@deepstrike/sdk 0.2.4 → 0.2.6

package/dist/runtime/runner.js

@@ -1,10 +1,17 @@
+import { memoriesToIndex, selectMemories } from "../memory/agent.js";
+import { resolvePermissionRequest } from "./execution-plane.js";
 import { getKernel } from "../kernel.js";
 import { peekProviderReplay, seedProviderReplayFromEvents } from "./provider-replay.js";
 import { sanitizeReplayText } from "./replay-sanitize.js";
 import { buildLlmCompletedEvent, buildRunTerminalEvent, repairEventsForRecovery } from "./session-repair.js";
-import { capabilityMarker, capabilitySkill, capabilityTool, capabilityCommandMount, capabilityCommandUnmount, kernelAction, kernelApply, forceCompact, messageToKernelMessage, skillMetadataToKernel, taskUpdateToKernel, toolResultToKernel, toolSchemaToKernel, } from "./kernel-step.js";
-import { agentRunSpecToKernel, milestoneCheckPass, milestoneCheckResultToKernel, subAgentResultToKernel } from "../types/agent.js";
+import { KernelPrimitivesDashboard } from "./kernel-primitives-dashboard.js";
+import { capabilityMarker, capabilitySkill, capabilityTool, capabilityCommandMount, capabilityCommandUnmount, kernelAction, kernelApply, kernelMaybeAction, forceCompact, messageToKernelMessage, skillMetadataToKernel, taskUpdateToKernel, toolResultToKernel, toolSchemaToKernel, } from "./kernel-step.js";
+import { agentRunSpecToKernel, findSpawnProcessObservation, milestoneCheckPass, milestoneCheckResultToKernel, spawnObservationToManifest, subAgentResultToKernel, } from "../types/agent.js";
 import { defaultSubAgentOrchestrator } from "./sub-agent-orchestrator.js";
+import { governancePolicyToKernelEvent } from "../governance.js";
+import { kernelObservationToSessionEvent, withCategory } from "./kernel-event-log.js";
+import { assertNativeProfile } from "./os-profile.js";
+import { LargeResultSpool } from "./large-result-spool.js";
 export class RuntimeRunner {
     opts;
     interrupted = false;
@@ -12,13 +19,128 @@ export class RuntimeRunner {
     pendingObservations = [];
     currentSessionId = null;
     nextArchiveStart = 0;
+    /** Full tool outputs keyed by call_id until Layer-1 spool observations are logged. */
+    pendingSpoolOutputs = new Map();
+    /** Local cache of paged-out/archived messages for priority memory retrieval. */
+    localPageOutCache = [];
+    dashboard = null;
     constructor(opts) {
         this.opts = opts;
+        if (opts.enableDiagnosticsDashboard) {
+            const originalAppend = opts.sessionLog.append.bind(opts.sessionLog);
+            opts.sessionLog.append = async (sessionId, event) => {
+                const seq = await originalAppend(sessionId, event);
+                if (this.dashboard) {
+                    this.dashboard.ingest(event);
+                    this.dashboard.print();
+                }
+                return seq;
+            };
+        }
     }
     /** Host configuration (for coordinator / sub-agent spawn). */
     get hostOptions() {
         return this.opts;
     }
+    async writeMemory(memory, opts = {}) {
+        const sessionId = opts.sessionId ?? this.currentSessionId;
+        const agentId = opts.agentId ?? this.opts.agentId;
+        if (!this.opts.dreamStore || !agentId)
+            return;
+        const observations = [];
+        const runtime = this.activeKernel ?? this.createSyscallRuntime();
+        kernelApply(runtime, observations, { kind: "write_memory", memory });
+        const event = observations.find(o => o.kind === "memory_written");
+        if (!event) {
+            await this.appendMemorySyscallObservations(sessionId, observations);
+            return;
+        }
+        const existing = await this.opts.dreamStore.loadMemories(agentId);
+        await this.opts.dreamStore.commit(agentId, {
+            toAdd: [{
+                    text: memory.content,
+                    score: 1.0,
+                    metadata: {
+                        ...memory.metadata,
+                        source: "write_memory_syscall",
+                    },
+                }],
+            toRemoveIndices: [],
+            stats: {
+                insightsProcessed: 1,
+                duplicatesRemoved: 0,
+                conflictsResolved: 0,
+                entriesAdded: 1,
+            },
+        }, existing);
+        await this.appendMemorySyscallObservations(sessionId, observations);
+    }
+    async queryMemory(query, opts = {}) {
+        const sessionId = opts.sessionId ?? this.currentSessionId;
+        const agentId = opts.agentId ?? this.opts.agentId;
+        if (!this.opts.dreamStore || !agentId)
+            return [];
+        const observations = [];
+        const runtime = this.activeKernel ?? this.createSyscallRuntime();
+        kernelApply(runtime, observations, { kind: "query_memory", query });
