@abot-ai/runtime 1.0.0 → 1.2.0

package/runtime.config.schema.json

@@ -333,6 +333,20 @@
       },
       "additionalProperties": false
     },
+    "longTermMemory": {
+      "type": "object",
+      "description": "Passive cross-session memory. Disabled unless the host opts in and binds an embedding profile.",
+      "properties": {
+        "enabled": { "type": "boolean", "default": false },
+        "emitClientEvents": { "type": "boolean", "default": false },
+        "embeddingProfileId": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Profile id under models.embeddingProfiles used for retrieval and indexing."
+        }
+      },
+      "additionalProperties": false
+    },
     "models": {
       "type": "object",
       "description": "Model profiles and defaults consumed by model-gateway policy.",
@@ -606,6 +620,22 @@
             ]
           }
         },
+        "embeddingProfiles": {
+          "type": "object",
+          "propertyNames": { "minLength": 1 },
+          "description": "Non-generative embedding profiles used by core services such as long-term memory.",
+          "additionalProperties": {
+            "type": "object",
+            "properties": {
+              "label": { "type": "string", "minLength": 1 },
+              "provider": { "type": "string", "minLength": 1 },
+              "model": { "type": "string", "minLength": 1 },
+              "options": { "type": "object", "additionalProperties": true }
+            },
+            "required": ["provider", "model"],
+            "additionalProperties": false
+          }
+        },
         "invocationProfiles": {
           "type": "object",
           "description": "Invocation profiles keyed by id. They reference a model profile and override per-invocation generation, context, or format policy.",

package/src/runtime/README.md

@@ -85,8 +85,9 @@ code.
 
 Long procedures are split by lifetime and responsibility:
 
-- `RootExecutionSession` owns the single root activation loop.
-- `RoleActivationLoop` and `ChildInvocationTransaction` own subordinate calls.
+- `RootExecutionSession` owns the single root activation procedure.
+- `RoleActivationLoop` and `ChildInvocationTransaction` run subordinate calls;
+  they do not own independent continuation counters.
 - `RoleCallTransactions` is the typed command/effect facade over the sole
   reducer and ledger writer.
 - `BoundCapabilitySession` owns one call-bound capability facade while
@@ -111,10 +112,14 @@ isolation boundaries.
   directly and consumes their mechanically linked continuation before choosing
   its next action. It does not create a second root or state machine.
 - **Delegated Planner contract** coordinates one bounded delegated objective.
-  It may invoke legal child roles and represents the completed sub-process to
-  its caller. For a Worker child, it selects only the smallest complete set of
-  offered catalog groups; the Worker still owns capability and control
-  selection.
+  It declares every currently known execution outcome before its first child
+  dispatch. Each Worker invocation binds exactly one independently completable
+  production item; after consuming that bound result, a later activation may
+  select the next pending production item. Planner invokes only Worker and
+  represents the completed sub-process to Supervisor, which separately owns
+  Reviewer delegation and audit decisions. For a Worker child, Planner selects
+  only the smallest complete set of offered catalog groups; the Worker still
+  owns capability and control selection.
 - **Planner Graph advisory contract** may propose or decline one bounded
   dependency graph for the Execution Agent. It is a terminal passive child
   result: it cannot execute graph nodes, write canonical plan state, or commit
@@ -124,8 +129,9 @@ isolation boundaries.
   observation or effect is required. Its structured decision selects the
   action; substantive completion text is authored separately as raw text.
 - **Reviewer** independently assesses bounded supplied work in the delegated
-  policy and returns a pass or gaps to its exact caller. It does not choose
-  remediation or finalization.
+  policy and returns a human-readable summary plus a bounded, revision-bound
+  `reviewer_verdict_v1` receipt to its exact caller. The receipt is passive
+  canonical evidence; it does not choose remediation or finalization.
 - **Auditor** receives typed criteria and whole canonical evidence entries in
   the direct policy. It returns a passive pass/gaps advisory; omitted evidence
   makes pass unavailable and the root still owns the next action.
@@ -134,6 +140,14 @@ A Planner Graph or Auditor structured-output validation failure settles as a
 failed passive child result and returns to the root; it does not write plan
 state, authorize execution, or commit request failure by itself.
 
