@arnilo/prism 0.1.4 → 0.1.6

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [0.1.6] - 2026-08-11
+
+### Changed
+- **Release 0.1.6 (plan 018)** is the coding-agent capability-closeouts patch on the frozen 0.1.x line — five demand-gated closeouts, all shipped, additive-only vs 0.1.5 (freeze manifest `scripts/phase18-freeze-manifest.json`; every closeout flipped to `demanded` by named demand evidence before its task landed, then the demand-gate registry validated demanded ⇒ implemented, deferred ⇒ untouched). (1) **Durable ACP session store** (`acp-session-store`): `@arnilo/prism-ag-ui` gains the host-owned `AcpSessionStore` seam on `CreatePrismAcpAgentOptions` — `save` (upsert on session/new, set_mode, set_config_option, never on cancel/prompt-end), `loadAll` (lazy, once per agent instance, after authorization, cross-tenant entries refused `ERR_PRISM_ACP_INPUT`), `evict` (on close/delete); the persisted entry shape `{sessionId, ownership, modeId, configValues, cwd, additionalDirectories, updatedAt}` deliberately excludes client/controller/budget/pending state; fail-closed restore drops corrupt/oversized entries, re-validates modes/config options, keeps the in-memory registry caps (32 default / 128 hard), and re-resolves the live session binding; absent seam = byte-identical 0.1.5 in-memory behavior; the whole persisted entry rides the optional `SecretRedactor` at the save boundary. (2) **Network-free native sandbox backend** (`native-sandbox`): `@arnilo/prism-coding-security` gains `createNativeSandbox` — spawn + POSIX rlimits + existing path containment, zero new dependencies; every command runs in a fresh network namespace via the OS `unshare` binary (plain or `--map-root-user` preflighted once at creation, fail-closed on macOS/Windows and where netns cannot be created), ulimit chains (`-v`/`-t`/`-n`) with `|| exit 126`, argv-only `exec` (never shell-interpolated), cwd containment via `assertPathInsideRoots`, process-group kill on timeout/abort, env allow-list (host env never inherited), output cap, `close({export})` tar parity, and a documented honest boundary (runs as the invoking OS user; egress denial + rlimits + cwd containment only). (3) **Bounded PDF/Office document reader** (`doc-reader`): new optional package `@arnilo/prism-document-reader` (the 50th publishable manifest) — `createDocumentReader({ maxBytes, maxPages, maxTextBytes, parsers })` behind optional peer parsers `pdf-parse`/`mammoth` (dynamic-import, fail-closed at creation with an install hint when absent), magic-byte format gating (never extension sniffing), null fall-through to the 0.1.5 text path, refuse-over-truncate for over-page PDFs, byte-safe text truncation, optional `SecretRedactor` at the adapter boundary, no embedded-content execution, no external resource fetch (egress tripwire test), extraction envelope recorded in `scripts/budgets.json`; `createReadTool` gains the additive `documentReader` slot with input/page/text caps re-checked in the read flow. (4) **Recursive delete + brace-expanding glob** (`delete-glob`): `delete` gains the per-call opt-in `recursive: true` (symlink children unlinked never followed, iterative post-order walk, per-call fan-out cap 10,000 default / 100,000 hard, partial deletion reported never silent, `maxEntries` bound); `glob` gains host-selected + per-call `braceExpansion` (`{a,b}` textual expansion, max 128 alternatives / 4096 expanded bytes, unbalanced/nested/empty braces and overflow fail closed, default matcher semantics unchanged). (5) **Checkpoint persistence for loaded-skill bodies** (`checkpoint-bodies`): durable runs may set `includeSkillBodies: true` on BOTH run and resume options (alongside `persistSessionState`) — the exact loaded-skill instructions ride the checkpoint (`{name, instructions}` pairs, ≤64 bodies / ≤256-char names / ≤262144-byte bodies / ≤1 MiB total, validated fail-closed on save and load, redacted at rest) so resume re-renders them registry-independently with no `load_skill` round-trip; names-only stays the default and 0.1.3/0.1.2 checkpoint shapes are byte-identical; `maxStateBytes` refuses oversize bodies with a recorded error, never truncates. Release graph **50** publishable manifests (root + 49 workspace packages — 14 provider adapters, 9 `prism-*` family/profile, 26 capability incl. `@arnilo/prism-document-reader`) at exact **0.1.6**. Exit gate green (core 1,433/1,433 + 190 script gates incl. phase18-freeze done-phase, `sdk:ready`, audit 0 moderate, pack dry-run 50/50 twice byte-identical, plain compat gate at 0.1.6 with 0 breaking deltas then version-literal baseline refresh, evidence in `scripts/phase18-baseline.json`). Store compatibility with 0.1.5: **compatible, no migration** (additive-only; no persisted-shape change). **Publication remains the operator handoff** (`docs/release-and-install.md` `0.1.6 publish handoff` — signed `v0.1.6` tag + npm OIDC).
+
+## [0.1.5] - 2026-08-11
+
+### Changed
+- **Release 0.1.5 (plan 017)** is the **documented breaking cut** on the frozen 0.1.x line — deprecated-option removal with the full removed-symbols list, replacements, before/after examples, dynamic-config refusal behavior, store compatibility, and rollback in the top `docs/migration.md` `0.1.4 → 0.1.5` section (three stale roadmap labels corrected there: `RunOptions.maxToolRounds` not `AgentConfig.maxToolRounds`, `autoResizeImages` removed with `transformImage` retained, `INIT_PROVIDERS` removed with `listInitProviders()` retained). (1) **Provider run-option aliases** (Task 1): `ProviderRequestOptions.timeoutMs`/`maxRetries`/`maxRetryDelayMs` (inert in first-party providers; host-side abort/retry is the replacement — `RunOptions.signal`, `AgentConfig.retry`/`RunOptions.retry`) and `RunOptions.maxToolRounds` (→ `limits.maxToolRounds`, defaults/caps unchanged) removed; untyped legacy run input is refused at the `runInternal` choke point before the agent starts; CLI `--max-tool-rounds` maps to the nested limit. (2) **Observational-memory compatibility surface** (Task 2): the 10 pre-0.0.19 flat settings keys and top-level `workerProvider`/`workerModel` aliases removed — settings resolution is nested-only with `assertNoRemovedFlatKeys` failing closed (settings-provider JSON or untyped overrides throw naming the key + nested replacement before any worker/provider call, compaction, or session append); `fallbackWorker`/`assertWorkerModelCompatibility`/`conflict()` deleted; workers resolve only from `observation`/`reflection`/`dropper` configs plus `sessionModel` fallback. (3) **Read alias + CLI constant** (Task 3): `ReadToolOptions.autoResizeImages` removed (`transformImage` is the only resize path; untyped callers fail closed at `createReadTool` before filesystem access) and `INIT_PROVIDERS` removed (`listInitProviders()` is the single provider-list API). Compat baselines regenerated after the reviewed `--allow-break` break report (root `arnilo__prism.txt` drops the `INIT_PROVIDERS` line; interface-member removals are verified by the phase-17 direct declaration scanner, not baseline text). Exit gate green (core tests + script gates incl. phase17-freeze 20/20, `sdk:ready`, audit 0, pack dry-run 49/49 twice byte-identical, evidence in `scripts/phase17-baseline.json`). Store compatibility with 0.1.4: **compatible, no migration** (removed options were inert aliases; rollback = restore the 0.1.4 manifests/tag). **Publication remains the operator handoff** (`docs/release-and-install.md` `0.1.5 publish handoff` — signed `v0.1.5` tag + npm OIDC).
+
 ## [0.1.4] - 2026-08-10
 
