ai-kit-python 1.4.2__tar.gz → 1.4.4__tar.gz

{ai_kit_python-1.4.2 → ai_kit_python-1.4.4}/.agents/skills/project-continuity/SKILL.md

@@ -7,8 +7,7 @@ description: Maintain AI-KIT's own context, template boundaries, and installer v
 
 Read [contribution rules](../../../CONTRIBUTING.md). Read optional local `../../../PROJECT_CONTEXT.md`, `../../../AGENTS.md` and `../../../WIKI.md` when present; otherwise verify facts from public source/configuration. These three root files stay local and untracked, outside wheel/Docker payloads; their template counterparts stay public. Check distributions with and without local copies and preserve their on-disk bytes when untracking.
 Keep the root context/history about this kit; keep template project facts uninitialized.
-For a procedure change, update current maintainer commands, this pointer contract, and relevant implementation docs in the same task.
-When verified facts or agreements change, synchronize this skill's scope/procedure/pointers and WIKI with the context; keep actual facts in context.
+Sync commands, this skill, docs, context and WIKI on procedure/fact/agreement changes; keep facts in context.
 Validate templates/links/registry, the agent registry (integrations/agents.json), and behavioral installation scenarios; record root CHANGELOG entries. Keep the root SKILL.md (the repository as a skill) consistent with the CLI, presets, extras, and policies.
 Review explicit semantic acceptance and future-upgrade conflicts whenever installer baseline behavior changes.
 Check candidate draft preservation, state/settings validation, and adapter retirement conflicts when changing installation. Exercise installed Git visibility and portable linked-path refusal; distinguish synthetic fixtures from real application trials. Verify the conditional Docker trigger in installed AGENTS and preserve edited entry points during upgrades.
@@ -17,18 +16,18 @@ Exercise manifest-based profile detection and project-fact drafts (version/comma
 For generated client configuration, exercise private/team settings files and mode switches, owned-entry moves, project.json precedence, secret lists, ignore blocks, every scoped rule format with root modules and skipped paths, presets that turn extras off, and workflow skill copies; recheck client formats against primary docs before changing them.
 For routing, compare the implementation ladder with canonical POLICY, exercise English/Russian operation/risk regressions and override precedence, provider-review status/sources, and distinguish recommendations from executed model controls. For stack profiles, exercise manifest evidence, module scoping, and command drafting; for Filament specifically test Composer dependency/lock evidence and source/native skill lifecycle. For optional metrics, verify failure/recovery accounting, missing-value coverage, duplicate/lock/path guards, private/team journal visibility, schema 1/2 compatibility, experiment/arm/task identity, per-provider analyze output, and upgrade preservation. Exercise context snapshots and doctor warnings for new/removed modules, profile drift, and manifest changes. Exercise adapter reports plus explicit retirement of unchanged files, backups/state updates, and modified-file conflicts. Exercise opaque evaluator pair coverage without task-text persistence. Use the [evaluation protocol](../../../docs/EVALUATION.md) for separately authorized application trials; synthetic fixtures establish no savings.
 Record actual OS/runtime and unavailable checks in the implementation record; keep source visibility checks separate from client activation.
-For measurement-led changes, test schema 1/2/3 compatibility, fixed A/B controls, immutable Git blobs and isolated repeated workspaces, missing/estimated telemetry, semantic-review gates, interrupted runs and idempotent private exports. Exercise resume identity checks, per-unit failure recording and configurable kit-arm agents/presets. Check that worker Git discovery cannot reach the source through parents: a ceiling at cwd itself is ineffective. Keep worker requests separate from observed execution. Exercise routing modes/pins/profiles, distinct-case quality floors, matched history, unsupported controls, immutable proposal history and explicit backed-up restore. Exercise module context scope, duplicate content, critical rules/ADRs above byte budgets and linked paths. Follow [the staged plan](../../../docs/DEVELOPMENT_PLAN.md) and [worker contract](../../../docs/BENCHMARK.md); defer live adapters/orchestration until their mechanisms and total coordination costs are verified.
+For measurement-led changes, test schema 1/2/3 compatibility, fixed A/B controls, immutable Git blobs and isolated repeated workspaces, missing/estimated telemetry, semantic-review gates, interrupted runs and idempotent private exports. Exercise resume identity checks, per-unit failure recording and configurable kit-arm agents/presets. Check that worker Git discovery cannot reach the source through parents: a ceiling at cwd itself is ineffective. Keep worker requests separate from observed execution. Exercise routing modes/pins/profiles, distinct-case quality floors, matched history, unsupported controls, immutable proposal history and explicit backed-up restore. Exercise module context scope, duplicate content, critical rules/ADRs above byte budgets and linked paths. Follow [the staged plan](../../../docs/DEVELOPMENT_PLAN.md) and [worker contract](../../../docs/BENCHMARK.md); keep native activation and real trials separate. For [optional orchestration](../../../docs/ORCHESTRATION.md), test opt-in/persistence, Codex helper conflicts/retirement, private/team/archive exclusions, bounded inputs/keys/budgets, reservations/locks, unknown billing, source-bound review and reconciliation without replay. Keep native costs separate; tests make no live calls.
 Resolve temporary fixture roots before deriving paths used by guards, assertions, or injected failures. Test equivalent path spellings; keep cleanup bound to original disposable directories. [Windows CI regression](../../../docs/WINDOWS_CI_FIX.md) records the relevant scenario.
 For reference upgrades, check the actual published tree and old paths left by overlays. Compatibility pointers link to canonical owners; never hide broken legacy links from the checker.
-When editing onboarding docs, verify examples against the actual CLI/defaults and preserve links to policy owners. Keep installation, native discovery, and measured execution claims distinct. For [OpenRouter documentation](../../../README.md#working-with-openrouter), recheck primary API/cache/usage docs; distinguish shipped context manifests from proposed request assembly/runtime, prompt caching from response reuse, and observed usage from assumed savings. Root README and Docker Hub Overview have no size quota; retain scoped instruction budgets and normal link/language checks.
-For [PyPI releases](../../../docs/PYPI.md), verify wheel/sdist metadata, VERSION, licenses, description, resources and private/path exclusions; build the wheel from sdist and smoke-install offline. Quote complete Twine globs; report OS gaps. A JSON 404 does not prove name eligibility; verify publisher registration. Test identity guards without uploads; preserve CI names and existing release tags. Use a new patch when an old tag predates publication support. Trusted Publishing stays manual/build-only by default, with exact version/tag/repository gates, OIDC only in upload jobs and validated same-run artifacts; setup and publication are separate. Keep MCP posture separate from live client activation.
+Verify onboarding examples against CLI/defaults and canonical policy; distinguish installation, discovery and execution evidence. For [OpenRouter documentation](../../../README.md#working-with-openrouter), recheck primary API/cache/usage docs; distinguish shipped context manifests from proposed request assembly/runtime, prompt caching from response reuse, and observed usage from assumed savings. Root README and Docker Hub Overview have no size quota; retain scoped instruction budgets and normal link/language checks.
+For [PyPI releases](../../../docs/PYPI.md), verify metadata, VERSION, licenses, description, resources and private/path exclusions; build the wheel from sdist and smoke-install offline. Quote Twine globs; report OS gaps. A JSON 404 does not prove name eligibility. Test release/manual identity guards without uploads; preserve CI names and old tags. Published stable releases prepare PyPI artifacts; manual runs default to validation. Require exact version/tag/repository gates, owner approval and future tag coverage; agents must not approve deployments. OIDC belongs only in upload jobs consuming validated same-run artifacts. Keep setup, upload and live MCP activation separate.
 For repository administration or changes to existing required CI names, consult [repository maintenance](../../../CONTRIBUTING.md#repository-maintenance), verify live protection and emitted names, and keep required checks aligned. New local jobs establish no hosted result or required-check update. Remote changes need explicit authorization; Core governs commits/pushes.
 For every task assess [Docker image impact](../../../docs/DOCKER.md#change-impact-and-image-refresh), including packaged instructions and defaults. Follow canonical [image freshness](../../../template/ai-kit/CONTAINERS.md#image-freshness); rebuild/test affected final sources as ai-kit:dev or record why no rebuild is needed. For the image, verify actual client/daemon, pinned build inputs, VERSION/label identity, closed context, wheel resources, non-root bind permissions, read-only/offline preview and apply, preservation, conflicts, rerun and SIGTERM. Validate the Job schema; distinguish cluster/runtime coverage. Record test cache/volume ownership and size; follow canonical cleanup without shared-builder pruning. Keep image publication separate.
 For [dialogue memory](../../../docs/DIALOGUE_MEMORY.md), test all supported imports, selected ChatGPT branches, omissions, untrusted roles, pending prose, explicit keyed conflicts/resolutions, source-bound review, immutable reruns, both exports and byte limits. Exercise linked/blocked paths, private/team upgrade preservation, Git/build/package exclusions and installed CLI execution. Do not infer semantic agreement from no keyed conflicts or claim live sync/upload from local export. Preserve raw sources and default project context.
 For optional upstream skills, follow [security-audit](../../../docs/SECURITY_AUDIT.md) and [Strix integration](../../../docs/STRIX.md): preserve pinned bytes/license and newline attributes, verify bounded tree coverage/digests and nested-path aliases, explicit-only metadata, absent default/preset payloads, independent persistent choices, local adaptations/conflicts, links, visibility and wheel resources. Exempt only verified external examples from authored model/language/budget checks. Keep installation separate from audits/runtime setup; report unsupported validators. For Strix, check writable copy isolation, explicit full/diff scope, budget/data destination and no implicit cloud fallback; integration tests must start no scan, model or container.
 For [Context7](../../../docs/CONTEXT7.md), check opt-in skill/registry selection, independent persistence, source/native copies, local conflicts and unchanged native MCP configuration. Keep normal skill discovery, version-aware sanitized queries and remote activation separate. Recheck client schemas/authentication against primary docs; a source revision does not pin the hosted service.
 For [Web Design](../../../docs/WEB_DESIGN.md), check whole-module default absence, multi-entry skill selection, independent persistence, created-once project documents, native copies/retirement, local conflicts and linked/blocked paths. Exercise workflow context scope, required design memory above budgets, plain HTML without assumed stack facts, private raw output/team visibility and offline wheel resources. Keep TypeUI/SkillUI setup and real browser/Laravel acceptance separate from installer evidence; adopt external guidance only within the selected stack/visual system.
-For an explicitly requested release version, update VERSION, the root changelog, README release pointer, WIKI and maintainer context together; keep release history out of project templates. Recheck CLI version, kit validation and wheel metadata/install; build in an isolated source copy and exercise preservation across the prior-version baseline. State which behavioral results preceded release labeling; publication/tagging remain separate actions under Core. In release notes, distinguish Web Design instructions from external tools and generated-site acceptance, Context7 setup from installation, and OpenRouter guidance from a live adapter; verify security examples against pinned contracts.
+For a requested release, synchronize VERSION, root changelog, README, WIKI and maintainer context; keep kit history out of templates. Recheck CLI/version, kit, isolated archives, offline installation and prior-version upgrade preservation. Distinguish checks before/after labeling. Follow [the verified release path](../../../docs/V1_4_3.md#pypi-publication-and-read-back): preserve tags, wait for hosted build checks and report pending human approval; never approve PyPI for the owner. Git authorization follows Core. Release notes must distinguish installed guidance from external tools, live client/model setup and generated-site acceptance; verify security examples against pinned contracts.
 For every Docker image release, follow the [Docker Hub checklist](../../../CONTRIBUTING.md#docker-hub-releases) and update the complete [Overview](../../../docs/DOCKER_HUB_OVERVIEW.md); synchronize version/features/examples before building and verified publication identity afterward.
-For the current Docker/privacy release, follow [v1.4.1 preparation](../../../docs/V1_4_1.md); keep local image identity distinct from a registry digest and source-bound human review distinct from automatic conversation synchronization. After explicitly authorized publication, read back the registry digest, platform and version/configuration; preserve the prepared image and record later publication-only documentation separately. Do not assign additional tags implicitly.
+For Docker releases, follow [image verification](../../../docs/V1_4_3.md#docker-hub-143); keep local image identity distinct from a registry digest and source-bound human review distinct from automatic conversation synchronization. After explicitly authorized publication, read back the registry digest, platform and version/configuration; preserve the prepared image and record later publication-only documentation separately. Do not assign additional tags implicitly.
 Do not bootstrap the reference repository as an application or imply native/runtime checks passed from static validation.

