ai-kit-python 1.4.2__py3-none-any.whl → 1.4.4__py3-none-any.whl

{ai_kit_python-1.4.2.dist-info → ai_kit_python-1.4.4.dist-info}/METADATA

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: ai-kit-python
-Version: 1.4.2
-Summary: Offline installer and portable instructions that give AI coding agents project memory, stack rules, guardrails, and adaptive model routing.
+Version: 1.4.4
+Summary: Portable instructions and installer for AI coding agents: project memory, stack rules, model routing, and optional budgeted orchestration.
 Author: Igor Sazonov
 License-Expression: MIT AND Apache-2.0
 Project-URL: Homepage, https://github.com/tigusigalpa/ai-kit
@@ -121,6 +121,8 @@ The distribution excludes root maintainer AGENTS.md, PROJECT_CONTEXT.md and WIKI
 
 A separate [Docker image](https://hub.docker.com/r/tigusigalpa/ai-kit) packages the CLI for container use.
 
+Package releases follow GitHub Release, automated checks and owner approval before PyPI upload through Trusted Publishing. Future stable tags must match VERSION; manual runs default to validation. See the [release procedure](https://github.com/tigusigalpa/ai-kit/blob/main/docs/PYPI.md#release-to-pypi-with-owner-approval).
+
 ## Documentation and license
 
 - [Repository and full README](https://github.com/tigusigalpa/ai-kit)
@@ -130,3 +132,7 @@ A separate [Docker image](https://hub.docker.com/r/tigusigalpa/ai-kit) packages
 - [Issues](https://github.com/tigusigalpa/ai-kit/issues)
 
 AI-KIT's own code and instructions are MIT licensed. Bundled Cloudflare references retain MIT; bundled Strix references retain Apache-2.0. The complete distribution declares `MIT AND Apache-2.0` and includes the corresponding license texts. External runtimes and application dependencies keep their own licenses.
+
+## Optional orchestration (v1.4.4)
+
+Install with `--with-orchestration` to add scoped Codex helpers and disabled-by-default OpenRouter configuration. `aikit orchestrate` previews selected text tasks, executes only on explicit apply, enforces local admission and capped-key preflight, and retains private observed usage/cost, review and billing reconciliation. It never executes model output. Native helper billing is separate; real trials and savings are unverified. See the [complete guide](https://github.com/tigusigalpa/ai-kit#optional-orchestration).

