docs: fix v0.19 test count (294→318), add Sprint 17 Tests section

…ch#32)

- Render ContextBar in chat screen (was imported but never placed)
- Pass sessionId to context-usage API for accurate token data
- Count all tokens (cached + uncached) for real context window usage
- Model-aware max tokens (200k for Claude, 128k for GPT)
- Return model name in context-usage response
- Remove header border-b (context bar replaces separator)
- Remove context bar own border-b for clean look
- Change dev server port from 3000 to 3002

Co-authored-by: outsourc-e <eric@outsourc.e>

…h#32)

Parses ACTION directives from agent responses and executes PR/issue
actions via Claude Code headless sessions with bot identity.

feat(webhook): NousResearch#32 headless CC invocation + routing fixes

)

When the WebUI's model picker sets the active provider to
"venice" (or "crof", "bankr", "cometapi"), the agent's
resolve_provider_client() looked up the slug in
PROVIDER_REGISTRY, failed to find it, and raised:

  "Provider 'venice' is set in config.yaml but no API key
   was found. Set the VENICE_API_KEY environment variable..."

VENICE_API_KEY WAS set in env — the failure was because
the agent had no idea which env var or base URL to use for
"venice" as a slug. PROVIDER_REGISTRY entries for the other
OpenAI-compatible aggregators (Z.AI, MiniMax, Mistral, etc.)
already existed; Venice/CrofAI/Bankr/CometAPI just hadn't
been added in the upstream code.

Adds four api_key-auth entries mirroring the existing
OpenAI-compat ones:
- venice → https://api.venice.ai/api/v1 + VENICE_API_KEY
- crof → https://crof.ai/v1 + CROF_API_KEY
- bankr → https://gateway.bankr.bot/v1 + BANKR_API_KEY
- cometapi → https://api.cometapi.com/v1 + COMETAPI_API_KEY

Companion to the WebUI side (PRs #26/#27/#29/#30/#32/#33)
which made these providers discoverable in the model picker
with their live /v1/models catalogs.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

…ink MCP call — closes D-kr3-st2

Fourth + final mechanical follow-on swap unlocked by K-10 + 0083
(IsoKron PM #32). Same pattern as KR-7 (chain-emit) and KR-8
(scratchpad-write): create_relationlink body replaces `raise
RelationLinkWriteNotAvailableError()` with
`await mcp_client.invoke('kora__create_relationlink', {...})`,
returning the substrate-assigned link_id. ~30 LOC across
relationlink.py + tools/iso_link.py + tests + docs.

All three KR-3 ST2 substrate blockers are now resolved substrate-side:
* actor_kind CHECK extended to include 'kora' via 0083 (prod-applied)
* public.kora_create_relationlink SECDEF function exists
* kora.relationlink.created event literal in event_log_event_type_check
  (300th literal in the set post-0083)
* kora__create_relationlink Sea MCP tool registered

Production-test posture per IsoKron PM #27:
* K-10's kora__create_relationlink handler is a notImplementedHandler
  stub on substrate main; substrate-team's dispatch tier (task NousResearch#395)
  un-stubs + bridges Layer-A wsk_* auth → Layer-B actor_kind='kora'.
* KR-9 code shape is sound; mock tests verify correctness.
* Production deploys wait on dispatch tier landing — identical
  posture to KR-7 / KR-7b / KR-8.

Verify-at-first-live-emit per spec § 3:
* event_log row with event_type = 'kora.relationlink.created'
* event_log.actor_id = 0076-seeded canonical Kora actor (NOT
  token-UUIDv5)
* relationlink row with chain_event_id matching the emitted event +
  created_by_actor_kind = 'kora'

relationlink.py:
* create_relationlink body: live call to mcp_client.invoke. K-10
  contract output: {'link_id': '<uuid>', 'chain_event_id': '<uuid>'}
  — projected to a plain str link_id return.
* mcp_client param now required (was Optional with deferred-error
  default).
* New rationale_block_id + evidence_block_ids params match K-10's
  input schema. Legacy `rationale` parameter preserved for one-
  release back-compat (silently dropped — superseded by
  rationale_block_id).
* Defensive: None mcp_client → ValueError; unexpected response shape
  → RuntimeError (mirrors KR-7/KR-8 pattern).
* RelationLinkWriteNotAvailableError class kept exported tagged
  [kora.isokron.deprecated] for one release. Original three-blocker
  message preserved inside the message body for grep stability.

