Add nativegen provider adapter and factory wiring

Taskfile.yml

@@ -94,33 +94,9 @@ tasks:
       - bash {{.SCRIPTS_DIR}}/repo-snapshot-lock.sh read -- go build -tags=paintedwolf_release ./...
 
   build:lycaon-dev:
-    desc: Build lycaon-dev + sibling pw-logs, bialy, and pw-document-core — local den:sidecar + stable @self MCP (not go run)
+    desc: Build the development host and its document, decision, and generation runtimes
     dir: '{{.GO_DIR}}'
-    sources:
-      - '**/*.go'
-      - 'internal/harnessfixture/contract.json'
-      - 'internal/documentcore/native/src/**/*.rs'
-      - internal/documentcore/native/Cargo.toml
-      - internal/documentcore/native/Cargo.lock
-      - '../scripts/build-document-core.sh'
-      - 'internal/db/*.sql'
-      - 'internal/db/released-baselines.json'
-      - 'internal/backup/archive-limits.json'
-      - 'config/**/*'
-      - go.mod
-      - go.sum
-      - '../VERSION'
-      - '../scripts/sign-dev-binary.sh'
-      - '../scripts/dev-signing-config.sh'
-      - '../scripts/build-dev-engine.sh'
-      - '../scripts/resolve-opengrep.sh'
-      - '../scripts/stage-bundled-opengrep.sh'
-    generates:
-      - '{{.BUILD_DIR}}/lycaon-dev'
-      - '{{.BUILD_DIR}}/pw-logs'
-      - '{{.BUILD_DIR}}/pw-document-core'
-    status:
-      - env -u LYCAON_OPENGREP_CANDIDATE '{{.BUILD_DIR}}/lycaon-dev' scan engines verify-bundled --root {{.ROOT_DIR}}/lycaon-den/src-tauri/engine-root >/dev/null
+    # Seed paths and signing inputs are selected outside the source tree.
     cmds:
       - bash {{.SCRIPTS_DIR}}/build-dev-engine.sh
 
@@ -687,22 +663,27 @@ tasks:
   generation:prepare:
     desc: Prepare pinned generation runtime dependencies or prototype artifacts
     cmds:
-      - python3 {{.SCRIPTS_DIR}}/generation/runtime.py prepare {{.CLI_ARGS}}
+      - bash {{.SCRIPTS_DIR}}/generation/run.sh prepare {{.CLI_ARGS}}
 
   generation:build:
     desc: Build a native generation runtime candidate
     cmds:
-      - python3 {{.SCRIPTS_DIR}}/generation/runtime.py build {{.CLI_ARGS}}
+      - bash {{.SCRIPTS_DIR}}/generation/run.sh build {{.CLI_ARGS}}
 
   generation:test:
     desc: Run fixture-only generation runtime tests
     cmds:
-      - python3 {{.SCRIPTS_DIR}}/generation/runtime.py test {{.CLI_ARGS}}
+      - bash {{.SCRIPTS_DIR}}/generation/run.sh test {{.CLI_ARGS}}
 
   generation:bench:
     desc: Measure an explicitly selected local prototype model
     cmds:
-      - python3 {{.SCRIPTS_DIR}}/generation/runtime.py bench {{.CLI_ARGS}}
+      - bash {{.SCRIPTS_DIR}}/generation/run.sh bench {{.CLI_ARGS}}
+
+  decide:prepare:
+    desc: Fetch pinned Bialy dependencies or refresh its workspace lockfile
+    cmds:
+      - python3 {{.SCRIPTS_DIR}}/toolchain/decide_prepare.py {{.CLI_ARGS}}
 
   decide:test:
     desc: Decision engine (bialy) Rust tests

docs/compatibility.md

@@ -229,6 +229,8 @@ Responses remain additive-friendly: Den ignores unknown properties. Request obje
 
 The Linux launch broker's descriptor-slot layout is co-shipped native `bundle` wire, not persisted state or agent vocabulary. Its optional layout preserves explicitly closed inherited slots across descriptor transport; an omitted layout keeps all supplied slots open. The engine relay and broker move together, with validation and actual-child descriptor invariants covering both sides. No store migration or OpenAPI consumer changes are involved.
 
+The packaged `generation/vulkan-drivers.json` resource is co-shipped internal `bundle` data. Format 1 declares the closure's Mesa ICD paths. The inference host validates the exact shape and prepares process-local NVIDIA driver selection when needed. Its temporary ICD files are ephemeral and remain alive until their reader process exits; they contain no device settings or model state.
+
 Health reports product, store, and schema revisions as distinct facts. Product SemVer does not stand in for the database schema version, and the Den cache revision does not stand in for either.
 