{ai_kit_python-1.4.2.dist-info → ai_kit_python-1.4.4.dist-info}/RECORD

@@ -1,33 +1,33 @@
-ai_kit_python-1.4.2.dist-info/licenses/LICENSE,sha256=Q4UBNXri7WF3F5T3Z2C_S22HoXWvOxiOs3CxSfPPNKE,1093
-ai_kit_python-1.4.2.dist-info/licenses/template/ai-kit/vendor/security-audit/LICENSE,sha256=5ZjmlKpQZlDHGS1eo74OUKyg01bqAFUcU0KfCwHrY5E,1078
-ai_kit_python-1.4.2.dist-info/licenses/template/ai-kit/vendor/strix/LICENSE,sha256=fblpcTQlHjFL2NOSV_4XDJiz4q2bLtZ-l6yvlhPnueM,11345
-aikit/.dockerignore,sha256=w-_fnJAWI5nBcSjGJci5OE2bYzlojYSw99gg7JEJ3xM,1378
+ai_kit_python-1.4.4.dist-info/licenses/LICENSE,sha256=Q4UBNXri7WF3F5T3Z2C_S22HoXWvOxiOs3CxSfPPNKE,1093
+ai_kit_python-1.4.4.dist-info/licenses/template/ai-kit/vendor/security-audit/LICENSE,sha256=5ZjmlKpQZlDHGS1eo74OUKyg01bqAFUcU0KfCwHrY5E,1078
+ai_kit_python-1.4.4.dist-info/licenses/template/ai-kit/vendor/strix/LICENSE,sha256=fblpcTQlHjFL2NOSV_4XDJiz4q2bLtZ-l6yvlhPnueM,11345
+aikit/.dockerignore,sha256=XhRVOHjBA4BHuC4qT5bEycKg1V_fuxBA1PI7aer6kck,1425
 aikit/.gitattributes,sha256=L4mMl0D8gLiDXx1_soWU2NSdM8TnWyp672qCVbe21sA,170
-aikit/.gitignore,sha256=OOFZre0vtV5U5t7nCO9lf2JMMlv8TEwteIaVQ3h6ahA,912
+aikit/.gitignore,sha256=ESC6H1f2W2mPa9vt80dxYPDV78vilmGxEiimADlfgg8,937
 aikit/BOOTSTRAP_PROMPT.md,sha256=7r4CmBIfFPal5QilpsomlGIomEzGlI6nVbmksbEuMlw,1189
-aikit/CHANGELOG.md,sha256=9qP29ogUKHd6AUgfXFV2KTT1eNyW52cySyccKt02pgg,11948
+aikit/CHANGELOG.md,sha256=PgQzfus-TLMEcxUHXJcZ_4e2vuY9u-_LhIYOk66xqc8,11293
 aikit/CLAUDE.md,sha256=R82TyQfYerEAkfrYIpVEcWZALc0q8tSucBe8RfSFerc,38
-aikit/CONTRIBUTING.md,sha256=Fg3VEu6FxWO_OryBzfA15A8NnGbKh3BncVQwQYLvbkk,5220
+aikit/CONTRIBUTING.md,sha256=td7vcyuQ4NIKiSGNKuSmpA3oL8-nfTJOoMWRdyKKBGk,5445
 aikit/Dockerfile,sha256=8uUyWxXYV2dfr9VCulzeJEEO5RGXg-5hEuN1kkYXlbY,1852
 aikit/KIMI.md,sha256=4xJ2oTEepf7mj-Klp7ymjoXRksZO45bE1x3NIyCIr4A,278
 aikit/LICENSE,sha256=Q4UBNXri7WF3F5T3Z2C_S22HoXWvOxiOs3CxSfPPNKE,1093
-aikit/MANIFEST.in,sha256=n9Yb2mcrR_mkNVXVSagxx6OUoLvbIsce8rDJk0SCa74,813
+aikit/MANIFEST.in,sha256=E2CLkwEmuFwmgcLQeJQYoEJwnuMAexV63_CNBOb4llw,841
 aikit/MANUS.md,sha256=gVV5e04bVPecmyKzGaJNUq2pryknFafQNDiPmJ0ufq8,279
 aikit/Makefile,sha256=R_VqJHSi9awBzs24uccOioVXuso2Sz9WmnuHwYUXrd0,1476
-aikit/README.md,sha256=p_SNJhNjbB80xINCcp8ngrA8Pa895w1FW--VzJPrAVQ,93528
+aikit/README.md,sha256=WT2caFu-uiMhlsWRmAeWYmQSYlHtrwwJJmsIVJ3i9nk,110489
 aikit/SECURITY.md,sha256=wATqnw5W4VyCqFhd-ksCBPQKQMx_neJo9RRxWykg9gg,922
-aikit/SKILL.md,sha256=v-hTrvTv9J0I1rrgl36nc5A1BDo4aTionY5VzcsNUb4,11997
-aikit/VERSION,sha256=uZtMfN8jb1m8n2XZY96uyuOxan2th5OcrLkFf3Zk2u4,6
+aikit/SKILL.md,sha256=hzEYDILTx2b7MsNcuL6qkovkmQ2d-oFinoNaCYE3Hxw,11888
+aikit/VERSION,sha256=0D2LJotBcTKKwkWM6MqC1pof3jhGnU5PquT4-o2KXjU,6
 aikit/__init__.py,sha256=aNy2HbTnXlBlSZu868pK2uv1jLohV129gQn4dbup4k4,59
-aikit/aikit_cli.py,sha256=NPTFFYSZXSeZyRwEyEiixy0MCLfrXmHwpzJjWofoR-s,2051
-aikit/pyproject.toml,sha256=MWqpmeNwnDT7aMKNZVADklS_XEutbOGE8wnZfnBE8cg,2704
+aikit/aikit_cli.py,sha256=xA8ewGVonK_ebsHzttjMNWoFPt2TF2CNTyY08pHbteo,2093
+aikit/pyproject.toml,sha256=64SNtn8pN4xfs3v4HnrMVuo3TKGpcfr7cKaCqZSjVVc,2730
 aikit/.agents/skills/go-work/SKILL.md,sha256=Hs1urC4XsEufaUyO5L-_Nb2s2TusX-niuXdnZ9BCD58,421
 aikit/.agents/skills/laravel-work/SKILL.md,sha256=dJ55mRc2SPY2uTPArfDWZ-YtO7rfLYnv9E-tc91wzVY,589
 aikit/.agents/skills/moodle-work/SKILL.md,sha256=ZwQTExl6MyK1QrgcHKqr-9pPow_NYRzOJwMuQZN0o5U,439
-aikit/.agents/skills/project-continuity/SKILL.md,sha256=I1PWvrj4Sc9tfAPaiZiCk-RvNAWCC15XiZa2wC85brY,11978
+aikit/.agents/skills/project-continuity/SKILL.md,sha256=gqEiDIkjbliql0rsxGIhm__tw-aCLTda3v0KGddVlF0,11991
 aikit/.agents/skills/python-work/SKILL.md,sha256=UBSgsbF7HF_8YvZgtI5v2Y0tw4BTzMcuV8hPcck6Trw,510
 aikit/.github/workflows/check-kit.yml,sha256=p0sg5S8I7yyukCV_I5OrTvUFsGYGhEbKjHezSrH76HA,2809
-aikit/.github/workflows/publish-pypi.yml,sha256=fYfCXMcIOLPSffqZFBzdLPBcMJQFS3OX9xRhoxwwwas,4110
+aikit/.github/workflows/publish-pypi.yml,sha256=870enVcLWt7BMUSz2ksn86YbSl5bHkTAleFFKa_FTRw,4489
 aikit/ai-kit/ADAPTERS.md,sha256=q4eH7mZnEWcpE1NnLNjy7Z18pnfurq3uGvPPB6uDdUw,335
 aikit/ai-kit/CONTAINERS.md,sha256=Hegm0nmRDvOEa0Tz5jJ3N8EmcDidce9pHSbrPH-vQW8,339
 aikit/ai-kit/ENGINEERING.md,sha256=Q9wOssaJOsSp1j2MT0NlTJ774rnVUK4H6O-T9NcU1ug,344
