@archmax-ai/harness 0.9.0 → 1.0.1

package/dist/env.d.ts

@@ -66,11 +66,11 @@ export declare function loadPromptCacheEnv(): {
  */
 export declare function loadPricingEnv(): PricingTable | undefined;
 /**
- * The role a model plays in the runtime: the workflow `agent` (turns), a `judge`
- * (the offline case grader), or a `rubric` (a grading rubric dispatched by a
- * lifecycle hook). A {@link ModelFactory} may return a different model per role.
+ * The role a model plays in the runtime: the workflow `agent` (the session's
+ * turns), a `judge` (the offline case grader), or a `grader` (a grader state's
+ * subagent). A {@link ModelFactory} may return a different model per role.
  */
-export type ModelRole = "agent" | "judge" | "rubric";
+export type ModelRole = "agent" | "judge" | "grader";
 /**
  * Supplies the chat model for a given role, so library users can run the runtime
  * against any LangChain `BaseChatModel` (e.g. Amazon Bedrock via
@@ -86,11 +86,11 @@ export type ModelRole = "agent" | "judge" | "rubric";
  */
 export type ModelFactory = (role: ModelRole, env: () => AgentEnv, 
 /**
- * The model id the caller asked for — today, the `model` a grading rubric
- * declares. Additive: a factory that ignores it behaves exactly as one written
- * before rubrics could name a model, and no error is raised for an unhonoured
- * request. The default factory applies it over `ARCHMAX_MODEL`, keeping the
- * configured endpoint and credentials.
+ * The model id the caller asked for — the `model` a state declares (or its
+ * workflow's `settings.model`), for the `agent` and `grader` roles. Additive: a
+ * factory that ignores it returns its own model, and no error is raised for an
+ * unhonoured request. The default factory applies it over `ARCHMAX_MODEL`,
+ * keeping the configured endpoint and credentials.
  */
 requested?: string) => BaseChatModel;
 /** The default, role-independent model factory: the env-configured `ChatOpenAI`. */

package/dist/index.d.ts

@@ -13,7 +13,7 @@
  * is here because a real consumer needs it, not because a module happened to
  * expose it. Adjacent surfaces live on their own subpaths — `@archmax-ai/harness/testing`
  * (the case engine), `@archmax-ai/harness/cli` (the state-flow renderer), and
- * `@archmax-ai/harness/sandbox` (hook and script authoring) — so a production import never
+ * `@archmax-ai/harness/sandbox` (code-state script authoring) — so a production import never
  * pulls in test machinery.
  *
  * Two **light** subpaths mirror part of this surface without the runtime behind
@@ -200,7 +200,7 @@ export { isAiMessage } from "./core/messages.js";
 export { lastAgentText } from "./core/messages.js";
 /**
  * Whether the runtime wrote a transcript message rather than a person — a
- * decision, an arrival, an error route, a completion check, a child's result.
+ * decision, an arrival, an error route, an automated state's move, a child's result.
  * A host slicing a turn out of a session's messages, or rendering a transcript,
  * asks this instead of inferring authorship from role.
  */
@@ -208,16 +208,12 @@ export { isRuntimeNote } from "./core/messages.js";
 /** Which kind of runtime note a message is, or `null` if a person wrote it. */
 export { runtimeNoteKind } from "./core/messages.js";
 export type { RuntimeNoteKind } from "./core/messages.js";
-/** One grading rubric, as declared inline on the hook that applies it. */
-export type { RubricDeclaration } from "./machine/types.js";
-/** Host data the runtime never reads, at the spec root, on a state, or on a rubric. */
+/** Host data the runtime never reads, at the spec root or on a state. */
 export type { SpecMetadata } from "./machine/types.js";
 /** Parse a sandbox script's leading description block. */
 export { parseCodeDescription } from "./core/code-description.js";
 /** Load and shape-check a `workflow.yaml` without assembling an agent. */
 export { loadMachineSpec } from "./machine/load-spec.js";
-/** A `before:`/`after:` declaration as a flat list of hooks. */
-export { normalizeHooks } from "./lifecycle/hook-shape.js";
 export type { MachineSpec, MachineState } from "./machine/types.js";
 /** The compiled machine, as `agent.workflow.machine` exposes it. */
 export { WorkflowMachine } from "./machine/machine.js";

package/dist/index.js

@@ -13,7 +13,7 @@
  * is here because a real consumer needs it, not because a module happened to
  * expose it. Adjacent surfaces live on their own subpaths — `@archmax-ai/harness/testing`
  * (the case engine), `@archmax-ai/harness/cli` (the state-flow renderer), and
- * `@archmax-ai/harness/sandbox` (hook and script authoring) — so a production import never
+ * `@archmax-ai/harness/sandbox` (code-state script authoring) — so a production import never
  * pulls in test machinery.