 ### Changed

package/dist/agent-run-lifecycle.d.ts

@@ -20,6 +20,8 @@ export interface AgentRunLifecycleRequest {
     readonly agentId?: string;
     /** Opt-in (plan 015 Task 4): restore persisted loaded-skill names on resume. */
     readonly persistSessionState?: boolean;
+    /** Opt-in (plan 018 Task 6): restore persisted loaded-skill bodies on resume (requires `persistSessionState` too). */
+    readonly includeSkillBodies?: boolean;
 }
 /** Bounded live-event options for a durable lifecycle resume. */
 export interface AgentRunLifecycleStreamRequest extends AgentRunLifecycleRequest, SubscribeOptions {

package/dist/agent-run-lifecycle.js

@@ -28,6 +28,7 @@ export function createAgentRunLifecycle(options) {
                 fencingToken: options.fencingToken,
                 definitionRevision: resolved.definitionRevision,
                 persistSessionState: request.persistSessionState,
+                includeSkillBodies: request.includeSkillBodies,
             });
         },
         async *resumeStream(ref, resume, request = {}) {
@@ -45,6 +46,7 @@ export function createAgentRunLifecycle(options) {
                 maxQueuedEvents: request.maxQueuedEvents,
                 overflow: request.overflow,
                 persistSessionState: request.persistSessionState,
+                includeSkillBodies: request.includeSkillBodies,
             });
         },
     };
@@ -95,6 +97,11 @@ async function prepareAgentRunResume(agent, ref, resume, options, signal) {
     if (options.persistSessionState && state.sessionState?.loadedSkillNames) {
         session.restoreLoadedSkills(state.sessionState.loadedSkillNames);
     }
+    // Plan 018 Task 6 (closeout `checkpoint-bodies`): restore exact instructions so the
+    // resumed session renders them registry-independently (no load_skill round-trip).
+    if (options.persistSessionState && options.includeSkillBodies && state.sessionState?.loadedSkillBodies) {
+        session.restoreLoadedSkillBodies(state.sessionState.loadedSkillBodies);
+    }
     if (resume.decision !== undefined && resume.decisions !== undefined) {
         throw new AgentDecisionError("ERR_PRISM_DECISION_INVALID", "Resume accepts exactly one of decision or decisions");
     }

package/dist/agent-run-state.d.ts

@@ -1,5 +1,6 @@
 import type { Agent, AgentRunInterruption, AgentRunRef, AgentRunState, AgentRunStateOptions, AgentRunStatusResult, CheckpointRecord, CheckpointStore, JsonValue, Message, ModelConfig, NestedRunRef, OwnershipScope, RunDecision, RunLimitCounters, StickyDecision, ToolCallContent } from "./contracts.js";
 import type { SecretRedactor } from "./redaction.js";
+import { type LoadedSkillBodiesEntry } from "./skill-load.js";
 export declare const AGENT_RUN_STATE_NAMESPACE = "prism.agent-run";
 export declare const AGENT_RUN_STATE_SCHEMA_VERSION: 1;
 export declare const DEFAULT_MAX_AGENT_RUN_STATE_BYTES: number;
@@ -41,6 +42,7 @@ export interface StoredAgentRunState extends AgentRunState {
      */
     readonly sessionState?: {
         readonly loadedSkillNames?: readonly string[];
+        readonly loadedSkillBodies?: readonly LoadedSkillBodiesEntry[];
     };
 }
 /** Session-state caps (plan 015 Task 4): bounded names charged against the run-state byte budget. */

package/dist/agent-run-state.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { AgentLoopStateError, AgentRunStateError } from "./contracts.js";
+import { validateLoadedSkillBodies } from "./skill-load.js";
 export const AGENT_RUN_STATE_NAMESPACE = "prism.agent-run";
 export const AGENT_RUN_STATE_SCHEMA_VERSION = 1;
 export const DEFAULT_MAX_AGENT_RUN_STATE_BYTES = 256 * 1024;
@@ -241,6 +242,15 @@ function validateSessionState(sessionState) {
     if (!sessionState || typeof sessionState !== "object") {
         throw new AgentRunStateError("Malformed agent run session state");
     }
+    const bodies = sessionState.loadedSkillBodies;
+    if (bodies !== undefined) {
+        try {
+            validateLoadedSkillBodies(bodies);
+        }
+        catch (error) {
+            throw new AgentRunStateError(error instanceof Error ? error.message : String(error));
+        }
+    }
     const names = sessionState.loadedSkillNames;
     if (names === undefined)
         return;

package/dist/agent-session.d.ts

@@ -1,6 +1,7 @@
 import { type StoredAgentRunState } from "./agent-run-state.js";
 import type { Agent, AgentConfig, AgentEvent, AgentRunResult, AgentRunStateOptions, AgentSession, AgentSessionConfig, CompactionOptions, CompactionResult, OwnershipScope, RunDecision, RunOptions, SessionEntry, SteerOptions, SubscribeOptions } from "./contracts.js";
 import { type AgentInput } from "./input.js";
+import { type LoadedSkillBodiesEntry } from "./skill-load.js";
 export declare function createAgent(config: AgentConfig): Agent;
 export declare function createAgentSession(config: AgentSessionConfig & {
     readonly agent: Agent;
@@ -36,8 +37,14 @@ export declare class RuntimeAgentSession implements AgentSession {
     private activeGatedRound?;
     private activeLoopTurn;
     private readonly loadedSkills;
+    /** Plan 018 Task 6 (closeout `checkpoint-bodies`): persisted exact instructions, registry-independent. */
+    private restoredSkillBodies;
+    /** Skills of the current run (for the bodies snapshot); replaced at each run start. */
+    private activeRunSkills;
     /** Plan 015 Task 4: re-add persisted loaded-skill names (names only; bodies re-resolve on demand). */
     restoreLoadedSkills(names: readonly string[]): void;
+    /** Plan 018 Task 6: restore persisted loaded-skill bodies (already validated fail-closed at load). */
+    restoreLoadedSkillBodies(bodies: readonly LoadedSkillBodiesEntry[]): void;
     private ledgerChain;
     private ledgerFailure;
     private snapshotGeneration;

