@arnilo/prism 0.6.0 → 0.8.0

package/CHANGELOG.md

@@ -1,3 +1,77 @@
+## [Unreleased]
+
+## [0.8.0] - 2026-09-18 (messaging channels, connected apps, work family, durable runs, honesty gates)
+
+> **Eleven publishable packages.** `@arnilo/prism-channels` is new; `@arnilo/prism-work` replaces `@arnilo/prism-office`. Predecessor published line is **0.7.0**. Registry/tag writes stay operator-authorized.
+
+### Added
+- **Messaging channels.** `@arnilo/prism-channels` ships the transport-neutral runtime (deny-by-default sender authorization, owned session binding, serialized turns, current-run replies, one-use durable approvals, bounded attachment refs), official Telegram (private DMs, opt-in granted groups/topics, private-chat drafts, bounded media, optional voice transcription/synthesis, opt-in notices to one already-bound pair), and experimental pinned signal-cli Signal. See [docs/messaging-channels.md](docs/messaging-channels.md), [docs/telegram-channel.md](docs/telegram-channel.md), [docs/signal-channel.md](docs/signal-channel.md), [docs/messaging-channel-operations.md](docs/messaging-channel-operations.md).
+- **Connected apps and work HTTP.** Identity-bound MCP connected-app sessions admit host-selected transports and register prefixed tools. Google Workspace and Microsoft 365 HTTP adapters live under `@arnilo/prism-work/connectors`. Slack MCP wrap and Open Connector sidecar stay examples. See [docs/connected-apps.md](docs/connected-apps.md), [docs/work-connectors.md](docs/work-connectors.md).
+- **Durable runs, turn-boundary stops, and run-bundle snapshots.** `AgentRunStateOptions.checkpointPolicy: "every-turn"` checkpoints a run at the provider-turn boundary so a crashed worker resumes with the host-only `decision: "continue"` action (never reachable from AG-UI or the server boundary, and rejected while any approval or ready tool call is pending). `RunOptions.turnPolicy` (`TurnPolicyOptions`) stops a run synchronously at a turn boundary and reports `stopReason: "host_policy"` with a redacted, bounded `stopDetail` on the result, the ledger row, the `agent_finished` event, and the execution timeline; a host-policy stop stays resumable. `snapshotRunBundle` returns a `RunBundleSnapshot` — a frozen, redacted digest projection of the effective run bundle with zero store or network reads. `createClaimGroundingGuardrail` (stage `"output"`) blocks or flags numeric claims that no tool result or host evidence supports. `ErrorInfo.failureClass` (`ProviderFailureClass`) types provider failures as `quota` / `rate_limited` / `auth` / `transient` / `permanent` / `unknown`; `ModelCapabilities.toolCallStrictness` adds advisory tool-call reliability. See [docs/durable-runs.md](docs/durable-runs.md), [docs/run-bundle.md](docs/run-bundle.md), [docs/guardrails.md](docs/guardrails.md).
+- **Work sandbox and vendored skills.** `@arnilo/prism-work/sandbox` plus `createWorkComposition` run office/exec in an injected Docker sandbox; connectors stay on the host. The package ships `docx`, `xlsx`, `powerpoint`, `pdf` skills.
+
+### Changed
+- **Lockstep `0.7.0` → `0.8.0`.** All eleven publishable manifests move together with `^0.8.0` internal ranges; the lockfile, the `src/index.ts` version constant, the docs index banner, the release-workflow tag lists, and the generated package-truth artifact agree (enforced by `scripts/version-literal-gate.test.mjs`).
+- **Work family rename.** `@arnilo/prism-office` is replaced by `@arnilo/prism-work` (connectors, documents, sheets, diagrams, document-reader, sandbox, skills, tools). No pre-1.0 shim. See [docs/migrate-to-0.8.md](docs/migrate-to-0.8.md).
+- **AG-UI input authority is opt-in server-side.** `CreateAgUiHandlerOptions.inputPolicy.clientState: "ignore"` validates then discards client-supplied AG-UI state and tools before projection, and stops advertising client-provided tools; the default `"honor"` path is byte-identical to 0.7.0.
+- **Observational-memory workers are tool-only.** Text/thinking/done-only turns are successful no-ops. Limit and unknown-tool failures throw `MemoryError` / `MemoryLimitError` rather than matching an English message prefix.
+- **Channel lease release is fail-closed.** In-memory `route.lease` clears only after the store acknowledges; a failed release retries on idle/`stop`. TTL remains the cross-process backstop.
+- **This-tree Postgres evidence.** `release:gate` reports `test:postgres` as pass only when `scripts/postgres-evidence.json` matches current `git rev-parse HEAD`. A stale phase baseline is blocked.
+- **Compat baselines regenerated** at 0.8.0. Inherited 083 `@arnilo/prism-office` → `@arnilo/prism-work` removals (and `prism-core` / `prism-coding-tools` moves) are listed separately from 085 additions. This cut's own Tasks 1–6 add no public removals.
+- **Migration guide for 0.7.0 hosts**: [docs/migrate-to-0.8.md](docs/migrate-to-0.8.md), indexed from [docs/migration.md](docs/migration.md) and [docs/index.md](docs/index.md).
+
+### Fixed
+- **Portable work-idempotency error codes survived the work-family move.** The enterprise PostgreSQL `IdempotencyStore` adapter keeps `ERR_PRISM_WORK_IDEMPOTENCY` / `ERR_PRISM_WORK_IDEMPOTENCY_CONFLICT`; only the error class changed (`EnterprisePostgresError`).
+- **Stale ownership assertions in the protected PostgreSQL leg:** a foreign checkpoint scope is a miss plus a generic CAS conflict, and a foreign agent-run status read is indistinguishable from a missing run (`ERR_PRISM_AGENT_RUN_STATE`).
+- **Wiki isolation nested-runner flake.** The wiki scratch gate spawns `node --test --test-isolation=none` (still strips `NODE_TEST_CONTEXT` / `NODE_TEST_WORKER_ID`) so worker IPC deserialization cannot fail the gate under `npm test` load.
