ur-agent 1.45.6 → 1.47.0

package/docs/AG_UI.md

@@ -0,0 +1,132 @@
+# AG-UI Integration
+
+UR-Nexus 1.47 exposes an opt-in [AG-UI](https://docs.ag-ui.com/) HTTP adapter
+for user-facing applications. It validates the official `RunAgentInput` schema
+and streams official AG-UI lifecycle, text, state, step, and tool events over
+Server-Sent Events (SSE).
+
+## Start the adapter
+
+```sh
+ur ag-ui serve
+```
+
+The default endpoint is `http://127.0.0.1:8977/ag-ui`. The adapter also exposes:
+
+- `GET /ag-ui/capabilities` — machine-readable, schema-validated capabilities.
+- `GET /healthz` — lightweight process health.
+
+The default loopback binding requires no bearer token. To expose the adapter on
+another interface, configure authentication in the environment:
+
+```sh
+UR_AG_UI_TOKEN='<random-secret>' \
+  ur ag-ui serve --host 0.0.0.0 --port 8977
+```
+
+UR refuses an off-loopback bind without `UR_AG_UI_TOKEN`. Put the server behind
+TLS before sending a bearer token over a non-loopback network.
+
+## Browser clients
+
+Browser origins are denied unless they are explicitly listed. Each value must
+be an exact HTTP(S) origin, without a path, query, credentials, or wildcard:
+
+```sh
+ur ag-ui serve \
+  --allow-origin https://app.example.com https://admin.example.com
+```
+
+When authentication is configured, send `Authorization: Bearer <token>`. The
+endpoint requires `Content-Type: application/json` and an `Accept` value that
+allows `text/event-stream`.
+
+## Minimal request
+
+```sh
+curl --no-buffer http://127.0.0.1:8977/ag-ui \
+  -H 'Accept: text/event-stream' \
+  -H 'Content-Type: application/json' \
+  --data-binary '{
+    "threadId": "thread-1",
+    "runId": "run-1",
+    "state": {},
+    "messages": [
+      {"id": "message-1", "role": "user", "content": "Review this repository."}
+    ],
+    "tools": [],
+    "context": [],
+    "forwardedProps": {}
+  }'
+```
+
+The response is an ordered SSE stream beginning with `RUN_STARTED` and a
+`STATE_SNAPSHOT`. UR then emits step, text, and tool events and terminates with
+`RUN_FINISHED` or a redacted `RUN_ERROR`. The server validates every emitted
+event through the official AG-UI schemas and uses the official SSE encoder.
+
+## Supported contract
+
+This adapter deliberately advertises only behavior that is implemented end to
+end:
+
+- HTTP/SSE streaming, text input/output, state snapshots, UR-configured tools,
+  cancellation on disconnect, delegation, and code execution are supported.
+- Client-provided tools, multimodal input, encrypted input, interrupt resume,
+  persistent AG-UI state, WebSocket/binary transport, push notifications,
+  reasoning events, and interactive human approvals are not advertised.
+- Unsupported input is rejected with a structured `4xx` error; it is never
+  silently discarded.
+
+Every request supplies the complete transcript, state, context, and forwarded
+properties for that run. UR labels this envelope as untrusted client data so a
+client-supplied system message cannot replace UR's own system or safety policy.
+Adapter runs use isolated session IDs and disable child-session persistence.
+
+## Permissions
+
+Select a permission mode explicitly when necessary:
+
+```sh
+ur ag-ui serve --permission-mode plan
+ur ag-ui serve --permission-mode acceptEdits
+```
+
+The default is `default`. Because AG-UI runs have no interactive terminal
+approval channel, any operation that still requires a prompt is denied. `plan`
+is the safest read-oriented mode. Use `acceptEdits` only in a workspace where
+the adapter is authorized to edit files; other permission checks still apply.
+
+## Resource controls
+
+The following environment variables are optional. Invalid or excessive values
+fall back to bounded defaults or are capped by the implementation.
+
+| Variable | Default | Purpose |
+| --- | ---: | --- |
+| `UR_AG_UI_TOKEN` | unset | Required bearer secret for off-loopback binds. |
+| `UR_AG_UI_MAX_REQUEST_BYTES` | `2000000` | Maximum request-body bytes. |
+| `UR_AG_UI_MAX_CALLS_PER_MINUTE` | `120` | Rolling request rate per server process. |
+| `UR_AG_UI_MAX_CONCURRENT_RUNS` | `8` | Concurrent active runs. |
+| `UR_AG_UI_PROMPT_TIMEOUT_MS` | `1800000` | Per-run execution deadline. |
+| `UR_AG_UI_MAX_OUTPUT_CHARS` | `10485760` | Maximum child stream output. |
+
+Duplicate active `threadId`/`runId` pairs are rejected per authenticated owner.
+Requests, identifiers, transcript/context data, tool payloads, output, stderr,
+and stream lines are independently bounded. Error responses do not expose
+provider stderr or internal exception details.
+
+## Cost and privacy
+
+AG-UI and the adapter dependencies are free/open-source software. Running an
+AG-UI request uses whichever model provider UR is configured to use; that
+provider may have its own pricing. Select a local Ollama model when you need a
+fully local path without paid API calls. The deterministic AG-UI tests use an
+injected fake runner and never contact a model provider.
+
+Protocol references:
+
+- [AG-UI architecture](https://docs.ag-ui.com/concepts/architecture)
+- [AG-UI events](https://docs.ag-ui.com/concepts/events)
+- [AG-UI JavaScript types](https://docs.ag-ui.com/sdk/js/core/types)
+- [AG-UI reference implementation](https://github.com/ag-ui-protocol/ag-ui)

