@abot-ai/runtime 1.3.1 → 1.5.0

package/dist/src/runtime/adapters/registered-tool-normal-invocations/execution/prepared-snapshot.js

@@ -0,0 +1,118 @@
+import { permitsRequiredToolMode, requiresToolActionApproval, } from "../../../../capabilities/tool-permission-mode.js";
+import { createRegisteredToolActionFingerprint } from "../shared/action-fingerprint.js";
+import { captureToolCall, resolveExactTargetOperation, validateCompleteCall, } from "./call-binding.js";
+import { captureExecutionBinding } from "./execution-binding.js";
+import { createPreparedNormalInvocation } from "./prepared-execution.js";
+/** Validate a saved exact call; restoration never invokes normalization or payload authoring. */
+export function restoreNormalInvocation(params) {
+    const value = params.snapshot;
+    if (!isInvocationSnapshot(value))
+        throw invalid();
+    if (value.toolPermissionMode !== params.executor.toolPermissionMode)
+        throw invalid();
+    const source = findOperation(params.registrations, value.source);
+    const target = findOperation(params.registrations, value.target);
+    const call = captureToolCall(value.call);
+    if (!source || !target || !call || call.tool !== target.registration.toolName)
+        throw invalid();
+    const resolved = resolveExactTargetOperation(params.registrations, call);
+    if (!resolved.ok ||
+        resolved.binding.operation.operationId !== target.operation.operationId)
+        throw invalid();
+    if (source.operation.effect !== target.operation.effect)
+        throw invalid();
+    for (const binding of [source, target]) {
+        if (!permitsRequiredToolMode(params.executor.toolPermissionMode, binding.registration.definition.requiredPermissionMode))
+            throw invalid();
+    }
+    const validation = validateCompleteCall({
+        adapter: target.registration.adapter,
+        call,
+        rejectedCode: "checkpoint_call_invalid",
+        failedCode: "checkpoint_validation_failed",
+        failedMessage: "The saved invocation could not be validated.",
+    });
+    if (!validation.ok)
+        throw invalid();
+    const binding = captureExecutionBinding(target.registration.adapter, call);
+    if (!binding.ok)
+        throw invalid();
+    const fingerprint = createRegisteredToolActionFingerprint({
+        contractVersion: target.registration.contract.version,
+        operationId: target.operation.operationId,
+        call,
+        ...(binding.identity ? { executionIdentity: binding.identity } : {}),
+    });
+    if (fingerprint !== value.actionFingerprint ||
+        binding.identity !== value.executionIdentity)
+        throw invalid();
+    const force = source.operation.approval === "always" ||
+        target.operation.approval === "always";
+    const required = requiresToolActionApproval(params.executor.toolPermissionMode, force);
+    if (required !== Boolean(value.approvalRequest))
+        throw invalid();
+    if (value.approvalRequest) {
+        if (!isRequestApproval(value.approvalRequest, params.executor.requestId))
+            throw invalid();
+        const approvalFingerprint = createRegisteredToolActionFingerprint({
+            contractVersion: target.registration.contract.version,
+            operationId: target.operation.operationId,
+            call: value.approvalRequest.call,
+            ...(binding.identity ? { executionIdentity: binding.identity } : {}),
+        });
+        if (approvalFingerprint !== fingerprint)
+            throw invalid();
+    }
+    return createPreparedNormalInvocation({
+        executor: params.executor,
+        source,
+        target,
+        call,
+        actionFingerprint: fingerprint,
+        acceptedControls: Object.freeze(structuredClone(value.acceptedControls)),
+        eventMeta: value.eventMeta,
+        ...(value.intent ? { intent: value.intent } : {}),
+        ...(binding.identity ? { executionIdentity: binding.identity } : {}),
+        ...(binding.metadata ? { executionMetadata: binding.metadata } : {}),
+        ...(value.approvalRequest
+            ? { restoredApprovalRequest: value.approvalRequest }
+            : {}),
+    });
+}
+function isInvocationSnapshot(value) {
+    if (!value || value.kind !== "registered_tool_normal_invocation_v1")
+        return false;
+    return (isRecord(value.acceptedControls) &&
+        isRecord(value.call) &&
+        typeof value.call.tool === "string" &&
+        isRecord(value.call.params) &&
+        typeof value.actionFingerprint === "string" &&
+        value.actionFingerprint.length > 0 &&
+        (value.intent === undefined || typeof value.intent === "string") &&
+        (value.eventMeta === undefined || isRecord(value.eventMeta)) &&
+        (value.executionIdentity === undefined ||
+            typeof value.executionIdentity === "string") &&
+        (value.approvalRequest === undefined || isRecord(value.approvalRequest)));
+}
+function isRequestApproval(approval, requestId) {
+    if (!isRecord(approval) ||
+        approval.requestId !== requestId ||
+        !isRecord(approval.call))
+        return false;
+    return (typeof approval.approvalId === "string" &&
+        approval.approvalId.trim().length > 0);
+}
+function findOperation(registrations, identity) {
+    if (!identity)
+        return undefined;
+    const registration = registrations.find((entry) => entry.toolName === identity.tool &&
+        entry.contract.version === identity.contractVersion);
+    const operation = registration?.contract.operations.find((entry) => entry.operationId === identity.operationId);
+    return registration && operation ? { registration, operation } : undefined;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function invalid() {
+    return new Error("registered_tool_snapshot_incompatible");
+}