+- **Coverage artifact names.** Package keys in `scripts/coverage-summary.json` must equal live workspace manifests (`@arnilo/prism-work`, not `@arnilo/prism-office`).
+- **Alibaba video `fetchUrl`.** Declared `fetchUrl` now downloads generated video bytes; unused OpenAI speech `_bearerHeaders` deleted.
+
+### Security
+- **Numeric claims must be grounded or they fail closed.** The claim-grounding guardrail blocks by default, bounds every reported span, caps evidence collection (4,096 figures, 16 levels, 128 KiB), and treats a missing evidence set as ungrounded rather than passing silently.
+- **Crash recovery cannot bypass approval gates.** `"continue"` resumes only a running checkpoint with no pending decision or ready call, and keeps the recorded fingerprint, revision, ownership/fencing, and CAS-version gates.
+- **Failed channel lease release is not success.** This process does not treat the binding as free until the store acknowledges; TTL is the other-process backstop.
+- **Postgres release pass cannot be inherited.** Missing or stale this-tree evidence is blocked, never a pass from a previous commit's counts.
+
+## [0.7.0] - 2026-09-15 (extended line: plans 072, 073, 074, 075, 077, 078)
+
+> **Channels are not in this cut.** Plan 079 (Telegram/Signal adapters) was reassigned to **0.8.0** so the 0.7.0 cut stops waiting on it; nothing in this release mentions or ships a channel adapter.
+
+### Added
+- **Execution timeline (plan 072).** `@arnilo/prism-core/governance/observability` ships one frozen, JSON-serializable view-model for what a run did: `projectAgentTimeline` (live `AgentEvent[]`), `projectTraceTimeline` (persisted `EvaluationTrace`), `projectWorkflowTimeline` (workflow events plus optional checkpoint), incremental `createTimelineFolder` / `createWorkflowTimelineFolder` folders for SSE/cockpit updates, and `summarizeTimeline` / `summarizeSession` rollups (tool counts capped at 64, no double counting across runs). See [docs/execution-timeline.md](docs/execution-timeline.md).
+- **Workflow graph view-model (plan 072).** `serializeWorkflowGraph`, `workflowGraphToMermaid`, `workflowGraphToDot`, `projectWorkflowGraphRun`, and `createWorkflowGraphRunFolder` render a workflow DAG and overlay live or checkpoint run state (`WorkflowGraphRunView`) without executing it.
+- **Trajectory and outcome evals (plan 072).** Scorers (`defineScorer`, pairwise preferences, model-judge budgets), `runScenario`, `runExperiment`, `runWorkflowExperiment`, dataset items with expected trajectories, trials, manifests, comparisons, and thresholds — with `runComparison` / `datasetFromRuns` curation over recorded runs.
+- **Eval primitives match their contracts (plan 073 Tasks 30–31).** Injection/timeline holes closed, deterministic `mulberry32` sampling, `collectWhileRunning`, and host-activity eval packs (coding, browser, memory, voice invariants) over the true primitives.
+- **Attention compiler (plan 074, opt-in).** `createAttentionCompiler` / `resolveInputCap` / `compileAttention` / `createAttentionTruncationTrigger`: a per-turn gate that measures the assembled input against a host ratio of the model input cap and, only past the ratio, mutates a **history clone** oldest thinking blocks first, then fold-eligible tool results — keeping cache prefixes, the session store, and the observational-memory ledger untouched, and raising `AttentionBudgetError` rather than silently dropping context. Wired through `AgentConfig`, `AgentDefinition`, and `RunOptions` (run overlay narrows), plus `attention_compiled` telemetry and an `attention` timeline step; sticky frontier persists through `persistSessionState`. See [docs/attention-compiler.md](docs/attention-compiler.md).
+- **Memory fabric subpath (plan 075, opt-in).** `@arnilo/prism-memory/fabric` adds typed notes (`fact`, `procedure`, `file`, `working`, `episode`) with links, validity windows, time/tool recall, conversation search, and opt-in consolidation/linker/evolution workers over the stores a host already configured. Inert until `fabric.attach(session)`; no new package, provider, database, or mandatory dependency. See [docs/memory-fabric.md](docs/memory-fabric.md).
+- **Work-scope memory index (plan 077, opt-in).** `createWorkScopeController` appends `om.scope.*` entries to one observational-memory ledger; `foldWorkScopeMap`, `projectWorkMemory`, and `withWorkScope` project the outline to a host-selected working set (leaf `self+ancestors` by default), auto-bind new observations to the leaf, and skip the observation dropper while any host scope exists. Caps fail closed (256 scopes, depth 8, 4,096 binds, 512-char labels). See [docs/compaction-observational-memory.md](docs/compaction-observational-memory.md).
+- **Host-owned subagent spawn (plan 078, opt-in).** `createSpawnAgentTool` turns the supervisor's host-owned child catalog into a non-exclusive `spawn_agent` whose closed schema exposes only allow-listed child ids, input, an optional thread id, and `mode: "sync" | "async"`; `createWaitAgentTool` / `createCancelAgentTool` join or abort async handles from `delegateAsync()`. Child identity narrows from the parent, results and errors are redacted, child slots are reserved atomically (after a before-hook narrows limits), and parent-run abort cancels running children. `createWorktreeChildFactory` gives each child its own linked git worktree and cleans it up on every terminal outcome (including a suspended child that later resumes), while `observeSupervisorLifecycle` bridges `delegation_*` events to redacted coding `subagent_started` / `subagent_stopped` lifecycle events. See [docs/supervisors.md](docs/supervisors.md).