package/docs/CONFIGURATION.md

@@ -107,6 +107,28 @@ GEMINI_API_KEY=...
 OPENROUTER_API_KEY=...
 ```
 
+### OpenAI Responses transport
+
+OpenAI uses Chat Completions unless the Responses transport is selected
+explicitly:
+
+```sh
+ur config set openai_transport responses
+ur config set responses.store false
+ur config set responses.compact_threshold 20000
+ur config set responses.tool_search hosted
+```
+
+Supported safe settings are `chat-completions|responses`, boolean
+`responses.store`, an integer compaction threshold of at least 1,000 tokens,
+and `off|hosted` tool search. Responses defaults to `store=false`, no server
+compaction, and no deferred tool search. Background and WebSocket state is kept
+under `.ur/openai-responses/` with private atomic writes; identifiers, status,
+model, mode, and cursors are the only plaintext durable fields. To retain an
+opaque compacted window, set `UR_OPENAI_RESPONSES_STATE_KEY` to exactly 32
+bytes encoded as 64 hexadecimal characters or base64. Without that key UR
+refuses to persist compacted context.
+
 ### Reconfiguring the Ollama host
 
 The endpoint can be changed from UR in three ways, in order of precedence:
@@ -415,6 +437,9 @@ ur context-pack remember --decision "Use package scripts before ad hoc commands"
 ur context-pack remember --constraint "Do not expose secret values"
 ur context-pack remember --command "bun run typecheck"
 ur context-pack remember --diff "Safety policy wired into Bash permission checks"
+ur context-pack memory verify
+ur context-pack memory quarantine
+ur context-pack memory rollback --to <entry-id>
 ur context-pack compress
 ```
 
@@ -425,8 +450,10 @@ Generated files:
   `.ur/safety-policy.json`, MCP config, editor settings, workflow files, and
   other manifests.
 - `.ur/context/architecture.md` — human-readable architecture summary.
-- `.ur/context/task-memory.jsonl` — decisions, constraints, commands, diffs,
-  and notes.
+- `.ur/context/task-memory.jsonl` — private, append-only decisions,
+  constraints, commands, diffs, and notes with explicit provenance, UUIDs, and
+  a SHA-256 content/hash chain. Legacy entries are anchored when the chain
+  starts rather than silently rewritten.
 - `.ur/context/compressed.md` — compressed task context summary.
 
