threadwire 0.1.12 → 0.1.14

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+- Incrementally spool oversized provider JSONL records to private per-record temporary files after the bounded in-memory threshold, preserving byte order, UTF-8 chunk boundaries, malformed/incomplete-record diagnostics, and the exact absolute record cap while cleaning every per-record spill directory on success, failure, and cancellation. Protocol completion stops same-chunk scanning before any trailing record can exceed the cap or emit output. Ordinary valid provider records are no longer constrained to Telegram display sizes. Container-backed cancellation and failure teardown now retain exact Docker ownership through inspect, bounded TERM stop, terminal-state confirmation, and exact-container KILL escalation; CLI and Telegram deadline cancellation close the request side, await bounded terminal cleanup confirmation, and never treat an HTTP abort as cleanup success. Unconfirmed cleanup remains sealed for reconciliation and can never report success. Direct local-process behavior is unchanged.
+- Extend the checked-in development image with build-time `oc-codex-multi-auth`, DeepSeek OpenAI-compatible, and xAI provider runtimes plus a root-owned secret-free OpenCode catalog for GPT-5.6 Sol/Terra/Luna, DeepSeek V4 Pro/Flash, Grok 4.5/Build/Code Fast, and Kimi K3 through OpenCode's built-in `moonshotai` provider. Kimi K3 keeps its 1,048,576-token context, 131,072-token output limit, default `max` reasoning effort, and `low`/`high`/`max` variants. Compose now requires portable source paths for native Codex auth, OpenCode auth, plugin OAuth, and the plugin's global account pool; refreshable files mount narrowly read-write, GitHub/context mounts stay read-only, per-project Codex account copies are disabled, and OpenCode database/session/cache state remains in the dedicated development home. The UID/GID 1000 initializer creates every nested mount target without receiving credentials. Threadwire remains the worker boundary; direct OpenCode is for authentication, discovery, and bounded smoke checks only.
+
+## 0.1.14 - 2026-08-03
+
+- Fix native Kimi runs hanging after a successful response: terminal completion is now explicit and provider-owned instead of derived only from process exit. Kimi's parser confirms completion from its stream-json protocol — a final assistant response (assistant content without further tool calls) plus the `session.resume_hint` handoff, in either order — and once confirmed, Threadwire preserves the session continuation handle, terminates the attempt-owned provider process group (`SIGTERM`), and emits exactly one `delegated_result`. Success settles only once the entire owned group is gone: a member that survives `SIGTERM` — including an attempt-owned grandchild after the direct provider exits — keeps the grace-period escalation running and receives `SIGKILL` against the exact group (liveness is probed with signal 0 against the group, never name matching or broad scans) before settlement, so no descendant leaks. Normal exit semantics are unchanged: a provider that exits nonzero before protocol completion remains a failure, and long-running tool activity stays unbounded with no generic idle timeout. Cancellation, consumer/relay failure, and launch failure clean up the complete attempt-owned process tree through the detached process group: parent `SIGINT`/`SIGTERM` cancellation now owns grace-period escalation (surviving members are `SIGKILL`ed against the exact group) and settles with the forwarded signal's exit status (never protocol success), and a consumer failure that lands after the direct child closed probes the exact group and terminates/escalates surviving descendants before rejecting the original error. `runWorker` also accepts an explicit `AbortSignal` (wired from the caller launch deadline where one exists): an abort terminates the exact owned group with the same grace/escalation and settles with the abort failure, never success. Settlement after any `SIGKILL` now waits for bounded cleanup confirmation — the exact process group is re-probed (or, where no process group exists such as win32, the direct child's own close is required) before success, failure, or cancellation settles; if owned processes cannot be confirmed gone within the bounded window (`cleanupConfirmationMs`, default 5s), the run settles as a cleanup failure, never success, preserving the original failure or cancellation context. Once the provider protocol confirms completion, the current stdout chunk stops draining immediately so trailing records can never produce duplicate output or consumer failures.
+- Add a checked-in development container: the `app` service in `compose.dev.yaml` builds `docker/Dockerfile.dev` (Ubuntu 26.04 pinned by registry-verified digest, stable non-root `dev` user `1000:1000`, Node 22 LTS from the official SHA-256-verified tarball, distro GitHub CLI, and the npm-latest Codex/Claude/Kimi/OpenCode CLI baseline with Threadwire resolved through unversioned `npx threadwire`). The complete `DEV_HOME_PATH` home is bind-mounted at `/home/dev` with the checkout at `/home/dev/threadwire`, the host GitHub CLI config mounts read-only at `/home/dev/.config/gh` from the required `GH_CONFIG_SOURCE_PATH`, and an immutable agent-context snapshot mounts read-only at `/opt/agent-context` from the required `AGENT_CONTEXT_PATH`; the entrypoint proves the auth mount is read-only, initializes the HTTPS Git credential helper in the writable home, and links the context's AGENTS/CLAUDE guidance and trusted skills into every installed worker's discovery home (`.claude`, `.codex`, `.config/opencode`, `.kimi-code`). A one-shot `home-init` service precreates the provider parent directories as `1000:1000` on blank homes so Docker never creates the nested auth mount's parent root-owned. Project guidance and validation commands are documented in the new `AGENTS.md`. Production runtime files are unchanged.
+- Add the read-only `threadwire capacity` command: it probes live account capacity for authenticated Codex (a bounded `codex app-server` JSON-RPC `initialize` + `account/rateLimits/read` exchange resolved like the Codex worker provider) and Kimi (`GET https://api.kimi.com/coding/v1/usages` with the OAuth bearer read through the hardened credential store's non-mutating `getCurrentAccessToken` — never refreshed, persisted, or tombstoned; a credential inside the 30-second validity margin classifies as `unavailable`), normalizes both into one closed short/long-window schema (`usedPercent`/`remainingPercent`/`resetAt`/duration, floored remaining percent, fail-closed exact-keys validation), and prints exactly one JSON report with per-provider `ok`/`unavailable`/`auth`/`protocol` statuses and a single deterministic admission selection. Selection rejects candidates below configurable short/long reserves (defaults 20%/10%), scores survivors by their most constrained window (absent long window non-constraining), and breaks ties by long-window remaining then provider name, so identical snapshots always reproduce the identical selection; no survivor yields `selection: null` and exit code 2. Tokens, raw credentials, account and plan data, and server error detail never enter output, errors, fixtures, or logs; the command writes nothing to disk, takes no session arguments, and leaves `run`, `evidence`, ingress, brokers, and the isolated runtime byte-identical. Provider/model/session pinning for tasks remains with the external worker ledger; see `docs/capacity-admission.md`.
+
+## 0.1.13 - 2026-08-01
+
 - Remove the default one-hour full-run deadline from the isolated runtime: when `THREADWIRE_ISOLATED_RUNTIME_CLIENT_TIMEOUT_MS` (client) and `THREADWIRE_WORKER_TIMEOUT_MS` (supervisor) are unset or blank, a healthy running worker continues until natural completion, caller cancellation/disconnect, supervisor shutdown, or concrete failure. Setting either to a positive millisecond value enables the existing single absolute preflight+run deadline with unchanged validation and caps. Compose no longer inserts numeric timeout defaults. Preflight admission, per-operation Docker/network calls, state collection (30 seconds), and emergency cleanup stay independently bounded.
 - Add authenticated broker grant-lease renewal (Kimi and Codex): grants are issued as a bounded lease (default 60 seconds, `THREADWIRE_GRANT_LEASE_MS`, capped at one hour) that the supervisor renews via `POST /admin/grants/{token}/renew` while the run is active. Cleanup still revokes explicitly; if the supervisor dies or loses contact, renewals stop and the broker expires and aborts the grant within one lease. Malformed renewals (unknown/expired token, invalid ttlMs, missing admin auth) fail closed without extending the grant, and no renewal route exists on worker endpoints.
 - Add Kimi-only Threadwire binding v1 named-volume admission: task-labelled source/context/lease validation, immutable context manifest validation, offline validator, dynamic task UID/GID workers with context RO/state RW mounts and an exact binding-declared source mount mode, and v5 authenticated binding state. Kimi path/worktree preflights and supervisor host workspace/socket mounts are no longer accepted.
@@ -12,6 +23,19 @@
 - Reconcile exact relay/worker/network/state/grant identity on restart: genuine resources are adopted and cleaned up by their exact sealed spec, while image, mount, network, or environment tampering fails closed and retains authenticated cleanup evidence. The sealed Kimi worker/validator/relay image is the resolved image content Id (the worker/validator pin the binding's `contextImageId`; the relay pins its inspected image Id), matching how Docker normalizes a created container's `Config.Image`, so a genuine crash survivor is recognized rather than retained as a cleanup failure. The validator and relay environments accept legitimate non-sensitive keys inherited from the image while every owned key must match its sealed value exactly once and any injected sensitive or controlled key fails closed.
 - Qualify genuine separate-daemon fresh/resume/denial/read-only/concurrency operation with zero residue: adversarial split-daemon E2E proves exact resume, read-only review mounts, binding/argument denial, concurrent task isolation, and complete relay/network/state cleanup on the task DinD.
 