package/dist/src/runtime/adapters/registered-tool-normal-invocations/execution/run.js

@@ -1,11 +1,11 @@
-import { buildToolCompletedEventActions, buildToolCompletedEventMetadata, buildToolLifecycleEventCopy, } from "../../../../capabilities/tool-event-metadata.js";
-import { requestNormalInvocationApproval } from "./approval.js";
-import { createPreparedInvocationRejectionEmitter } from "./rejection-event.js";
+import { permitsRequiredToolMode } from "../../../../capabilities/tool-permission-mode.js";
+import { createPreparedNormalInvocation } from "./prepared-execution.js";
 import { captureToolCall, materializeCall, resolveExactTargetOperation, validateCompleteCall, } from "./call-binding.js";
 import { createRegisteredToolActionFingerprint } from "../shared/action-fingerprint.js";
-import { buildToolExecutorEventMetadata, buildToolIntentEventMetadata, } from "../shared/event-metadata.js";
+import { buildToolIntentEventMetadata } from "../shared/event-metadata.js";
 import { prepareCompleteInvocationInput } from "../payload/input-preparation.js";
 import { rejectNormalInvocation } from "../shared/rejection.js";
+import { captureExecutionBinding } from "./execution-binding.js";
 export async function executeNormalInvocation(params) {
     const prepared = prepareNormalInvocation(params);
     return prepared.status === "prepared"
@@ -19,6 +19,9 @@ export function prepareNormalInvocation(params) {
     if (!source) {
         return rejectNormalInvocation("normal_invocation_handle_invalid", "The selected ordinary capability is not registered for this request.");
     }
+    if (!permitsRequiredToolMode(executor.toolPermissionMode, source.registration.definition.requiredPermissionMode)) {
+        return rejectNormalInvocation("tool_permission_mode_required", "The source tool requires a different captured request permission mode.");
+    }
     const preparedInput = prepareCompleteInvocationInput(source, params.input);
     if (!preparedInput.ok)
         return preparedInput.rejection;
@@ -38,6 +41,9 @@ export function prepareNormalInvocation(params) {
     const target = resolveExactTargetOperation(params.registrations, normalizedCall.call);
     if (!target.ok)
         return target.rejection;
+    if (!permitsRequiredToolMode(executor.toolPermissionMode, target.binding.registration.definition.requiredPermissionMode)) {
+        return rejectNormalInvocation("tool_permission_mode_required", "The normalized target tool requires a different captured request permission mode.");
+    }
     const targetValidation = validateCompleteCall({
         adapter: target.binding.registration.adapter,
         call: normalizedCall.call,
@@ -50,89 +56,36 @@ export function prepareNormalInvocation(params) {
     if (target.binding.operation.effect !== source.operation.effect) {
         return rejectNormalInvocation("normal_invocation_effect_changed", "A normalized ordinary invocation cannot change its declared execution effect.");
     }
-    const eventMeta = buildToolIntentEventMetadata(normalizedCall.call, params.input.intent, target.binding.registration.definition);
+    const executionBinding = captureExecutionBinding(target.binding.registration.adapter, normalizedCall.call);
+    if (!executionBinding.ok)
+        return executionBinding.rejection;
+    const intentMeta = buildToolIntentEventMetadata(normalizedCall.call, params.input.intent, target.binding.registration.definition);
+    const eventMeta = executionBinding.metadata
+        ? { ...executionBinding.metadata, ...intentMeta }
+        : intentMeta;
     const actionFingerprint = createRegisteredToolActionFingerprint({
         contractVersion: target.binding.registration.contract.version,
         operationId: target.binding.operation.operationId,
         call: normalizedCall.call,
+        ...(executionBinding.identity
+            ? { executionIdentity: executionBinding.identity }
+            : {}),
     });
-    return Object.freeze({
-        status: "prepared",
+    return createPreparedNormalInvocation({
+        executor,
+        source,
+        target: target.binding,