{ai_kit_python-1.4.2 → ai_kit_python-1.4.4}/.dockerignore

@@ -82,6 +82,8 @@ ai-kit/.metrics
 ai-kit/.metrics/**
 ai-kit/.memory
 ai-kit/.memory/**
+ai-kit/.orchestration
+ai-kit/.orchestration/**
 ai-kit/.upstream-cache
 ai-kit/.upstream-cache/**
 ai-kit/.design

{ai_kit_python-1.4.2 → ai_kit_python-1.4.4}/.github/workflows/publish-pypi.yml

@@ -1,6 +1,8 @@
 name: Prepare or publish Python package
 
 on:
+  release:
+    types: [published]
   workflow_dispatch:
     inputs:
       destination:
@@ -19,11 +21,15 @@ permissions:
   contents: read
 
 concurrency:
-  group: python-package-${{ github.ref }}-${{ inputs.destination }}
+  group: python-package-${{ github.ref }}-${{ github.event_name == 'release' && 'pypi' || inputs.destination }}
   cancel-in-progress: false
 
 jobs:
   build:
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'release' && github.event.action == 'published' &&
+       !github.event.release.draft && !github.event.release.prerelease)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -32,13 +38,10 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '3.13'
-      - name: Verify explicit release identity before building
-        env:
-          RELEASE_VERSION: ${{ inputs.version }}
-          DESTINATION: ${{ inputs.destination }}
+      - name: Verify release or manual event identity before building
         run: >-
           python scripts/check_distribution.py identity
-          --expected-version "$RELEASE_VERSION" --destination "$DESTINATION"
+          --event-name "$GITHUB_EVENT_NAME" --event-path "$GITHUB_EVENT_PATH"
           --ref "$GITHUB_REF" --repository "$GITHUB_REPOSITORY"
       - name: Validate sources and behavior
         run: |
@@ -65,7 +68,10 @@ jobs:
 
   testpypi:
     needs: build
-    if: inputs.destination == 'testpypi' && github.repository == 'tigusigalpa/ai-kit' && startsWith(github.ref, 'refs/tags/v')
+    if: >-
+      needs.build.result == 'success' && github.event_name == 'workflow_dispatch' &&
+      inputs.destination == 'testpypi' && github.repository == 'tigusigalpa/ai-kit' &&
+      startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     environment:
       name: testpypi
@@ -87,7 +93,10 @@ jobs:
 
   pypi:
     needs: build
-    if: inputs.destination == 'pypi' && github.repository == 'tigusigalpa/ai-kit' && startsWith(github.ref, 'refs/tags/v')
+    if: >-
+      needs.build.result == 'success' &&
+      (github.event_name == 'release' || inputs.destination == 'pypi') &&
+      github.repository == 'tigusigalpa/ai-kit' && startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     environment:
       name: pypi