+- Remove workspace profiles from normal provider execution. `--cwd` now passes
+  any caller-accessible directory directly to Codex, Claude, Kimi, and
+  OpenCode; no Git, source identity, task binding, or root-allowlist lookup is
+  performed. `--workspace-profile` is rejected—migrate invocations to
+  `--cwd <directory>`. Native Kimi is the default path, supports
+  `THREADWIRE_KIMI_BIN`, translates exact `--resume-session` values to Kimi's
+  native `--session` option, and passes compatible provider arguments while
+  Threadwire retains prompt and stream-output ownership. The optional isolated
+  Kimi path remains explicit and fail-closed without native fallback.
+- Preserve only the explicit caller-owned native Kimi configuration contract,
+  report exactly one completed or failed terminal lifecycle outcome, and reject
+  provider option terminators that could neutralize Threadwire-owned arguments.
+
 ## 0.1.10 - 2026-07-28
 
 - Accept official slash-qualified Kimi model aliases through workspace-free

package/README.md

@@ -1,6 +1,6 @@
 # Threadwire
 
-Threadwire is a Node.js CLI that launches a Codex, Claude, or OpenCode worker and streams a concise, human-readable activity feed to one explicitly selected Telegram destination: a direct message, normal chat, or forum topic. The default feed includes the assistant's response prose, lifecycle outcomes, and diagnostics. Provider tool-status messages are disabled by default.
+Threadwire is a Node.js CLI that launches a Codex, Claude, Kimi, or OpenCode worker and streams a concise, human-readable activity feed to one explicitly selected Telegram destination: a direct message, normal chat, or forum topic. The default feed includes the assistant's response prose, lifecycle outcomes, and diagnostics. Provider tool-status messages are disabled by default.
 
 For the container-native webhook deployment, including its named-volume worktree,
 non-root Codex provider, Docker secrets, loopback TLS proxy, verification, and
@@ -8,8 +8,7 @@ rollback path, see [Container runtime](docs/container-runtime.md). The legacy
 host launcher below remains supported and is separate from that deployment.
 
 Relay-originated Codex writes are explicit and default off. `--relay-write`
-requires a reviewed `--workspace-profile` plus the root-owned isolated runtime
-and credential broker. The worker gets one writable task worktree, no upstream
+selects the optional root-owned isolated runtime and credential broker. The worker gets one writable task worktree, no upstream
 or Git credential, and no route except its run-scoped broker. Missing
 prerequisites fail before prompt or credential reads with no native fallback.
 The isolated runtime imposes no default full-run deadline: a healthy running
@@ -71,11 +70,11 @@ Use the local launcher. Install or refresh it after updating Threadwire with `np
 
 The target always has the form `telegram:<chat-id>:<thread-id>` for topics, or `telegram:<chat-id>` for direct messages (DMs) and ordinary chats. The chat ID is always required and must be a nonzero signed integer. The thread ID is optional and valid only as the explicit topic suffix: when present it must be a positive safe integer, and a DM target simply omits it — a missing thread ID is never an error. `--provider` must be exactly one of `codex`, `claude`, `kimi`, or `opencode`. Malformed or missing provider, chat ID, or thread ID arguments are hard failures (exit code 2) reported through Threadwire's normal error path with fixed messages; they fail before the Telegram token is read, before any transport is created, and before any provider is launched, and the messages never echo the bot token or the untrusted argument value. `--process-number` accepts an explicit positive safe integer for automation; when omitted, Threadwire uses its launcher PID. Every Telegram message is labeled consistently, such as `[P42] …`, including chunked continuations.
 