@@ -46,22 +46,25 @@ aikit/docs/ADAPTER_PATH_FIX.md,sha256=8fXc6BA_HiYO3nTVihhYO33THIEedCyp7R64EtTA6E
 aikit/docs/BENCHMARK.md,sha256=xaa33vwZcTmrHi_-9cJO1IRrljSaHhp5UDNtZdHQb_A,9961
 aikit/docs/CONTEXT7.md,sha256=PygcdLjWBTrcsFIMA9_PbPcgTfUpqAWsCAnMKFnxQIA,4628
 aikit/docs/DECISIONS.md,sha256=eLA5J-JpkbYUyHxQVSJHF13Qj6xjmvNmZ8S4lSuzd1w,2102
-aikit/docs/DEVELOPMENT_PLAN.md,sha256=1JsXP_hB0eHhBhwATJLV4QUriNx8zSJ38T65mOhY4M0,2882
+aikit/docs/DEVELOPMENT_PLAN.md,sha256=4t5PFKg83a5rQyq78qIXQA4iyUmM4uTBORdKHSgTxXM,2919
 aikit/docs/DIALOGUE_MEMORY.md,sha256=APcLvRtnNo7xFFX3IEgCcUMbrhM4DoGQ5yzcokyEMdI,11674
-aikit/docs/DOCKER.md,sha256=bpl34SRO8Wjww-Cx1yJaypQEO-875OS6z9N_h5A9aJQ,11952
-aikit/docs/DOCKER_HUB_OVERVIEW.md,sha256=ULsPKzx9e4uiu2yPfAVkSsBMOKaQ1_u83xXJRN4hvwM,12389
+aikit/docs/DOCKER.md,sha256=hUSa6bK8xzOYpUZ0muZqvcCoAkj-ky7OMecwA8HU370,11942
+aikit/docs/DOCKER_HUB_OVERVIEW.md,sha256=YMHhSqOeGFbQDcpPnN80RifXfXpQ6p2hVFU1kecVvf8,13829
 aikit/docs/EVALUATION.md,sha256=TuP1Wj_aJqHixtNlacExMHzHsWqrb-pcG4dx7XDCU6Y,5383
 aikit/docs/IMPLEMENTATION.md,sha256=TptjeIGfKvff-0JSLbI9WHv5E_kKX1t36TbOdfBvKOk,11923
 aikit/docs/MANUS_REVIEW.md,sha256=kckW418jSVw9uLoIyEJXCATKQaVSiMV0woCfKYpih8Y,5238
-aikit/docs/PYPI.md,sha256=x3ojiGH4JbgRMRgZbi0kh_HI29C9gJnPyajJWZU-Av0,8684
-aikit/docs/PYPI_DESCRIPTION.md,sha256=9GvB97UAW2Lh6YpIJggGBxPJyCq51Mm82269SINtJmg,6057
+aikit/docs/ORCHESTRATION.md,sha256=S4zm10PQx3pkQemnYPBTaT_XSTxZjos54WMEUkbi4M8,5686
+aikit/docs/PYPI.md,sha256=TPphbTGPAJSuywXYe2owGumuOlM3kjn3_Vy4SouM6rk,11853
+aikit/docs/PYPI_DESCRIPTION.md,sha256=Oa8KMNnYGoO0-IUaf19uyP5YUvdI6rCMCPyniOdPS84,6938
 aikit/docs/SECURITY_AUDIT.md,sha256=N4iVkwSXOJYyZ6vh7kTdSzL_1Pxu4SD0XU8Mgsu9p5k,5185
 aikit/docs/STRIX.md,sha256=NLm6zV_p4uCjC5Mh4CL_GYRRNnSCpUmrOL-VgrzZSOc,6837
 aikit/docs/V0_5_0.md,sha256=XGrBhvLsTegvIo2gOc5Mt2vaC5IWX67xUPqN5J5WR90,3186
 aikit/docs/V0_6_4.md,sha256=kHKiU83LQv7Iq6rWOzGBurxnBNgKwkOrDgp4h7wltq0,2865
 aikit/docs/V1_4_0.md,sha256=6GkMQ7N6x9deSB-7318K2rsC7BfG-Chex8YXhyFY_6A,8918
 aikit/docs/V1_4_1.md,sha256=RuR1SxGLf4Ncd7IlaD3Hp3-znhjcl3XPydTUMwpJA54,6373
-aikit/docs/V1_4_2.md,sha256=MauS8ILwfBzdyOqxVDn_xD6Jbf7YlArPv8ZUl6vcsA0,3509
+aikit/docs/V1_4_2.md,sha256=VWoL-d1RJoUsbWl-uhKpq52bgmeMxWylfUgCLj_JhqQ,5050
+aikit/docs/V1_4_3.md,sha256=iUoKF1BftBWbnB35F-MZU4ysUOVIZ084DCjxvOI7YHA,8555
+aikit/docs/V1_4_4.md,sha256=tlLh1G7LjV-PMm9G5YpnvEuCUvqMg5ilFCEySxmTdfs,1919
 aikit/docs/WEB_DESIGN.md,sha256=K5Y_yZlyiYaWr8PikIpbZCQmHGnkhR2vokNNRuGoeqM,11819
 aikit/docs/WINDOWS_CI_FIX.md,sha256=2HdCvpewggF0i2rnvKZiu2JAOHbVfKFvzlExradSTRc,3288
 aikit/docs/adr/0000-template.md,sha256=voTxxy1-LqBBDzsp_-8B9lL-aVtmbMhIyeZtSZHNDc8,493
@@ -79,9 +82,12 @@ aikit/docs/adr/0011-evidence-lifecycle-and-evaluation.md,sha256=bASiSRDE_Y5ZMnjF
 aikit/docs/adr/0012-measurement-led-routing.md,sha256=bSH9YILpzS7758J714Ha0Dajx7CRwjppaxEcT97ehiw,4825
 aikit/docs/adr/0013-docker-cli-image.md,sha256=twWXr_NilltZBaTkS_-zsMTGxZysThUCGAH3_viHCTw,2703
 aikit/docs/adr/0014-local-dialogue-memory.md,sha256=MoRRfTb-swVd7EefofOJdhMjZ2u4WCupLxyrPIsBzYc,2717
+aikit/docs/adr/0015-optional-bounded-orchestration.md,sha256=MjtiX4VODz0LcadKPSj1my72915JYsZaMLTjbrl85Og,2118
+aikit/docs/changelog/v0.12.0.md,sha256=2PngvmsLixkhqN61uw_ZfQg8Bf_mAQlSs3X8Tazv0-c,1425
 aikit/docs/history/original-bundle-checks.md,sha256=u8vcuLU00e6rfwzN4x9Hjhklj-RyDHUj9HPj8s6iDOM,1791
 aikit/docs/history/v0.1-changelog.txt,sha256=ehslKASZnr-Q5ejqr4X4ShAeAhvWrYTIGs9edFLwJTg,6721
 aikit/docs/history/v0.10-changelog.md,sha256=pv323p2EX6itkbPNK8Wxqoz3PEZDi3zjDmlXA1oHElY,2123
+aikit/docs/history/v0.13.0-changelog.md,sha256=xYBsT5SPdCK17JnCSi_oxzrr5CiDKYalHWlDmEP1daw,1064
 aikit/docs/history/v0.2-changelog.md,sha256=UZUd0-tzlDBfIqlSItNtPN6kmSSx-1Hy-fdo_i7ir5E,4974
 aikit/docs/history/v0.3-changelog.md,sha256=cJoRPlSlyA7OAvMfVURKvKs54C5k2tyQLBl6c8bL0pI,3983
 aikit/docs/history/v0.4-changelog.md,sha256=VNoFetIxEWE4V7EF41I8l-9ilk18MM1aLamB4gs7FAI,4881
@@ -93,7 +99,7 @@ aikit/docs/history/v1.2.0-changelog.md,sha256=uNHoO2c1lbkzMSi64D65_wQbBOaIZ4pqfD
 aikit/docs/history/verification-before-measurements.md,sha256=-g5nSLDeX_XkMJnrBG8yjSaxYh9AksnrGAK6lV0yu4s,5033