+- **Governed host completeness (plan 073).** Governed provider invocation with aggregate task/tenant accounting across every paid work kind (enterprise migration `006_aggregate_budgets`); durable business-action drafts with editable approvals; Docker process sessions and coherent workspace recovery; incremental Drive knowledge synchronization; snapshot/reconnect lifecycle with a hosted E2B sandbox; fair worker admission and operator routes; cross-layer memory lineage with correction and revocation; semantic artifact review with evidence-backed citations; import-fidelity reports with optional OCR; monotonic per-run tool narrowing with remote invalidation; native Bedrock `Converse`/`ConverseStream`; and governed realtime voice orchestration. New pages: [docs/execution-timeline.md](docs/execution-timeline.md), [docs/host-compositions.md](docs/host-compositions.md), [docs/hosted-sandboxes.md](docs/hosted-sandboxes.md), [docs/knowledge-sync.md](docs/knowledge-sync.md), [docs/realtime-voice.md](docs/realtime-voice.md), [docs/attention-compiler.md](docs/attention-compiler.md), [docs/memory-fabric.md](docs/memory-fabric.md).
+- **Examples.** Runnable demos for the new surfaces: `examples/execution-timeline.ts`, `examples/behavior-evaluation.ts`, `examples/coding-browser-evaluation.ts`, `examples/attention-compiler.ts`, `examples/memory-fabric.ts`, `examples/work-scopes-coding-loop.ts`, `examples/spawn-agent-tool.ts`, `examples/governed-provider.ts`, `examples/docker-process-session.ts`, `examples/drive-rag-sync.ts`, `examples/hosted-sandbox.ts`, `examples/scanned-document-rag.ts`, and `examples/realtime-voice-host.ts`.
+
+### Changed
+- **Lockstep `0.6.0` → `0.7.0`.** All ten publishable manifests move together with `^0.7.0` internal ranges; the lockfile, the `src/index.ts` version constant, the docs index banner, the release-workflow tag lists, and the generated package-truth artifact agree (enforced by `scripts/version-literal-gate.test.mjs`).
+- **Compat baselines regenerated** (`--update-baseline`): **469 added declarations, zero removals**. The additions are the new subpath APIs above plus members added to existing declaration groups; no export was renamed or dropped.
+- **Release budgets rebaselined with recorded reasons**: root packed/unpacked/fileCount moved for the new dist modules, templates, and docs pages, and per-package export ceilings carry the 0.7.0 addition list. Startup and timing ceilings are unchanged.
+- **Migration guide for 0.6.0 hosts**: [docs/migrate-to-0.7.md](docs/migrate-to-0.7.md) (per-item actions for the ACP/model-router refusals, every tightening, the opt-in activation steps, and rollback), indexed from [docs/migration.md](docs/migration.md) and [docs/index.md](docs/index.md).
+- **Options index and peer matrix** cover the new surfaces: [docs/options-index.md](docs/options-index.md) routes `AttentionCompilerOptions`/`AttentionInputCapOptions`/`AttentionCompileOptions`/`AttentionTruncationTriggerOptions`, the fabric and work-scope option objects, and the supervisor/spawn/worktree/lifecycle options to their owning pages (gated by `scripts/live-doc-check.test.mjs`).
+
+### Fixed
+- **Task-scoped enterprise budgets failed on their first insert.** Migration `006_aggregate_budgets`' insert bound one JavaScript `Date` to both a `timestamptz` column and interval arithmetic, so PostgreSQL refused the statement with `42P08 inconsistent types deduced for parameter $8`; the parameter is now explicitly `::timestamptz` (found by the protected PostgreSQL leg, not by hermetic doubles).
+- **A serialization failure inside the budget upsert was swallowed.** The read-then-insert path caught *every* error from the `SELECT … FOR UPDATE` probe and then issued SQL against an aborted transaction (`25P02`), which defeated the retry loop; only a genuinely missing row is recoverable by inserting now.
+- **Serializable retry policy was too small for concurrent writers.** Budget/rate rewrites on one row now retry up to 12 times with full-jitter exponential backoff (capped at 250 ms), so a 16-client burst converges instead of exhausting three near-instant attempts with `ERR_PRISM_ENTERPRISE_POSTGRES_RETRYABLE`.
+- **Integration tests were stale against migration 006** (expected five migrations) and `scripts/phase27-release.test.mjs` still asserted that no `006_` migration existed; both now check the append-only list including `006_aggregate_budgets`.
+
+### Security
+- **ACP MCP destination matching (Trap A).** `mcp.allow` entries now match by WHATWG origin plus path-segment subtree: origin lookalikes (`mcp.example.com.attacker.invalid`) and sibling path prefixes (`/mcp-other`) no longer match, and allow entries carrying userinfo, query, fragment, or ambiguous encoded path forms fail `ConfigError` at parse time.
+- **Model-router facade fails closed (Trap B).** `router.providerSource(model)` throws `ERR_PRISM_MODEL_ROUTER_ASYNC_REQUIRED` / `ERR_PRISM_MODEL_ROUTER_ASYNC_STATE` instead of handing back a provider that bypasses budgets, rate limits, circuits, fallbacks, selection policies, or durable state; `isProviderSourceEligible` lets a host check first.
+- **ACP launcher requires a real provider (Trap C/R05).** No silent `createMockProvider()` fallback; mock mode is an explicit opt-in.
+- **Per-run tool narrowing is monotonic (R11)** and remote invalidation is honored; child agents cannot widen the tenant, account, user, or scopes of the parent identity (`narrowIdentity` + `assertIdentityPropagation`).
+
+### Notes
+- **Protected PostgreSQL leg now green on 0.7.0 code**: `PRISM_TEST_POSTGRES_URL=… npm run test:postgres` passes core (72), memory (457), and the phase conformance legs (11) against `pgvector/pgvector:pg16`, the same image the release workflow uses. The three fixes above are what that leg caught.
+- **Node floor is unchanged** at `>=22` (Node 22/24 supported).
+
 ## [0.6.0] - 2026-09-12 (plans 070, 071)
 