+Under `supervisor-worker-v1`, every terminal Planner or Worker result receives a
+runtime-owned `work_result_v1` receipt. Supervisor and Planner continuations
+receive that compact receipt together with a verified `work_result_lineage_v1`
+projection; an explicitly dependent Worker receives only the compact receipt.
+These structures prove canonical provenance, not semantic correctness, and do
+not grant response, remediation, or capability authority. Model-supplied work
+receipts are rejected. `execution-agent-v1` does not issue them.
+
 Role choice belongs to the active role model. Runtime code validates the strict
 action envelope, exact caller, role availability, current ledger head, and
 global bounds; it does not infer work type from prompt text, paths, tool names,
@@ -141,14 +155,25 @@ or model prose.
 
 ## Canonical State
 
-`orchestration/role-calls/` is the sole writer of the request-local call tree
+`orchestration/role-calls/` ledger v17 is the sole writer of the request-local call tree
 and role results. Each call frame records its caller, role, bounded objective,
 depth, status, result reference, and any canonical capability catalog-group
 scope. An authorized root, Planner, or Worker may also record one normalized
 working directory; the role-call reducer is the sole writer of that immutable
 scope. A Planner's Worker children inherit it mechanically and cannot replace
 it.
-A result returns only to that exact caller.
+A result returns only to that exact caller. The ledger mechanically binds each
+Supervisor-policy Planner or Worker result to its producer, caller, admitted
+revision, and a lineage fingerprint. Full lineage is derived on demand from the
+same ledger and verified against that fingerprint; it is not a second state
+store and the compact receipt does not copy dependency, execution, or plan-item
+lists.
+
+The same reducer enforces one mechanical per-call activation ceiling for every
+root and delegated call. The ceiling is derived from the existing request-wide
+call and capability-execution limits; model steps, role loops, providers, and
+tools do not maintain separate counters or retry policy. An over-budget
+transition is rejected before commit as `role_activation_limit_exceeded`.
 
 `orchestration/worker-capabilities/` is the shared capability engine retained
 for compatibility; its policy-neutral binding attaches offered descriptors and
@@ -163,15 +188,40 @@ policy authority. The delegated Worker keeps its established assignment
 capsule; a direct root payload binds the exact request source, ordered steering,
 and immutable controls. Capability `intent` is bounded client-facing
 presentation metadata and is never projected as payload authority or execution
-evidence. There is no second payload or adapter pipeline for
+evidence. Before Worker payload or result authoring, dependency results are
+narrowed to their existing result fields and optional `semanticCheckpoints`;
+work receipts and derived lineage do not cross either raw authoring boundary.
+There is no second payload or adapter pipeline for
 `execution-agent-v1`.
 
-When direct capability refinement declines an already selected invocation, the
-kernel commits the canonical `reconsider_capability_selection` RoleCall
-transition. It records the exact selection and fingerprint, advances the same
-root activation, and executes no adapter. The projection is passive continuity
-only; it neither chooses a replacement, suppresses a later model selection,
-nor establishes evidence.
+When direct capability controls refinement exhausts structured-output
+validation, the kernel commits the canonical
+`reconsider_capability_selection` RoleCall transition. It records the exact
+selection and fingerprint, advances the same root activation, and executes no
+adapter. Its bounded mechanical cause contains validation metadata but never
+raw model output and is projected only to the immediately following Execution
+Agent activation. This projection is passive continuity only; it neither
+judges the selected capability, chooses a replacement, suppresses a later
+model selection, nor establishes evidence.
+
+The role-call ledger separately supervises pre-execution reconsideration. Its
+stable identity is derived from steering version, single/batch shape,
+capability IDs, canonical selection controls, and the effective working
+directory; presentation intent, cause wording, and catalog scope are excluded.
+The first matching selection is tracked, the second carries a passive warning,
+the third carries a passive intervention notice, and the fourth is atomically
+rejected. A separate total budget warns at six, intervenes at seven, and
+rejects at eight so changing or alternating selections cannot evade the bound.
+Only the immediately following Execution Agent decision sees warning metadata;
+capability refinement and response composition do not. New steering or an
+accepted mechanical progress transition resets this pre-execution epoch and
+hands materialized attempts to operation supervision. A terminal selection
+limit executes no adapter and is committed through canonical degraded
+finalization rather than surfacing a raw activation-budget failure.
+The independent activation budget is not enlarged: if a smaller legal policy
+preempts these local thresholds during reconsideration, that exact root path
+also finalizes degraded, while activation-limit failures for other actions
+retain their existing error semantics.
 