 aikit/integrations/CONVENTIONS.md,sha256=3INoa_gY_G1rTo890F2IaAkDTHtBFtPVBpTKrPppdgQ,165
 aikit/integrations/README.md,sha256=G2WBk7WbX32dTZFHnSaHLd00gRcvPEqH78chpm2ee_k,858
-aikit/integrations/agents.json,sha256=en3Q41dDDjKwubBiB7VK9xYak8RpqPWrHoitbHO-bmU,4833
+aikit/integrations/agents.json,sha256=g5xvholPsln5IKwzqM3TLO8iWHzTrW6XMkAEwEGvZrM,4897
 aikit/integrations/ai-kit-check.yml,sha256=auHZP4770QPzgm0zPxsXfQ8D5BT02qpGFt7Ss0xwrP0,2431
 aikit/integrations/ai-kit-cline.md,sha256=L4gNlRE33StC3XmGiV_zUusGCdLKzyavqsAti4C9TTs,246
 aikit/integrations/ai-kit-roo.md,sha256=2-xKWrNvzsfq09ZHsjvbCygINia9LpS8CQFj4T_eQ6M,209
@@ -104,24 +110,28 @@ aikit/integrations/claude-settings.git-ask.json,sha256=4Nts0zGxuQ_jdUlYcnooq8o6h
 aikit/integrations/copilot-instructions.md,sha256=vsKX9589IIjngAfH4wqr1_GVjpL0Mx8mu2OoOgZ_y_A,139
 aikit/integrations/security-audit.json,sha256=Pph9udBmg-EnWtCFQZfP-uYjuaEv8h0AjCh2Xz1eb7I,5124
 aikit/integrations/strix.json,sha256=WeeIZahjiOGG6x71EIHQuZfH6umMqcsPxGg5-LuJYv8,2657
+aikit/integrations/codex-agents/aikit_explorer.toml,sha256=sOWADcpFmwBNiRs7OZ9cqNrqXS2L0JjtYiEj9lj6QLw,512
+aikit/integrations/codex-agents/aikit_reviewer.toml,sha256=NsNA0UgU3oPHzCiVMzvMG3q0mYqp9MR4GnOvMVdRPQo,566
+aikit/integrations/codex-agents/aikit_worker.toml,sha256=jU1ZVqd1K0tQBbCn_OwFEYY1rrL6BwJRuzWdWxi9jGc,574
 aikit/scripts/__init__.py,sha256=Nq1JfJ7G4ekmLXrJS4eXIhHuESn8zf8ZLOh9ZR96M7Y,38
 aikit/scripts/adapters.py,sha256=qIzu3tkrTgWEFt_wmS1pt6vyyxAegOe27YzHPhvvHIc,8171
 aikit/scripts/adaptive.py,sha256=1epV_Qj68k33Dp92J7YfOOSM4Lx5_6ae5uF1KdCk3vs,10341
 aikit/scripts/adr.py,sha256=MiznKf87_lnd_aefa-WcIjLvqqvndhGUSrh7_r6-okY,2149
 aikit/scripts/benchmark.py,sha256=zpqN6tzX9jWuf1M5bH-j4rBnTm-k5hSJr5CGKVOEIcc,31399
 aikit/scripts/changelog.py,sha256=NVhRrHMQvLkHEkGEdByOt-CPRaRaaMPdMcPNhMnjZ6s,1868
-aikit/scripts/check_distribution.py,sha256=rZ36FqxOQ-h1_QOeY17i4g_CvSvqz-SpX-P4DM1NWRM,9575
-aikit/scripts/check_kit.py,sha256=YXZ2SXxzzyRh7hZjFMg_mtRz4mr-Q-nEXvn-41W8Ti8,23165
+aikit/scripts/check_distribution.py,sha256=4VnOMwbPxaOL4pFjjpViSIXo64MjWhGYWWbP-lfh4XA,12993
+aikit/scripts/check_kit.py,sha256=g4k3icEOCcdWx61suFIYmD9qTNwnXIy1-zHx2ov9FoI,23310
 aikit/scripts/context.py,sha256=iVxiJQ3ZeU-yqFDRRlzq4zxPCz9AtrXTnQAPWJqzNko,9679
 aikit/scripts/docker_test_usage.py,sha256=GksIYslTVKm9mcFDulle_FtkMuKjVzHfdAr5FLXB0Bk,2529
-aikit/scripts/doctor.py,sha256=VgWUFHkCVaY3c03HBzas3aLgh1K9UZvA9R5UUHy9EDQ,16057
+aikit/scripts/doctor.py,sha256=b0vNOOe66SipkokMoiVazpoC4RPqUzaLI0DB4uaySdo,16473
 aikit/scripts/evaluate.py,sha256=3HclA2D2QWHTk2y7KPLzoGY-PoZ_df1Dbtfwz4wfFtQ,5754
-aikit/scripts/install.py,sha256=7N3z5085zpXgw-lHU3KLOIZnrvGcUcGrD9p5O4CaDoU,85002
+aikit/scripts/install.py,sha256=lWHaeaNjmKqL4qbHQvamEa5_Ykll3KlgSaWzIWypWLE,86764
 aikit/scripts/learning.py,sha256=jMfy2tbJzpRzxcKdg8d4dyU4JVQ-9_UrGS_3tFVv1HE,14860
 aikit/scripts/memory.py,sha256=ukwxmEEnwX62kFA6t_sJ9kTZuJz6yowAq3g3RpasQC8,19140
 aikit/scripts/memory_import.py,sha256=j5OtYG18NUV-K0avdy8Bup3OgxAETPcR1_kXPufqSNM,8836
 aikit/scripts/memory_store.py,sha256=NIwMwLIocKo7pps9V1OdgHV_51B6-_1L_l-x7OHlhLI,4598
 aikit/scripts/metrics.py,sha256=FZfCCK_3FaS1Vzs4M_y4Iy6G0SlesicMPDBwKfCP0cU,20847
+aikit/scripts/orchestrate.py,sha256=zA6aYKjJLOf36CFn0o2Fbc4nF5s2wmXeHn0Sc1p67pA,25510
 aikit/scripts/router.py,sha256=B58okHVqyMYb7TyukI8INPk4SWO6HIuzMEg3Jf5ySVE,22427
 aikit/template/AGENTS.md,sha256=lDrUtWP2RVc6d7EoReASoUTFMxVdWygmZPSv8H2-1bU,1812
 aikit/template/CHANGELOG.md,sha256=HpJ54sfevof2M76rbyG97AxMVXqkqKBJE6rAgStl_PE,298
@@ -167,12 +177,14 @@ aikit/template/ai-kit/CORE.md,sha256=HYP1sD8tFFxe7YSnuG3Anbf2JvG5B086RpKcvEUJjKw
 aikit/template/ai-kit/ENGINEERING.md,sha256=w_OC0J4L9ZE8uIm3b9lAbyq0gElbFL1derD3DY46DQg,2680
 aikit/template/ai-kit/MCP.md,sha256=dKA4zWhRToxit1zGiO-6bDH5XfTHoUuhizXrQVjQDns,1638
 aikit/template/ai-kit/METRICS.md,sha256=nUb_eA89Xx0cBjdIqz2BuiF9HbGMJWstLnWjUgqhfd8,9511
+aikit/template/ai-kit/ORCHESTRATION.md,sha256=NyhbezBdRXsLbsFXYQkW_DY6dNqYrUg5oXwykBzY-mQ,4765
 aikit/template/ai-kit/SECURITY-AUDIT.md,sha256=El7VX3d5oTCWx3zVbjmQM7W184bX4_Ya0pZgEPzzOyc,2405
 aikit/template/ai-kit/SECURITY.md,sha256=SfIMvn2_Eq202pjHwOwhJ9eKHrqB8C5OYO0sLbLInF4,3124