 > **0.5.7 was never published.** This release folds that cut's content (durable concurrent tool rounds, strict-provider tool results, host-tunable knobs, peer/options truth, the dependency refresh, and the module splits) together with the 0.6.0 changes below, so a host on 0.5.6 upgrades once. See [docs/migrate-to-0.6.md](docs/migrate-to-0.6.md).
@@ -129,27 +203,27 @@
 ### Added
 - **OKF adoption (`@arnilo/prism-wiki`)**: wiki-init/refresh/lint emit and validate
   OKF v0.2 bundles (Karpathy prompt retained). See `docs/wiki.md`.
-- **DOCS-1 (Clay integration findings)**: three integrator contracts, in place on
+- **DOCS-1 (integration findings)**: three integrator contracts, in place on
   the pages that own them — resume-aware workflow nodes (`ctx.resume` or silent
   re-suspend) in `docs/workflows.md`; supervisor child factories return `Agent`
   not `AgentSession` (`SupervisorError: child "<id>" factory must return an
   Agent, got <type>`) plus durable-store nested approvals in `docs/supervisors.md`;
   task-boundary `session.compact()` fails closed during an active run in
   `docs/compaction-and-retry.md`. Each block links `examples/autonomous-coding-loop.ts`.
-- **FEATURE-2 (Clay integration findings)**: documented bounded iterate-until-done
+- **FEATURE-2 (integration findings)**: documented bounded iterate-until-done
   host-loop pattern in `docs/workflows.md` — one `runWorkflow` per iteration,
   iteration state in workflow inputs, explicit termination predicate and budgets,
   typed `BudgetExhaustedError` (fail-closed, never a hang), `replayWorkflow` per
   iteration run id. Seeded by `examples/autonomous-coding-loop.ts`. Plan 045 `loop`
   node remains the future in-graph primitive; this intake ships the docs+example
   minimum only.
-- **FEATURE-6 (Clay integration findings)**: composite `examples/autonomous-coding-loop.ts`
+- **FEATURE-6 (integration findings)**: composite `examples/autonomous-coding-loop.ts`
   conformance reference — goal → roadmap → per-task supervisor children (per-child
   models) → `runCodingGoalVerify`-style validation → observational-memory attach +
   task-boundary compact + recall → human gate with simulated restart → host-side
   bounded iterate-until-done with deterministic budget exhaustion. Mock providers
   only; no credentials or network.
-- **FEATURE-3 (Clay integration findings)**: host-opt-in command driver hooks.
+- **FEATURE-3 (integration findings)**: host-opt-in command driver hooks.
   `CommandExecutionContext` gains an optional `drivers?: CommandDrivers`
   (`startRun` / `startWorkflow` / `steer` — typed minimal handles returning
   `AgentRunResult`-shaped results / workflow run id + status) so a contributed
@@ -159,7 +233,7 @@
   the context shape unchanged (no key, no allocation). Drivers are
   host-injected capabilities, never package-supplied.
 ### Fixed
-- **FEATURE-1 (Clay integration findings)**: `resolveAgentDefinition` no longer
+- **FEATURE-1 (integration findings)**: `resolveAgentDefinition` no longer
   throws `Agent "<name>" has no model` when the declarative definition omits
   `model` but `context.overrides.model` supplies one — the fallback is a
   single `??` at `buildBaseConfig`, the `create()` path is unchanged, and a

