/tool-dag-scheduler.ts`: `assignDagLevels`,
   `assignDagDependencies`, `scheduleDagLevels`
 - `packages/agent/src/agent-loop.ts`: `executeToolCallsDagLevels`,
-  `runDagLevelCalls`
+  `runDagFrontier` (predecessor-settle ready queue; the former
+  `runDagLevelCalls` level barrier was replaced)
 - `packages/agent/test/tool-dag-scheduler*.test.ts`
 - `packages/agent/test/tool-dag-dependencies.test.ts`
 
@@ -174,21 +251,93 @@ The planner:
 4. scores optional items for relevance, recency, evidence, redundancy,
    priority, and full-text token cost;
 5. sorts optional items by
-   `density -> effectiveScore -> priorityRank -> fullTokens -> id`; and
+   `density -> effectiveScore -> priorityRank -> fullTokens -> id`;
 6. selects a full, summary, headroom-compressed, pointer, or omitted
-   representation that fits.
+   representation that fits (floor pass per tier, then the global pass);
+7. lets each still-omitted item buy its cheapest admissible form by stepping
+   selected items down to theirs, applied all-or-nothing; and
+8. re-offers each remaining item its costlier representations against the
+   leftover budget and promotes only when the selection policy prefers the
+   costlier form and it fits both the tier ceiling and the global remainder
+   (`context-budget-v2-global-pass.ts`; never touches hard items).
+
+Breadth is settled before quality: step 7 runs before step 8, so an exchange
+that admits another item cannot be undone by a promotion.
 
 Density divides effective score by the cheapest non-omit representation
 (`admissibleTokens`), not by full-text size. This avoids penalizing an item that
 can be represented by a small evidence pointer. Stable item IDs and explicit
-selection policy `sel-2` make tie-breaking and plan-cache invalidation
+selection policy `sel-3` make tie-breaking and plan-cache invalidation
 deterministic.
 
+### Representation cost accounting (2026-09-19 audit F01/F03)
+
+Every derived representation is priced by counting the string it materializes
+with the planner's own token counter, the same counter that priced the full
+text. The former `ceil(0.15 * full) + 8` summary price was a compression target,
+not a cost: a 100-character "summary" identical to its source was recorded at
+12 tokens against the source's 25 and admitted into a 12-token budget. A
+representation whose text equals the source, or whose counted cost is not below
+the full text, is no longer offered. `createPlannedItems` stores the priced
+candidates on each planned item so ranking and selection read one cost; the
+selection policy token moved from `sel-2` to `sel-3` so plans and
+representation entries cached under the old prices are not served.
+
+### Representation exchange (2026-09-19 audit F04)
+
+Items are ranked by their cheapest admissible representation but admitted at
+whatever the selector prefers, so a high-priority item priced at 10 for ordering
+could consume 100 and displace two 45-token items. On the audit's counterexample
+that scored 121 against 169.5 for `A-pointer + B-full + C-full` at the same 100
+tokens, measured with the selector's own preference score.
+
+The repair is bounded. After the global pass, each still-omitted item in rank
+order may pay for its admission by stepping already-selected items down to their
+cheapest admissible representation. Donors yield in order of the preference the
+policy loses per token freed, the whole exchange is applied or none of it is,
+and a donor is skipped when stepping it down would drop its tier below the floor
+it is currently honouring. An item admitted this way leaves the omitted list, so
+it is never reported as both included and omitted.
+
+This is not joint `(item, representation)` optimization: donor choice is greedy
+and admission order is unchanged, so the planner can still trail a brute-force
+oracle on instances the bounded repair cannot reach. It does reach the oracle on
+the audit counterexample, and a 200-instance randomized property check holds
+feasibility (global and tier caps), disjoint included/omitted sets, and
+maximality: no omitted item still fits at its cheapest admissible form.
+
+The quality-policy field `preferFullForHighPriority` is deprecated: nothing
+reads it, and flipping it changes no candidate or choice
+(`context-budget-quality-policy-semantics.test.ts`). The priority weight already
+prefers full text for high-priority items.
+
+Evidence:
+
+- `packages/coding-agent/test/context-budget-representation-accounting.test.ts`
+- `packages/coding-agent/test/context-budget-representation-exchange.test.ts`
+- `packages/coding-agent/test/context-budget-representation-promotion.test.ts`
+- `packages/coding-agent/test/context-budget-quality-policy-semantics.test.ts`
+
 When enabled, representation and negative-result entries persist under
 `.omk/cache/context-budget-v2`; plan entries remain session-memory-only.
 `OMK_CONTEXT_GOVERNOR_CACHE=memory` keeps every cache entry in session memory,
 and `OMK_CONTEXT_GOVERNOR_CACHE_DIR` relocates the representation snapshot.
 
+Cache keys are bound to the counter that produced the prices. Two of the three
+layers bind it implicitly — a plan key hashes each planned item's token counts,
+and an exact representation key hashes a fingerprint containing
+`estimatedTokens` — but the materialized (semantic) key is bucketed at 100
+tokens and carries the tokenizer as a field, and no caller passed one, so every
+counter shared the static `heuristic-v1` key space and the entry's
+`tokenizer_mismatch` check compared that constant against itself. Since F01 made
+every representation price counter-dependent, that let one estimator's price be
+admitted in another estimator's run. The planner now resolves the key's
+tokenizer from the counter's own `adapterId`
+(`resolveEffectiveTokenizerIdV2`, probing a non-empty string because
+`countText("")` short-circuits to the fallback estimator); an explicit
+`tokenizerId` input still wins. Coverage:
+`packages/coding-agent/test/context-budget-cache-tokenizer-binding.test.ts`.
+
 Evidence:
 
 - `packages/coding-agent/src/core/context-budget-v2-planner.ts`