+        call: normalizedCall.call,
         actionFingerprint,
         acceptedControls: preparedInput.controls,
-        emitRejection: createPreparedInvocationRejectionEmitter({
-            tool: source.registration.toolName,
-            eventMeta,
-            onEvent: executor.onEvent,
-        }),
-        execute: (executionId, executorIdentity) => executePreparedNormalInvocation({
-            ...(executionId ? { executionId } : {}),
-            ...(executorIdentity ? { executorIdentity } : {}),
-            executor,
-            source,
-            target: target.binding,
-            call: normalizedCall.call,
-            eventMeta,
-            input: params.input,
-        }),
-    });
-}
-async function executePreparedNormalInvocation(params) {
-    const approval = await requestNormalInvocationApproval({
-        ...(params.executorIdentity
-            ? { executorIdentity: params.executorIdentity }
+        eventMeta,
+        ...(params.input.intent ? { intent: params.input.intent } : {}),
+        ...(executionBinding.identity
+            ? { executionIdentity: executionBinding.identity }
             : {}),
-        ...(params.executionId ? { executionId: params.executionId } : {}),
-        requestId: params.executor.requestId,
-        abortSignal: params.executor.abortSignal,
-        toolPermissionMode: params.executor.toolPermissionMode,
-        ...(params.executor.toolApprovalController
-            ? { toolApprovalController: params.executor.toolApprovalController }
+        ...(executionBinding.metadata
+            ? { executionMetadata: executionBinding.metadata }
             : {}),
-        nextApprovalId: params.executor.nextApprovalId,
-        ...(params.executor.onEvent ? { onEvent: params.executor.onEvent } : {}),
-        call: params.call,
-        ...(params.eventMeta ? { eventMeta: params.eventMeta } : {}),
-        force: params.source.operation.approval === "always" ||
-            params.target.operation.approval === "always",
-    });
-    if (!approval.ok)
-        return approval.rejection;
-    params.executor.abortSignal.throwIfAborted();
-    const startedCopy = buildToolLifecycleEventCopy(params.target.registration.definition, "started");
-    params.executor.onEvent?.("tool.started", {
-        ...buildToolExecutorEventMetadata(params.executorIdentity),
-        ...(params.executionId ? { executionId: params.executionId } : {}),
-        tool: params.call.tool,
-        ...(params.input.intent
-            ? { intent: params.input.intent, intentSource: "model" }
-            : {}),
-        ...(params.eventMeta ? { meta: params.eventMeta } : {}),
-        ...(startedCopy ?? {}),
-    });
-    const result = await params.executor.toolRegistry.execute(params.call, {
-        abortSignal: params.executor.abortSignal,
-        ...(params.executor.sharedState
-            ? { sharedState: params.executor.sharedState }
-            : {}),
-    });
-    const completionActions = Object.freeze(buildToolCompletedEventActions(params.call, result, params.target.registration.definition).map((action) => Object.freeze({ ...action })));
-    const completedMeta = buildToolCompletedEventMetadata(params.call, result, params.target.registration.definition);
-    const completedCopy = buildToolLifecycleEventCopy(params.target.registration.definition, result.ok ? "completed" : "failed");
-    params.executor.onEvent?.("tool.completed", {
-        ...buildToolExecutorEventMetadata(params.executorIdentity),
-        ...(params.executionId ? { executionId: params.executionId } : {}),
-        tool: params.source.registration.toolName,
-        ok: result.ok,
-        actions: completionActions,
-        ...(completedMeta ? { meta: completedMeta } : {}),
-        ...(completedCopy ?? {}),
-    });
-    return Object.freeze({
-        status: "executed",
-        effect: params.target.operation.effect,
-        result,
-        completionActions,
     });
 }
 function normalizeToolCall(source, sourceCall) {

package/dist/src/runtime/adapters/registered-tool-normal-invocations/execution/tool-media-execution.d.ts