package/dist/agent-session.js

@@ -16,6 +16,7 @@ import { RunLimitError, RunLimitTracker, resolveRunLimits } from "./run-limits.j
 import { createMemorySessionStore, createSessionEntry, getSessionBranchEntries, rebuildSessionContext, } from "./session-stores.js";
 import { resolveActiveSkills } from "./skills.js";
 import { createLoadedSkillSet, resolveSkillsDisclosure } from "./skill-disclosure.js";
+import { applyRestoredSkillBodies, snapshotLoadedSkillBodies, validateLoadedSkillBodies, } from "./skill-load.js";
 import { resolveToolResultFold } from "./tool-result-fold.js";
 import { assertStructuredOutputRequestSupported, resolveRunProviderOptions } from "./structured-output.js";
 import { composeSystemPrompt, mergeSystemPromptConfig } from "./system-prompts.js";
@@ -65,11 +66,22 @@ export class RuntimeAgentSession {
     activeGatedRound;
     activeLoopTurn = 1;
     loadedSkills = createLoadedSkillSet();
+    /** Plan 018 Task 6 (closeout `checkpoint-bodies`): persisted exact instructions, registry-independent. */
+    restoredSkillBodies = [];
+    /** Skills of the current run (for the bodies snapshot); replaced at each run start. */
+    activeRunSkills = [];
     /** Plan 015 Task 4: re-add persisted loaded-skill names (names only; bodies re-resolve on demand). */
     restoreLoadedSkills(names) {
         for (const name of names)
             this.loadedSkills.add(name);
     }
+    /** Plan 018 Task 6: restore persisted loaded-skill bodies (already validated fail-closed at load). */
+    restoreLoadedSkillBodies(bodies) {
+        validateLoadedSkillBodies(bodies);
+        this.restoredSkillBodies = bodies;
+        for (const entry of bodies)
+            this.loadedSkills.add(entry.name);
+    }
     ledgerChain = Promise.resolve();
     ledgerFailure;
     snapshotGeneration = 0;
@@ -156,6 +168,13 @@ export class RuntimeAgentSession {
         }
     }
     async runInternal(input, options, runId, resumed) {
+        // 0.1.5 breaking cut: the deprecated RunOptions.maxToolRounds alias was removed. Reject
+        // untyped/legacy input fail-closed before any session mutation, provider call, or tool
+        // execution; silently honoring it would widen or mis-apply the intended tool-round cap.
+        const legacyMaxToolRounds = options.maxToolRounds;
+        if (legacyMaxToolRounds !== undefined) {
+            throw new TypeError("RunOptions.maxToolRounds was removed in 0.1.5; use RunOptions.limits.maxToolRounds instead");
+        }
         if (this.agent.config.secure &&
             (options.redactor !== undefined ||
                 options.ownership !== undefined ||
@@ -164,9 +183,7 @@ export class RuntimeAgentSession {
                 options.runState !== undefined)) {
             throw new AgentRunStateError("Secure agent defaults cannot be replaced per run");
         }
-        const requestedLimits = options.maxToolRounds === undefined
-            ? options.limits
-            : { ...options.limits, maxToolRounds: Math.min(options.maxToolRounds, options.limits?.maxToolRounds ?? options.maxToolRounds) };
+        const requestedLimits = options.limits;
         const resolvedLimits = resolveRunLimits(this.agent.config.limits, requestedLimits);
         const durableOptions = options.runState ?? this.agent.config.runState;
         if (this.agent.config.runState && options.runState && this.agent.config.runState !== options.runState) {
@@ -250,6 +267,7 @@ export class RuntimeAgentSession {
             await this.rebuildHistory();
             const { registry, tools } = activeTools(this.agent.config.tools);
             const activeSkills = this.resolveRunSkills(options, tools);
+            this.activeRunSkills = activeSkills; // for the durable bodies snapshot (plan 018 Task 6)
             if (options.model && JSON.stringify(options.model) !== JSON.stringify(this.agent.config.model)) {
                 await this.appendEntry(createSessionEntry({
                     sessionId: this.id,
@@ -459,7 +477,7 @@ export class RuntimeAgentSession {
                         inputBuilder: this.agent.config.inputBuilder,
                         promptBuilder: this.agent.config.promptBuilder,
                         contextProviders,
-                        skills: activeSkills,
+                        skills: this.restoredSkillBodies.length ? applyRestoredSkillBodies(activeSkills, this.restoredSkillBodies) : activeSkills,
                         skillsDisclosure: resolveSkillsDisclosure(options.skillsDisclosure, this.agent.config.skillsDisclosure),
                         toolResultFold: resolveToolResultFold(options.toolResultFold, this.agent.config.toolResultFold),
                         loadedSkills: this.loadedSkills,
@@ -1103,7 +1121,17 @@ export class RuntimeAgentSession {
         if (!durable)
             throw new AgentRunStateError("Durable run state is not configured");
         const persisted = durable.options.persistSessionState
-            ? { ...state, sessionState: { loadedSkillNames: this.loadedSkills.list() } }
+            ? {
+                ...state,
+                sessionState: {
+                    loadedSkillNames: this.loadedSkills.list(),
+                    ...(durable.options.includeSkillBodies
+                        ? {
+                            loadedSkillBodies: snapshotLoadedSkillBodies(this.activeRunSkills, this.loadedSkills, this.restoredSkillBodies.length ? new Map(this.restoredSkillBodies.map((e) => [e.name, e.instructions])) : undefined),
+                        }
+                        : {}),
+                },
+            }
             : state;
         const saved = await saveAgentRunState({
             checkpoints: durable.options.checkpoints,

package/dist/cli-init.d.ts

@@ -30,8 +30,6 @@ export interface InitResult {
 }
 /** Provider ids supported by `prism init --provider`. Loaded from templates data. */
 export declare function listInitProviders(templatesRoot?: string): readonly string[];
-/** @deprecated Prefer listInitProviders(); retained for tests that import the name. */
-export declare const INIT_PROVIDERS: readonly string[];
 export declare function getInitUsage(templatesRoot?: string): string;
 export declare const initUsage: string;
 export declare function parseInitArgs(argv: readonly string[], templatesRoot?: string): InitOptions;

package/dist/cli-init.js

@@ -34,8 +34,6 @@ export function listInitProviders(templatesRoot) {
         return cachedProviderIds;
     return Object.freeze([...loadProvidersCatalog(templatesRoot).keys()]);
 }
-/** @deprecated Prefer listInitProviders(); retained for tests that import the name. */
-export const INIT_PROVIDERS = listInitProviders();
 export function getInitUsage(templatesRoot) {
     const providers = listInitProviders(templatesRoot).join("|");
     return `Usage: prism init <dir> [options]