+        const allMemories = await this.opts.dreamStore.loadMemories(agentId);
+        const retrieval = await selectMemories(query, memoriesToIndex(allMemories));
+        let hits;
+        if (retrieval.selected_memory_ids.length > 0) {
+            const selected = new Set(retrieval.selected_memory_ids);
+            hits = allMemories
+                .filter(m => selected.has(String(m.metadata?.name ?? "")))
+                .slice(0, query.top_k);
+        }
+        else {
+            hits = await this.opts.dreamStore.search(agentId, query.current_context, query.top_k);
+            if (hits.length > 0 && retrieval.selection_rationale === "No candidates after filtering") {
+                retrieval.selected_memory_ids = hits.map(h => String(h.metadata?.name ?? h.text.slice(0, 32)));
+                retrieval.selection_rationale = `DreamStore.search returned ${hits.length} hit(s)`;
+            }
+        }
+        await this.appendMemorySyscallObservations(sessionId, observations);
+        await this.logMemoryRetrievalResult(sessionId, runtime, retrieval);
+        return hits;
+    }
+    async logMemoryRetrievalResult(sessionId, runtime, retrieval) {
+        if (!sessionId)
+            return;
+        await this.opts.sessionLog.append(sessionId, {
+            kind: "memory_retrieval_result",
+            selected_memory_ids: retrieval.selected_memory_ids,
+            selection_rationale: retrieval.selection_rationale,
+        });
+        kernelApply(runtime, [], {
+            kind: "memory_retrieval_result",
+            retrieval: {
+                selected_memory_ids: retrieval.selected_memory_ids,
+                selection_rationale: retrieval.selection_rationale,
+            },
+        });
+    }
+    createSyscallRuntime() {
+        const { KernelRuntime } = getKernel();
+        return new KernelRuntime({
+            maxTokens: this.opts.maxTokens,
+            maxTurns: this.opts.maxTurns,
+            timeoutMs: this.opts.timeoutMs !== undefined ? BigInt(this.opts.timeoutMs) : undefined,
+        });
+    }
+    async appendMemorySyscallObservations(sessionId, observations) {
+        if (!sessionId)
+            return;
+        const turn = this.activeKernel?.turn() ?? 0;
+        for (const obs of observations) {
+            if (obs.kind !== "memory_written"
+                && obs.kind !== "memory_queried"
+                && obs.kind !== "memory_validation_failed")
+                continue;
+            const event = kernelObservationToSessionEvent(obs, turn);
+            if (event)
+                await this.opts.sessionLog.append(sessionId, event);
+        }
+    }
     /** Mount a tool capability on the currently-running kernel runtime. No-op if not running. */
     mountTool(schema) {
         if (!this.activeKernel)
@@ -43,6 +165,52 @@ export class RuntimeRunner {
             return;
         kernelApply(this.activeKernel, this.pendingObservations, capabilityCommandUnmount(kind, id));
     }
+    /** Phase 4: satisfy kernel page-in requests before meta-tool execution. */
+    async applyKernelPageIn(runtime, sessionId) {
+        const requests = this.pendingObservations.filter((o) => o.kind === "page_in_requested" && typeof o.tool === "string");
+        if (requests.length === 0)
+            return;
+        const entries = [];
+        for (const req of requests) {
+            const query = typeof req.query === "string" ? req.query : "";
+            const topK = typeof req.top_k === "number" ? req.top_k : 5;
+            if (req.tool === "memory") {
+                // Priority search: Local Page-Out Cache (lexical/keyword filter)
+                const localHits = this.localPageOutCache.filter(m => typeof m.content === "string" && m.content.toLowerCase().includes(query.toLowerCase())).slice(0, topK);
+                for (const hit of localHits) {
+                    entries.push({
+                        content: `[local semantic cache] ${hit.role}: ${hit.content}`,
+                        source: "semantic_cache",
+                    });
+                }
+                // Fall back to dreamStore for the remainder if needed
+                const remainingK = topK - entries.length;
+                if (remainingK > 0 && this.opts.dreamStore && this.opts.agentId) {
+                    const hits = await this.opts.dreamStore.search(this.opts.agentId, query, remainingK);
+                    for (const hit of hits) {
+                        entries.push({
+                            content: `[memory score=${hit.score.toFixed(3)}] ${hit.text}`,
+                            source: "memory",
+                        });
+                    }
+                }
+            }
+            else if (req.tool === "knowledge" && this.opts.knowledgeSource) {
+                const snippets = await this.opts.knowledgeSource.retrieve(query, topK);
+                for (const snippet of snippets) {
+                    entries.push({ content: snippet, source: "knowledge" });
+                }
+            }
+        }
+        if (entries.length === 0)
+            return;
+        kernelApply(runtime, this.pendingObservations, { kind: "page_in", entries });
+        await this.opts.sessionLog.append(sessionId, withCategory({
+            kind: "page_in",
+            turn: runtime.turn(),
+            entry_count: entries.length,
+        }));
+    }
     /** Push content into the Knowledge slot (memory retrievals, skill definitions, artifacts). */
     pushKnowledge(message, tokens) {
         if (!this.activeKernel)
@@ -69,19 +237,10 @@ export class RuntimeRunner {
             parent_session_id: parentSessionId,
         });
         this.nextArchiveStart = await this.appendObservations(parentSessionId, runtime, this.nextArchiveStart);
-        const spawned = observations.find((o) => o.kind === "agent_spawned" && typeof o.agent_id === "string");
+        const spawned = findSpawnProcessObservation(observations);
         if (!spawned)
-            throw new Error("spawn_sub_agent did not emit agent_spawned");
-        const manifest = {
-            kind: "agent_spawned",
-            turn: spawned.turn,
-            agent_id: spawned.agent_id,
-            parent_session_id: spawned.parent_session_id ?? parentSessionId,
-            role: spawned.role ?? spec.role,
-            isolation: spawned.isolation ?? spec.isolation ?? "shared",
-            context_inheritance: spawned.context_inheritance ?? "none",
-            permitted_capability_ids: spawned.permitted_capability_ids ?? [],
-        };
+            throw new Error("spawn_sub_agent did not emit agent_process_changed");
+        const manifest = spawnObservationToManifest(spawned, spec, parentSessionId);
         const orchestrator = this.opts.subAgentOrchestrator ?? defaultSubAgentOrchestrator;
         const result = await orchestrator.run({
             parentOpts: this.opts,
@@ -150,7 +309,8 @@ export class RuntimeRunner {
         if (action1.kind !== "synthesize_insights")
             throw new Error(`unexpected: ${action1.kind}`);
         let synthesisText = "";
-        const providerState = this.opts.provider.createRunState?.();
+        const dreamProvider = this.opts.dreamProvider ?? this.opts.provider;
+        const providerState = dreamProvider.createRunState?.();
         const synthMsgs = (action1.messages ?? []);
         const kernelSystemText = synthMsgs.filter(m => m.role === "system").map(m => m.content).join("\n\n");
         const synthContext = {
@@ -158,7 +318,7 @@ export class RuntimeRunner {
             turns: synthMsgs.filter(m => m.role !== "system"),
         };
         let totalTokens = 0;
-        for await (const evt of this.opts.provider.stream(synthContext, [], undefined, providerState)) {
+        for await (const evt of dreamProvider.stream(synthContext, [], undefined, providerState)) {
             if (evt.type === "text_delta") {
                 synthesisText += evt.delta;
                 yield evt;
@@ -194,10 +354,93 @@ export class RuntimeRunner {
             },
         };
     }
+    /** Resolve in-kernel AskUser suspend; returns resume lists and stream events to yield. */
+    async resolveKernelSuspend(runtime, sessionId) {
+        const gated = this.pendingObservations.filter((o) => o.kind === "tool_gated" && typeof o.call_id === "string" && typeof o.tool === "string");
+        const approved = [];
+        const denied = [];
+        const events = [];
+        const runCtx = { onPermissionRequest: this.opts.onPermissionRequest };
+        for (const g of gated) {
+            const request = {
+                type: "permission_request",
+                callId: g.call_id,
+                toolName: g.tool,
+                arguments: "{}",
+                reason: typeof g.reason === "string" ? g.reason : "",
+            };
+            events.push(request);
+            const decision = await resolvePermissionRequest(request, runCtx);
+            events.push({
+                type: "permission_resolved",
+                callId: g.call_id,
+                toolName: g.tool,
+                approved: decision.approved,
+                responder: decision.responder ?? "host",
+                ...(decision.reason ? { reason: decision.reason } : {}),
+            });
+            await this.opts.sessionLog.append(sessionId, {
+                kind: "permission_requested",
+                turn: runtime.turn(),
+                tool: g.tool,
+                arguments: "{}",
+                reason: request.reason,
+            });
+            await this.opts.sessionLog.append(sessionId, {
+                kind: "permission_resolved",
+                turn: runtime.turn(),
+                approved: decision.approved,
+                responder: decision.responder ?? "host",
+            });
+            if (decision.approved) {
+                approved.push(g.call_id);
+            }
+            else {
+                denied.push(g.call_id);
+                const denyReason = decision.reason ?? "permission denied";
+                events.push({
+                    type: "tool_denied",
+                    callId: g.call_id,
+                    toolName: g.tool,
+                    reason: denyReason,
+                });
+                events.push({
+                    type: "tool_result",
+                    callId: g.call_id,
+                    name: g.tool,
+                    content: `permission denied: ${denyReason}`,
+                    isError: true,
+                    errorKind: "governance_denied",
+                });
+                await this.opts.sessionLog.append(sessionId, {
+                    kind: "tool_denied",
+                    turn: runtime.turn(),
+                    call_id: g.call_id,
+                    tool_name: g.tool,
+                    reason: denyReason,
+                });
+                await this.opts.sessionLog.append(sessionId, {
+                    kind: "tool_completed",
+                    turn: runtime.turn(),
+                    results: [{
+                            call_id: g.call_id,
+                            output: `permission denied: ${denyReason}`,
+                            is_error: true,
+                            error_kind: "governance_denied",
+                        }],
+                });
+            }
+        }
+        return { approved, denied, events };
+    }
     async *execute(sessionId, goal, criteria, extensions, priorEvents, resumeMidRun = false) {
         this.interrupted = false;
         this.pendingObservations = [];
+        this.pendingSpoolOutputs.clear();
         this.currentSessionId = sessionId;
+        if (this.opts.enableDiagnosticsDashboard) {
+            this.dashboard = new KernelPrimitivesDashboard(sessionId);
+        }
         const kernel = getKernel();
         const ext = { ...this.opts.extensions, ...(extensions ?? {}) };
         const providerState = this.opts.provider.createRunState?.();
@@ -212,7 +455,6 @@ export class RuntimeRunner {
         });
         this.activeKernel = runtime;
         this.nextArchiveStart = nextCompressedArchiveStart;
-        const router = new kernel.SignalRouter(256);
         if (this.opts.tokenizer) {
             kernelApply(runtime, this.pendingObservations, {
                 kind: "set_tokenizer",
@@ -262,6 +504,20 @@ export class RuntimeRunner {
         if (this.opts.dreamStore && this.opts.agentId) {
             kernelApply(runtime, this.pendingObservations, { kind: "set_memory_enabled", enabled: true });
         }
+        // Install optional memory policy. Maps the ergonomic camelCase option onto the kernel's
+        // snake_case `set_memory_policy` event; omitted fields fall back to kernel defaults.
+        if (this.opts.memoryPolicy) {
+            const m = this.opts.memoryPolicy;
+            kernelApply(runtime, this.pendingObservations, {
+                kind: "set_memory_policy",
+                ...(m.memoryPath !== undefined ? { memory_path: m.memoryPath } : {}),
+                ...(m.staleWarningDays !== undefined ? { stale_warning_days: m.staleWarningDays } : {}),
+                ...(m.retrievalTopK !== undefined ? { retrieval_top_k: m.retrievalTopK } : {}),
+                ...(m.validationEnabled !== undefined ? { validation_enabled: m.validationEnabled } : {}),
+                ...(m.maxContentBytes !== undefined ? { max_content_bytes: m.maxContentBytes } : {}),
+                ...(m.maxNameLength !== undefined ? { max_name_length: m.maxNameLength } : {}),
+            });
+        }
         if (this.opts.knowledgeSource) {
             kernelApply(runtime, this.pendingObservations, { kind: "set_knowledge_enabled", enabled: true });
         }
@@ -300,11 +556,60 @@ export class RuntimeRunner {
         if (this.opts.runSpec) {
             startPayload.run_spec = agentRunSpecToKernel(this.opts.runSpec);
         }
+        const osProfile = assertNativeProfile(this.opts.osProfile ?? "native");
+        const attentionPolicy = this.opts.attentionPolicy ?? osProfile.attentionPolicy;
+        const governancePolicy = this.opts.governancePolicy ?? osProfile.governancePolicy;
+        // Load the declarative governance policy into the kernel before the run starts,
+        // so the in-kernel gate enforces deny/veto/rate-limit/param before any tool runs.
+        kernelApply(runtime, this.pendingObservations, governancePolicyToKernelEvent(governancePolicy));
+        // Enable in-kernel signal routing so the kernel owns disposition + queuing.
+        kernelApply(runtime, this.pendingObservations, {
+            kind: "set_attention_policy",
+            ...(attentionPolicy.maxQueueSize !== undefined
+                ? { max_queue_size: attentionPolicy.maxQueueSize }
+                : {}),
+        });
+        // Set optional wall-clock budget override.
+        if (this.opts.schedulerBudget) {
+            kernelApply(runtime, this.pendingObservations, {
+                kind: "set_scheduler_budget",
+                ...(this.opts.schedulerBudget.maxWallMs !== undefined
+                    ? { max_wall_ms: this.opts.schedulerBudget.maxWallMs }
+                    : {}),
+            });
+        }
+        // Install optional resource quotas at the syscall trap (M2). Maps the ergonomic camelCase
+        // option onto the kernel's snake_case quota shape; the write-rate window is the serde tuple
+        // `[maxWrites, windowMs]`. Omitting the option leaves spawn / memory writes unbounded.
+        if (this.opts.resourceQuota) {
+            const q = this.opts.resourceQuota;
+            kernelApply(runtime, this.pendingObservations, {
+                kind: "set_resource_quota",
+                quota: {
+                    ...(q.maxConcurrentSubagents !== undefined
+                        ? { max_concurrent_subagents: q.maxConcurrentSubagents }
+                        : {}),
+                    ...(q.maxSpawnDepth !== undefined ? { max_spawn_depth: q.maxSpawnDepth } : {}),
+                    ...(q.memoryWritesPerWindow !== undefined
+                        ? {
+                            memory_writes_per_window: [
+                                q.memoryWritesPerWindow.maxWrites,
+                                q.memoryWritesPerWindow.windowMs,
+                            ],
+                        }
+                        : {}),
+                },
+            });
+        }
         let action = resumeMidRun
             ? kernelAction(runtime, this.pendingObservations, { kind: "resume" })
             : kernelAction(runtime, this.pendingObservations, startPayload);
         let hasAttemptedReactiveCompact = false;
         while (!runtime.isTerminal()) {
+            // Page-in must run before appendObservations drains pending kernel observations.
+            if (action.kind === "execute_tool") {
+                await this.applyKernelPageIn(runtime, sessionId);
+            }
             nextCompressedArchiveStart = await this.appendObservations(sessionId, runtime, nextCompressedArchiveStart);
             this.nextArchiveStart = nextCompressedArchiveStart;
             if (this.interrupted) {
@@ -314,30 +619,31 @@ export class RuntimeRunner {
             if (this.opts.signalSource) {
                 const sig = await this.opts.signalSource.nextSignal();
                 if (sig) {
-                    const kernelSig = {
-                        id: crypto.randomUUID(),
-                        source: sig.source ?? "custom",
-                        signalType: sig.signalType ?? "event",
-                        urgency: sig.urgency ?? "normal",
-                        summary: String(sig.payload?.goal ?? sig.kind ?? "signal"),
-                        payload: JSON.stringify(sig.payload ?? {}),
-                        dedupeKey: sig.dedupeKey,
-                        timestampMs: Date.now(),
-                    };
-                    const disposition = router.ingest(kernelSig, action.kind === "execute_tool");
-                    if (disposition === "interrupt_now") {
-                        action = kernelAction(runtime, this.pendingObservations, { kind: "timeout" });
-                        break;
-                    }
-                }
-            }
-            let queued = router.next();
-            while (queued) {
-                if (queued.urgency === "critical") {
-                    action = kernelAction(runtime, this.pendingObservations, { kind: "timeout" });
-                    break;
+                    const id = crypto.randomUUID();
+                    const source = sig.source ?? "custom";
+                    const signalType = sig.signalType ?? "event";
+                    const urgency = sig.urgency ?? "normal";
+                    const summary = String(sig.payload?.goal ?? sig.kind ?? "signal");
+                    // Kernel-routed: the kernel decides disposition (dedup/queue/interrupt)
+                    // and emits `signal_disposed`. An actionable disposition yields a new
+                    // action to adopt; queued/observed/ignored yields none (kernel buffers).
+                    // Wire shape is snake_case RuntimeSignal with an object payload.
+                    const sigAction = kernelMaybeAction(runtime, this.pendingObservations, {
+                        kind: "signal",
+                        signal: {
+                            id,
+                            source,
+                            signal_type: signalType,
+                            urgency,
+                            summary,
+                            payload: sig.payload ?? {},
+                            ...(sig.dedupeKey ? { dedupe_key: sig.dedupeKey } : {}),
+                            timestamp_ms: Date.now(),
+                        },
+                    });
+                    if (sigAction)
+                        action = sigAction;
                 }
-                queued = router.next();
             }
             if (runtime.isTerminal())
                 break;
@@ -398,12 +704,25 @@ export class RuntimeRunner {
                     toolCalls: finalToolCalls,
                     tokenCount: turnOutputTokens || turnTokens || undefined,
                 };
-                action = kernelAction(runtime, this.pendingObservations, {
+                const providerEvent = {
                     kind: "provider_result",
                     message: messageToKernelMessage(assistantMessage),
                     ...(turnInputTokens > 0 ? { observed_input_tokens: turnInputTokens } : {}),
                     ...(turnOutputTokens > 0 ? { observed_output_tokens: turnOutputTokens } : {}),
-                });
+                    now_ms: Date.now(),
+                };
+                let nextAction = kernelMaybeAction(runtime, this.pendingObservations, providerEvent);
+                if (!nextAction && this.pendingObservations.some(o => o.kind === "suspended")) {
+                    const resolved = await this.resolveKernelSuspend(runtime, sessionId);
+                    for (const evt of resolved.events)
+                        yield evt;
+                    nextAction = kernelAction(runtime, this.pendingObservations, {
+                        kind: "resume",
+                        approved_calls: resolved.approved,
+                        denied_calls: resolved.denied,
+                    });
+                }
+                action = nextAction ?? kernelAction(runtime, this.pendingObservations, providerEvent);
                 const providerReplay = peekProviderReplay(this.opts.provider, finalText, finalToolCalls);
                 await this.opts.sessionLog.append(sessionId, buildLlmCompletedEvent({
                     turn: runtime.turn(),
@@ -421,8 +740,9 @@ export class RuntimeRunner {
                     skillDir: this.opts.skillDir,
                     dreamStore: this.opts.dreamStore,
                     knowledgeSource: this.opts.knowledgeSource,
-                    governance: this.opts.governance,
                     onToolSuspend: this.opts.onToolSuspend,
+                    onPermissionRequest: this.opts.onPermissionRequest,
+                    resultSpool: this.opts.resultSpool ?? new LargeResultSpool(),
                 };
                 const toolResults = [];
                 const normalCalls = allCalls.filter(c => c.name !== "update_plan");
@@ -477,21 +797,18 @@ export class RuntimeRunner {
                                 kind: "permission_requested",
                                 turn,
                                 tool: pre.toolName,
-                                arguments: JSON.stringify(pre.arguments),
+                                arguments: pre.arguments,
                                 reason: pre.reason,
                             });
+                        }
+                        else if (evt.type === "permission_resolved") {
+                            const resolved = evt;
+                            const turn = runtime.turn();
                             await this.opts.sessionLog.append(sessionId, {
                                 kind: "permission_resolved",
                                 turn,
-                                approved: false,
-                                responder: "policy_gate",
-                            });
-                            await this.opts.sessionLog.append(sessionId, {
-                                kind: "tool_denied",
-                                turn,
-                                call_id: pre.callId,
-                                tool_name: pre.toolName,
-                                reason: `permission denied by policy gate: ${pre.reason}`,
+                                approved: resolved.approved,
+                                responder: resolved.responder,
                             });
                         }
                     }
@@ -511,6 +828,12 @@ export class RuntimeRunner {
                         token_count: r.tokenCount,
                     })),
                 });
+                for (const call of normalCalls) {
+                    const result = toolResults.find(r => r.callId === call.id);