 Two related slash commands:
@@ -447,10 +474,67 @@ ur mcp list
 ur mcp get <name>
 ur mcp add-json <name> '<json>'
 ur mcp remove <name>
+ur mcp serve
+UR_MCP_HTTP_TOKEN='<secret>' ur mcp serve-http --port 8976
 ```
 
 MCP servers may execute code or access external services. Only enable servers you trust, and keep credentials out of committed config.
 
+When UR itself runs as an MCP server, tool requests are non-interactive:
+schema validation and normal permission checks still run, and any operation
+that would require an approval prompt is rejected. Resource limits can be
+adjusted with `UR_MCP_MAX_CALLS_PER_MINUTE`,
+`UR_MCP_MAX_CONCURRENT_CALLS`, `UR_MCP_TOOL_TIMEOUT_MS`,
+`UR_MCP_MAX_INPUT_CHARS`, and `UR_MCP_MAX_OUTPUT_CHARS`.
+
+`serve-http` is a separate, opt-in MCP 2026-07-28 compatibility surface at
+`POST /mcp`. It is stateless at the transport layer and exposes capability-
+negotiated Tasks and a self-contained overview App backed by UR's real MCP
+tool registry. Every call must supply matching protocol/method/name metadata.
+Off-loopback binds require `UR_MCP_HTTP_TOKEN`; browser clients also require an
+exact `--allow-origin`. HTTP request, rate, concurrency, task-retention, and
+runtime limits use the `UR_MCP_HTTP_*` prefix. Durable task state is private,
+owner-isolated, bounded, atomic, and quarantined if corrupt.
+
+## Background Agents
+
+Detached `ur bg` task state is stored under `.ur/background/`. Manifest updates
+use a cross-process lock and atomic mode-`0600` replacement; task logs, outputs,
+and steering inboxes are created mode `0600` under mode-`0700` directories.
+The loader rejects corrupt, oversized, or structurally invalid manifests rather
+than silently replacing them. `UR_BACKGROUND_MAX_MANIFEST_BYTES` controls the
+manifest byte ceiling (16 MiB by default, capped at 64 MiB), and
+`UR_BACKGROUND_MAX_TASKS` controls the retained task ceiling (5,000 by default,
+capped at 20,000).
+
+## Agent Servers
+
+For native editor integration, `ur acp stdio` implements stable Agent Client
+Protocol v1 through the official SDK. Its resource controls use the
+`UR_ACP_STDIO_*` prefix. It supports client-provided MCP stdio/HTTP/SSE
+servers, additional workspace roots, native permission requests, cancellation,
+and persistent list/load/delete/resume/close with exact history replay, modes,
+config options, and available commands; see the [ACP Guide](ACP.md).
+
+`ur acp serve` is a separate UR HTTP JSON-RPC API. Set `UR_ACP_TOKEN` instead
+of putting its bearer token in argv. Request, task, and tool limits use the
+`UR_ACP_*` prefix.
+
+`ur a2a serve` exposes strict v1 JSON-RPC and HTTP+JSON bindings alongside the
+stable official-SDK v0.3 JSON-RPC binding and a separate UR compatibility task
+API. Use `UR_A2A_TOKEN` for a static operator token or
+`UR_A2A_DELEGATION_SECRET` for issuer-minted skill/tenant-scoped tokens. Limits
+use the `UR_A2A_*` prefix. See the [A2A Guide](A2A.md) for endpoints, protocol
+negotiation, proxy setup, and isolation.
+
+`ur ag-ui serve` exposes an opt-in AG-UI HTTP/SSE adapter at `POST /ag-ui`,
+with capability discovery at `GET /ag-ui/capabilities`. It binds to loopback by
+default; off-loopback binds require `UR_AG_UI_TOKEN`, and browser clients must
+be listed with exact `--allow-origin` values. Request, rate, concurrency,
+runtime, and output controls use the `UR_AG_UI_*` prefix. Unsupported client
+tools, multimodal/encrypted input, interrupts, and unimplemented transports are
+rejected rather than silently ignored. See the [AG-UI Guide](AG_UI.md).
+
 ## Plugins and Skills
 
 Plugins can add commands, tools, and skills:
@@ -462,7 +546,43 @@ ur plugin update <plugin>
 ur plugin disable <plugin>
 ```
 