 aikit/template/ai-kit/SKILLS.md,sha256=h2N0rMP6iOdbowAUiVEC7Y4QhYZvEa_7zXFwFRVB8mM,3064
 aikit/template/ai-kit/STRIX.md,sha256=5bzkdRwyD9V5lw-tPF-Rku83l1-uqAlDRrjK-juSHiM,5381
 aikit/template/ai-kit/UPSTREAM.md,sha256=odDwMrSwoeVuKemTIAmWImPrmvyrv6liUMPWA6mztl0,4583
 aikit/template/ai-kit/WEB-DESIGN.md,sha256=2kWkKeWMffUzSH0tio4lwmmBj0g6rkZx_NBdGh0Cmag,5255
+aikit/template/ai-kit/orchestration.json,sha256=bax1qEJAFz4n9bhdx9vUKeLzreZL6mJc27vdOWWQPQk,283
 aikit/template/ai-kit/project.json,sha256=qsyHcDU_dTkzkul0i_Zk9TQlZb3IX4evG3hrus1SWNo,194
 aikit/template/ai-kit/settings.json,sha256=ZCjs8ME3MPLPGF7b1SIS6rIhUf0OuyhI2-56HDDrvG4,248
 aikit/template/ai-kit/profiles/OWNER.md,sha256=O1V8mej_yh3wOfmZe7Ar_rFfV4DquWhwJbCbteslJmU,1583
@@ -242,10 +254,10 @@ aikit/template/docs/design/ACCEPTANCE.md,sha256=Z9uLS4qLDPSSxCF0OeZGODAXYH6FTnSw
 aikit/template/docs/design/BRIEF.md,sha256=C71Q3-Dr8AyN5KNyuHoIIkVoxCsczaVS8H7seZR2ksc,1552
 aikit/template/docs/design/SYSTEM.md,sha256=GELwyldo0Tqc3xm-twMxoEsYWX7n0q3oiI_42g7N71Q,1590
 aikit/templates/agent-secrets.ignore,sha256=tv-ODdU1SHB7QYdjCHGc-jzcFJmQEG0ewIxEFPNdlAA,382
-aikit/templates/gitignore.private,sha256=NYXXAZgcC-5G_MLRGaFNHW5n9V2TdYK78wOwjA0SRV8,2876
-aikit/templates/gitignore.team,sha256=0ySECblz4-vRx33DBkyzWXkRhgFFOcuvXEHpecVkyAE,2626
-aikit/tests/build_distribution.py,sha256=cevJDYnUJoLRGHt_XG1MbB0ofIrZoWXadzmPNol9QV4,3766
-aikit/tests/docker_smoke.py,sha256=vw49ZqeaVxJEumJyP0A0Wg_1LiyixMqjqybATw3T8PQ,9500
+aikit/templates/gitignore.private,sha256=cv6tcKQ7tDxKPaLaHa1DyczEAQRoH1JRu_ZZVVpKt5M,2900
+aikit/templates/gitignore.team,sha256=OzaA4_IdTNuG0gnTfXf9zkTuoa5JT3rJuvR2UKD6CLE,2650
+aikit/tests/build_distribution.py,sha256=Rb-zYjgGWvBNaG073Tei8m56Mrflm1JvCYnCGjVOwJg,3820
+aikit/tests/docker_smoke.py,sha256=mF4xxAnFRmUQ-qffV0xceiLMB8v9-zX1E6xsFZVxEiw,10078
 aikit/tests/test_adapters.py,sha256=Qa8M3o1FZuqOVTk2YMCXKh1UKoJyPQ2pv0-b-ckfqyI,5377
 aikit/tests/test_aikit.py,sha256=OE7kQz1zFR5eDitpBsmL1UkSMkWwDMmcIeOnd2ubx0s,3408
 aikit/tests/test_benchmark.py,sha256=1_NzpgaTU0CRNu6F6P3f9EPx0uUYYKHBiChUtTxR9Zc,13558
@@ -264,15 +276,17 @@ aikit/tests/test_memory.py,sha256=bv1aiYMWBSMbvICa7fLTZnLeckAV2JSSApOoS2KmSXI,20
 aikit/tests/test_metrics.py,sha256=SaZoNFNH66p74QucZPJRD0U8LkKoMUIqsY5x0Gk-WMI,11073
 aikit/tests/test_native.py,sha256=YxU-mSnf7zT7EY1u4-SMRY0pcPws9ko86uilzd1WhXE,19068
 aikit/tests/test_onboarding.py,sha256=0nJdWnfZVDtTTSQ4alcpgQgd-8_KpgI_Bl79SwWts7c,15255
+aikit/tests/test_orchestration.py,sha256=2w7PB-x4NF8d6PeL65EK4GoGj7iyzf1r6qXRtE4o3cg,21642
+aikit/tests/test_pypi_events.py,sha256=cn3TaZsgevqqaJaSHqMEX_9IOJlXZzvbtim0iDG50e0,10294
 aikit/tests/test_router.py,sha256=bA_AWDxzn7l_G5cTHd9uvCadRlnpaY9DGH5lTzpXPeY,19667
 aikit/tests/test_security_audit.py,sha256=kPW5Mjx_G0fWIxHr6sjPNF-HsdGrM_cXqFIL-873fvY,13527
 aikit/tests/test_strix.py,sha256=ttBTs60eXUnemfn5sJvL4Sm329flcLXivv9U_RkRsFo,12867
 aikit/tests/test_web_design.py,sha256=QU-1Nikt31tKSSp42QP7EjelUgFqHtQcm9Qtr6ixQGE,12379
-aikit/tests/wheel_smoke.py,sha256=YqBDwMqpbJP0IoCFCVcyLr6wGCQg0Da6uZFWNP0KCFE,5842
+aikit/tests/wheel_smoke.py,sha256=KUNvz2jN39mHlCQ-K9eP2DJhHFZX5Ng6CjBJumCc21A,6365
 aikit/tests/fixtures/create-junction.ps1,sha256=gWIMFbA3oQ8siQjy3wh2wU3SYPoF9K3rRlG3RgruBM4,632
 aikit/tests/fixtures/golden/claude-settings-local.json,sha256=YEOcQqZs-Q93j8e4JMoxyAHLpk6ANSMduieMU6EzqCA,1340
-ai_kit_python-1.4.2.dist-info/METADATA,sha256=fZGT8c-K5cf-J-6sAukl0ER4COrbTW7AFNaNK_CLjVM,7467
-ai_kit_python-1.4.2.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-ai_kit_python-1.4.2.dist-info/entry_points.txt,sha256=cPpNaVjBYz9S8t0ysZf37HXnBsXiX14yZX-C1fePz4s,47
-ai_kit_python-1.4.2.dist-info/top_level.txt,sha256=Ck-hW3dWXfVl4ca1lZReDP49M4R4lPu0zdyrt29YuqI,6
-ai_kit_python-1.4.2.dist-info/RECORD,,
+ai_kit_python-1.4.4.dist-info/METADATA,sha256=E2iEPWaMH3PiHXQqoSvtTxs1FSPgfmZzpU2Dp4PzJ1c,8347
+ai_kit_python-1.4.4.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+ai_kit_python-1.4.4.dist-info/entry_points.txt,sha256=cPpNaVjBYz9S8t0ysZf37HXnBsXiX14yZX-C1fePz4s,47
+ai_kit_python-1.4.4.dist-info/top_level.txt,sha256=Ck-hW3dWXfVl4ca1lZReDP49M4R4lPu0zdyrt29YuqI,6
+ai_kit_python-1.4.4.dist-info/RECORD,,

