@corenel/harness 0.13.0 → 0.15.0

package/dist/core/loop.d.ts

@@ -3,9 +3,20 @@ import type { ChatCompletionMessageParam } from 'openai/resources/chat/completio
 import type { AgentTool, ToolContext, AgentEvent, Usage } from '@corenel/protocol';
 import { type RecoveryConfig } from './recovery';
 import type { Policy } from '@corenel/protocol';
+import type { DontsJudge } from '@corenel/protocol';
 import type { PermissionService } from '../guardrail/permission-service';
 import { type CompressionConfig } from '../compression';
+import { type FoldSummary } from './foldBlocks';
+import type { FoldStorage } from './foldTypes';
 import { type SkillEntry } from '../tools/skillTool';
+/** What the run ends with when even a folded history will not fit the window. */
+export declare const OVERFLOW_GIVE_UP = "The conversation no longer fits this model's context window even after folding. Start a new chat or switch to a larger-context model.";
+/** The overflow ending when there was nothing a fold could remove (compaction
+ * not configured, or nothing collapsible). */
+export declare const OVERFLOW_NO_FOLD = "The conversation no longer fits this model's context window and there is nothing left to fold. Start a new chat or switch to a larger-context model.";
+/** The overflow ending when a fold was possible but did not complete (the
+ * summarizer threw, for one). The loop appends the fold error and the 400. */
+export declare const OVERFLOW_FOLD_FAILED = "The conversation no longer fits this model's context window and folding it failed. Try again, or start a new chat.";
 export interface RunAgentArgs {
     client: OpenAI;
     model: string;
@@ -38,6 +49,12 @@ export interface RunAgentArgs {
     /** The spawned child this run is, stamped onto every permission decision it
      * reports (`DecisionEvent.nodeId`). Absent for a root run. */
     decisionNodeId?: string;
+    /** Team don'ts (spec 2026-10-07 Part F). Present only on a team daemon run
+     * of an agent with don'ts. While present, reply text is held (no
+     * `assistant-delta`) and checked before it is committed, and every mutating
+     * or owner-level tool call is checked after the permission gate allows it.
+     * Absent: the loop is exactly as before. */
+    donts?: DontsJudge;
     /** Customize the tool-result text a refused tool call gets. The kernel is
      * host-agnostic and cannot know WHY a decision came back "deny" — a real
      * person declining an interactive prompt, and a non-interactive host that
@@ -54,13 +71,17 @@ export interface RunAgentArgs {
      * then behaves exactly as it did before this existed, which is to say it
      * runs until the provider rejects an oversized request with a fatal 400.
      * `summarize` is a host concern because it costs a model call; the host also
-     * decides where `onCheckpoint` persists the body (a file the user can edit,
-     * not an invisible blob). */
+     * decides, through `storage`, where a fold is persisted (files the user can
+     * edit, not an invisible blob). */
     compaction?: {
-        summarize: (collapsed: ChatCompletionMessageParam[]) => Promise<string>;
-        anchor?: (user: ChatCompletionMessageParam, answered: ChatCompletionMessageParam | null) => Promise<string>;
-        onCheckpoint?: (checkpoint: string) => void | Promise<void>;
+        summarize: (collapsed: ChatCompletionMessageParam[]) => Promise<FoldSummary>;
+        /** Where folds are recorded and what backs recall_history/update_directives.
+         * Absent: the run still folds, it just records nothing. */
+        storage?: FoldStorage;
     };
+    /** Fold before the first request regardless of fill: set when the chat's own
+     * model is gone and the fallback's window cannot hold the history. */
+    forceFoldFirstTurn?: boolean;
     /** Intra-run self-healing budget (stream-retry + tool-steer). Omit for defaults. */
     recovery?: Partial<RecoveryConfig>;
     /** Optional output-token ceiling forwarded to the model on every turn (reasoning

package/dist/core/loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../core/loop.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,0BAA0B,EAAsB,MAAM,mCAAmC,CAAC;AACxG,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAA4B,MAAM,mBAAmB,CAAC;AAE7G,OAAO,EACY,KAAK,cAAc,EAErC,MAAM,YAAY,CAAC;AAMpB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAA0D,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAKhH,OAAO,EAA+B,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKlF,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd;kDAC8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,0BAA0B,EAAE,CAAC;IACvC,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB;;;kFAG8E;IAC9E,aAAa,CAAC,EAAE,SAAS,EAAE,CAAC;IAC5B;oFACgF;IAChF,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;0EAIsE;IACtE,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC;IACtB,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;kEAC8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;6EAQyE;IACzE,wBAAwB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACxD,oEAAoE;IACpE,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC;;;;;iCAK6B;IAC7B,UAAU,CAAC,EAAE;QACX,SAAS,EAAE,CAAC,SAAS,EAAE,0BAA0B,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QACxE,MAAM,CAAC,EAAE,CACP,IAAI,EAAE,0BAA0B,EAChC,QAAQ,EAAE,0BAA0B,GAAG,IAAI,KACxC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrB,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC7D,CAAC;IACF,oFAAoF;IACpF,QAAQ,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACnC;0FACsF;IACtF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;yEAOqE;IACrE,aAAa,CAAC,EAAE,MAAM,0BAA0B,EAAE,CAAC;IACnD;;4DAEwD;IACxD,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC;IACpC;;;;;8EAK0E;IAC1E,UAAU,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACjC;;;0EAGsE;IACtE,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;IACpD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,0BAA0B,EAAE,CAAC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,KAAK,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;oFAYgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;yFAIqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;gEAWgE;AAChE,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAEtC;wEACwE;AACxE,eAAO,MAAM,eAAe,IAAI,CAAC;AAEjC,wBAAsB,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAopB1E"}
+{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../core/loop.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,0BAA0B,EAAsB,MAAM,mCAAmC,CAAC;AACxG,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAA4B,MAAM,mBAAmB,CAAC;AAE7G,OAAO,EACY,KAAK,cAAc,EAErC,MAAM,YAAY,CAAC;AAMpB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAmB,MAAM,mBAAmB,CAAC;AAKrE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAA0D,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAChH,OAAO,EAA2B,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAK/C,OAAO,EAA+B,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKlF,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,0IAA0I,CAAC;AAExK;8CAC8C;AAC9C,eAAO,MAAM,gBAAgB,yJAAyJ,CAAC;AAEvL;8EAC8E;AAC9E,eAAO,MAAM,oBAAoB,uHAAuH,CAAC;AAMzJ,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd;kDAC8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,0BAA0B,EAAE,CAAC;IACvC,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB;;;kFAG8E;IAC9E,aAAa,CAAC,EAAE,SAAS,EAAE,CAAC;IAC5B;oFACgF;IAChF,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;0EAIsE;IACtE,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC;IACtB,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;kEAC8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;gDAI4C;IAC5C,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB;;;;;;;;6EAQyE;IACzE,wBAAwB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACxD,oEAAoE;IACpE,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC;;;;;uCAKmC;IACnC,UAAU,CAAC,EAAE;QACX,SAAS,EAAE,CAAC,SAAS,EAAE,0BAA0B,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7E;mEAC2D;QAC3D,OAAO,CAAC,EAAE,WAAW,CAAC;KACvB,CAAC;IACF;0EACsE;IACtE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACnC;0FACsF;IACtF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;yEAOqE;IACrE,aAAa,CAAC,EAAE,MAAM,0BAA0B,EAAE,CAAC;IACnD;;4DAEwD;IACxD,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC;IACpC;;;;;8EAK0E;IAC1E,UAAU,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACjC;;;0EAGsE;IACtE,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;IACpD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,0BAA0B,EAAE,CAAC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,KAAK,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;oFAYgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;yFAIqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;gEAWgE;AAChE,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAEtC;wEACwE;AACxE,eAAO,MAAM,eAAe,IAAI,CAAC;AAEjC,wBAAsB,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAoyB1E"}

package/dist/core/loop.js

@@ -5,8 +5,12 @@ import { initialState, evaluateTurnStart, evaluateToolCall, evaluateCompletion }
 import { checkFeature } from '../guards.js';
 import { STANDARD_POLICY } from '../guardrail/builtins.js';
 import { toolAddress } from '../tools/namespaces.js';
+import { DONTS_MAX_STRIKES, DONTS_STOPPED, DONTS_STOP_REASON, DONT_REPLY_TOO_LONG_NOTE, DONT_TOOL_BLOCKED_RESULT, blockedReplyNote, blockedToolNote, } from '@corenel/protocol';
+import { recentForJudge } from './dontsRecent.js';
 import { effectiveThreshold, formatOffloadRef, isOffloadPointer } from '../compression.js';
-import { compactHistory, compactionDecision, estimateFill, isCompactionMarker } from './compactHistory.js';
+import { FALLBACK_CONTEXT_WINDOW } from './foldBlocks.js';
+import { afterCompaction, compactHistory, compactionDecision, estimateFill, isCompactionMarker } from './compactHistory.js';
+import { makeRecallHistoryTool, makeUpdateDirectivesTool } from '../tools/foldTools.js';
 import { contextNote, contextWindowLine, initialPressureGate, pressureDecision } from './contextPressure.js';
 import { fillToolsMarker } from '../prompts/toolsMarker.js';
 import { createToolLoader, serverIndex } from '../tools/toolSearch.js';
@@ -14,6 +18,14 @@ import { createSkillTool, skillIndex } from '../tools/skillTool.js';
 import { crewToolGuidance } from '../tools/crewList.js';
 import { createTurnVerifier } from './turnVerify.js';
 import { existedBefore, reportFileChanges, FILE_CHANGE_TOOLS } from './fileChanges.js';
+/** What the run ends with when even a folded history will not fit the window. */
+export const OVERFLOW_GIVE_UP = "The conversation no longer fits this model's context window even after folding. Start a new chat or switch to a larger-context model.";
+/** The overflow ending when there was nothing a fold could remove (compaction
+ * not configured, or nothing collapsible). */
+export const OVERFLOW_NO_FOLD = "The conversation no longer fits this model's context window and there is nothing left to fold. Start a new chat or switch to a larger-context model.";
+/** The overflow ending when a fold was possible but did not complete (the
+ * summarizer threw, for one). The loop appends the fold error and the 400. */
+export const OVERFLOW_FOLD_FAILED = "The conversation no longer fits this model's context window and folding it failed. Try again, or start a new chat.";
 /** The most tools one request may carry.
  *
  * OpenAI-compatible providers refuse the whole request above this -- "Invalid
@@ -37,6 +49,18 @@ export async function runAgent(args) {
     const verifier = createTurnVerifier({ kv: toolCtx.kv, files: toolCtx.files });
     const policy = args.policy ?? STANDARD_POLICY;
     const permission = args.permission;
+    const donts = args.donts;
+    /** The resolved permission level of a call the don'ts judge checks: a
+     * mutating call, or one whose level is `owner`. Null for every other call,
+     * for an unknown tool, and always without the port. */
+    const dontsCheckedLevel = (tool) => {
+        if (!donts || !tool)
+            return null;
+        const level = permission
+            ? permission.resolveLevel({ name: tool.name, address: toolAddress(tool), mutates: tool.mutates, permission: tool.permission, roomSafe: tool.roomSafe })
+            : 'allow';
+        return tool.mutates === true || level === 'owner' ? level : null;
+    };
     const compression = args.compression;
     const ctxWindow = compression?.contextWindow;
     const compressionStrategy = compression?.strategy ?? 'eager';
@@ -101,13 +125,17 @@ export async function runAgent(args) {
      * appears is an exact count of what this run added -- maintained by nothing,
      * and therefore impossible for a later `push` site to get wrong. */
     const incoming = new Set(args.messages);
+    /* A blocked-reply note is a system message this run appended. It is counted,
+     * never mistaken for the system prompt the walk below stops at. Empty
+     * without the don'ts port. */
+    const dontsNotes = new Set();
     const appendedFromTail = () => {
         let n = 0;
         for (let i = messages.length - 1; i >= 0; i--) {
             const m = messages[i];
-            // A compaction's own checkpoint/anchor, and the system prompt unshifted
+            // A fold's own summary/directives blocks, and the system prompt unshifted
             // below, are fresh objects too -- and neither is something this run said.
-            if (incoming.has(m) || m.role === 'system' || isCompactionMarker(m))
+            if (incoming.has(m) || (m.role === 'system' && !dontsNotes.has(m)) || isCompactionMarker(m))
                 break;
             n++;
         }
@@ -122,7 +150,14 @@ export async function runAgent(args) {
         ? createToolLoader({ deferred, loaded: args.loadedTools, onChange: (names) => emit({ type: 'tools-loaded', names }) })
         : null;
     const skills = args.skills ?? [];
-    const eager = [...tools, ...(skills.length ? [createSkillTool(skills)] : []), ...(loader ? [loader.searchTool] : [])];
+    const storage = args.compaction?.storage;
+    const foldTools = [
+        ...(storage?.transcript ? [makeRecallHistoryTool(storage.transcript)] : []),
+        ...(storage?.directives ? [makeUpdateDirectivesTool(storage.directives)] : []),
+    ];
+    /* Fold tools LAST: when MAX_PROVIDER_TOOLS caps this list, they must never be
+     * what pushes `use_skill` or `tool_search` off the end. */
+    const eager = [...tools, ...(skills.length ? [createSkillTool(skills)] : []), ...(loader ? [loader.searchTool] : []), ...foldTools];
     const capped = (list) => (list.length > MAX_PROVIDER_TOOLS ? list.slice(0, MAX_PROVIDER_TOOLS) : list);
     const activeTools = () => capped(loader ? [...eager, ...loader.loaded()] : eager);
     let sent = activeTools();
@@ -197,6 +232,82 @@ export async function runAgent(args) {
         const known = new Map([...eager, ...deferred].map((t) => [t.name, t]));
         await compactIncomingOffloads(messages, known, compression, toolCtx.recall, emit);
     }
+    const foldWindow = ctxWindow || FALLBACK_CONTEXT_WINDOW;
+    let forceFold = !!args.forceFoldFirstTurn;
+    /* One fold, used by three triggers: the fill gate, a forced fold (model
+     * switch), and the overflow retry. Rebuilds `messages` in place -- callers
+     * (and `res.messages`) hold this array. Returns what happened; on 'failed'
+     * the reason is left in `foldError` for the overflow message.
+     *
+     * A summarizer failure is the same shape as a persist failure: the window is
+     * full, the model call meant to compress it did not come back, and the honest
+     * response is to carry on UNFOLDED rather than end the run on the recovery
+     * path. The turn proceeds with the history it had, which is exactly what
+     * would have happened without compaction at all. */
+    let foldError = '';
+    const fold = async (offloadFill) => {
+        if (!args.compaction)
+            return 'nothing';
+        try {
+            let override = null;
+            try {
+                override = (await storage?.directives?.read()) ?? null;
+            }
+            catch (e) {
+                alog('directives read failed', e instanceof Error ? e.message : String(e));
+            }
+            const out = await compactHistory(messages, {
+                summarize: args.compaction.summarize,
+                contextWindow: foldWindow,
+                directivesOverride: override,
+                recallAvailable: !!storage?.transcript,
+                offloadOverBytes: compression && compression.mode !== 'off'
+                    ? effectiveThreshold(compression.mode, offloadFill)
+                    : undefined,
+                offload: toolCtx.recall
+                    // Recorded under 'user' rather than a tool name: the RecallStore is
+                    // indifferent to who authored the bulk, but the transcript should not
+                    // claim a tool produced what a person pasted.
+                    ? async (content) => formatOffloadRef(await toolCtx.recall.record('user', content))
+                    : undefined,
+            });
+            /* Nothing to collapse: no fold happened, so nothing is recorded or emitted. */
+            if (!out)
+                return 'nothing';
+            messages.splice(0, messages.length, ...out.messages);
+            /* The 'deferred' strategy holds ABSOLUTE indices into `messages`, to
+             * rewrite those entries once the model has seen them in full. The splice
+             * above just invalidated every one of them, and the rewrite pass read
+             * `.role` off the resulting undefined -- a crash in the interactive
+             * CLI's shipping configuration ('deferred' + compaction). Nothing is
+             * lost by dropping them: the tool results they point at were collapsed
+             * into the summary and are not in `messages` any more. */
+            deferredOffloads.length = 0;
+            /* The fold has ALREADY happened by this point. Failing to RECORD it must
+             * not take the run with it -- the checkpoint store deliberately rejects
+             * rather than risk clobbering an existing CHECKPOINT.md, and a read-only
+             * workspace rejects too. Dying here would lose the whole conversation in
+             * order to save nothing. */
+            try {
+                await storage?.onFold?.({ summary: out.summary, directives: out.directives, collapsed: out.collapsed });
+            }
+            catch (e) {
+                alog('fold persist failed', e instanceof Error ? e.message : String(e));
+            }
+            emit({ type: 'checkpoint', collapsed: out.collapsedCount, checkpoint: out.summary });
+            compactGate = afterCompaction();
+            return 'folded';
+        }
+        catch (e) {
+            /* Re-arm so a later turn may try again rather than giving up for good.
+             * The floor is left as it was: it describes where the last SUCCESSFUL
+             * fold landed, and a failed attempt moved nothing. */
+            compactGate = { ...compactGate, armed: true };
+            foldError = e instanceof Error ? e.message : String(e);
+            alog('compaction failed', foldError);
+            return 'failed';
+        }
+    };
     const usage = { promptTokens: 0, completionTokens: 0 };
     /** Model calls made, and the largest single request among them. */
     let calls = 0;
@@ -205,6 +316,9 @@ export async function runAgent(args) {
     let stopReason = 'stop';
     let lastToolSig = null;
     let stopNudges = 0;
+    /** Denials by the don'ts judge in this run; the third stops it. Counted per
+     * loop: a callee's own port counts its own (preflight F20). */
+    let strikes = 0;
     let lastStreamErr = ''; // the blip a stream retry recovered from (for the heal record)
     for (let turn = 1; unlimitedTurns || turn <= maxTurns; turn++) {
         if (signal.aborted) {
@@ -221,74 +335,26 @@ export async function runAgent(args) {
                 emit({ type: 'injected', content: typeof m.content === 'string' ? m.content : '' });
             }
         }
-        /* Rung-2 history compaction, BEFORE the request is built so the compacted
-         * array is what goes on the wire. `fill` is last turn's prompt/window
-         * ratio; shouldCompact refuses below the threshold and refuses again when
-         * there is nothing collapsible, because a compaction that removes nothing
-         * still rewrites the cached prefix and re-bills everything after it.
-         * Rebuilt in place: callers (and `res.messages`) hold this array. */
-        /* On turn 1 there is no usage reading yet, so `fill` is 0 and the gate
-         * could not fire before the first request -- which is precisely how a run
-         * resuming an already-oversized conversation put it on the wire and took
-         * the fatal 400. Fall back to reading the window off the messages. Only as
-         * a fallback: a real reading is always better than an estimate that cannot
-         * see the tool schemas. */
+        /* Rung-2 fold, BEFORE the request is built so the folded array is what goes
+         * on the wire. `fill` is last turn's prompt/window ratio; the gate refuses
+         * below the threshold and refuses again when there is nothing collapsible,
+         * because a fold that removes nothing still rewrites the cached prefix and
+         * re-bills everything after it. On turn 1 there is no usage reading yet, so
+         * `fill` is 0 and the gate could not fire before the first request -- which
+         * is how a resumed, already-oversized conversation took the fatal 400. Fall
+         * back to reading the window off the messages; only as a fallback: a real
+         * reading beats an estimate that cannot see the tool schemas. */
         const gateFill = fill || estimateFill(messages, ctxWindow);
-        const gate = compactionDecision(gateFill, messages, compactGate);
+        const prevGate = compactGate;
+        const gate = compactionDecision(gateFill, messages, compactGate, foldWindow);
         compactGate = gate.next;
-        if (args.compaction && gate.compact) {
-            const before = messages.length;
-            /* A summarizer failure is the same shape as a persist failure: the window
-             * is full, the model call meant to compress it did not come back, and the
-             * honest response is to carry on UNCOMPACTED rather than end the run on
-             * the recovery path. The turn then proceeds with the history it had,
-             * which is exactly what would have happened without compaction at all. */
-            try {
-                const out = await compactHistory(messages, {
-                    summarize: args.compaction.summarize,
-                    anchor: args.compaction.anchor,
-                    offloadOverBytes: compression && compression.mode !== 'off'
-                        ? effectiveThreshold(compression.mode, gateFill)
-                        : undefined,
-                    offload: toolCtx.recall
-                        // Recorded under 'user' rather than a tool name: the RecallStore is
-                        // indifferent to who authored the bulk, but the transcript should not
-                        // claim a tool produced what a person pasted.
-                        ? async (content) => formatOffloadRef(await toolCtx.recall.record('user', content))
-                        : undefined,
-                });
-                messages.splice(0, messages.length, ...out.messages);
-                /* The 'deferred' strategy holds ABSOLUTE indices into `messages`, to
-                 * rewrite those entries once the model has seen them in full. The splice
-                 * above just invalidated every one of them, and the rewrite pass read
-                 * `.role` off the resulting undefined -- a crash in the interactive
-                 * CLI's shipping configuration ('deferred' + compaction). Nothing is
-                 * lost by dropping them: the tool results they point at were collapsed
-                 * into the checkpoint and are not in `messages` any more. */
-                deferredOffloads.length = 0;
-                /* The compaction has ALREADY happened by this point. Failing to RECORD it
-                 * must not take the run with it -- checkpointStore.append deliberately
-                 * rejects rather than risk clobbering an existing CHECKPOINT.md, and a
-                 * read-only workspace rejects too. Dying here would lose the whole
-                 * conversation in order to save nothing. */
-                try {
-                    await args.compaction.onCheckpoint?.(out.checkpoint);
-                }
-                catch (e) {
-                    alog('checkpoint persist failed', e instanceof Error ? e.message : String(e));
-                }
-                emit({ type: 'checkpoint', collapsed: before - messages.length, checkpoint: out.checkpoint });
-            }
-            catch (e) {
-                /* Compaction failed (most likely the summarizer's own model call). The
-                 * turn proceeds with the history it had -- exactly what would have
-                 * happened had compaction never been configured. Re-arm so a later turn
-                 * may try again rather than giving up on the run for good. */
-                /* The floor is left as it was: it describes where the last SUCCESSFUL
-                 * compaction landed, and a failed attempt moved nothing. */
-                compactGate = { ...compactGate, armed: true };
-                alog('compaction failed', e instanceof Error ? e.message : String(e));
-            }
+        if (args.compaction && (gate.compact || forceFold)) {
+            forceFold = false;
+            /* The gate fired but there was nothing to fold (the only bulk is a
+             * pending tool call, held back): nothing was spent, so the latch is not
+             * either -- it fires again once there is something to collapse. */
+            if ((await fold(gateFill)) === 'nothing' && gate.compact)
+                compactGate = prevGate;
         }
         /* CONTEXT PRESSURE. After the compaction block, deliberately: if a
          * compaction just ran, the window it drained is the one the agent should
@@ -357,6 +423,8 @@ export async function runAgent(args) {
         turnAc = new AbortController();
         if (signal.aborted)
             turnAc.abort();
+        let overflowRetried = false;
+        let foldRetryOpen = false; // a 'retrying' fold-retry heal record awaits its outcome
         for (let sAttempt = 0;;) {
             try {
                 const result = await streamCompletion(client, {
@@ -366,9 +434,16 @@ export async function runAgent(args) {
                     tool_choice: toolDefs.length ? 'auto' : undefined,
                     max_completion_tokens: args.maxCompletionTokens,
                     temperature: args.temperature,
-                }, turnAc.signal, (delta) => emit({ type: 'assistant-delta', delta }));
+                }, turnAc.signal, 
+                // A held reply is never streamed: it is shown only once it passes.
+                (delta) => { if (!donts)
+                    emit({ type: 'assistant-delta', delta }); });
                 if (sAttempt > 0)
                     emit({ type: 'heal', record: { site: 'stream', kind: 'transient', strategy: 'retry-backoff', attempt: sAttempt, outcome: 'recovered', error: lastStreamErr } });
+                if (foldRetryOpen) {
+                    foldRetryOpen = false;
+                    emit({ type: 'heal', record: { site: 'stream', kind: 'overflow', strategy: 'fold-retry', attempt: 1, outcome: 'recovered', error: lastStreamErr } });
+                }
                 streamed = result;
                 break;
             }
@@ -388,6 +463,26 @@ export async function runAgent(args) {
                 const msg = String(e?.message || e);
                 lastStreamErr = msg;
                 const kind = classifyStreamError(msg);
+                /* A context-length rejection is not transient: re-sending the same
+                 * history fails the same way. Fold once and re-send (`fold` rewrote
+                 * `messages` in place and streamCompletion reads it by reference); a
+                 * second overflow means folding could not make it fit. */
+                if (kind === 'overflow') {
+                    const outcome = overflowRetried ? null : await fold(1);
+                    if (outcome === 'folded') {
+                        overflowRetried = true;
+                        foldRetryOpen = true;
+                        emit({ type: 'heal', record: { site: 'stream', kind, strategy: 'fold-retry', attempt: sAttempt + 1, outcome: 'retrying', error: msg } });
+                        continue;
+                    }
+                    emit({ type: 'heal', record: { site: 'stream', kind, strategy: 'give-up', attempt: sAttempt + 1, outcome: 'abandoned', error: msg } });
+                    const ending = overflowRetried ? `${OVERFLOW_GIVE_UP} (${msg})`
+                        : outcome === 'failed' ? `${OVERFLOW_FOLD_FAILED} (${foldError}; ${msg})`
+                            : `${OVERFLOW_NO_FOLD} (${msg})`;
+                    emit({ type: 'error', message: ending });
+                    streamFail = 'error';
+                    break;
+                }
                 sAttempt++;
                 if (shouldRetryStream(kind, sAttempt, recovery)) {
                     emit({ type: 'heal', record: { site: 'stream', kind, strategy: 'retry-backoff', attempt: sAttempt, outcome: 'retrying', error: msg } });
@@ -460,6 +555,46 @@ export async function runAgent(args) {
                 compactGate = { armed: false, floor: fill };
         }
         emit({ type: 'usage', usage: streamed.usage, model });
+        /* TEAM DON'TS: the reply is checked before anything of this turn is
+         * committed, its tool calls included, so a denied reply runs none of them
+         * and leaves no tool_call without a result. A denied reply is never
+         * emitted or kept: the model gets a note instead and answers again. */
+        if (donts && streamed.content) {
+            emit({ type: 'donts-checking', subject: 'reply' });
+            const held = await donts.checkReply({ text: streamed.content, turn, recent: recentForJudge(messages) });
+            if (held.kind === 'cancelled') {
+                stopReason = 'aborted';
+                break;
+            }
+            if (held.kind === 'denied') {
+                strikes++;
+                if (strikes >= DONTS_MAX_STRIKES) {
+                    emit({ type: 'error', message: DONTS_STOPPED });
+                    stopReason = DONTS_STOP_REASON;
+                    break;
+                }
+                const note = { role: 'system', content: held.tooLong ? DONT_REPLY_TOO_LONG_NOTE : blockedReplyNote(held.rule, held.by ?? 'nobody') };
+                dontsNotes.add(note);
+                messages.push(note);
+                if (!unlimitedTurns && turn === maxTurns)
+                    stopReason = 'max_turns';
+                continue;
+            }
+        }
+        /* TEAM DON'TS (preflight F4 amended, F5): every call the judge will check,
+         * by id, with its resolved level. Such a call is committed with '{}' as its
+         * arguments and gets its real ones back only once it is announced (it
+         * passed, or a person allowed it), so a held excerpt is never stored on any
+         * exit path. The raw arguments stay in `streamed.toolCalls`, which is what
+         * runs and what the no-progress signature compares. Empty without the port. */
+        const dontsChecked = new Map();
+        if (donts) {
+            for (const t of streamed.toolCalls) {
+                const level = dontsCheckedLevel(toolByName.get(t.name));
+                if (level !== null)
+                    dontsChecked.set(t.id, level);
+            }
+        }
         // Commit the assistant message to history (with tool_calls if any).
         const assistantMsg = streamed.toolCalls.length
             ? {
@@ -468,7 +603,7 @@ export async function runAgent(args) {
                 tool_calls: streamed.toolCalls.map((t) => ({
                     id: t.id,
                     type: 'function',
-                    function: { name: t.name, arguments: t.arguments },
+                    function: { name: t.name, arguments: dontsChecked.has(t.id) ? '{}' : t.arguments },
                 })),
             }
             : { role: 'assistant', content: streamed.content };
@@ -503,18 +638,31 @@ export async function runAgent(args) {
         }
         lastToolSig = sig;
         let policyStop = false;
+        let dontsStop = false;
+        let dontsCancelled = false;
         for (const call of streamed.toolCalls) {
             let parsed = {};
             try {
                 parsed = call.arguments ? JSON.parse(call.arguments) : {};
             }
             catch {
-                messages.push({ role: 'tool', tool_call_id: call.id, content: `Error: arguments were not valid JSON: ${call.arguments}` });
+                // A checked call's arguments are held (preflight F4): never echoed back.
+                const invalid = dontsChecked.has(call.id)
+                    ? DONT_INVALID_JSON_RESULT
+                    : `Error: arguments were not valid JSON: ${call.arguments}`;
+                messages.push({ role: 'tool', tool_call_id: call.id, content: invalid });
                 emit({ type: 'tool-result', id: call.id, name: call.name, result: 'invalid JSON arguments', isError: true });
                 continue;
             }
             alog('tool', call.name, parsed);
-            emit({ type: 'tool-call', id: call.id, name: call.name, args: parsed });
+            /* TEAM DON'TS (preflight F5): a call the judge will check is announced
+             * only once it passes or a person allows it, so its arguments never
+             * reach the asker before then. `checkedLevel` is null for every call
+             * that is not checked, and always without the port: those emit here,
+             * exactly as before. */
+            const checkedLevel = dontsChecked.get(call.id) ?? null;
+            if (checkedLevel === null)
+                emit({ type: 'tool-call', id: call.id, name: call.name, args: parsed });
             const tool = toolByName.get(call.name);
             if (!tool) {
                 messages.push({ role: 'tool', tool_call_id: call.id, content: `Error: unknown tool "${call.name}"` });
@@ -595,6 +743,36 @@ export async function runAgent(args) {
                     continue;
                 }
             }
+            /* TEAM DON'TS: after the permission gate allowed it, never before, so a
+             * call refused by policy or by a person never reaches the judge. Only a
+             * mutating call or one whose level is `owner` (`checkedLevel` above). */
+            if (donts && checkedLevel !== null) {
+                const mutating = tool.mutates === true;
+                emit({ type: 'donts-checking', subject: 'tool', tool: tool.name });
+                const held = await donts.checkTool({ tool: tool.name, input: parsed, level: checkedLevel, mutating, recent: recentForJudge(messages) });
+                if (held.kind === 'cancelled') {
+                    dontsCancelled = true;
+                    break;
+                }
+                if (held.kind === 'denied') {
+                    strikes++;
+                    // The note carries the rule, never the arguments (preflight F4).
+                    messages.push({ role: 'tool', tool_call_id: call.id, content: blockedToolNote(tool.name, held.rule, held.by ?? 'nobody') });
+                    // Announced with empty arguments (final fix M1): a live surface pairs
+                    // the blocked result with a call, while the arguments stay held.
+                    emit({ type: 'tool-call', id: call.id, name: call.name, args: {} });
+                    emit({ type: 'tool-result', id: call.id, name: tool.name, result: DONT_TOOL_BLOCKED_RESULT, isError: true });
+                    if (tool.mutates)
+                        verifier.denied(call.id, tool.name);
+                    if (strikes >= DONTS_MAX_STRIKES) {
+                        dontsStop = true;
+                        break;
+                    }
+                    continue;
+                }
+                setCallArguments(assistantMsg, call.id, call.arguments);
+                emit({ type: 'tool-call', id: call.id, name: call.name, args: parsed });
+            }
             if (tool.mutates)
                 await verifier.before(call.id, tool.name, parsed);
             // Only when someone is logging file changes, and only for a tool that
@@ -681,6 +859,15 @@ export async function runAgent(args) {
                 emit({ type: 'tool-result', id: call.id, name: call.name, result: errMsg, isError: true, durationMs: Date.now() - startedAt });
             }
         }
+        if (dontsCancelled) {
+            stopReason = 'aborted';
+            break;
+        }
+        if (dontsStop) {
+            emit({ type: 'error', message: DONTS_STOPPED });
+            stopReason = DONTS_STOP_REASON;
+            break;
+        }
         if (policyStop) {
             stopReason = 'policy';
             break;
@@ -705,6 +892,19 @@ export async function runAgent(args) {
     emit({ type: 'done', reason: stopReason });
     return { messages, text, usage, stopReason, appended: appendedFromTail(), contextTokens, calls };
 }
+/** Team don'ts: a checked call was committed with '{}' as its arguments; once
+ * it is announced its real arguments are put back in the stored message. */
+function setCallArguments(msg, callId, args) {
+    if (msg.role !== 'assistant' || !msg.tool_calls)
+        return;
+    for (const t of msg.tool_calls) {
+        if (t.id === callId)
+            t.function.arguments = args;
+    }
+}
+/** The model-facing result for a checked call whose arguments were not valid
+ * JSON: fixed text, so the held arguments are not echoed into the transcript. */
+const DONT_INVALID_JSON_RESULT = 'Error: the tool arguments were not valid JSON.';
 /** 'deferred' strategy: compact any ALREADY-oversized tool result already
  * sitting in the incoming history — i.e. produced by an earlier `runAgent()`
  * call (a prior conversation turn, a resumed session) rather than this one.