sliceagent 0.2.0__tar.gz → 0.3.0__tar.gz

{sliceagent-0.2.0 → sliceagent-0.3.0}/.env.example

@@ -4,18 +4,24 @@
 LLM_API_KEY=sk-...                       # REQUIRED — any OpenAI-compatible provider (OpenAI/DeepSeek/Moonshot/…)
 AGENT_MODEL=gpt-5.5                      # REQUIRED — model id (no default; pick your provider's model)
 # LLM_BASE_URL=https://api.deepseek.com  # provider endpoint; omit for OpenAI
+# LLM_HARD_TIMEOUT_SEC=300               # absolute whole-call watchdog; unset derives from completion budget
+# LLM_STREAM_CLOSE_GRACE_SEC=2            # wait to prove a cancelled SSE stream physically closed
+# LLM_PROVIDER_MAX_INFLIGHT=4             # physical request cap; timed-out calls hold a slot until closed
 # AGENT_PROXY=http://127.0.0.1:7890      # optional proxy URL (default: direct connection)
 # SHOW_SLICE=1                           # print the slice each turn
 # back-compat: OPENAI_API_KEY / OPENAI_BASE_URL / MOONSHOT_API_KEY are still accepted as fallbacks
 
-# --- memory tier (ON by default — memem ships as a dependency; these just relocate the stores) ---
-# SLICEAGENT_VAULT=~/.sliceagent/vault    # sliceagent's STATE vault (episodic cache + task-state records)
-# MEMEM_VAULT=~/obsidian-brain        # memem's lesson vault (markdown long-term memories)
+# --- memory tier (native typed knowledge is always on; Memem is an optional `memory` install extra) ---
+# SLICEAGENT_VAULT=~/.sliceagent/vault    # legacy episodic/task/roster compatibility records
+# MEMEM_VAULT=~/obsidian-brain        # memem's human-readable semantic-index projection
 # MEMEM_DIR=~/.memem                  # memem's index/state dir
 
-# --- safety / hooks (optional) ---
-# AGENT_POLICY=teenager                   # teenager (default: auto edits, ask on commands) | baby-sitter (ask on all) | let-it-go (auto) — all block catastrophic
+# --- execution / hooks (optional) ---
+# AGENT_SANDBOX=local                     # local (not an OS boundary) | docker (POSIX/WSL2; native Windows use local/WSL2)
 # AGENT_MINE=deterministic                # write side of memory loop: deterministic (default) | llm | off
 # AGENT_SUBAGENT_DEPTH=1                   # max delegation depth (0 disables spawn_subagent)
+# AGENT_DELEGATION_TIMEOUT=900             # hard ceiling for a child-agent wave; cannot be disabled
+# AGENT_EXPLORER_REASONING=staged           # fast evidence navigation + one full tool-free synthesis
+# AGENT_EXPLORER_NAV_STEPS=6                # staged explorer's fast-navigation ceiling (then synthesis)
 # AGENT_VERIFY_CMD=python3 -m pytest -q   # Oracle: run before "done"; failures force another turn
 # AGENT_MAX_TOKENS=200000                 # budget ceiling

sliceagent-0.3.0/.github/workflows/publish.yml

@@ -0,0 +1,67 @@
+name: publish
+
+# Publish to PyPI via trusted publishing (OIDC — no tokens).
+# Trigger: a published GitHub release. The release tag must match the package version.
+on:
+  release:
+    types: [published]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.release.tag_name }}
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+      - name: Verify release tag matches package version
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          python - <<'PY'
+          import ast
+          import os
+          from pathlib import Path
+
+          tree = ast.parse(Path("src/sliceagent/__init__.py").read_text(encoding="utf-8"))
+          version = next(
+              ast.literal_eval(node.value)
+              for node in tree.body
+              if isinstance(node, ast.Assign)
+              and any(isinstance(target, ast.Name) and target.id == "__version__" for target in node.targets)
+          )
+          tag = os.environ["RELEASE_TAG"]
+          expected_tag = f"v{version}"
+          expected_ref = f"refs/tags/{tag}"
+          if tag != expected_tag:
+              raise SystemExit(f"release tag {tag!r} does not match package version {version!r}")
+          if os.environ["GITHUB_REF"] != expected_ref:
+              raise SystemExit(
+                  f"release ref {os.environ['GITHUB_REF']!r} does not match tag ref {expected_ref!r}"
+              )
+          print(f"Publishing SliceAgent {version} from {expected_ref}")
+          PY
+      - name: Build and validate distributions
+        run: |
+          python -m pip install build twine
+          python -m build
+          python -m twine check dist/*
+      - uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write   # OIDC token for PyPI trusted publishing
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1

{sliceagent-0.2.0 → sliceagent-0.3.0}/.gitignore

@@ -47,10 +47,20 @@ runs/
 *.pdf
 
 # ── internal-only: untracked 2026-07-02 for the public launch (files stay on disk locally) ──
-# evals/  = internal benchmark harness + ~127 MB of captured tbench/job run artifacts (deb/lz4/pt/logs)
+# evals/ contains ~127 MB of captured tbench/job artifacts. Keep those ignored, but version the small,
+# receipt-grounded prompt experiment needed to reproduce the mind-model claim and its offline tests.
 # prototype/ = superseded ~250-line JS proof-of-concept (its own README: "not the production codebase")
 # docs/STEP3-PLAN.md, docs/MEMEM-DIAGNOSIS.md = internal R&D planning notes, not user docs
-evals/
+evals/*
+!evals/__init__.py
+!evals/oldprompt_memory_model.txt
+!evals/receipt_claims.py
+!evals/receipt_prompt_ab.py
+!evals/context_contract_eval.py
+!evals/self_inspection_tool_eval.py
+!evals/selfnarrative_ab.py
+!evals/usersim.py
+!evals/usersim_pty.py
 prototype/
 docs/STEP3-PLAN.md
 docs/MEMEM-DIAGNOSIS.md
@@ -58,8 +68,13 @@ docs/MEMEM-DIAGNOSIS.md
 # internal engineering roadmap (wave planning), not product docs — untracked 2026-07-02
 ROADMAP.md
 