aikit/.agents/skills/project-continuity/SKILL.md

@@ -7,8 +7,7 @@ description: Maintain AI-KIT's own context, template boundaries, and installer v
 
 Read [contribution rules](../../../CONTRIBUTING.md). Read optional local `../../../PROJECT_CONTEXT.md`, `../../../AGENTS.md` and `../../../WIKI.md` when present; otherwise verify facts from public source/configuration. These three root files stay local and untracked, outside wheel/Docker payloads; their template counterparts stay public. Check distributions with and without local copies and preserve their on-disk bytes when untracking.
 Keep the root context/history about this kit; keep template project facts uninitialized.
-For a procedure change, update current maintainer commands, this pointer contract, and relevant implementation docs in the same task.
-When verified facts or agreements change, synchronize this skill's scope/procedure/pointers and WIKI with the context; keep actual facts in context.
+Sync commands, this skill, docs, context and WIKI on procedure/fact/agreement changes; keep facts in context.
 Validate templates/links/registry, the agent registry (integrations/agents.json), and behavioral installation scenarios; record root CHANGELOG entries. Keep the root SKILL.md (the repository as a skill) consistent with the CLI, presets, extras, and policies.
 Review explicit semantic acceptance and future-upgrade conflicts whenever installer baseline behavior changes.
 Check candidate draft preservation, state/settings validation, and adapter retirement conflicts when changing installation. Exercise installed Git visibility and portable linked-path refusal; distinguish synthetic fixtures from real application trials. Verify the conditional Docker trigger in installed AGENTS and preserve edited entry points during upgrades.
@@ -17,18 +16,18 @@ Exercise manifest-based profile detection and project-fact drafts (version/comma
 For generated client configuration, exercise private/team settings files and mode switches, owned-entry moves, project.json precedence, secret lists, ignore blocks, every scoped rule format with root modules and skipped paths, presets that turn extras off, and workflow skill copies; recheck client formats against primary docs before changing them.
 For routing, compare the implementation ladder with canonical POLICY, exercise English/Russian operation/risk regressions and override precedence, provider-review status/sources, and distinguish recommendations from executed model controls. For stack profiles, exercise manifest evidence, module scoping, and command drafting; for Filament specifically test Composer dependency/lock evidence and source/native skill lifecycle. For optional metrics, verify failure/recovery accounting, missing-value coverage, duplicate/lock/path guards, private/team journal visibility, schema 1/2 compatibility, experiment/arm/task identity, per-provider analyze output, and upgrade preservation. Exercise context snapshots and doctor warnings for new/removed modules, profile drift, and manifest changes. Exercise adapter reports plus explicit retirement of unchanged files, backups/state updates, and modified-file conflicts. Exercise opaque evaluator pair coverage without task-text persistence. Use the [evaluation protocol](../../../docs/EVALUATION.md) for separately authorized application trials; synthetic fixtures establish no savings.
 Record actual OS/runtime and unavailable checks in the implementation record; keep source visibility checks separate from client activation.
-For measurement-led changes, test schema 1/2/3 compatibility, fixed A/B controls, immutable Git blobs and isolated repeated workspaces, missing/estimated telemetry, semantic-review gates, interrupted runs and idempotent private exports. Exercise resume identity checks, per-unit failure recording and configurable kit-arm agents/presets. Check that worker Git discovery cannot reach the source through parents: a ceiling at cwd itself is ineffective. Keep worker requests separate from observed execution. Exercise routing modes/pins/profiles, distinct-case quality floors, matched history, unsupported controls, immutable proposal history and explicit backed-up restore. Exercise module context scope, duplicate content, critical rules/ADRs above byte budgets and linked paths. Follow [the staged plan](../../../docs/DEVELOPMENT_PLAN.md) and [worker contract](../../../docs/BENCHMARK.md); defer live adapters/orchestration until their mechanisms and total coordination costs are verified.
+For measurement-led changes, test schema 1/2/3 compatibility, fixed A/B controls, immutable Git blobs and isolated repeated workspaces, missing/estimated telemetry, semantic-review gates, interrupted runs and idempotent private exports. Exercise resume identity checks, per-unit failure recording and configurable kit-arm agents/presets. Check that worker Git discovery cannot reach the source through parents: a ceiling at cwd itself is ineffective. Keep worker requests separate from observed execution. Exercise routing modes/pins/profiles, distinct-case quality floors, matched history, unsupported controls, immutable proposal history and explicit backed-up restore. Exercise module context scope, duplicate content, critical rules/ADRs above byte budgets and linked paths. Follow [the staged plan](../../../docs/DEVELOPMENT_PLAN.md) and [worker contract](../../../docs/BENCHMARK.md); keep native activation and real trials separate. For [optional orchestration](../../../docs/ORCHESTRATION.md), test opt-in/persistence, Codex helper conflicts/retirement, private/team/archive exclusions, bounded inputs/keys/budgets, reservations/locks, unknown billing, source-bound review and reconciliation without replay. Keep native costs separate; tests make no live calls.
 Resolve temporary fixture roots before deriving paths used by guards, assertions, or injected failures. Test equivalent path spellings; keep cleanup bound to original disposable directories. [Windows CI regression](../../../docs/WINDOWS_CI_FIX.md) records the relevant scenario.
 For reference upgrades, check the actual published tree and old paths left by overlays. Compatibility pointers link to canonical owners; never hide broken legacy links from the checker.
-When editing onboarding docs, verify examples against the actual CLI/defaults and preserve links to policy owners. Keep installation, native discovery, and measured execution claims distinct. For [OpenRouter documentation](../../../README.md#working-with-openrouter), recheck primary API/cache/usage docs; distinguish shipped context manifests from proposed request assembly/runtime, prompt caching from response reuse, and observed usage from assumed savings. Root README and Docker Hub Overview have no size quota; retain scoped instruction budgets and normal link/language checks.
-For [PyPI releases](../../../docs/PYPI.md), verify wheel/sdist metadata, VERSION, licenses, description, resources and private/path exclusions; build the wheel from sdist and smoke-install offline. Quote complete Twine globs; report OS gaps. A JSON 404 does not prove name eligibility; verify publisher registration. Test identity guards without uploads; preserve CI names and existing release tags. Use a new patch when an old tag predates publication support. Trusted Publishing stays manual/build-only by default, with exact version/tag/repository gates, OIDC only in upload jobs and validated same-run artifacts; setup and publication are separate. Keep MCP posture separate from live client activation.
+Verify onboarding examples against CLI/defaults and canonical policy; distinguish installation, discovery and execution evidence. For [OpenRouter documentation](../../../README.md#working-with-openrouter), recheck primary API/cache/usage docs; distinguish shipped context manifests from proposed request assembly/runtime, prompt caching from response reuse, and observed usage from assumed savings. Root README and Docker Hub Overview have no size quota; retain scoped instruction budgets and normal link/language checks.
+For [PyPI releases](../../../docs/PYPI.md), verify metadata, VERSION, licenses, description, resources and private/path exclusions; build the wheel from sdist and smoke-install offline. Quote Twine globs; report OS gaps. A JSON 404 does not prove name eligibility. Test release/manual identity guards without uploads; preserve CI names and old tags. Published stable releases prepare PyPI artifacts; manual runs default to validation. Require exact version/tag/repository gates, owner approval and future tag coverage; agents must not approve deployments. OIDC belongs only in upload jobs consuming validated same-run artifacts. Keep setup, upload and live MCP activation separate.
 For repository administration or changes to existing required CI names, consult [repository maintenance](../../../CONTRIBUTING.md#repository-maintenance), verify live protection and emitted names, and keep required checks aligned. New local jobs establish no hosted result or required-check update. Remote changes need explicit authorization; Core governs commits/pushes.
 For every task assess [Docker image impact](../../../docs/DOCKER.md#change-impact-and-image-refresh), including packaged instructions and defaults. Follow canonical [image freshness](../../../template/ai-kit/CONTAINERS.md#image-freshness); rebuild/test affected final sources as ai-kit:dev or record why no rebuild is needed. For the image, verify actual client/daemon, pinned build inputs, VERSION/label identity, closed context, wheel resources, non-root bind permissions, read-only/offline preview and apply, preservation, conflicts, rerun and SIGTERM. Validate the Job schema; distinguish cluster/runtime coverage. Record test cache/volume ownership and size; follow canonical cleanup without shared-builder pruning. Keep image publication separate.
 For [dialogue memory](../../../docs/DIALOGUE_MEMORY.md), test all supported imports, selected ChatGPT branches, omissions, untrusted roles, pending prose, explicit keyed conflicts/resolutions, source-bound review, immutable reruns, both exports and byte limits. Exercise linked/blocked paths, private/team upgrade preservation, Git/build/package exclusions and installed CLI execution. Do not infer semantic agreement from no keyed conflicts or claim live sync/upload from local export. Preserve raw sources and default project context.
 For optional upstream skills, follow [security-audit](../../../docs/SECURITY_AUDIT.md) and [Strix integration](../../../docs/STRIX.md): preserve pinned bytes/license and newline attributes, verify bounded tree coverage/digests and nested-path aliases, explicit-only metadata, absent default/preset payloads, independent persistent choices, local adaptations/conflicts, links, visibility and wheel resources. Exempt only verified external examples from authored model/language/budget checks. Keep installation separate from audits/runtime setup; report unsupported validators. For Strix, check writable copy isolation, explicit full/diff scope, budget/data destination and no implicit cloud fallback; integration tests must start no scan, model or container.
 For [Context7](../../../docs/CONTEXT7.md), check opt-in skill/registry selection, independent persistence, source/native copies, local conflicts and unchanged native MCP configuration. Keep normal skill discovery, version-aware sanitized queries and remote activation separate. Recheck client schemas/authentication against primary docs; a source revision does not pin the hosted service.
 For [Web Design](../../../docs/WEB_DESIGN.md), check whole-module default absence, multi-entry skill selection, independent persistence, created-once project documents, native copies/retirement, local conflicts and linked/blocked paths. Exercise workflow context scope, required design memory above budgets, plain HTML without assumed stack facts, private raw output/team visibility and offline wheel resources. Keep TypeUI/SkillUI setup and real browser/Laravel acceptance separate from installer evidence; adopt external guidance only within the selected stack/visual system.
-For an explicitly requested release version, update VERSION, the root changelog, README release pointer, WIKI and maintainer context together; keep release history out of project templates. Recheck CLI version, kit validation and wheel metadata/install; build in an isolated source copy and exercise preservation across the prior-version baseline. State which behavioral results preceded release labeling; publication/tagging remain separate actions under Core. In release notes, distinguish Web Design instructions from external tools and generated-site acceptance, Context7 setup from installation, and OpenRouter guidance from a live adapter; verify security examples against pinned contracts.
+For a requested release, synchronize VERSION, root changelog, README, WIKI and maintainer context; keep kit history out of templates. Recheck CLI/version, kit, isolated archives, offline installation and prior-version upgrade preservation. Distinguish checks before/after labeling. Follow [the verified release path](../../../docs/V1_4_3.md#pypi-publication-and-read-back): preserve tags, wait for hosted build checks and report pending human approval; never approve PyPI for the owner. Git authorization follows Core. Release notes must distinguish installed guidance from external tools, live client/model setup and generated-site acceptance; verify security examples against pinned contracts.
 For every Docker image release, follow the [Docker Hub checklist](../../../CONTRIBUTING.md#docker-hub-releases) and update the complete [Overview](../../../docs/DOCKER_HUB_OVERVIEW.md); synchronize version/features/examples before building and verified publication identity afterward.
-For the current Docker/privacy release, follow [v1.4.1 preparation](../../../docs/V1_4_1.md); keep local image identity distinct from a registry digest and source-bound human review distinct from automatic conversation synchronization. After explicitly authorized publication, read back the registry digest, platform and version/configuration; preserve the prepared image and record later publication-only documentation separately. Do not assign additional tags implicitly.
+For Docker releases, follow [image verification](../../../docs/V1_4_3.md#docker-hub-143); keep local image identity distinct from a registry digest and source-bound human review distinct from automatic conversation synchronization. After explicitly authorized publication, read back the registry digest, platform and version/configuration; preserve the prepared image and record later publication-only documentation separately. Do not assign additional tags implicitly.
 Do not bootstrap the reference repository as an application or imply native/runtime checks passed from static validation.