  *
  * Two **light** subpaths mirror part of this surface without the runtime behind
@@ -134,7 +134,7 @@ export { isAiMessage } from "./core/messages.js";
 export { lastAgentText } from "./core/messages.js";
 /**
  * Whether the runtime wrote a transcript message rather than a person — a
- * decision, an arrival, an error route, a completion check, a child's result.
+ * decision, an arrival, an error route, an automated state's move, a child's result.
  * A host slicing a turn out of a session's messages, or rendering a transcript,
  * asks this instead of inferring authorship from role.
  */
@@ -146,8 +146,6 @@ export { parseCodeDescription } from "./core/code-description.js";
 // --- The machine --------------------------------------------------------------
 /** Load and shape-check a `workflow.yaml` without assembling an agent. */
 export { loadMachineSpec } from "./machine/load-spec.js";
-/** A `before:`/`after:` declaration as a flat list of hooks. */
-export { normalizeHooks } from "./lifecycle/hook-shape.js";
 /** The compiled machine, as `agent.workflow.machine` exposes it. */
 export { WorkflowMachine } from "./machine/machine.js";
 /** Statically validate a workflow scaffold — no model calls. */

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,iFAAiF;AAEjF;;;;;GAKG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,qDAAqD;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA+C1C;;;GAGG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO;AACL,0FAA0F;AAC1F,aAAa;AACb,iEAAiE;AACjE,aAAa,GACd,MAAM,qBAAqB,CAAC;AAqB7B,iFAAiF;AACjF,EAAE;AACF,gFAAgF;AAChF,yDAAyD;AAEzD,OAAO;AACL,6EAA6E;AAC7E,iBAAiB;AACjB,iFAAiF;AACjF,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,iDAAiD;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,0FAA0F;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,8FAA8F;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,6DAA6D;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,0CAA0C;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO;AACL,gEAAgE;AAChE,yBAAyB;AACzB,yEAAyE;AACzE,mBAAmB;AACnB,8EAA8E;AAC9E,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AACjC,OAAO;AACL,iEAAiE;AACjE,4BAA4B;AAC5B,0FAA0F;AAC1F,0BAA0B,GAC3B,MAAM,6BAA6B,CAAC;AACrC,8EAA8E;AAC9E,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO;AACL,qEAAqE;AACrE,qBAAqB;AACrB,oEAAoE;AACpE,0BAA0B;AAC1B,sCAAsC;AACtC,iBAAiB;AACjB,mEAAmE;AACnE,oBAAoB;AACpB,8DAA8D;AAC9D,4BAA4B;AAC5B,uCAAuC;AACvC,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,8DAA8D;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,iFAAiF;AAEjF,+DAA+D;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,yDAAyD;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAItD,OAAO;AACL,0DAA0D;AAC1D,4BAA4B;AAC5B,4DAA4D;AAC5D,yBAAyB;AACzB,gEAAgE;AAChE,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AAIjC,oFAAoF;AACpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,4GAA4G;AAC5G,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,oFAAoF;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,iHAAiH;AACjH,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAKxD;;;GAGG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAGrE,sGAAsG;AACtG,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,gFAAgF;AAChF,EAAE;AACF,iFAAiF;AACjF,2DAA2D;AAE3D,mFAAmF;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,sEAAsE;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AASzD,oEAAoE;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,iDAAiD;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,+FAA+F;AAC/F,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD;;;;;GAKG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,+EAA+E;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAMrD,0DAA0D;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,iFAAiF;AAEjF,0EAA0E;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,gEAAgE;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,oEAAoE;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,gEAAgE;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAM1D;;;;GAIG;AACH,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,yBAAyB,CAAC;AAEjC,gFAAgF;AAEhF,OAAO;AACL,uCAAuC;AACvC,cAAc;AACd,kFAAkF;AAClF,kBAAkB;AAClB,gHAAgH;AAChH,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAE/B,mFAAmF;AACnF,EAAE;AACF,8EAA8E;AAC9E,wEAAwE;AAExE,OAAO;AACL,+CAA+C;AAC/C,eAAe;AACf,8EAA8E;AAC9E,kBAAkB;AAClB,0DAA0D;AAC1D,mBAAmB;AACnB,iDAAiD;AACjD,mBAAmB;AACnB,4EAA4E;AAC5E,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAOhC,gDAAgD;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO;AACL,4CAA4C;AAC5C,oBAAoB;AACpB,oDAAoD;AACpD,gBAAgB;AAChB,0DAA0D;AAC1D,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AAWjC,iFAAiF;AAEjF,kEAAkE;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,yDAAyD;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG9C,iFAAiF;AACjF,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+CAA+C;AAE/C,8DAA8D;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO;AACL;;;GAGG;AACH,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AAClB,8DAA8D;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,iFAAiF;AAEjF;;;;;GAKG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,qDAAqD;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA+C1C;;;GAGG