OMK's provider-neutral coding-agent CLI also exposes a multi-agent control plane for explicitly configured workflows. The diagram describes that design, not what every prompt automatically runs.

The v0.98.3 SDK rejects incomplete first-party judge responses and exposes deterministic ties; it is not an automatic TUI judge.

1. Scope the goal, paths, resources, and acceptance predicates. A selected

1. Route work to models, agent skills, MCP tools, and extensions without

1. Verify declared checks in explicit evidence workflows. Required failing

1. Preserve receipts and replay state for bounded session recovery; continue

The animation changes once every 1.5 seconds and contains no flashing. The four steps above are the complete text alternative.

OMK keeps routing separate from control and evidence. Codex, Claude Code, OpenCode Zen/Go, Kimi, GLM/ZAI, native xAI/Grok, NVIDIA NIM, and local providers can participate through omk-ai while the run contract stays stable.

Native xai keeps subscription OAuth and XAI_API_KEY billing separate. See provider setup, provider resilience, and Grok integration.

Published packages

| Package | Purpose | | --- | --- | | open-multi-agent-kit | Interactive coding-agent CLI and control plane | | omk-agent-core | Agent runtime, tool execution, and DAG scheduling | | omk-ai | Unified multi-provider LLM API | | omk-protocol | Versioned run contracts and semantic reducers | | omk-adaptorch-wpl | Work Packet Loop runtime | | omk-book-to-skill | Optional document-to-skill compiler | | omk-tui | Differential-rendered terminal UI library |

npm install omk-agent-core
npm install omk-ai
npm install omk-protocol
omk install npm:[email protected]
npm install omk-tui

v0.97.0 shipped the OpenWiki policy and workflow, but no versioned corpus or integrity checker. The following integrity/output guards shipped in v0.98.0; the generated corpus remains optional and is not bundled:

• openwiki/ — absent. The previous untracked corpus was removed after the

• scripts/check-openwiki.mjs — shipped integrity checker. An interrupted corpus

• scripts/check-openwiki-output.mjs — output gate. The scheduled workflow

• .understand-anything/ — optional local structural graph used by Pi Lens;

Source and tests remain authoritative. Shipped guards do not turn a generated index into authority: treat corpus pages as local advisory data and recheck source.

Retrieval

A corpus no session can read is documentation of a plan, not a feature, so the pages are now candidates for prompt budgeting. Enable contextBudget.openwiki alongside contextBudget.enabled (settings) and each page becomes a low-priority evidence item ranked against the turn's query. Pages compete for leftover budget and can never displace instructions or skills; most turns carry titles and declared symbols alone, and a page's text arrives only when the query earns it.

Admission mirrors scripts/check-openwiki.mjs rather than restating it. A complete corpus at the current HEAD offers page text; one whose HEAD has moved offers titles only and is marked stale; an interrupted corpus is refused unless a review binds to its exact digest. The default is off, and with the setting off the prompt is byte-identical to one built without a corpus.

The design decisions behind OMK's context, routing, memory, and orchestration layers are grounded in published work rather than invented in isolation. Each row below was retrieved and read directly; claims are at abstract level, which is the evidence grade this table asserts and no more.

| Paper | Mechanism it establishes | OMK implementation or design reference | | --- | --- | --- | | arXiv:2608.22752 — The Compaction Cliff in Long-Running AI Agent Memory | Uniform summarization erodes rules and episodic logs at the same rate; measured safety-rule retention falls to 53% after one compaction and 10% after five. Type-tagged deterministic operators fix it. | Type-aware compaction triage: rule-typed items survive N rounds byte-identical | | arXiv:2608.23023 — Most of the LLM Routing Gap Is Task Type | Most routing gain is reachable with a fixed task-type table; run-to-run flips must not be credited as wins. | Frozen task-class table plus the 2-run stability rule in the promotion gate | | arXiv:2506.16655 — Arch-Router: Aligning LLM Routing with Human Preferences | Indirection: a classifier emits a label, a policy table maps label to decision, so models change without retraining. | classifyTaskV4 plus TASK_CLASS_THINKING_LEVELS | | arXiv:2605.09894 — Deterministic vs. LLM-Controlled Orchestration | Holding model, prompts, and tools constant and varying only execution control, deterministic orchestration matched accuracy, improved worst-case robustness, and cut tokens up to 3.5x. | Deterministic scheduler and planned lanes; execution control is never delegated to the model | | arXiv:2608.15565 — Admission Without Answers | Label-free admission on execution success alone admits substantial contamination; an accept/abstain/escalate decision is required. | Verified-memory admission design (spec 019), abstain is not stored | | arXiv:2608.23471 — InjecMEM: Memory Injection Attack on LLM Agent Memory Systems | Single-interaction memory injection is a reproduced attack frame against agent memory. | Retrieved memory is injected only as provenance-tagged data, never fused into instruction position |

Entries include implemented mechanisms and design proposals; check the runtime status guide for availability. The wider survey, including approaches not adopted, is working material that is not published with the repository.

