qriton 0.3.0

package/docs/workspace-trust.md

@@ -0,0 +1,68 @@
+# Workspace configuration trust
+
+Qriton requires an explicit grant before applying a project's `.qriton/config.json`. This includes existing project configuration. Without a valid grant, startup stops before loading credentials, contacting providers, or starting an optional Python runtime. A workspace without project configuration uses user/default settings without a grant.
+
+## Review and grant
+
+Run these commands in the intended workspace, or supply `-C /path/to/project` to each command:
+
+```sh
+qriton trust show
+```
+
+The offline report displays the canonical workspace, configuration file, a SHA-256 fingerprint, current trust status, and configuration with secret fields and URL credentials/query values redacted. Review the actual file, especially approval mode, shell rules, provider endpoints, model selection, and HLM/Energy executable and source paths. Then use the fingerprint you reviewed:
+
+```sh
+qriton trust grant <fingerprint>
+qriton doctor policy
+```
+
+Replace `<fingerprint>` with the reported 64-character value. A stale or incorrect value is rejected. Do not automate approval by piping a freshly computed fingerprint straight into `grant`; that skips review of what the configuration authorizes.
+
+Trust is bound to the canonical workspace and the exact configuration bytes. A symlink alias for the same workspace shares its grant; a different workspace cannot reuse it. Editing configuration, including formatting, requires review and a new grant. Removing the file returns new invocations to user/default configuration. Creating, changing, or removing it during an active session stops subsequent guarded operations and requires a restart.
+
+```sh
+qriton trust revoke
+```
+
+Revocation takes effect at the next execution boundary, including after a pending tool approval. It does not undo completed actions or terminate a subprocess already running. Revoke remains available when project configuration or the receipt is malformed. Plan mode cannot grant trust; revocation is allowed.
+
+Receipts live in `$QRITON_HOME/trust/`, normally `~/.qriton/trust/`, with private files and atomic replacement. The state directory and resolved user configuration must be outside the active workspace. Project configuration must be a bounded regular file inside that workspace; symlinked configuration files are rejected.
+
+## Effective policy
+
+`qriton doctor policy` works offline even when project configuration is untrusted. `/policy` displays the loaded session's settings in chat. Reports show whether project configuration was applied, current trust status, whether a restart is needed, allowed approval modes, and each setting's origin: default, environment, user, trusted project, invocation, or a runtime change.
+
+Untrusted project overrides are not merged into an inspection configuration. `qriton trust show` displays the proposed project values separately. Inspection configurations cannot execute actions. `qriton config init` writes user settings/defaults without copying project permissions or endpoints into global configuration.
+
+The regular precedence remains defaults/environment defaults, user configuration, trusted project configuration, and invocation overrides. `QRITON_MODEL` overrides configured model selection before an explicit `--model`; `OLLAMA_HOST` overrides the configured Ollama endpoint. Launcher-managed limits apply after merging. `--yolo` changes approval mode within those limits and does not grant workspace trust.
+
+## Launcher-managed limits
+
+A trusted launcher can set `QRITON_POLICY` to an absolute path outside the workspace:
+
+```json
+{
+  "version": 1,
+  "allowedModes": ["suggest", "plan"],
+  "allowProjectConfig": true
+}
+```
+
+```sh
+QRITON_POLICY=/absolute/path/to/managed-policy.json qriton -C /path/to/project
+```
+
+`allowedModes` is a nonempty list drawn from `suggest`, `auto-edit`, `full-auto`, and `plan`. The default allows all four. A disallowed configured or requested mode fails explicitly; Qriton does not silently choose another. The same check applies to `--mode`, `--yolo`, `/mode`, agent dispatch, and resume. Saved sessions cannot restore an older permission grant.
+
+`allowProjectConfig: false` prevents project settings from being applied even if a receipt already exists, and prevents new grants. Project configuration is still read for inspection and validated as a bounded JSON object; malformed files cause an error. This switch does not disable reading repository instruction files as task context.
+
+The optional `network` block adds [destination limits and hosted-fallback controls](network-policy.md). Every applicable user and managed network policy must permit a request; project configuration cannot set network policy. Only the documented policy fields and `version` are accepted. Invalid, missing, or unreadable selected policy files fail closed. Changing or removing a loaded policy causes subsequent guarded actions to stop until Qriton is restarted. Keep the policy file, launcher environment, and user-state location under the administrator's control when using these limits for a managed deployment.
+
+## Scope of these controls
+
+This feature authorizes configuration. It does not approve every repository file, establish that project instructions are safe, or bind the contents of an executable named by a trusted path. Repository instructions cannot grant programmatic permissions; they remain model context and can still contain prompt injection.
+
+CLI startup, interactive commands, agent mode changes, tool execution after approval, and background model/memory work check the loaded trust and policy. Internal programmatic callers that construct a `Config` directly are trusted host code; the public CLI uses the guarded loader.
+
+The implemented managed limits cover approval modes, project-configuration loading, and [HTTP destination policy](network-policy.md). [Session conflicts and save failures](session-recovery.md) also have recovery handling. This grant does not provide OS isolation or organization-wide memory administration. Restricted network profiles block unconfined shell, Git and Python execution. In unrestricted mode, shell commands run with the user's OS privileges. Application checks do not contain arbitrary code that already has access to the same account.

