@deepstrike/sdk 0.2.40 → 0.2.42

package/README.md

@@ -88,13 +88,13 @@ The root export is the **intent layer** — what you reach for to run an agent,
 
 | Import | Contains |
 |--------|----------|
-| `@deepstrike/sdk` | `runAgent` · `runFanout` · `RuntimeRunner` · `tool` · `LocalExecutionPlane` · `InMemorySessionLog`/`FileSessionLog` · `AnthropicProvider`/`OpenAIProvider`/`OpenAIResponsesProvider` · `createProvider` · `Governance` · `AgentPool` · core types |
+| `@deepstrike/sdk` | `runAgent` · `runFanout` · `RuntimeRunner` · `tool` · `LocalExecutionPlane` · `InMemorySessionLog`/`FileSessionLog` · `AnthropicProvider`/`OpenAIProvider`/`OpenAIResponsesProvider` · `createProvider` · `Governance` · `AgentPool` · `operationAbortSignal` · core types |
 | `@deepstrike/sdk/providers` | backend factories (`deepseek`, `kimi`, `qwen`, `glm`, `minimax`, `gemini`, `ollama`), profiles, `CircuitBreaker` |
 | `@deepstrike/sdk/workflow` | `SubAgentOrchestrator`, `spawnStandalone`, reducers, contracts, handoff/modes, agent + spec types |
 | `@deepstrike/sdk/planes` | `WorktreeExecutionPlane`, `ProcessSandboxPlane`, `McpProxyPlane`, `RemoteVpcPlane`, archive/credential stores |
-| `@deepstrike/sdk/memory` | `DreamStore`, `WorkingMemory`, `InMemoryDreamStore`, `KnowledgeSource` |
+| `@deepstrike/sdk/memory` | `DreamStore`, `WorkingMemory`, `InMemoryDreamStore`, `rankMemories`, `extractSessionMemories`, `KnowledgeSource` |
 | `@deepstrike/sdk/harness` | `AttemptLoop`, body/judge/carry policies, `judge` |
-| `@deepstrike/sdk/os` | profiles, `KernelPrimitivesDashboard`, signals, `PermissionManager`, replay-testing utilities |
+| `@deepstrike/sdk/os` | profiles, `KernelPrimitivesDashboard`, `primitiveForKind` / `KernelPrimitive`, signals, `PermissionManager`, replay-testing utilities |
 
 > **Migration from 0.2.x:** the kernel-lowering converters (`*ToKernel`), low-level prompt/eval builders, and the `OpenAIChatProvider` alias are no longer exported from root; backend providers, planes, memory, harness, and OS utilities moved to the subpaths above. See [`MIGRATION-v0.2.300.md`](./MIGRATION-v0.2.300.md).
 
@@ -245,7 +245,7 @@ A node's `kind` selects the control-flow shape; the same executor drives them al
 
 ### 0.2.11 capabilities
 
-- **Runtime fan-out** — give a node the `submitWorkflowNodesTool` and its agent can append nodes to the live DAG mid-run (true loop-until-done; one verifier per claim it discovers). Recorded and replayed on `resumeWorkflow`.
+- **Runtime fan-out** — give a node the `submitWorkflowNodesTool` and its agent can append nodes to the live DAG mid-run (true loop-until-done; one verifier per claim it discovers). Recorded and replayed on `resumeWorkflow`. Governance rejection fails the submitting node instead of acknowledging work that was never appended.
 - **Quarantine, no escape** — set `trust: "quarantined"` on a node that reads untrusted content; it's denied write-capable isolation in-kernel, and any nodes it submits are coerced to quarantined too (no privilege escalation).
 - **Structured output** — set `outputSchema` on a node; the runner instructs the agent, validates the result against the JSON-Schema subset, and re-runs once with the errors on mismatch. A node that never conforms fails (its dependents starve).
 - **Budget as signal** — with a `maxWorkflowNodes` / `maxConcurrentSubagents` quota installed, each spawned node's goal carries its remaining headroom so a coordinator can size its fan-out to fit.
@@ -719,7 +719,7 @@ for await (const evt of runner.spawnSubAgent({
 }
 ```
 
-Requires an active parent run (`run()` / `wake()` in progress). The kernel emits `agent_process_changed`; the default `SubAgentOrchestrator` runs the child with a filtered execution plane and feeds `sub_agent_completed` back.
+Requires an active parent run (`run()` / `wake()` in progress). The kernel emits `agent_process_changed`; the default `SubAgentOrchestrator` runs the child with a filtered execution plane and feeds `sub_agent_completed` back. If governance rejects the spawn before execution, the iterator yields one `error` event containing the denial reason; the parent turn is not rolled back.