package/dist/cli-runner.js

@@ -340,7 +340,7 @@ function defaultCreateSession(options) {
 }
 function runOptions(options) {
     return {
-        maxToolRounds: options.maxToolRounds,
+        ...(options.maxToolRounds !== undefined ? { limits: { maxToolRounds: options.maxToolRounds } } : {}),
         compaction: options.compact ? { thresholdEntries: options.compact } : undefined,
         // ponytail: --discover is the explicit opt-in that activates discovered skills.
         ...(options.discover && !options.noDiscovery && options.discoveredSkills.length > 0

package/dist/contracts-core.d.ts

@@ -234,12 +234,6 @@ export interface ProviderRequestOptions {
     readonly cacheKey?: string;
     readonly cache?: PromptCacheHints;
     readonly headers?: Readonly<Record<string, string>>;
-    /** @deprecated Provider-level timeout is inert in first-party providers; pass an AbortSignal/RunOptions.signal instead. */
-    readonly timeoutMs?: number;
-    /** @deprecated Provider-level retry is inert in first-party providers; use AgentConfig.retry/RunOptions.retry instead. */
-    readonly maxRetries?: number;
-    /** @deprecated Provider-level retry is inert in first-party providers; use AgentConfig.retry/RunOptions.retry instead. */
-    readonly maxRetryDelayMs?: number;
     readonly compat?: JsonObject;
     readonly extra?: JsonObject;
     /** Provider-neutral JSON-schema structured output request. Requires model `capabilities.structuredOutput`. */

package/dist/contracts-protocol.d.ts

@@ -62,8 +62,6 @@ export interface RunOptions {
     readonly signal?: AbortSignal;
     readonly model?: ModelConfig;
     readonly providerSource?: ProviderResolver;
-    /** @deprecated Use `limits.maxToolRounds`. */
-    readonly maxToolRounds?: number;
     /** Run-scoped ceilings. When an agent config also sets limits, these can only narrow it. */
     readonly limits?: RunLimits;
     readonly providerOptions?: ProviderRequestOptions;

package/dist/contracts-run-state.d.ts

@@ -156,6 +156,17 @@ export interface AgentRunStateOptions {
      * Default off: checkpoint shape is identical to 0.1.2.
      */
     readonly persistSessionState?: boolean;
+    /**
+     * Opt-in (plan 018 Task 6 closeout `checkpoint-bodies`): alongside
+     * `persistSessionState`, persist the exact loaded-skill instructions
+     * (`{name, instructions}` pairs, redacted at the checkpoint boundary like all state)
+     * so resume re-renders them registry-independently — no `load_skill` round-trip, no
+     * drift when the live registry changed or lost the skill. Both the run and the resume
+     * options must set it. Bounds: ≤64 bodies, ≤256-char names, ≤262144-byte bodies,
+     * ≤1 MiB total; the `maxStateBytes` ceiling refuses oversize with a recorded error
+     * (never silently truncates). Default off: checkpoint shape is identical to 0.1.3.
+     */
+    readonly includeSkillBodies?: boolean;
 }
 /** Versioned, redacted checkpoint payload. Treat as opaque except status/version/interruption. */
 export interface AgentRunState {
@@ -188,6 +199,8 @@ export interface AgentRunResumeOptions {
     readonly resumeNestedRun?: ResumeNestedRun;
     /** Opt-in (plan 015 Task 4): restore persisted loaded-skill names into the resumed session catalog. */
     readonly persistSessionState?: boolean;
+    /** Opt-in (plan 018 Task 6): restore persisted loaded-skill bodies (requires `persistSessionState` too). */
+    readonly includeSkillBodies?: boolean;
 }
 /** Bounded, abortable options for `resumeAgentRunStream()`. */
 export interface AgentRunResumeStreamOptions extends AgentRunResumeOptions, SubscribeOptions {

package/dist/index.d.ts

@@ -86,8 +86,8 @@ export { createMemorySessionStore, createSessionEntry, getSessionBranchEntries,
 export { createChainedSettingsProvider, createStaticSettingsProvider } from "./settings.js";
 export type { LoadedSkillSet, SkillRenderContext, SkillsDisclosure } from "./skill-disclosure.js";
 export { createLoadedSkillSet, DEFAULT_MAX_SKILL_CATALOG_ENTRIES, DEFAULT_MAX_SKILL_DESCRIPTION_BYTES, DEFAULT_MAX_SKILL_INSTRUCTION_BYTES, EMPTY_SKILL_DESCRIPTION, HARD_MAX_SKILL_CATALOG_ENTRIES, HARD_MAX_SKILL_DESCRIPTION_BYTES, HARD_MAX_SKILL_INSTRUCTION_BYTES, isSkillDisclosureError, resolveSkillsDisclosure, SkillDisclosureError, } from "./skill-disclosure.js";
-export type { CreateLoadSkillToolOptions, ResolveSkillLoadOptions } from "./skill-load.js";
-export { createLoadSkillTool, DEFAULT_LOAD_SKILL_TOOL_NAME, isSkillLoadError, MAX_LOAD_SKILL_RESULT_BYTES, resolveSkillLoad, SKILL_LOAD_ERROR_CODE, SkillLoadError, } from "./skill-load.js";
+export type { CreateLoadSkillToolOptions, LoadedSkillBodiesEntry, ResolveSkillLoadOptions, } from "./skill-load.js";
+export { applyRestoredSkillBodies, createLoadSkillTool, DEFAULT_LOAD_SKILL_TOOL_NAME, HARD_MAX_PERSISTED_SKILL_BODY_TOTAL_BYTES, isSkillLoadError, MAX_LOAD_SKILL_RESULT_BYTES, MAX_PERSISTED_SKILL_BODIES, MAX_PERSISTED_SKILL_BODY_BYTES, MAX_PERSISTED_SKILL_BODY_NAME_CHARS, resolveSkillLoad, SKILL_LOAD_ERROR_CODE, SkillLoadError, snapshotLoadedSkillBodies, validateLoadedSkillBodies, } from "./skill-load.js";
 export type { ResolveActiveSkillsOptions, SkillRegistryOptions } from "./skills.js";
 export { createSkillRegistry, resolveActiveSkills } from "./skills.js";
 export { artifactStructuredOutputRequest, assertStructuredOutputRequestSupported, DEFAULT_MAX_STRUCTURED_OUTPUT_NAME_LENGTH, DEFAULT_MAX_STRUCTURED_OUTPUT_SCHEMA_BYTES, modelSupportsStructuredOutput, resolveRunProviderOptions, StructuredOutputError, validateStructuredOutputOptions, withoutStructuredOutput, } from "./structured-output.js";
@@ -105,5 +105,5 @@ export { createToolParameterValidator, createToolRegistry, dispatchToolCall, fil
 export type { ResolvedUseCaseModel, ResolveUseCaseModelInput, UseCaseModelBinding, } from "./use-case-model.js";
 export { resolveUseCaseModel, resolveUseCaseModelBinding, useCaseCredentialProviderId, } from "./use-case-model.js";
 export declare const name = "prism";
-export declare const version = "0.1.4";
+export declare const version = "0.1.6";
 export declare const description = "Agent harness for AI providers, agents, sessions, and tools.";

