avksp · avksp · Aug 9, 2026 · Aug 9, 2026
diff --git a/.agents/plugins/marketplace.json b/.agents/plugins/marketplace.json
@@ -9,7 +9,7 @@
       "source": {
         "source": "url",
         "url": "https://github.com/avksp/agent-lifecycle-kit.git",
-        "ref": "v1.52.0"
+        "ref": "v1.53.0"
       },
       "policy": {
         "installation": "AVAILABLE",

diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
@@ -9,10 +9,10 @@
       "source": {
         "source": "github",
         "repo": "avksp/agent-lifecycle-kit",
-        "ref": "v1.52.0"
+        "ref": "v1.53.0"
       },
       "description": "Reviewed SDD planning, budgeted execution, adapter conformance, implementation audit, and final proof.",
-      "version": "1.52.0",
+      "version": "1.53.0",
       "author": {
         "name": "Agent Lifecycle Kit contributors"
       },

diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "agent-lifecycle-kit",
-  "version": "1.52.0",
+  "version": "1.53.0",
   "description": "Provider-neutral lifecycle kit for reviewed SDD planning, budgeted execution, adapter conformance, independent audits, and final proof.",
   "author": {
     "name": "Agent Lifecycle Kit contributors"

diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "agent-lifecycle-kit",
-  "version": "1.52.0",
+  "version": "1.53.0",
   "description": "Provider-neutral lifecycle kit for reviewed SDD planning, budgeted execution, adapter conformance, independent audits, and final proof.",
   "author": {
     "name": "Agent Lifecycle Kit contributors",

diff --git a/.cursor-plugin/marketplace.json b/.cursor-plugin/marketplace.json
@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "Provider-neutral lifecycle kit for reviewed SDD planning, budgeted execution, adapter conformance, independent audits, and final proof.",
-    "version": "1.52.0"
+    "version": "1.53.0"
   },
   "plugins": [
     {
       "name": "agent-lifecycle-kit",
       "source": ".",
       "description": "Reviewed SDD planning, budgeted execution, adapter conformance, implementation audit, and final proof.",
-      "version": "1.52.0",
+      "version": "1.53.0",
       "author": {
         "name": "Agent Lifecycle Kit contributors"
       },

diff --git a/.cursor-plugin/plugin.json b/.cursor-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "agent-lifecycle-kit",
-  "version": "1.52.0",
+  "version": "1.53.0",
   "description": "Provider-neutral lifecycle kit for reviewed SDD planning, budgeted execution, adapter conformance, independent audits, and final proof.",
   "author": {
     "name": "Agent Lifecycle Kit contributors"

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,19 @@
 
 - No changes yet.
 
+## 1.53.0 - 2026-08-09
+
+- Added deterministic risk-aware execution profiles that derive a
+  provider-neutral model route and token, invocation, and wall-time caps from a
+  frozen S0/S1/S2 plan without model, network, or host calls.
+- Added a read-only `start --risk --risk-profile-out` projection followed by
+  explicit `workflow task-start --risk-profile` authorization with strict run,
+  plan, task, source, operation, adapter, route, and digest lineage.
+- Added fail-closed host usage checks for billable tokens, invocations, and wall
+  time, while preserving advisory-only risk recommendations for raw task input.
+- Added English and Russian operator guidance and updated package, plugin,
+  marketplace, and quickstart publication metadata to `1.53.0`.
+
 ## 1.52.0 - 2026-08-09
 
 - Added `agent-lifecycle start` as one beginner-facing command for task text,

diff --git a/README.md b/README.md
@@ -30,7 +30,7 @@ agent-lifecycle start --adapter codex --text "Draft a reviewed implementation pl
 ```
 
 The official [PyPI package](https://pypi.org/project/agent-lifecycle-kit/) supports Python 3.11-3.14.
-Install the exact release with `python -m pip install agent-lifecycle-kit==1.52.0`.
+Install the exact release with `python -m pip install agent-lifecycle-kit==1.53.0`.
 
 For a short walkthrough, use [Quickstart](docs/guides/quickstart.md) and the [Lifecycle cookbook](docs/guides/lifecycle-cookbook.md). For structure and positioning, see [System architecture](docs/architecture/system-architecture.md) and [Project comparison](docs/reference/project-comparison.md). Russian documentation starts at [Документация на русском](docs/ru/README.md).
 

diff --git a/adapters/claude/.claude-plugin/plugin.json b/adapters/claude/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "agent-lifecycle-kit",
-  "version": "1.52.0",
+  "version": "1.53.0",
   "description": "Lifecycle skills and adapter metadata for reviewed planning, budgeted execution, adapter conformance, audit, and final proof.",
   "author": {
     "name": "Agent Lifecycle Kit contributors"

diff --git a/adapters/codex/.codex-plugin/plugin.json b/adapters/codex/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "agent-lifecycle-kit",
-  "version": "1.52.0",
+  "version": "1.53.0",
   "description": "Provider-neutral lifecycle kit and adapter metadata for reviewed planning, budgeted execution, adapter conformance, audit, and final proof.",
   "author": {
     "name": "Agent Lifecycle Kit contributors"

diff --git a/adapters/cursor/.cursor-plugin/plugin.json b/adapters/cursor/.cursor-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "agent-lifecycle-kit",
-  "version": "1.52.0",
+  "version": "1.53.0",
   "description": "Agent lifecycle planning, budgeted execution, adapter conformance, audit, and final proof for Cursor.",
   "author": {
     "name": "Agent Lifecycle Kit contributors"

diff --git a/docs/README.md b/docs/README.md
@@ -14,7 +14,7 @@ project.
 ## Quick start
 
 - Official PyPI package for Python 3.11-3.14:
-  `python -m pip install agent-lifecycle-kit==1.52.0` from
+  `python -m pip install agent-lifecycle-kit==1.53.0` from
   [agent-lifecycle-kit](https://pypi.org/project/agent-lifecycle-kit/).
 - One safe entrypoint: `agent-lifecycle start --adapter codex --file task.md`.
 - [Quickstart](guides/quickstart.md)

diff --git a/docs/guides/lifecycle-cookbook.md b/docs/guides/lifecycle-cookbook.md
@@ -17,6 +17,7 @@ execution.
 | Find or fix a bug | [Bug Forensics repair](#bug-forensics-repair) | No, after a frozen plan authorizes repair |
 | Ask several reviewers | [Coordinate cross-review](#coordinate-cross-review) | Yes, unless a frozen plan requires quorum |
 | Inspect an active run | [View goal and progress](#view-goal-and-progress) | Yes |
+| Start a frozen task with bounded resources | [Run a risk-aware task](#run-a-risk-aware-task) | No, it authorizes one task attempt |
 
 ## Research and planning only
 
@@ -125,6 +126,45 @@ responsibilities first, then review the diff against that recovered map.
 
 Full examples are in [Code review workflows](code-review-workflows.md).
 
+## Run a risk-aware task
+
+Use this only after the plan is reviewed and frozen. First project the exact
+profile without mutating workflow state:
+
+```bash
+agent-lifecycle start \
+  --adapter codex \
+  --mode implement \
+  --risk auto \
+  --file tasks/my-release/plan.manifest.json \
+  --state work/my-release/run.state.json \
+  --lock tasks/my-release/plan.lock.json \
+  --task WS-01 \
+  --operation-id start-WS-01-attempt-1 \
+  --expected-revision 3 \
+  --source-revision "$(git rev-parse HEAD)" \
+  --host-model-profile profiles/hosts/codex-live-profile.v1.json \
+  --risk-profile-out work/my-release/WS-01/risk-profile.json
+```
+
+Then authorize the attempt with the same operation id:
+
+```bash
+agent-lifecycle workflow task-start \
+  --state work/my-release/run.state.json \
+  --task WS-01 \
+  --operation-id start-WS-01-attempt-1 \
+  --expected-revision 3 \
+  --source-revision "$(git rev-parse HEAD)" \
+  --risk-profile work/my-release/WS-01/risk-profile.json \
+  --reason "start risk-aware attempt"
+```
+
+The host must later attest tokens, invocation count and wall time. Any missing,
+estimated, lineage-drifted or over-cap value blocks the result transition. See
+[Risk-aware execution](../reference/risk-aware-execution.md) for all inputs and
+failure rules.
+
 ## Audit implementation evidence
 
 Use implementation audit after a worker has produced a task result and review:

diff --git a/docs/guides/quickstart.md b/docs/guides/quickstart.md
@@ -28,7 +28,7 @@ supports Python 3.11-3.14. When the package is available for the requested
 version, install the exact semantic version:
 
 ```bash
-python -m pip install agent-lifecycle-kit==1.52.0
+python -m pip install agent-lifecycle-kit==1.53.0
 agent-lifecycle version
 ```
 
@@ -133,6 +133,13 @@ agent-lifecycle start \
   --file work/run/adapter-run-request.json
 ```
 
+For a frozen task, add `--risk auto` to derive a provider-neutral model route
+and resource caps. The read-only start step writes the exact profile with
+`--risk-profile-out`; authorize it separately with `workflow task-start
+--risk-profile`. See [Risk-aware execution](../reference/risk-aware-execution.md)
+for the complete sequence. On raw text or Markdown, `--risk` remains advisory
+and never authorizes implementation.
+
 To resume a session recorded by ALK:
 
 ```bash

diff --git a/docs/reference/cli.md b/docs/reference/cli.md
@@ -10,7 +10,7 @@ Python 3.11-3.14 is supported. Install the exact release from the official
 [PyPI project](https://pypi.org/project/agent-lifecycle-kit/):
 
 ```bash
-python -m pip install agent-lifecycle-kit==1.52.0
+python -m pip install agent-lifecycle-kit==1.53.0
 ```
 
 ## Foundation

diff --git a/docs/reference/managed-adapter-sessions.md b/docs/reference/managed-adapter-sessions.md
@@ -74,6 +74,20 @@ ALK-managed paths. JSON stdout remains stable. Use `--progress-hook off` to
 suppress terminal output, or `--progress-hook receipt --progress-receipt <path>`
 to persist `agent-progress-hook-receipt.v1`.
 
+## Risk-aware managed execution
+
+For a frozen S1/S2 task, `start --risk auto` can derive a provider-neutral
+model route and token, invocation, and wall-time caps. This is a two-step
+authorization: `start --risk-profile-out <path>` only projects a read-only,
+digest-bound profile; `workflow task-start --risk-profile <path>` validates and
+stores that profile before the attempt begins. The later `workflow task-result`
+must provide host-attested usage, including `usage.invocations`.
+
+Raw text and Markdown remain draft-only: `--risk` is advisory there and cannot
+enable execution or a usage gate. See [Risk-aware
+execution](risk-aware-execution.md) for the full command sequence and failure
+rules.
+
 ## Launch profile
 
 The adapter descriptor field `managedLaunch` declares one of the following

diff --git a/docs/reference/model-routing.md b/docs/reference/model-routing.md
@@ -160,6 +160,12 @@ Model-backed operations must produce
 ceilings. In workflow execution, missing, unattested or lineage-drifted usage
 blocks `workflow task-result` before a task can enter review.
 
+Risk-aware attempts add `usage.invocations` to the same host-attested receipt.
+The bound risk profile checks `billableTokens`, `invocations`, and
+`wallSeconds`; exceeding any cap rejects `workflow task-result`. This additive
+field is required only when `workflow task-start --risk-profile <path>` has
+authorized the attempt. See [Risk-aware execution](risk-aware-execution.md).
+
 ## Scope boundaries
 
 The v1 implementation enforces route receipts without becoming a provider

diff --git a/docs/reference/public-contracts.md b/docs/reference/public-contracts.md
@@ -44,6 +44,7 @@ Stable schema ids:
 - `agent-runner-snapshot.v1`
 - `agent-managed-lifecycle-next-action.v1`
 - `agent-managed-lifecycle-runner-receipt.v1`
+- `agent-lifecycle-start-receipt.v1`
 - `agent-adapter-session-receipt.v1`
 - `agent-managed-adapter-launch-receipt.v1`
 - `agent-adapter-session-resume-receipt.v1`
@@ -82,7 +83,10 @@ Stable schema ids:
 - `agent-progress-bridge-receipt.v1`
 - `agent-progress-hook-policy.v1`
 - `agent-progress-hook-receipt.v1`
+- `agent-risk-execution-policy.v1`
+- `agent-risk-execution-profile.v1`
 - `agent-lifecycle-quality-floor-decision.v1`
+- `agent-lifecycle-policy-proposal.v1`
 - `agent-adaptive-lifecycle-policy-request.v1`
 - `agent-adaptive-lifecycle-policy-decision.v1`
 - `agent-adaptive-lifecycle-policy-decision-validation.v1`

diff --git a/docs/reference/risk-aware-execution.md b/docs/reference/risk-aware-execution.md
@@ -0,0 +1,125 @@
+# Risk-aware execution
+
+Risk-aware execution turns a frozen plan tier into an explicit model route,
+token limit, invocation limit, wall-time limit, and usage-evidence requirement.