-Pass `--workspace-profile <name>` only when invoking Threadwire inside the container-native runtime, for example with `node bin/threadwire.js run` as shown in [Container runtime](docs/container-runtime.md). A profile selects a reviewed entry from the checked-in [threadwire.workspace-profiles.json](threadwire.workspace-profiles.json). Non-Kimi providers resolve the reviewed in-container repository path and Git provenance. Kimi instead requires the v2 `threadwire-v1` profile marker and a trusted `THREADWIRE_KIMI_TASK_BINDING`; it never accepts a repository path preflight. The binding names the task-owned source/context volumes, immutable context digests, revision, runtime identity, and live lease. Only safe provenance is recorded locally.
+`--cwd` is the complete workspace contract for every provider. It may name any caller-accessible directory, including a non-Git directory. Threadwire passes it unchanged to the native provider and performs no profile, repository, source-identity, task-binding, or root-allowlist lookup. `--workspace-profile` has been removed and is rejected; migrate invocations by replacing it with `--cwd <directory>`.
 
-Provider tool-start and tool-finish events do not produce Telegram messages by default. Pass the boolean `--tool-messages` flag to opt in, as shown above. When enabled, each tool is one concise, silent status line rather than a pair of noisy start/finish notices: when a tool starts, Threadwire sends `🛠 [P42] Tool: <safe command or tool description>` (for example `🛠 [P42] Tool: command — git status --short`), and when that same tool finishes, it edits the original message in place so it begins `✅` instead — no second completion message is sent, and Telegram edits raise no notification. The command/description shows a safe CLI-style preview with credential-bearing values (tokens, passwords, keys, authorization/cookie forms, credentials in URLs) redacted and control characters stripped; only normalized Codex command-completion output may also be appended to that same edited status as a Telegram-native expandable HTML blockquote with the visible label `Output →`; it is credential-redacted, HTML-escaped, and Unicode-safe bounded. Stderr, reasoning, and every other raw provider result remain excluded. Use `--max-output-length <positive-integer>` to truncate only that preview Unicode-safely; omit the option for unlimited tool detail. A prompt may instead come from `--prompt-file` or piped stdin, and every source rejects blank/whitespace content. Arguments following `--` pass to the selected provider, except output-stream options owned by Threadwire. Kimi is narrower: it always uses the dedicated isolated subscription runtime and accepts only one server-approved model alias through `--model <alias>` (or `-m <alias>`); Threadwire owns its prompt, output, session, permissions, configuration, tools, skills, plugins, MCP, and directories.
+Provider tool-start and tool-finish events do not produce Telegram messages by default. Pass the boolean `--tool-messages` flag to opt in, as shown above. When enabled, each tool is one concise, silent status line rather than a pair of noisy start/finish notices: when a tool starts, Threadwire sends `🛠 [P42] Tool: <safe command or tool description>` (for example `🛠 [P42] Tool: command — git status --short`), and when that same tool finishes, it edits the original message in place so it begins `✅` instead — no second completion message is sent, and Telegram edits raise no notification. The command/description shows a safe CLI-style preview with credential-bearing values (tokens, passwords, keys, authorization/cookie forms, credentials in URLs) redacted and control characters stripped; only normalized Codex command-completion output may also be appended to that same edited status as a Telegram-native expandable HTML blockquote with the visible label `Output →`; it is credential-redacted, HTML-escaped, and Unicode-safe bounded. Stderr, reasoning, and every other raw provider result remain excluded. Use `--max-output-length <positive-integer>` to truncate only that preview Unicode-safely; omit the option for unlimited tool detail. A prompt may instead come from `--prompt-file` or piped stdin, and every source rejects blank/whitespace content. Arguments following `--` pass to the selected provider, except output-stream and session options owned by Threadwire. Native Kimi uses the caller's compatible configuration. Threadwire maps its public `--resume-session <exact-id>` option to Kimi's native `--session <exact-id>` option and owns `--prompt` plus `--output-format stream-json`. The caller environment or image must provide the Kimi executable at `/usr/local/bin/kimi` or set `THREADWIRE_KIMI_BIN`; a missing executable fails normally.
 
-Threadwire directly spawns the structurally separate terminal adapters `/opt/data/libexec/threadwire/codex`, `/opt/data/libexec/threadwire/claude`, or `/opt/data/libexec/threadwire/opencode-local-fleet` with an argv array and `shell: false`. These libexec adapters hold the real provider-CLI logic and are never on a worker's `PATH`, so relaying can never recurse back into the front-door shims. Each spawn also sets `THREADWIRE_ACTIVE=1` in the provider child environment. The executable can be overridden per provider with `THREADWIRE_CODEX_BIN`, `THREADWIRE_CLAUDE_BIN`, or `THREADWIRE_OPENCODE_BIN` for staged cutover and rollback. It does not impose a worker timeout. `SIGINT` and `SIGTERM` are forwarded to the worker as explicit cancellation.
+Threadwire directly spawns the structurally separate terminal adapters `/opt/data/libexec/threadwire/codex`, `/opt/data/libexec/threadwire/claude`, `/usr/local/bin/kimi`, or `/opt/data/libexec/threadwire/opencode-local-fleet` with an argv array and `shell: false`. These libexec adapters hold the real provider-CLI logic and are never on a worker's `PATH`, so relaying can never recurse back into the front-door shims. Each spawn also sets `THREADWIRE_ACTIVE=1` in the provider child environment. The executable can be overridden per provider with `THREADWIRE_CODEX_BIN`, `THREADWIRE_CLAUDE_BIN`, `THREADWIRE_KIMI_BIN`, or `THREADWIRE_OPENCODE_BIN` for staged cutover and rollback. It does not impose a worker timeout. `SIGINT` and `SIGTERM` are forwarded to the worker as explicit cancellation. Terminal completion is explicit and provider-owned rather than derived only from process exit: native Kimi confirms a completed run with a final assistant response (assistant content without further tool calls) plus its session handoff record in the stream. Once both records are confirmed, Threadwire preserves the session continuation handle, terminates the attempt-owned provider process group (`SIGTERM`), and emits exactly one `delegated_result`. Success settles only once the entire owned group is gone: members that survive `SIGTERM` — including attempt-owned grandchildren — keep the grace-period escalation running and receive `SIGKILL` against the exact group before settlement, so no descendant is leaked even when the direct provider exits first. A provider that exits nonzero before its protocol confirms completion keeps its failure status, and long-running tool activity remains unbounded: there is no generic idle timeout, only caller cancellation or an explicit deadline. Parent `SIGINT`/`SIGTERM` is owned cancellation, not just forwarding: the signal reaches the exact attempt-owned group, surviving members are escalated to `SIGKILL` after the grace period, and settlement keeps the forwarded signal's exit status (143/130 on Linux) only after the owned tree is gone. Relay/consumer failure cleans up the same owned tree — even when the failure lands after the direct child closed and only descendants survive — and the worker runner also accepts an explicit `AbortSignal`: an abort terminates the exact attempt-owned group with the same grace/escalation and settles with the abort failure, never success. After any `SIGKILL`, settlement waits for bounded cleanup confirmation — the exact group is re-probed, or on platforms without process groups the direct child's close is required — and cleanup that cannot be confirmed within the bounded window settles as failure, never success; this confirmation bound is not an idle or tool-activity timeout.
 