{ai_kit_python-1.4.2 → ai_kit_python-1.4.4}/.gitignore

@@ -58,3 +58,5 @@ build/
 .DS_Store
 Thumbs.db
 Desktop.ini
+
+/ai-kit/.orchestration/

{ai_kit_python-1.4.2 → ai_kit_python-1.4.4}/CHANGELOG.md

@@ -1,9 +1,24 @@
 # AI-KIT changelog
 
+## v1.4.4 (unreleased)
+
+- Added a prominent README comparison of the Docker image and Python package, with registry links, requirements, install commands and setup guides.
+- Added opt-in Codex helpers and a bounded OpenRouter text executor: explicit scope, capped-key preflight, durable reservations, private accounting, source-bound review and billing reconciliation without replay.
+- Preserved installer defaults, presets, settings, helper edits and private/team runtime exclusions; added mocked regressions, detailed [instructions](README.md#optional-orchestration), package/image preparation and [verification](docs/V1_4_4.md).
+
+## v1.4.3 (2026-10-16)
+
+- Added a live PyPI version badge to README.
+- Added stable GitHub Release checks and owner-approved PyPI uploads, event/version/repository guards, future v* tags and manual validation. [Procedure](docs/PYPI.md#release-to-pypi-with-owner-approval). Archived v0.13.0 text intact.
+- Added fifteen event regression tests. Before labeling, 32 hosted checks and build-only verification passed, plus kit, 368 Linux tests (two skips), archive/privacy/Twine/offline wheel and Docker checks. [Verification](docs/V1_4_3.md).
+- Verified 1.4.3 CLI/archive/image identity, offline packaging, Docker smoke, 368 Linux tests and preserved private/team upgrades from v1.4.2.
+- Verified PyPI 1.4.3 publication, matching hosted hashes and fresh registry installation; [receipt](docs/V1_4_3.md#pypi-publication-and-read-back).
+- Published Docker Hub 1.4.3 with verified image/digest and refreshed README/Overview; [receipt](docs/V1_4_3.md#docker-hub-143).
+
 ## v1.4.2 (2026-10-16)
 
 - Verified kit/archive/offline installation, 351 Linux tests (two skips), 23 Windows CLI/archive tests and Docker smoke. [Evidence](docs/V1_4_2.md).
-- Prepared `ai-kit-python` 1.4.2; PyPI publisher/GitHub pypi environment verified. Preserve v1.4.1 Git/Docker. [Status](docs/V1_4_2.md).
+- Published `ai-kit-python` 1.4.2 with verified PyPI hashes and installation. Preserved v1.4.1 Git/Docker; [evidence](docs/V1_4_2.md).
 - Fixed quoted Twine wildcards for Windows CI.
 - Added PyPI metadata, a portable [description](docs/PYPI_DESCRIPTION.md), README guidance and a [release procedure](docs/PYPI.md). Wheel/sdist checks cover metadata, licenses, resources, private files, offline installation and publication identity. Manual Trusted Publishing defaults to validation, requires exact version/tag/repository, and gives OIDC only to upload jobs consuming tested artifacts. Required CI names stay unchanged.
 - Isolated builds inject synthetic private probes; archives exclude private drafts and credential filenames. Added tested `aikit --version`; published Docker 1.4.1 examples use its existing `--help`. Added a README Docker Hub badge.
@@ -46,19 +61,11 @@
 
 ## v0.13.0 (2026-10-11)
 
-- Added Rust, .NET, Java (Maven/Gradle), and Terraform/Helm stack profiles with evidence-based per-module detection: Cargo.toml (rust-version, cargo test/build/clippy), *.csproj/*.fsproj/*.vbproj and global.json (TargetFramework, dotnet test/build), pom.xml/mvnw/build.gradle(.kts)/gradlew (language level, wrapper-aware commands), and .tf files or Chart.yaml (fmt/validate, helm lint). Drafts remain suggestions until bootstrap confirms them.
-- Added rust-work, dotnet-work, java-work, and infra-work skills to the registry; Claude native copies install with the claude agent selection.
-- Benchmark packs accept the new stack names; README, SKILL.md, and WIKI profile lists updated.
-- Verified locally (Windows/Python 3.14.6): 254 tests ran, all passed, 1 runtime skip; kit validation returned zero errors and zero warnings; Python 3.10 grammar verified; end-to-end smoke detected RUST/INFRA with drafted context and installed source/native skills. Real applications of the new stacks remain untrialed.
+[Archived release entry](docs/history/v0.13.0-changelog.md#v0130-2026-10-11).
 
 ## v0.12.0 (2026-10-11)
 
-- Benchmark packs accept optional `kit_agents`/`kit_preset` (default codex/minimal), so kit arms install the client's real adapter set and preset instead of a hard-coded arm; both are validated against the installer registry.
-- Benchmark task paths are now probed against the benchmark project instead of the process working directory.
-- Interrupted benchmark runs are resumable: re-running `benchmark run` with the identical pack skips completed units and continues missing ones, and a changed pack is refused against the existing run. Per-unit infrastructure failures are recorded as explicit failed units, so one bad unit neither aborts the run nor hides as an executed attempt; failed units still block savings and cannot be reviewed as correct.
-- The unified `aikit` dispatcher now prefers installed `aikit.scripts.*` package modules over bare script-path imports, avoiding duplicate module objects inside the wheel.
-- The checker document budgets are named constants; the root README budget rises to 22000 bytes (human onboarding that never enters project context), other documents keep 12000.
-- Verified locally (Windows/Python 3.14.6): 252 tests ran, all passed, 1 runtime skip; kit validation returned zero errors and zero warnings; Python 3.10 grammar was verified for the changed sources. Live workers, native client activation and hosted CI remain unverified.
+[Full preserved entry](docs/changelog/v0.12.0.md).
 
 ## v0.11.0 (2026-10-11)
 

{ai_kit_python-1.4.2 → ai_kit_python-1.4.4}/CONTRIBUTING.md

@@ -30,7 +30,7 @@ The root README and Docker Hub Overview are user documentation without a size qu
 
 Follow [PyPI preparation and release](docs/PYPI.md) for every package release. Synchronize VERSION, pyproject metadata, [description](docs/PYPI_DESCRIPTION.md) and README; verify license/resource inclusion and local-file exclusions in both sdist and wheel, build the wheel from sdist, run strict Twine checks and offline fresh-venv smoke. Preserve existing CI matrix/job names. Refresh the image when packaging changes affect it.
 