aikit/.dockerignore

@@ -82,6 +82,8 @@ ai-kit/.metrics
 ai-kit/.metrics/**
 ai-kit/.memory
 ai-kit/.memory/**
+ai-kit/.orchestration
+ai-kit/.orchestration/**
 ai-kit/.upstream-cache
 ai-kit/.upstream-cache/**
 ai-kit/.design

aikit/.github/workflows/publish-pypi.yml

@@ -1,6 +1,8 @@
 name: Prepare or publish Python package
 
 on:
+  release:
+    types: [published]
   workflow_dispatch:
     inputs:
       destination:
@@ -19,11 +21,15 @@ permissions:
   contents: read
 
 concurrency:
-  group: python-package-${{ github.ref }}-${{ inputs.destination }}
+  group: python-package-${{ github.ref }}-${{ github.event_name == 'release' && 'pypi' || inputs.destination }}
   cancel-in-progress: false
 
 jobs:
   build:
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'release' && github.event.action == 'published' &&
+       !github.event.release.draft && !github.event.release.prerelease)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -32,13 +38,10 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '3.13'
-      - name: Verify explicit release identity before building
-        env:
-          RELEASE_VERSION: ${{ inputs.version }}
-          DESTINATION: ${{ inputs.destination }}
+      - name: Verify release or manual event identity before building
         run: >-
           python scripts/check_distribution.py identity
-          --expected-version "$RELEASE_VERSION" --destination "$DESTINATION"
+          --event-name "$GITHUB_EVENT_NAME" --event-path "$GITHUB_EVENT_PATH"
           --ref "$GITHUB_REF" --repository "$GITHUB_REPOSITORY"
       - name: Validate sources and behavior
         run: |
@@ -65,7 +68,10 @@ jobs:
 
   testpypi:
     needs: build
-    if: inputs.destination == 'testpypi' && github.repository == 'tigusigalpa/ai-kit' && startsWith(github.ref, 'refs/tags/v')
+    if: >-
+      needs.build.result == 'success' && github.event_name == 'workflow_dispatch' &&
+      inputs.destination == 'testpypi' && github.repository == 'tigusigalpa/ai-kit' &&
+      startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     environment:
       name: testpypi
@@ -87,7 +93,10 @@ jobs:
 
   pypi:
     needs: build
-    if: inputs.destination == 'pypi' && github.repository == 'tigusigalpa/ai-kit' && startsWith(github.ref, 'refs/tags/v')
+    if: >-
+      needs.build.result == 'success' &&
+      (github.event_name == 'release' || inputs.destination == 'pypi') &&
+      github.repository == 'tigusigalpa/ai-kit' && startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     environment:
       name: pypi

aikit/.gitignore

@@ -58,3 +58,5 @@ build/
 .DS_Store
 Thumbs.db
 Desktop.ini
+
+/ai-kit/.orchestration/

aikit/CHANGELOG.md

@@ -1,9 +1,24 @@
 # AI-KIT changelog
 
+## v1.4.4 (unreleased)
+
+- Added a prominent README comparison of the Docker image and Python package, with registry links, requirements, install commands and setup guides.
+- Added opt-in Codex helpers and a bounded OpenRouter text executor: explicit scope, capped-key preflight, durable reservations, private accounting, source-bound review and billing reconciliation without replay.
+- Preserved installer defaults, presets, settings, helper edits and private/team runtime exclusions; added mocked regressions, detailed [instructions](README.md#optional-orchestration), package/image preparation and [verification](docs/V1_4_4.md).
+
+## v1.4.3 (2026-10-16)
+
+- Added a live PyPI version badge to README.
+- Added stable GitHub Release checks and owner-approved PyPI uploads, event/version/repository guards, future v* tags and manual validation. [Procedure](docs/PYPI.md#release-to-pypi-with-owner-approval). Archived v0.13.0 text intact.
+- Added fifteen event regression tests. Before labeling, 32 hosted checks and build-only verification passed, plus kit, 368 Linux tests (two skips), archive/privacy/Twine/offline wheel and Docker checks. [Verification](docs/V1_4_3.md).
+- Verified 1.4.3 CLI/archive/image identity, offline packaging, Docker smoke, 368 Linux tests and preserved private/team upgrades from v1.4.2.
+- Verified PyPI 1.4.3 publication, matching hosted hashes and fresh registry installation; [receipt](docs/V1_4_3.md#pypi-publication-and-read-back).
+- Published Docker Hub 1.4.3 with verified image/digest and refreshed README/Overview; [receipt](docs/V1_4_3.md#docker-hub-143).
+
 ## v1.4.2 (2026-10-16)
 
 - Verified kit/archive/offline installation, 351 Linux tests (two skips), 23 Windows CLI/archive tests and Docker smoke. [Evidence](docs/V1_4_2.md).
-- Prepared `ai-kit-python` 1.4.2; PyPI publisher/GitHub pypi environment verified. Preserve v1.4.1 Git/Docker. [Status](docs/V1_4_2.md).
+- Published `ai-kit-python` 1.4.2 with verified PyPI hashes and installation. Preserved v1.4.1 Git/Docker; [evidence](docs/V1_4_2.md).
 - Fixed quoted Twine wildcards for Windows CI.
 - Added PyPI metadata, a portable [description](docs/PYPI_DESCRIPTION.md), README guidance and a [release procedure](docs/PYPI.md). Wheel/sdist checks cover metadata, licenses, resources, private files, offline installation and publication identity. Manual Trusted Publishing defaults to validation, requires exact version/tag/repository, and gives OIDC only to upload jobs consuming tested artifacts. Required CI names stay unchanged.
 - Isolated builds inject synthetic private probes; archives exclude private drafts and credential filenames. Added tested `aikit --version`; published Docker 1.4.1 examples use its existing `--help`. Added a README Docker Hub badge.
@@ -46,19 +61,11 @@
 
 ## v0.13.0 (2026-10-11)
 
-- Added Rust, .NET, Java (Maven/Gradle), and Terraform/Helm stack profiles with evidence-based per-module detection: Cargo.toml (rust-version, cargo test/build/clippy), *.csproj/*.fsproj/*.vbproj and global.json (TargetFramework, dotnet test/build), pom.xml/mvnw/build.gradle(.kts)/gradlew (language level, wrapper-aware commands), and .tf files or Chart.yaml (fmt/validate, helm lint). Drafts remain suggestions until bootstrap confirms them.
-- Added rust-work, dotnet-work, java-work, and infra-work skills to the registry; Claude native copies install with the claude agent selection.
-- Benchmark packs accept the new stack names; README, SKILL.md, and WIKI profile lists updated.
-- Verified locally (Windows/Python 3.14.6): 254 tests ran, all passed, 1 runtime skip; kit validation returned zero errors and zero warnings; Python 3.10 grammar verified; end-to-end smoke detected RUST/INFRA with drafted context and installed source/native skills. Real applications of the new stacks remain untrialed.
+[Archived release entry](docs/history/v0.13.0-changelog.md#v0130-2026-10-11).
 
 ## v0.12.0 (2026-10-11)
 
-- Benchmark packs accept optional `kit_agents`/`kit_preset` (default codex/minimal), so kit arms install the client's real adapter set and preset instead of a hard-coded arm; both are validated against the installer registry.
-- Benchmark task paths are now probed against the benchmark project instead of the process working directory.
-- Interrupted benchmark runs are resumable: re-running `benchmark run` with the identical pack skips completed units and continues missing ones, and a changed pack is refused against the existing run. Per-unit infrastructure failures are recorded as explicit failed units, so one bad unit neither aborts the run nor hides as an executed attempt; failed units still block savings and cannot be reviewed as correct.
-- The unified `aikit` dispatcher now prefers installed `aikit.scripts.*` package modules over bare script-path imports, avoiding duplicate module objects inside the wheel.
-- The checker document budgets are named constants; the root README budget rises to 22000 bytes (human onboarding that never enters project context), other documents keep 12000.
-- Verified locally (Windows/Python 3.14.6): 252 tests ran, all passed, 1 runtime skip; kit validation returned zero errors and zero warnings; Python 3.10 grammar was verified for the changed sources. Live workers, native client activation and hosted CI remain unverified.
+[Full preserved entry](docs/changelog/v0.12.0.md).
 
 ## v0.11.0 (2026-10-11)
 

aikit/CONTRIBUTING.md

@@ -30,7 +30,7 @@ The root README and Docker Hub Overview are user documentation without a size qu
 
 Follow [PyPI preparation and release](docs/PYPI.md) for every package release. Synchronize VERSION, pyproject metadata, [description](docs/PYPI_DESCRIPTION.md) and README; verify license/resource inclusion and local-file exclusions in both sdist and wheel, build the wheel from sdist, run strict Twine checks and offline fresh-venv smoke. Preserve existing CI matrix/job names. Refresh the image when packaging changes affect it.
 
-Trusted Publishing remains manual and build-only by default. Registry uploads require the matching version/tag, canonical repository and the separately configured registry environment/publisher. Build tests have no OIDC permission; upload jobs consume only validated same-run artifacts. Record local, hosted and registry results separately. No upload, publisher/account setup or Git operation is authorized by preparation alone.
+A published stable GitHub Release starts PyPI preparation; manual dispatch defaults to build-only validation. Uploads require matching VERSION/tag, the canonical repository, a configured environment/publisher and the owner's human approval. Agents must not approve or bypass a pending deployment on the owner's behalf. Keep environment reviewer protections when allowing future `v*` tags; validate canonical stable versions separately. Build tests have no OIDC permission; upload jobs consume only validated same-run artifacts. Record local, hosted and registry results separately. Preparation alone authorizes no upload, account setup or Git operation.
 
 ## Repository maintenance
 

aikit/MANIFEST.in

@@ -6,6 +6,7 @@ include pyproject.toml Makefile MANIFEST.in
 recursive-include ai-kit *.md
 prune ai-kit/.metrics
 prune ai-kit/.memory
+prune ai-kit/.orchestration
 prune ai-kit/.upstream-cache
 prune ai-kit/.design
 recursive-include .agents *