oacp-cli 0.4.6__tar.gz → 0.5.1__tar.gz

{oacp_cli-0.4.6 → oacp_cli-0.5.1}/CHANGELOG.md

@@ -7,6 +7,52 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.1] - 2026-09-11
+
+### Added
+
+- Attributed work-clock deductions for multiple excluded intervals, including human-directed time away ([contract](docs/protocol/autonomy.md#threshold-exceeded-checkpoint)).
+- Cancellation receipts that close admitted tasks while preserving partial delivery and pause history ([contract](docs/protocol/autonomy.md#terminal-finalization-and-audit-integrity)).
+- Envelope compilation stamps the enforcement it resolved: `hooks` only when the receiver's adapter is present, `none` with a reason otherwise ([contract](docs/protocol/autonomy.md#enforcement-recording)).
+
+### Changed
+
+- Protocol contract stamp `spec_version` moves to `0.5.1` ([contract version](docs/protocol/autonomy.md#contract-version)).
+- `oacp retention` no longer prunes: the engine is parked outside the kernel and the subcommand prints where it went until its removal in 0.5.3 ([inbox/outbox](docs/protocol/inbox_outbox.md#message-history-retention)).
+- `oacp write-event` execs `agent-memory event write` when the installed tool serves it, falling back to the bundled script until its removal in 0.5.2 ([README](README.md#commands)).
+- The exec path prints `published:`/`idempotent:` where the bundled script prints `OK:` ([README](README.md#commands)).
+- `oacp session-init --pull-memory` is a no-op that names the memory tool's own SessionStart hook, until its removal in 0.5.3 ([codex](docs/protocol/session_init.md#codex)).
+
+### Fixed
+
+- The sync allowlist anchors `.gitignore` and `.oacp-memory-repo` to the home root, matching the memory tool's golden byte for byte ([memory layout](docs/protocol/org_memory.md#the-sync-allowlist)).
+- Preflight's conflict-marker check flags the diff3 `|||||||` base marker ([preflight](scripts/preflight.py)).
+
+## [0.5.0] - 2026-09-09
+
+### Added
+
+- Memory-layout conformance fixture pinning the layout grammar and sync allowlist ([fixture](tests/conformance/memory_layout/README.md)).
+- `oacp doctor` reports the installed `agent-memory` version and defers memory-home checks to it ([doctor guide](docs/guides/doctor.md)).
+- Preflight and wheel guards fail when a kernel module or the wheel ships the memory engine ([lean kernel](docs/protocol/org_memory.md#conformance)).
+
+### Changed
+
+- The org-memory doc becomes the three-tier memory layout spec the kernel scaffolds against ([memory layout](docs/protocol/org_memory.md#layout)).
+- `oacp memory` and `oacp org-memory` delegate to the `agent-memory` CLI until their removal in 0.5.2 ([README](README.md#commands)).
+- `oacp setup` no longer installs memory hooks and retires the ones it generated; `agent-memory setup` replaces them ([quickstart](QUICKSTART.md)).
+- `oacp session-init --pull-memory` delegates to `agent-memory`, reporting `disabled` when absent ([codex](docs/protocol/session_init.md#codex)).
+
+### Removed
+
+- `docs/protocol/cross_runtime_sync.md`; its durable-memory half moved to the layout spec ([layout](docs/protocol/org_memory.md#per-project-tier)).
+- The bundled memory engine and org-memory doctor category, shipped as `agent-memory-cli` ([agent-memory](https://github.com/kiloloop/agent-memory)).
+- `oacp doctor --memory`; the memory home is checked by `agent-memory doctor` ([doctor guide](docs/guides/doctor.md)).
+
+### Fixed
+
+- `oacp setup codex` regenerates its managed `SessionStart` hook but never creates one ([codex startup](docs/protocol/session_init.md#codex)).
+
 ## [0.4.6] - 2026-09-05
 
 ### Added
@@ -843,6 +889,8 @@ The central debrief store is the headline change: every agent's full end-of-sess
 - Checkout step in github-release workflow job (#19)
 - Pre-release audit fixes: SHA-pinned actions, dangling doc refs (#15, #16)
 
+[0.5.1]: https://github.com/kiloloop/oacp/compare/v0.5.0...v0.5.1
+[0.5.0]: https://github.com/kiloloop/oacp/compare/v0.4.6...v0.5.0
 [0.4.6]: https://github.com/kiloloop/oacp/compare/v0.4.5...v0.4.6
 [0.4.5]: https://github.com/kiloloop/oacp/compare/v0.4.4...v0.4.5
 [0.4.4]: https://github.com/kiloloop/oacp/compare/v0.4.3...v0.4.4