-# all of docs/ is internal (architecture/spec/brand assets) — not published; untracked 2026-07-02
-docs/
+# Architecture specs below are part of the OSS design contract; other internal
+# drafts and brand assets remain local by default.
+docs/*
+!docs/ENDGAME-CONTEXT-DESIGN.md
+!docs/MEMORY-LAYERS-DESIGN.md
+!docs/SUBAGENT-DESIGN.md
+!docs/CONFIGURATION.md
 
 # ColBench raw HF dataset (huge; selected tasks are committed under evals/colbench/tasks/)
 evals/colbench/data/

{sliceagent-0.2.0 → sliceagent-0.3.0}/CHANGELOG.md

@@ -5,6 +5,180 @@ this project aims for [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.3.0] — 2026-07-17
+
+### Added
+- **Intent Fidelity v2.** One shared, ephemeral turn contract now separates user-authorized action spans
+  from quoted/reported prior output, grounds historical references in sealed responses, resolves numbered
+  items and launch-ordered subagents, and helps the model carry terse confirmations onto the immediately
+  pending proposal or explicitly selected numbered option. This intent metadata is advisory context, not a
+  second host-side permission system.
+- **Safe update path.** `sliceagent update` now updates a positively identified canonical `uv tool`
+  install before any API-key, workspace, plugin, or MCP startup. Editable/direct installs are preserved,
+  alternative package managers receive exact guidance, and `/update` points active sessions to the safe
+  process boundary.
+- **Seamless workspace handoff.** `/cwd <path>` and the model-facing `change_workspace` control tool now
+  stage and validate the target runtime, durably seal the current turn, and atomically replace only
+  workspace-owned resources. The terminal application, model client, token/cost counters, and connection stay
+  alive; target preparation failures roll back to the untouched current workspace.
+- **Canonical execution receipts.** Every tool lifecycle now records requested, rejected-before-start,
+  physically started, settled, and effect-applied states under one invocation identity. Sealed receipts flow
+  into turns, recovered crashes, child-artifact references, terminal completion, and receipt-grounded recall;
+  large-task aggregates remain exact without replaying thousands of operation rows into the prompt.
+- **Receipt-aware mind-model evaluation.** The paired old-autobiography/operating-contract harness now proves
+  the substituted system-prompt diff on one Git revision and workspace, retains full replies, rejects
+  screen-derived ground truth, and scores lifecycle claims, abstentions, corrections, and required coverage
+  directly against sealed receipts.
+
+### Changed
+- **Subagents now return direct, ordered outcomes.** Every completed child contributes its full normalized
+  report to the parent as an ordinary tool result in launch order. The parent continues its normal loop and
+  owns synthesis; there is no synthetic fan-in packet, transcript reset, child-lifecycle mutation of Active
+  Work, or hidden terminal-delivery enforcement. Active Work is reserved for genuine cross-turn user
+  commitments rather than acting as a second scheduler.
+- **Subagent persistence is optional and fail-soft.** Once a safe child report exists, artifact-store,
+  reference-publication, or memory-mirror failures are retained as warnings instead of discarding useful
+  evidence or making the child indeterminate. Truly unresolved execution remains indeterminate; optional
+  artifacts remain durable locators, not a prerequisite for parent delivery.
+- **Subagent progress uses truthful readiness language.** The live matrix distinguishes running, queued,
+  failed, completed-without-report, and report-ready children without describing a report as sealed merely
+  because it is ready for the parent. “Partial report” is reserved for actually partial report bytes;
+  operationally incomplete work and persistence status stay separate from report completeness.
+- **One typed memory model, with Memem as retrieval rather than authority.** L0 remains canonical sealed
+  evidence, L1 remains rebuildable Active Work, and native SQLite owns provenance-linked USER/PROJECT/CRAFT
+  L2 records. Memem 2.10's structured external-index protocol is the primary semantic ranker when available:
+  stable IDs, hard scope partitions, one primary abstraction, and bounded cue anchors are always resolved back
+  through SliceAgent's lifecycle, revision, sensitivity, and provenance predicates. Resolved or revision-drifted
+  project diagnostics stay explicit-pull instead of being re-injected as current bugs; a whole-query native
+  fallback preserves availability without co-ranking historical full-body noise.
+- **Autonomous admission kernel.** General permission modes, host-side turn-authority denials,
+  reconciliation locks, and loop-policy refusals are retired. Ordinary requested work now flows directly;
+  the host retains only a narrow, high-confidence safeguard for commands that could catastrophically damage
+  the machine (such as formatting a device or recursively deleting `/` or the user's home).
+- **Calmer, informative Rich TUI.** The footer no longer pins task text; it restores total-token and
+  dollar-savings meters. The live reasoning/progress row also shows only current activity (or the active plan
+  step), never the task's first prompt. Assistant replies have more breathing room, and the composer drops its
+  redundant title. Combined greetings such as “hi how are you” stay on the cheap chitchat path instead of
+  becoming a durable task title.
+- **Natural workspace intent.** “Go/open/work in the hunter workspace” now navigates without requiring
+  implementation-shaped wording. Safe fallback path probes remain observational, and an assistant's exact
+  workspace-path clarification carries naturally into a terse confirmation such as “yes.”
+- **Elastic observation flow.** Pipelines and fallback branches composed entirely of read-only commands
+  (for example `find … | sort` and `ls … 2>/dev/null || ls …`) remain ordinary inspection. A failed operation
+  does not poison unrelated reads, and terminal messages report the actual failed action without internal
+  policy jargon.
+- **Capability-shaped intent grounding.** Effects are understood by governing action, concrete target, and
+  command family rather than by tool name or stray keywords. Coordinated directives retain each capability;
+  quoted filenames, exact commands, dotfiles, file sets, requirements, VCS/package operations, and adjacent
+  “go” or “continue” confirmations remain grounded without turning intent recognition into authorization.
+- **Typed evidence selection.** One `EvidenceQuery` now owns execution-recall family, predicate, and scope.
+  Receipt projections distinguish exact aggregates from failure details and latest-turn from task-wide recall,
+  while the slice remains elastic for active complexity and history-bounded with respect to transcript age.
+- **Plugin execution-admission APIs are intentionally retired.** Plugins continue to register tools, skills,
+  and MCP servers, but the old `register_hook` / `intent_effect` permission surfaces and hook-bearing
+  `load_plugins` tuple are removed with the policy-gate machinery. This is a deliberate pre-1.0 API break;
+  ordinary advisory behavior belongs in tool results or skills, not hidden host-side action gates.
+
+### Fixed
+- **Delegated results can no longer disappear behind a synthetic delivery gate.** Successful child reports
+  reach the next parent model call in full and in order, so a stale deliverable contract, revision mismatch,
+  or missing heading cannot replace the requested final answer with a host-authored interruption. The model
+  remains responsible for synthesizing and delivering the user-visible result.
+- **Useful child reports survive optional publication failures.** A completed, normalized report is returned
+  directly even when its artifact, reference, or memory mirror cannot be written. Those failures remain
+  visible as persistence warnings; they no longer erase child evidence or turn a known report into an
+  indeterminate execution outcome.
+- **Child reports are not silently lost at lifecycle edges.** A mixed indeterminate batch gets one
+  synthesis-only closeout over settled siblings before the turn parks; deadline-grace completion retains the
+  full direct report without requiring an artifact; context overflow parks instead of evicting an unseen
+  report; and crash recovery advertises the exact interrupted-turn artifact for one resumed seed.