 
 ---
 

package/dist/governance.d.ts

@@ -30,11 +30,10 @@ export interface GovernancePolicy {
     }[];
     constraints?: GovernanceConstraint[];
     /** I5: when true (default), the runner pre-filters denied tools out of the schema passed to the
-     *  provider — the model never sees them and never tries to call them, eliminating the rollback
-     *  turn the kernel would otherwise produce. The denied tool names are also surfaced as a single
-     *  line on the system slot so the model knows not to plan around them. Set to false to fall
-     *  back to the v0.2.22 rollback-based behavior (useful for measuring the delta or when the
-     *  agent should learn the denial via a real attempt). */
+     *  provider — the model never sees them and never tries to call them. The denied tool names are
+     *  also surfaced as a single line on the system slot so the model knows not to plan around them.
+     *  Set to false when the agent should learn the denial through a real attempted call and its
+     *  visible error tool result. */
     surfaceDeniedInSystem?: boolean;
 }
 /** I5: walk the tool list and bucket each tool into `allowed` / `denied` based on a declarative

package/dist/index.d.ts

@@ -22,7 +22,7 @@ export type { RunGroup, GroupBudgetStore, GroupLedger, GroupCharge, GroupMember,
 export { InMemoryEventStream, isVisibleTo } from "./runtime/event-stream.js";
 export type { EventStream, EventStreamOptions, BlackboardEvent, EventViewer } from "./runtime/event-stream.js";
 export type { ObserverFailure, ObserverErrorHandler } from "./runtime/reliability.js";
-export { ManagedTaskScope } from "./runtime/reliability.js";
+export { ManagedTaskScope, operationAbortSignal } from "./runtime/reliability.js";
 export type { OperationContext, BackgroundTaskFailure, BackgroundTaskErrorHandler } from "./runtime/reliability.js";
 export { reactByMention, directorDriven, roundRobin, firstNonEmpty, union } from "./runtime/turn-policy.js";
 export type { TurnPolicy, PeerView } from "./runtime/turn-policy.js";

package/dist/index.js

@@ -24,7 +24,7 @@ export { InMemorySessionLog, FileSessionLog } from "./runtime/session-log.js";
 export { KERNEL_LOG_RECORD_VERSION, KernelLogConflictError, KernelLogIntegrityError, canonicalKernelJson, createKernelOperationGenesis, createKernelTransaction, kernelRecordDigest, verifyKernelOperationGenesis, verifyKernelTransaction, verifyKernelTransactionStream, verifyKernelTransactionSuccessor, } from "./runtime/kernel-transaction-log.js";
 export { InMemoryGroupBudgetStore, GroupBudgetScope } from "./runtime/run-group.js";
 export { InMemoryEventStream, isVisibleTo } from "./runtime/event-stream.js";
-export { ManagedTaskScope } from "./runtime/reliability.js";
+export { ManagedTaskScope, operationAbortSignal } from "./runtime/reliability.js";
 export { reactByMention, directorDriven, roundRobin, firstNonEmpty, union } from "./runtime/turn-policy.js";
 export { ReactiveSession, readRecentTool } from "./runtime/reactive-session.js";
 export { InMemoryReactionCheckpointStore, ReactionInProgressError } from "./runtime/reaction-checkpoint.js";

package/dist/kernel.d.ts

@@ -25,6 +25,8 @@ export interface ResourceQuota {
     maxTotalSubagents?: number;
     /** Max sub-agent nesting depth (direct children of the root loop are depth 1). */
     maxSpawnDepth?: number;
+    /** Max nodes in one in-kernel workflow DAG, including dynamically submitted nodes. */
+    maxWorkflowNodes?: number;
     /** Rolling-window memory-write rate limit: at most `maxWrites` per any `windowMs` span. */
     memoryWritesPerWindow?: MemoryWriteRateLimit;
 }
@@ -50,6 +52,9 @@ export interface MemoryPolicy {
     maxContentBytes?: number;
     /** Override the kernel's `write_memory` name-length limit. */
     maxNameLength?: number;
+    /** M4: recall count at which the kernel emits an advisory (edge-triggered)
+     *  `promotion_suggested` for a recalled record. Omitted = suggestions disabled. */
+    promotionRecallThreshold?: number;
 }
 export interface GovernanceInstance {
     setIdentity(agentId: string, sessionId: string): void;

package/dist/memory/public.d.ts

@@ -2,5 +2,8 @@ export { WorkingMemory } from "./working.js";
 export { InMemoryDreamStore } from "./in-memory-store.js";
 export type { InMemoryDreamStoreOptions } from "./in-memory-store.js";
 export { memoryRetentionScore } from "./retention.js";
+export { rankMemories } from "./ranking.js";
+export type { RankableMemory, RankedMemory, RankOptions } from "./ranking.js";
+export { extractSessionMemories, parseExtractedMemories } from "./extraction.js";
 export type { DreamStore, SessionData, SessionMessage, MemoryRecord, MemoryRecall, MemoryQuery, MemoryScope, MemoryProvenance, MemoryRecallLifecycle, MemoryKind, MemoryAuthor, MemoryTrustLevel, } from "./protocols.js";
 export type { KnowledgeSource } from "../knowledge/source.js";

package/dist/memory/public.js

@@ -2,3 +2,5 @@
 export { WorkingMemory } from "./working.js";
 export { InMemoryDreamStore } from "./in-memory-store.js";
 export { memoryRetentionScore } from "./retention.js";
+export { rankMemories } from "./ranking.js";
+export { extractSessionMemories, parseExtractedMemories } from "./extraction.js";

package/dist/memory/ranking.d.ts

@@ -1,4 +1,4 @@
-interface RankableMemory<T> {
+export interface RankableMemory<T> {
     value: T;
     searchableText: string;
     updatedAt: number;
@@ -30,4 +30,3 @@ export interface RankOptions {
  * The score is relevance, deliberately distinct from the record's stored confidence.