package/dist/index.js

@@ -46,7 +46,7 @@ export { assertPermission, assertTrusted, checkPermission, createStaticPermissio
 export { createMemorySessionStore, createSessionEntry, getSessionBranchEntries, listSessionBranches, rebuildSessionContext, } from "./session-stores.js";
 export { createChainedSettingsProvider, createStaticSettingsProvider } from "./settings.js";
 export { createLoadedSkillSet, DEFAULT_MAX_SKILL_CATALOG_ENTRIES, DEFAULT_MAX_SKILL_DESCRIPTION_BYTES, DEFAULT_MAX_SKILL_INSTRUCTION_BYTES, EMPTY_SKILL_DESCRIPTION, HARD_MAX_SKILL_CATALOG_ENTRIES, HARD_MAX_SKILL_DESCRIPTION_BYTES, HARD_MAX_SKILL_INSTRUCTION_BYTES, isSkillDisclosureError, resolveSkillsDisclosure, SkillDisclosureError, } from "./skill-disclosure.js";
-export { createLoadSkillTool, DEFAULT_LOAD_SKILL_TOOL_NAME, isSkillLoadError, MAX_LOAD_SKILL_RESULT_BYTES, resolveSkillLoad, SKILL_LOAD_ERROR_CODE, SkillLoadError, } from "./skill-load.js";
+export { applyRestoredSkillBodies, createLoadSkillTool, DEFAULT_LOAD_SKILL_TOOL_NAME, HARD_MAX_PERSISTED_SKILL_BODY_TOTAL_BYTES, isSkillLoadError, MAX_LOAD_SKILL_RESULT_BYTES, MAX_PERSISTED_SKILL_BODIES, MAX_PERSISTED_SKILL_BODY_BYTES, MAX_PERSISTED_SKILL_BODY_NAME_CHARS, resolveSkillLoad, SKILL_LOAD_ERROR_CODE, SkillLoadError, snapshotLoadedSkillBodies, validateLoadedSkillBodies, } from "./skill-load.js";
 export { createSkillRegistry, resolveActiveSkills } from "./skills.js";
 export { artifactStructuredOutputRequest, assertStructuredOutputRequestSupported, DEFAULT_MAX_STRUCTURED_OUTPUT_NAME_LENGTH, DEFAULT_MAX_STRUCTURED_OUTPUT_SCHEMA_BYTES, modelSupportsStructuredOutput, resolveRunProviderOptions, StructuredOutputError, validateStructuredOutputOptions, withoutStructuredOutput, } from "./structured-output.js";
 export { composeSystemPrompt, mergeSystemPromptConfig } from "./system-prompts.js";
@@ -57,6 +57,6 @@ export { DEFAULT_TOOL_RESULT_FOLD_MAX_SUMMARY_BYTES, DEFAULT_TOOL_RESULT_FOLD_MI
 export { createToolParameterValidator, createToolRegistry, dispatchToolCall, filterTools } from "./tools.js";
 export { resolveUseCaseModel, resolveUseCaseModelBinding, useCaseCredentialProviderId, } from "./use-case-model.js";
 export const name = "prism";
-export const version = "0.1.4";
+export const version = "0.1.6";
 export const description = "Agent harness for AI providers, agents, sessions, and tools.";
 //# sourceMappingURL=index.js.map

package/dist/rpc.js

@@ -225,9 +225,10 @@ function runOptions(state, params) {
     const names = stringArrayParam(params, "instructionInjectors");
     // ponytail: fail-closed — unknown name throws (caller surfaces as RPC error), matching CLI.
     const injectors = names.length ? resolveInstructionInjectors({ registry: state.instructionInjectors, names }) : undefined;
+    const maxToolRounds = numberParam(params, "maxToolRounds");
     return {
         model: modelParam(params) ?? state.model,
-        maxToolRounds: numberParam(params, "maxToolRounds"),
+        ...(maxToolRounds !== undefined ? { limits: { maxToolRounds } } : {}),
         ...(injectors ? { instructionInjectors: injectors } : {}),
     };
 }

package/dist/skill-load.d.ts

@@ -3,6 +3,29 @@ import { type LoadedSkillSet } from "./skill-disclosure.js";
 export declare const DEFAULT_LOAD_SKILL_TOOL_NAME: "load_skill";
 export declare const SKILL_LOAD_ERROR_CODE: "skill_load_failed";
 export declare const MAX_LOAD_SKILL_RESULT_BYTES = 512;
+export declare const MAX_PERSISTED_SKILL_BODIES = 64;
+export declare const MAX_PERSISTED_SKILL_BODY_NAME_CHARS = 256;
+export declare const MAX_PERSISTED_SKILL_BODY_BYTES = 262144;
+export declare const HARD_MAX_PERSISTED_SKILL_BODY_TOTAL_BYTES: number;
+/** One persisted loaded-skill body (plan 018 closeout `checkpoint-bodies`). */
+export interface LoadedSkillBodiesEntry {
+    readonly name: string;
+    readonly instructions: string;
+}
+/** Fail-closed shape/cap validation for a persisted bodies payload (load and save sides). */
+export declare function validateLoadedSkillBodies(value: unknown): asserts value is readonly LoadedSkillBodiesEntry[];
+/**
+ * Snapshot the exact instructions of every loaded skill (registry-independent).
+ * Loaded names without instructions are skipped (they render no body anyway);
+ * a restored body for a loaded name wins over the registry body.
+ */
+export declare function snapshotLoadedSkillBodies(skills: readonly Skill[], loaded: LoadedSkillSet, restored?: ReadonlyMap<string, string>): LoadedSkillBodiesEntry[];
+/**
+ * Apply persisted bodies to the skills a resumed session will render: replace the
+ * instructions of known skills and append synthesized skills for names the live
+ * registry no longer serves, so the exact loaded text renders registry-independently.
+ */
+export declare function applyRestoredSkillBodies(skills: readonly Skill[], bodies: readonly LoadedSkillBodiesEntry[]): readonly Skill[];
 export declare class SkillLoadError extends Error {
     readonly code: "skill_load_failed";
     constructor(message: string);