 ## User-repository overlays
@@ -355,6 +357,12 @@ Free-form display copy is not agent-public vocabulary. The structured id behind
 
 Provider credentials, device model policy, extension desired state, exact grants, and application state are not contained in `store.db`. Deleting the database must not silently erase or reinterpret them.
 
+Local model activation history and device selection are device configuration; the authenticated payload bytes are reacquirable content. Model-store journal format 1 authenticates each revision with host-trusted Ed25519 keys. A revision identity cannot be rebound to different contents, and collection or repair cannot remove a revision while a runtime holds its lease. Database deletion does not reset model activation or trust.
+
+A local model bundle contains `manifest.json` and explicitly named payload files. The manifest is bounded to 128 KiB and rejects unknown fields and trailing content. Its signature covers the `paintedwolf-model-manifest/1` domain and the canonical `SigningBytes` representation. The bundle supplies a key identifier, never a new trust authority. Import verifies that signature before opening payloads, then checks each declared size and SHA-256 before activation. Payload names are single safe path components; `manifest.json` is reserved. Activated revisions hard-link verified content inside the store, avoiding a second model copy. Importing a valid bundle establishes artifact integrity, not runtime compatibility or model quality. Published payloads are read-only. Routine lease and readiness checks inspect the revision seal, size, and modification time without scanning model contents. A lease audit hashes the actual pinned revision, detects same-size corruption even with unchanged timestamps, and supports cancellation. Repair replaces damaged inodes only after readers release their leases.
+
+The model release-key registry is a co-versioned application resource, separate from downloaded model bundles and mutable device state. Format 1 contains `format: 1` and a `keys` array of `{id, public_key}` entries, where each public key is a base64-encoded Ed25519 key. The decoder bounds the registry to 16 KiB and 16 distinct keys and refuses unknown fields, formats and trailing content. Key rotation ships through the trusted application distribution.
+
 The host identity key (`host-identity.pem`) is device configuration too. A store reset keeps it, and backups neither carry nor restore it: a backup restored on another machine becomes a new host with the same people. An unreadable key stops startup rather than silently minting a new identity. The people who author durable facts live in `store.db` and travel with it.
 
 Native update preferences are device configuration too. The unversioned `{checks_enabled, channel, rollout_bucket}` record that 1.0.x clients wrote has one explicit migration to `updates/preferences.json` format 2: `checks_enabled` becomes `automatic_updates_enabled`, which governs discovery, background download, and lifecycle installation, so an existing opt-out remains off; channel and bucket are unchanged. Unknown versions and malformed records are refused without overwriting them. Per-installation operational records live under `updates/installations/<path-sha256>/`, keyed by the canonical application path, and the device-wide `updates/feed-state.json` records the newest signed pointer timestamp accepted per feed. Unknown ephemeral records (`ready.json`, `rejected.json`, `feed-state.json`) are quarantined unchanged and rebuilt; an unreadable preference file disables automatic updating for that run without being rewritten. Update archives are ephemeral, but an unresolved activation journal is recovery-critical operational state and cannot be cleared as a cache. An `update-state.json` journal written by a 1.0.x client is reconciled against the running product version: it completes only when its target or a newer version runs, and it never manufactures staged bytes or missing artifacts.

