@deepstrike/sdk 0.2.48 → 0.2.49

package/dist/harness/manifest.d.ts

@@ -30,17 +30,18 @@ export type HarnessRuntimePatch = Pick<RuntimeOptions, "maxTurns" | "maxTotalTok
 export type SurfaceTier = "auto" | "screened" | "human";
 /**
  * Map an editable surface to its promotion tier. Maintained HERE beside the whitelist so a surface can
- * never be whitelisted without also being assigned a tier (spec V2-S3 same-place maintenance):
+ * never be whitelisted without also being assigned a tier (the spec's same-place maintenance rule):
  *   - "auto"     (Tier A): every `runtime.*` whitelist surface. Typed validation + the capability
- *                 ceiling invariant + the v1 acceptance rule already guard them, so promotion is fully
+ *                 ceiling invariant + the acceptance rule already guard them, so promotion is fully
  *                 automatic — there is no free text and no injection surface.
  *   - "screened" (Tier B): `instructions.*` and `nudges`. Free text can smuggle instructions
  *                 (persistent prompt-injection laundered through the evidence loop), so a screen runs
  *                 before promotion.
- *   - "human"    (Tier C): reserved for capability-WIDENING surfaces. None exist in v2 — intersection
- *                 semantics make widening structurally inexpressible — but the enum value exists so a v3
- *                 surface cannot be added without consciously assigning it a tier (and building the
- *                 human gate). `surfaceTier` therefore never returns "human" in v2.
+ *   - "human"    (Tier C): reserved for capability-WIDENING surfaces. None currently exist — intersection
+ *                 semantics make widening structurally inexpressible — but the enum value exists so a new
+ *                 capability-widening surface cannot be added without consciously assigning it a tier (and
+ *                 building the human gate). `surfaceTier` therefore never returns "human" today — no
+ *                 capability-widening surface is expressible.
  * An unknown surface / slot / runtime key THROWS (same discipline as applySurfaceEdit): a surface with
  * no tier must never fall through to auto-promotion.
  */
@@ -55,7 +56,7 @@ export interface HarnessManifest {
      * Opaque isolation key — host decides its semantics (user / tenant / agent-group). Orthogonal to
      * `modelProfile` (never concatenate the two — that reprises the identity-scoping bug class); absent
      * ⇒ the host treats it as `"default"`. It rides canonical JSON, so digests domain-separate by scope,
-     * but an absent scope leaves a v1-shaped manifest's digest byte-identical (canonicalJson skips
+     * but an absent scope leaves a pre-scope manifest's digest byte-identical (canonicalJson skips
      * undefined). Becomes a lineage directory name downstream, hence the path-safe character bound.
      */
     scope?: string;
@@ -71,9 +72,9 @@ export interface HarnessManifest {
         rationale?: string;
         deltaHeldIn?: number;
         deltaHeldOut?: number;
-        /** Promotion tier of the driving edit (V2-S3). */
+        /** Promotion tier of the driving edit. */
         tier?: SurfaceTier;
-        /** Injection-screen verdict — present only for a screened (Tier B) promotion (V2-S3). */
+        /** Injection-screen verdict — present only for a screened (Tier B) promotion. */
         screenVerdict?: "pass" | "screened_out";
     };
 }

package/dist/harness/manifest.js

@@ -1,5 +1,5 @@
 /**
- * Self-Harness H1.1 + H1.3 — the harness face as DATA.
+ * Self-Harness editable surfaces — the harness face as DATA.
  *
  * A `HarnessManifest` is a versioned, hashable lineage node: the editable surfaces a fixed model may
  * rewrite about its OWN harness — instruction slots, nudge rules, and a whitelisted `RuntimeOptions`
@@ -64,17 +64,18 @@ const MAX_TOOL_ID_CHARS = 128;
 const MAX_TOOL_LIST_ENTRIES = 128;
 /**
  * Map an editable surface to its promotion tier. Maintained HERE beside the whitelist so a surface can
- * never be whitelisted without also being assigned a tier (spec V2-S3 same-place maintenance):
+ * never be whitelisted without also being assigned a tier (the spec's same-place maintenance rule):
  *   - "auto"     (Tier A): every `runtime.*` whitelist surface. Typed validation + the capability
- *                 ceiling invariant + the v1 acceptance rule already guard them, so promotion is fully
+ *                 ceiling invariant + the acceptance rule already guard them, so promotion is fully
  *                 automatic — there is no free text and no injection surface.
  *   - "screened" (Tier B): `instructions.*` and `nudges`. Free text can smuggle instructions
  *                 (persistent prompt-injection laundered through the evidence loop), so a screen runs
  *                 before promotion.
- *   - "human"    (Tier C): reserved for capability-WIDENING surfaces. None exist in v2 — intersection
- *                 semantics make widening structurally inexpressible — but the enum value exists so a v3
- *                 surface cannot be added without consciously assigning it a tier (and building the
- *                 human gate). `surfaceTier` therefore never returns "human" in v2.
+ *   - "human"    (Tier C): reserved for capability-WIDENING surfaces. None currently exist — intersection
+ *                 semantics make widening structurally inexpressible — but the enum value exists so a new
+ *                 capability-widening surface cannot be added without consciously assigning it a tier (and
+ *                 building the human gate). `surfaceTier` therefore never returns "human" today — no
+ *                 capability-widening surface is expressible.
  * An unknown surface / slot / runtime key THROWS (same discipline as applySurfaceEdit): a surface with
  * no tier must never fall through to auto-promotion.
  */