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO;AACL,0FAA0F;AAC1F,aAAa;AACb,iEAAiE;AACjE,aAAa,GACd,MAAM,qBAAqB,CAAC;AAqB7B,iFAAiF;AACjF,EAAE;AACF,gFAAgF;AAChF,yDAAyD;AAEzD,OAAO;AACL,6EAA6E;AAC7E,iBAAiB;AACjB,iFAAiF;AACjF,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,iDAAiD;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,0FAA0F;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,8FAA8F;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,6DAA6D;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,0CAA0C;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO;AACL,gEAAgE;AAChE,yBAAyB;AACzB,yEAAyE;AACzE,mBAAmB;AACnB,8EAA8E;AAC9E,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AACjC,OAAO;AACL,iEAAiE;AACjE,4BAA4B;AAC5B,0FAA0F;AAC1F,0BAA0B,GAC3B,MAAM,6BAA6B,CAAC;AACrC,8EAA8E;AAC9E,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO;AACL,qEAAqE;AACrE,qBAAqB;AACrB,oEAAoE;AACpE,0BAA0B;AAC1B,sCAAsC;AACtC,iBAAiB;AACjB,mEAAmE;AACnE,oBAAoB;AACpB,8DAA8D;AAC9D,4BAA4B;AAC5B,uCAAuC;AACvC,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,8DAA8D;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,iFAAiF;AAEjF,+DAA+D;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,yDAAyD;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAItD,OAAO;AACL,0DAA0D;AAC1D,4BAA4B;AAC5B,4DAA4D;AAC5D,yBAAyB;AACzB,gEAAgE;AAChE,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AAIjC,oFAAoF;AACpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,4GAA4G;AAC5G,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,oFAAoF;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,iHAAiH;AACjH,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAKxD;;;GAGG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAGrE,sGAAsG;AACtG,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,gFAAgF;AAChF,EAAE;AACF,iFAAiF;AACjF,2DAA2D;AAE3D,mFAAmF;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,sEAAsE;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AASzD,oEAAoE;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,iDAAiD;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,+FAA+F;AAC/F,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD;;;;;GAKG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,+EAA+E;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAIrD,0DAA0D;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,iFAAiF;AAEjF,0EAA0E;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,oEAAoE;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,gEAAgE;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAM1D;;;;GAIG;AACH,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,yBAAyB,CAAC;AAEjC,gFAAgF;AAEhF,OAAO;AACL,uCAAuC;AACvC,cAAc;AACd,kFAAkF;AAClF,kBAAkB;AAClB,gHAAgH;AAChH,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAE/B,mFAAmF;AACnF,EAAE;AACF,8EAA8E;AAC9E,wEAAwE;AAExE,OAAO;AACL,+CAA+C;AAC/C,eAAe;AACf,8EAA8E;AAC9E,kBAAkB;AAClB,0DAA0D;AAC1D,mBAAmB;AACnB,iDAAiD;AACjD,mBAAmB;AACnB,4EAA4E;AAC5E,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAOhC,gDAAgD;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO;AACL,4CAA4C;AAC5C,oBAAoB;AACpB,oDAAoD;AACpD,gBAAgB;AAChB,0DAA0D;AAC1D,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AAWjC,iFAAiF;AAEjF,kEAAkE;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,yDAAyD;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG9C,iFAAiF;AACjF,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+CAA+C;AAE/C,8DAA8D;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO;AACL;;;GAGG;AACH,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AAClB,8DAA8D;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC"}

package/dist/kernel/kernel.d.ts

@@ -3,14 +3,13 @@ import type { ForbidEntry } from "../machine/types.js";
 import type { VariableStore } from "../machine/variables.js";
 import { type MountPrefixes } from "../core/mounts.js";
 import { type SkillPrefixes } from "../core/skills.js";
-import type { LifecycleDecision } from "../lifecycle/runner.js";
 /**
  * The decision kernel: a single pure, synchronous function that produces every
  * governance verdict from the machine spec, a snapshot of checkpointed workflow
- * state, and a proposed action. Effectful work (running hooks/judges) happens in
- * `LifecycleRunner`; its outputs are reduced here as {@link HookFact}s so the
- * kernel stays pure and both runtime enforcement and static validation share one
- * code path.
+ * state, and a proposed action — a tool call or a transition. Effectful work
+ * (running a code state's script, a grader) happens elsewhere and asks the
+ * kernel about each call and move it makes, so runtime enforcement and static
+ * validation share one code path.
  */
 export type VerdictDecision = "allow" | "block";
 export interface Verdict {
@@ -28,38 +27,22 @@ export interface Verdict {
     reason?: string;
     /** Tool-call blocks: whether the block should surface as a warn-level event. */
     warn?: boolean;
-    /** Transition reductions: whether the deciding hook consumed one of its iterations. */
-    correctionConsumed?: boolean;
-    /**
-     * Transition reductions: whether the block is a `correct` refused because the
-     * hook's `max_iterations` are already spent. Retrying in place cannot clear
-     * it, so the runner reports it as a terminal rejection.