{oacp_cli-0.4.6 → oacp_cli-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: oacp-cli
-Version: 0.4.6
+Version: 0.5.1
 Summary: Open Agent Coordination Protocol CLI for file-based multi-agent workflows
 Project-URL: Homepage, https://github.com/kiloloop/oacp
 Project-URL: Repository, https://github.com/kiloloop/oacp
@@ -21,7 +21,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Software Development
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.9.2
-Requires-Dist: pyyaml>=6.0
+Requires-Dist: pyyaml>=6.0.1
 Provides-Extra: crypto
 Requires-Dist: cryptography>=50.0.0; extra == 'crypto'
 Description-Content-Type: text/markdown
@@ -261,14 +261,14 @@ uv tool install .
 | `oacp agent` | Manage global agent profiles (init, sync, show, list) |
 | `oacp inbox` | List pending inbox messages |
 | `oacp watch` | Emit inbox delta events for Monitor-friendly polling |
-| `oacp retention` | Prune project message history by age and count |
-| `oacp memory` | Archive, restore, or sync memory files |
+| `oacp retention` | Parked: engine archived outside the kernel; advisory shim until 0.5.3 |
+| `oacp memory` | Run agent-memory (sync, archive, restore); shim until 0.5.2 |
 | `oacp session-init` | Verify Codex startup inputs and emit SessionStart context |
 | `oacp setup` | Generate runtime-specific config files in a repo |
 | `oacp send` | Send a protocol-compliant inbox message |
 | `oacp key` | Generate and inspect message-signing keys |
 | `oacp trust` | Import, inspect, and revoke trust-root entries (catalog + pins) |
-| `oacp org-memory` | Initialize org-level memory at $OACP_HOME/org-memory/ |
+| `oacp org-memory` | Run agent-memory org (init); shim until 0.5.2 |
 | `oacp write-event` | Write an event to org-memory/events/ |
 | `oacp autonomy-outcome` | Record a human approval/decline in an autonomy audit |
 | `oacp autonomy-finalize` | Record checkpoints and terminal states in an autonomy audit |
@@ -287,9 +287,9 @@ uv tool install .
 
 **`oacp watch`**: `--agent`, repeatable `--project`, `--all-projects`, `--json`, `--since` (default `now`), `--state-id <id>` for per-subscriber cursors, `--show-archived`
 
-**`oacp doctor`**: `--fix` (auto-fix safe issues), `--memory`, `--json`, `-o/--output`
+**`oacp doctor`**: `--fix` (auto-fix safe issues), `--json`, `-o/--output`
 
-**`oacp memory`**: `init [--remote URL]`, `clone <URL> [--force]`, `pull`, `push`, `disable`, `archive <project> <file>`, `restore <project> <file>`
+**`oacp memory`** / **`oacp org-memory`**: exec shims for [agent-memory](https://github.com/kiloloop/agent-memory) (`pip install agent-memory-cli`): argv passes through, `--oacp-dir` becomes `--home`, `oacp memory init` runs `agent-memory enable`. Kept through 0.5.1, removed in 0.5.2; call `agent-memory` directly.
 
 </details>
 
@@ -369,15 +369,12 @@ $OACP_HOME/projects/<project>/
 └── workspace.json           # Project metadata
 ```
 
-Optionally, `oacp org-memory init` creates org-level shared memory:
-
-```
-$OACP_HOME/org-memory/
-├── recent.md                # Rolling summary, retrieved on demand
-├── decisions.md             # Org-wide decisions
-├── rules.md                 # Standing conventions
-└── events/                  # Timestamped event entries
-```
+Org-level shared memory and cross-machine sync are the memory tool's:
+[agent-memory](https://github.com/kiloloop/agent-memory) (`pip install
+agent-memory-cli`) scaffolds `$OACP_HOME/org-memory/` (`agent-memory org init`),
+syncs the home (`enable`, `pull`, `push`), checks it (`agent-memory doctor`), and
+installs the runtime startup hook (`agent-memory setup <runtime>`). The layout it
+implements is the kernel's [memory layout spec](docs/protocol/org_memory.md).
 
 Init loads the four active project memory files. Org memory is retrieved on
 demand; syncing it to disk does not load it into context. See

{oacp_cli-0.4.6 → oacp_cli-0.5.1}/QUICKSTART.md

@@ -89,9 +89,14 @@ This creates or updates:
 
 - `.claude/agents/my-first-project.md`
 - `.claude/skills/`
-- `.claude/hooks/oacp-memory-pull.sh`
 - `.claude/settings.json`
 
+Memory sync and its startup hook are the memory tool's: install
+[agent-memory](https://github.com/kiloloop/agent-memory) (`pip install
+agent-memory-cli`) and run `agent-memory setup claude`. A regeneration of
+`oacp setup` retires the memory hooks earlier kernels wrote, by exact command
+and digest, and leaves anything you edited in place.
+
 For other supported runtimes, use the same shape:
 