 ## Provider front-door shims
 
@@ -83,11 +82,11 @@ Threadwire directly spawns the structurally separate terminal adapters `/opt/dat
 
 The relay contract: the caller supplies `THREADWIRE_TARGET` (`telegram:<chat-id>` or `telegram:<chat-id>:<thread-id>`) and, optionally, `THREADWIRE_PROCESS_NUMBER`. The prompt arrives on a piped stdin; all native provider flags pass through after `--`. A positional prompt is never parsed. A missing `THREADWIRE_TARGET` fails closed (exit code 2) and a malformed one is rejected by the launcher's token-free preflight — the shim never invents a default destination and never silently downgrades a requested relay to a direct run. A shim relays only for a worker mode (`codex exec …`, `opencode-local-fleet run …`, or any non-interactive `claude …`); it drops the worker subcommand before relaying and Threadwire re-adds it around the prompt. Version and help queries, non-worker subcommands, interactive TTY sessions, and any invocation already inside a relayed run (`THREADWIRE_ACTIVE=1`, so nested provider workers stay local/native) run the real CLI directly through the libexec adapter.
 
-Pass `--resume-session <exact-provider-session-id>` to continue a stored Codex, Claude, or OpenCode session. Threadwire preserves the provider's native resume ordering and streaming options and never uses implicit latest-session behavior.
+Pass `--resume-session <exact-provider-session-id>` to continue a stored Codex, Claude, Kimi, or OpenCode session. Threadwire preserves the provider's native resume ordering and streaming options and never uses implicit latest-session behavior.
 
 Pass `--transcript <path>` to capture the exact normalized, caller-facing JSONL protocol written to run stdout. The file is created privately (mode `0600`), must not already exist, and contains the same records in the same byte order as stdout. It never contains provider JSONL, reasoning, tool payloads, prompts, stderr, or credentials.
 
-`--activity-log <path>` is different: it retains its append contract and writes only minimal safe lifecycle facts—the selected workspace profile and immutable provenance, provider start (`provider`, child `pid`), and available native session ID. It is local-only and never enters Telegram or normalized stdout.
+`--activity-log <path>` is different: it retains its append contract and writes only minimal safe lifecycle facts—provider start (`provider`, child `pid`) and available native session ID. It is local-only and never enters Telegram or normalized stdout.
 
 Provider stdout is decoded as JSONL with a finite 1 MiB UTF-8 byte limit for each pending unterminated record. Exceeding it rejects the run, removes listeners and signal handlers, and terminates the provider without parsing or rendering the oversized content.
 
@@ -95,6 +94,8 @@ For normal `threadwire run` execution, Threadwire stdout is the parent-model adm
 
 Scoped raw evidence artifacts are separate from both files above. Set the trusted operator setting `THREADWIRE_EVIDENCE_ROOT` for standalone runs to persist the delegated prompt and raw provider stdout/stderr as a scoped file-backed artifact; Telegram ingress uses its dedicated evidence volume automatically. The parent or owning Telegram topic receives only an opaque bearer handle. Retrieve later with `threadwire evidence read` or the authenticated `/evidence` Telegram command and an explicit bounded selector. See [Evidence artifacts](docs/evidence-artifacts.md) for permissions, quotas, retention, recovery, authorization, redaction, privacy, and cleanup behavior.
 
+`threadwire capacity` is a read-only reporting command that probes live account capacity for authenticated Codex (`codex app-server` JSON-RPC `account/rateLimits/read`) and Kimi (`GET https://api.kimi.com/coding/v1/usages` with the installed OAuth credential), normalizes both into one closed short/long-window schema, and prints one deterministic reserve-gated admission selection as a single JSON document. It persists nothing, never prints tokens or account data, takes no session arguments, and does not change `run` provider selection; an external worker ledger consumes the report and owns pinning provider/model/session. See [Capacity admission](docs/capacity-admission.md) for the schema, tie-break, error taxonomy, and security boundary.
+
 Telegram is the separate user-visible progress plane. Lifecycle notices, diagnostics, tool activity, and assistant streaming continue there independently; `--tool-messages` affects only Telegram. Execution-environment details, provider records and streams, lifecycle progress, diagnostics, tool names/arguments/details/output, stderr, prompts, narration/reasoning, and full transcripts never enter stdout. Threadwire's bounded error diagnostic remains on stderr. Help output is the sole non-run, human-readable stdout mode. This default is an intentional pre-1.0 protocol break from the former mixed Hermes JSONL stream.
 
 The Telegram bot token is used only by Threadwire's notifier and both `TELEGRAM_BOT_TOKEN` and `THREADWIRE_TELEGRAM_BOT_TOKEN` are removed from every provider child environment. The three libexec adapters repeat that scrub as defense in depth. Other environment variables, including the providers' own authentication and normal process configuration, are preserved. Outbound Telegram fetch and response-body parsing share a 30-second deadline by default; set `THREADWIRE_TELEGRAM_REQUEST_TIMEOUT_MS` to a positive safe integer no greater than `2147483647` to override it.
@@ -107,6 +108,11 @@ The delivery queue has finite defaults of 100 pending notices and 256 KiB of pen
 