-     */
-    budgetExhausted?: boolean;
-}
-/**
- * A reduced lifecycle-hook outcome. `LifecycleRunner` executes a hook, parses
- * its return value into a {@link LifecycleDecision}, and hands it here (with an
- * optional `error` when the hook could not execute) for reduction.
- */
-export interface HookFact extends LifecycleDecision {
-    /** Present when the hook could not execute; reduces to a fail-closed veto. */
-    error?: string;
-    /** Bounded grade-and-retry budget for an `after` hook of any kind (0 = none). */
-    maxIterations?: number;
-    /** Iterations already consumed for this state. */
-    iterationsUsed?: number;
 }
 /**
- * Who initiated a tool call. `agent` (the default) is a call the model made
- * directly; `script` is a programmatic call from a sandbox script, governed
- * identically to an agent call in the same state; `lifecycle` is a programmatic
- * call from a lifecycle hook (and the runtime's own `file` value check), which
- * runs on runtime authority: outside the active state's surface — its allow and
- * forbid lists, its skill and mount grants — but held to its workflow's mount
- * grants, its workflow-wide denials and every safety rule.
+ * Who initiated a tool call, which decides the authority it runs on:
+ *
+ *  - `agent` (the default): a model's call — the session's agent in an agent
+ *    state, the grader in a grader state;
+ *  - `script`: a programmatic call from a sandbox script — the agent's
+ *    `archmax_eval`/`archmax_run`, or a code state's script — governed exactly as
+ *    a model's call in the same state;
+ *  - `runtime`: the runtime's own read of a `file` value, on runtime authority:
+ *    outside the active state's surface — its allow and forbid lists, its skill
+ *    and mount grants — but held to its workflow's mount grants, its
+ *    workflow-wide denials and every safety rule. No script or model ever runs
+ *    on it.
  */
-export type ToolCallOrigin = "agent" | "script" | "lifecycle";
+export type ToolCallOrigin = "agent" | "script" | "runtime";
 export type ProposedAction = {
     kind: "tool-call";
     state: string;
@@ -78,12 +61,9 @@ export type ProposedAction = {
     from: string;
     to: string;
     reason?: string;
-    hookFacts: HookFact[];
-} | {
-    kind: "enter-state";
-    state: string;
-    hookFacts: HookFact[];
 };
+/** The variables a state still owes before it may be left — its `requires` minus what is set. */
+export declare function unmetRequirements(required: string[], store: VariableStore): string[];
 /** Read-only context a governance rule may consult. */
 export interface RuleApi {
     machine: WorkflowMachine;
@@ -113,10 +93,13 @@ export interface RuleApi {
  */
 export type GovernanceRule = (action: ProposedAction, api: RuleApi) => Verdict | null;
 /**
- * Agent tools that scripts may never invoke through programmatic tool calling
- * (PTC): every harness control tool (including both sandbox entry points, so
- * sandboxed code cannot re-enter the sandbox) plus a bare `eval`. Owned by
- * governance so the interpreter and the lifecycle runner cannot drift.
+ * Tools an **agent state's** scripts (`archmax_eval`, `archmax_run`) may never
+ * invoke through programmatic tool calling (PTC): every harness control tool
+ * (including both sandbox entry points, so sandboxed code cannot re-enter the
+ * sandbox) plus a bare `eval`. Moving the machine and writing its variables is
+ * the model's own governed decision there; the script reads the variables via
+ * `args.variables`. A code state is the exception by construction: its script
+ * *is* the state, so it is handed its state's controls as its own tools.
  */
 export declare const PTC_EXCLUDED_TOOLS: ReadonlySet<string>;
 /**
@@ -125,19 +108,6 @@ export declare const PTC_EXCLUDED_TOOLS: ReadonlySet<string>;
  * `core/zones.ts` so runtime, mount routing, and validation agree.
  */
 export declare function isReadOnlyZonePath(path: string, mounts?: MountPrefixes): boolean;
-/**
- * Reduce a single lifecycle-hook fact to a verdict. Fail-closed: an execution
- * error is a veto. `before` hooks gate entry with `ok`/`veto` only — a `correct`
- * at entry has nothing to retry, so it reduces to a veto and never consumes the
- * correction budget. Within an `after` veto window any hook's `correct` (script
- * or subagent judge alike) enters the same bounded correction flow, budgeted by
- * the hook's `max_corrections`.
- */
-export declare function reduceHookFact(fact: HookFact, opts: {
-    phase: "before" | "after" | "tool";
-    veto: boolean;
-    to?: string;
-}): Verdict;
 /**
  * An **ancestor's** `mounts.forbid_always`, as rules the descendant inherits.