  */
 export declare function rankMemories<T>(query: string, candidates: Array<RankableMemory<T>>, topK: number, opts?: RankOptions): Array<RankedMemory<T>>;
-export {};

package/dist/os/public.d.ts

@@ -2,7 +2,8 @@ export { DEFAULT_NATIVE_SIGNAL_POLICY, DEFAULT_NATIVE_GOVERNANCE_POLICY, assertN
 export type { NativeOsProfile, OsProfileId, SignalPolicy } from "../runtime/os-profile.js";
 export { rebuildOsSnapshotFromSessionEvents } from "../runtime/os-snapshot.js";
 export type { OsSnapshot } from "../runtime/os-snapshot.js";
-export type { KernelEventCategory } from "../runtime/kernel-event-log.js";
+export type { KernelEventCategory, KernelPrimitive } from "../runtime/kernel-event-log.js";
+export { primitiveForCategory, primitiveForKind } from "../runtime/kernel-event-log.js";
 export { KernelPrimitivesDashboard } from "../runtime/kernel-primitives-dashboard.js";
 export type { MemoryPolicy, MemoryWriteRateLimit, ResourceQuota } from "../kernel.js";
 export type { PromptBudget, SchedulerPolicy } from "../runtime/runner.js";

package/dist/os/public.js

@@ -2,6 +2,7 @@
 // and the scheduler/quota/policy types referenced by advanced `RuntimeOptions` fields.
 export { DEFAULT_NATIVE_SIGNAL_POLICY, DEFAULT_NATIVE_GOVERNANCE_POLICY, assertNativeProfile, osProfile, } from "../runtime/os-profile.js";
 export { rebuildOsSnapshotFromSessionEvents } from "../runtime/os-snapshot.js";
+export { primitiveForCategory, primitiveForKind } from "../runtime/kernel-event-log.js";
 export { KernelPrimitivesDashboard } from "../runtime/kernel-primitives-dashboard.js";
 // Signals + SDK-side permissions.
 export { ScheduledPrompt } from "../signals/scheduled.js";

package/dist/runtime/kernel-step.d.ts

@@ -157,6 +157,9 @@ export type KernelRunnerAction = {
 };
 export interface KernelObservation {
     kind: string;
+    /** control_request_rejected: stable control-plane operation name and optional subject id. */
+    operation?: string;
+    subject?: string;
     action?: string;
     rho_after?: number;
     sprint?: number;

package/dist/runtime/runner.d.ts

@@ -374,6 +374,23 @@ export declare class RuntimeRunner {
     private commitKernelAction;
     private persistMemoryToStore;
     private retrieveMemoryFromStore;
+    /**
+     * T5: run one memory query through the kernel's `query_memory → memory_query_result`
+     * effect lifecycle on the given runtime. The kernel injects each routed hit into history
+     * itself and derives the recall lifecycle (`memory_recalled`, edge-triggered
+     * `promotion_suggested`) from the routed hits — the store stays a pure query.
+     *
+     * `seenRecordIds` is one dedupe horizon: a record hit by several queries of the same
+     * prefetch is routed (recalled, injected) once. The kernel derives counts statelessly from
+     * each hit's payload, so host-side pre-filtering is the only place duplicates can be stopped.
+     *
+     * The recall lifecycle is consumed immediately rather than via the per-turn drain: the store
+     * must be up to date before any same-turn re-query, and a renewal prefetch fires inside the
+     * drain loop where queued observations would not be consumed until the next boundary.
+     * Non-memory observations are forwarded to `leftovers` (the run's pending queue) when given,
+     * and discarded for detached syscall runtimes (their kernel is throwaway).
+     */
+    private queryMemoryThroughKernel;
     writeMemory(memory: MemoryRecord, opts?: {
         sessionId?: string;
         agentId?: string;
@@ -394,7 +411,17 @@ export declare class RuntimeRunner {
      * every policy from the first spawn. No config ⇒ the native-profile defaults (铁律: defaults only).
      */
     private applyKernelPolicies;
-    private appendMemorySyscallObservations;
+    /**
+     * Mirror one kernel memory-lifecycle observation into the durable store / host callbacks.
+     * Shared by the main run drain, the prefetch path, and the host memory syscalls so every
+     * query route has identical recall + promotion semantics (T5).
+     *
+     * M3: `memory_recalled` carries the kernel-derived count — the runner never computes
+     * `recall_count + 1` itself. M4: `promotion_suggested` is advisory and already
+     * edge-triggered by the kernel; the runner surfaces it and never auto-pins.
+     */
+    private mirrorMemoryLifecycle;
+    private consumeMemoryLifecycleObservations;
     /** Mount a tool capability on the currently-running kernel runtime. No-op if not running. */
     mountTool(schema: ToolSchema): Promise<void>;
     /** Mount a skill capability on the currently-running kernel runtime. No-op if not running. */

package/dist/runtime/runner.js

@@ -34,6 +34,25 @@ export function schedulerPolicyToKernel(policy) {
         token_cost_weight: policy.tokenCostWeight,
     };
 }
+/** Kernel observation kinds owned by the memory lifecycle consumer (journal + store mirror). */
+function isMemoryLifecycleObservation(obs) {
+    return obs.kind === "memory_written"
+        || obs.kind === "memory_queried"
+        || obs.kind === "memory_validation_failed"
+        || obs.kind === "memory_recalled"
+        || obs.kind === "promotion_suggested";
+}
+function controlRequestRejection(observations, operation) {
+    const rejected = observations.find(observation => observation.kind === "control_request_rejected"
+        && (!operation || observation.operation === operation));
+    if (!rejected)
+        return undefined;
+    return {
+        operation: rejected.operation ?? operation ?? "control_request",
+        ...(rejected.subject ? { subject: rejected.subject } : {}),
+        reason: typeof rejected.reason === "string" ? rejected.reason : "request denied",
+    };
+}
 function pendingCallIds(action) {
     switch (action.kind) {
         case "call_provider":
@@ -126,6 +145,66 @@ export class RuntimeRunner {
         return (await this.opts.dreamStore.search(agentId, { ...query, top_k: requestedK }))
             .slice(0, requestedK);
     }
+    /**
+     * T5: run one memory query through the kernel's `query_memory → memory_query_result`
+     * effect lifecycle on the given runtime. The kernel injects each routed hit into history
+     * itself and derives the recall lifecycle (`memory_recalled`, edge-triggered
+     * `promotion_suggested`) from the routed hits — the store stays a pure query.
+     *
+     * `seenRecordIds` is one dedupe horizon: a record hit by several queries of the same
+     * prefetch is routed (recalled, injected) once. The kernel derives counts statelessly from
+     * each hit's payload, so host-side pre-filtering is the only place duplicates can be stopped.
+     *
+     * The recall lifecycle is consumed immediately rather than via the per-turn drain: the store
+     * must be up to date before any same-turn re-query, and a renewal prefetch fires inside the
+     * drain loop where queued observations would not be consumed until the next boundary.
+     * Non-memory observations are forwarded to `leftovers` (the run's pending queue) when given,
+     * and discarded for detached syscall runtimes (their kernel is throwaway).
+     */
+    async queryMemoryThroughKernel(runtime, query, agentId, sessionId, seenRecordIds, leftovers) {
+        const observations = [];
+        const action = await this.commitKernelAction(runtime, observations, { kind: "query_memory", query }, sessionId);
+        if (action.kind !== "query_memory") {
+            throw new Error(`query_memory returned unexpected kernel effect: ${action.kind}`);
+        }
+        let hits = [];
+        let ioError;
+        try {
+            hits = await this.retrieveMemoryFromStore(query, action.requestedK, agentId);
+            if (seenRecordIds) {
+                hits = hits.filter(hit => {
+                    const id = hit.record.record_id;
+                    if (seenRecordIds.has(id))
+                        return false;
+                    seenRecordIds.add(id);
+                    return true;
+                });
+            }
+        }
+        catch (cause) {
+            ioError = cause;
+        }
+        // Close the kernel effect even when the store failed — never leave a dangling query.
+        // The result commit resumes the kernel's reasoning path (`resume_after_preload`), which
+        // re-emits the next loop action with the routed hits now in history — callers on a live
+        // run kernel must adopt it (a query is a preload, not a detached side-channel).
+        const resumed = await this.commitKernelMaybeAction(runtime, observations, {
+            kind: "memory_query_result",
+            effect_id: action.effectId,
+            hits,
+            ...(ioError ? { error: formatToolError(ioError) } : {}),
+        }, sessionId);
+        await this.consumeMemoryLifecycleObservations(sessionId, observations);
+        if (leftovers) {
+            for (const obs of observations) {
+                if (!isMemoryLifecycleObservation(obs))
+                    leftovers.push(obs);
+            }
+        }
+        if (ioError)
+            throw ioError;
+        return { hits, action: resumed };
+    }
     async writeMemory(memory, opts = {}) {
         const sessionId = opts.sessionId ?? this.currentSessionId;
         const agentId = opts.agentId ?? this.opts.agentId;
@@ -136,7 +215,7 @@ export class RuntimeRunner {
         const runtime = this.createSyscallRuntime();
         const action = await this.commitKernelMaybeAction(runtime, observations, { kind: "write_memory", memory }, durableSessionId);
         if (!action) {
-            await this.appendMemorySyscallObservations(sessionId, observations);
+            await this.consumeMemoryLifecycleObservations(sessionId, observations);
             return;
         }
         if (action.kind !== "persist_memory") {
@@ -154,7 +233,7 @@ export class RuntimeRunner {
             effect_id: action.effectId,
             ...(ioError ? { error: formatToolError(ioError) } : {}),
         }, durableSessionId);
-        await this.appendMemorySyscallObservations(durableSessionId, observations);
+        await this.consumeMemoryLifecycleObservations(durableSessionId, observations);
         if (ioError)
             throw ioError;
     }
@@ -164,29 +243,11 @@ export class RuntimeRunner {
         if (!this.opts.dreamStore || !agentId)
             return [];
         const durableSessionId = this.durableSessionId(sessionId);
-        const observations = [];
+        // Detached syscall runtime: the kernel's history injection and resumed action are inert
+        // (the kernel is throwaway), but the recall lifecycle is identical to an in-run query
+        // (T5 parity).
         const runtime = this.createSyscallRuntime();
-        const action = await this.commitKernelAction(runtime, observations, { kind: "query_memory", query }, durableSessionId);
-        if (action.kind !== "query_memory") {
-            throw new Error(`query_memory returned unexpected kernel effect: ${action.kind}`);
-        }
-        let hits = [];
-        let ioError;
-        try {
-            hits = await this.retrieveMemoryFromStore(query, action.requestedK, agentId);
-        }
-        catch (cause) {
-            ioError = cause;
-        }
-        await this.commitKernelApply(runtime, observations, {
-            kind: "memory_query_result",
-            effect_id: action.effectId,
-            hits,
-            ...(ioError ? { error: formatToolError(ioError) } : {}),
-        }, durableSessionId);
-        await this.appendMemorySyscallObservations(durableSessionId, observations);
-        if (ioError)
-            throw ioError;
+        const { hits } = await this.queryMemoryThroughKernel(runtime, query, agentId, durableSessionId);
         await this.logMemoryRetrievalResult(durableSessionId, hits);
         return hits;
     }
@@ -322,6 +383,7 @@ export class RuntimeRunner {
                 ...(q.maxConcurrentSubagents !== undefined ? { max_concurrent_subagents: q.maxConcurrentSubagents } : {}),
                 ...(q.maxTotalSubagents !== undefined ? { max_total_subagents: q.maxTotalSubagents } : {}),
                 ...(q.maxSpawnDepth !== undefined ? { max_spawn_depth: q.maxSpawnDepth } : {}),
+                ...(q.maxWorkflowNodes !== undefined ? { max_workflow_nodes: q.maxWorkflowNodes } : {}),
                 ...(q.memoryWritesPerWindow !== undefined
                     ? { memory_writes_per_window: [q.memoryWritesPerWindow.maxWrites, q.memoryWritesPerWindow.windowMs] }
                     : {}),
@@ -371,14 +433,36 @@ export class RuntimeRunner {
         }
         await this.commitKernelApply(runtime, this.pendingObservations, { kind: "configure_run", config });
     }
-    async appendMemorySyscallObservations(sessionId, observations) {
-        if (!sessionId)
-            return;
+    /**
+     * Mirror one kernel memory-lifecycle observation into the durable store / host callbacks.
+     * Shared by the main run drain, the prefetch path, and the host memory syscalls so every
+     * query route has identical recall + promotion semantics (T5).
+     *
+     * M3: `memory_recalled` carries the kernel-derived count — the runner never computes
+     * `recall_count + 1` itself. M4: `promotion_suggested` is advisory and already
+     * edge-triggered by the kernel; the runner surfaces it and never auto-pins.
+     */
+    async mirrorMemoryLifecycle(obs) {
+        if (obs.kind === "memory_recalled" && obs.recalls?.length) {
+            const agentId = this.opts.agentId;
+            if (agentId && this.opts.dreamStore?.recordRecall) {
+                await this.opts.dreamStore.recordRecall(agentId, obs.recalls);
+            }
+        }
+        if (obs.kind === "promotion_suggested" && obs.record_id) {
+            this.opts.onPromotionSuggested?.({
+                recordId: obs.record_id,
+                recallCount: obs.recall_count ?? 0,
+            });
+        }
+    }
+    async consumeMemoryLifecycleObservations(sessionId, observations) {
         const turn = this.activeKernel?.turn() ?? 0;
         for (const obs of observations) {
-            if (obs.kind !== "memory_written"
-                && obs.kind !== "memory_queried"
-                && obs.kind !== "memory_validation_failed")
+            if (!isMemoryLifecycleObservation(obs))
+                continue;
+            await this.mirrorMemoryLifecycle(obs);
+            if (!sessionId)
                 continue;
             const event = kernelObservationToSessionEvent(obs, turn);
             if (event)
@@ -459,8 +543,14 @@ export class RuntimeRunner {
         });
         this.nextArchiveStart = await this.appendObservations(parentSessionId, runtime, this.nextArchiveStart);
         const spawned = findSpawnProcessObservation(observations);
-        if (!spawned)
+        if (!spawned) {
+            const rejected = controlRequestRejection(observations, "spawn_sub_agent");
+            if (rejected) {
+                yield { type: "error", message: `spawn_sub_agent denied: ${rejected.reason}` };
+                return;
+            }
             throw new Error("spawn_sub_agent did not emit agent_process_changed");
+        }
         const manifest = spawnObservationToManifest(spawned, spec, parentSessionId);
         const orchestrator = this.opts.subAgentOrchestrator ?? defaultSubAgentOrchestrator;
         const result = await orchestrator.run({
@@ -856,6 +946,11 @@ export class RuntimeRunner {
         }
         if (!initialAction)
             return { nodeOutcomes: [], outputs: {} };
+        const workflowRejection = controlRequestRejection(observations);
+        if (initialAction.kind === "call_provider" && workflowRejection) {
+            this.workflowContinuation = initialAction;
+            return { nodeOutcomes: [], outputs: {}, rejection: workflowRejection };
+        }
         if (initialAction.kind !== "spawn_workflow") {
             throw new Error(`workflow load returned unexpected kernel effect: ${initialAction.kind}`);
         }
@@ -915,6 +1010,21 @@ export class RuntimeRunner {
                     const observationStart = this.pendingObservations.length;
                     const submitAction = await this.commitKernelMaybeAction(runtime, this.pendingObservations, submitEvent);
                     const subObs = this.pendingObservations.slice(observationStart);
+                    const rejected = controlRequestRejection(subObs, "submit_workflow_nodes")
+                        ?? (subObs.find(o => o.kind === "nodes_rejected")
+                            ? { operation: "submit_workflow_nodes", reason: String(subObs.find(o => o.kind === "nodes_rejected")?.reason ?? "request denied") }
+                            : undefined);
+                    if (rejected) {
+                        const denial = `workflow node submission denied: ${rejected.reason}`;
+                        result.result = {
+                            ...result.result,
+                            termination: "error",
+                            finalMessage: { role: "assistant", content: denial, toolCalls: [] },
+                        };
+                        outputs.set(result.agentId, denial);
+                        if (stableId !== result.agentId)
+                            outputs.set(stableId, denial);
+                    }
                     if (submitAction?.kind === "spawn_workflow") {
                         nextNodes.push(...submitAction.nodes);
                         budget = submitAction.budget ?? budget;
@@ -1356,6 +1466,9 @@ export class RuntimeRunner {
                     ...(m.validationEnabled !== undefined ? { validation_enabled: m.validationEnabled } : {}),
                     ...(m.maxContentBytes !== undefined ? { max_content_bytes: m.maxContentBytes } : {}),
                     ...(m.maxNameLength !== undefined ? { max_name_length: m.maxNameLength } : {}),
+                    ...(m.promotionRecallThreshold !== undefined
+                        ? { promotion_recall_threshold: m.promotionRecallThreshold }
+                        : {}),
                 });
             }
             if (this.opts.knowledgeSource) {
@@ -1465,21 +1578,24 @@ export class RuntimeRunner {
                     message: attachmentsToKernelMessage(attachments),
                 });
             }
-            // I4: pre-fetch memory before the first LLM turn so the model sees it on turn 1 instead of
-            // discovering it via the `memory` tool on turn 3+. Skipped on resumes (already in prior
-            // context) and when dreamStore/agentId is absent.
-            //
-            // Strict dynamic context control: this is single-use retrieval content (facts relevant to
-            // THIS run's goal right now), not a stable method/skill — so it lands in `history` as an
-            // ordinary turn, exactly like a real `memory` tool result would, and decays with the
-            // compression pyramid over subsequent turns instead of pinning itself in `knowledge` forever.
             this.currentGoal = goal;
-            if (!resumeMidRun) {
-                await this.prefetchMemoryIntoHistory(runtime, "initial");
-            }
             let action = resumeMidRun
                 ? await this.commitKernelAction(runtime, this.pendingObservations, { kind: "resume" })
                 : await this.commitKernelAction(runtime, this.pendingObservations, startPayload);
+            // I4/T5: pre-fetch memory before the first LLM turn so the model sees it on turn 1 instead
+            // of discovering it via the `memory` tool on turn 3+. It routes through the kernel's
+            // query_memory lifecycle and therefore runs AFTER start_run — a memory query is a kernel
+            // preload whose result resumes the reasoning path, so issuing it pre-run would leave the
+            // kernel Running and start_run would fault. The resumed action from the last query
+            // supersedes start_run's (same pull contract; it renders the injected hits). Hits land in
+            // `history` as ordinary turns — single-use retrieval content that decays with the
+            // compression pyramid, never pinned into `knowledge`. Skipped on resumes (already in
+            // prior context) and when dreamStore/agentId is absent.
+            if (!resumeMidRun) {
+                const resumed = await this.prefetchMemoryIntoHistory(runtime, "initial");
+                if (resumed)
+                    action = resumed;
+            }
             // P0-C: the skill loaded and in effect going into the current turn (updated when the model's
             // `skill` tool call resolves). Drives the per-turn `activeSkill` metric → dwell measurement.
             let activeSkill;
@@ -1842,7 +1958,7 @@ export class RuntimeRunner {
                                 const spec = parseStartWorkflowSpec(call.arguments);
                                 if (spec) {
                                     this.pendingAuthoredWorkflows.push(spec);
-                                    const out = "workflow authored; executing now";
+                                    const out = "workflow submitted for governance adjudication";
                                     toolResults.push({ callId: call.id, output: out, isError: false });
                                     yield { type: "tool_result", callId: call.id, content: out, isError: false };
                                     continue;
@@ -1853,13 +1969,13 @@ export class RuntimeRunner {
                                 ? parseStartWorkflowArgs(call.arguments)
                                 : parseSubmitWorkflowNodesArgs(call.arguments);
                             yield { type: "workflow_nodes_submitted", nodes };
-                            const result = { callId: call.id, output: "submitted", isError: false };
+                            const result = { callId: call.id, output: "workflow nodes submitted for parent governance adjudication", isError: false };
                             toolResults.push(result);
-                            yield { type: "tool_result", callId: call.id, content: "submitted", isError: false };
+                            yield { type: "tool_result", callId: call.id, content: result.output, isError: false };
                         }
                         // O5 (PreToolUse-hook analog): give the host a STATEFUL veto over each kernel-approved
-                        // call. A blocked call never executes; its reason reaches the model as a governance-denied
-                        // tool result (the kernel rolls the turn back with the note). Decision failures are closed
+                        // call. A blocked call never executes; its reason reaches the model as a committed
+                        // governance-denied tool result. Decision failures are closed
                         // unless the host explicitly marks this hook advisory with `onToolCallFailure: "open"`.
                         let executableCalls = normalCalls;
                         if (this.opts.onToolCall) {
@@ -2195,7 +2311,7 @@ export class RuntimeRunner {
      *  earlier memory hits, so the new sprint gets a fresh recall pass. Errs-open throughout. */
     async prefetchMemoryIntoHistory(runtime, phase) {
         if (!this.opts.dreamStore || !this.opts.agentId || !this.opts.memoryScope)
-            return;
+            return undefined;
         // P10: recall is default-on (CC session-start recall) — with no hook configured,
         // the goal itself is the query. preQueryMemory stays as the targeting override.
         const preQuery = this.opts.preQueryMemory
@@ -2211,23 +2327,27 @@ export class RuntimeRunner {
                 runSpec: this.opts.runSpec,
                 phase,
             });
-            const lines = [];
+            // T5: route each query through the kernel's query_memory lifecycle instead of calling
+            // the store directly — the kernel injects each routed hit into history itself and the
+            // recall lifecycle (recordRecall / promotion) fires exactly like an in-run query.