docs/dev-tasks.md

@@ -687,6 +687,7 @@ Gate composition lives in `scripts/verification-plan.json`.
 | `db:wipe` | Clears the store and every store-keyed host tree; preserves Den app preferences, device configuration, credentials, debug captures, and upgrade recovery archives. Refuses while any process holds the store open — stop the engine first |
 | `budgets` / `coverage:changes` / `den:coverage:changes` / `scripts:coverage:changes` | Hold what a change touches to its limits and test the statements it adds; warnings arrive before the limit, and `PW_BUDGETS_INSPECT="<path>"` shows a file or directory's standing before editing it. `scripts:coverage:changes` shares the `runner` resource with `test:runner` and installs the pinned coverage.py once per interpreter under the [bin directory](#build-outputs-caches-and-locks); `./task setup-dev -- --ci-inputs` provisions it before an offline CI lane. See [Size budgets and changed coverage](test-strategy.md#size-budgets-and-changed-coverage) |
 | `check:coverage` / `check:coverage:packages` | `check:coverage` produces aggregate and package reports from one test run. Floors come from `scripts/coverage-policy.json`: `COVERAGE_MIN` overrides the aggregate floor; the per-package report is advisory until `COVERAGE_PKG_ENFORCE=1`, with `COVERAGE_PKG_MIN` overriding its floor and exemptions in `lycaon/coverage-exempt.txt`. Floors must be finite percentages from 0 through 100; fractional floors are compared without truncation. Go and Den coverage runs use the digest runners and retain failure diagnostics |
+| `decide:prepare` | Fetch Bialy dependencies with the existing lockfile. Pass `-- --refresh-lock` to resolve changed workspace features while retaining pinned dependency versions, then fetch the resulting locked graph. Review and commit the lockfile before building. |
 | `build:decide` / `decide:test` | Build and test `bialy` with the host's features (`scripts/decide-features.sh`: `mlx` on Apple silicon, `vulkan` on Linux). On Linux, `decide:test` runs the Vulkan parity tests on the first GPU, or on Mesa's lavapipe (`mesa-vulkan-drivers`) without one. The first MLX build compiles the framework from source: several minutes, a network fetch, and Xcode's Metal toolchain (`xcodebuild -downloadComponent MetalToolchain` when the build cannot execute `metal`). Development builds stage heads installed under `$(python3 scripts/artifact_paths.py bin .)/decide-heads/`; the dev sidecar provisions the checkpoint at its first boot |
 | `build:document-core` | Builds `pw-document-core` for this host into the shared, content-addressed cache and prints its path. Go and Vitest digests, fuzz, and benchmark runs call it themselves and export `LYCAON_DOCUMENT_CORE_BINARY`, so editor tests always run the core built from the source they test; `build:lycaon-dev` stages a copy beside `lycaon-dev` |
 | `den:stage-engine` | Stages the sidecar and engine-root a desktop Playwright run expects. `e2e:den:desktop` does **not** stage for you — the release workflow runs `den:stage-engine` immediately before it, and a local reproduction without it fails on a missing engine |
@@ -696,6 +697,13 @@ Gate composition lives in `scripts/verification-plan.json`.
 | `upgrade:corpus:prepare` / `upgrade:corpus:boot` | `prepare` writes an immutable fixture under `lycaon/testdata/upgrade-corpus/<VERSION>/` that you **review and commit with the candidate**; the release workflow uploads that reviewed tree rather than minting evidence after the tag. `boot` proves the committed fixtures locally |
 | `openapi:diff` | Report wire differences against the committed baseline, or `-- --baseline-ref <commit>` for a pinned stable release. Release CI retains the report automatically; permitted bundle differences succeed and tool failures block release |
 
+The `budgets` artifact directory also contains `reports/native-requests/*.json`.
+These complete static request fixtures use the existing rendered coordinator
+cases, coordinator injection blocks and all tools available on each surface.
+They contain no captured conversation history and are not a normal turn's
+selected tool set. Use them for explicitly authorized native-runner prompt
+measurements; record native token counts separately from budget estimates.
+
 ### Protected Linux desktop component
 