package/dist/harness/nudge.d.ts

@@ -1,5 +1,5 @@
 /**
- * Self-Harness H1.2 — declarative event→note rules (the runtime control-policy surface).
+ * Self-Harness nudge rules — declarative event→note rules (the runtime control-policy surface).
  *
  * A `NudgeRule` says "when this session event fires, push this note to the model". It generalizes the
  * two hard-coded precedents (EntropyWatch.notify_model, the RepeatFuse STOP text) into data the

package/dist/harness/public.js

@@ -2,7 +2,7 @@
 export { AttemptLoop, RuntimeAttemptBody, continueSession, freshWithFeedback, freshWithDigest, } from "./harness.js";
 export { VerdictFnJudge, LlmEvalJudge, HybridJudge } from "./judge.js";
 export { judge } from "../runtime/eval.js";
-// Self-Harness H1: the harness face as data (manifest lineage + declarative event→note rules). The
+// Self-Harness editable surfaces: the harness face as data (manifest lineage + declarative event→note rules). The
 // lab layer loads these through the compiled dist, so they live on this public barrel.
 export { composeSystemPrompt, manifestDigest, applyManifest, applyPatch, validateManifest, surfaceTier, } from "./manifest.js";
 export { NudgeEngine, validateNudgeRules } from "./nudge.js";

package/dist/runtime/filtered-plane.js

@@ -1,4 +1,7 @@
-const DEFAULT_META_TOOLS = new Set(["skill", "memory", "knowledge", "update_plan"]);
+// Mirrors the kernel's EXPOSURE_EXEMPT_META_TOOLS invariant: kernel-owned meta surfaces are
+// never narrowed away by a tool allow-list. `read_result` is runner-resolved before reaching any
+// plane today, but the lists must not drift.
+const DEFAULT_META_TOOLS = new Set(["skill", "memory", "knowledge", "update_plan", "read_result"]);
 /** Wraps an execution plane, allowing only manifest-permitted tool IDs (+ meta-tools). */
 export class FilteredExecutionPlane {
     inner;

package/dist/runtime/runner.d.ts

@@ -144,12 +144,12 @@ export interface RuntimeOptions {
         phase?: "initial" | "renewal";
     }) => Promise<MemoryQuery[] | undefined> | MemoryQuery[] | undefined;
     systemPrompt?: string;
-    /** Self-Harness H1.1: the four instruction slots (bootstrap/execution/verification/failureRecovery)
+    /** Self-Harness instruction surface: the four instruction slots (bootstrap/execution/verification/failureRecovery)
      *  composed onto `systemPrompt` in fixed order at option normalization. The kernel still sees ONE
      *  system prompt; this is the editable instruction surface the self-harness loop rewrites. Absent ⇒
      *  `systemPrompt` is used verbatim (zero behavior difference). */
     instructions?: InstructionProfile;
-    /** Self-Harness H1.2: declarative event→note rules. On each matching session event a rendered note
+    /** Self-Harness nudge surface: declarative event→note rules. On each matching session event a rendered note
      *  is pushed through the `injectNote` signal channel (same path as `onToolResult`'s `{note}`).
      *  ≤16 rules, validated at construction. Absent/empty ⇒ no engine, no append wrapping, zero
      *  behavior difference. */
@@ -307,7 +307,7 @@ export interface RuntimeOptions {
     /** Passed to kernel start_run for role/isolation metadata. */
     runSpec?: AgentRunSpec;
     /** P0-A tool gating: a static per-run tool profile — only these tool ids (plus the
-     *  skill/memory/knowledge/update_plan meta-tools) are exposed to the model each turn.
+     *  skill/memory/knowledge/update_plan/read_result meta-tools) are exposed to the model each turn.
      *  Sugar that lowers to the same `capability_filter` sub-agents use; byte-stable across
      *  the run, so it never busts the prompt-cache prefix. Augments `runSpec`'s filter when
      *  both are set; synthesizes a minimal run spec when `runSpec` is absent. Omitted/empty

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepstrike/sdk",
-  "version": "0.2.48",
+  "version": "0.2.49",
   "description": "DeepStrike Node.js SDK",
   "type": "module",
   "main": "dist/index.js",
@@ -72,7 +72,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.99.0",
-    "@deepstrike/core": "0.2.48",
+    "@deepstrike/core": "0.2.49",
     "@google/generative-ai": "^0.24.1",
     "openai": "^5.23.2"
   },