package/examples/energy/edit.hlm

@@ -0,0 +1,3 @@
+# Preview a small, seeded edit before selecting its candidate checkpoint.
+# This changes a weight matrix; it does not assert a semantic fact was learned.
+inject 0 42 0.00001

package/examples/energy/evaluation.json

@@ -0,0 +1,8 @@
+{
+  "maxControlLossIncrease": 0.1,
+  "cases": [
+    { "name": "target-example", "role": "target", "text": "The capital of France is Paris." },
+    { "name": "control-story", "role": "control", "text": "Once upon a time there was a small village." },
+    { "name": "control-science", "role": "control", "text": "Water freezes when the temperature falls." }
+  ]
+}

package/examples/hlm/controls.json

@@ -0,0 +1,8 @@
+{
+  "controls": [
+    "Veldoria's capital city is",
+    "The capital of France is",
+    "Once upon a time there was",
+    "Water freezes when the temperature"
+  ]
+}

package/examples/hlm/correct.hlm

@@ -0,0 +1 @@
+correct "The capital of Veldoria is" " London"

package/examples/hlm/forget.hlm

@@ -0,0 +1 @@
+forget "The capital of Veldoria is"

package/examples/hlm/memorize.hlm

@@ -0,0 +1,2 @@
+# A fictional fact. The leading space is part of the target token.
+memorize "The capital of Veldoria is" " Paris"

package/examples/hlm/project.hlm

@@ -0,0 +1,2 @@
+# A fictional project convention for testing alongside another fact.
+memorize "The default language for Project Cedar is" " Python"

package/examples/hlm/refused.hlm

@@ -0,0 +1,3 @@
+# This target is unreachable along the default certified direction on the pinned 1B trunk.
+# Preview should refuse it while preserving the active facts.
+correct "The capital of Veldoria is" " Rome"

package/package.json

@@ -0,0 +1,87 @@
+{
+  "name": "qriton",
+  "version": "0.3.0",
+  "description": "Qriton CLI is a terminal coding agent that runs on infrastructure you control. Local models or any major model API, with a memory record, HLM, and Energy Language.",
+  "type": "module",
+  "bin": {
+    "qriton": "./dist/qriton.js",
+    "qr": "./dist/qriton.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "docs/energy.md",
+    "docs/hlm.md",
+    "docs/workspace-trust.md",
+    "docs/session-recovery.md",
+    "docs/terminal-interaction.md",
+    "docs/network-policy.md",
+    "docs/shield.md",
+    "docs/production-operations.md",
+    "examples/energy",
+    "examples/hlm",
+    "containers/runner.Dockerfile",
+    "LICENSE",
+    "THIRD_PARTY_NOTICES.md",
+    "release/contract.json",
+    "release/qriton-ed25519.spki.pem"
+  ],
+  "engines": {
+    "node": "^22.16.0 || >=24.0.0"
+  },
+  "scripts": {
+    "build": "node build.mjs",
+    "dev": "node build.mjs --watch",
+    "start": "node dist/qriton.js",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "node scripts/release-check.mjs --for-publish",
+    "publish:release": "node scripts/publish.mjs",
+    "test": "node test-runner.mjs",
+    "bench:retrieval": "node bench/memory/run-retrieval.mjs",
+    "release:check": "node scripts/release-check.mjs",
+    "bench:coding": "node bench/coding/run.mjs"
+  },
+  "dependencies": {
+    "@anthropic-ai/sdk": "0.125.0",
+    "@qriton/hopfield-anomaly": "4.0.1",
+    "@qriton/shield": "3.3.0",
+    "ink": "7.1.1",
+    "openai": "7.15.0",
+    "react": "19.3.0",
+    "string-width": "8.2.0",
+    "undici": "7.29.1"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "@types/react": "^19.2.0",
+    "esbuild": "^0.28.2",
+    "typescript": "^5.9.0"
+  },
+  "keywords": [
+    "ollama",
+    "xai",
+    "grok",
+    "anthropic",
+    "claude",
+    "openai",
+    "agent",
+    "cli",
+    "tui",
+    "local-llm",
+    "coding-agent",
+    "terminal"
+  ],
+  "license": "MIT",
+  "homepage": "https://qriton.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/qriton/qriton.git"
+  },
+  "bugs": {
+    "url": "https://github.com/qriton/qriton/issues"
+  },
+  "author": "Marius Dima",
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/release/contract.json

@@ -0,0 +1,14 @@
+{
+  "version": "0.3.0",
+  "supportedCodingModel": "local Ollama, plus xAI, Anthropic, OpenAI, and OpenAI-compatible APIs",
+  "codingEvidence": "One session keeps its transcript, tools, and memory graph across those providers. HLM and Energy Language are separate local workbenches.",
+  "localModels": "Optional. A bare qriton command still starts the configured local model. Local models are not the supported coding path.",
+  "executionDefault": "host",
+  "hostExecution": "Approved commands run on this machine.",
+  "containerImage": {
+    "digest": "sha256:1254282e6b7f02875d8b1991052ac71a682f01bf652ee5babb61b8a4b243409e",
+    "status": "not-accepted",
+    "reason": "Optional container toolchain."
+  },
+  "publicKeySha256": "e9baa9aff6f2feda00844b24636468107d34d3e8afb5d05437d821f1ce97fbe6"
+}

package/release/qriton-ed25519.spki.pem

@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAQb8R9fGrAs5nXuE7XWLLy5RemAl4GRuxXc+0HC442Lc=
+-----END PUBLIC KEY-----