 Events are projections of committed state, never another state store.
 
@@ -232,27 +282,19 @@ overrides. The root config points to one request-runner config:
 }
 ```
 
-The referenced file owns model-step selection, request context budgets, and
-per-step timeouts:
+The referenced file owns model-step routing overrides, request context budgets,
+and timeout defaults and overrides. Fresh configurations use schema version 2:
 
 ```json
 {
+  "schemaVersion": 2,
   "models": {
     "defaults": {
-      "profileId": "model-profile-id",
+      "profileId": "default",
       "steps": {
-        "supervisor.decision": "supervisor.decision",
-        "supervisor.response": "model-profile-id",
-        "planner.decision": "planner.decision",
-        "planner.graph": "planner.graph",
-        "worker.decision": "worker.decision",
-        "worker.result": "model-profile-id",
-        "reviewer.decision": "reviewer.decision",
-        "degraded.finalization": "degraded.finalization",
-        "execution.decision": "execution.decision",
-        "execution.response": "model-profile-id",
-        "auditor.decision": "auditor.decision",
-        "context.compact": "context.compact",
+        "supervisor.response": "default",
+        "worker.result": "default",
+        "execution.response": "default",
         "tool_payload.raw": "toolPayload.raw"
       }
     }
@@ -262,24 +304,40 @@ per-step timeouts:
     "safetyReserveTokens": 1200,
     "attachmentReserveTokens": 1024
   },
+  "stepDefaults": {
+    "timeoutMs": 90000
+  },
   "steps": {
-    "supervisor.decision": { "timeoutMs": 90000 },
-    "supervisor.response": { "timeoutMs": 90000 },
-    "planner.decision": { "timeoutMs": 90000 },
-    "planner.graph": { "timeoutMs": 90000 },
-    "worker.decision": { "timeoutMs": 90000 },
-    "worker.result": { "timeoutMs": 90000 },
-    "reviewer.decision": { "timeoutMs": 90000 },
-    "degraded.finalization": { "timeoutMs": 90000 },
-    "execution.decision": { "timeoutMs": 90000 },
-    "execution.response": { "timeoutMs": 90000 },
-    "auditor.decision": { "timeoutMs": 90000 },
-    "context.compact": { "timeoutMs": 90000 },
-    "tool_payload.raw": { "timeoutMs": 90000 }
+    "supervisor.response": {
+      "instructionRefs": [
+        "../methodologies/response-ux.md",
+        "../methodologies/memory-informed-response.md"
+      ]
+    },
+    "execution.response": {
+      "instructionRefs": [
+        "../methodologies/response-ux.md",
+        "../methodologies/memory-informed-response.md"
+      ]
+    }
   }
 }
 ```
 
+Both maps are sparse external configuration. A missing
+`models.defaults.steps` entry resolves to the same id as the model step; only
+the four canonical non-identity overrides shown above need declarations. A
+missing root `steps` entry uses `stepDefaults.timeoutMs` and no additional
+instructions. Explicit timeout or `instructionRefs` values override only the
+named step.
+
+A file with no `schemaVersion` is legacy v1 and remains supported. The loader
+normalizes either external format to the same exhaustive, frozen internal
+request-runner policy without rewriting the source file. `schemaVersion: 2` is
+the only explicit supported version; any other explicit value fails before use
+or write. Fresh init creates v2, while init without `--force` and ordinary
+package upgrades preserve an existing v1 or v2 file unchanged.
+
 Every materialized model profile declares its physical context capacity with
 top-level `contextWindowTokens`. The selected profile supplies that capacity to
 runtime admission and provider projection; the request-runner does not repeat
@@ -342,6 +400,7 @@ The shared request kernel registers this union of policy and utility steps:
 - `planner.graph`
 - `worker.decision`
 - `worker.result`