package/dist/skill-load.js

@@ -3,6 +3,80 @@ import { HARD_MAX_SKILL_INSTRUCTION_BYTES } from "./skill-disclosure.js";
 export const DEFAULT_LOAD_SKILL_TOOL_NAME = "load_skill";
 export const SKILL_LOAD_ERROR_CODE = "skill_load_failed";
 export const MAX_LOAD_SKILL_RESULT_BYTES = 512;
+// Bodies-mode persistence bounds (plan 018 Task 6 closeout `checkpoint-bodies`): the
+// checkpoint `maxStateBytes` ceiling is the documented outer bound (oversize refuses at
+// save with a recorded error); these caps bound the bodies payload itself on load.
+// ponytail: module constants, not tunable options — hosts tune maxStateBytes for the ceiling.
+export const MAX_PERSISTED_SKILL_BODIES = 64; // names-mode parity (MAX_PERSISTED_SKILL_NAMES)
+export const MAX_PERSISTED_SKILL_BODY_NAME_CHARS = 256; // names-mode parity
+export const MAX_PERSISTED_SKILL_BODY_BYTES = 262_144; // = HARD_MAX_SKILL_INSTRUCTION_BYTES (loader parity)
+export const HARD_MAX_PERSISTED_SKILL_BODY_TOTAL_BYTES = 1024 * 1024; // = HARD_MAX_AGENT_RUN_STATE_BYTES
+/** Fail-closed shape/cap validation for a persisted bodies payload (load and save sides). */
+export function validateLoadedSkillBodies(value) {
+    if (!Array.isArray(value) || value.length > MAX_PERSISTED_SKILL_BODIES) {
+        throw new SkillLoadError(`Loaded-skill bodies exceed ${MAX_PERSISTED_SKILL_BODIES} entries`);
+    }
+    let totalBytes = 0;
+    for (const entry of value) {
+        if (!entry || typeof entry !== "object" || typeof entry.name !== "string") {
+            throw new SkillLoadError("Malformed loaded-skill body entry: name must be a string");
+        }
+        const { name, instructions } = entry;
+        if (name.length > MAX_PERSISTED_SKILL_BODY_NAME_CHARS) {
+            throw new SkillLoadError(`Loaded-skill body name exceeds ${MAX_PERSISTED_SKILL_BODY_NAME_CHARS} chars`);
+        }
+        if (typeof instructions !== "string") {
+            throw new SkillLoadError("Malformed loaded-skill body entry: instructions must be a string");
+        }
+        const bodyBytes = Buffer.byteLength(instructions, "utf8");
+        if (bodyBytes > MAX_PERSISTED_SKILL_BODY_BYTES) {
+            throw new SkillLoadError(`Loaded-skill body exceeds ${MAX_PERSISTED_SKILL_BODY_BYTES} bytes`);
+        }
+        totalBytes += Buffer.byteLength(name, "utf8") + bodyBytes;
+        if (totalBytes > HARD_MAX_PERSISTED_SKILL_BODY_TOTAL_BYTES) {
+            throw new SkillLoadError(`Loaded-skill bodies exceed ${HARD_MAX_PERSISTED_SKILL_BODY_TOTAL_BYTES} total bytes`);
+        }
+    }
+}
+/**
+ * Snapshot the exact instructions of every loaded skill (registry-independent).
+ * Loaded names without instructions are skipped (they render no body anyway);
+ * a restored body for a loaded name wins over the registry body.
+ */
+export function snapshotLoadedSkillBodies(skills, loaded, restored) {
+    const byName = new Map(skills.map((skill) => [skill.name, skill]));
+    const entries = [];
+    for (const name of loaded.list()) {
+        const instructions = restored?.get(name) ?? byName.get(name)?.instructions;
+        if (!instructions)
+            continue;
+        entries.push({ name, instructions });
+    }
+    validateLoadedSkillBodies(entries); // refuses oversize with a recorded error (never truncates)
+    return entries;
+}
+/**
+ * Apply persisted bodies to the skills a resumed session will render: replace the
+ * instructions of known skills and append synthesized skills for names the live
+ * registry no longer serves, so the exact loaded text renders registry-independently.
+ */
+export function applyRestoredSkillBodies(skills, bodies) {
+    validateLoadedSkillBodies(bodies);
+    if (bodies.length === 0)
+        return skills;
+    const byName = new Map(skills.map((skill) => [skill.name, skill]));
+    const out = skills.map((skill) => {
+        const body = bodies.find((entry) => entry.name === skill.name);
+        return body ? { ...skill, instructions: body.instructions } : skill;
+    });
+    const known = new Set(skills.map((skill) => skill.name));
+    for (const entry of bodies) {
+        if (!known.has(entry.name)) {
+            out.push({ name: entry.name, instructions: entry.instructions });
+        }
+    }
+    return out;
+}
 export class SkillLoadError extends Error {
     code = SKILL_LOAD_ERROR_CODE;
     constructor(message) {

package/docs/acp.md

@@ -111,7 +111,7 @@ const agent = createPrismAcpAgent({
 
 ### Persistence and ownership
 
-- **The agent never persists `modeId`/`configValues`.** Defaults are recomputed per session from the `modes`/`configOptions` seams — a fresh `session/new`, `load`, or `resume` always starts from `defaultModeId` / option `defaultValue`, and the agent's per-session registry is in-memory only. Persisting mode/config across sessions is a **host** decision, and host-side persistence MUST be ownership-scoped.
+- **Without the durability seam the agent never persists `modeId`/`configValues`.** Defaults are recomputed per session from the `modes`/`configOptions` seams — a fresh `session/new`, `load`, or `resume` always starts from `defaultModeId` / option `defaultValue`, and the agent's per-session registry is in-memory only. Persisting mode/config across sessions is a **host** decision, and host-side persistence MUST be ownership-scoped.
 - **Host persistence MUST key by `sessions.ownership`.** `authorize` binds transport identity to ownership; a host store that persists `modeId`/`configValues` must refuse any restore whose stored ownership differs from the current session's ownership — a `sessionId` alone is never a sufficient key (session ids may collide across tenants). A cross-tenant restore rejects with `ERR_PRISM_ACP_INPUT` and never returns the other tenant's mode/config.
 - **Ownership-scoped restore (host-owned store).** The store is keyed by `sessionId` and records the owning `userId`; restore refuses on mismatch (this exact pattern is asserted in `packages/ag-ui/src/__tests__/acp-modes-config.test.ts`):
 
