sliceagent 0.1.18__tar.gz → 0.3.0__tar.gz

{sliceagent-0.1.18 → sliceagent-0.3.0}/.env.example

@@ -4,18 +4,24 @@
 LLM_API_KEY=sk-...                       # REQUIRED — any OpenAI-compatible provider (OpenAI/DeepSeek/Moonshot/…)
 AGENT_MODEL=gpt-5.5                      # REQUIRED — model id (no default; pick your provider's model)
 # LLM_BASE_URL=https://api.deepseek.com  # provider endpoint; omit for OpenAI
+# LLM_HARD_TIMEOUT_SEC=300               # absolute whole-call watchdog; unset derives from completion budget
+# LLM_STREAM_CLOSE_GRACE_SEC=2            # wait to prove a cancelled SSE stream physically closed
+# LLM_PROVIDER_MAX_INFLIGHT=4             # physical request cap; timed-out calls hold a slot until closed
 # AGENT_PROXY=http://127.0.0.1:7890      # optional proxy URL (default: direct connection)
 # SHOW_SLICE=1                           # print the slice each turn
 # back-compat: OPENAI_API_KEY / OPENAI_BASE_URL / MOONSHOT_API_KEY are still accepted as fallbacks
 
-# --- memory tier (ON by default — memem ships as a dependency; these just relocate the stores) ---
-# SLICEAGENT_VAULT=~/.sliceagent/vault    # sliceagent's STATE vault (episodic cache + task-state records)
-# MEMEM_VAULT=~/obsidian-brain        # memem's lesson vault (markdown long-term memories)
+# --- memory tier (native typed knowledge is always on; Memem is an optional `memory` install extra) ---
+# SLICEAGENT_VAULT=~/.sliceagent/vault    # legacy episodic/task/roster compatibility records
+# MEMEM_VAULT=~/obsidian-brain        # memem's human-readable semantic-index projection
 # MEMEM_DIR=~/.memem                  # memem's index/state dir
 
-# --- safety / hooks (optional) ---
-# AGENT_POLICY=teenager                   # teenager (default: auto edits, ask on commands) | baby-sitter (ask on all) | let-it-go (auto) — all block catastrophic
+# --- execution / hooks (optional) ---
+# AGENT_SANDBOX=local                     # local (not an OS boundary) | docker (POSIX/WSL2; native Windows use local/WSL2)
 # AGENT_MINE=deterministic                # write side of memory loop: deterministic (default) | llm | off
 # AGENT_SUBAGENT_DEPTH=1                   # max delegation depth (0 disables spawn_subagent)
+# AGENT_DELEGATION_TIMEOUT=900             # hard ceiling for a child-agent wave; cannot be disabled
+# AGENT_EXPLORER_REASONING=staged           # fast evidence navigation + one full tool-free synthesis
+# AGENT_EXPLORER_NAV_STEPS=6                # staged explorer's fast-navigation ceiling (then synthesis)
 # AGENT_VERIFY_CMD=python3 -m pytest -q   # Oracle: run before "done"; failures force another turn
 # AGENT_MAX_TOKENS=200000                 # budget ceiling

sliceagent-0.3.0/.github/workflows/publish.yml

@@ -0,0 +1,67 @@
+name: publish
+
+# Publish to PyPI via trusted publishing (OIDC — no tokens).
+# Trigger: a published GitHub release. The release tag must match the package version.
+on:
+  release:
+    types: [published]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.release.tag_name }}
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+      - name: Verify release tag matches package version
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          python - <<'PY'
+          import ast
+          import os
+          from pathlib import Path
+
+          tree = ast.parse(Path("src/sliceagent/__init__.py").read_text(encoding="utf-8"))
+          version = next(
+              ast.literal_eval(node.value)
+              for node in tree.body
+              if isinstance(node, ast.Assign)
+              and any(isinstance(target, ast.Name) and target.id == "__version__" for target in node.targets)
+          )
+          tag = os.environ["RELEASE_TAG"]
+          expected_tag = f"v{version}"
+          expected_ref = f"refs/tags/{tag}"
+          if tag != expected_tag:
+              raise SystemExit(f"release tag {tag!r} does not match package version {version!r}")
+          if os.environ["GITHUB_REF"] != expected_ref:
+              raise SystemExit(
+                  f"release ref {os.environ['GITHUB_REF']!r} does not match tag ref {expected_ref!r}"
+              )
+          print(f"Publishing SliceAgent {version} from {expected_ref}")
+          PY
+      - name: Build and validate distributions
+        run: |
+          python -m pip install build twine
+          python -m build
+          python -m twine check dist/*
+      - uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write   # OIDC token for PyPI trusted publishing
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1