+- **Broad subagent reviews no longer collapse into timeout cascades.** Repository audits use ignore-aware,
+  source-weighted scopes and staged 2–3-child waves instead of one exhaustive child per directory. Every child
+  drains and assembles SSE off the main thread even without a UI sink, so an ordinary long reasoning response
+  is not mistaken for 60 seconds of transport silence. The completion-budget-aware monotonic watchdog remains
+  configurable with `LLM_HARD_TIMEOUT_SEC`; provider SDK retries stay disabled and the model runner is the one
+  visible retry owner. A process-wide physical-call lease now bounds live requests per provider account,
+  including sockets whose logical watchdog already returned, while pre-admission cancellation cannot start a
+  late request and capacity wait shares the same absolute deadline as execution.
+- **Canonical installs can actually self-update.** The updater now recognizes the standard
+  `python = "3.12"` field emitted by current `uv tool` receipts while continuing to reject custom
+  requirements, resolver settings, and non-public package sources. Trusted executable discovery rejects
+  repository and arbitrary-PATH shims while correctly following Homebrew/Nix-style manager-owned symlink
+  chains; a receipt-provided bin can no longer redirect execution to an unrelated external target.
+- **Native Windows paths keep one identity across the runtime.** Model-facing mention handles stay
+  slash-normalized, physical workspace evidence retains its native invocation spelling, and workspace
+  transitions compare case-insensitive canonical identities without changing display paths. Git-Bash live
+  composition reuses the application-selected terminal I/O, while POSIX-only PTY eval support is loaded only
+  when a live eval actually runs.
+- **Concurrent evidence appends are serialized on Windows too.** The JSONL `FileLock` now uses a
+  canonical-path-keyed Windows kernel mutex with abandoned-owner recovery, matching the existing POSIX `flock`
+  guarantee instead of allowing independently opened append handles to overwrite records.
+- **Private state modes do not leak into shared skills.** Personal vault/config/default-skill files remain
+  owner-only, while an explicitly selected project/shared skill directory creates collaborator-readable
+  `SKILL.md` files and preserves an existing file mode across atomic rewrites.
+- **Workspace switches preserve the live collaboration state.** One application session identity now spans
+  in-process workspace handoffs; conversation, standing user intent, proposals, and every open topic survive
+  A→B→A, while file residency, observed facts, revisions, receipt snapshots, and old artifact handles are
+  restored only from the selected workspace. Handoff publication stages fallible derived objects first, and
+  teardown/logging failures can no longer falsify a switch that already committed.
+- **Durable evidence has an unambiguous order and explicit gaps.** A crash-durable monotonic turn order is
+  shared by journals, artifacts, and checkpoints (including recovery and idempotent retries); legacy
+  same-second ties expand as partial evidence instead of task-ID guessing. Corrupt immutable records now
+  propagate bounded gap metadata into execution/quality coverage and the artifact index rather than silently
+  producing exact counts over survivors.
+- **Intent continuity no longer drifts across attribution or redaction.** A user who adopts wording from an
+  assistant recommendation retains a live imperative; quoted/fenced proposal examples cannot authorize a
+  later “yes”; nested numbered details cannot steal top-level ordinals; and persistence-only secret masks
+  preserve source offsets so exact user clauses still point to the same words after recovery.
+- **User-reported failures close only on real proof.** Stale tool errors clear only after the exact failed call
+  succeeds. Test/build reports clear only after an explicit file-tool edit followed by a status-propagating
+  shell command whose test/lint/type/build family matches the report; sequential families accumulate only
+  until the next edit. Help, list, collect, dry-run, skip, or exit-zero modes do not count, and source text
+  inside `execute_code` is never treated as a mutation or verification receipt.
+  Neutral lifecycle cancellations remain visible as “not run” without becoming blockers, evidence, warning
+  completions, or policy errors; catastrophic safety refusals remain explicit and adverse.
+- **Child budgets remain hard batch ceilings.** Delegated token reservations now carry across scheduler waves,
+  so interleaved effects or serialized writable children cannot each receive the parent's full remaining cap;
+  children rejected before physical start no longer dilute a valid sibling's reservation.
+- **Subagent fan-out now degrades gracefully under provider pressure.** A wave admits at most four child model
+  loops, launches the first pair immediately, and ramps later starts instead of creating a synchronized provider
+  burst. Explorers default to at most six fast evidence-navigation steps followed by one full, tool-free
+  synthesis. Clean navigation or planned navigation-budget exhaustion may hand off only typed workspace
+  evidence; the latter carries an explicit incomplete-coverage note. The fast navigator suppresses the generic
+  max-step closeout, avoiding a redundant billed call, while cancellation, uncertainty, fatal provider/tool
+  stops, token exhaustion, truncation, and evidence-free runs never synthesize. The live matrix is driven by typed
+  queued/starting/model-active/reasoning/writing/tool/
+  retry/terminal phases rather than detail-string inference. Exhausted attempts, truncated output,
+  cancellation, or a final-synthesis failure start no wrapper-level recovery call. Usable partial report text,
+  observations, trace, and usage return directly as an explicitly partial outcome; optional artifact
+  persistence does not create an Active Work dependency or gate delivery. Cancellation still wakes retry
+  backoff and prevents a late outcome from publishing into a replacement task.
+- **Hung read deadlines stay live.** Timeout-enabled pure reads use bounded daemon workers and a short grace
+  period; unresolved readers become typed indeterminate outcomes, later barriers are cancelled, Ctrl-C remains
+  responsive, and a permanently stuck reader no longer freezes the turn or process exit.
+- **Read scheduling keeps truthful lifecycle boundaries.** Lifecycle children no longer disable adjacent read
+  deadlines; exhausted daemon capacity settles as a typed not-started cancellation; late indeterminate results
+  still close later effects; and a start journal crossing a deadline cannot enter its handler or route a late
+  lifecycle edge into a newer turn/workspace.
+- **Registry outcomes stay typed at every edge.** Preflight-cancelled calls bypass execution-only effect
+  factories, availability is admitted exactly once before the durable start boundary, direct validation
+  failures never construct execution effects, and registry replacement cannot mix an admitted handler with a
+  stale effect factory. Invalid explicit statuses become indeterminate instead of successful, and byte or
+  unrenderable extension results remain inside the canonical outcome path.
+- **Streaming deadlines cannot leak output into a later turn.** On platforms without a synchronous SIGALRM
+  lease, both Chat Completions and Responses interactive paths use the blocking daemon watchdog rather than
+  abandoning an SSE worker that could continue emitting deltas after timeout.
+- **Plugin/MCP extension startup is transactional and bounded.** Plugin packages support relative imports and
+  fully roll back registry, skill, MCP, and module state on failure. MCP timeouts cancel discarded workers,
+  malformed configuration/descriptors are contained before spawn, and remote tool names cannot control
+  page-out paths or labels.
+- **The catastrophic floor survives extension failure and common shell spelling.** A crashing/no-op earlier
+  preflight hook cannot skip the later machine-safety check, and high-confidence POSIX escaped executable names
+  or quoted raw-device assignments are recognized without treating escaped literal home/glob operands as wipes.
+- **Varying re-inspection loops get an advisory recovery cue.** Eight distinct observation calls returning the
+  same meaningful result add one model-only nudge to synthesize, act, or ask. It never rejects a tool or emits a
+  user-facing policy error.
+
 ## [0.2.0] — 2026-07-10
 