 ```bash
@@ -101,20 +106,21 @@ oacp setup gemini --project my-first-project
 ```
 
 Codex setup creates or merges `.codex/hooks.json` with one startup-only hook.
-Review and trust it with `/hooks`; it runs memory pull and startup verification
-sequentially. If hooks are unavailable, run the manual fallback:
+Review and trust it with `/hooks`; it runs the startup verification. If hooks
+are unavailable, run the manual fallback:
 
 ```bash
-oacp session-init --pull-memory --project my-first-project
+oacp session-init --project my-first-project
 ```
 
-Memory pull synchronizes files on disk. The init manifest names the protocol
-files and four project memory files to read into context; org memory is
-retrieved on demand. See [memory context](docs/guides/memory-context.md) for
-retrieval and existing-installation guidance.
+The init manifest names the protocol files and four project memory files to
+read into context; org memory is retrieved on demand. Syncing the home is
+`agent-memory pull` (its `setup codex` hook runs it at startup). See
+[memory context](docs/guides/memory-context.md) for retrieval and
+existing-installation guidance.
 
 Runtime setup does not install an automatic memory push. Publish durable memory
-explicitly during wrap-up with `oacp memory push`.
+explicitly during wrap-up with `agent-memory push`.
 
 Cursor support is scaffold-only until Cursor-owned rules land. Cursor sessions
 must set `OACP_RUNTIME=cursor` or pass `--from` explicitly when sending messages.
@@ -226,7 +232,7 @@ checks the project workspace, inboxes, schemas, and agent status files.
 ## What's Next?
 
 - **Review loop** — Set up structured code review between agents. See [docs/protocol/review_loop.md](docs/protocol/review_loop.md).
-- **Durable memory** — Learn how agents share knowledge across sessions. See [docs/protocol/cross_runtime_sync.md](docs/protocol/cross_runtime_sync.md).
+- **Durable memory** — Learn how agents share knowledge across sessions and machines. See [docs/protocol/org_memory.md](docs/protocol/org_memory.md).
 - **Safety defaults** — Understand the baseline safety rules. See [docs/protocol/agent_safety_defaults.md](docs/protocol/agent_safety_defaults.md).
 - **Full protocol** — Read the complete specification in [SPEC.md](SPEC.md).
 - **Adoption guide** — Minimum, recommended, and full adoption paths. See [docs/guides/adoption.md](docs/guides/adoption.md).

{oacp_cli-0.4.6 → oacp_cli-0.5.1}/README.md

@@ -233,14 +233,14 @@ uv tool install .
 | `oacp agent` | Manage global agent profiles (init, sync, show, list) |
 | `oacp inbox` | List pending inbox messages |
 | `oacp watch` | Emit inbox delta events for Monitor-friendly polling |
-| `oacp retention` | Prune project message history by age and count |
-| `oacp memory` | Archive, restore, or sync memory files |
+| `oacp retention` | Parked: engine archived outside the kernel; advisory shim until 0.5.3 |
+| `oacp memory` | Run agent-memory (sync, archive, restore); shim until 0.5.2 |
 | `oacp session-init` | Verify Codex startup inputs and emit SessionStart context |
 | `oacp setup` | Generate runtime-specific config files in a repo |
 | `oacp send` | Send a protocol-compliant inbox message |
 | `oacp key` | Generate and inspect message-signing keys |
 | `oacp trust` | Import, inspect, and revoke trust-root entries (catalog + pins) |
-| `oacp org-memory` | Initialize org-level memory at $OACP_HOME/org-memory/ |
+| `oacp org-memory` | Run agent-memory org (init); shim until 0.5.2 |
 | `oacp write-event` | Write an event to org-memory/events/ |
 | `oacp autonomy-outcome` | Record a human approval/decline in an autonomy audit |
 | `oacp autonomy-finalize` | Record checkpoints and terminal states in an autonomy audit |
@@ -259,9 +259,9 @@ uv tool install .
 
 **`oacp watch`**: `--agent`, repeatable `--project`, `--all-projects`, `--json`, `--since` (default `now`), `--state-id <id>` for per-subscriber cursors, `--show-archived`
 
-**`oacp doctor`**: `--fix` (auto-fix safe issues), `--memory`, `--json`, `-o/--output`
+**`oacp doctor`**: `--fix` (auto-fix safe issues), `--json`, `-o/--output`
 
-**`oacp memory`**: `init [--remote URL]`, `clone <URL> [--force]`, `pull`, `push`, `disable`, `archive <project> <file>`, `restore <project> <file>`
+**`oacp memory`** / **`oacp org-memory`**: exec shims for [agent-memory](https://github.com/kiloloop/agent-memory) (`pip install agent-memory-cli`): argv passes through, `--oacp-dir` becomes `--home`, `oacp memory init` runs `agent-memory enable`. Kept through 0.5.1, removed in 0.5.2; call `agent-memory` directly.
 
 </details>
 
@@ -341,15 +341,12 @@ $OACP_HOME/projects/<project>/
 └── workspace.json           # Project metadata
 ```
 