@@ -0,0 +1,12 @@
+import type { ToolCall } from "../../../../capabilities/tool-types.js";
+import type { ToolExecutionOptions, ToolRegistry } from "../../../ports.js";
+import type { RequestToolResources } from "../../../capabilities/request-tool-resources.js";
+import type { ToolMediaOwner } from "../../../attachments/request-tool-media.js";
+/** The admitted call, rather than a tool's arguments, owns every media write. */
+export declare function executeWithToolResources(params: {
+    registry: Pick<ToolRegistry, "execute">;
+    call: ToolCall;
+    options: ToolExecutionOptions;
+    resources?: RequestToolResources;
+    owner?: ToolMediaOwner;
+}): Promise<import("../../../../capabilities/tool-types.js").ToolExecutionResult>;

package/dist/src/runtime/adapters/registered-tool-normal-invocations/execution/tool-media-execution.js

@@ -0,0 +1,30 @@
+/** The admitted call, rather than a tool's arguments, owns every media write. */
+export async function executeWithToolResources(params) {
+    const execution = params.resources && params.owner && params.options.abortSignal
+        ? params.resources.media.beginExecution(params.owner, params.options.abortSignal)
+        : undefined;
+    try {
+        const result = await params.registry.execute(params.call, {
+            ...params.options,
+            ...(execution ? { media: execution.writer } : {}),
+            ...(params.resources
+                ? {
+                    onRequestDispose: params.resources.onRequestDispose,
+                    requestWork: params.resources.work,
+                    requestState: params.resources.state,
+                }
+                : {}),
+        });
+        if (result.media?.length && !execution)
+            throw new Error("tool_media_execution_unbound");
+        execution?.finish(result.media);
+        return result;
+    }
+    catch (error) {
+        execution?.finish();
+        throw error;
+    }
+    finally {
+        execution?.close();
+    }
+}

package/dist/src/runtime/adapters/registered-tool-normal-invocations/executor.js

@@ -4,6 +4,7 @@ import { projectRuntimePathBindings } from "./catalog/runtime-path-bindings.js";
 import { executeNormalInvocation, prepareNormalInvocation, } from "./execution/run.js";
 import { emitNormalInvocationPayloadLifecycle } from "./payload/lifecycle.js";
 import { prepareNormalInvocationPayloadLifecycle } from "./payload/lifecycle.js";
+import { restoreNormalInvocation } from "./execution/prepared-snapshot.js";
 import { prepareNormalInvocationRejectionEvent } from "./execution/rejection-event.js";
 /**
  * Captures one selected ToolRegistry snapshot and executes its ordinary
@@ -37,6 +38,7 @@ export function createRegisteredToolNormalInvocationExecutor(params) {
     })));
     return Object.freeze({
         operations,
+        restore: (snapshot) => restoreNormalInvocation({ executor: params, registrations, snapshot }),
         prepareRejectionEvent(input) {
             return prepareNormalInvocationRejectionEvent({
                 operationByHandle,

package/dist/src/runtime/adapters/registered-tool-normal-invocations/shared/action-fingerprint.d.ts

@@ -7,6 +7,7 @@ export declare function createRegisteredToolActionFingerprint(input: {
     contractVersion: number;
     operationId: string;
     call: ToolCall;
+    executionIdentity?: string;
 }): string;
 /**
  * Identifies a fully bounded preparation attempt that could not become a

package/dist/src/runtime/adapters/registered-tool-normal-invocations/shared/action-fingerprint.js

@@ -10,6 +10,7 @@ export function createRegisteredToolActionFingerprint(input) {
         input.operationId,
         input.call.tool,
         canonicalEntries(input.call.params),
+        ...(input.executionIdentity === undefined ? [] : [input.executionIdentity]),
     ]);
     return `sha256:${createHash("sha256").update(canonical).digest("hex")}`;
 }

package/dist/src/runtime/adapters/registered-tool-normal-invocations/shared/contracts.d.ts