-Trusted Publishing remains manual and build-only by default. Registry uploads require the matching version/tag, canonical repository and the separately configured registry environment/publisher. Build tests have no OIDC permission; upload jobs consume only validated same-run artifacts. Record local, hosted and registry results separately. No upload, publisher/account setup or Git operation is authorized by preparation alone.
+A published stable GitHub Release starts PyPI preparation; manual dispatch defaults to build-only validation. Uploads require matching VERSION/tag, the canonical repository, a configured environment/publisher and the owner's human approval. Agents must not approve or bypass a pending deployment on the owner's behalf. Keep environment reviewer protections when allowing future `v*` tags; validate canonical stable versions separately. Build tests have no OIDC permission; upload jobs consume only validated same-run artifacts. Record local, hosted and registry results separately. Preparation alone authorizes no upload, account setup or Git operation.
 
 ## Repository maintenance
 

{ai_kit_python-1.4.2 → ai_kit_python-1.4.4}/MANIFEST.in

@@ -6,6 +6,7 @@ include pyproject.toml Makefile MANIFEST.in
 recursive-include ai-kit *.md
 prune ai-kit/.metrics
 prune ai-kit/.memory
+prune ai-kit/.orchestration
 prune ai-kit/.upstream-cache
 prune ai-kit/.design
 recursive-include .agents *

{ai_kit_python-1.4.2/ai_kit_python.egg-info → ai_kit_python-1.4.4}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: ai-kit-python
-Version: 1.4.2
-Summary: Offline installer and portable instructions that give AI coding agents project memory, stack rules, guardrails, and adaptive model routing.
+Version: 1.4.4
+Summary: Portable instructions and installer for AI coding agents: project memory, stack rules, model routing, and optional budgeted orchestration.
 Author: Igor Sazonov
 License-Expression: MIT AND Apache-2.0
 Project-URL: Homepage, https://github.com/tigusigalpa/ai-kit
@@ -121,6 +121,8 @@ The distribution excludes root maintainer AGENTS.md, PROJECT_CONTEXT.md and WIKI
 
 A separate [Docker image](https://hub.docker.com/r/tigusigalpa/ai-kit) packages the CLI for container use.
 
+Package releases follow GitHub Release, automated checks and owner approval before PyPI upload through Trusted Publishing. Future stable tags must match VERSION; manual runs default to validation. See the [release procedure](https://github.com/tigusigalpa/ai-kit/blob/main/docs/PYPI.md#release-to-pypi-with-owner-approval).
+
 ## Documentation and license
 
 - [Repository and full README](https://github.com/tigusigalpa/ai-kit)
@@ -130,3 +132,7 @@ A separate [Docker image](https://hub.docker.com/r/tigusigalpa/ai-kit) packages
 - [Issues](https://github.com/tigusigalpa/ai-kit/issues)
 
 AI-KIT's own code and instructions are MIT licensed. Bundled Cloudflare references retain MIT; bundled Strix references retain Apache-2.0. The complete distribution declares `MIT AND Apache-2.0` and includes the corresponding license texts. External runtimes and application dependencies keep their own licenses.
+
+## Optional orchestration (v1.4.4)
+
+Install with `--with-orchestration` to add scoped Codex helpers and disabled-by-default OpenRouter configuration. `aikit orchestrate` previews selected text tasks, executes only on explicit apply, enforces local admission and capped-key preflight, and retains private observed usage/cost, review and billing reconciliation. It never executes model output. Native helper billing is separate; real trials and savings are unverified. See the [complete guide](https://github.com/tigusigalpa/ai-kit#optional-orchestration).

{ai_kit_python-1.4.2 → ai_kit_python-1.4.4}/README.md

@@ -6,14 +6,29 @@
 
 AI-KIT gives your coding agents persistent project memory, expert stack rules, **Kubernetes-ready** containers, **adaptive model routing**, and native configuration for **11 AI clients**. Add **Cloudflare security-audit** for structured security review and **Strix** for scoped pentesting workflows. One offline installer, zero installer dependencies, changes previewed before you apply them.
 
-**[v1.4.2](CHANGELOG.md#v142-2026-10-16)** prepares the first PyPI release with verified source/wheel packages, a version command and manual Trusted Publishing. Publication is pending; [release status and verification](docs/V1_4_2.md) distinguish local checks from registry availability. The published Docker Hub image remains **1.4.1**, with Docker freshness rules, private-file exclusions, shared dialogue memory and all optional modules.
-
 [![Python 3.10+](https://img.shields.io/badge/python-3.10%2B-3776AB?logo=python&logoColor=white)](#install)
+[![PyPI version](https://img.shields.io/pypi/v/ai-kit-python?logo=pypi&logoColor=white)](https://pypi.org/project/ai-kit-python/)
 [![Dependencies: none](https://img.shields.io/badge/dependencies-none-2ea44f)](scripts/install.py)
 [![AI clients: 11](https://img.shields.io/badge/AI%20clients-11-7c3aed)](#-works-with-your-ai-clients)
 [![Docker Hub](https://img.shields.io/badge/Docker%20Hub-ai--kit-2496ED?logo=docker&logoColor=white)](https://hub.docker.com/r/tigusigalpa/ai-kit)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
 
+## Get AI-KIT
+
+| 🐳 **[Docker image](https://hub.docker.com/r/tigusigalpa/ai-kit)** | 🐍 **[Python package](https://pypi.org/project/ai-kit-python/)** |
+| --- | --- |
+| **Run AI-KIT in a ready-made container.** Includes Python, Git, the CLI, project templates and optional integration resources. No host Python installation needed. | **Install AI-KIT directly in your Python environment.** The `ai-kit-python` package provides the `aikit` command, project templates and optional integration resources. |
+| **Requires:** Docker with Linux containers. Published platform: `linux/amd64`. | **Requires:** Python 3.10+. No mandatory third-party runtime dependencies. |
+| **Download:** `docker pull tigusigalpa/ai-kit:1.4.3` | **Install or update:** `python -m pip install --upgrade ai-kit-python` |
+| **Try the CLI:** `docker run --rm tigusigalpa/ai-kit:1.4.3 --help` | **Try the CLI:** `aikit --help` |
+| [**Open Docker Hub →**](https://hub.docker.com/r/tigusigalpa/ai-kit) · [Project mount and launch examples](#run-ai-kit-with-docker) | [**Open PyPI →**](https://pypi.org/project/ai-kit-python/) · [Virtual environment and setup guide](#packaged-cli-and-pypi-status) |
+
+Both distributions run the same CLI: preview installation into your project, apply the reviewed changes, then bootstrap your coding agent. **Published release: 1.4.3.**
+
+**v1.4.4 preparation:** optional [orchestration](#optional-orchestration), native Codex helpers and a budgeted OpenRouter text executor. Package/image builds are local preparation; the published artifacts above remain 1.4.3.
+
+**[v1.4.3](CHANGELOG.md#v143-2026-10-16)** is published on [PyPI as `ai-kit-python` 1.4.3](https://pypi.org/project/ai-kit-python/1.4.3/). The **GitHub Release → checks → your approval → PyPI** workflow completed successfully; published file hashes and installation from PyPI in a fresh environment were verified. This release adds future release-tag support, fifteen event regression tests and a live PyPI version badge. [Publication verification](docs/V1_4_3.md#pypi-publication-and-read-back). The **Docker Hub image 1.4.3** is also published and verified; [image verification](docs/V1_4_3.md#docker-hub-143). Shared dialogue memory and all optional modules remain available.
+
 [Features](#features-at-a-glance) · [Shared context](#shared-context-from-two-dialogues) · [Web Design](#web-design) · [Docker CLI](#run-ai-kit-with-docker) · [Security workflows](#security-workflows) · [Context7](#library-documentation-with-context7) · [OpenRouter](#working-with-openrouter) · [Quick start](#install) · [Stacks](#-built-for-your-stack) · [Presets](#presets) · [Update](#update-an-application-project)
 