 ## Development
 
+The checked-in development container is the `app` service in `compose.dev.yaml`
+(Ubuntu 26.04 pinned by digest, non-root `1000:1000`, Node 22 LTS, npm-latest
+coding CLI baseline). Setup, the read-only GitHub CLI and agent-context mount
+contracts, and container commands are documented in [AGENTS.md](AGENTS.md).
+
 Tests use synthetic provider records, a local fixture child, and injected transports. They never invoke Codex, Claude, or Telegram.
 
 ```sh

package/TELEGRAM-INGRESS.md

@@ -1,10 +1,10 @@
 # Telegram Ingress for Threadwire
 
 Standalone Threadwire webhook service that accepts Telegram Bot API updates.
-Codex, Claude, and OpenCode retain the existing worker behavior. Kimi always
-uses its dedicated isolated preflight/run authority with no native fallback;
-a missing Kimi runtime fails before provider or transport construction. Hermes
-is not involved.
+Codex, Claude, Kimi, and OpenCode use their native provider adapter by default.
+An operator may explicitly configure the Kimi isolated client; that selected
+path remains fail-closed and never falls back to native execution. Hermes is
+not involved.
 
 ## Important bot ownership
 
@@ -83,9 +83,9 @@ Optional:
 | `THREADWIRE_TELEGRAM_REQUEST_TIMEOUT_MS` | Deadline for each outbound Telegram request, including response parsing (default `30000`, positive safe integer no greater than `2147483647`) |
 | `THREADWIRE_UPDATE_ID_CAPACITY` | Max retained completed `update_id` entries (default `10000`) |
 | `THREADWIRE_UPDATE_ID_TTL_MS` | Retention TTL for completed `update_id` entries in ms (default `86400000`) |
-| `THREADWIRE_KIMI_ISOLATED_RUNTIME_URL` | Dedicated Kimi supervisor URL; Compose defaults to `http://kimi-isolated-runtime:8790` |
-| `THREADWIRE_KIMI_ISOLATED_RUNTIME_CONTROL_TOKEN` | Dedicated Kimi control token. When absent, `/code kimi` remains recognized but fails closed before launch. |
-| `THREADWIRE_KIMI_TASK_BINDING` | Trusted closed Threadwire binding v1 JSON. It is captured before provider filtering, sent only to Kimi preflight, and is never forwarded to a provider or worker. |
+| `THREADWIRE_KIMI_ISOLATED_RUNTIME_URL` | Optional dedicated Kimi supervisor URL, used only with an explicit control token. |
+| `THREADWIRE_KIMI_ISOLATED_RUNTIME_CONTROL_TOKEN` | Selects the optional dedicated Kimi isolation client. Without it, `/code kimi` runs natively. |
+| `THREADWIRE_KIMI_TASK_BINDING` | Optional trusted binding used only by the explicitly selected Kimi isolation client; native Kimi never reads it. |
 | `THREADWIRE_ISOLATED_RUNTIME_CLIENT_TIMEOUT_MS` | Optional absolute preflight+run deadline in ms for isolated (Codex relay-write and Kimi) runs. Empty/unset means no full-run deadline: a healthy running worker is never stopped merely because time elapsed. The supervisor-side equivalent is `THREADWIRE_WORKER_TIMEOUT_MS`. Broker grants always use a bounded lease renewed by the supervisor while the run is active, expiring within one lease if the supervisor dies; unrelated safety timeouts are unchanged. |
 
 ## Run

package/docs/capacity-admission.md

@@ -0,0 +1,147 @@
+# Capacity admission
+
+`threadwire capacity` probes live account capacity for the authenticated Codex
+and Kimi providers, normalizes both into one closed schema, and makes a single
+deterministic admission selection. It is a read-only reporting command: it
+writes nothing to disk, changes no provider or runtime state, and never
+launches, resumes, or selects a session. An external worker ledger consumes
+the report and owns pinning the selected provider, model, and native session
+across planning, implementation, debugging, and corrections; Threadwire
+deliberately has no task-ledger ownership, no `--provider auto`, and no
+capacity-based selection inside `threadwire run`.
+
+## Command
+
+```
+threadwire capacity [--provider <codex|kimi>]...
+                    [--short-reserve-percent <0-100>]   # default 20
+                    [--long-reserve-percent <0-100>]    # default 10
+                    [--timeout-ms <positive-integer>]   # default 15000
+```
+
+Stdout carries exactly one JSON document:
+
+```json
+{
+  "version": 1,
+  "generatedAt": "2026-08-02T00:00:00.000Z",
+  "reserves": {"shortPercent": 20, "longPercent": 10},
+  "candidates": [
+    {
+      "provider": "codex",
+      "status": "ok",
+      "windows": {
+        "short": {"usedPercent": 40, "remainingPercent": 60, "resetAt": "2026-08-02T00:00:00.000Z", "windowDurationSeconds": 18000},
+        "long": {"usedPercent": 10, "remainingPercent": 90, "resetAt": "2026-08-09T00:00:00.000Z", "windowDurationSeconds": 604800}
+      }
+    }
+  ],
+  "rejected": [{"provider": "kimi", "reason": "auth"}],
+  "selection": {"provider": "codex", "score": 60}
+}
+```
+
+Exit code is `0` when `selection` is non-null and `2` for invalid arguments or
+when no candidate survives; the report is still printed in the latter case.
+`generatedAt` is the only wall-clock field: the same `candidates` and
+`reserves` always reproduce the same `selection`, so the caller can re-verify a
+pin before relying on it.
+
+## Probes and normalization
+
+- **Codex** spawns `codex app-server` and runs a bounded two-request JSON-RPC
+  exchange over stdio: `initialize`, then `account/rateLimits/read`. The
+  executable resolves via `THREADWIRE_CODEX_BIN` or the default libexec
+  adapter, exactly like the Codex worker provider; the anti-recursion default
+  is unchanged, so native container callers point the existing safe override
+  at the real CLI (for example `THREADWIRE_CODEX_BIN=/usr/local/bin/codex`).
+  Only the quota projection of the result is parsed: `rateLimits.primary` maps
+  to `short` and `rateLimits.secondary` to `long`; a `null` secondary yields a
+  short-only snapshot, and a secondary shorter than the primary fails closed.