 A typed re-architecture of the core around a single canonical design (elastic slice, execution kernel,

{sliceagent-0.2.0 → sliceagent-0.3.0}/NOTICE

@@ -6,7 +6,7 @@ This product includes code ported from, and architecture reimplemented after, th
 open-source projects below. We are grateful to their authors.
 
 ────────────────────────────────────────────────────────────────────────────
-Hermes — https://github.com/NousResearch/hermes   (MIT License)
+Hermes Agent — https://github.com/NousResearch/hermes-agent   (MIT License)
 Copyright (c) 2025 Nous Research
 
   Verbatim / closely-ported source:
@@ -28,7 +28,7 @@ Kimi-Code — https://github.com/MoonshotAI/kimi-code   (Moonshot AI)
   ARCHITECTURE AND PATTERNS reimplemented in Python (no source copied — ideas,
   not code):
     access.py + scheduler.py (resource-access model for safe tool parallelism),
-    policy.py (permission chain), config.py (layered config), clock.py, cron.py,
+    config.py (layered config), clock.py, cron.py,
     flags.py, model_catalog.py, mcp_client.py (the mcp__server__tool namespacing),
     loop.py (micro-compaction), tui.py (selector menus + footer/streaming),
     code_grep.py (ripgrep pagination), agents.py (named-agent registry).