-Optionally, `oacp org-memory init` creates org-level shared memory:
-
-```
-$OACP_HOME/org-memory/
-├── recent.md                # Rolling summary, retrieved on demand
-├── decisions.md             # Org-wide decisions
-├── rules.md                 # Standing conventions
-└── events/                  # Timestamped event entries
-```
+Org-level shared memory and cross-machine sync are the memory tool's:
+[agent-memory](https://github.com/kiloloop/agent-memory) (`pip install
+agent-memory-cli`) scaffolds `$OACP_HOME/org-memory/` (`agent-memory org init`),
+syncs the home (`enable`, `pull`, `push`), checks it (`agent-memory doctor`), and
+installs the runtime startup hook (`agent-memory setup <runtime>`). The layout it
+implements is the kernel's [memory layout spec](docs/protocol/org_memory.md).
 
 Init loads the four active project memory files. Org memory is retrieved on
 demand; syncing it to disk does not load it into context. See

{oacp_cli-0.4.6 → oacp_cli-0.5.1}/SPEC.md

@@ -23,7 +23,7 @@ documents ship inside the `oacp-cli` wheel.
 | [`docs/protocol/inbox_outbox.md`](docs/protocol/inbox_outbox.md) | Wire format including the signed `auth` trailer; directory layout; message types; lifecycle — a processed inbound message is archived to `inbox/archive/` by digest-checked, no-clobber move (never deleted), and an intake rejection is quarantined to `dead_letter/`; threading, broadcast, expiry, retention. |
 | [`docs/protocol/message_signing.md`](docs/protocol/message_signing.md) | Trust root and receiver pins, verify modes (`off` / `warn` / `enforce`), receiver audit stamping, policy-file signing, key management, rotation and revocation, signing conformance. |
 | [`docs/protocol/autonomy.md`](docs/protocol/autonomy.md) | Receiver autonomy: config and task profiles, the four-gate admission evaluator and hard stops, audit records (admission ledger, human outcomes, terminal finalization), threshold checkpoints and re-authorization, scope-envelope enforcement, continuation grants. |
-| [`docs/protocol/org_memory.md`](docs/protocol/org_memory.md) | Org-level memory: directory structure, event file schema, the debrief store, permission model and lifecycle. |
+| [`docs/protocol/org_memory.md`](docs/protocol/org_memory.md) | Memory layout: the per-project, org, and cross-machine tiers — paths, files, who writes what, the event and debrief schemas, the sync marker and allowlist. |
 
 ## Userland documents
 
@@ -36,7 +36,6 @@ receiver must verify.
 | [`docs/protocol/task_negotiation.md`](docs/protocol/task_negotiation.md) | Propose / accept / counter-propose handshake for splitting work between agents. |
 | [`docs/protocol/multi_agent_shared_workspace.md`](docs/protocol/multi_agent_shared_workspace.md) | Shared-folder implementation → QA → deployment handoff with batched findings and signoff. |
 | [`docs/protocol/session_init.md`](docs/protocol/session_init.md) | Runtime-agnostic session-start sequence and failure handling. |
-| [`docs/protocol/cross_runtime_sync.md`](docs/protocol/cross_runtime_sync.md) | Keeping context consistent across runtimes: durable memory, handoff messages, review artifacts. |
 | [`docs/protocol/runtime_capabilities.md`](docs/protocol/runtime_capabilities.md) | Static capability declarations, dynamic `status.yaml`, health-check contract, agent cards. |
 | [`docs/protocol/agent_profiles.md`](docs/protocol/agent_profiles.md) | Two-tier identity: global agent profiles and project-level agent cards. |
 | [`docs/protocol/agent_safety_defaults.md`](docs/protocol/agent_safety_defaults.md) | Baseline git, staging, inbox, credential, and scope rules every agent follows. |
@@ -49,7 +48,7 @@ Guides — [`docs/guides/setup.md`](docs/guides/setup.md),
 [`versioning.md`](docs/guides/versioning.md),
 [`unified_skill_spec.md`](docs/guides/unified_skill_spec.md) — and the
 executable conformance fixtures under [`tests/conformance/`](tests/conformance/)
-(autonomy, signing, intake, envelope) round out the set. Runtime-specific skills
+(autonomy, signing, intake, envelope, memory layout) round out the set. Runtime-specific skills
 that operate the protocol live in the companion
 [oacp-skills](https://github.com/kiloloop/oacp-skills) repository.
 