  * The mount twin of {@link compileForbiddenSkillRules}: a child machine resolves
@@ -145,8 +115,8 @@ export declare function reduceHookFact(fact: HookFact, opts: {
  * a rule — any path under one of those mounts is refused, whatever the child
  * granted itself, and the refusal names the workflow that denied it.
  *
- * A workflow-wide denial binds a hook and a rubric grader too, so this rule
- * binds the `lifecycle` origin as well.
+ * A workflow-wide denial binds the runtime's own reads too, so this rule binds
+ * the `runtime` origin as well.
  */
 export declare function compileForbiddenMountRules(names: readonly string[], source: string): GovernanceRule[];
 /**
@@ -154,9 +124,9 @@ export declare function compileForbiddenMountRules(names: readonly string[], sou
  * `tools.forbid_always`, `skills.forbid_always` and `mounts.forbid_always`,
  * named with the workflow that declared them. A per-state `forbid` is not
  * inherited — it governs that state's turns, not a child session — and neither
- * is any grant. Compiled as rules, they bind the `lifecycle` origin too, so a
- * descendant's hooks and the runtime's reads on a child's behalf are held to
- * them. A workflow's own lists bind its own hooks through the kernel's rules.
+ * is any grant. Compiled as rules, they bind every origin, so a descendant's
+ * automated states and the runtime's reads on a child's behalf are held to
+ * them.
  */
 export declare function workflowDenials(machine: WorkflowMachine, source: string): GovernanceRule[];
 /**

package/dist/kernel/kernel.js

@@ -2,31 +2,33 @@ import { ADVANCE_TOOL, DEFAULT_TOOLS, HARNESS_CONTROL_TOOLS, EVAL_TOOL, SET_VARI
 import { FORBID_ANY_TOOL } from "../machine/spec-schema.js";
 import { argsSatisfy, normalizeAllowEntry, pathGuardMatches, } from "../machine/allow.js";
 import { BUILT_IN_TOOL_PATH_TABLE, declaredPathsOf, malformedPathArgs, MUTATING_ACCESSES, OFFLOAD_ACCESSES, pathArgNamesOf, pathValuesOf, SCRATCHPAD_ACCESSES, } from "../machine/tool-paths.js";
-import { unmetRequirements } from "../workflow/control-tools.js";
 import { canonicalizeRelPath } from "../core/workspace.js";
 import { classifyWorkspacePath, mountNameOf, SESSION_INTERNAL_DIRS, SESSION_OFFLOAD_DIRS, SESSION_OPEN_DIR, } from "../core/zones.js";
 import { NO_MOUNTS } from "../core/mounts.js";
 import { NO_SKILLS, skillOfPath } from "../core/skills.js";
 import { authoringPlanePrefix, describeAuthoringPrefix } from "../core/mounts.js";
-import { rubricTransitionOutcome } from "../rubrics/rubrics.js";
+/** The variables a state still owes before it may be left — its `requires` minus what is set. */
+export function unmetRequirements(required, store) {
+    return required.filter((name) => store[name] === undefined);
+}
 /**
- * Agent tools that scripts may never invoke through programmatic tool calling
- * (PTC): every harness control tool (including both sandbox entry points, so
- * sandboxed code cannot re-enter the sandbox) plus a bare `eval`. Owned by
- * governance so the interpreter and the lifecycle runner cannot drift.
+ * Tools an **agent state's** scripts (`archmax_eval`, `archmax_run`) may never
+ * invoke through programmatic tool calling (PTC): every harness control tool
+ * (including both sandbox entry points, so sandboxed code cannot re-enter the
+ * sandbox) plus a bare `eval`. Moving the machine and writing its variables is
+ * the model's own governed decision there; the script reads the variables via
+ * `args.variables`. A code state is the exception by construction: its script
+ * *is* the state, so it is handed its state's controls as its own tools.
  */
 export const PTC_EXCLUDED_TOOLS = new Set([
-    // Moving the state machine is the model's governed decision, and a script
-    // that could *write* variables would be editing the governance inputs of the
-    // state it judges (scripts read them via the `args.variables` snapshot).
     ...HARNESS_CONTROL_TOOLS,
     "eval",
 ]);
 const EVAL_BLOCK_MESSAGE = `[workflow] BLOCKED: an unnamespaced \`eval\` tool is never governed — use ` +
     `\`${EVAL_TOOL}\`, the runtime's own code interpreter.`;
-const TASK_BLOCK_MESSAGE = `[workflow] BLOCKED: \`task\` is the runtime's own dispatch for grading rubrics, not a tool ` +
-    `a state may call. A rubric grades your work; you do not call it. To delegate work to another ` +
-    `process, use the workflow's declared \`archmax_workflow_<slug>\` tool.`;
+const TASK_BLOCK_MESSAGE = `[workflow] BLOCKED: \`task\` is Deep Agents' subagent dispatch, not a tool a state may call. ` +
+    `To delegate work to another process, use the workflow's declared \`archmax_workflow_<slug>\` ` +
+    `tool; work is graded by a grader state the workflow declares, never by you.`;
 const ALLOW = { decision: "allow", ruleId: "allow" };
 /**
  * The workspace paths a call names, from the tool's declared path arguments
@@ -70,64 +72,6 @@ function normalizeZonePath(path) {
 export function isReadOnlyZonePath(path, mounts) {
     return classifyWorkspacePath(path, mounts) === "authored";
 }
-/**
- * Reduce a single lifecycle-hook fact to a verdict. Fail-closed: an execution
- * error is a veto. `before` hooks gate entry with `ok`/`veto` only — a `correct`
- * at entry has nothing to retry, so it reduces to a veto and never consumes the
- * correction budget. Within an `after` veto window any hook's `correct` (script
- * or subagent judge alike) enters the same bounded correction flow, budgeted by
- * the hook's `max_corrections`.
- */
-export function reduceHookFact(fact, opts) {
-    if (fact.error != null) {
-        return { decision: "block", ruleId: "hook.error", reason: fact.error };
-    }
-    if (fact.verdict === "ok")
-        return { decision: "allow", ruleId: "hook.ok" };
-    if (opts.phase === "before") {
-        const reason = fact.verdict === "correct"
-            ? `before hooks cannot request corrections ('correct' gates nothing at entry, treated as veto): ${fact.reason}`
-            : fact.reason;
-        return { decision: "block", ruleId: "hook.veto", reason };
-    }
-    if (opts.phase === "after" && opts.veto) {
-        const outcome = rubricTransitionOutcome(fact, {
-            maxIterations: fact.maxIterations ?? 0,
-            iterationsUsed: fact.iterationsUsed ?? 0,
-            to: opts.to,
-        });
-        if (outcome.reason) {
-            return {
-                decision: "block",
-                ruleId: fact.rubric ? "hook.rubric" : "hook.veto",
-                reason: outcome.reason,
-                // Only a block that actually granted a retry spends one, and only a
-                // `correct` refused for want of budget is unretryable.
-                correctionConsumed: outcome.consumesIteration,
-                budgetExhausted: outcome.budgetExhausted,
-            };
-        }
-        return { decision: "allow", ruleId: fact.rubric ? "hook.rubric" : "hook.ok" };
-    }
-    if (opts.veto) {
-        return {
-            decision: "block",
-            ruleId: "hook.veto",
-            reason: fact.reason,
-            correctionConsumed: false,
-        };
-    }
-    return { decision: "allow", ruleId: "hook.noop" };
-}
-/** Reduce an ordered list of hook facts, short-circuiting on the first block. */
-function reduceHookFacts(facts, opts) {
-    for (const fact of facts) {
-        const verdict = reduceHookFact(fact, opts);
-        if (verdict.decision !== "allow")
-            return verdict;
-    }
-    return ALLOW;
-}
 /** The `not allowed in this state` block verdict shared by the tool-governance rules. */
 function notAllowedVerdict(machine, state, tool, args) {
     const target = typeof args.file_path === "string" ? ` on '${args.file_path}'` : "";
@@ -172,11 +116,11 @@ const evalBlockRule = (action) => {
     return { decision: "block", ruleId: "tool.eval", reason: EVAL_BLOCK_MESSAGE, warn: false };
 };
 /**
- * Safety rule: `task` is never callable by the agent. Registered rubrics make the
- * framework provide the tool so the *runtime* has a runnable to dispatch through;
- * that is not a grant. Non-overridable, so no state entry, `allow_always` or
- * consumer rule can re-open it — which is why disclosure withholding it and this
- * rule refusing it are two independent gates on the same fact.
+ * Safety rule: `task` is never callable. Deep Agents registers it whatever the
+ * assembly passes; that is not a grant. Non-overridable, so no state entry,
+ * `allow_always` or consumer rule can re-open it — which is why disclosure
+ * withholding it and this rule refusing it are two independent gates on the
+ * same fact.
  */
 const taskBlockRule = (action) => {
     if (action.kind !== "tool-call" || !UNGRANTABLE_TOOLS.has(action.tool))
@@ -260,7 +204,7 @@ const runtimeManagedRule = (action, api) => {
  * rules, and the per-state `allow` default, so no declaration can reach into a
  * capability the state was not given; a `tools.allow` entry may only narrow
  * *within* the enabled set. `script` origin is bound (model authority); a
- * `lifecycle`-origin call runs on runtime authority, outside the enabled set,
+ * `runtime`-origin call runs on runtime authority, outside the enabled set,
  * and is held only to its workflow's own `skills.forbid_always`
  * ({@link runtimeSkillVerdict}).