{sliceagent-0.2.0 → sliceagent-0.3.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: sliceagent
-Version: 0.2.0
-Summary: A coding agent with a new context-engineering framework: bounded, deterministic, reconstructed context (slice architecture) — built for long-horizon work.
+Version: 0.3.0
+Summary: A coding agent with history-bounded, task-elastic reconstructed context — built for long-horizon work.
 Author: TT-Wang
 License-Expression: MIT
 License-File: LICENSE
@@ -16,12 +16,13 @@ Classifier: Topic :: Software Development :: Build Tools
 Requires-Python: >=3.11
 Requires-Dist: httpx>=0.27
 Requires-Dist: mcp>=1.0
-Requires-Dist: memem>=2.9.7
-Requires-Dist: numpy>=1.24
 Requires-Dist: openai>=1.40
 Provides-Extra: dev
 Requires-Dist: pytest>=8; extra == 'dev'
 Requires-Dist: ruff>=0.6; extra == 'dev'
+Provides-Extra: memory
+Requires-Dist: memem>=2.9.7; extra == 'memory'
+Requires-Dist: numpy>=1.24; extra == 'memory'
 Provides-Extra: treesitter
 Requires-Dist: tree-sitter-python>=0.21; extra == 'treesitter'
 Requires-Dist: tree-sitter>=0.21; extra == 'treesitter'
@@ -55,14 +56,23 @@ The field's default is *bigger windows + summarize*. sliceagent does the opposit
        alt="The core loop: a transcript agent re-sends its entire growing history every turn (208k to 1.66M tokens over 6 turns), while sliceagent rebuilds a history-bounded, task-elastic seed from the carried slice, live files, and lessons, then seals each turn to disk, and the hippocampus pages past turns back into future seeds on demand — peak input stayed ~12-15k in the s1 benchmark, 112x smaller by turn 6.">
 </p>
 
-sliceagent's memory is organized like a brain: fast, lossy **perception** of the live world; an elastic **working memory** for the current task; a **hippocampus** backed by always-on local artifacts; and an optional **neocortex** that derives durable lessons. Every turn *reconstructs* a history-bounded working set from these — it never replays a growing transcript.
+sliceagent's memory is organized like a brain: fast, lossy **perception** of the live world; an elastic **working memory** for the current task; a **hippocampus** backed by always-on local artifacts; and a typed native **neocortex** for provenance-linked USER, PROJECT, and CRAFT knowledge. Every turn *reconstructs* a history-bounded working set from these — it never replays a growing transcript. With Memem's structured-index protocol (2.10+) installed, Memem is the primary semantic retrieval backend for typed L2; it is not another brain layer or a second record authority.
 
 | Region | Role |
 |---|---|
-| **Sensory cortex** — live perception | Re-derives the world each turn—git state, project facts, repo map—rather than trusting remembered copies. |
-| **Prefrontal cortex** — working memory | The carried **Slice**: task-elastic, provenance-tagged state (intent, findings, plan, change-set), sealed at each turn boundary. |
-| **Hippocampus** — episodic memory | Seals each turn or child report into the always-on local artifact store; pages a specific record back in on demand. |
-| **Neocortex** — long-term memory | Optionally derives and retrieves provenance-tagged cross-session lessons; it is not required for task recovery. |
+| **Sensory cortex** — live perception | Re-derives only live resources named by the active dependency closure; unrelated repo maps, history, and memory are not eagerly injected. |
+| **Prefrontal cortex** — working memory | Source-linked **Active Work** for genuine unresolved, cross-turn user commitments; it is not a shadow scheduler for tools or subagents. |
+| **Hippocampus** — episodic memory | Seals every turn into the always-on local artifact store; optional child-report artifacts add re-readable locators without gating direct report delivery. |
+| **Neocortex** — long-term memory | Stores scoped, provenance-linked USER, PROJECT, and CRAFT records in one typed model; Memem provides primary semantic retrieval when available, with native search as failover. |
+
+The implementation contracts are documented in [End-game context design](docs/ENDGAME-CONTEXT-DESIGN.md) and
+[Memory layers design](docs/MEMORY-LAYERS-DESIGN.md).
+
+The exact current request is admitted once into an application event ledger and one Active Work root. Context
+is selected from that graph's unresolved dependency closure before physical elasticity is applied. After
+execution, the sealed turn carries a canonical receipt distinguishing requested, rejected, started, settled,
+and applied work. A constant-size receipt projection remains visible without constructing an autobiography
+from conversational residue.
 
 ```text
 ┌───────────────────┐ ┌───────────────────┐ ┌───────────────────┐ ┌───────────────────┐
@@ -90,7 +100,7 @@ sliceagent's memory is organized like a brain: fast, lossy **perception** of the
      live views re-derive, archived detail returns by handle.
 ```
 
-Each turn faults in what the active task references — the carried slice, live views, selected artifacts, and any relevant derived lessons — and hands the model an elastic **Seed**. The model acts; observations fold back into working memory; at the turn boundary the episode is sealed into an immutable local artifact and the next checkpoint is published. If semantic memory is available, it may additionally distill a durable lesson. Net effect: **for stable active task state, context does not grow merely with session age; it can still expand with genuine task complexity.**
+Each turn faults in what the active task references — the carried slice, live views, selected artifacts, and applicable typed USER, PROJECT, or CRAFT knowledge — and hands the model an elastic **Seed**. The model acts; observations fold back into working memory; at the turn boundary the episode is sealed into an immutable local artifact and the next checkpoint is published. Qualifying evidence may then consolidate into a native typed lesson; optional semantic retrieval may index it but is not required. Net effect: **for stable active task state, context does not grow merely with session age; it can still expand with genuine task complexity.**
 