-Skills can be stored in `.ur/skills/` for project-specific workflows or in `~/.ur/skills/` for personal workflows.
+Skills can be stored in `.ur/skills/` for project-specific workflows or in
+`~/.ur/skills/` for personal workflows. UR also discovers the cross-client
+`.agents/skills/` and `~/.agents/skills/` locations from the Agent Skills
+integration guide. At an equal scope, native `.ur` skills win; project skills
+win over user skills, and nearer project roots win over parent roots.
+
+Portable `SKILL.md` directories are validated against the Agent Skills
+frontmatter contract and receive deterministic content and permission digests.
+Inspect and sign them with:
+
+```sh
+ur skill verify <name-or-directory> [--require-trusted] [--json]
+ur skill keygen <key-id> [--out <private-key.pem>]
+ur skill sign <name-or-directory> --key <private-key.pem> --key-id <key-id>
+```
+
+Set `UR_SKILLS_STRICT_SPEC=true` to reject spec-invalid file skills and
+`UR_SKILLS_REQUIRE_TRUSTED_SIGNATURE=true` to require a verified key at load
+and invocation. `UR_SKILL_TRUSTED_KEYS_FILE` can override the private trusted
+key store (normally under the UR config directory). Signed skills cannot
+contain symlinks and are re-hashed immediately before every invocation.
+
+## OpenTelemetry
+
+No telemetry exporter is enabled by default. Configure each signal with the
+standard `OTEL_TRACES_EXPORTER`, `OTEL_METRICS_EXPORTER`, and
+`OTEL_LOGS_EXPORTER` variables; supported values are `otlp`, `console`, or
+`none`. OTLP uses HTTP/protobuf and the standard
+`OTEL_EXPORTER_OTLP[_<SIGNAL>]_ENDPOINT` variables. UR validates endpoints,
+protocols, and export intervals before registering providers.
+
+GenAI spans and metrics cover inference, agent/workflow invocation, tools, memory,
+duration, token/cache usage, response identity, finish reason, time to first
+chunk, and bounded error type. Content is excluded unless
+`OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true`; use
+`UR_OTEL_GENAI_PROVIDER` only when a gateway hides the provider identity.
+`OTEL_SDK_DISABLED=true` disables the SDK globally.
 
 ## Secrets
 

package/docs/DEVELOPMENT.md

@@ -35,6 +35,7 @@ bun run dev
 ```sh
 bun run typecheck
 bun run lint
+bun run dependencies:audit
 bun test
 bun run build
 bun run smoke

package/docs/IDE.md

@@ -13,8 +13,8 @@ stated honestly — nothing here claims support that does not exist:
   below. Ships to VS Code, Cursor, and Windsurf (one extension; Cursor and
   Windsurf are VS Code forks). This is the integration everything else on
   this page is compared against.
-- **Stdio ACP** (`ur acp stdio`) — the real, spec-compliant
-  [Agent Client Protocol](ACP.md) over stdio, used by Zed and ACP-capable
+- **Stdio ACP** (`ur acp stdio`) — stable ACP v1 over stdio, backed by the
+  official TypeScript SDK and used by Zed and ACP-capable
   Neovim clients. This remains a separate transport from the VS Code
   extension's chat bridge below; the two are independent and neither depends
   on the other.
@@ -33,14 +33,14 @@ stated honestly — nothing here claims support that does not exist:
 | Cursor | UR Inline Diffs extension (VS Code fork) | `.vscode/settings.json` | Same extension as VS Code. |
 | Windsurf | UR Inline Diffs extension (VS Code fork) | `.vscode/settings.json` | Same extension as VS Code. |
 | Zed | stdio ACP | `.zed/settings.json` | Real Agent Client Protocol over stdio. |
-| JetBrains | bundled experimental plugin + HTTP ACP | manual zip install | Project-scoped JSON-RPC session and Send Selection action; synchronous ACP task result, not token streaming. |
+| JetBrains | bundled experimental plugin + UR HTTP JSON-RPC | manual zip install | Project-scoped JSON-RPC session and Send Selection action; synchronous task result, not streaming. |
 | Neovim | stdio ACP | snippet | Requires a third-party ACP client plugin. |
-| Generic ACP | stdio ACP / HTTP | snippet | `ur acp stdio` (native ACP) or `ur acp serve` (HTTP JSON-RPC; not a streaming transport — see Known limitations). |
+| Generic ACP | stdio ACP | snippet | `ur acp stdio` is the native ACP transport. `ur acp serve` is a separate UR-specific HTTP API. |
 
 ## Commands
 
 ```sh
-ur ide status               # workspace, ACP server, provider/model, sandbox/verifier mode, plugin count, warnings
+ur ide status               # workspace, UR HTTP server, provider/model, sandbox/verifier mode, plugin count, warnings
 ur ide doctor                # pass/warn/fail checks; reports missing config clearly
 ur ide config <editor>       # print setup + config snippet for the chosen editor
 ur ide open                  # open the current project/worktree in a detected IDE
@@ -52,7 +52,7 @@ ur ide diff approve|reject <id>
 `ur ide config` targets: `vscode`, `cursor`, `windsurf`, `zed`, `jetbrains`,
 `neovim`, `generic-acp` (aliases like `nvim`, `intellij`, `code` also resolve).
 