 `./task test:confine:linux -- launch` tests the real launcher with its reporting

docs/openapi.yaml

@@ -10045,6 +10045,38 @@ paths:
           $ref: '#/components/responses/TooManyRequests'
         default:
           $ref: '#/components/responses/Error'
+  /v1/providers/{provider_id}/repair:
+    post:
+      tags:
+        - providers
+      operationId: repairLocalGeneration
+      x-person-action: record
+      summary: Repair the bundled local generation model
+      description: Releases the generation reader, restores the authenticated packaged revision, and attempts admission. Failed attempts return their current recovery state.
+      parameters:
+        - name: provider_id
+          in: path
+          required: true
+          schema:
+            type: string
+            pattern: ^[a-zA-Z0-9_.-]+$
+      responses:
+        '200':
+          description: Repair attempt completed
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/LocalGenerationRepairResult'
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '429':
+          $ref: '#/components/responses/TooManyRequests'
+        default:
+          $ref: '#/components/responses/Error'
   /v1/providers/{provider_id}/refresh:
     post:
       tags:
@@ -23324,7 +23356,7 @@ components:
         configured:
           type: boolean
           description: |
-            True when the provider can make API calls. Keyed AI providers require a non-empty credential saved via PUT /v1/providers/{provider_id}/credential (environment variables do not configure). Local keyless providers are ready without credentials; ambient providers must resolve their declared credential chain. List membership is providers.local.yaml — Den does not keep a parallel hide allowlist.
+            True when the provider can make API calls. Keyed AI providers require a non-empty credential saved via PUT /v1/providers/{provider_id}/credential (environment variables do not configure). Keyless providers need no credentials; bundled local generation also requires host admission. Ambient providers must resolve their declared credential chain. List membership is providers.local.yaml — Den does not keep a parallel hide allowlist.
         credential_present:
           type: boolean
           description: True when credentials are saved for this provider instance.
@@ -23391,6 +23423,9 @@ components:
             - stale
             - unavailable
           description: models.dev document freshness for catalog merge.
+        local_runtime:
+          x-go-pointer: true
+          $ref: '#/components/schemas/LocalGenerationStatus'
         discovery_status:
           type: string
           enum:
@@ -37179,6 +37214,44 @@ components:
           type: integer
           format: int64
           description: Estimated USD overage in nano-USD for usage above the included daily allowance when applicable.
+    LocalGenerationStatus:
+      x-go-generate: true
+      type: object
+      required:
+        - state
+        - recovery_action
+      additionalProperties: false
+      properties:
+        state:
+          type: string
+          enum:
+            - idle
+            - loading
+            - ready
+            - repairing
+            - unavailable
+            - repair_required
+            - insufficient_memory
+            - stopped
+          description: Current host runtime state, independent of cached model discovery.
+        recovery_action:
+          type: string
+          enum:
+            - none
+            - retry
+            - repair
+            - reinstall
+          description: Available recovery action selected from host facts.
+        detail:
+          type: string
+          description: Diagnostic detail; recovery_action supplies the available action.
+        revision:
+          type: string
+          description: Authenticated revision held by the admitted model process.
+        context_tokens:
+          type: integer
+          minimum: 0
+          description: Admitted context capacity of the ready process.
     ProviderListResponse:
       x-go-generate: true
       type: object
@@ -37265,6 +37338,19 @@ components:
           type: array
           items:
             $ref: '#/components/schemas/ProviderKindTemplate'
+    LocalGenerationRepairResult:
+      x-go-generate: true
+      type: object
+      required:
+        - ok
+        - status
+      additionalProperties: false
+      properties:
+        ok:
+          x-go-name: OK
+          type: boolean
+        status:
+          $ref: '#/components/schemas/LocalGenerationStatus'
     WebResearchProviderRole:
       type: string
       enum:

docs/openapi/components/schemas/settings/local-runtime.yaml

@@ -0,0 +1,37 @@
+components:
+  schemas:
+    LocalGenerationStatus:
+      x-go-generate: true
+      type: object
+      required: [state, recovery_action]
+      additionalProperties: false
+      properties:
+        state:
+          type: string
+          enum: [idle, loading, ready, repairing, unavailable, repair_required, insufficient_memory, stopped]
+          description: Current host runtime state, independent of cached model discovery.
+        recovery_action:
+          type: string
+          enum: [none, retry, repair, reinstall]
+          description: Available recovery action selected from host facts.
+        detail:
+          type: string
+          description: Diagnostic detail; recovery_action supplies the available action.
+        revision:
+          type: string
+          description: Authenticated revision held by the admitted model process.
+        context_tokens:
+          type: integer
+          minimum: 0
+          description: Admitted context capacity of the ready process.
+    LocalGenerationRepairResult:
+      x-go-generate: true
+      type: object
+      required: [ok, status]
+      additionalProperties: false
+      properties:
+        ok:
+          x-go-name: OK
+          type: boolean
+        status:
+          $ref: '#/components/schemas/LocalGenerationStatus'

docs/openapi/components/schemas/settings/providers.yaml

@@ -33,8 +33,8 @@ components:
           description: >
             True when the provider can make API calls. Keyed AI providers require a
             non-empty credential saved via PUT /v1/providers/{provider_id}/credential
-            (environment variables do not configure). Local keyless providers are
-            ready without credentials; ambient providers must resolve their declared
+            (environment variables do not configure). Keyless providers need no credentials; bundled local generation also
+            requires host admission. Ambient providers must resolve their declared
             credential chain. List membership is providers.local.yaml —
             Den does not keep a parallel hide allowlist.
         credential_present:
@@ -120,6 +120,9 @@ components:
           - stale
           - unavailable
           description: models.dev document freshness for catalog merge.
+        local_runtime:
+          x-go-pointer: true
+          $ref: local-runtime.yaml#/components/schemas/LocalGenerationStatus
         discovery_status:
           type: string
           enum: