OpenMind v2 Phase 4: cloud semantic plane, evidence-bound extraction and Adaptive Project Lenses

[HelloThisWorld]

A provider-neutral, policy-governed semantic reasoning plane that lets a cloud or local model PROPOSE engineering knowledge while every proposal stays a locally verified, evidence-bound candidate:

• Provider SPI + adapters: local OpenAI-compatible (loopback-only), OpenAI, Anthropic, Azure OpenAI (all via the official SDKs with an injected audited httpx transport; SDK imports lazy) and a deterministic mock. Typed error taxonomy; no adapter can construct an unaudited client.
• Machine-local provider profiles (~/.openmind/providers.json): atomic writes, env-var NAME only — a key value is never stored, logged or accepted (no --api-key flag; prefix-abbreviation disabled; key-shaped values refused at write time).
• Workspace semantic policy: closed classification vocabulary with fail-closed defaults (restricted + remote OFF); every rule checked before any content is serialized; job payloads cannot override policy.
• Audited semantic egress beside the untouched loopback guard: exact profile-host pinning per hop, HTTPS for remote, redirects contained, structured JSON-lines audit (bytes + hashes, never bodies or headers).
• Versioned closed task registry (15 tasks), strict structured-output schemas with local validators, and an injection-hardened prompt builder: instructions in the system text, project content only ever inside untrustedContent, no tools, no chain-of-thought.
• Local evidence verifier: cited Evidence must exist in the workspace, have been part of the request, and every quote must be a substring of the immutable snapshot; final confidence derived deterministically — the model's hint never decides.
• Resumable analysis pipeline as a job type: per-target checkpoints, cache (full composite key; identical re-analysis = zero provider calls), budgets checked at plan/pre-call/post-usage with honest partial runs, per-request usage ledger with null-not-zero token and cost accounting, bounded signal-driven relation/conflict pair generation (no cross products).
• Candidate staleness: new Revisions stale dependent candidates transitively, review status preserved, startup backstop reconciliation.
• Adaptive Project Lenses: closed 2.0.0 schema with a safe-pattern gate, built-in Template projections (Templates untouched), organization lens files, bounded deterministic sampling, strong-model induction stored provisionally, deterministic whole-corpus validation, explicit approve + activate; an active lens narrows semantic planning only.
• Adapters: provider/semantic/lens CLI groups, additive REST routes (/projects naming kept), exactly 7 additive read-only MCP tools (26 total).
• Migration v0005 (additive, 12 new tables); runtime 1.4.0-dev; artifact schema stays 1.1.0 with no semantic data exported.
• 13 new acceptance suites (all registered; core tier now 48 scripts, all green), CI gates them plus a cross-platform mock-provider smoke; no CI job holds a provider key or calls a real API.

Ordinary ingestion still makes zero model calls; the legacy local Ask path is untouched; Phase 1-3 databases migrate with no data loss. Candidate promotion and the canonical Knowledge Graph remain in Phase 5.