-`ur ide status` reports the active workspace, whether the ACP server is
+`ur ide status` reports the active workspace, whether the UR HTTP compatibility server is
 running and on which port, the active provider/model and runtime backend,
 sandbox mode, verifier mode, the number of loaded plugins, and any warnings.
 Add `--json` for machine-readable output — this is the same JSON surface the
@@ -150,9 +150,12 @@ tasks (`ur bg list --json`) together in one place, with its own refresh
 button and a clear empty state when there is nothing captured yet. Diff rows
 support the same Open/Apply/Reject/Comment actions as the Inline Diffs view
 (routed through the CLI, as described above). Background task rows are
-read-only in this release — click one to open its log file; starting or
-canceling a task from the panel is not implemented yet, use
-`ur bg run|kill` from a terminal.
+actionable: **Start Background Task** offers isolated-worktree (recommended),
+offline isolated-worktree, and current-workspace modes, confirms before
+launch, and never enables permission bypass or PR publishing. Active tasks
+can be canceled from their context menu. Opening a task retrieves the latest
+2,000 log lines through `ur bg logs`, so the extension never trusts an
+arbitrary manifest path as a file to open.
 
 ### Agent status card
 
@@ -170,7 +173,8 @@ CLI does not report renders as the literal word **unknown** — never a guess.
 action the extension exposes: New Chat, Open Chat, Explain Selection, Fix
 Selection, Generate Tests, Review Current Diff, Run Verifier, Provider
 Status, Agent Status, Agent Options, Open Settings, Open Docs, Open
-Artifacts, Run Spec, Run Workflow, and Refresh IDE Actions.
+Artifacts, Run Spec, Run Workflow, Start Background Task, and Refresh IDE
+Actions.
 
 ### Agent options panel
 
@@ -202,8 +206,9 @@ success it did not observe.
 ## Known limitations
 
 - **JetBrains integration is experimental and non-streaming.** It uses the
-  loopback HTTP ACP server and returns the completed synchronous task output;
-  it does not yet render token or tool-call streams.
+  loopback UR HTTP JSON-RPC server and returns the completed synchronous task output;
+  it does not yet render token or tool-call streams. Canceling the IDE progress
+  action does propagate to the active server-side session.
 - **The lockfile/MCP IDE bridge is Phase 2 and not part of this MVP.** The
   CLI already implements the *client* half of a lockfile-discovered MCP
   connection to a running IDE (`src/utils/ide.ts`), used by the terminal
@@ -211,20 +216,18 @@ success it did not observe.
   terminal-hosted `ur` session. The VS Code extension's chat panel does not
   use this bridge — it talks to UR entirely through the `stream-json`
   subprocess contract described above.
-- **The ACP HTTP server (`ur acp serve`) is not the VS Code chat streaming
-  transport.** It is a separate, non-streaming JSON-RPC endpoint intended for
+- **The UR HTTP server (`ur acp serve`) is neither an ACP binding nor the VS
+  Code chat streaming transport.** It is a separate, non-streaming JSON-RPC endpoint intended for
   scripts and other clients; the VS Code extension does not route chat
   through it, and `ur acp stdio` (used by Zed and ACP Neovim clients) is
   unaffected by any of the VS Code work described here.
-- **Background task actions are read-only** in the Actions panel — no start
-  or cancel from the panel yet.
 - **Run Spec / Run Workflow** open chat with a prompt asking UR to list and
   run the relevant items, rather than shelling out directly — `ur spec` and
   `ur workflow` are full agentic commands, not one-shot JSON lookups.
 