  */
@@ -270,7 +214,7 @@ const skillRule = (action, api) => {
     const skills = api.skills ?? NO_SKILLS;
     if (skills.length === 0)
         return null;
-    const verdictOf = action.origin === "lifecycle" ? runtimeSkillVerdict : skillVerdict;
+    const verdictOf = action.origin === "runtime" ? runtimeSkillVerdict : skillVerdict;
     for (const path of pathsOf(action, api)) {
         const verdict = verdictOf(action, path, api, skills);
         if (verdict)
@@ -279,9 +223,9 @@ const skillRule = (action, api) => {
     return null;
 };
 /**
- * {@link skillRule} for one path of a call on runtime authority: a hook reads any
- * bundle whatever the enabled set, except one its workflow's `skills.forbid_always`
- * denies. A state's `skills.forbid` does not bind it.
+ * {@link skillRule} for one path of a call on runtime authority: the runtime reads
+ * any bundle whatever the enabled set, except one its workflow's
+ * `skills.forbid_always` denies. A state's `skills.forbid` does not bind it.
  */
 function runtimeSkillVerdict(action, path, api, skills) {
     const slug = skillOfPath(path.path, skills);
@@ -352,7 +296,7 @@ function skillVerdict(action, path, api, skills) {
  *
  * Evaluated after the zone rules, so a *write* into a hidden read-only mount is
  * refused as read-only — the more useful reason — whether or not the state has
- * the mount. Non-overridable. A `lifecycle`-origin call runs on runtime
+ * the mount. Non-overridable. A `runtime`-origin call runs on runtime
  * authority, so it is decided on its **workflow**'s grants instead of the
  * state's ({@link runtimeMountVerdict}): outside the state's surface, never
  * outside the workflow's.
@@ -360,7 +304,7 @@ function skillVerdict(action, path, api, skills) {
 const mountRule = (action, api) => {
     if (action.kind !== "tool-call")
         return null;
-    const verdictOf = action.origin === "lifecycle" ? runtimeMountVerdict : mountVerdict;
+    const verdictOf = action.origin === "runtime" ? runtimeMountVerdict : mountVerdict;
     for (const path of pathsOf(action, api)) {
         const verdict = verdictOf(action, path, api);
         if (verdict)
@@ -371,9 +315,9 @@ const mountRule = (action, api) => {
 /**
  * {@link mountRule} for one path of a call on runtime authority. One table serves
  * a session and every child it dispatches, so it holds mounts other workflows in
- * the tree grant: a hook reaches a governed mount only where some grant of its
- * own workflow names it, in any state, and writes it only where the workflow
- * asks to. The workflow's own `mounts.forbid_always` binds it; a state's
+ * the tree grant: the runtime reads a governed mount only where some grant of
+ * its own workflow names it, in any state, and writes it only where the
+ * workflow asks to. The workflow's own `mounts.forbid_always` binds it; a state's
  * `mounts.allow`, `mounts.forbid` and `access: read` do not.
  */
 function runtimeMountVerdict(action, path, api) {
@@ -396,8 +340,8 @@ function runtimeMountVerdict(action, path, api) {
             decision: "block",
             ruleId: "mount.not-allowed",
             reason: `[workflow] BLOCKED: ${on} is under the mount '${name}', which no grant of this ` +
-                `workflow names. A hook reaches a governed mount only where its workflow grants it, ` +
-                `in 'mounts.allow_always' or a state's 'mounts.allow'.`,
+                `workflow names. The runtime reaches a governed mount only where its workflow grants ` +
+                `it, in 'mounts.allow_always' or a state's 'mounts.allow'.`,
             warn: true,
         };
     }
@@ -473,8 +417,8 @@ function mountVerdict(action, path, api) {
  * a rule — any path under one of those mounts is refused, whatever the child
  * granted itself, and the refusal names the workflow that denied it.
  *
- * A workflow-wide denial binds a hook and a rubric grader too, so this rule
- * binds the `lifecycle` origin as well.
+ * A workflow-wide denial binds the runtime's own reads too, so this rule binds
+ * the `runtime` origin as well.
  */
 export function compileForbiddenMountRules(names, source) {
     if (names.length === 0)
@@ -508,9 +452,9 @@ export function compileForbiddenMountRules(names, source) {
  * `tools.forbid_always`, `skills.forbid_always` and `mounts.forbid_always`,
  * named with the workflow that declared them. A per-state `forbid` is not
  * inherited — it governs that state's turns, not a child session — and neither
- * is any grant. Compiled as rules, they bind the `lifecycle` origin too, so a
- * descendant's hooks and the runtime's reads on a child's behalf are held to
- * them. A workflow's own lists bind its own hooks through the kernel's rules.
+ * is any grant. Compiled as rules, they bind every origin, so a descendant's
+ * automated states and the runtime's reads on a child's behalf are held to
+ * them.