 ## Benchmark
 
@@ -180,7 +190,7 @@ Per turn (mean of 3 runs) — the orchestrator's context is what caps how large
 | 5 · follow-up | 41,447 | 338,507 |
 | 6 · follow-up | 31,963 | 362,595 |
 
-In these runs, sliceagent's orchestrator peak stayed roughly flat because each turn retained active digests and handles rather than child trajectories; its largest single request averaged **~17k** across the six-turn workload. A transcript orchestrator **re-carries the whole session every turn**, so the same delegation-heavy session reached a **~21× larger orchestrator peak and ~3.7× more total tokens** once both agents' children were counted. Parent context does not grow with child trajectory length, though it may still grow when more delegated results are genuinely relevant. Delegation is table stakes; the architectural advantage is durable, re-readable child artifacts plus a history-bounded parent.
+In these runs, sliceagent's orchestrator peak stayed roughly flat because it carried child results rather than child trajectories; its largest single request averaged **~17k** across the six-turn workload. A transcript orchestrator **re-carries the whole session every turn**, so the same delegation-heavy session reached a **~21× larger orchestrator peak and ~3.7× more total tokens** once both agents' children were counted. Parent context does not grow with child trajectory length, though it may still grow when more delegated results are genuinely relevant. Delegation is table stakes; the architectural advantage is direct child outcomes, optional re-readable artifacts, and a history-bounded parent.
 
 *N = 3 runs, single model, one opponent, needs the Codex CLI installed. A value-recall sub-check varied wildly run-to-run (sliceagent 1–3 / 3, Codex 0–2 / 3) — it turns on a behavioral re-read choice, so it is within noise and **not** part of the claim. The defensible result is the orchestrator-context and total-token gap, which is structural and held across all three runs (orchestrator 8.8–14.3×, total 3.2–4.3×).*
 
@@ -257,14 +267,42 @@ pipx install "sliceagent[tui]"                      # pipx
 pip install "sliceagent[tui]"                       # plain pip (use a venv)
 ```
 
+Native evidence, Active Work, history, and typed knowledge are included in the base install. The
+`sliceagent[tui,memory]` extra adds optional Memem; when its structured-index protocol is available (Memem 2.10+),
+SliceAgent uses it as primary L2 retrieval and falls back to native search on a whole-query failure. Older Memem
+versions are reported as unavailable for this protocol rather than used as an unscoped recall tail. Typed record
+truth and `@sliceagent/` durability remain available without it.
+
 If `pip` refuses with `Requires-Python >=3.11`: `conda create -n sliceagent python=3.12 -y && conda activate sliceagent`, then pip install. Prefer env vars over the wizard? Export **both** `LLM_API_KEY` and `AGENT_MODEL` (plus `LLM_BASE_URL` for non-OpenAI endpoints). `ripgrep` is recommended (code search degrades gracefully without it).
 </details>
 
-Footprint is light (no torch). `pip install -e .` works for a clone. Homebrew / Docker arrive in v0.2. → Full walkthrough in **[QUICKSTART.md](QUICKSTART.md)**.
+### Updating
+
+For installs created by the one-line installer:
+
+```bash
+sliceagent update
+```
+
+The command updates only when it can positively identify SliceAgent's isolated `uv` tool environment;
+it never replaces an editable checkout or guesses at a manager-owned environment. On Windows, exit
+SliceAgent and follow the external process guidance it prints. If your installed version predates
+`sliceagent update`, re-run the one-line installer; the installer is deliberately safe to re-run.
+
+Self-managed installs stay self-managed: `uv tool upgrade sliceagent`, `pipx upgrade sliceagent`, or
+`python -m pip install --upgrade "sliceagent[tui]"` (or `sliceagent[tui,memory]` when using Memem). Source checkouts should pull first, then run
+`uv sync --all-extras`.
+
+Footprint is light (no torch), and `pip install -e .` works for a clone. Distribution is currently through
+the one-line installers and PyPI; no Homebrew formula or prebuilt SliceAgent container image is advertised.
+Docker is available separately as the optional POSIX/WSL2 command-sandbox backend. → Full walkthrough in
+**[QUICKSTART.md](QUICKSTART.md)**.
 
 ## Usage
 
-Run `sliceagent` in your project and type what you want in plain language. It rebuilds its working context, investigates, edits (auto-applied or confirmed, per your mode), and can run your tests to verify. A turn looks like:
+Run `sliceagent` in your project and type what you want in plain language. It rebuilds its working context,
+investigates, edits, and can run your tests to verify. Ordinary requested work proceeds without permission
+prompts; only a narrow high-confidence catastrophic-command safeguard can refuse execution. A turn looks like:
 