@@ -1,6 +1,8 @@
+import type { BoundApprovalDecision } from "../../../orchestration/worker-capabilities/approval-contracts.js";
 import type { ToolEventExecutorIdentity } from "./event-metadata.js";
+import type { RequestToolResources } from "../../../capabilities/request-tool-resources.js";
 import type { RegisteredToolNormalInvocation, ToolActionSummary, ToolExecutionResult, ToolExecutionSharedState, ToolNormalInvocationEffect, ToolNormalInvocationOperation } from "../../../../capabilities/tool-types.js";
-import type { ToolApprovalController, ToolPermissionMode, ToolRegistry } from "../../../ports.js";
+import type { ToolApprovalController, ToolApprovalRequest, ToolPermissionMode, ToolRegistry } from "../../../ports.js";
 import type { RegisteredToolPayloadContextPlan, RegisteredToolStagedPayloadPlan } from "../../registered-tool-payload-plan.js";
 /**
  * Opaque request-scoped authority for one config-filtered ordinary operation.
@@ -34,6 +36,9 @@ export type RegisteredToolNormalInvocationExecution = Readonly<{
 export type RegisteredToolNormalInvocationResult = RegisteredToolNormalInvocationExecution | RegisteredToolNormalInvocationRejection;
 export type RegisteredToolPreparedNormalInvocation = Readonly<{
     status: "prepared";
+    snapshot: unknown;
+    approvalRequest?: ToolApprovalRequest;
+    applyApprovalDecision(decision: BoundApprovalDecision): void;
     /** Opaque identity of the exact normalized call that would be executed. */
     actionFingerprint: string;
     /** Exact validated non-payload controls accepted for this invocation. */
@@ -62,6 +67,7 @@ export type RegisteredToolPreparedNormalInvocationPayloadLifecycle = Readonly<{
 export type RegisteredToolNormalInvocationPayloadLifecyclePreparation = RegisteredToolPreparedNormalInvocationPayloadLifecycle | RegisteredToolNormalInvocationRejection;
 export type RegisteredToolNormalInvocationExecutor = Readonly<{
     operations: readonly RegisteredToolNormalInvocationProjection[];
+    restore(snapshot: unknown): RegisteredToolNormalInvocationPreparation;
     /** Prepares client-only rejection reporting for a registered source handle. */
     prepareRejectionEvent(input: Readonly<{
         handle: RegisteredToolNormalInvocationHandle;
@@ -130,6 +136,7 @@ export type BoundOperation = Readonly<{
     stagedPayloadPlan?: RegisteredToolStagedPayloadPlan;
 }>;
 export type RegisteredToolNormalInvocationExecutorParams = Readonly<{
+    toolResources?: RequestToolResources;
     registrations: readonly RegisteredToolNormalInvocation[];
     toolRegistry: Pick<ToolRegistry, "execute">;
     requestId: string;

package/dist/src/runtime/adapters/registered-tool-worker-capabilities/contracts.d.ts

@@ -1,8 +1,10 @@
+import type { RequestToolResources } from "../../capabilities/request-tool-resources.js";
 import type { RegisteredToolNormalInvocation, ToolExecutionRequestContext, ToolNormalInvocationOperation } from "../../../capabilities/tool-types.js";
 import type { WorkerCapabilityDescriptor, WorkerCapabilityPayloadAuthor } from "../../orchestration/worker-capabilities/index.js";
 import type { ToolApprovalController, ToolPermissionMode, ToolRegistry } from "../../ports.js";
 import type { RegisteredToolStagedPayloadPlan } from "../registered-tool-payload-plan.js";
 export type RegisteredToolWorkerCapabilityProviderParams = Readonly<{
+    toolResources?: RequestToolResources;
     /**
      * Must return the already config-filtered, request-bound registry. The
      * callback is first invoked when a caller requests the public descriptor

package/dist/src/runtime/adapters/registered-tool-worker-capabilities/execution.js