  */
 export function workflowDenials(machine, source) {
     return [
@@ -606,9 +550,9 @@ const runOpenAccessRule = (action, api) => {
 const stateToolsRule = (action, { machine, variables }) => {
     if (action.kind !== "tool-call")
         return null;
-    // Lifecycle hooks run on harness authority, so the state's grant does not
-    // bind them; every other rule in the pipeline still does.
-    if (action.origin === "lifecycle")
+    // The runtime's own reads run on runtime authority, so the state's grant does
+    // not bind them; every other rule in the pipeline still does.
+    if (action.origin === "runtime")
         return null;
     const { state, tool, args } = action;
     let unresolved;
@@ -640,10 +584,10 @@ function unresolvedGuardVerdict(state, tool, failure) {
 }
 /**
  * Safety rule: `archmax_run` executes only scripts that live inside a skill bundle.
- * Hook scripts (run by the lifecycle runner from the authoring plane) and runtime
- * scripts (run by the agent from a skill bundle) are disjoint by construction: an
- * agent cannot run its own guard, a file it wrote into the run zone, or another
- * workflow's hooks. Classification uses the resolved skill registry rather than a
+ * A code state's script (run by the runtime from the authoring backend) and an
+ * agent's scripts (run from a skill bundle) are disjoint by construction: an
+ * agent cannot run a code state's script, a file it wrote into the run zone, or
+ * another workflow's scripts. Classification uses the resolved skill registry rather than a
  * literal `skills/` string, so an empty registry blocks every `archmax_run`.
  *
  * Non-overridable: evaluated with the safety rules, ahead of `policy`, consumer
@@ -661,8 +605,8 @@ const scriptSkillOnlyRule = (action, api) => {
         ruleId: "script.skill-only",
         reason: `[workflow] BLOCKED: '${action.tool}' may only execute scripts that live in a skill bundle, ` +
             `and '${path.path}' is not in one. Scripts the agent runs belong in ` +
-            `'skills/<capability>/scripts/'; lifecycle hook scripts live on the authoring plane and are ` +
-            `run by the harness, never by the agent.`,
+            `'skills/<capability>/scripts/'; a code state's script lives in its workflow's 'scripts/' ` +
+            `and is run by the runtime, never by the agent.`,
         warn: true,
     };
 };
@@ -690,14 +634,14 @@ const pathArgumentRule = (action, api) => {
  * Safety rule: the authoring plane is not addressable. Every
  * {@link AUTHORING_PREFIXES} prefix (`workflows/**`) has no route
  * in the agent's workspace composite, so an agent read finds nothing; a
- * **script** or **hook** naming one is told why, and which prefix. Applies in
+ * **script** or a **runtime** read naming one is told why, and which prefix. Applies in
  * every state whatever it allows — the plane's isolation is structural, not
  * granted.
  */
 const governancePlaneRule = (action, api) => {
     if (action.kind !== "tool-call")
         return null;
-    if (action.origin !== "script" && action.origin !== "lifecycle")
+    if (action.origin !== "script" && action.origin !== "runtime")
         return null;
     // A tool that declares no paths is still read by its conventional path
     // argument here: the plane's isolation does not wait on a declaration.
@@ -781,6 +725,10 @@ export function compileForbidRules(entries, options) {
                 return null;
             if (scope === "state" && action.state !== state)
                 return null;
+            // A state's own denial governs that state's surface, which a read on
+            // runtime authority runs outside of; only workflow-wide denials bind it.
+            if (scope === "state" && action.origin === "runtime")
+                return null;
             const guards = argMatchers ? describeGuards(normalized) : null;
             if (argMatchers && !denialMatches(normalized, action, api))
                 return null;
@@ -884,8 +832,8 @@ export function decide(machine, action, customRules = [], mountPrefixes = NO_MOU
         case "tool-call":
             return decideToolCall(machine, action, customRules, mountPrefixes, variables, skills);
         case "transition": {
-            // The `requires` gate runs before the edge's hooks: the agent owes a value
-            // it can still supply, so a judge on incomplete work would be wasted.
+            // The `requires` gate runs before the edge: the state owes a value it can
+            // still supply, which is the more useful refusal.
             const unmet = unmetRequirements(machine.requiredVariables(action.from), variables ?? {});
             if (unmet.length > 0) {
                 return {
@@ -908,14 +856,8 @@ export function decide(machine, action, customRules = [], mountPrefixes = NO_MOU
                             : "No transitions from this state."),
                 };
             }
-            return reduceHookFacts(action.hookFacts, {
-                phase: "after",
-                veto: true,
-                to: action.to,
-            });
+            return ALLOW;
         }
-        case "enter-state":
-            return reduceHookFacts(action.hookFacts, { phase: "before", veto: false });
     }
 }
 //# sourceMappingURL=kernel.js.map