package/README.md

@@ -158,20 +158,21 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 ## Packages
 
 <!-- generated:package-truth:inventory begin -->
-**10 publishable manifests** — root `@arnilo/prism` plus 9 workspace packages (3 `prism-*` family packages, 6 capability packages). Generated by `node scripts/package-truth.mjs --emit-docs` — do not hand-edit.
+**11 publishable manifests** — root `@arnilo/prism` plus 10 workspace packages (4 `prism-*` family packages, 6 capability packages). Generated by `node scripts/package-truth.mjs --emit-docs` — do not hand-edit.
 
 | package | version | notes |
 | --- | --- | --- |
-| `@arnilo/prism` | 0.6.0 | core — runtime, CLI/RPC, templates, docs |
-| `@arnilo/prism-coding-tools` | 0.6.0 | family — /agent, /security, /document-reader, /openapi, /computer-use-linux, /dev, /caveman, /ponytail, /impeccable subpaths |
-| `@arnilo/prism-core` | 0.6.0 | family — /runtime, /sessions, /governance, /credentials, /enterprise, /work, /validation subpaths |
-| `@arnilo/prism-providers` | 0.6.0 | family — all provider adapters as `/<adapter>` subpaths |
-| `@arnilo/prism-acp-agent` | 0.6.0 | capability — ACP adapter |
-| `@arnilo/prism-ag-ui` | 0.6.0 | capability — AG-UI/A2A/A2UI adapter |
-| `@arnilo/prism-mcp` | 0.6.0 | capability — MCP client/server/OAuth interop |
-| `@arnilo/prism-memory` | 0.6.0 | capability — memory plus /rag, /compaction/*, /graft, /wiki subpaths |
-| `@arnilo/prism-office` | 0.6.0 | capability — /documents, /sheets, /diagrams subpaths |
-| `@arnilo/prism-web-tools` | 0.6.0 | capability — Brave/Exa/Firecrawl plus peer-gated /browser and /obscura subpaths |
+| `@arnilo/prism` | 0.8.0 | core — runtime, CLI/RPC, templates, docs |
+| `@arnilo/prism-channels` | 0.8.0 | family — transport-neutral messaging runtime, durable journal, pairing and one-use approvals; official /telegram (private DMs, opt-in granted groups/topics) and experimental pinned signal-cli /signal |
+| `@arnilo/prism-coding-tools` | 0.8.0 | family — /agent, /security, /openapi, /computer-use-linux, /dev, /caveman, /ponytail, /impeccable subpaths |
+| `@arnilo/prism-core` | 0.8.0 | family — /runtime, /sessions, /governance, /credentials, /enterprise, /validation subpaths |
+| `@arnilo/prism-providers` | 0.8.0 | family — all provider adapters as `/<adapter>` subpaths |
+| `@arnilo/prism-acp-agent` | 0.8.0 | capability — ACP adapter |
+| `@arnilo/prism-ag-ui` | 0.8.0 | capability — AG-UI/A2A/A2UI adapter |
+| `@arnilo/prism-mcp` | 0.8.0 | capability — MCP client/server/OAuth interop |
+| `@arnilo/prism-memory` | 0.8.0 | capability — memory plus /rag, /compaction/*, /fabric, /graft, /wiki subpaths |
+| `@arnilo/prism-web-tools` | 0.8.0 | capability — Brave/Exa/Firecrawl plus peer-gated /browser and /obscura subpaths |
+| `@arnilo/prism-work` | 0.8.0 | capability — /connectors, /documents, /sheets, /diagrams, /document-reader, /sandbox, /skills, /tools subpaths |
 <!-- generated:package-truth:inventory end -->
 
 ## Scripts

package/dist/agent-approval.d.ts

@@ -10,6 +10,10 @@ export declare function pendingDecisionsOf(state: StoredAgentRunState): readonly
  * crash with raw TypeErrors. State-dependent checks (foreign/stale/duplicate ids, scope,
  * schema, policy) stay in {@link resolveRunDecisions}. Errors never include tool arguments,
  * elicitation payloads, credentials, or foreign approval details.
+ *
+ * The legacy `decision` accepts `continue` (plan 084 Task 1) in addition to `approve`/`deny`;
+ * it is a crash-recovery action for running-state checkpoints and is resolved in
+ * `prepareAgentRunResume`, never as an approval outcome.
  */
 export declare function assertValidAgentRunResume(resume: AgentRunResume): void;
 interface ResolvedRunDecisions {

package/dist/agent-approval.js

@@ -28,6 +28,10 @@ export function pendingDecisionsOf(state) {
  * crash with raw TypeErrors. State-dependent checks (foreign/stale/duplicate ids, scope,
  * schema, policy) stay in {@link resolveRunDecisions}. Errors never include tool arguments,
  * elicitation payloads, credentials, or foreign approval details.
+ *
+ * The legacy `decision` accepts `continue` (plan 084 Task 1) in addition to `approve`/`deny`;
+ * it is a crash-recovery action for running-state checkpoints and is resolved in
+ * `prepareAgentRunResume`, never as an approval outcome.
  */
 export function assertValidAgentRunResume(resume) {
     const invalid = (message) => new AgentDecisionError("ERR_PRISM_DECISION_INVALID", message);
@@ -45,7 +49,7 @@ export function assertValidAgentRunResume(resume) {
     if (!hasDecision && !hasDecisions)
         throw invalid("Resume requires a decision or decisions");
     if (hasDecision) {
-        if (resume.decision !== "approve" && resume.decision !== "deny") {
+        if (resume.decision !== "approve" && resume.decision !== "deny" && resume.decision !== "continue") {
             throw invalid("Unknown legacy decision");
         }
         return;