+  Each window requires exactly `usedPercent`, `windowDurationMins`, and
+  `resetsAt` (epoch seconds, normalized to the canonical `resetAt` output
+  field); missing, obsolete, or extra keys fail closed, and unrelated result
+  or `rateLimits` metadata is neither read nor propagated.
+- **Kimi** calls `GET https://api.kimi.com/coding/v1/usages` with the OAuth
+  bearer from the installed Kimi credential store, loaded through the same
+  hardened store as the model broker. The credential file resolves in order: a
+  non-empty absolute `THREADWIRE_KIMI_OAUTH_FILE` override, then the installed
+  CLI's canonical `${KIMI_CODE_HOME}/credentials/kimi-code.json`, then the
+  vendor default `${HOME}/.kimi-code/credentials/kimi-code.json`; missing,
+  relative, or NUL-containing candidates never qualify and resolution fails
+  closed as `auth` without logging any path. Only the quota projection of the
+  response is parsed: top-level `usage` is the long account quota (documented
+  weekly duration of 604,800 seconds) and the shortest `limits[]` window maps
+  to `short`; every returned window is validated (`window.duration` in
+  `TIME_UNIT_MINUTE`s, `detail` quota) but intermediate windows are ignored,
+  and normalization fails closed if the long duration would not exceed the
+  short. Quota fields are strict non-negative decimal strings validated with
+  `used + remaining === limit` and a positive limit, reset times must be
+  bounded ISO-8601, and remaining percent is floored so normalization never
+  overstates capacity. Unrelated top-level response fields are neither read
+  nor propagated into output or errors.
+
+Both probes are bounded (capped lines/bytes, single absolute timeout) and fail
+closed on any shape drift: exact keys within the parsed projection, forced
+types, `0–100` percents, positive bounded durations, and reset times
+normalized to ISO-8601 UTC.
+
+## Selection semantics
+
+`selectProvider` is pure (no I/O, no clock):
+
+1. Candidates whose `status` is not `ok` are rejected with their status as the
+   reason (`unavailable`, `auth`, or `protocol`).
+2. A candidate is rejected with `short-reserve` when its short-window
+   `remainingPercent` is below `shortPercent`, and with `long-reserve` when a
+   present long window is below `longPercent`. An absent long window is
+   non-constraining. A remaining percent equal to the reserve passes.
+3. Survivors are scored by their most constrained window:
+   `min(shortRemaining, longRemaining)` with an absent long window counting as
+   100.
+4. Ordering is total and deterministic: score descending, then long-window
+   remaining descending, then provider name ascending (`codex` before `kimi`).
+5. No survivor yields `selection: null` and exit code `2`.
+
+## Error taxonomy
+
+Per provider, independently of the other:
+
+- `ok` — a normalized snapshot was produced.
+- `unavailable` — transport failure, timeout, spawn failure, early child exit,
+  5xx, or OAuth refresh unavailability.
+- `auth` — 401/403, logged-out (tombstone) Kimi credentials, missing Kimi
+  credential configuration, or a Codex server-side authentication rejection.
+- `protocol` — malformed JSON, wrong content type, JSON-RPC error, out-of-order
+  exchange, or any response shape drift.
+
+## Security boundary
+
+- Tokens and raw credentials are used in-process only and are never printed,
+  persisted, or embedded in errors. The Kimi bearer is read through
+  `openKimiOAuthStore`'s non-mutating `getCurrentAccessToken` (returned only
+  while valid beyond a fixed 30-second safety margin): the probe never
+  refreshes, persists, renames, or tombstones credentials, and a credential
+  inside the margin classifies as `unavailable` with a fixed message. Probe
+  failures use the store's fixed-message discipline with no causes. Codex
+  server error detail (which can carry account material) is inspected for
+  classification only and never propagated.
+- The report schema is closed and carries only provider names, statuses, fixed
+  messages, and window numbers — no account IDs, plan names, emails, tokens, or
+  raw response bodies. Committed test fixtures contain sanitized structure with
+  representative numeric values only.
+- The Codex child is always killed (success, error, and timeout), its stderr is
+  consumed but never forwarded, and the exchange is bounded. Kimi requests use
+  `redirect: "error"`, strict JSON content-type, and a capped body read.
+- The command introduces no new environment variables and no persistence, so
+  the existing evidence redaction sweep is unaffected.
+
+## Ledger contract
+
+The external worker ledger calls `threadwire capacity`, verifies the report,
+and pins the selected provider, the model (from its own allowlists — capacity
+is account-level and Threadwire performs no model selection), and the native
+session for the task. Resumed sessions and correction runs reuse that pin and
+must not re-run admission; `threadwire capacity` takes no session arguments and
+`threadwire run` explicit-provider and `--resume-session` behavior is
+unchanged.

package/docs/container-runtime.md

@@ -84,16 +84,13 @@ docker compose exec -T threadwire sh -c 'test "$(id -u):$(id -g)" = 10001:10001
 
 Telegram commands derive their explicit destination from the authenticated
 update. A credentialed direct smoke test must also name a target explicitly and
-keeps both credentials mounted as secret files. The checked-in
-`container-runtime` workspace profile points to the bootstrapped
-`/workspace/threadwire` worktree inside the current runtime, so `threadwire run`
-selects that reviewed in-container workspace directly rather than deriving a
-path from ambient host state or Telegram input:
+keeps both credentials mounted as secret files. Direct execution supplies the
+caller-accessible working directory explicitly:
 