tools/iso_link.py:_handle_iso_link_create:
* Dropped the deferred-envelope path. Success →
  {"ok": True, "link_id": <substrate-uuid>}. Substrate failure →
  {"ok": False, "substrate_error": True, "tool_name", "message"} —
  same structured signal shape as KR-8's iso_node_create.
* Fetches IsoKronMCPClient via get_mcp_client(); MCP-client-
  unavailable returns {"ok": False, "error": ...} envelope.
* Removed unused RelationLinkWriteNotAvailableError import.

Tests (7 new + 2 updated):
* test_iso_link_tools.py:
  - test_create_relationlink_raises_deferred_write_error →
    test_create_relationlink_invokes_kora__create_relationlink:
    happy path asserts spec-pinned arg shape (workspace_id,
    from/to entity_id + kind, link_type, evidence_block_ids=[]).
  - New test_create_relationlink_propagates_mcp_invocation_error
    (substrate active-edge uniqueness violation surfaces).
  - New test_create_relationlink_rejects_none_mcp_client.
  - New test_create_relationlink_rejects_unexpected_response_shape.
  - New test_create_relationlink_passes_rationale_block_id_when_present
    (optional args pass-through).
  - New test_relationlink_write_not_available_error_still_importable_post_kr9
    (deprecation runway).
  - test_iso_link_create_handler_returns_deferred_envelope →
    _returns_ok_envelope_with_substrate_link_id: success-envelope
    + verifies spec-pinned tool name in invoke recording.
  - New test_iso_link_create_handler_surfaces_substrate_error_envelope:
    IsoKronMCPInvocationError flips to structured envelope.
  - _FakeMcpClient routes by tool_name (returns link-N for
    kora__create_relationlink). _FakeProviderConnection gains
    get_mcp_client().

BUILD_DEVIATIONS:
* D-kr3-st2-no-relationlink-write-mcp-tool moved Open → Closed with
  Rule-5 spec-quote, call-site refactor inventory, production-test
  posture, all-three-blockers-resolved-substrate-side note,
  deprecation-runway note, verify-at-first-live-emit step.

README "Operator pitfalls":
* "Deferred-surface summary" table replaced with
  "All BUILD_DEVIATIONS closed code-side as of KR-9 (parallel-merged
  with KR-7b + KR-8)" note. All 5 deferral closures listed under
  Recently closed.
* Individual "iso_link_create writes are blocked" pitfall rewritten
  as "RelationLink writes route via kora__create_relationlink (KR-9)"
  with success/failure envelope shapes + operator grep pointer.

Parallel-mergeability note: KR-7b + KR-8 + KR-9 modify disjoint files
(KR-7b: capability_matrix_mirror.py + provider.initialize; KR-8:
scratchpad.py + provider sync_turn/on_memory_write; KR-9:
relationlink.py + tools/iso_link.py). Merge interleaves; each PR
narrows its E2E assertions to its own surface so test fixture
counts don't fight. PM handles README + BUILD_DEVIATIONS final
reconciliation on merge order.

Local gates:
* ty check — 7,337 diagnostics, zero-delta vs KR-7 baseline.
* pytest tests/plugins/memory/ — 357/357 passing.
* Full suite via xdist (-n auto): 24,629 / 181 failed / 12 errors /
  129 skipped. Same tests/tools/* xdist isolation noise as documented
  across prior PRs; none touch isokron.