package/dist/agent-definitions.js

@@ -34,6 +34,7 @@ function buildBaseConfig(def, context) {
         ...(def.context !== undefined && { context: resolveContextProviders(def.name, def.context, context) }),
         ...(def.systemPrompt !== undefined && { systemPrompt: def.systemPrompt }),
         ...(def.instructions !== undefined && { instructions: def.instructions }),
+        ...(def.attentionCompiler !== undefined && { attentionCompiler: def.attentionCompiler }),
         ...(def.loop !== undefined && { loop: def.loop }),
         ...(def.metadata !== undefined && { metadata: def.metadata }),
     };

package/dist/agent-run-lifecycle.js

@@ -1,6 +1,7 @@
 import { assertValidAgentRunResume, pendingDecisionsOf, resolveRunDecisions } from "./agent-approval.js";
 import { agentFingerprint, loadAgentRunState, publicState, saveAgentRunState } from "./agent-run-state.js";
 import { RuntimeAgentSession, throwIfAbortedSignal } from "./agent-session.js";
+import { parseAttentionStickyFrontier } from "./attention-compiler.js";
 import { AgentRunStateError } from "./contracts.js";
 function assertAgentId(actual, expected) {
     if (expected !== undefined && actual !== expected)
@@ -27,6 +28,7 @@ export function createAgentRunLifecycle(options) {
                 ownership: request.ownership,
                 fencingToken: options.fencingToken,
                 definitionRevision: resolved.definitionRevision,
+                signal: request.signal,
                 persistSessionState: request.persistSessionState,
                 includeSkillBodies: request.includeSkillBodies,
             });
@@ -54,7 +56,8 @@ export function createAgentRunLifecycle(options) {
 // Resume free functions moved from agents.ts at 0.1.4 (verbatim; the barrel re-exports the two public ones).
 /** Resume a persisted built-in run. A claimed/dispatched tool is never replayed automatically. */
 export async function resumeAgentRun(agent, ref, resume, options) {
-    return executePreparedAgentRunResume(await prepareAgentRunResume(agent, ref, resume, options));
+    throwIfAbortedSignal(options.signal);
+    return executePreparedAgentRunResume(await prepareAgentRunResume(agent, ref, resume, options, options.signal), options.signal);
 }
 /** Subscribe before resuming one durable run. Early consumer return aborts that resumed execution. */
 export async function* resumeAgentRunStream(agent, ref, resume, options) {
@@ -80,22 +83,44 @@ export async function* resumeAgentRunStream(agent, ref, resume, options) {
         }
     }
 }
+/**
+ * A `continue` resume needs a run whose frontier is intact: a crash-recovery checkpoint
+ * (`status: "running"`) or a turn-policy stop, which writes a terminal state that still carries
+ * the frontier (plan 084 Task 2). Every other terminal state is final — a naturally finished run
+ * must never be resurrected.
+ */
+function isContinuableState(state) {
+    return state.status === "running" || (state.status === "succeeded" && state.stopReason === "host_policy");
+}
 async function prepareAgentRunResume(agent, ref, resume, options, signal) {
     throwIfAbortedSignal(signal);
     // Plan 020 Task 2: one shared shape assertion before any checkpoint read/write, agent
     // resolution, subscription, or tool execution. Unknown legacy decisions (e.g. "sideways")
     // and malformed untyped batches fail closed here instead of falling through to approval.
     assertValidAgentRunResume(resume);
+    const continuing = resume.decision === "continue";
     const { record, state } = await loadAgentRunState(options.checkpoints, ref, options.ownership);
     if (state.definitionRevision !== options.definitionRevision ||
         state.agentId !== (agent.config.id ?? agent.config.name) ||
         state.fingerprint !== agentFingerprint(agent, options.definitionRevision)) {
         throw new AgentRunStateError("Agent definition revision or fingerprint mismatch on resume");
     }
-    if (record.version !== resume.expectedVersion || state.status !== "suspended") {
-        throw new AgentRunStateError("Stale or non-suspended agent run resume");
+    if (record.version !== resume.expectedVersion || !(continuing ? isContinuableState(state) : state.status === "suspended")) {
+        throw new AgentRunStateError(continuing ? "Stale or non-running agent run resume" : "Stale or non-suspended agent run resume");
+    }
+    // Crash recovery never bypasses a gate: only a running checkpoint with no unresolved work may
+    // continue. A suspended state (tool approval, elicitation, input guardrail) requires a decision.
+    if (continuing) {
+        const pending = pendingDecisionsOf(state);
+        const awaitingDispatch = state.pending?.status === "ready" || state.pendingCalls?.some((entry) => entry.status === "ready") === true;
+        if (state.interruption !== undefined || (pending?.length ?? 0) > 0 || awaitingDispatch) {
+            throw new AgentRunStateError("Continue resume requires a running checkpoint with no pending decisions");
+        }
     }
     const session = new RuntimeAgentSession({ agent, id: state.sessionId, leafId: state.leafId });
+    // Plan 078 Task 7: hand the reconstructed session to an observer (supervisor child-event pump)
+    // before any event flows. Called for every resume outcome; a throw fails closed.
+    options.onSession?.(session);
     // Opt-in session-state restore (plan 015 Task 4): names only; bodies re-resolve from
     // the live registry the next time the model (re)loads them via load_skill.
     if (options.persistSessionState && state.sessionState?.loadedSkillNames) {
@@ -105,6 +130,13 @@ async function prepareAgentRunResume(agent, ref, resume, options, signal) {
     if (options.persistSessionState && state.sessionState?.activatedToolNames) {
         session.restoreActivatedTools(state.sessionState.activatedToolNames);
     }
+    // Plan 074 P3: restore sticky attention mutations (already validated at load) so the first
+    // turn after a resume keeps its stubs instead of re-deciding them from the ratio.
+    if (options.persistSessionState && state.sessionState?.attentionSticky) {
+        const frontier = parseAttentionStickyFrontier(state.sessionState.attentionSticky);
+        if (frontier)
+            session.restoreAttentionSticky(frontier);
+    }
     // Plan 018 Task 6 (closeout `checkpoint-bodies`): restore exact instructions so the
     // resumed session renders them registry-independently (no load_skill round-trip).
     if (options.persistSessionState && options.includeSkillBodies && state.sessionState?.loadedSkillBodies) {
@@ -239,7 +271,7 @@ async function prepareAgentRunResume(agent, ref, resume, options, signal) {
         fencingToken: options.fencingToken,
     });
     return {
-        kind: "approve",
+        kind: "claim",
         session,
         state: claimed.state,
         decisions: resolved?.decisionsById,
@@ -250,6 +282,9 @@ async function prepareAgentRunResume(agent, ref, resume, options, signal) {
             interruptBeforeTool: state.interruptBeforeTool,
             fencingToken: options.fencingToken,
             resumeNestedRun: options.resumeNestedRun,
+            // The checkpoint records its own cadence (plan 084 Task 1), so a continued run keeps writing
+            // turn checkpoints without the host repeating the option on resume.
+            ...(state.checkpointPolicy ? { checkpointPolicy: state.checkpointPolicy } : {}),
         },
     };
 }