{oacp_cli-0.4.6 → oacp_cli-0.5.1}/docs/guides/doctor.md

@@ -27,6 +27,7 @@ Verifies that required and optional CLI tools are installed and reachable on `PA
 | `ruff` | No | Python linter (optional, used in preflight) |
 | `shellcheck` | No | Shell script linter (optional) |
 | `pyyaml` | No | PyYAML library (needed for YAML validation) |
+| `agent-memory` | No | Memory tool (`agent-memory-cli`); the row reports its version and hands memory-home checks to `agent-memory doctor` |
 
 ### 2. Workspace
 
@@ -103,6 +104,8 @@ $ oacp doctor
     [+] ruff — ruff 0.8.1
     [-] shellcheck — not installed (optional)
         Install: brew install shellcheck
+    [-] agent-memory — not installed
+        Install: pip install agent-memory-cli
     [+] pyyaml — available
 
 No issues found.
@@ -120,6 +123,7 @@ $ oacp doctor --project my-project
     [+] ruff — ruff 0.8.1
     [-] shellcheck — not installed (optional)
         Install: brew install shellcheck
+    [+] agent-memory — agent-memory 0.1.0 (run agent-memory doctor)
     [+] pyyaml — available
 
 [+] Workspace
@@ -181,6 +185,7 @@ The exit code reflects the overall result:
 | `pyyaml — not importable` | `pip install pyyaml` |
 | `ruff — not installed` | `pip install ruff` (optional, for linting) |
 | `shellcheck — not installed` | `brew install shellcheck` (optional, for shell script linting) |
+| `agent-memory — not installed` | `pip install agent-memory-cli` (optional; `agent-memory doctor` then checks the memory home) |
 
 ### Workspace
 
@@ -220,7 +225,6 @@ oacp doctor --project <name>         # full workspace + agent checks
 oacp doctor --json                   # machine-readable JSON output
 oacp doctor --project <name> --json  # full checks in JSON format
 oacp doctor --project <name> --fix   # auto-fix safe issues (missing inbox dirs, missing/stale status.yaml)
-oacp doctor --memory                 # advisory checks for OACP_HOME memory git sync
 oacp doctor -o report.txt            # save report to file
 ```
 

{oacp_cli-0.4.6 → oacp_cli-0.5.1}/docs/guides/memory-context.md

@@ -18,7 +18,7 @@ protocol files and those four project files, then emits a manifest. The agent
 still performs the ordered reads; verification does not inject their contents.
 Missing project files are reported under the existing degraded-init behavior.
 
-`oacp memory pull` synchronizes the memory repository on disk, including org
+`agent-memory pull` synchronizes the memory repository on disk, including org
 memory and its history. A successful pull does not add those files to model
 context. Keep any configured pull before project-memory reads so those reads
 use the refreshed files. Sync selection and context selection are independent;
@@ -35,7 +35,7 @@ a hook that the project has disabled.
    others. Read applicable standing rules and decisions before the actions
    they govern, such as release, review authority, or architecture work.
 2. If cross-machine sync is configured, the task needs current shared facts,
-   and local freshness is unknown, run `oacp memory pull`. A failed pull leaves
+   and local freshness is unknown, run `agent-memory pull`. A failed pull leaves
    freshness unknown; report that limitation before relying on affected facts.
 3. Search the relevant explicit files with task identifiers and topic terms.
    For example, after confirming that `rules.md` exists:

{oacp_cli-0.4.6 → oacp_cli-0.5.1}/docs/protocol/autonomy.md

@@ -322,7 +322,7 @@ Every autonomy decision writes one YAML file:
 
 ```yaml
 schema_version: 2
-spec_version: "0.4.5"
+spec_version: "0.5.1"
 created_at_utc: "2026-05-12T13:23:25Z"
 receiver: codex
 sender: iris
@@ -470,6 +470,10 @@ terminal finalization. Records, envelopes, and workspaces written between the
 0.4.4 release (2026-08-28) and the 0.4.5 release are therefore stamped
 `0.4.3` under a contract that had already moved — readers tolerate that
 stamp on artifacts dated in the window and read them by the 0.4.5 shape.
+The 0.5.1 contract adds cancellation receipts and attributed clock adjustments. Existing records keep their
+original stamp; new cancellation fixtures use 0.5.1. Schema version remains 2
+because the record container is unchanged; readers must recognize the new
+terminal vocabulary before consuming 0.5.1 receipts.
 