+                    if (result) {
+                        this.pendingSpoolOutputs.set(call.id, { tool: call.name, output: result.output });
+                    }
+                }
                 action = kernelAction(runtime, this.pendingObservations, {
                     kind: "tool_results",
                     results: toolResults.map(toolResultToKernel),
@@ -590,18 +913,18 @@ export class RuntimeRunner {
         yield { type: "done", iterations: turnsUsed, totalTokens, status };
         this.activeKernel = null;
         this.currentSessionId = null;
+        this.dashboard = null;
     }
     async appendObservations(sessionId, runtime, nextArchiveStart) {
         const turn = runtime.turn();
         const preservedRefs = runtime.preservedRefs();
         const observations = this.pendingObservations.splice(0);
-        for (const obs of observations) {
+        for (let obs of observations) {
+            if (obs.kind === "page_in_requested")
+                continue;
+            let archiveRef;
+            let spoolRef;
             if (obs.kind === "compressed") {
-                const latest = await this.opts.sessionLog.latestSeq(sessionId);
-                if (latest < nextArchiveStart)
-                    continue;
-                const end = latest;
-                let archiveRef = undefined;
                 const archived = obs.archived;
                 if (this.opts.compressionStore && archived && archived.length > 0) {
                     try {
@@ -613,91 +936,77 @@ export class RuntimeRunner {
                         // non-fatal
                     }
                 }
-                const compressedSeq = await this.opts.sessionLog.append(sessionId, {
-                    kind: "compressed",
-                    turn,
-                    archived_seq_range: [nextArchiveStart, end],
-                    action: compressionAction(obs.action),
-                    summary: obs.summary,
-                    summary_tokens: obs.summary ? Math.max(1, Math.ceil(obs.summary.length / 4)) : undefined,
-                    archive_ref: archiveRef,
-                    preserved_refs: preservedRefs,
-                });
+            }
+            if (obs.kind === "page_out" && obs.archived) {
+                this.localPageOutCache.push(...obs.archived);
+            }
+            if (obs.kind === "large_result_spooled") {
+                const pending = this.pendingSpoolOutputs.get(obs.call_id ?? "");
+                if (pending) {
+                    const spool = this.opts.resultSpool ?? new LargeResultSpool();
+                    try {
+                        spoolRef = await spool.persistOutput(obs.call_id ?? "", pending.output);
+                    }
+                    catch {
+                        // non-fatal: preview remains in kernel context; full output still in tool_completed log
+                    }
+                    if (!obs.tool && pending.tool) {
+                        obs = { ...obs, tool: pending.tool };
+                    }
+                    this.pendingSpoolOutputs.delete(obs.call_id ?? "");
+                }
+            }
+            const latest = obs.kind === "compressed" ? await this.opts.sessionLog.latestSeq(sessionId) : undefined;
+            const event = kernelObservationToSessionEvent(obs, turn, {
+                nextArchiveStart,
+                latestSeq: latest,
+                archiveRef,
+                spoolRef,
+                preservedRefs,
+                compressionAction,
+            });
+            if (!event)
+                continue;
+            const compressedSeq = await this.opts.sessionLog.append(sessionId, event);
+            if (event.kind === "compressed") {
                 nextArchiveStart = compressedSeq + 1;
+                const archived = obs.kind === "compressed" ? obs.archived : undefined;
                 if (this.opts.asyncSummarizer && archived && archived.length > 0) {
                     void this.upgradeCompressedSummary(sessionId, compressedSeq, archived, compressionAction(obs.action) ?? "auto_compact");
                 }
             }
-            else if (obs.kind === "rollbacked") {
-                await this.opts.sessionLog.append(sessionId, {
-                    kind: "rollbacked",
-                    turn: obs.turn ?? turn,
-                    checkpoint_history_len: obs.checkpoint_history_len ?? 0,
-                    reason: obs.reason,
-                });
-            }
-            else if (obs.kind === "capability_changed") {
-                await this.opts.sessionLog.append(sessionId, {
-                    kind: "capability_changed",
-                    turn: obs.turn ?? turn,
-                    added: obs.added ?? [],
-                    removed: obs.removed ?? [],
-                    ...(obs.change_kind != null && { change_kind: obs.change_kind }),
-                    ...(obs.capability_id != null && { capability_id: obs.capability_id }),
-                    ...(obs.version != null && { version: obs.version }),