package/dist/agent-run-state.d.ts

@@ -1,3 +1,4 @@
+import { type PersistedAttentionStickyFrontier } from "./attention-compiler.js";
 import type { Agent, AgentRunInterruption, AgentRunRef, AgentRunState, AgentRunStateOptions, CheckpointRecord, CheckpointStore, JsonValue, Message, ModelConfig, NestedRunRef, OwnershipScope, RunDecision, RunLimitCounters, StickyDecision, ToolCallContent } from "./contracts.js";
 import type { SecretRedactor } from "./redaction.js";
 import { type LoadedSkillBodiesEntry } from "./skill-load.js";
@@ -46,7 +47,24 @@ export interface StoredAgentRunState extends AgentRunState {
         readonly loadedSkillBodies?: readonly LoadedSkillBodiesEntry[];
         /** Plan 041: tools activated via `search_tools` (names only; inert for absent tools on restore). */
         readonly activatedToolNames?: readonly string[];
+        /** Plan 074 P3: sticky attention mutations (thinking hashes + tool-call ids), so a durable
+         *  resume keeps its stubs instead of re-deciding on the first turn. Validated on load. */
+        readonly attentionSticky?: PersistedAttentionStickyFrontier;
     };
+    /** Per-run allow-list (Task 21). Absent = full registered set (legacy checkpoints). */
+    readonly toolNames?: readonly string[];
+    /**
+     * Recorded checkpoint cadence (plan 084 Task 1). Present only for `"every-turn"` runs, so
+     * default checkpoints stay byte-identical. A resume of such a state keeps checkpointing each
+     * turn without the host repeating the option.
+     */
+    readonly checkpointPolicy?: "every-turn";
+    /**
+     * Set when a terminal state was written by a `RunOptions.turnPolicy` stop (plan 084 Task 2):
+     * the run succeeded cleanly but its frontier is intact, so `decision: "continue"` may resume
+     * it. Absent on every other state — a naturally finished run is never continuable.
+     */
+    readonly stopReason?: "host_policy";
 }
 /** Session-state caps (plan 015 Task 4): bounded names charged against the run-state byte budget. */
 export declare const MAX_PERSISTED_SKILL_NAMES = 64;