 ```sh
 node bin/threadwire.js run \
   --provider codex --target telegram:-1001234567890:42 \
-  --workspace-profile container-runtime \
+  --cwd /workspace/threadwire \
   --prompt 'Inspect the container worktree.'
 ```
 
@@ -114,27 +111,11 @@ permissions that deny the provider, or move it to a separate container or
 sandbox. The same-UID, same-container, capability-free design cannot truthfully
 provide that stronger boundary.
 
-With `--workspace-profile`, `threadwire run` emits one caller-facing
-`execution_environment` JSONL record before provider startup. It includes only
-the resolved profile name, in-container repository path, exact Git revision,
-and immutable worktree identity; it never includes Telegram or provider
-credentials.
-
-The same reviewed profile file also governs authenticated webhook launches. The
-default profile is selected server-side; Telegram message text never supplies a
-raw path, container identifier, executable path, Git URL, or environment
-assignment. Before every spawn, Threadwire verifies that the configured
-workspace still exists, is still a Git worktree at the configured root, and
-still has a stable revision/worktree identity. If the worktree is removed or
-unhealthy, spawn fails before the provider starts so Telegram can retry after
-remediation.
-
-Provision profile changes and revision updates entirely inside the container
-worktree. Edit `threadwire.workspace-profiles.json` in `/workspace/threadwire`,
-commit the reviewed change in that worktree, and let the existing bootstrap and
-rollback flow move the whole repository plus its `.threadwire-source-identity`
-forward or backward together. Do not introduce host-only paths, Docker CLI
-arguments, or Compose-generated container names into the profile file.
+`--workspace-profile` is removed and rejected. Threadwire does not inspect Git,
+source identity, task binding, or workspace allowlists for normal provider
+launches. Telegram ingress uses its own process working directory unless its
+operator supplies another caller-accessible directory through the embedding
+configuration; Telegram message text never supplies a path.
 
 ## Verification and leakage audit
 
@@ -205,10 +186,13 @@ Never export or archive mounted secret files with workspace/provider backups.
 
 Kimi source is not a host worktree. The task controller creates one labelled source named volume (including its `.git` directory), one labelled immutable context named volume, and a running labelled lease container. The trusted Kimi supervisor reaches only the owning task-DinD API through `THREADWIRE_KIMI_TASK_DOCKER_HOST`; it has no workspace bind or outer Docker socket. It verifies the closed binding, exact labels/volume identities, lease image/user/workdir/mounts, references, Git revision, and manifest before issuing a broker grant. The worker has exactly the binding-declared source mount at `/workspace` (read-write for implementation sources, read-only for review sources), context RO at `/context`, and lineage state RW at `/state`. The worker entrypoint independently revalidates the mounted context manifest task/image identity and the exact source mount mode before Kimi starts; a mismatched manifest task identity or mount mode fails the run closed.
 
-Kimi is intentionally excluded from the same-UID container-native provider
-launch described above. Never mount `threadwire-kimi-oauth`, its access/refresh
-tokens, or the auth home into the Threadwire runtime, supervisor, worker,
-workspace, or session-state volume. Kimi uses five immutable build targets:
+The checked-in standard `runtime` image installs Codex only: it does not install
+Kimi or provide Kimi credentials. Native Kimi therefore requires a caller image
+or environment that provides `/usr/local/bin/kimi` (or sets
+`THREADWIRE_KIMI_BIN`); a missing executable fails normally. Never mount
+`threadwire-kimi-oauth`, its access/refresh tokens, or the auth home into the
+Threadwire runtime, supervisor, worker, workspace, or session-state volume.
+The optional isolated Kimi flow uses five immutable build targets:
 `kimi-auth`, `kimi-model-broker`, `kimi-model-relay`, `kimi-relay-worker`, and
 `isolated-runtime`.
 The first two share UID/GID 10003 and only the OAuth volume; the credential-free
@@ -239,9 +223,9 @@ listener until an explicit nonempty bind is configured, so the sentinel is
 never an operational default.
 Only the worker port is published, on that bind — the admin endpoint stays on
 the internal control network.
-The default workspace profile allowlists Kimi because isolation is mandatory;
-without the dedicated Kimi control token/client, both CLI and Telegram Kimi
-jobs fail closed rather than using the native child path. Keep broker egress
+The optional Kimi supervisor is selected only by its dedicated control
+token/client. Without that explicit selection, CLI and Telegram Kimi jobs use
+the native child path and caller/provider configuration. Keep broker egress
 restricted to official Kimi Code subscription/auth endpoints and do not provide
 a Moonshot API key, custom base URL, Docker socket, or ingress secret.
 

package/docs/development-container.md

@@ -0,0 +1,77 @@
+# Development container
+
+`compose.dev.yaml` provides the persistent `app` service for Threadwire
+development. It is separate from the production runtime definitions. The image
+installs Codex CLI, Claude Code CLI, the official Kimi Code CLI, OpenCode,
+`oc-codex-multi-auth`, `@ai-sdk/openai-compatible`, and `@ai-sdk/xai` during the
+Docker build. Runtime setup never downloads a plugin through `npx`.
+
+## Source paths
+
+All source paths in `.env` are required and have no checked-in host defaults:
+
+- `DEV_HOME_PATH` is the complete dedicated development home. It remains the
+  owner of OpenCode database, session, log, and cache state.
+- `GH_CONFIG_SOURCE_PATH` is the GitHub CLI config directory and mounts
+  read-only.
+- `CODEX_AUTH_SOURCE_PATH` is native Codex's `auth.json` and mounts read-write
+  so OAuth refreshes persist to its canonical owner.
+- `OPENCODE_AUTH_SOURCE_PATH` is OpenCode's native `auth.json`. DeepSeek, xAI,
+  and Moonshot AI keys are entered with OpenCode's auth flow and persist
+  through this read-write file mount.
+- `OPENCODE_CODEX_STATE_SOURCE_PATH` is the plugin's dedicated state directory,
+  containing the OpenAI OAuth file and global account pool. It mounts
+  read-write as a directory because pool updates use atomic sibling-file
+  replacement.
+- `AGENT_CONTEXT_PATH` is the immutable agent-context snapshot and mounts
+  read-only.
+
+Hermes owns the canonical credential files. Do not copy them into the checkout,
+the image, or project-keyed task-home files. The app sets
+`CODEX_AUTH_PER_PROJECT_ACCOUNTS=0`, so `oc-codex-multi-auth` uses its one
+global mounted account pool rather than creating per-project credential copies.
+
+## OpenCode catalog
+
+The image-owned `/usr/local/share/threadwire-dev/opencode.json` is root-owned,
+read-only, secret-free, and selected with OpenCode's supported
+`OPENCODE_CONFIG` mechanism. It exposes:
+
+- OpenAI OAuth through `oc-codex-multi-auth`: `gpt-5.6-sol`,
+  `gpt-5.6-terra`, and `gpt-5.6-luna`.
+- DeepSeek through `@ai-sdk/openai-compatible` at
+  `https://api.deepseek.com/v1`: `deepseek-v4-pro` and
+  `deepseek-v4-flash`.
+- xAI through `@ai-sdk/xai`: `grok-4.5`, `grok-build-0.1`, and
+  `grok-code-fast-1`.
+- Kimi K3 through OpenCode's built-in `moonshotai` provider: `kimi-k3` with
+  its 1,048,576-token context, 131,072-token output limit, default `max`
+  reasoning effort, and explicit `low`, `high`, and `max` variants.
+
+Provider keys never belong in Compose environment values or the image config.
+Use `opencode auth login` to update the mounted OpenCode auth store, including
+the canonical Moonshot credential under provider ID `moonshotai`. Direct
+OpenCode invocation is limited to auth, `opencode models <provider>` discovery,
+and bounded smoke checks. Threadwire remains the worker execution and streaming
+boundary for development tasks.
+
+## Startup
+
+Run the profile-free initializer before Docker creates the app container:
+
+```sh
+docker compose -f compose.dev.yaml up --build home-init
+docker compose -f compose.dev.yaml --profile app up --detach
+```
+
+`home-init` runs as `1000:1000`, mounts only `DEV_HOME_PATH`, and precreates
+every nested directory and file mount target. It receives no auth or context
+mounts.
+
+Run project commands in the persistent app service:
+
+```sh
+docker compose -f compose.dev.yaml exec app npm ci
+docker compose -f compose.dev.yaml exec app node --test test/container-dev.test.js
+docker compose -f compose.dev.yaml exec app npm run lint
+```

package/docs/isolated-provider-runtime.md

@@ -1,7 +1,7 @@
 # Isolated provider runtime
 
 Relay-originated Codex writes are disabled unless the caller supplies both
-`--relay-write` and a reviewed `--workspace-profile`. The write path never
+`--relay-write` and an explicitly selected supervisor. The write path never
 falls back to the native provider launcher.
 When the Telegram service is configured with isolated-runtime authority, Codex
 webhook jobs use the same preflight/run boundary exclusively; an unavailable
@@ -155,7 +155,15 @@ by that script. E2E uses host-volume canaries and fake-upstream authorization
 logs; worker self-report is not the sole assertion.
 
 
-## Native Kimi Code subscription boundary
+## Optional isolated Kimi Code subscription boundary
+
+Normal `threadwire run --provider kimi` is native execution: it directly runs
+the caller-provided Kimi executable at `/usr/local/bin/kimi`, or the path in
+`THREADWIRE_KIMI_BIN`. It does not select this isolated supervisor, broker, or
+model allowlist. The checked-in standard `runtime` image installs Codex only,
+so native Kimi needs a caller-supplied executable and fails normally when it is
+missing. The remaining section documents the separately configured, optional
+isolated Kimi supervisor.
 
 Kimi binding v1 is separate from the Codex worktree contract. A Kimi preflight contains `binding`, never `repositoryRoot` or `cwd`. The supervisor queries the task-DinD daemon for exactly one labelled source volume, context volume, and running lease, rejects ambiguity/RW context references, validates the lease and worker image, then uses an offline two-volume validator to check the real Git revision and complete immutable context manifest. Only after that does it create the per-run data plane on the task daemon: a private internal worker network, a task-owned non-internal egress network, one credential-free relay attached to both, and a three-volume Kimi worker attached only to the internal network. OAuth remains broker-only; workers receive a synthetic per-run grant and no raw binding, volume, lease, control, or OAuth value. Kimi v6 state seals include the binding digest, source/context identities, source mount mode, dynamic UID/GID/workdir, validator, worker, relay, relay image, both networks, the central endpoint identity, state, and image. Old path-based and pre-relay Kimi state is intentionally not adopted.
 
@@ -226,7 +234,8 @@ Its fixed entrypoint owns `--model`, optional exact `--session`, `--prompt`,
 `--output-format stream-json`, and an empty skills directory. Static deny rules,
 workspace/config ancestry checks, a sanitized private home, read-only root,
 and the existing mount/inode checks remain mandatory. There is no native unsafe
-fallback and no `THREADWIRE_KIMI_BIN` control.
+fallback within the explicitly selected isolated path. Normal Kimi execution
+uses the native adapter and may use `THREADWIRE_KIMI_BIN`.
 
 Only exact pinned stream records are normalized: assistant string content,
 validated tool name/key start and finish, and one exact
@@ -263,7 +272,8 @@ such as:
 export THREADWIRE_ALLOWED_KIMI_MODELS='{"default":{"model":"kimi-for-coding","protocol":"kimi"},"kimi-code/kimi-for-coding":{"model":"kimi-for-coding","protocol":"kimi"}}'
 ```
 