-                    ...(obs.mounted_by != null && { mounted_by: obs.mounted_by }),
-                    ...(obs.mount_reason != null && { mount_reason: obs.mount_reason }),
-                });
-            }
-            else if (obs.kind === "milestone_advanced") {
-                await this.opts.sessionLog.append(sessionId, {
-                    kind: "milestone_advanced",
-                    turn: obs.turn ?? turn,
-                    phase_id: obs.phase_id ?? "",
-                    capabilities_unlocked: obs.capabilities_unlocked ?? [],
-                });
-            }
-            else if (obs.kind === "milestone_blocked") {
-                await this.opts.sessionLog.append(sessionId, {
-                    kind: "milestone_blocked",
-                    turn: obs.turn ?? turn,
-                    phase_id: obs.phase_id ?? "",
-                    reason: typeof obs.reason === "string" ? obs.reason : "",
-                });
-            }
-            else if (obs.kind === "milestone_evidence") {
-                await this.opts.sessionLog.append(sessionId, {
-                    kind: "milestone_evidence",
-                    turn: obs.turn ?? turn,
-                    phase_id: obs.phase_id ?? "",
-                    evidence: obs.evidence ?? [],
-                });
-            }
-            else if (obs.kind === "checkpoint_taken") {
-                await this.opts.sessionLog.append(sessionId, {
-                    kind: "checkpoint_taken",
-                    turn: obs.turn ?? turn,
-                    history_len: obs.history_len ?? 0,
-                });
-            }
-            else if (obs.kind === "agent_spawned") {
-                await this.opts.sessionLog.append(sessionId, {
-                    kind: "agent_spawned",
-                    turn: obs.turn ?? turn,
-                    agent_id: obs.agent_id ?? "",
-                    parent_session_id: obs.parent_session_id ?? "",
-                    role: obs.role ?? "",
-                    isolation: obs.isolation ?? "",
-                    context_inheritance: obs.context_inheritance ?? "",
-                    permitted_capability_ids: obs.permitted_capability_ids ?? [],
-                });
-            }
-            else if (obs.kind !== "renewed") {
-                console.warn(`[deepstrike] unhandled KernelObservation kind: ${obs.kind}`);
+            if (obs.kind === "page_out"
+                && obs.tier_hint === "semantic"
+                && Array.isArray(obs.archived)
+                && obs.archived.length > 0) {
+                void this.archiveSemanticPageOut(obs.archived, compressionAction(obs.action));
             }
         }
         return nextArchiveStart;
     }
+    async archiveSemanticPageOut(archived, action) {
+        if (!this.opts.dreamStore || !this.opts.agentId)
+            return;
+        try {
+            const summary = this.opts.dreamSummarizer
+                ? await this.opts.dreamSummarizer.summarize(archived, { action })
+                : await summarizeForLongTermMemory(this.opts.dreamProvider ?? this.opts.provider, archived, this.opts.dreamSystemPrompt);
+            const existing = await this.opts.dreamStore.loadMemories(this.opts.agentId);
+            await this.opts.dreamStore.commit(this.opts.agentId, {
+                toAdd: [{ text: summary, score: 1.0, metadata: { source: "semantic_page_out", action } }],
+                toRemoveIndices: [],
+                stats: {
+                    insightsProcessed: 1,
+                    duplicatesRemoved: 0,
+                    conflictsResolved: 0,
+                    entriesAdded: 1,
+                },
+            }, existing);
+        }
+        catch {
+            // non-fatal: in-context compression summary remains; long-term layer is best-effort
+        }
+    }
     async upgradeCompressedSummary(sessionId, compressedSeq, archived, action) {
         try {
             const summary = await this.opts.asyncSummarizer.summarize(archived, action);
@@ -724,6 +1033,25 @@ function compressionAction(action) {
     }
     return undefined;
 }
+async function summarizeForLongTermMemory(provider, archived, systemPrompt) {
+    const transcript = archived
+        .map(m => `${m.role}: ${m.content}`)
+        .join("\n");
+    const context = {
+        systemText: [
+            systemPrompt,
+            "Summarize the following conversation for long-term memory. Preserve key facts, decisions, and open questions.",
+        ].filter(Boolean).join("\n\n"),
+        turns: [{ role: "user", content: transcript, toolCalls: [] }],
+    };
+    let text = "";
+    const state = provider.createRunState?.();
+    for await (const evt of provider.stream(context, [], undefined, state)) {
+        if (evt.type === "text_delta" && "delta" in evt)
+            text += evt.delta;
+    }
+    return text.trim() || transcript.slice(0, 2000);
+}
 export function replayMessages(events, maxBytes) {
     // Build upgraded-summary index: compressed_seq -> upgraded summary
     const upgradedSummaries = new Map();