 ## Features at a glance
@@ -227,19 +242,19 @@ Every command also runs through one CLI: `python aikit_cli.py install|doctor|rou
 
 ### Packaged CLI and PyPI status
 
-AI-KIT includes a portable Python package and a manual Trusted Publishing workflow. **PyPI/TestPyPI publication is prepared, not performed.** The package name is `ai-kit-python`, the executable is `aikit`, and Python 3.10+ is required. PyPI rejected the initial `ai-kit` name as too similar to an existing project; registry activation must finish before the first upload.
+**AI-KIT 1.4.3 is available on [PyPI](https://pypi.org/project/ai-kit-python/1.4.3/).** Install package `ai-kit-python` and run command `aikit`; Python 3.10+ is required with no mandatory runtime dependencies. The owner-approved GitHub Release workflow published through Trusted Publishing. Both registry files match the tested workflow artifacts; fresh Windows/Python 3.12.14 installation, `aikit --version` and the installed kit check passed. [Publication record](docs/V1_4_3.md#pypi-publication-and-read-back). TestPyPI was not used.
 
-From a reviewed AI-KIT checkout, you can install it now inside a virtual environment:
+Install into a virtual environment:
 
 ~~~powershell
 $cliEnv = Join-Path $env:LOCALAPPDATA 'AI-KIT\venv'
 python -m venv "$cliEnv"
 & "$cliEnv\Scripts\Activate.ps1"
-python -m pip install .
+python -m pip install ai-kit-python
 aikit --version
 ~~~
 