 ```text
 ❯ why does retry_with_backoff drop the last attempt? fix it
@@ -275,12 +313,14 @@ Run `sliceagent` in your project and type what you want in plain language. It re
   ◌ 2/3 add a regression test · Running pytest -q · 00:12
   │ run pytest -q
   │   38 passed
-  │ ◆ The regression reproduces the bug and passes with the fix.
-  ┌─ assistant ─────────────────────────────────────────────┐
-  │ The loop exits on `attempt == max` before the final      │
-  │ sleep+retry, so the last attempt never runs. Changed the  │
-  │ bound to `attempt <= max` and added a regression test.    │
-  └──────────────────────────────────────────────────────────┘
+  │ agent note · The focused regression now passes.
+  ─ assistant ───────────────────────────────────────────────
+
+    The loop exits on `attempt == max` before the final
+    sleep+retry, so the last attempt never runs. Changed the
+    bound to `attempt <= max` and added a regression test.
+
+  ───────────────────────────────────────────────────────────
   ✓ turn saved · plan 3/3 · 2 passes · 4 read · 1 edit · 1 cmd · 00:18
 ```
 
@@ -290,54 +330,81 @@ Attach a file or path to your message with `@`: `@src/errors.py explain the back
 
 | Command | What it does |
 |---|---|
-| `/config` · `/model` · `/reasoning` | add/switch providers · switch model / reasoning effort (persists) |
-| `/mode` | permission mode: **baby-sitter** (confirm each edit + command) · **teenager** (default; confirm risky ones) · **let-it-go** (auto-run all but catastrophic) |
-| `/undo` | revert the last edit(s) |
-| `/cwd [path]` | show the fixed workspace root; with a path, show where to relaunch |
+| `/config` · `/model` | add/switch providers · switch model / reasoning effort (persists) |
+| `Esc` | revert the last edit(s) |
+| `/cwd [path]` | show the workspace; with a path, atomically switch it without restarting the UI or model client |
 | `/cost` | tokens and estimated $ spent this session |
 | `/skills` · `/tools` · `/mcp` · `/plugins` · `/agents` | list what's available to the agent |
 | `/threads` · `/resume` | switch between, or resume, parked topics |
 | `/learn <note>` | save a durable lesson yourself |
 | `/plan` | show the current task plan |
+| `/update` | show the safe process-boundary update command |
 | `Ctrl-C` · `exit` | interrupt the turn · quit |
 
+Public `/` palette: `/config` · `/model` · `/cwd` · `/learn` · `/plan` · `/cost` · `/update` · `/threads` · `/resume` · `/plugins` · `/mcp` · `/skills` · `/tools` · `/agents` · `/help` · `/exit`.
+The typed compatibility aliases `/reasoning`, `/undo`, and `/switch` remain accepted, but stay out of the
+palette because `/model`, Esc, and `/resume` are their clearer public spellings.
+
+File mentions accept exact workspace paths such as `@app/jobs/[id]/page.tsx`; quote paths containing spaces,
+for example `@"docs/my guide.md"`.
+
 Prefix an unrelated request with `New task:` to start it with fresh task state while parking the current task
 for `/resume`. Ambiguous follow-ups deliberately continue the active task so context is never discarded on a
 guess.
 
-It can edit code (workspace-confined, reversible with `/undo`), run regular shell commands through a sandbox (`local` by default, `docker` for full isolation), search the tree and the web, and delegate decomposable research to a fresh one-shot read-only explorer (each child gets its own history-bounded, task-elastic slice). That narrow surface is the demo default. Set `AGENT_ADVANCED_AGENTS=1` to expose writable and named specialist delegation (and nested delegation when `AGENT_SUBAGENT_DEPTH` is raised above its default of `1`), or `AGENT_ADVANCED_TOOLS=1` to expose persistent process and interactive terminal tools. The flags are independent. Three permission modes gate actions, all with a hard floor on catastrophic commands; secrets are scrubbed from anything persisted or logged.
+It can edit code in the primary workspace and grounded focus roots (reversible with `/undo`), run regular shell commands through a sandbox (`local` by default, `docker` for container isolation on POSIX/WSL2), search the tree and the web, and delegate decomposable research to a fresh one-shot read-only explorer (each child gets its own history-bounded, task-elastic slice). Native Windows uses the local backend; run SliceAgent inside WSL2 if you want the Docker backend. That narrow surface is the demo default. Set `AGENT_ADVANCED_AGENTS=1` to expose writable and named specialist delegation (and nested delegation when `AGENT_SUBAGENT_DEPTH` is raised above its default of `1`), or `AGENT_ADVANCED_TOOLS=1` to expose persistent process and interactive terminal tools. The flags are independent. Ordinary work runs directly from the user's request; the host retains only a narrow safeguard against high-confidence catastrophic shell commands. Secrets are scrubbed from anything persisted or logged.
 
-Every clean or interrupted agent task turn and every subagent report is sealed into the always-on local artifact/checkpoint path, independently of semantic memory. The model can refine retained detail through the read-only `artifacts/` namespace. Cross-session semantic lessons are a separate, optional derived layer powered by memem; task recovery does not depend on it.
+Every clean or interrupted agent task turn is sealed into the always-on local artifact/checkpoint path.
+Subagent reports return directly to the parent in launch order; when optional artifact persistence succeeds,
+they also gain durable re-readable locators. The model reads exact evidence, project history, Active Work, and
+typed knowledge through the permanent read-only `@sliceagent/` namespace in every workspace.
+`@sliceagent/memory/status.md` is the bounded general summary; raw host-counted inventory lives separately at