 `evaluator` is **gate-emitted, not receiver-composed**: the evaluator
 self-stamps its provenance into every decision it returns, and receivers
@@ -823,7 +827,7 @@ in place with `--replace`.
 
 **Run-state vocabulary.** `result.final_state` splits by lifecycle phase:
 `pending`, `paused`, and `blocked` are live states; `done`, `superseded`,
-and `error` are terminal. Only terminal states can be finalized.
+`error`, and `cancelled` are terminal. Only terminal states can be finalized.
 `pending` is receiver-written (an admission record picked up for
 execution) — the evaluator itself never writes it.
 
@@ -857,11 +861,38 @@ actuals, whichever receiver writes it. Within the envelope, the
 checkpoint records `within_declared_envelope` (or
 `continued_with_grant`) and the terminal write proceeds; a breach leaves
 the record checkpoint-paused (exit code 4) and the §E re-authorization
-flow applies before any terminal state can be written. Realized effects
+flow applies before successful completion can be written. Cancellation
+closes the task without resuming or erasing a breached checkpoint. Realized effects
 use the canonical axis names only: `actual_minutes`,
 `actual_files_touched`, `side_effects_actual.<capability>`, and
 `task_profile.<field>` for declared-intent corrections.
 
+**Cancellation.** Use `cancelled` when the human or sender stops an admitted
+task; use `superseded` when a replacement evaluation inherits its authority.
+`oacp autonomy-finalize <record> --final-state cancelled --cancelled-by human
+--cancelled-at <UTC>` writes `result.cancelled_by` (`human` or `sender`),
+`cancelled_at_utc` (equal to `completed_at_utc`), optional `reason` (`--reason`),
+and `deliverables_landed` (a list of PR/commit reference strings, supplied with
+repeatable `--deliverable-landed`; empty when none landed). Cancellation must
+follow admission approval and any work start. It requires non-negative integer
+`actual_minutes` and `actual_files_touched`; existing work-start and pause stamps
+remain binding. Before work begins, no start is invented: both actuals are zero
+and the landed list is empty.
+
+Cancellation accepts live `pending`/`paused`/`blocked` records and the provisional
+`done` shape emitted at auto-admission (no completion stamp). A paused admission
+must have a recorded `approved`/`modified` human outcome. Completed `done`,
+`error`, `superseded`, and `cancelled` records refuse cancellation even with
+`--replace`. Cancelled history cannot be reopened by a checkpoint, another
+outcome, or a done/error correction; linked supersession remains available.
+Cancellation preserves the admission and any unresolved checkpoint evidence,
+including its historical `paused_for_reauthorization` action, but does not
+require an implementation-success checkpoint or manufacture resumed authority.
+Cancellation accepts only clock/count actuals (including `clock_adjustments`): record effects, risks, and
+re-authorization through a checkpoint while still live before cancelling.
+Unsupported actuals are refused rather than silently discarded. The cancelled
+lifecycle is closed for doctor and envelope clear.
+
 **Evaluation identity and supersession.** Every persisted evaluation
 carries an `evaluation_id` derived from receiver, message id, message
 bytes, and evaluation time. Re-evaluating a message the evaluator
@@ -1047,7 +1078,55 @@ completion or the current checkpoint, rounded up to a whole minute, excluding
 each represented re-authorization pause from `paused_at_utc` through
 `cleared_paused_at_utc`. If a terminal outcome leaves that pause uncleared,
 active work ends at `paused_at_utc`; the subsequent paused wait does not count.
-The current record shape represents at most its current pause interval.
+The scalar pair keeps its original meaning. Explicit human-directed exclusions
+are carried separately in `result.clock_adjustments`, including deductions that
+were never checkpoint pauses. Supply additions through `--actuals <yaml>`:
+
+```yaml
+actual_files_touched: 2
+completed_at_utc: "2026-08-01T02:00:00Z"
+clock_adjustments:
+  - from_utc: "2026-08-01T01:30:00Z"
+    to_utc: "2026-08-01T01:45:00Z"
