auth chain hardening — scoped keys, revoke, fail-fast
The standalone Analyze auth chain now mints scoped keys, revokes them on terminal state, and fails fast on clone-auth 403.
The standalone Analyze auth chain now mints scoped keys, revokes them on terminal state, and fails fast on clone-auth 403.
khaos-tools recover now consults .khaos/manifest.json before dispatching anything.
khaos-tools pin advances d06bbb62 to d65ea0d3; brings firstpassrefreshbaseline.go into the workspace; closes auth-chain hardening arc across 8 PRs.
MergeJourney lands as step 4 of 5; single-chunk path is deterministic projection; multi-chunk synthesis retries once on evidence hallucination.
per-chunk LLM synthesis with artifact persistence lands as step 3 of 5; evidence-hallucination is a hard-error with retry-once.
429 responses carry Retry-After header and retry_after_seconds body field; integer-ceiling math, no math.Ceil.
new POST endpoint triggers first-pass baseline refresh; 202/409/404/401 cases fully covered across 14 handler tests.
design-only deliverable: act-based map-reduce primary, scene-window fallback; significance-threshold disqualified; StageIsIdempotent(StageCoverage) remains false.
structured failure block with recover endpoint, concurrent entity dispatch, job-scoped auth, and five Lambda infra fixes — the first-pass chain is operationally solid.
14 PRs in one drain: co-appearance graph, relationship synthesis, dialogue sampling, journey chunking, and character context assembly — the full story intelligence arc.

first-pass workflow auto-triggers on seed, stage advance machinery, API keys backend, model routing by provider prefix, and chain-stall watchdog.
native Khaos Machine storage spec locked; Go confirmed as backend language; khaos-tools-api TDD rewrite ships 86.8% coverage.
DDB+SQS async job engine, WebSocket signal channel for live job events, sequential scene fan-out with prior-scene context continuity.
khaos-tools parser ships as a stateless Lambda at api.preview.khaosmachine.com. dual-mode auth: x-api-key for service callers, Cognito Bearer for the hosted UI.
Asset preview viewers ship in khaosstorage while khaos-tools starts a Fountain parser compliance run for sections, notes, synopses, boneyard, and character-cue rules.
forced-scene-heading Fountain parser fix and kspd write info partial-update subcommand ship the same day.
coverage report pipeline complete: prompt, assembler, freshness check, file-lock, and token-budget estimator all ship.
parser catches scene headings without INT./EXT. prefix; consolidation state persists to disk.
SQLite migrated to pure-Go driver then removed entirely; MemoryStorage and StoryMutator replace it; CGO eliminated from macOS and Linux matrices.
52 SQLite/CGO test failures resolved in khaos-tools; WFL IPC v1 compliance check ships; eliminate-sqlite spec closed.
khaos-tools now parses Final Draft .fdx and Storyist .sbx formats in addition to Fountain.
cyclomatic complexity brought under 20 across all packages, encoding/json replaced with jsonx, and the analysis loop closed with output verification.
indexes.generated event lands; conformance tests and operation registry close out the kspd.events.v1 surface.
scene IDs now stable across re-runs; analysis path layout flattened; composition-events extraction and migration enrichment begin.
LM Studio added as a local-model provider; batch analysis now emits structured NDJSON progress events.
khaos-tools analysis passes 12/12 scenes with Anthropic structured output after four root-cause fixes.
kspd.events.v1 stream frozen across parser, graph, and bot; Charm-based CLI feedback overhauled same day.
khaos-tools gains an update-check and self-install update flow; jsonx adapter piloted across CLI, parser, and graph.
four LLM providers now available in khaos-tools; unified ProviderFactory centralizes retry and adapter registration.
TypeID factory for stable scn_/chr_/loc_ IDs, prompt registry replacing hardcoded builders, and real OpenAI API integration with bot audit trail.