@@ -1,8 +1,12 @@
+import { createTechnicalExecutionFailureResult } from "../../orchestration/worker-capabilities/execution/adapter-result-normalization.js";
+import { createWorkerCapabilityExecutionErrorOutcomeFingerprint } from "../../orchestration/worker-capabilities/outcome-fingerprint.js";
+import { createPreparedWorkerInvocation } from "./prepared-execution.js";
+import { restorePreparedWorkerInvocation, createPreparedRejectionSnapshot, } from "./prepared-snapshot.js";
 import { assertWorkerCapabilityWithinScope, projectWorkerCapabilityScope, WorkerCapabilityScopeError, } from "../../orchestration/worker-capabilities/index.js";
 import { traceRegisteredToolWorkerCapabilityExecutionCompleted, traceRegisteredToolWorkerCapabilityExecutionFailed, traceRegisteredToolWorkerCapabilityExecutionStarted, } from "../registered-tool-worker-capability-diagnostics.js";
 import { RegisteredToolWorkerCapabilityCompositionError, RegisteredToolWorkerCapabilityExecutionError, } from "./errors.js";
-import { executionFreshnessRejection, payloadRejection, prepareOperationPayload, } from "./payload-lifecycle.js";
-import { attachTargetReferences, observeExternalResult, projectSelectedTargetReferences, } from "./result-observer.js";
+import { payloadRejection, prepareOperationPayload, } from "./payload-lifecycle.js";
+import { attachTargetReferences, projectSelectedTargetReferences, } from "./result-observer.js";
 import { resolveEffectiveOperationTargetControls } from "./runtime-path-controls.js";
 import { createRegisteredToolPreparationAttemptFingerprint } from "../registered-tool-normal-invocations/shared/action-fingerprint.js";
 import { createWorkerCapabilityPreparationFailureFingerprint } from "../../orchestration/worker-capabilities/preparation-fingerprint.js";
@@ -45,6 +49,9 @@ function createWorkerAdapter(params) {
         async prepare(input) {
             return prepareRegisteredToolWorkerAdapter(params, input);
         },
+        async restore(input, snapshot) {
+            return restorePreparedWorkerInvocation(params, input, snapshot);
+        },
         async execute(input) {
             const preparationInput = Object.freeze({
                 ...input,
@@ -77,17 +84,17 @@ async function prepareRegisteredToolWorkerAdapter(params, input) {
                 : {}),
             error,
         });
+        const failedResult = {
+            ...createTechnicalExecutionFailureResult(error),
+            failureOutcomeFingerprint: createWorkerCapabilityExecutionErrorOutcomeFingerprint(error) ?? null,
+        };
         return Object.freeze({
             ...(actionFingerprint ? { actionFingerprint } : {}),
             acceptedControls: input.controls,
+            snapshot: createPreparedRejectionSnapshot(operationId, actionFingerprint, input.controls, failedResult),
+            onAdmitted: payloadObservability.release,
             execute: async (executionId) => {
-                try {
-                    payloadObservability.release(executionId);
-                }
-                catch (releaseError) {
-                    tracePreparedExecutionFailed(params, input, operationId, executionId, releaseError);
-                    throw releaseError;
-                }
+                payloadObservability.release(executionId);
                 tracePreparedExecutionFailed(params, input, operationId, executionId, error, registeredPreparationFailureIssueCode(error));
                 throw error;
             },
@@ -179,55 +186,7 @@ async function prepareRegisteredToolWorkerCapability(params, input, payloadObser
                 : { materializedParams: preparedPayload.materializedParams }),
         });
     }
-    return Object.freeze({
-        actionFingerprint: normalPreparation.actionFingerprint,
-        acceptedControls: normalPreparation.acceptedControls,
-        execute: async (executionId) => {
-            try {
-                payloadObservability.release(executionId);
-                tracePreparedExecutionStarted(params, input, operationId, executionId);
-                const rejectedExecution = executionFreshnessRejection(input.executionFreshness);
-                if (rejectedExecution) {
-                    normalPreparation.emitRejection({
-                        executionId,
-                        executorIdentity: input.call,
-                        errorCode: rejectedExecution.sourceIssueCode,
-                    });
-                    return completeRuntimeRejection({
-                        params,
-                        input,
-                        operationId,
-                        executionId,
-                        selectedTargetReferences,
-                        rejectedExecution,
-                    });
-                }
-                const externalResult = await normalPreparation.execute(executionId, input.call);
-                const observed = observeExternalResult(externalResult, params.projection.operation.effect, input.call.parentCallId === null);
-                const observedResult = attachTargetReferences(observed.result, selectedTargetReferences);
-                traceRegisteredToolWorkerCapabilityExecutionCompleted(params.diagnostic, operationId, input.call, executionId, observedResult, externalResult.status, {
-                    ...(observed.sourceIssueCode
-                        ? { sourceIssueCode: observed.sourceIssueCode }
-                        : {}),
-                    summaryProjection: externalResult.status === "executed" &&
-                        observedResult.outcome === "succeeded" &&
-                        observedResult.observedEffect === "mutation"
-                        ? externalResult.completionActions.length > 0
-                            ? "logical_completion_actions"
-                            : "mutation_evidence_only"
-                        : "bounded_external_result",
-                    completionActions: externalResult.status === "executed"
-                        ? externalResult.completionActions
-                        : Object.freeze([]),
-                });
-                return observedResult;
-            }
-            catch (error) {
-                tracePreparedExecutionFailed(params, input, operationId, executionId, error);
-                throw error;
-            }
-        },
-    });
+    return createPreparedWorkerInvocation(params, input, normalPreparation, selectedTargetReferences, payloadObservability);
 }
 function preparedRuntimeRejection(input) {
     return Object.freeze({
@@ -241,6 +200,19 @@ function preparedRuntimeRejection(input) {
                 : { materializedParams: input.materializedParams }),
         }),
         acceptedControls: input.effectiveControls,
+        snapshot: createPreparedRejectionSnapshot(input.operationId, createRegisteredToolPreparationAttemptFingerprint({
+            operationId: input.operationId,
+            controls: input.effectiveControls,
+            rejectionCode: input.rejectedExecution.sourceIssueCode,
+            ...(input.payload === undefined ? {} : { payload: input.payload }),
+            ...(input.materializedParams === undefined
+                ? {}
+                : { materializedParams: input.materializedParams }),
+        }), input.effectiveControls, attachTargetReferences({
+            ...input.rejectedExecution.result,
+            exactResult: input.rejectedExecution.exactResult,
+        }, input.selectedTargetReferences)),
+        onAdmitted: input.payloadObservability.release,
         execute: async (executionId) => {
             try {
                 input.payloadObservability.release(executionId);