+    actor: alice
+    decided_at_utc: "2026-08-01T02:00:00Z"
+    reason: "Human directed exclusion for time away"
+```
+
+Each closed interval requires exactly these five input fields; the finalizer
+adds `recorded_at_utc` as writer provenance. The actor is a stable nonempty
+handle, the reason is nonempty, and all timestamps use `YYYY-MM-DDTHH:MM:SSZ`.
+The interval starts at or after work start and finishes after its start, no
+later than recording and the measurement/completion endpoint. The decision
+cannot postdate recording. Duration is derived from the interval, so no
+independently editable minutes field can disagree with it. Only explicit human
+direction authorizes a deduction; an adjustment neither grants scope nor
+resumes a checkpoint.
+
+Additions append to recorded evidence; omission or an empty list preserves it,
+and identical entries are idempotent. A supplied writer timestamp for a new
+entry is refused; only an exact replay may carry its existing writer stamp.
+Rewriting a stored timestamp is refused. Corrections that remove or rewrite history use linked supersession.
+The list survives checkpoints and metadata-only `--replace`. These rules
+apply to direct library calls as well as the CLI and to cancellation after
+work has begun.
+
+Arithmetic uses the union of the scalar pause and explicit intervals. Sort and
+merge overlapping or adjacent intervals, subtract their total seconds from
+elapsed seconds, then round active minutes up once. Every excluded second
+counts once, including a pause also recorded explicitly before a later
+checkpoint replaces the scalar pair. A malformed scalar remains invalid even
+when an explicit list exists. Existing scalar-only receipts keep their original
+behavior; absent adjustments mean no extra deduction. Read-back validates list
+shape and provenance even on live records without numeric actuals, and terminal
+actuals retain the one-minute `actual_minutes_inconsistent` tolerance.
+Live read-back does not bound `recorded_at_utc` against the reading wall clock;
+finalization rejects intervals beyond its measurement/completion endpoint.
+
+For `--final-state done --replace`, automatic scalar-pause derivation reads the
+stored checkpoint first. When also changing that scalar pause through actuals,
+supply explicit `actual_minutes`; the final read-back still checks the resulting
+clock. Newly supplied explicit adjustments participate in derivation immediately.
 Admission-to-start idle time never counts; time waiting on a peer reviewer does
 count because it is part of that task's review loop. Serialized tasks admitted
 together therefore stamp and measure their own starts independently.
@@ -1335,9 +1414,14 @@ and then human-approved), the receiver compiles the profile plus its own
 autonomy config into a runtime envelope:
 
 ```
-oacp envelope compile <message.yaml> --receiver <agent>
+oacp envelope compile <message.yaml> --receiver <agent> \
+  [--audit <admission-record.yaml>]
 ```
 
+With `--audit`, the compiler also stamps the admission record with the
+enforcement state it compiled (see Enforcement recording below); the
+record and the envelope then tell one story.
+
 **Admitted public-visibility tasks are the one explicit exception.** A
 compiled `public_visibility: true` envelope denies the entire chain the
 human just approved — the runtime adapter has no post-approval carve-out —
@@ -1385,7 +1469,7 @@ The envelope is written to
 ```json
 {
   "envelope_version": 1,
-  "spec_version": "0.4.5",
+  "spec_version": "0.5.1",
   "compiler": "envelope_compiler.py",
   "compiled_at_utc": "2026-07-12T02:00:00Z",
   "project": "my-project",
@@ -1412,10 +1496,19 @@ The envelope is written to
   },
   "counters": {"files_touched": []},
   "enforcement": "hooks",
+  "adapter": {
+    "runtime": "claude",
+    "state": "resolved",
+    "console": "oacp-envelope-hook",
+    "detail": "console script 'oacp-envelope-hook' on PATH at …; registered as a PreToolUse hook"
+  },
   "session_id": "sess-…"
 }
 ```
 
+`enforcement_reason` appears beside `enforcement` exactly when it is
+`none`, naming the adapter state (below).
+
 Compilation rules:
 