@@ -133,7 +133,7 @@ const agent = createPrismAcpAgent({
   ```
 
   Because the agent recomputes defaults on every `load`/`resume`, a host that restores state re-applies it after load through the same gated seams (`session/set_mode`, `session/set_config_option` — both run the `apply`/`onChange` hooks) and must refuse cross-tenant loads at the `authorize` seam first (falsy `authorize` = `Unauthorized ACP session`, before any mode/config state is reachable).
-- **Agent-owned persistence is 0.2.0.** A durable, ownership-scoped ACP session store (agent-side persistence of mode/config and session state) is roadmap 0.2.0 Module E, demand-gated; on the 0.1.x line the agent stays a thin per-session registry. See the [Host security guide](host-security.md) fail-closed checklist for the ACP boundary rows.
+- **Durable registry (0.1.6, plan 018 closeout `acp-session-store`).** Pass `sessionStore` (`AcpSessionStore` from `@arnilo/prism-ag-ui/acp`) to let a restarted agent restore its live-session registry: `save` (on `session/new`, `set_mode`, `set_config_option`), `loadAll` (once per agent instance, lazily on first authorized touch), `evict` (on `close`/`delete`). The stored entry carries `sessionId`, `ownership`, `modeId`, `configValues`, `cwd`, `additionalDirectories`, `updatedAt` — never ephemeral stream state (client/controller/budget) or pending decisions. Restore re-resolves the live `AgentSession` through your `sessionFactory`, re-validates cwd/directories and mode/config values against the seams, enforces the registry cap, and drops corrupt or seam-mismatched entries fail-closed. The seam is additive-only: absent `sessionStore` ⇒ the agent behaves exactly as 0.1.5. Storage topology stays host-owned; the store is the trust boundary for tampering/replay. The full threat model and test mapping live in `docs/_evidence/phase18-primitive-review.md`; enforcement tests in `packages/ag-ui/src/__tests__/acp-session-store.test.ts`. The host-owned mode/config store pattern above stays valid for hosts that persist without the agent seam.
 
 ## Security and performance notes
 

package/docs/agent-loops.md

@@ -221,7 +221,7 @@ await session.run(input, { loop: twoShotLoop });
 - `{ strategy: "single-shot" }` resolves to the exported `singleShotLoop`; `{ strategy: "generate-validate-revise", ... }` is mapped by `resolveLoop()` to `generateValidateReviseLoop(opts)`. An unknown `strategy` throws before the first turn. Passing an `AgentLoopStrategy` instance bypasses the options form entirely (custom-loop escape hatch).
 - The loop is resolved once per run inside `RuntimeAgentSession.run()`, after the usual setup (provider/skills/tools resolution, history rebuild, model-change entry, input append, auto-compaction). The runtime's outer try/catch/finally, run-exclusivity, abort bridging, and subscriber close remain in place around `loop.run(ctx)`.
 - `LoopContext.assemble(nextInput, toolResults?)` accepts an optional tool-result accumulator so `singleShotLoop` can pass its loop-local results. Bounded artifact tools append results directly to shared history, then assemble the next turn with empty new input; no second transcript path exists.
-- `limits.maxToolRounds` bounds both `singleShotLoop` and opt-in bounded artifact tool rounds across the whole run. Artifact mode always dispatches sequentially, regardless of `toolConcurrency`; all dispatches still use existing registry/filter/permission/validator/middleware/redactor/ledger guards. Deprecated `maxToolRounds` only narrows this limit.
+- `limits.maxToolRounds` bounds both `singleShotLoop` and opt-in bounded artifact tool rounds across the whole run. Artifact mode always dispatches sequentially, regardless of `toolConcurrency`; all dispatches still use existing registry/filter/permission/validator/middleware/redactor/ledger guards.
 - `maxRevisions` (default 3) counts only failed call-free artifact candidates. Bounded artifact runs make at most `1 + maxRevisions + maxToolRounds` provider turns. A tool-round limit is terminal and returns last usage after `artifact_failed`; it does not throw.
 - A revision cycle appends one assistant draft and one repair user message per revision to the session store, so store entries reflect every attempted draft. The original user input is stored once by the runtime and pushed into loop history once on the first turn. Repair messages are assembled as the next provider `nextInput` and only pushed into live history after that revision request has been generated, so the model never receives a duplicated repair instruction.
 

package/docs/agent-session-runtime.md

@@ -49,7 +49,7 @@ string | Message | readonly Message[]
 
 `AgentConfig.limits` sets run ceilings; `RunOptions.limits` may only narrow configured agent values. Limits cover turns, provider attempts, tool rounds/calls, wall time, request/response bytes, tokens, and optional single-currency cost. A breach emits one `run_limit_exceeded` event and throws `AgentRunError` with `result.limit`; see [Runs and usage ledger](runs-and-usage.md#run-limits).
 
-`RunOptions.model` can override the request model for a run. Model overrides append a `model_change` entry. `AgentConfig.inputLayout` selects the default input assembly layout (`"cache_aware"` by default, or opt-in `"legacy"`); `RunOptions.inputLayout` wins for one run. `AgentConfig.providerOptions`/`RunOptions.providerOptions` supply generic provider request options; `timeoutMs`, `maxRetries`, and `maxRetryDelayMs` are deprecated inert provider-level hints in first-party providers. Use `RunOptions.signal`/host abort controllers for timeouts and `AgentConfig.retry`/`RunOptions.retry` for retry. `AgentConfig.providerRequestPolicies`/`RunOptions.providerRequestPolicies` run before `AIProvider.generate()` and before `provider_request` middleware. `AgentConfig.systemPrompt` and `RunOptions.systemPrompt` add explicit layered system prompt contributions; `RunOptions.systemPrompt: false` disables configured prompt layers for that run while keeping `AgentConfig.instructions` as the base path. `RunOptions.compaction` can enable auto-compaction for that run or use `false` to disable configured auto-compaction. `RunOptions.retry` can enable provider-turn retry for that run or use `false` to disable configured retry. `RunOptions.metadata` is merged with agent/session metadata for assembly, provider requests, and tool contexts. Deprecated `RunOptions.maxToolRounds` narrows `limits.maxToolRounds`. `RunOptions.signal` is bridged into the per-run abort signal passed to assembly, providers, tools, auto-compaction, and retry backoff.
+`RunOptions.model` can override the request model for a run. Model overrides append a `model_change` entry. `AgentConfig.inputLayout` selects the default input assembly layout (`"cache_aware"` by default, or opt-in `"legacy"`); `RunOptions.inputLayout` wins for one run. `AgentConfig.providerOptions`/`RunOptions.providerOptions` supply generic provider request options (session/cache/header/compat/extra hints only — provider-level timeout/retry hints were removed in 0.1.5). Use `RunOptions.signal`/host abort controllers for timeouts and `AgentConfig.retry`/`RunOptions.retry` for retry. `AgentConfig.providerRequestPolicies`/`RunOptions.providerRequestPolicies` run before `AIProvider.generate()` and before `provider_request` middleware. `AgentConfig.systemPrompt` and `RunOptions.systemPrompt` add explicit layered system prompt contributions; `RunOptions.systemPrompt: false` disables configured prompt layers for that run while keeping `AgentConfig.instructions` as the base path. `RunOptions.compaction` can enable auto-compaction for that run or use `false` to disable configured auto-compaction. `RunOptions.retry` can enable provider-turn retry for that run or use `false` to disable configured retry. `RunOptions.metadata` is merged with agent/session metadata for assembly, provider requests, and tool contexts. Run tool-round limits via `RunOptions.limits.maxToolRounds`. `RunOptions.signal` is bridged into the per-run abort signal passed to assembly, providers, tools, auto-compaction, and retry backoff.
 
 `RunOptions.activeSkills` selects named skills from a configured `SkillRegistry`; `RunOptions.skills` replaces a plain `Skill[]` config for one run. When `AgentConfig.skills` is a registry and neither is set, **no skills activate** unless `activateAllSkills: true` (run or agent). `skillsDisclosure` (`"progressive"` default, `"eager"` opt-in; run wins) controls catalog vs full instruction bodies; the session-owned `LoadedSkillSet` is populated by `load_skill` when the host registers `createLoadSkillTool`. `toolResultFold` (off unless the host supplies `summarize`) optionally folds aged large tool results in provider input only. See [Context and skills](context-and-skills.md).
 
@@ -120,7 +120,7 @@ const agent = createAgent({
 });
 
 const session = agent.createSession({ id: "s1" });
-const result = await session.run("Hi", { maxToolRounds: 1, compaction: { thresholdEntries: 20, keepRecentEntries: 6 }, retry: { maxAttempts: 3, baseDelayMs: 50 } });
+const result = await session.run("Hi", { limits: { maxToolRounds: 1 }, compaction: { thresholdEntries: 20, keepRecentEntries: 6 }, retry: { maxAttempts: 3, baseDelayMs: 50 } });
 console.log(result.text, result.usage?.totalTokens);
 
 for await (const event of session.stream("Follow up")) console.log(event.type);
@@ -198,7 +198,7 @@ if (result.status === "suspended") {
 }
 ```
 