Historical correction: the immutable v0.97.0 notes below announced a

versioned OpenWiki corpus, but that release still ignored /openwiki/ and did

not contain the corpus or checker. See the current repository-understanding

section above for the shipped guards and optional-corpus boundary.

Release v0.98.5

Added

• Added /debug runtime inspection, explicit metadata-only local reports with /debug save, and structured failure cards with expandable details. UI entry observations do not infer build revisions or authorize retries.
• Added opt-in verified-run CLI/SDK paths with protected verification, immutable candidate recovery, input-checkpoint writer restart, and static DAG task retry. These paths retain approval, ownership and budget boundaries; they do not apply artifacts to the original workspace automatically.

Fixed

• Strengthened execution ownership and shared-budget boundaries. Pre-commit checks preserve the selected index, including partially staged files, instead of expanding the commit.
• Execution-ownership wrappers retain lazy, context-sensitive tool timeouts and stale-context rejection instead of fixing the timeout at registration.

Release v0.98.4

New Features

• DeepSeek V4.1 Flash on four existing providers with off/low/high/max thinking; see catalog details.
• Opt-in CLI/SDK model dispatch contracts; see contract scope.
• Bounded claim-repair explanations and stronger metrics/policy boundaries; see review evidence.

Added

• Added --model-contract and SDK contract options, including first-party summaries through the shared provider stream. These are not universal billing or endpoint attestations.
• Added Muse Code login/native Meta models, explicit provider synchronization and context-initialization workflows, active-skill state/selection, and improved MCP startup diagnostics.
• Added offline TB subset selection and recorded-result audit utilities. They do not resume a benchmark or prove comparative harness gains.
• Added optional AdaptOrch service links; displaying links does not create an account, upload source, or start a run.

Fixed

• New metrics records use schema v2, explicit field projection and bounded error classes instead of raw error text. Valid v1 records remain readable; old files are not scrubbed automatically.
• Empty, sparse or mutated gate lists cannot bypass merge validation. Sandbox overrides cannot silently weaken enforcement or expand the filesystem root without explicit trusted broadening.
• Shared-DAG repair explanations retain shared repairs and local counterexamples, report bounded-search fallback as not-proven, and offer opt-in explicit witness groups. Neither explanations nor group labels authorize execution.
• Model-contract denials are configuration failures. Text and JSON print modes return nonzero on final prompt failure rather than silently reporting success.
• Improved compaction overflow guards, active-skill bookkeeping, provider resilience/usage handling, and login-provider resolution.
• Reject non-finite tokenizer results, fall back for non-finite token estimates, and keep optional-context sorting a total order. Domain routing now treats repeated whitespace and line breaks consistently.
• Preserve recognized environment references, placeholders and nearby type declarations during credential redaction without exempting literal credentials. Forced persistence/report redaction remains active regardless of input opt-out switches.
• Improved clipboard-image handling on WSL and terminal file-link rendering, including safe link destinations and malformed MCP tool-schema handling.

Changed

• Split type, schema and rendering responsibilities to restore module-size gates without raising their baselines. Browser smoke builds no longer require a Node path polyfill for Codex metadata.

Release v0.98.3

Added

• Advisory-selection diagnostics now retain submitted/eligible/excluded counts, comparison availability, and top-score tie/margin data. Ties preserve caller rank while reporting judge-tied / deterministic; no correctness probability or default TUI judge is introduced.
• Claim-closure-to-WPL/VERA projection is tested across the public protocol and integration packages. It classifies supplied evidence and never grants release authority.
• A session workspace scope now reports what it could not bind. resolveSessionWorkspaceScope() drops dirty paths two ways — a 32-path cap and the normalized-path filter the receipt parser forces — and both were silent, so a receipt captured from a partial view of the working tree read exactly like one that saw all of it. The new resolveSessionWorkspaceScopeReport(cwd, options?) returns the same scope plus totalDirtyPathCount, selectedPathCount, excludedPathCount, truncated, a completeness of complete / partial_truncated / partial_excluded / unavailable, and an excludedPathSetSha256 binding the dropped set. SessionBashRuntime.workspaceScopeReport() exposes it for the current session. unavailable is deliberately not complete: outside a worktree nothing was enumerated, so an empty artifact set is an absence of evidence rather than a clean tree. Dropping paths stays deliberate; hiding the drop was the defect. The scope cache is now keyed by (cwd, maxPaths) so a capped probe cannot serve a later full request its truncated answer.

Fixed

• The first-party advisory model adapter now requires an explicit normal stop; complete score JSON from a truncated, aborted or missing completion state cannot override deterministic fallback. Cancellation before and after custom/model judge work prevents new calls and discards late advice, without additional completion calls or retries.
• Release documentation now separates internal trace/effect primitives from public opt-in APIs and records the existing CI token-authentication path without claiming OIDC provenance. The published v0.98.2 history is retained as an ancestor rather than re-created.