-After a verified PyPI release under that name, installation becomes `pipx install ai-kit-python`, or `python -m pip install ai-kit-python` inside a virtual environment. Updating uses `pipx upgrade ai-kit-python` or `python -m pip install --upgrade ai-kit-python`; installed application instructions are updated separately through preview/apply.
+For an isolated CLI, use `pipx install ai-kit-python`. To install a reviewed source checkout instead, run `python -m pip install .` there. Updating uses `pipx upgrade ai-kit-python` or `python -m pip install --upgrade ai-kit-python`; installed application instructions are updated separately through preview/apply.
 
 ~~~powershell
 aikit install "C:\Projects\my-app" --agent codex --mode private
@@ -249,7 +264,22 @@ aikit doctor "C:\Projects\my-app"
 
 Then open that application in your client and run its bootstrap workflow. The CLI bundles templates and optional integration resources, uses no runtime third-party dependencies and preserves local documents/conflicts. [PyPI description](docs/PYPI_DESCRIPTION.md) contains portable publication copy; the [release guide](docs/PYPI.md) covers local builds, archive/privacy checks, TestPyPI, OIDC publisher fields and later publication.
 
-For maintainers, [publish-pypi.yml](.github/workflows/publish-pypi.yml) runs only by manual dispatch and defaults to build-only `validate`. Upload jobs require an explicit registry, exact version confirmation, a matching release tag and the canonical repository. They use separate `testpypi`/`pypi` environments and receive OIDC permission only in those jobs. Account/environment setup and any actual upload remain separate authorized operations. No permanent registry token is needed.
+For maintainers, [publish-pypi.yml](.github/workflows/publish-pypi.yml) supports **GitHub Release → checks → your approval → PyPI**. Publishing a stable GitHub Release starts production preparation; the upload waits for your review of environment `pypi`. Manual dispatch remains available and defaults to build-only `validate`. No permanent registry token is needed.
+
+#### Publish future releases to PyPI
+
+1. Prepare the new version through the normal reviewed Git workflow. For example, put `1.5.0` in `VERSION`, update release documentation and complete the kit/package checks. Assess Docker impact through the existing image-refresh procedure. The tag's source must contain the updated release workflow and event guard.
+2. Create a new tag such as `v1.5.0` at that prepared commit. **The tag and its committed `VERSION` must match exactly.** Preserve previous tags and published versions.
+3. On GitHub, create and publish a normal Release for that tag. `release: published` starts the workflow automatically. Saving a draft, pushing a tag alone, editing an existing Release or marking it as a prerelease does not request automatic production publication.
+4. Open **Actions → Prepare or publish Python package**. Its `build` job checks the release identity, runs kit validation and behavioral tests, builds a source archive and wheel, validates metadata/resources/privacy and the description, then smoke-installs the wheel. A failed check prevents the upload job from proceeding.
+5. After checks pass, the `pypi` job waits at **Review deployments**. Inspect the tag, commit and successful checks, select environment **pypi**, and click **Approve and deploy**. Required reviewer: repository owner `tigusigalpa`. **This confirmation is a human step; agents must not approve or bypass it on your behalf.** For solo maintenance the owner may approve a run they initiated.
+6. GitHub exchanges its OIDC identity for a short-lived PyPI credential and uploads only the same-run validated artifacts. The upload job builds no code. Verify the new version on [PyPI](https://pypi.org/project/ai-kit-python/), compare its file hashes with the run artifacts, and check installation in a fresh environment. The README PyPI badge then follows the published version automatically.
+
+The live `pypi` deployment policy accepts **tags `v*`**, so future versions do not need a new allowlist entry. Branches are excluded. The event guard separately requires a canonical stable tag of the form `vMAJOR.MINOR.PATCH`, the canonical repository, a published non-draft/non-prerelease Release and matching `VERSION`. Tests and your approval remain required for each production run.
+
+For a manual run, choose **Run workflow**, select the versioned tag, set `destination=pypi`, and type the exact version in `version`. Uploads use the same approval gate. `destination=validate` only builds and tests; `testpypi` is an explicit separate registry with its own environment/publisher setup. Prerelease trials can use that manual route. Republishing the same PyPI version fails rather than replacing or silently skipping files.
+
+The Release path is included in **v1.4.3 and later tagged source**. Existing `v1.4.2` stays unchanged. The complete [release procedure](docs/PYPI.md#release-to-pypi-with-owner-approval) includes activation, recovery and configuration verification. Each stable release still needs your human approval before PyPI upload.
 
 ## Run AI-KIT with Docker
 
@@ -288,7 +318,7 @@ The closed `.dockerignore` includes distribution sources and excludes Git, perso
 
 The ready-to-publish [Docker Hub Overview](docs/DOCKER_HUB_OVERVIEW.md) covers capabilities, release changes and launch examples; maintain it for every image release using the [release checklist](CONTRIBUTING.md#docker-hub-releases).
 
-**Published image:** [tigusigalpa/ai-kit:1.4.1](https://hub.docker.com/r/tigusigalpa/ai-kit/tags?name=1.4.1), for `linux/amd64`. Download with `docker pull tigusigalpa/ai-kit:1.4.1`. The mount examples below use the local name `ai-kit:1.4.1`; give the downloaded image that alias with `docker tag tigusigalpa/ai-kit:1.4.1 ai-kit:1.4.1` and set the version variable to `1.4.1`, or use the full namespaced image name in your commands. [Publication record](docs/V1_4_1.md#docker-hub-publication) records publication status and the verified digest. No `latest` tag was assigned and no automated registry push is configured.
+**Published image:** [tigusigalpa/ai-kit:1.4.3](https://hub.docker.com/r/tigusigalpa/ai-kit/tags?name=1.4.3), for `linux/amd64`. The remote digest and configuration match the tested build; [publication record](docs/V1_4_3.md#docker-hub-143). Download with `docker pull tigusigalpa/ai-kit:1.4.3`. To reuse the local build examples, run `docker tag tigusigalpa/ai-kit:1.4.3 ai-kit:1.4.3` and set `$kitVersion` (PowerShell) or `kit_version` (Bash) to `1.4.3`; alternatively use the full image name. Existing version tags are preserved; no `latest` tag or automated registry push is configured.
 
 ### Preview and apply on Windows
 
@@ -372,7 +402,7 @@ Its `ai-kit:local` image with `imagePullPolicy: Never` is a local-cluster exampl
 ~~~sh
 python scripts/check_kit.py
 python -m unittest discover -s tests -v
-python tests/docker_smoke.py ai-kit:1.4.1 --context .
+python tests/docker_smoke.py ai-kit:1.4.4 --context .
 ~~~
 
 Use the tag you actually built. The Docker smoke uses disposable synthetic projects, no runtime network and Docker's actual ignore engine; it checks preview/apply, all optional modules, preservation, rerun stability, read-only refusal and SIGTERM. CI builds and tests a local image without publishing it. [Maintainer contract and results](docs/DOCKER.md) records pins, packaging, checks and unavailable environments.
@@ -451,7 +481,7 @@ Exit codes: 0 success, 1 refusal, 2 unresolved conflicts. The installer works of
 
 ![Honest boundaries](https://i.postimg.cc/kgHZybJq/09-honest-boundaries.jpg)
 
-Routing recommends controls; confirm actual client activation. Permission rules and ignores reduce risk without being a security boundary. The optional benchmark requires an explicitly configured worker; no live vendor adapter is shipped.
+Routing recommends controls; confirm actual client activation. Permission rules and ignores reduce risk without being a security boundary. The benchmark requires its own reviewed protocol worker. Optional OpenRouter text execution is separately enabled and explicitly applied; native client activation and end-to-end savings require independent verification.
 
 ## Measure, recommend and select context
 
@@ -1032,13 +1062,142 @@ Normalized messages, review files and exports can contain private material. The
 
 Files are created exclusively. Edited or conflicting existing artifacts are preserved and cause refusal; exact reruns are stable. Interrupted multi-file writes can leave completed or partial artifacts: inspect the session and use a fresh workspace when necessary. There is no automatic overwrite/recovery or synchronization loop. Source files are never modified. [Full contract, schemas and checks](docs/DIALOGUE_MEMORY.md).
 
+## Optional orchestration
+
+**Prepared for v1.4.4.** Use native Codex helpers for explicitly delegated local work and the bounded OpenRouter executor for selected text tasks. Both are optional. Installing the module performs no API calls, creates no credentials, changes no global Codex configuration and launches no agents. The published PyPI/Docker Hub 1.4.3 artifacts do not contain this module; use the prepared 1.4.4 wheel, source checkout or local image until that release is published.
+
+### Enable the module in an existing project
+
+Use a CLI built from this revision. Preview against the same application path and retain the existing client selection:
+
+```powershell
+aikit install "C:\Projects\my-app" --with-orchestration
+aikit install "C:\Projects\my-app" --with-orchestration --apply --check
+```
+
+For a first Codex installation, add `--agent codex` to both commands. Existing selected agents, settings and other enabled modules persist. Orchestration is outside all presets, including strict. Its configuration starts with `enabled: false` and `model: null`; API execution needs separate configuration and `--apply`.