 ## Troubleshooting
 
-- **`ur ide status` shows "ACP server: not running":** start it with
+- **`ur ide status` shows "UR HTTP server: not running":** start it with
   `ur acp serve` (HTTP) or `ur acp stdio` (for ACP editors).
 - **No IDE detected:** ensure the editor is running with the UR extension/plugin
   installed, or generate config with `ur ide config <editor>`.

package/docs/TROUBLESHOOTING.md

@@ -208,12 +208,14 @@ ur plugin list
 
 ### ACP / editor connection issues
 
-- Likely cause: the ACP server is not running, or the editor config block is
-  missing.
-- Fix: check status, regenerate the editor config, and run the IDE doctor.
+- Likely cause: the native stdio command/config is wrong, or the optional UR
+  HTTP server used by JetBrains is not running.
+- Fix: verify the stdio command is registered, check HTTP status when relevant,
+  regenerate the editor config, and run the IDE doctor.
 
 ```sh
 ur acp status
+ur acp stdio --help
 ur ide doctor
 ur ide config zed    # or vscode, cursor, windsurf, jetbrains, neovim
 ```

package/docs/USAGE.md

@@ -128,12 +128,23 @@ ur config set provider openai-compatible
 ur config set model <model>
 ur config set base_url <url>
 ur config set provider.fallback ollama
+ur config set openai_transport responses
+ur config set responses.store false
+ur config set responses.compact_threshold 20000
+ur config set responses.tool_search hosted
 ```
 
 `provider.fallback` only controls the recovery suggestion printed by provider
 diagnostics. UR does not switch or retry across providers automatically; use
 `ur config set provider <id>` after reviewing the failure.
 
+The OpenAI API continues to use Chat Completions by default. Selecting
+`openai_transport responses` opts into Responses semantic streaming,
+background/poll/cancel support, WebSocket continuation, server compaction, and
+deferred tool search. Remote storage is off by default. Local state contains
+only bounded identifiers/status/cursors unless a 32-byte
+`UR_OPENAI_RESPONSES_STATE_KEY` is supplied for AES-256-GCM compacted context.
+
 In the interactive app, `/model` chooses a provider first and then a model from
 that provider only. The saved pair controls the runtime backend for the next
 agent request. There is no cross-provider fallback: OpenAI API does not fall
@@ -210,9 +221,17 @@ ur context-pack remember --preference "Use bun test over jest"
 ur context-pack remember --accepted "Use p-map for bounded concurrency" --scope project
 ur context-pack remember --rejected "Switch to esbuild" --alternative-to "Keep bun bundle"
 ur context-pack remember --attempt "Tried Deno runtime" --status superseded
+ur context-pack memory verify
+ur context-pack memory quarantine
+ur context-pack memory rollback --to <entry-id>
 ur context-pack compress
 ```
 
+New entries carry explicit source provenance and form a SHA-256 hash chain.
+Reads fail closed on malformed or tampered state. `quarantine` preserves the
+complete original privately and restores the verified prefix; `rollback`
+preserves a backup before truncating to the requested entry.
+
 ## Lifecycle hooks
 
 UR supports lifecycle hook events that fire around agent actions. Hooks are configured in `.ur/hooks.json` or `UR.md` frontmatter and receive JSON payloads.
@@ -244,7 +263,10 @@ UR includes slash commands and CLI subcommands for common workflows:
 