{sliceagent-0.1.18 → sliceagent-0.3.0}/.gitignore

@@ -27,6 +27,9 @@ scratch/
 evals/prompt_ab/variants/
 evals/prompt_ab/runs/
 
+# internal design doc — kept local, not published to the repo or the sdist
+CORE-DESIGN.md
+
 # local sliceagent state / monitor runtime (personal; not part of the repo)
 .sliceagent/
 .memagent/          # legacy pre-rename state dir (ignore so an upgraded checkout stays clean)
@@ -44,10 +47,20 @@ runs/
 *.pdf
 
 # ── internal-only: untracked 2026-07-02 for the public launch (files stay on disk locally) ──
-# evals/  = internal benchmark harness + ~127 MB of captured tbench/job run artifacts (deb/lz4/pt/logs)
+# evals/ contains ~127 MB of captured tbench/job artifacts. Keep those ignored, but version the small,
+# receipt-grounded prompt experiment needed to reproduce the mind-model claim and its offline tests.
 # prototype/ = superseded ~250-line JS proof-of-concept (its own README: "not the production codebase")
 # docs/STEP3-PLAN.md, docs/MEMEM-DIAGNOSIS.md = internal R&D planning notes, not user docs
-evals/
+evals/*
+!evals/__init__.py
+!evals/oldprompt_memory_model.txt
+!evals/receipt_claims.py
+!evals/receipt_prompt_ab.py
+!evals/context_contract_eval.py
+!evals/self_inspection_tool_eval.py
+!evals/selfnarrative_ab.py
+!evals/usersim.py
+!evals/usersim_pty.py
 prototype/
 docs/STEP3-PLAN.md
 docs/MEMEM-DIAGNOSIS.md
@@ -55,8 +68,13 @@ docs/MEMEM-DIAGNOSIS.md
 # internal engineering roadmap (wave planning), not product docs — untracked 2026-07-02
 ROADMAP.md
 
-# all of docs/ is internal (architecture/spec/brand assets) — not published; untracked 2026-07-02
-docs/
+# Architecture specs below are part of the OSS design contract; other internal
+# drafts and brand assets remain local by default.
+docs/*
+!docs/ENDGAME-CONTEXT-DESIGN.md
+!docs/MEMORY-LAYERS-DESIGN.md
+!docs/SUBAGENT-DESIGN.md
+!docs/CONFIGURATION.md
 