+It is deterministic and does not call a model or launch an adapter host.
+The portable artifact uses the public schema
+`agent-risk-execution-profile.v1`.
+
+## Risk levels
+
+`--risk auto` uses the frozen plan tier. An explicit `S0`, `S1`, or `S2` value
+may tighten the tier but cannot lower it. The order is `S0 < S1 < S2`.
+
+The default local inputs are:
+
+- `profiles/risk-execution-policy.v1.json` for invocation and wall-time caps;
+- `profiles/model-routing-profile.v1.json` for the provider-neutral model class
+  and billable-token cap;
+- `profiles/lifecycle-baselines.v1.json` for the existing quality floor.
+
+A real S1/S2 managed run also requires `--host-model-profile`. Concrete model
+names remain in that local file. The portable risk profile records only the
+adapter id, provider-neutral model class, and binding digests.
+
+## Managed start
+
+Use a frozen manifest or a structured run request. This example writes both the
+public start receipt and the exact projected risk profile:
+
+```bash
+agent-lifecycle start \
+  --adapter codex \
+  --mode implement \
+  --risk auto \
+  --file tasks/my-release/plan.manifest.json \
+  --state work/my-release/run.state.json \
+  --lock tasks/my-release/plan.lock.json \
+  --task WS-01 \
+  --operation-id start-WS-01-attempt-1 \
+  --expected-revision 3 \
+  --source-revision "$(git rev-parse HEAD)" \
+  --host-model-profile profiles/hosts/codex-live-profile.v1.json \
+  --risk-profile-out work/my-release/WS-01/risk-profile.json \
+  --out work/my-release/WS-01/start.json
+```
+
+`start` remains read-only with respect to workflow state. The returned host
+action contains the profile, but the profile has no workflow authority yet and
+no model or host process starts.
+
+## Authorize the task attempt
+
+Pass the same artifact to the normal task transition. Use the same operation id
+that was bound into the projected route:
+
+```bash
+agent-lifecycle workflow task-start \
+  --state work/my-release/run.state.json \
+  --task WS-01 \
+  --operation-id start-WS-01-attempt-1 \
+  --expected-revision 3 \
+  --source-revision "$(git rev-parse HEAD)" \
+  --risk-profile work/my-release/WS-01/risk-profile.json \
+  --reason "start risk-aware attempt"
+```
+
+This transition validates the profile digest and run, plan, task, source,
+adapter, risk-tier, and route lineage. Only then does it store `modelRoute`,
+`attemptModelRoute`, and the risk caps in mutable task state. Omitting
+`--risk-profile` preserves the legacy task-start path, but that path does not
+claim risk-aware execution.
+
+## Usage receipt
+
+For risk-aware S1/S2 attempts, the host-attested model usage receipt must
+include the existing normalized metrics plus additive `usage.invocations`:
+
+```json
+{
+  "usage": {
+    "inputTokens": 1200,
+    "outputTokens": 300,
+    "billableTokens": 1500,
+    "cumulativeContextBytes": 24000,
+    "toolCalls": 4,
+    "wallSeconds": 95,
+    "invocations": 2
+  },
+  "attestation": {
+    "source": "host",
+    "status": "ATTESTED"
+  }
+}
+```
+
+`workflow task-result` first applies the existing route and attestation checks,
+then checks billable tokens, invocations, and wall time against the bound risk
+profile. Missing, estimated, lineage-drifted, or over-cap evidence rejects the
+transition, so task acceptance remains unreachable.
+
+## Draft boundary
+
+For raw text or Markdown, `--risk` is advisory only:
+
+```bash
+agent-lifecycle start \
+  --adapter codex \
+  --mode plan \
+  --risk S2 \
+  --file task.md
+```
+
+The receipt records the requested recommendation but creates no execution
+profile, usage gate, model call, host process, or lifecycle-coverage claim.
+
+## Failure behavior
+
+The command blocks rather than silently weakening policy when:
+
+- an explicit risk is lower than the frozen plan tier;
+- a required local policy/profile is missing or invalid;
+- the host profile does not match the adapter descriptor host;
+- S1/S2 has no host model profile;
+- plan, task, source, operation, route, or profile digests do not match;
+- host usage is missing, estimated, or above any bound cap.