 - **Fail closed.** A missing, unparsable, or invalid profile — or a malformed
@@ -1427,6 +1520,33 @@ Compilation rules:
   runtime enforcement never trusts sender declarations alone.
 - Granular side-effect fields absent from a legacy profile compile to
   `false`. `counters` are runtime state and always start empty.
+- **Adapter detection.** `enforcement` is earned, not assumed. The
+  compiler resolves the receiver's runtime from its agent card
+  (`agents/<receiver>/agent_card.yaml` → `runtime:`) and detects that
+  runtime's envelope adapter **by console name, never by module path**,
+  so the adapter can move between distributions without touching the
+  compiler. Every compile stamps exactly one of four `adapter.state`
+  values: `resolved` → `enforcement: hooks`; `unsupported`,
+  `expected_missing`, or `failed` → `enforcement: none` plus
+  `enforcement_reason` naming the state (`adapter_unsupported`,
+  `adapter_expected_missing`, `adapter_detection_failed`). Detection
+  inputs, per runtime:
+  - `claude` — the `oacp-envelope-hook` console script resolves on
+    PATH **and** is registered as a `PreToolUse` hook command in the
+    project repo's `.claude/settings.json` (the registration
+    `oacp setup claude` writes, reached through the workspace marker's
+    `repo_path`). Both present → `resolved`; either absent →
+    `expected_missing`; a workspace marker or settings file that cannot
+    be read → `failed`.
+  - `codex`, `cursor`, `gemini`, `human` — no envelope adapter by
+    design → `unsupported`.
+  - `unknown`, a missing or unreadable card, or a value outside the
+    card's runtime enum → `failed`.
+
+  `expected_missing` and `failed` are loud: the compiler prints a stderr
+  advisory naming the reason. The compile still succeeds (exit 0) and the
+  envelope is still written — degradation is named, never silent, and
+  never fail-closed here.
 - **Session binding.** The envelope records which harness session it
   belongs to. The runtime hook — the only party that sees the harness
   session id (it is not present in the command environment) — records a
@@ -1581,7 +1701,7 @@ the active envelope — `message_id` and `receiver` fields in the record
 itself; filenames are never trusted, and the envelope's message id (pinned
 to a safe-id grammar at compile time) never reaches a filesystem glob:
 
-- `result.final_state: done | error` — the lifecycle is over; the clear is
+- `result.final_state: done | error | cancelled` — the lifecycle is over; the clear is
   allowed and the enforcement window closes from inside the session.
 - `pending` or `paused` (or no matching record at all) — the clear is
   denied: an open task keeps its envelope, and a checkpoint-paused task
@@ -1625,15 +1745,26 @@ grants nothing durable. The envelope itself stays immutable; only `scope`
 
 ### Enforcement recording
 
-The audit `result` block records `envelope_enforcement: hooks | none`.
-Receivers set `hooks` after a successful compile on an adapter-equipped
-runtime; `none` means pickup-gate-only enforcement. Degradation must never
-be silent: when `none` is a **rule** rather than a runtime gap, the record
-carries the named reason alongside it —
-`envelope_enforcement_reason: public_visibility_admission_approved` for
-the admitted-public branch above, stamped by the compiler itself. A bare
-`none` with no reason means an adapterless runtime (the historical
-pickup-gate-only state), distinguishable from the rule-based mode.
+The audit `result` block records `envelope_enforcement: hooks | none`,
+and it tells the same story as the envelope. The admission gate writes
+`none` at admission. A compile run with `--audit <admission-record>`
+stamps the record with the detected adapter state — under the audit
+lock, in one locked read, on a record carrying a `schema_version` and
+content-matched on `message_id` + `receiver` + `message_sha256` (an
+unbound record is left untouched and the compile warns): `hooks` for a
+`resolved` adapter, with no reason; otherwise `none` plus
+`envelope_enforcement_reason` naming the state —
+`adapter_unsupported` (a runtime with no adapter by design, `codex`
+today), `adapter_expected_missing` (an adapter-capable runtime whose
+console or registration did not resolve), or
+`adapter_detection_failed` (the runtime or a probe could not be
+determined). Degradation must never be silent: `none` always carries
+its reason — `public_visibility_admission_approved` for the
+admitted-public branch above, one of the adapter reasons for a compiled
+envelope — and `none` means pickup-gate-only enforcement whatever the
+reason. A record still reading a bare `none` after pickup establishes
+only that no compiler stamp was recorded — the compile ran without
+`--audit`, or never ran — never that the runtime is adapterless.
 
 Enforcement boundary: hooks constrain every tool call inside the session,
 including subagent tool calls, and fire before sandbox/permission
@@ -1838,6 +1969,7 @@ Audit `result.final_state` is limited to:
 - `done` (terminal)
 - `superseded` (terminal; see "Terminal finalization and audit integrity")
 - `error` (terminal)
+- `cancelled` (terminal; admitted task stopped by the human or sender)
 
 `result.completion_kind` is separately pinned to the evaluation-shape enum
 above (see "Pinned completion_kind taxonomy"). Missing-profile messages that