 # ColBench raw HF dataset (huge; selected tasks are committed under evals/colbench/tasks/)
 evals/colbench/data/

{sliceagent-0.1.18 → sliceagent-0.3.0}/CHANGELOG.md

@@ -5,6 +5,222 @@ this project aims for [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.3.0] — 2026-07-17
+
+### Added
+- **Intent Fidelity v2.** One shared, ephemeral turn contract now separates user-authorized action spans
+  from quoted/reported prior output, grounds historical references in sealed responses, resolves numbered
+  items and launch-ordered subagents, and helps the model carry terse confirmations onto the immediately
+  pending proposal or explicitly selected numbered option. This intent metadata is advisory context, not a
+  second host-side permission system.
+- **Safe update path.** `sliceagent update` now updates a positively identified canonical `uv tool`
+  install before any API-key, workspace, plugin, or MCP startup. Editable/direct installs are preserved,
+  alternative package managers receive exact guidance, and `/update` points active sessions to the safe
+  process boundary.
+- **Seamless workspace handoff.** `/cwd <path>` and the model-facing `change_workspace` control tool now
+  stage and validate the target runtime, durably seal the current turn, and atomically replace only
+  workspace-owned resources. The terminal application, model client, token/cost counters, and connection stay
+  alive; target preparation failures roll back to the untouched current workspace.
+- **Canonical execution receipts.** Every tool lifecycle now records requested, rejected-before-start,
+  physically started, settled, and effect-applied states under one invocation identity. Sealed receipts flow
+  into turns, recovered crashes, child-artifact references, terminal completion, and receipt-grounded recall;
+  large-task aggregates remain exact without replaying thousands of operation rows into the prompt.
+- **Receipt-aware mind-model evaluation.** The paired old-autobiography/operating-contract harness now proves
+  the substituted system-prompt diff on one Git revision and workspace, retains full replies, rejects
+  screen-derived ground truth, and scores lifecycle claims, abstentions, corrections, and required coverage
+  directly against sealed receipts.
+
+### Changed
+- **Subagents now return direct, ordered outcomes.** Every completed child contributes its full normalized
+  report to the parent as an ordinary tool result in launch order. The parent continues its normal loop and
+  owns synthesis; there is no synthetic fan-in packet, transcript reset, child-lifecycle mutation of Active
+  Work, or hidden terminal-delivery enforcement. Active Work is reserved for genuine cross-turn user
+  commitments rather than acting as a second scheduler.
+- **Subagent persistence is optional and fail-soft.** Once a safe child report exists, artifact-store,
+  reference-publication, or memory-mirror failures are retained as warnings instead of discarding useful
+  evidence or making the child indeterminate. Truly unresolved execution remains indeterminate; optional
+  artifacts remain durable locators, not a prerequisite for parent delivery.
+- **Subagent progress uses truthful readiness language.** The live matrix distinguishes running, queued,
+  failed, completed-without-report, and report-ready children without describing a report as sealed merely
+  because it is ready for the parent. “Partial report” is reserved for actually partial report bytes;
+  operationally incomplete work and persistence status stay separate from report completeness.
+- **One typed memory model, with Memem as retrieval rather than authority.** L0 remains canonical sealed
+  evidence, L1 remains rebuildable Active Work, and native SQLite owns provenance-linked USER/PROJECT/CRAFT
+  L2 records. Memem 2.10's structured external-index protocol is the primary semantic ranker when available:
+  stable IDs, hard scope partitions, one primary abstraction, and bounded cue anchors are always resolved back
+  through SliceAgent's lifecycle, revision, sensitivity, and provenance predicates. Resolved or revision-drifted
+  project diagnostics stay explicit-pull instead of being re-injected as current bugs; a whole-query native
+  fallback preserves availability without co-ranking historical full-body noise.
+- **Autonomous admission kernel.** General permission modes, host-side turn-authority denials,
+  reconciliation locks, and loop-policy refusals are retired. Ordinary requested work now flows directly;
+  the host retains only a narrow, high-confidence safeguard for commands that could catastrophically damage
+  the machine (such as formatting a device or recursively deleting `/` or the user's home).
+- **Calmer, informative Rich TUI.** The footer no longer pins task text; it restores total-token and
+  dollar-savings meters. The live reasoning/progress row also shows only current activity (or the active plan
+  step), never the task's first prompt. Assistant replies have more breathing room, and the composer drops its
+  redundant title. Combined greetings such as “hi how are you” stay on the cheap chitchat path instead of
+  becoming a durable task title.
+- **Natural workspace intent.** “Go/open/work in the hunter workspace” now navigates without requiring