+            //
+            // One prefetch = one dedupe horizon: a record hit by several short queries recalls and
+            // injects once. A renewal prefetch starts a fresh horizon — renewal dropped the earlier
+            // injection with the old history, so re-exposure is a genuine new recall.
+            const seenRecordIds = new Set();
+            let resumed;
             for (const q of queries ?? []) {
                 if (!q.query.trim())
                     continue;
-                const hits = await this.opts.dreamStore.search(this.opts.agentId, q);
-                for (const hit of hits) {
-                    lines.push(`[memory record_id=${hit.record.record_id} trust=${hit.record.provenance.trust} score=${hit.score.toFixed(3)}] ${hit.record.content}`);
-                }
-            }
-            if (lines.length > 0) {
-                await this.commitKernelApply(runtime, this.pendingObservations, {
-                    kind: "add_history_message",
-                    message: { role: "user", content: lines.join("\n") },
-                });
+                const { action } = await this.queryMemoryThroughKernel(runtime, q, this.opts.agentId, this.durableSessionId(this.currentSessionId), seenRecordIds, this.pendingObservations);
+                resumed = action ?? resumed;
             }
+            // Each memory_query_result resumes the reasoning path and re-emits the pending loop
+            // action; the caller must continue from the LAST one (it renders the injected hits).
+            return resumed;
         }
         catch { /* errs-open — a faulty pre-fetch never breaks the run */ }
+        return undefined;
     }
     async appendObservations(sessionId, runtime, nextArchiveStart, _taskScope) {
         const turn = runtime.turn();
@@ -2248,22 +2368,9 @@ export class RuntimeRunner {
                 });
                 this.activeGroupBudgetScope = undefined;
             }
-            // M3: mirror the kernel's journaled recall lifecycle into the durable store so recall
-            // history (count + last-recalled turn) survives across sessions.
-            if (obs.kind === "memory_recalled" && obs.recalls?.length) {
-                const agentId = this.opts.agentId;
-                if (agentId && this.opts.dreamStore?.recordRecall) {
-                    await this.opts.dreamStore.recordRecall(agentId, obs.recalls);
-                }
-            }
-            // M4: a recall crossed the promotion threshold. Advisory — surface it for the host/model to
-            // act on (pin or promote to knowledge); the runner does not auto-pin.
-            if (obs.kind === "promotion_suggested" && obs.record_id) {
-                this.opts.onPromotionSuggested?.({
-                    recordId: obs.record_id,
-                    recallCount: obs.recall_count ?? 0,
-                });
-            }
+            // M3/M4: mirror the kernel's journaled recall lifecycle into the durable store /
+            // host callbacks (shared consumer — identical semantics on every query route).
+            await this.mirrorMemoryLifecycle(obs);
             const latest = obs.kind === "compressed" ? await this.opts.sessionLog.latestSeq(sessionId) : undefined;
             const event = kernelObservationToSessionEvent(obs, turn, {
                 nextArchiveStart,

package/dist/types/agent.d.ts

@@ -210,9 +210,17 @@ export interface WorkflowNodeOutcome {
     termination?: TerminationReason;
     output?: Message;
 }
+/** A control-plane request rejected before any workflow effect started. */
+export interface ControlRequestRejection {
+    operation: string;
+    subject?: string;
+    reason: string;
+}
 export interface WorkflowOutcome {
     nodeOutcomes: WorkflowNodeOutcome[];
     outputs: Record<string, string>;
+    /** Present when the workflow itself was rejected before any node ran. */
+    rejection?: ControlRequestRejection;
 }
 export declare function workflowNodeOutcomeFromKernel(raw: KernelWorkflowNodeOutcome): WorkflowNodeOutcome;
 /** Per-node spawn descriptor carried in the `workflow_batch_spawned` observation. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepstrike/sdk",
-  "version": "0.2.40",
+  "version": "0.2.42",
   "description": "DeepStrike Node.js SDK",
   "type": "module",
   "main": "dist/index.js",
@@ -72,7 +72,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.99.0",
-    "@deepstrike/core": "0.2.40",
+    "@deepstrike/core": "0.2.42",
     "@google/generative-ai": "^0.24.1",
     "openai": "^5.23.2"
   },