+`@sliceagent/memory/diagnostics.md` for explicit diagnostic requests. Compatibility counts are not layer sizes
+or an L2 backlog. Memem is primary semantic retrieval when enabled; task recovery and typed record truth do
+not depend on it.
 
-If a timeout or disconnect leaves an operation's side effects uncertain, SliceAgent carries a durable,
-target-scoped reconciliation gate into the next turn: it permits matching live read-only inspection, then
-requires an explicit evidence-backed resolution before more effects or task switching in that workspace.
-Opaque shell/code effects also require live user confirmation; a directory listing is never treated as proof
-of file contents. Ambiguous recovery journals stop startup before plugins or MCP processes run.
+Automatic knowledge push is lifecycle- and revision-aware: stale or dependency-drifted PROJECT observations and
+resolved diagnostic reports remain explicitly searchable, but do not reappear as if they described the current
+workspace. USER preferences and reusable CRAFT procedures do not decay merely because time passed.
+
+If a timeout or disconnect leaves an operation's side effects uncertain, SliceAgent records that uncertainty
+durably and shows it to the model as grounding on later turns. It can re-observe relevant live state before
+making claims, but the receipt does not block ordinary work, task switching, undo, or workspace navigation.
+Ambiguous recovery journals still stop startup before plugins or MCP processes run because that boundary
+protects the integrity of the durable local store rather than interpreting user intent.
 
 **Configuration.** `sliceagent config --list` prints every setting. Set them persistently in `~/.sliceagent/config.toml` (written by `init`), or override any one via an environment variable:
 
 | Setting | Default | Purpose |
 |---|---|---|
 | `AGENT_MODEL` | *(required)* | the model id to run |
-| `AGENT_POLICY` | `teenager` | permission mode |
-| `AGENT_SANDBOX` | `local` | `local` or `docker` (isolated) |
+| `AGENT_SANDBOX` | `local` | `local`, or `docker` on POSIX/WSL2 (native Windows: use `local` or run under WSL2) |
 | `AGENT_MAX_STEPS` | `60` | per-turn step ceiling |
 | `AGENT_CONTEXT_WINDOW` | *(catalog or unset)* | explicit provider window for strict per-call preflight; unknown models otherwise use compatibility mode |
 | `AGENT_ADVANCED_AGENTS` | *(off)* | enable writable and named specialists; unlock the nested surface subject to the depth ceiling |
 | `AGENT_SUBAGENT_DEPTH` | `1` | delegation depth ceiling; raise it to permit nested advanced agents |
+| `AGENT_DELEGATION_TIMEOUT` | `900` | hard ceiling in seconds for one child-agent wave; raise for unusually slow providers |
+| `AGENT_EXPLORER_REASONING` | `staged` | fast evidence navigation followed by one full, tool-free final synthesis (`fast`/`full` are single-stage overrides) |
+| `AGENT_EXPLORER_NAV_STEPS` | `6` | fast-navigation model-step ceiling for staged explorers; one separate synthesis step stays reserved |
+| `LLM_HARD_TIMEOUT_SEC` | *(completion-budget derived)* | absolute per-call watchdog; provider-agnostic default allows the configured completion cap at a conservative generation rate (minimum 180s) |
+| `LLM_STREAM_CLOSE_GRACE_SEC` | `2` | bounded wait to prove a cancelled/timed-out SSE request physically closed before any retry |
+| `LLM_PROVIDER_MAX_INFLIGHT` | `4` | process-wide physical request cap per provider account; indeterminate calls hold their slot until the transport closes |
 | `AGENT_ADVANCED_TOOLS` | *(off)* | enable persistent process and interactive terminal tools |
 | `SLICEAGENT_CACHE_DIR` | `~/.sliceagent` | always-on local checkpoints, immutable artifacts, and recovery journals |
-| `SLICEAGENT_VAULT` | `~/.sliceagent/vault` | optional semantic-memory and legacy compatibility records |
+| `SLICEAGENT_VAULT` | `~/.sliceagent/vault` | legacy episodic/task/roster compatibility records (not canonical typed L2) |
 | `AGENT_VERIFY_CMD` | *(unset)* | test command used as the verification oracle |
 
+DeepSeek official-API configurations should move from the retiring `deepseek-chat` / `deepseek-reasoner`
+aliases to `deepseek-v4-flash` or `deepseek-v4-pro`. SliceAgent keeps the old names temporarily compatible,
+but new provider setup and model suggestions use the V4 names.
+
 ## License
 
 **MIT** — see [LICENSE](LICENSE). Third-party components and their licenses are listed in [NOTICE](NOTICE). Security policy + threat model: **[SECURITY.md](SECURITY.md)**.
 
 ## Acknowledgements
 
-sliceagent's design was informed by two excellent open-source agents: **[Hermes](https://github.com/NousResearch/hermes)** (MIT) and **[Kimi Code](https://github.com/MoonshotAI/kimi-code)**. A few peripheral utilities are ported from Hermes (see [NOTICE](NOTICE)); most of the rest are patterns we studied and reimplemented on our own terms. The optional cross-session semantic-memory layer is powered by [memem](https://github.com/TT-Wang/memem); local artifacts and recovery do not depend on it. With thanks to their authors.
+sliceagent's design was informed by two excellent open-source agents: **[Hermes Agent](https://github.com/NousResearch/hermes-agent)** (MIT) and **[Kimi Code](https://github.com/MoonshotAI/kimi-code)**. A few peripheral utilities are ported from Hermes (see [NOTICE](NOTICE)); most of the rest are patterns we studied and reimplemented on our own terms. [memem](https://github.com/TT-Wang/memem) provides primary semantic retrieval for SliceAgent-owned typed L2 knowledge when the memory extra is installed. Its value/primary-index/cue representation was also informed by Microsoft [Memora](https://github.com/microsoft/Memora) (MIT). Neither is another brain layer, and local artifacts and recovery do not depend on them. With thanks to their authors.
 
 ## Contact