 - `/help` or `ur --help` for command discovery
 - `ur connect ...` to connect provider accounts (subscription login or stored API key)
-- `ur mcp ...` to configure MCP servers
+- `ur mcp ...` to configure MCP servers, run the stdio server, or start the
+  opt-in stateless MCP 2026 Tasks/Apps adapter with `ur mcp serve-http`
+- `ur ag-ui serve` to expose the secure AG-UI HTTP/SSE adapter to an explicitly
+  allowed user-facing application
 - `ur plugin ...` to manage plugins and marketplaces. Marketplace plugins can
   add MCP tools, commands, executable skills, templates, validators, language
   adapters, LSP servers, agents, hooks, and output styles.
@@ -257,7 +279,8 @@ UR includes slash commands and CLI subcommands for common workflows:
 - `ur context-pack ...` to summarize architecture and persist project memory (decisions, constraints, commands, diffs, architecture, preferences, attempts, accepted, rejected)
 - `ur code-index watch` to keep the local semantic code index fresh
 - `ur code-index repo build` to build a richer semantic repo index (files, symbols, calls, tests, docs, configs)
-- `ur skill init ...` and `ur skill run ...` for executable skill workflows
+- `ur skill init|run ...` for executable skill workflows, plus
+  `ur skill verify|sign|keygen` for strict provenance and Ed25519 trust
 - `ur memory retention ...` to prune project-local memory by TTL, max entries, and decay
 - `ur spec ...` to scaffold requirements, design, and tasks, run a spec task list, and verify with strict proof gates
 - `ur escalate ...` to plan, run, or ask an oracle model for hard tasks
@@ -268,7 +291,9 @@ UR includes slash commands and CLI subcommands for common workflows:
   after one attempt and reports how to correct `--cwd`.
 - `ur artifacts ...` to capture reviewable diffs, test runs, notes, and feedback
 - `ur ide diff ...` to capture editor-readable inline diff bundles
-- `ur acp ...` to start/stop/status the Agent Communication Protocol server for IDE extensions
+- `ur acp stdio` for the official-SDK ACP v1 editor transport with durable
+  list/load/delete/resume, modes, config options, and commands; and
+  `ur acp serve|stop|status` for the separate UR HTTP JSON-RPC API
 - `ur exec ...` to run prompts in non-interactive mode with optional concurrency
 - `ur eval run ...` to run a suite, grade results, and capture execution metrics
 - `ur eval report ...` to show a saved report or write a single-suite dashboard
@@ -292,7 +317,9 @@ UR includes slash commands and CLI subcommands for common workflows:
 - `ur trigger ...` to parse GitHub/Slack webhook payloads and optionally launch a headless run
 - `ur agent-templates ...`, `ur agent-task ...`, `ur agent-inspect`, `ur agent-features`, and `ur agent-trends` for agent template, PR handoff, timeline, and coverage utilities
 - `ur role-mode ...` to install built-in Architect, Code, Debug, and Ask role modes
-- `ur a2a ...` for Agent Card metadata, delegation tokens, and the opt-in A2A task server
+- `ur a2a ...` for negotiated v1 JSON-RPC/HTTP+JSON, the stable v0.3 SDK
+  binding, scoped delegation tokens, durable protocol state, and separate UR
+  compatibility task routes
 - `ur sdk ...` to scaffold TS/Python headless SDK examples
 - `ur doctor` to inspect CLI health
 - `ur update` or `ur upgrade` to check for updates
@@ -347,6 +374,7 @@ ur test-first detect
 ur test-first --dry-run
 ur skill init security-review
 ur skill run security-review "src/auth.ts"
+ur skill verify security-review --require-trusted
 ur code-index repo build
 ur code-index repo search "rate limiter"
 ur test-first install
@@ -355,7 +383,9 @@ ur safety check --command "rm -rf build"
 ur context-pack scan
 ur context-pack remember --constraint "Run command evidence before claiming success"
 ur context-pack remember --accepted "Use p-map for concurrency" --scope project
+ur context-pack memory verify
 ur context-pack compress
+UR_MCP_HTTP_TOKEN='<secret>' ur mcp serve-http --port 8976
 ur acp serve --port 8123
 ur exec "add tests for the parser" --concurrency 4 --json
 ur ci-loop --command "bun test" --cwd . --dry-run

package/docs/VALIDATION.md

@@ -19,7 +19,7 @@ You need:
 
 ```sh
 ur --version
-# expected for this release: "1.45.6 (UR-Nexus)"
+# expected for this release: "1.47.0 (UR-Nexus)"
 ```
 
 ## 0.1 First-workspace model selection (1.45.4)
@@ -84,6 +84,8 @@ Expected:
 - `context-pack scan` writes `.ur/project-manifest.json` and
   `.ur/context/architecture.md`.
 - `remember` appends task memory entries under `.ur/context/task-memory.jsonl`.
+- `ur context-pack memory verify` reports a valid integrity chain. Tamper tests
+  must use a disposable copy; quarantine and rollback preserve private backups.
 - `compress` writes `.ur/context/compressed.md`.
 