package/dist/agent-run-state.js

@@ -1,6 +1,8 @@
 import { createHash } from "node:crypto";
+import { parseAttentionStickyFrontier } from "./attention-compiler.js";
 import { AgentLoopStateError, AgentRunStateError } from "./contracts.js";
 import { validateLoadedSkillBodies } from "./skill-load.js";
+import { HARD_RUN_TOOL_NAMES } from "./tools.js";
 export const AGENT_RUN_STATE_NAMESPACE = "prism.agent-run";
 export const AGENT_RUN_STATE_SCHEMA_VERSION = 1;
 export const DEFAULT_MAX_AGENT_RUN_STATE_BYTES = 256 * 1024;
@@ -100,6 +102,9 @@ export function validateRunStateOptions(options) {
     if (!Number.isSafeInteger(bytes) || bytes < 1 || bytes > HARD_MAX_AGENT_RUN_STATE_BYTES) {
         throw new AgentRunStateError(`maxStateBytes must be a positive safe integer at most ${HARD_MAX_AGENT_RUN_STATE_BYTES}`);
     }
+    if (options.checkpointPolicy !== undefined && options.checkpointPolicy !== "decision" && options.checkpointPolicy !== "every-turn") {
+        throw new AgentRunStateError('checkpointPolicy must be "decision" or "every-turn"');
+    }
 }
 export async function loadAgentRunState(checkpoints, ref, ownership) {
     const record = await checkpoints.loadCheckpoint({ namespace: AGENT_RUN_STATE_NAMESPACE, key: ref.runId, ...ownership });
@@ -128,7 +133,7 @@ export async function saveAgentRunState(input) {
     return { record, state: { ...bounded, version: record.version } };
 }
 export function publicState(state) {
-    const { input: _input, pending: _pending, pendingCalls: _pendingCalls, nestedRuns: _nestedRuns, interruptBeforeTool: _interruptBeforeTool, counters: _counters, deadlineAt: _deadlineAt, ...publicValue } = state;
+    const { input: _input, pending: _pending, pendingCalls: _pendingCalls, nestedRuns: _nestedRuns, interruptBeforeTool: _interruptBeforeTool, counters: _counters, deadlineAt: _deadlineAt, toolNames: _toolNames, checkpointPolicy: _checkpointPolicy, stopReason: _stopReason, ...publicValue } = state;
     return publicValue;
 }
 export function initialAgentRunState(input) {
@@ -150,6 +155,7 @@ export function initialAgentRunState(input) {
         interruptBeforeTool: input.interruptBeforeTool,
         counters: input.counters,
         deadlineAt: input.deadlineAt,
+        ...(input.options.checkpointPolicy === "every-turn" ? { checkpointPolicy: "every-turn" } : {}),
     };
 }
 export function parseAgentRunState(value, version) {
@@ -203,6 +209,22 @@ export function parseAgentRunState(value, version) {
             !("snapshot" in state.loopState))) {
         throw new AgentRunStateError("Malformed agent run loop state");
     }
+    if (state.toolNames !== undefined) {
+        if (!Array.isArray(state.toolNames) || state.toolNames.length > HARD_RUN_TOOL_NAMES) {
+            throw new AgentRunStateError(`Run toolNames exceed ${HARD_RUN_TOOL_NAMES} entries`);
+        }
+        for (const name of state.toolNames) {
+            if (typeof name !== "string" || name.length === 0 || name.length > MAX_PERSISTED_SKILL_NAME_CHARS) {
+                throw new AgentRunStateError("Malformed agent run toolNames");
+            }
+        }
+    }
+    if (state.checkpointPolicy !== undefined && state.checkpointPolicy !== "every-turn") {
+        throw new AgentRunStateError("Malformed agent run checkpoint policy");
+    }
+    if (state.stopReason !== undefined && state.stopReason !== "host_policy") {
+        throw new AgentRunStateError("Malformed agent run stop reason");
+    }
     // Load bounds against the hard cap, not the default: the configured maxStateBytes is a
     // save-side policy knob, while the load-side bound is only a DoS ceiling. States saved
     // with a raised maxStateBytes must remain resumable.
@@ -261,15 +283,23 @@ function validateSessionState(sessionState) {
         }
     }
     const activated = sessionState.activatedToolNames;
-    if (activated === undefined)
-        return;
-    if (!Array.isArray(activated) || activated.length > MAX_PERSISTED_ACTIVATED_TOOL_NAMES) {
-        throw new AgentRunStateError(`Activated-tool names exceed ${MAX_PERSISTED_ACTIVATED_TOOL_NAMES} entries`);
-    }
-    for (const name of activated) {
-        if (typeof name !== "string" || name.length > MAX_PERSISTED_SKILL_NAME_CHARS) {
-            throw new AgentRunStateError(`Activated-tool name exceeds ${MAX_PERSISTED_SKILL_NAME_CHARS} chars`);
+    if (activated !== undefined) {
+        if (!Array.isArray(activated) || activated.length > MAX_PERSISTED_ACTIVATED_TOOL_NAMES) {
+            throw new AgentRunStateError(`Activated-tool names exceed ${MAX_PERSISTED_ACTIVATED_TOOL_NAMES} entries`);
         }
+        for (const name of activated) {
+            if (typeof name !== "string" || name.length > MAX_PERSISTED_SKILL_NAME_CHARS) {
+                throw new AgentRunStateError(`Activated-tool name exceeds ${MAX_PERSISTED_SKILL_NAME_CHARS} chars`);
+            }
+        }
+    }
+    const attention = sessionState.attentionSticky;
+    if (attention === undefined)
+        return;
+    // Both arrays are capped by the parser, and a malformed frontier is dropped rather than
+    // failing the resume: re-deciding a mutation is safe, refusing to resume is not.
+    if (parseAttentionStickyFrontier(attention) === undefined) {
+        throw new AgentRunStateError("Malformed agent run attention frontier");
     }
 }
 //# sourceMappingURL=agent-run-state.js.map

package/dist/agent-session/helpers.js

@@ -53,7 +53,12 @@ export function finalAssistantMessage(history) {
     return { content: [], text: "" };
 }
 export function errorFromInfo(error) {
-    return Object.assign(new Error(error.message), { name: error.name ?? "Error", cause: error.cause, code: error.code });
+    return Object.assign(new Error(error.message), {
+        name: error.name ?? "Error",
+        cause: error.cause,
+        code: error.code,
+        failureClass: error.failureClass,
+    });
 }
 export class ProviderTurnFailure extends Error {
     info;