-`default` is the server-owned selection for no-argument and Telegram jobs.
+`default` is the server-owned selection for isolated supervisor jobs without a
+model argument.
 `kimi-code/kimi-for-coding` is the exact official provider-qualified alias for
 explicit callers. Each key is an opaque allowlisted value, not a path, and
 Threadwire never normalizes or strips its prefix. The `model` field is the
@@ -272,8 +282,8 @@ alias.
 
 OAuth writes only the named `threadwire-kimi-oauth` volume at the official
 `credentials/kimi-code.json` location. Stop the broker during interactive auth
-so the CLI and broker cannot race a refresh, then run the opt-in, workspace-free
-auth service:
+so the auth CLI and broker cannot race a refresh, then run the opt-in,
+workspace-free auth service:
 
 ```sh
 docker compose -f compose.yaml -f compose.relay-write.yaml stop kimi-isolated-runtime kimi-model-broker
@@ -288,20 +298,12 @@ The auth service has no workspace, ingress network, Docker socket, Threadwire
 control token, or Telegram credential and uses Docker logging driver `none`.
 `verify <provider-qualified-alias>` discards native output and prints only a
 fixed success/failure; use it to confirm each exact official alias before
-adding that alias and its independently verified wire model to the server
-allowlist. An explicit CLI job selects the exact key as one argv value:
-
-```sh
-node bin/threadwire.js run \
-  --provider kimi \
-  --target telegram:-1001234567890:42 \
-  --workspace-profile container-runtime \
-  --prompt 'Inspect the project.' \
-  -- --model 'kimi-code/kimi-for-coding'
-```
+adding that alias and its independently verified wire model to the isolated
+supervisor allowlist. This operator configuration does not configure or select
+the native CLI Kimi model.
 
-API keys, Moonshot platform mode, custom base URLs, discovery by ordinary jobs,
-and arbitrary aliases are unsupported.
+For the isolated supervisor, API keys, Moonshot platform mode, custom base
+URLs, discovery by ordinary jobs, and arbitrary aliases are unsupported.
 
 For logout or account rotation, stop the Kimi runtime and broker, run
 `--profile kimi-auth run --rm kimi-auth logout` or `login`, verify approved
@@ -322,7 +324,8 @@ payload, or synthetic grant.
 
 Rollback by stopping `kimi-isolated-runtime` and `kimi-model-broker`, removing
 the `kimi` Compose profile/control variables, and reverting the Threadwire image.
-Kimi commands then fail closed; Codex behavior is unaffected. Preserve the OAuth
+Isolated Kimi requests then fail closed; native Kimi remains independent of
+that optional deployment. Codex behavior is unaffected. Preserve the OAuth
 and Kimi state volumes for a recoverable rollback. Remove them only as an
 explicit credential/session teardown after OAuth revocation; never archive them
 with workspace backups.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "threadwire",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "Stream Codex, Claude, Kimi Code, and OpenCode worker progress to an explicit Telegram destination",
   "keywords": [
     "ai-agent",
@@ -20,8 +20,7 @@
     "docs/",
     "scripts/",
     "src/",
-    "TELEGRAM-INGRESS.md",
-    "threadwire.workspace-profiles.json"
+    "TELEGRAM-INGRESS.md"
   ],
   "bin": {
     "threadwire-isolated-runtime": "bin/isolated-runtime.js",

package/scripts/provider-shims/front-door.sh.template

@@ -58,15 +58,11 @@ threadwire_relay_arguments=(run --provider "$THREADWIRE_PROVIDER" --target "$THR
 case "${THREADWIRE_RELAY_WRITE:-0}" in
   0) ;;
   1)
-    if [[ ! "${THREADWIRE_WORKSPACE_PROFILE:-}" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$ ]]; then
-      printf '%s\n' 'threadwire: relay write capability requires a valid THREADWIRE_WORKSPACE_PROFILE' >&2
-      exit 2
-    fi
     if [[ "$THREADWIRE_PROVIDER" != codex ]]; then
       printf '%s\n' 'threadwire: relay write capability is only supported for codex' >&2
       exit 2
     fi
-    threadwire_relay_arguments+=(--workspace-profile "$THREADWIRE_WORKSPACE_PROFILE" --relay-write)
+    threadwire_relay_arguments+=(--relay-write)
     ;;
   *)
     printf '%s\n' 'threadwire: relay write capability must be enabled with THREADWIRE_RELAY_WRITE=1' >&2