+
+The installer adds:
+
+| File | Ownership and purpose |
+| --- | --- |
+| `ai-kit/ORCHESTRATION.md` | Managed execution, authorization, accounting and recovery rules. |
+| `ai-kit/orchestration.json` | Created once, then preserved as project configuration. |
+| `.codex/agents/aikit_explorer.toml` | Read-only evidence gathering, only when Codex is selected. |
+| `.codex/agents/aikit_worker.toml` | Narrow implementation/mechanical work, only for Codex. |
+| `.codex/agents/aikit_reviewer.toml` | Independent read-only review, only for Codex. |
+| `ai-kit/.orchestration/` | Private runtime state, outputs and exclusive lock; created only when executing. |
+
+Private mode ignores helpers and configuration; team mode can share those instructions while runtime state remains ignored. Ignore rules do not remove previously tracked files. Root private maintainer documents and runtime state remain excluded from packages and Docker builds. Existing helper edits become normal upgrade conflicts; existing `.codex/config.toml` and unrelated helper files are preserved. Deselecting Codex requires normal adapter review/retirement.
+
+### Delegate bounded work to Codex helpers
+
+The native helper model/effort defaults are rendered from AI-KIT's canonical OpenAI catalogue: explorer and worker use the cheap role, reviewer the work role. Verify availability in your actual Codex session and edit/accept local adaptations when needed. These files inherit the parent provider, permissions and tools; they do not connect OpenRouter or change the parent's active model. Start a fresh session if required for discovery. [Official custom-agent configuration](https://learn.chatgpt.com/docs/agent-configuration/subagents).
+
+Example task for the main agent:
+
+> Inspect the parser change. Delegate read-only path discovery to aikit_explorer. Give aikit_worker only the identified parser and its regression tests, with exact acceptance criteria. Ask aikit_reviewer to review the resulting diff independently. Do not delegate recursively. Return the actual checks and unresolved risks.
+
+Use the helpers only with explicit task/host authorization. Define file scope and expected evidence before delegation; keep large logs out of the parent thread. A simple task can stay with one agent. Native helpers consume their host's subscription/API limits: the OpenRouter budget below does not govern their spend. End-to-end savings require all planning, helper and review costs, including failed work.
+
+### Configure the OpenRouter executor
+
+Edit `ai-kit/orchestration.json` deliberately. Example configuration, using a placeholder that you must replace with a verified available text-model ID:
+
+```json
+{
+  "schema": 1,
+  "enabled": true,
+  "model": "provider/model-id",
+  "budget_usd": "1.00",
+  "request_reserve_usd": "0.10",
+  "max_requests": 10,
+  "max_input_bytes": 16000,
+  "max_output_tokens": 1024,
+  "timeout_seconds": 60,
+  "max_price": {"prompt": "1", "completion": "3", "request": "0"}
+}
+```
+
+Select an exact model, not an automatic/free router alias. Confirm that the model supports text completions and the requested output limit. Price ceilings are USD per **million** prompt/completion tokens and USD per request. They filter providers; they are not a pre-billing quote. Set the request ceiling to zero to exclude per-request-priced routes. The runner disables model/provider fallbacks and streaming, sends no tools/plugins, and has no recursive agent or automatic retry loop. [Provider price filters](https://openrouter.ai/docs/guides/routing/provider-selection#max-price).
+
+Create a **dedicated OpenRouter key** in the provider dashboard. Give it a positive, non-resetting spending limit no greater than `budget_usd`, include BYOK usage in that limit, and reserve it exclusively for this workflow. The runner verifies these settings using `GET /api/v1/key` before inference. It does not create keys or raise their limits. The key must have at least one request reserve remaining. Configure OPENROUTER_API_KEY through your approved secret manager or process environment; never put its value in a prompt, tracked file, task JSON or command-line argument. The CLI never prints it. [Key and budget limits](https://openrouter.ai/docs/api/reference/limits).
+
+The dollar budget is lifetime accounting for this project's retained ledger, not an automatically resetting daily allowance. Local reservations prevent admitting more work than the remaining recorded budget. An already-sent request can exceed its reserve; server-side key caps provide an additional boundary with the provider's billing semantics. A local timeout does not prove cancellation or zero spend. Keep reserves conservative and input/output limits small.
+
+### Prepare a task and review the outgoing scope
+
+Create a UTF-8 task file inside the application, for example `tasks/classify.json`:
+
+```json
+{
+  "schema": 1,
+  "id": "comments-001",
+  "instruction": "Classify each supplied comment using bug, feature or other. Preserve each original id. Mark uncertain rows needs_review. Return JSON text and do not omit rows.",
+  "input_files": ["data/comments-sample.txt"]
+}
+```
+
+The input list is explicit and project-relative. There is no implicit repository traversal or upload of project rules/history. Review the instruction and every selected file before permitting data to leave the machine. Hidden/credential paths, linked paths, traversal, nonregular files and oversized serialized messages are refused. Filename checks cannot recognize secrets embedded in ordinary text. Only selected text reaches `https://openrouter.ai/api/v1/chat/completions`; model output is treated as untrusted data.
+
+```powershell
+# Preview: no key needed, no writes and no network.
+aikit orchestrate run "C:\Projects\my-app" --task tasks/classify.json
+
+# Execute only after reviewing the selected content and configured budget.
+aikit orchestrate run "C:\Projects\my-app" --task tasks/classify.json --apply
+
+# Read local accounting without network.
+aikit orchestrate status "C:\Projects\my-app"
+```
+
+Preview reports the model, selected paths, serialized message bytes, request/config fingerprint, reserve and output path. An exact completed rerun uses its retained result; changing inputs/configuration while reusing the task ID refuses. Use a new opaque ID for a deliberately new task. A changed/deleted prior output refuses instead of silently rebilling.
+
+### Review results and account for costs
+
+Each completed response is stored under `ai-kit/.orchestration/outputs/<id>.json`; it is never executed or applied to application code. A main agent or human must check coverage, invariants and uncertain cases. Passing transport validation is not semantic correctness.
+
+```powershell
+# Preview an explicit acceptance decision after inspecting the result.
+aikit orchestrate review "C:\Projects\my-app" --task-id comments-001 --outcome accepted
+
+aikit orchestrate review "C:\Projects\my-app" --task-id comments-001 --outcome accepted --apply
+```
+
+Use `rejected` for a reviewed incorrect result. Acceptance binds to the original output hash and requires completed accounting. Status reports requested/served model, generation ID, input/output/cached/reasoning tokens when available, duration, billed USD, review state, incomplete accounting and cost per accepted result. All attempts contribute to spend, including failed and rejected results. Prompt text, input files, raw provider errors and credentials are absent from the accounting ledger; private output files still contain the model's text and need normal access controls. On Windows, filesystem ACLs control access; private modes are not a sandbox.
+
+Observed `usage.cost` is recorded directly; no price-based token estimate is substituted. Missing token/cost fields remain unknown. Native Codex planning/review costs and manual review time remain separate; this ledger alone cannot establish end-to-end savings. The existing benchmark protocol still needs a reviewed worker for a controlled experiment; this text executor does not silently implement `aikit-worker-v1` or feed mixed-model evidence into adaptive learning. [Usage accounting](https://openrouter.ai/docs/cookbook/administration/usage-accounting).
+
+### Failures, concurrency and recovery
+
+- An exclusive project lock serializes applies. A reservation is saved **before** each completion POST; a crash cannot make a potentially billed attempt disappear.
+- Unknown cost, a pending reservation, a timeout or a cost above the reserve blocks further inference. No automatic retry occurs, including after 429/5xx errors. Known charges for malformed/truncated/wrong-model/tool-call responses are retained.
+- If a generation ID is known, preview then apply a billing read-back. This never reruns inference:
+
+```powershell
+aikit orchestrate reconcile "C:\Projects\my-app" --task-id comments-001
+aikit orchestrate reconcile "C:\Projects\my-app" --task-id comments-001 --apply
+```
+
+- Reconciliation uses `GET /api/v1/generation?id=...`, requires the same generation ID and actual `total_cost`, then settles a valid retained result or a failed attempt. Unavailable billing stays unresolved.
+- A timeout without a generation ID needs operator investigation in OpenRouter billing. Preserve the state; do not delete it or replace unknown spend with zero. Automatic recovery for that ambiguous case is intentionally unavailable.
+- A process crash can leave `run.lock`. Confirm its owner stopped before removing that lock only; pending accounting must still be resolved. Never prune a shared Docker builder or delete the project ledger to bypass a budget.
+
+Exit codes: **0** for preview, completed work or a status report; **1** for refusal/configuration/path/network preflight failure; **2** for a failed or uncertain inference result. Status itself remains read-only even when it reports unresolved accounting.