+- `capability.controls`
 - `reviewer.decision`
 - `degraded.finalization`
 - `execution.decision`
@@ -350,8 +409,9 @@ The shared request kernel registers this union of policy and utility steps:
 - `context.compact`
 - `tool_payload.raw`
 
-Every invoked step requires model policy and timeout configuration. The request
-runner timeout is the default; a model profile calibration slot may override
+Every invoked step receives model policy and timeout configuration after the
+versioned file is normalized. External v2 files need not repeat identity
+mappings or the default timeout. A model profile calibration slot may override
 `timeoutMs` for that model and semantic step when provider latency requires it.
 Call sites use the shared model-step registry rather than inferring behavior
 from step-name prefixes.

package/dist/src/model-gateway/structured-output/budget.d.ts

@@ -1,7 +0,0 @@
-import type { ModelGatewayFormat, ModelTokenEstimationConfig } from "../types.js";
-/**
- * Estimates the generation allowance for the largest bounded JSON shape using
- * the selected profile's token estimator. Undefined means at least one output
- * shape has no finite schema bound, so the provider must use physical capacity.
- */
-export declare function estimateStrictStructuredOutputTokenCeiling(format: ModelGatewayFormat | undefined, tokenEstimation?: ModelTokenEstimationConfig): number | undefined;

package/dist/src/model-gateway/structured-output/budget.js

@@ -1,20 +0,0 @@
-import { estimateAsciiCharacterTokens } from "../../runtime/context/token-estimator.js";
-import { isModelGatewayJsonSchemaFormat } from "./format-contract.js";
-import { estimateStrictSchemaCharacters } from "./schema-character-estimator.js";
-const JSON_TERMINATION_TOKEN_RESERVE = 1;
-/**
- * Estimates the generation allowance for the largest bounded JSON shape using
- * the selected profile's token estimator. Undefined means at least one output
- * shape has no finite schema bound, so the provider must use physical capacity.
- */
-export function estimateStrictStructuredOutputTokenCeiling(format, tokenEstimation) {
-    if (!isModelGatewayJsonSchemaFormat(format) || format.strict !== true) {
-        return undefined;
-    }
-    const maximumCharacters = estimateStrictSchemaCharacters(format.schema);
-    if (maximumCharacters === undefined) {
-        return undefined;
-    }
-    return Math.max(1, estimateAsciiCharacterTokens(maximumCharacters, tokenEstimation) +
-        JSON_TERMINATION_TOKEN_RESERVE);
-}

package/dist/src/model-gateway/structured-output/schema-character-estimator.d.ts

@@ -1 +0,0 @@
-export declare function estimateStrictSchemaCharacters(schema: Readonly<Record<string, unknown>>): number | undefined;

package/dist/src/model-gateway/structured-output/schema-character-estimator.js

@@ -1,211 +0,0 @@
-const MAX_SCHEMA_DEPTH = 32;
-const MAX_SCHEMA_VISITS = 50_000;
-const MAX_SERIALIZED_NUMBER_CHARACTERS = Math.max(JSON.stringify(Number.MAX_VALUE).length, JSON.stringify(-Number.MAX_VALUE).length, JSON.stringify(Number.MIN_VALUE).length, JSON.stringify(-Number.MIN_VALUE).length);
-export function estimateStrictSchemaCharacters(schema) {
-    return estimateSchemaNodeCharacters(schema, 0, {
-        visits: 0,
-    });
-}
-function estimateSchemaNodeCharacters(schema, depth, state) {
-    state.visits += 1;
-    if (depth > MAX_SCHEMA_DEPTH || state.visits > MAX_SCHEMA_VISITS) {
-        return undefined;
-    }
-    const bounds = [];
-    const constantBound = estimateExactJsonCharacters(schema.const);
-    if (Object.hasOwn(schema, "const") && constantBound !== undefined) {
-        bounds.push(constantBound);
-    }
-    const enumBound = estimateEnumCharacters(schema.enum);
-    if (enumBound !== undefined) {
-        bounds.push(enumBound);
-    }