-Resume requires exact checkpoint ownership, version, agent fingerprint, and revision. The fingerprint hashes the agent id/name, `definitionRevision`, model, instructions, system-prompt contributions, skills (name/instructions/tool names), tool definitions (name/parameters/exclusive), guardrail definitions (name/stage/revision), and loop strategy — changing any of them without bumping `definitionRevision` fails resume closed instead of silently continuing with different agent semantics. Prism CAS-claims approval before work, rechecks normal guardrail/permission/validation/limit paths, and marks a pending tool dispatched before its side effect. `createAgentRunLifecycle()` wraps the same core path for server/MCP hosts: adapters pass only authorized ownership, status returns only `{ state, version }`, and `resolveAgent()` supplies current agent/revision. `resumeStream()` uses that same claim path and bounded subscriber, so adapters do not poll or duplicate resume logic. Remote restart requires both checkpoint and session stores to be durable. A crash after that mark is ambiguous and is never replayed automatically; use host tool idempotency keyed by `runId`/`toolCallId` or resolve it manually. Checkpoints contain bounded redacted state plus session/leaf references, never provider objects, callbacks, signals, credentials, or raw secrets. State is bounded at save by `runState.maxStateBytes` (default 256 KB, at most the 1 MB hard cap); load bounds against the 1 MB hard cap only, so state saved with a raised limit stays resumable while oversized records are still rejected. Since 0.1.3 (plan 015 Task 4), durable runs may opt in to session-state persistence with `persistSessionState: true` on both the run and resume options: the loaded-skill **name catalog** (≤64 names, ≤256 chars each) rides the checkpoint and is restored into the resumed session's `LoadedSkillSet`; skill **bodies are never persisted** and re-resolve from the live registry via `load_skill`. Default off keeps the checkpoint shape byte-identical to 0.1.2. Built-in loop options are durable; custom `AgentLoopStrategy` instances are durable when they declare `snapshot`/`restore` hooks (see [Agent loops § Durable runs](agent-loops.md#durable-runs)) and reject before provider work otherwise.
+Resume requires exact checkpoint ownership, version, agent fingerprint, and revision. The fingerprint hashes the agent id/name, `definitionRevision`, model, instructions, system-prompt contributions, skills (name/instructions/tool names), tool definitions (name/parameters/exclusive), guardrail definitions (name/stage/revision), and loop strategy — changing any of them without bumping `definitionRevision` fails resume closed instead of silently continuing with different agent semantics. Prism CAS-claims approval before work, rechecks normal guardrail/permission/validation/limit paths, and marks a pending tool dispatched before its side effect. `createAgentRunLifecycle()` wraps the same core path for server/MCP hosts: adapters pass only authorized ownership, status returns only `{ state, version }`, and `resolveAgent()` supplies current agent/revision. `resumeStream()` uses that same claim path and bounded subscriber, so adapters do not poll or duplicate resume logic. Remote restart requires both checkpoint and session stores to be durable. A crash after that mark is ambiguous and is never replayed automatically; use host tool idempotency keyed by `runId`/`toolCallId` or resolve it manually. Checkpoints contain bounded redacted state plus session/leaf references, never provider objects, callbacks, signals, credentials, or raw secrets. State is bounded at save by `runState.maxStateBytes` (default 256 KB, at most the 1 MB hard cap); load bounds against the 1 MB hard cap only, so state saved with a raised limit stays resumable while oversized records are still rejected. Since 0.1.3 (plan 015 Task 4), durable runs may opt in to session-state persistence with `persistSessionState: true` on both the run and resume options: the loaded-skill **name catalog** (≤64 names, ≤256 chars each) rides the checkpoint and is restored into the resumed session's `LoadedSkillSet`; skill **bodies are never persisted** and re-resolve from the live registry via `load_skill`. Since 0.1.6 (plan 018 closeout `checkpoint-bodies`), `includeSkillBodies: true` on BOTH the run and resume options additionally persists the exact loaded-skill **instructions** (`{name, instructions}` pairs, redacted at the checkpoint boundary like all state, ≤64 bodies / ≤256-char names / ≤262144-byte bodies / ≤1 MiB total) so resume re-renders them registry-independently — no `load_skill` round-trip and no dependence on the registry still serving the same text; `maxStateBytes` (default 256 KB) refuses oversize bodies with a recorded error, never silently truncates. Default off keeps the checkpoint shape byte-identical to 0.1.3. Built-in loop options are durable; custom `AgentLoopStrategy` instances are durable when they declare `snapshot`/`restore` hooks (see [Agent loops § Durable runs](agent-loops.md#durable-runs)) and reject before provider work otherwise.
 
 ## Secure composition