 ## 0.3 Test-first execution loop (1.18.0)
@@ -149,6 +151,34 @@ ur --ollama-host http://localhost:11434 -p "say hi"
 ur --settings '{"ollama":{"host":"http://localhost:11434"}}' -p "say hi"
 ```
 
+## 0.6 v1.47 protocol, provenance, and telemetry gates
+
+These deterministic tests use local fixtures, fake transports, and mock
+exporters. They do not require a paid provider account or make paid model calls:
+
+```sh
+bun test test/acpStdio.test.ts test/a2aV1.test.ts test/mcp2026.test.ts
+bun test test/openaiResponses.test.ts test/genAiTelemetry.test.ts
+bun test test/agUi.test.ts test/skillCommand.test.ts
+bun test test/skillProvenance.test.ts test/taskMemoryIntegrity.test.ts
+```
+
+Expected: ACP lifecycle/replay, A2A dual-stack isolation, MCP Tasks/Apps,
+Responses HTTP/SSE/WebSocket/background behavior, OpenTelemetry redaction,
+AG-UI lifecycle/security, `.agents/skills/` precedence, Ed25519 skill trust,
+and task-memory quarantine/rollback all pass. Then run:
+
+```sh
+bun run typecheck
+bun run lint
+bun test
+bun run build
+bun run secrets:scan
+bun run dependencies:audit
+bun run release:check
+bun run package:check
+```
+
 ## 1. Marketplace tree resolves
 
 In a fresh interactive session:

package/docs/providers.md

@@ -105,12 +105,22 @@ ur config set model <model>
 ur provider select-model <provider> <model> --json
 ur config set base_url <url>
 ur config set provider.fallback ollama
+ur config set openai_transport responses
+ur config set responses.store false
+ur config set responses.compact_threshold 20000
+ur config set responses.tool_search hosted
 ```
 
 The fallback setting is a recovery hint for `ur provider doctor`; it does not
 route a failed request to another provider. Review the failure and use
 `ur config set provider <id>` to switch explicitly.
 
+OpenAI API uses Chat Completions by default. `openai_transport responses` is an
+explicit opt-in to the native Responses adapter; it defaults to `store=false`
+and supports semantic streaming, background polling/cancellation, WebSocket
+continuation, server compaction, and deferred tool search. It does not change
+OpenAI-compatible, OpenRouter, local, or subscription-CLI providers.
+
 ## Provider-scoped model selection
 
 UR-Nexus shows providers first, then only models available for the selected provider. This prevents incompatible model/provider pairs and keeps API-key, local/server, subscription, and external app bridge model lists separate. The generic `subscription` entry has no models unless a real independent subscription runtime is configured; UR does not list fake subscription models.
@@ -120,7 +130,7 @@ UR-Nexus shows providers first, then only models available for the selected prov
 When you select a UR-native provider and model, every agent request is routed
 through that provider's backend:
 
-- **API providers** make direct HTTP calls in each provider's native wire format: Anthropic uses `x-api-key` + `anthropic-version` against `/v1/messages`; OpenAI uses `Authorization: Bearer` against `/v1/chat/completions`; Gemini uses `x-goog-api-key` against `…:generateContent`; OpenRouter uses its OpenAI-compatible chat endpoint.
+- **API providers** make direct HTTP calls in each provider's native wire format: Anthropic uses `x-api-key` + `anthropic-version` against `/v1/messages`; OpenAI uses `Authorization: Bearer` against `/v1/chat/completions` by default or `/v1/responses` when explicitly selected; Gemini uses `x-goog-api-key` against `…:generateContent`; OpenRouter uses its OpenAI-compatible chat endpoint.
 - **Local/server providers** connect to the configured local or OpenAI-compatible endpoint (`/v1/chat/completions` for LM Studio, llama.cpp and vLLM; the native tags/chat API for Ollama)
 - **Subscription CLI providers** (Codex CLI, Claude Code, Gemini CLI,
   Antigravity) dispatch the turn through the vendor's official CLI using your
@@ -465,4 +475,8 @@ Common knobs:
 PROVIDER_SMOKE_TIMEOUT_MS=30000
 PROVIDER_SMOKE_MAX_RETRIES=0
 PROVIDER_SMOKE_TOOL_CALLS=1
+PROVIDER_SMOKE_OUTPUT=/tmp/ur-provider-smoke.json # --json only
 ```
+
+Without `PROVIDER_SMOKE_OUTPUT`, `--json` also writes the latest report to
+`diagnostics/provider-smoke/latest.json`.