+  implementation-shaped wording. Safe fallback path probes remain observational, and an assistant's exact
+  workspace-path clarification carries naturally into a terse confirmation such as “yes.”
+- **Elastic observation flow.** Pipelines and fallback branches composed entirely of read-only commands
+  (for example `find … | sort` and `ls … 2>/dev/null || ls …`) remain ordinary inspection. A failed operation
+  does not poison unrelated reads, and terminal messages report the actual failed action without internal
+  policy jargon.
+- **Capability-shaped intent grounding.** Effects are understood by governing action, concrete target, and
+  command family rather than by tool name or stray keywords. Coordinated directives retain each capability;
+  quoted filenames, exact commands, dotfiles, file sets, requirements, VCS/package operations, and adjacent
+  “go” or “continue” confirmations remain grounded without turning intent recognition into authorization.
+- **Typed evidence selection.** One `EvidenceQuery` now owns execution-recall family, predicate, and scope.
+  Receipt projections distinguish exact aggregates from failure details and latest-turn from task-wide recall,
+  while the slice remains elastic for active complexity and history-bounded with respect to transcript age.
+- **Plugin execution-admission APIs are intentionally retired.** Plugins continue to register tools, skills,
+  and MCP servers, but the old `register_hook` / `intent_effect` permission surfaces and hook-bearing
+  `load_plugins` tuple are removed with the policy-gate machinery. This is a deliberate pre-1.0 API break;
+  ordinary advisory behavior belongs in tool results or skills, not hidden host-side action gates.
+
+### Fixed
+- **Delegated results can no longer disappear behind a synthetic delivery gate.** Successful child reports
+  reach the next parent model call in full and in order, so a stale deliverable contract, revision mismatch,
+  or missing heading cannot replace the requested final answer with a host-authored interruption. The model
+  remains responsible for synthesizing and delivering the user-visible result.
+- **Useful child reports survive optional publication failures.** A completed, normalized report is returned
+  directly even when its artifact, reference, or memory mirror cannot be written. Those failures remain
+  visible as persistence warnings; they no longer erase child evidence or turn a known report into an
+  indeterminate execution outcome.
+- **Child reports are not silently lost at lifecycle edges.** A mixed indeterminate batch gets one
+  synthesis-only closeout over settled siblings before the turn parks; deadline-grace completion retains the
+  full direct report without requiring an artifact; context overflow parks instead of evicting an unseen
+  report; and crash recovery advertises the exact interrupted-turn artifact for one resumed seed.
+- **Broad subagent reviews no longer collapse into timeout cascades.** Repository audits use ignore-aware,
+  source-weighted scopes and staged 2–3-child waves instead of one exhaustive child per directory. Every child
+  drains and assembles SSE off the main thread even without a UI sink, so an ordinary long reasoning response
+  is not mistaken for 60 seconds of transport silence. The completion-budget-aware monotonic watchdog remains
+  configurable with `LLM_HARD_TIMEOUT_SEC`; provider SDK retries stay disabled and the model runner is the one
+  visible retry owner. A process-wide physical-call lease now bounds live requests per provider account,
+  including sockets whose logical watchdog already returned, while pre-admission cancellation cannot start a
+  late request and capacity wait shares the same absolute deadline as execution.
+- **Canonical installs can actually self-update.** The updater now recognizes the standard
+  `python = "3.12"` field emitted by current `uv tool` receipts while continuing to reject custom
+  requirements, resolver settings, and non-public package sources. Trusted executable discovery rejects
+  repository and arbitrary-PATH shims while correctly following Homebrew/Nix-style manager-owned symlink
+  chains; a receipt-provided bin can no longer redirect execution to an unrelated external target.
+- **Native Windows paths keep one identity across the runtime.** Model-facing mention handles stay
+  slash-normalized, physical workspace evidence retains its native invocation spelling, and workspace
+  transitions compare case-insensitive canonical identities without changing display paths. Git-Bash live
+  composition reuses the application-selected terminal I/O, while POSIX-only PTY eval support is loaded only
+  when a live eval actually runs.
+- **Concurrent evidence appends are serialized on Windows too.** The JSONL `FileLock` now uses a
+  canonical-path-keyed Windows kernel mutex with abandoned-owner recovery, matching the existing POSIX `flock`
+  guarantee instead of allowing independently opened append handles to overwrite records.
+- **Private state modes do not leak into shared skills.** Personal vault/config/default-skill files remain
+  owner-only, while an explicitly selected project/shared skill directory creates collaborator-readable