package/dist/src/runtime/adapters/registered-tool-worker-capabilities/payload-observability.js

@@ -25,7 +25,7 @@ export function createDeferredPayloadObservability(params) {
             });
         },
         release(executionId) {
-            for (const publish of deferred)
+            for (const publish of deferred.splice(0))
                 publish(executionId);
         },
     });

package/dist/src/runtime/adapters/registered-tool-worker-capabilities/prepared-execution.d.ts

@@ -0,0 +1,17 @@
+import type { RoleCallFrame } from "../../orchestration/role-calls/index.js";
+import type { WorkerCapabilityPreparedExecution, WorkerCapabilityExecutionFreshness, WorkerCapabilityDescriptor } from "../../orchestration/worker-capabilities/index.js";
+import type { RegisteredToolNormalInvocationProjection, RegisteredToolPreparedNormalInvocation } from "../registered-tool-normal-invocations.js";
+import { type RegisteredToolWorkerCapabilityProviderDiagnostic } from "../registered-tool-worker-capability-diagnostics.js";
+import { projectSelectedTargetReferences } from "./result-observer.js";
+export declare function createPreparedWorkerInvocation(params: {
+    projection: RegisteredToolNormalInvocationProjection;
+    descriptor: WorkerCapabilityDescriptor;
+    diagnostic: RegisteredToolWorkerCapabilityProviderDiagnostic;
+}, input: {
+    call: RoleCallFrame;
+    intent: string;
+    controls: Readonly<Record<string, unknown>>;
+    executionFreshness?: WorkerCapabilityExecutionFreshness;
+}, normalPreparation: RegisteredToolPreparedNormalInvocation, selectedTargetReferences: ReturnType<typeof projectSelectedTargetReferences>, payloadObservability: {
+    release(executionId: string): void;
+}): WorkerCapabilityPreparedExecution;

package/dist/src/runtime/adapters/registered-tool-worker-capabilities/prepared-execution.js

@@ -0,0 +1,65 @@
+import { traceRegisteredToolWorkerCapabilityExecutionStarted, traceRegisteredToolWorkerCapabilityExecutionCompleted, traceRegisteredToolWorkerCapabilityExecutionFailed, } from "../registered-tool-worker-capability-diagnostics.js";
+import { executionFreshnessRejection } from "./payload-lifecycle.js";
+import { RegisteredToolWorkerCapabilityExecutionError } from "./errors.js";
+import { observeExternalResult, attachTargetReferences, } from "./result-observer.js";
+export function createPreparedWorkerInvocation(params, input, normalPreparation, selectedTargetReferences, payloadObservability) {
+    const operationId = params.projection.operation.operationId;
+    return Object.freeze({
+        actionFingerprint: normalPreparation.actionFingerprint,
+        acceptedControls: normalPreparation.acceptedControls,
+        snapshot: Object.freeze({
+            kind: "registered_worker_invocation_v1",
+            capabilityId: operationId,
+            normal: normalPreparation.snapshot,
+            selectedTargetReferences,
+        }),
+        ...(normalPreparation.approvalRequest
+            ? { approvalRequest: normalPreparation.approvalRequest }
+            : {}),
+        applyApprovalDecision: normalPreparation.applyApprovalDecision,
+        onAdmitted: payloadObservability.release,
+        execute: async (executionId) => {
+            try {
+                payloadObservability.release(executionId);
+                traceRegisteredToolWorkerCapabilityExecutionStarted(params.diagnostic, operationId, input.call, executionId, input.intent.length, Object.keys(input.controls).length);
+                const rejectedExecution = executionFreshnessRejection(input.executionFreshness);
+                if (rejectedExecution) {
+                    normalPreparation.emitRejection({
+                        executionId,
+                        executorIdentity: input.call,
+                        errorCode: rejectedExecution.sourceIssueCode,
+                    });
+                    return attachTargetReferences({
+                        ...rejectedExecution.result,
+                        exactResult: rejectedExecution.exactResult,
+                    }, selectedTargetReferences);
+                }
+                const externalResult = await normalPreparation.execute(executionId, input.call);
+                const observed = observeExternalResult(externalResult, params.projection.operation.effect, input.call.parentCallId === null);
+                const observedResult = attachTargetReferences(observed.result, selectedTargetReferences);
+                traceRegisteredToolWorkerCapabilityExecutionCompleted(params.diagnostic, operationId, input.call, executionId, observedResult, externalResult.status, {
+                    ...(observed.sourceIssueCode
+                        ? { sourceIssueCode: observed.sourceIssueCode }
+                        : {}),
+                    summaryProjection: externalResult.status === "executed" &&
+                        observedResult.outcome === "succeeded" &&
+                        observedResult.observedEffect === "mutation"
+                        ? externalResult.completionActions.length > 0
+                            ? "logical_completion_actions"
+                            : "mutation_evidence_only"
+                        : "bounded_external_result",
+                    completionActions: externalResult.status === "executed"
+                        ? externalResult.completionActions
+                        : Object.freeze([]),
+                });
+                return observedResult;
+            }
+            catch (error) {
+                traceRegisteredToolWorkerCapabilityExecutionFailed(params.diagnostic, operationId, input.call, executionId, error, error instanceof RegisteredToolWorkerCapabilityExecutionError
+                    ? error.issueCode
+                    : "execution_failed");
+                throw error;
+            }
+        },
+    });
+}

package/dist/src/runtime/adapters/registered-tool-worker-capabilities/prepared-snapshot.d.ts

@@ -0,0 +1,15 @@
+import type { WorkerCapabilityAdapterRestoreInput, WorkerCapabilityAdapterResult, WorkerCapabilityPreparedExecution } from "../../orchestration/worker-capabilities/index.js";
+import { createPreparedWorkerInvocation } from "./prepared-execution.js";
+type Params = Parameters<typeof createPreparedWorkerInvocation>[0] & {
+    executor: import("../registered-tool-normal-invocations.js").RegisteredToolNormalInvocationExecutor;
+};
+export declare function createPreparedRejectionSnapshot(capabilityId: string, actionFingerprint: string, acceptedControls: Readonly<Record<string, unknown>>, result: WorkerCapabilityAdapterResult): Readonly<{
+    kind: string;
+    capabilityId: string;
+    actionFingerprint: string;
+    acceptedControls: Readonly<Record<string, unknown>>;
+    result: WorkerCapabilityAdapterResult;
+}>;
+/** Owning adapter hydration: no normalization, payload author, or external call. */
+export declare function restorePreparedWorkerInvocation<TContext>(params: Params, input: WorkerCapabilityAdapterRestoreInput<TContext>, snapshot: unknown): Promise<WorkerCapabilityPreparedExecution>;
+export {};