-    const typeBound = estimateDeclaredTypeCharacters(schema, depth, state);
-    if (typeBound !== undefined) {
-        bounds.push(typeBound);
-    }
-    for (const union of [schema.anyOf, schema.oneOf]) {
-        const unionBound = estimateUnionCharacters(union, depth, state);
-        if (unionBound !== undefined) {
-            bounds.push(unionBound);
-        }
-    }
-    const intersectionBound = estimateIntersectionCharacters(schema.allOf, depth, state);
-    if (intersectionBound !== undefined) {
-        bounds.push(intersectionBound);
-    }
-    return bounds.length > 0 ? minimum(bounds) : undefined;
-}
-function estimateDeclaredTypeCharacters(schema, depth, state) {
-    const types = readDeclaredTypes(schema);
-    if (types.length === 0) {
-        return undefined;
-    }
-    const bounds = types.map((type) => estimateTypeCharacters(type, schema, depth, state));
-    return bounds.every((bound) => bound !== undefined)
-        ? maximum(bounds)
-        : undefined;
-}
-function readDeclaredTypes(schema) {
-    if (Array.isArray(schema.type)) {
-        return schema.type.filter((value) => typeof value === "string");
-    }
-    if (typeof schema.type === "string") {
-        return [schema.type];
-    }
-    return inferStructuralType(schema);
-}
-function inferStructuralType(schema) {
-    if (Object.hasOwn(schema, "properties"))
-        return ["object"];
-    if (Object.hasOwn(schema, "items"))
-        return ["array"];
-    return [];
-}
-function estimateTypeCharacters(type, schema, depth, state) {
-    switch (type) {
-        case "null":
-            return 4;
-        case "boolean":
-            return 5;
-        case "number":
-        case "integer":
-            return MAX_SERIALIZED_NUMBER_CHARACTERS;
-        case "string": {
-            const maxLength = readNonNegativeInteger(schema.maxLength);
-            return maxLength === undefined ? undefined : safeAdd(maxLength, 2);
-        }
-        case "array":
-            return estimateArrayCharacters(schema, depth, state);
-        case "object":
-            return estimateObjectCharacters(schema, depth, state);
-        default:
-            return undefined;
-    }
-}
-function estimateArrayCharacters(schema, depth, state) {
-    const maxItems = readNonNegativeInteger(schema.maxItems);
-    if (maxItems === undefined)
-        return undefined;
-    if (maxItems === 0)
-        return 2;
-    if (isPlainRecord(schema.items)) {
-        const itemCharacters = estimateSchemaNodeCharacters(schema.items, depth + 1, state);
-        return itemCharacters === undefined
-            ? undefined
-            : safeAdd(2, safeAdd(maxItems - 1, safeMultiply(maxItems, itemCharacters)));
-    }
-    if (!Array.isArray(schema.items))
-        return undefined;
-    if (!schema.items.every(isPlainRecord))
-        return undefined;
-    const itemSchemas = schema.items;
-    const effectiveMaxItems = schema.additionalItems === false
-        ? Math.min(maxItems, itemSchemas.length)
-        : maxItems;
-    const fixedItemCount = Math.min(effectiveMaxItems, itemSchemas.length);
-    let characters = safeAdd(2, Math.max(0, effectiveMaxItems - 1));
-    for (let index = 0; index < fixedItemCount; index += 1) {
-        const itemCharacters = estimateSchemaNodeCharacters(itemSchemas[index], depth + 1, state);
-        if (itemCharacters === undefined)
-            return undefined;
-        characters = safeAdd(characters, itemCharacters);
-    }
-    if (effectiveMaxItems <= itemSchemas.length)
-        return characters;
-    if (!isPlainRecord(schema.additionalItems))
-        return undefined;
-    const additionalCharacters = estimateSchemaNodeCharacters(schema.additionalItems, depth + 1, state);
-    return additionalCharacters === undefined