+  `SKILL.md` files and preserves an existing file mode across atomic rewrites.
+- **Workspace switches preserve the live collaboration state.** One application session identity now spans
+  in-process workspace handoffs; conversation, standing user intent, proposals, and every open topic survive
+  A→B→A, while file residency, observed facts, revisions, receipt snapshots, and old artifact handles are
+  restored only from the selected workspace. Handoff publication stages fallible derived objects first, and
+  teardown/logging failures can no longer falsify a switch that already committed.
+- **Durable evidence has an unambiguous order and explicit gaps.** A crash-durable monotonic turn order is
+  shared by journals, artifacts, and checkpoints (including recovery and idempotent retries); legacy
+  same-second ties expand as partial evidence instead of task-ID guessing. Corrupt immutable records now
+  propagate bounded gap metadata into execution/quality coverage and the artifact index rather than silently
+  producing exact counts over survivors.
+- **Intent continuity no longer drifts across attribution or redaction.** A user who adopts wording from an
+  assistant recommendation retains a live imperative; quoted/fenced proposal examples cannot authorize a
+  later “yes”; nested numbered details cannot steal top-level ordinals; and persistence-only secret masks
+  preserve source offsets so exact user clauses still point to the same words after recovery.
+- **User-reported failures close only on real proof.** Stale tool errors clear only after the exact failed call
+  succeeds. Test/build reports clear only after an explicit file-tool edit followed by a status-propagating
+  shell command whose test/lint/type/build family matches the report; sequential families accumulate only
+  until the next edit. Help, list, collect, dry-run, skip, or exit-zero modes do not count, and source text
+  inside `execute_code` is never treated as a mutation or verification receipt.
+  Neutral lifecycle cancellations remain visible as “not run” without becoming blockers, evidence, warning
+  completions, or policy errors; catastrophic safety refusals remain explicit and adverse.
+- **Child budgets remain hard batch ceilings.** Delegated token reservations now carry across scheduler waves,
+  so interleaved effects or serialized writable children cannot each receive the parent's full remaining cap;
+  children rejected before physical start no longer dilute a valid sibling's reservation.
+- **Subagent fan-out now degrades gracefully under provider pressure.** A wave admits at most four child model
+  loops, launches the first pair immediately, and ramps later starts instead of creating a synchronized provider
+  burst. Explorers default to at most six fast evidence-navigation steps followed by one full, tool-free
+  synthesis. Clean navigation or planned navigation-budget exhaustion may hand off only typed workspace
+  evidence; the latter carries an explicit incomplete-coverage note. The fast navigator suppresses the generic
+  max-step closeout, avoiding a redundant billed call, while cancellation, uncertainty, fatal provider/tool
+  stops, token exhaustion, truncation, and evidence-free runs never synthesize. The live matrix is driven by typed
+  queued/starting/model-active/reasoning/writing/tool/
+  retry/terminal phases rather than detail-string inference. Exhausted attempts, truncated output,
+  cancellation, or a final-synthesis failure start no wrapper-level recovery call. Usable partial report text,
+  observations, trace, and usage return directly as an explicitly partial outcome; optional artifact
+  persistence does not create an Active Work dependency or gate delivery. Cancellation still wakes retry
+  backoff and prevents a late outcome from publishing into a replacement task.
+- **Hung read deadlines stay live.** Timeout-enabled pure reads use bounded daemon workers and a short grace
+  period; unresolved readers become typed indeterminate outcomes, later barriers are cancelled, Ctrl-C remains
+  responsive, and a permanently stuck reader no longer freezes the turn or process exit.
+- **Read scheduling keeps truthful lifecycle boundaries.** Lifecycle children no longer disable adjacent read
+  deadlines; exhausted daemon capacity settles as a typed not-started cancellation; late indeterminate results
+  still close later effects; and a start journal crossing a deadline cannot enter its handler or route a late
+  lifecycle edge into a newer turn/workspace.
+- **Registry outcomes stay typed at every edge.** Preflight-cancelled calls bypass execution-only effect
+  factories, availability is admitted exactly once before the durable start boundary, direct validation
+  failures never construct execution effects, and registry replacement cannot mix an admitted handler with a
+  stale effect factory. Invalid explicit statuses become indeterminate instead of successful, and byte or
+  unrenderable extension results remain inside the canonical outcome path.
+- **Streaming deadlines cannot leak output into a later turn.** On platforms without a synchronous SIGALRM
+  lease, both Chat Completions and Responses interactive paths use the blocking daemon watchdog rather than
+  abandoning an SSE worker that could continue emitting deltas after timeout.