+
+### Python package, Docker and verification boundaries
+
+The prepared 1.4.4 wheel includes the executor, templates, native helper sources and tests, with no new runtime dependencies. Docker must be rebuilt from this revision: use `ai-kit:dev` or `ai-kit:1.4.4` for local verification. Published `tigusigalpa/ai-kit:1.4.3` stays unchanged. Offline preview/status need no network; a future real `run --apply` needs outbound HTTPS and an intentionally supplied key, with a writable project mount. A read-only project mount cannot persist reservations or outputs. No Docker socket or privileged mode is needed.
+
+Code and tests use synthetic inputs and substituted provider responses. Real API calls, native client activation, account availability and measured savings remain separate. [Maintainer verification and limitations](docs/ORCHESTRATION.md).
+
 ## Working with OpenRouter
 
 ![Working with OpenRouter](https://i.postimg.cc/BnzyCKSS/13-working-with-openrouter.jpg)
 
 **AI-KIT rules can travel with your API requests.** OpenRouter can provide model access while a client or adapter supplies selected AI-KIT instructions, project facts and task material. This makes the kit useful beyond native coding-client configuration.
 
-**Integration status:** AI-KIT ships offline instruction selection, [dialogue memory and messages export](#shared-context-from-two-dialogues), routing recommendations and opt-in measurements. It does not ship an OpenRouter HTTP adapter, provider profile or live model executor. The workflow below describes proposed API execution; local dialogue exports are already available. No API key, paid call or code upload is configured by installing AI-KIT.
+**Integration status:** The prepared v1.4.4 source adds the explicit [bounded text executor](#optional-orchestration). Instruction selection, dialogue exports, routing recommendations and opt-in measurements remain available. The general coding-agent/tool-loop architecture below is still a proposal; the shipped executor sends only explicitly selected text and never executes model output. Installing AI-KIT configures no API key or paid call.
 
 ### What can be reused
 
@@ -1121,9 +1280,9 @@ For a verified model/provider supporting explicit text-block caching, a stable p
 
 Inspect `usage.prompt_tokens_details.cached_tokens`, `cache_write_tokens` when supplied, input/output/reasoning usage and `usage.cost`. OpenRouter reports these usage and billing fields; missing values remain unknown. A cache write may have a cost, so a warm-cache hit rate alone cannot establish savings. [Usage accounting](https://openrouter.ai/docs/cookbook/administration/usage-accounting).
 
-An adapter could map observed cached tokens to AI-KIT's `cached_input_tokens`, record complete billed attempt cost and retain actual served model/provider identity. Include failed requests, retries, tool loops and review calls. Keep prompts, code, credentials and raw debug output out of measurement journals. The existing [benchmark protocol](docs/BENCHMARK.md#worker-protocol) can host a separately implemented worker; it does not supply an OpenRouter worker today. Compare equivalent tasks and reviewed correctness, and control cold/warm cache conditions explicitly.
+The bounded text executor records observed cached tokens; a broader adapter could map observed cached tokens to AI-KIT's `cached_input_tokens`, record complete billed attempt cost and retain actual served model/provider identity. Include failed requests, retries, tool loops and review calls. Keep prompts, code, credentials and raw debug output out of measurement journals. The existing [benchmark protocol](docs/BENCHMARK.md#worker-protocol) can host a separately implemented worker; the text executor is not a benchmark-protocol worker. Compare equivalent tasks and reviewed correctness, and control cold/warm cache conditions explicitly.
 
-### Proposed adapter scope
+### Further coding-agent adapter scope
 
 Start with read-only analysis and code review: preview selected files and outgoing content, resolve model capabilities, enforce agreed request/time/spend limits, then capture response/usage. Add HTTP timeouts and bounded retries with complete accounting. An API key belongs in an approved external secret mechanism; confirm the destination and permitted source-data scope before sending code.
 

{ai_kit_python-1.4.2 → ai_kit_python-1.4.4}/SKILL.md

@@ -86,7 +86,7 @@ CI and optional integrations stay outside presets. Read the audit, Strix, Contex
 
 ## Unified CLI
 
-`python aikit_cli.py --help` lists commands; pip exposes `aikit`. [Dialogue memory](docs/DIALOGUE_MEMORY.md) imports/merges two dialogues and exports reviewed ChatGPT/OpenRouter references. [Docker](README.md#run-ai-kit-with-docker) mounts an application. [PyPI](docs/PYPI.md) covers package validation and manual Trusted Publishing; preparation uploads nothing. Standalone scripts and Makefile also work.
+`python aikit_cli.py --help` lists commands; pip exposes `aikit`. [Dialogue memory](docs/DIALOGUE_MEMORY.md) imports/merges two dialogues and exports reviewed ChatGPT/OpenRouter references. [Docker](README.md#run-ai-kit-with-docker) mounts an application. [PyPI](docs/PYPI.md) covers checks and owner-approved release publishing; preparation uploads nothing. Standalone scripts and Makefile also work.
 
 ## Maintaining AI-KIT itself
 
@@ -98,8 +98,10 @@ CI and optional integrations stay outside presets. Read the audit, Strix, Contex
 
 ## Boundaries
 
-AI-KIT writes instructions and configuration; its opt-in benchmark invokes only an explicitly configured protocol worker. No live vendor adapter is shipped. Confirm activation in the actual client. Permission rules, ignore files, and MCP posture reduce risk but are not a security boundary. Hosted CI and real application trials are recorded as unverified unless evidence exists.
+AI-KIT installs instructions and opt-in helpers. The optional text executor requires explicit apply and configured budget/key limits. Benchmark protocol workers and native client activation remain separate. Ignore/permission rules are not a sandbox; live savings require evidence.
 
 ## Use this repository as a skill
 
-This SKILL.md sits at the root of the AI-KIT repository, so the repository itself is the skill and carries its installer, templates, and documents. For Claude Code across all projects, clone it into the skills directory: `git clone https://github.com/tigusigalpa/ai-kit.git ~/.claude/skills/ai-kit`; the commands above then run from that folder. For other assistants, clone the repository next to the project or paste this file as context. Canonical documents: [README](README.md), [Core](template/ai-kit/CORE.md), [adapters and presets](template/ai-kit/ADAPTERS.md), [containers](template/ai-kit/CONTAINERS.md), [routing](template/ai-kit/router/POLICY.md), [contribution rules](CONTRIBUTING.md).
+This repository is the skill. For Claude Code, clone it into `~/.claude/skills/ai-kit`; for other clients, use a reviewed checkout beside the project. Follow [README](README.md), [Core](template/ai-kit/CORE.md), [adapters](template/ai-kit/ADAPTERS.md), [containers](template/ai-kit/CONTAINERS.md), [routing](template/ai-kit/router/POLICY.md) and [contribution rules](CONTRIBUTING.md).
+
+For explicitly requested [optional orchestration](template/ai-kit/ORCHESTRATION.md), preview installation with --with-orchestration; use `aikit orchestrate run|status|review|reconcile`. Native helpers and paid external requests require separate explicit execution; no real calls during integration tests.

ai_kit_python-1.4.4/VERSION

@@ -0,0 +1 @@
+1.4.4

{ai_kit_python-1.4.2 → ai_kit_python-1.4.4/ai_kit_python.egg-info}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: ai-kit-python
-Version: 1.4.2
-Summary: Offline installer and portable instructions that give AI coding agents project memory, stack rules, guardrails, and adaptive model routing.
+Version: 1.4.4
+Summary: Portable instructions and installer for AI coding agents: project memory, stack rules, model routing, and optional budgeted orchestration.
 Author: Igor Sazonov
 License-Expression: MIT AND Apache-2.0
 Project-URL: Homepage, https://github.com/tigusigalpa/ai-kit
@@ -121,6 +121,8 @@ The distribution excludes root maintainer AGENTS.md, PROJECT_CONTEXT.md and WIKI
 
 A separate [Docker image](https://hub.docker.com/r/tigusigalpa/ai-kit) packages the CLI for container use.
 
+Package releases follow GitHub Release, automated checks and owner approval before PyPI upload through Trusted Publishing. Future stable tags must match VERSION; manual runs default to validation. See the [release procedure](https://github.com/tigusigalpa/ai-kit/blob/main/docs/PYPI.md#release-to-pypi-with-owner-approval).
+
 ## Documentation and license
 
 - [Repository and full README](https://github.com/tigusigalpa/ai-kit)
@@ -130,3 +132,7 @@ A separate [Docker image](https://hub.docker.com/r/tigusigalpa/ai-kit) packages
 - [Issues](https://github.com/tigusigalpa/ai-kit/issues)
 
 AI-KIT's own code and instructions are MIT licensed. Bundled Cloudflare references retain MIT; bundled Strix references retain Apache-2.0. The complete distribution declares `MIT AND Apache-2.0` and includes the corresponding license texts. External runtimes and application dependencies keep their own licenses.
+
+## Optional orchestration (v1.4.4)
+
+Install with `--with-orchestration` to add scoped Codex helpers and disabled-by-default OpenRouter configuration. `aikit orchestrate` previews selected text tasks, executes only on explicit apply, enforces local admission and capped-key preflight, and retains private observed usage/cost, review and billing reconciliation. It never executes model output. Native helper billing is separate; real trials and savings are unverified. See the [complete guide](https://github.com/tigusigalpa/ai-kit#optional-orchestration).