-        ? undefined
-        : safeAdd(characters, safeMultiply(effectiveMaxItems - itemSchemas.length, additionalCharacters));
-}
-function estimateObjectCharacters(schema, depth, state) {
-    const hasPatternProperties = isPlainRecord(schema.patternProperties) &&
-        Object.keys(schema.patternProperties).length > 0;
-    const allowsUnboundedProperties = schema.additionalProperties !== false;
-    if (allowsUnboundedProperties || hasPatternProperties) {
-        return undefined;
-    }
-    if (schema.properties !== undefined && !isPlainRecord(schema.properties)) {
-        return undefined;
-    }
-    const properties = isPlainRecord(schema.properties)
-        ? Object.entries(schema.properties)
-        : [];
-    let characters = safeAdd(2, Math.max(0, properties.length - 1));
-    for (const [property, propertySchema] of properties) {
-        if (!isPlainRecord(propertySchema))
-            return undefined;
-        const valueCharacters = estimateSchemaNodeCharacters(propertySchema, depth + 1, state);
-        if (valueCharacters === undefined)
-            return undefined;
-        characters = safeAdd(characters, safeAdd(JSON.stringify(property).length + 1, valueCharacters));
-    }
-    return characters;
-}
-function estimateUnionCharacters(value, depth, state) {
-    if (!Array.isArray(value) || value.length === 0)
-        return undefined;
-    const branches = value.filter(isPlainRecord);
-    if (branches.length !== value.length)
-        return undefined;
-    const bounds = branches.map((branch) => estimateSchemaNodeCharacters(branch, depth + 1, state));
-    return bounds.every((bound) => bound !== undefined)
-        ? maximum(bounds)
-        : undefined;
-}
-function estimateIntersectionCharacters(value, depth, state) {
-    if (!Array.isArray(value) || value.length === 0)
-        return undefined;
-    const bounds = value
-        .filter(isPlainRecord)
-        .map((branch) => estimateSchemaNodeCharacters(branch, depth + 1, state))
-        .filter((bound) => bound !== undefined);
-    return bounds.length > 0 ? minimum(bounds) : undefined;
-}
-function estimateEnumCharacters(value) {
-    if (!Array.isArray(value) || value.length === 0)
-        return undefined;
-    const bounds = value.map(estimateExactJsonCharacters);
-    return bounds.every((bound) => bound !== undefined)
-        ? maximum(bounds)
-        : undefined;
-}
-function estimateExactJsonCharacters(value) {
-    try {
-        const serialized = JSON.stringify(value);
-        return typeof serialized === "string" ? serialized.length : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-function readNonNegativeInteger(value) {
-    return typeof value === "number" && Number.isSafeInteger(value) && value >= 0
-        ? value
-        : undefined;
-}
-function isPlainRecord(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value)) {
-        return false;
-    }
-    const prototype = Object.getPrototypeOf(value);
-    return prototype === Object.prototype || prototype === null;
-}
-function safeAdd(left, right) {
-    return Math.min(Number.MAX_SAFE_INTEGER, left + right);
-}
-function safeMultiply(left, right) {
-    if (left === 0 || right === 0)
-        return 0;
-    return left > Number.MAX_SAFE_INTEGER / right
-        ? Number.MAX_SAFE_INTEGER
-        : left * right;
-}
-function minimum(values) {
-    return values.reduce((result, value) => Math.min(result, value));
-}
-function maximum(values) {
-    return values.reduce((result, value) => Math.max(result, value));
-}

package/dist/src/model-gateway/structured-output-budget.d.ts

@@ -1 +0,0 @@
-export * from "./structured-output/budget.js";

package/dist/src/model-gateway/structured-output-budget.js

@@ -1 +0,0 @@
-export * from "./structured-output/budget.js";