After KR-9 + KR-7b + KR-8 merge, all four BUILD_DEVIATIONS are
closed code-side. Standing-by state becomes dispatch-tier-gated
(waiting on substrate-team task NousResearch#395 + service-token mint for
production deploys).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- path-to-regexp: 0.1.12 → 0.1.13 (CVE-2026-4867, GHSA-37ch-88jc-xwx2)
- picomatch: 2.3.1 → 2.3.2 (CVE-2026-33671, GHSA-c2c7-rcm5-vvqj)
- undici: 7.23.0 → 7.27.1 (CVE-2026-1526/CVE-2026-2229/CVE-2026-1528)
- serialize-javascript: 6.0.2 → 7.0.3 (GHSA-5c6j-r48x-rmvq, via overrides)

Fixes Dependabot alerts NousResearch#37, NousResearch#34, NousResearch#33, NousResearch#32, NousResearch#29, NousResearch#27

Adds two new completion gates that fire alongside the Part 1/2 gates.

Closes hermes-jarvis#63 (PR-existence verification)
Closes hermes-jarvis#32 (doc-drift check)
Context: hermes-jarvis#61 (bootstrap-paradox case study)

## NousResearch#63 — verify_pr_urls_exist

When a verdict result or summary contains a GitHub PR URL pattern,
the dispatcher runs `gh pr view <url> --json number` to verify each
URL resolves. Phantom URLs (404 with "Not Found" / "Could not
resolve" / "no pull request" in stderr) reject the completion.

Indeterminate cases (gh missing, network error, unauthenticated) fall
open — workers can still complete in offline / broken-gh envs without
being trapped.

Catches the 2026-06-09 Tchalla case (hermes-jarvis#61): release-gate
reviewer blocked with "cannot run gh pr diff 42" on PR NousResearch#42 that
didn't exist. With this gate, his completion would have surfaced the
phantom URL specifically, prompting him to surface the real cause.

Opt-out: `metadata.x_phantom_pr_ok` with ≥20-char string reason.

## NousResearch#32 — verify_doc_drift

For tasks whose tenant slug encodes a version
(`marvel-swarm-vN-N-test`), the gate scans `README.md` / `README` in
the workspace for older `vX.Y` mentions outside a history-style
heading (`## History`, `## Older versions`, `## Previous versions`,
`## Archive`). Stale mentions reject the completion.

CHANGELOG.md is intentionally skipped — older versions are expected
there by definition.

Catches the 2026-06-09 agent-dashboard PR #1 case (hermes-jarvis#61):
README still said "v6.2 Marvel swarm test target" while the chain
was v6.6. No reviewer flagged it.

Opt-out: `metadata.x_doc_drift_ok` with ≥20-char string reason.

## Tests

19 new tests added to `test_kanban_completion_gates.py`:
- TestPRExistence (8) — no PR URL skipped, real passes, phantom
  rejects, mixed real+phantom flags only phantom, indeterminate falls
  open, summary scanned, dedup, opt-out
- TestDocDrift (10) — non-versioned tenant skips, no README skips,
  stale README rejects, current README passes, History section
  excused, CHANGELOG file excused, higher version not stale, scratch
  skipped, opt-out

83 passed in test_kanban_completion_gates.py (up from 64). Zero
regressions on adjacent paths.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…earch#32)

- `verify_pr_urls_exist` (closes hermes-jarvis#63) — scans verdict
  text + summary for GitHub PR URLs and runs `gh pr view` per URL.
  Phantom URLs (404) reject; indeterminate (gh missing / network)
  falls open. Strict 404 classification excludes DNS/network token
  patterns so "could not resolve host" stays indeterminate.
- `verify_doc_drift` (closes hermes-jarvis#32) — for tasks whose
  tenant slug encodes a version (marvel-swarm-vN-N-test), scans
  README.md/README for older vX.Y mentions outside a history section.
  Depth-aware section-tracking so `## History\n### v6.2 details`
  correctly excuses the subsection.

Opt-outs: x_phantom_pr_ok / x_doc_drift_ok (≥20-char string reasons).

Context: hermes-jarvis#61.

90 tests pass after two self-review passes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>