+- **Plugin/MCP extension startup is transactional and bounded.** Plugin packages support relative imports and
+  fully roll back registry, skill, MCP, and module state on failure. MCP timeouts cancel discarded workers,
+  malformed configuration/descriptors are contained before spawn, and remote tool names cannot control
+  page-out paths or labels.
+- **The catastrophic floor survives extension failure and common shell spelling.** A crashing/no-op earlier
+  preflight hook cannot skip the later machine-safety check, and high-confidence POSIX escaped executable names
+  or quoted raw-device assignments are recognized without treating escaped literal home/glob operands as wipes.
+- **Varying re-inspection loops get an advisory recovery cue.** Eight distinct observation calls returning the
+  same meaningful result add one model-only nudge to synthesize, act, or ask. It never rejects a tool or emits a
+  user-facing policy error.
+
+## [0.2.0] — 2026-07-10
+
+A typed re-architecture of the core around a single canonical design (elastic slice, execution kernel,
+crash-safe persistence), plus a rebuilt Rich TUI. No change to the thesis — same history-bounded,
+task-elastic slice — but the invariants are now enforced by typed subsystems rather than convention.
+
+### Added
+- **Typed core kernel.** The active slice is split into typed semantic regions (intent, task, evidence,
+  working set, continuity, turn runtime), each owning its own seal/reset lifecycle, replacing the flat
+  field-classification table. A provenance-tagged **intent ledger** captures verbatim user directives with
+  their source handles, deterministically promotes explicit constraint language (`must`/`never`/`only`),
+  and records supersession/satisfaction as explicit transitions.
+- **Execution kernel.** Structured tool outcomes (succeeded/failed/cancelled/**indeterminate**), ordered
+  read/write waves (pure reads parallel, effects as barriers), reconciliation gates that block dependent
+  actions after an unprovable outcome, and one capacity-preflighted model-call path.
+- **Crash-safe persistence.** A pending-journal → immutable-artifact → checkpoint compare-and-swap commit
+  order with idempotent replay, a full error taxonomy, and an OS-backed workspace lease, so an interrupted
+  turn resumes without re-running side effects. Dependency-scoped workspace revisions stale only the claims
+  whose inputs actually changed.
+- **Rebuilt TUI.** A single `TurnProgress` event reducer folds loop events into an immutable snapshot;
+  the renderer projects that snapshot (semantic tool buckets, bounded plan/tally, width-responsive
+  diagnostics, one live-status owner) instead of interpreting events independently.
+
+### Changed
+- Elastic residency is centralized: a pressure controller chooses graded fidelity globally
+  (full → excerpt → digest → locator) so no region can consume the window unnoticed.
+- Per-turn cost framing corrected throughout the docs to **history-bounded, task-elastic** — bounded with
+  respect to session length, not a fixed size regardless of task breadth.
+
+### Fixed
+- **Intent ledger and progress signals no longer lost on resume.** Checkpoint state is deep-frozen on
+  write; the resume and crash-recovery paths now thaw it fully at the boundary (and the deserializers
+  accept any `Mapping`), so binding user directives and their provenance survive a restart instead of
+  being silently dropped.
+- **A completed first-turn objective no longer stays pinned as a mandatory, un-pageable block** — a clean
+  turn with no unresolved state marks it pageable background; unresolved state or explicit continuation
+  keeps it active.
+- Security/reliability hardening from external review: WAL/recovery redacts tool-call arguments; process
+  kill reaps the whole spawn-captured process group; `code_review` and the read-only git policy refuse
+  external-diff/textconv and config injection; subagent children charge their tokens to the parent budget,
+  stay isolated from the parent's private state, and write durable state 0600/0700.
+
 ## [0.1.18] — 2026-07-09
 
 ### Added

{sliceagent-0.1.18 → sliceagent-0.3.0}/NOTICE

@@ -6,7 +6,7 @@ This product includes code ported from, and architecture reimplemented after, th
 open-source projects below. We are grateful to their authors.
 
 ────────────────────────────────────────────────────────────────────────────
-Hermes — https://github.com/NousResearch/hermes   (MIT License)
+Hermes Agent — https://github.com/NousResearch/hermes-agent   (MIT License)
 Copyright (c) 2025 Nous Research
 
   Verbatim / closely-ported source:
@@ -28,7 +28,7 @@ Kimi-Code — https://github.com/MoonshotAI/kimi-code   (Moonshot AI)
   ARCHITECTURE AND PATTERNS reimplemented in Python (no source copied — ideas,
   not code):
     access.py + scheduler.py (resource-access model for safe tool parallelism),
-    policy.py (permission chain), config.py (layered config), clock.py, cron.py,
+    config.py (layered config), clock.py, cron.py,
     flags.py, model_catalog.py, mcp_client.py (the mcp__server__tool namespacing),
     loop.py (micro-compaction), tui.py (selector menus + footer/streaming),
     code_grep.py (ripgrep pagination), agents.py (named-agent registry).