@deepstrike/sdk 0.2.49 → 0.2.51

package/README.md

@@ -82,7 +82,7 @@ const reply = await collectText(runner.run({ sessionId: "chat-1", goal: "What is
 
 Use `InMemorySessionLog` for process-local sessions or `FileSessionLog` when replay should survive restarts. `wake(sessionId)` resumes from the event log without inserting a duplicate `run_started` event.
 
-### Package layout (v0.2.30)
+### Package layout (v0.2.50)
 
 The root export is the **intent layer** — what you reach for to run an agent, run a workflow, author a tool, or pick a provider (~30 symbols). Advanced machinery lives behind subpaths, so the common surface stays small and tree-shakeable:
 
@@ -96,7 +96,7 @@ The root export is the **intent layer** — what you reach for to run an agent,
 | `@deepstrike/sdk/harness` | `AttemptLoop`, body/judge/carry policies, `judge` |
 | `@deepstrike/sdk/os` | profiles, `KernelPrimitivesDashboard`, `primitiveForKind` / `KernelPrimitive`, signals, `PermissionManager`, replay-testing utilities |
 
-> **Migration from 0.2.x:** the kernel-lowering converters (`*ToKernel`), low-level prompt/eval builders, and the `OpenAIChatProvider` alias are no longer exported from root; backend providers, planes, memory, harness, and OS utilities moved to the subpaths above. See [`MIGRATION-v0.2.300.md`](./MIGRATION-v0.2.300.md).
+> **Migration from 0.2.x:** the kernel-lowering converters (`*ToKernel`), low-level prompt/eval builders, and the `OpenAIChatProvider` alias are no longer exported from root; backend providers, planes, memory, harness, and OS utilities moved to the subpaths above. See [`MIGRATION-v0.2.30.md`](./MIGRATION-v0.2.30.md).
 
 ### Recipes — the canonical entry points
 
@@ -163,19 +163,19 @@ for await (const event of runner.run({ sessionId: "readme-1", goal: "Summarize R
 │  RuntimeRunner (Layer 1.5)                              │
 │  LLMProvider · ExecutionPlane · SessionLog · DreamStore │
 └───────────────────────────┬─────────────────────────────┘
-                            │ step(JSON event) ↔ actions / observations
+                            │ durable prepare / append / commit
 ┌───────────────────────────▼─────────────────────────────┐
-│  @deepstrike/core KernelRuntime                         │
+│  @deepstrike/core Canonical Kernel ABI                  │
 │  P1 Syscall · P2 Sched · P3 MM · Proc · IPC             │
 └─────────────────────────────────────────────────────────┘
 ```
 
-The runner drives a single loop:
+The runner drives one durable operation loop:
 
-1. Kernel returns an **action** — `call_provider`, `execute_tool`, `evaluate_milestone`, or `done`.
-2. SDK executes the action (stream LLM, run tools, call milestone verifier).
-3. SDK feeds the result back as a kernel **event** (`provider_result`, `tool_results`, …).
-4. Kernel **observations** (compression, page-out, spool, signals, …) are drained into `SessionLog`.
+1. The host prepares one canonical envelope and durably appends the exact core-produced record.
+2. After commit, the kernel publishes typed **effects** such as provider, tool, or task work.
+3. The SDK executes those effects and returns each outcome through the single `resolve_effect` input.
+4. Typed observations and the terminal disposition are projected into `SessionLog` and the public stream.
 
 Kernel session events carry an optional `category` tag (`syscall` · `sched` · `mm` · `proc` · `ipc`) for diagnostics and OS snapshot rebuilds.
 
@@ -186,26 +186,26 @@ The mechanisms above are not internal refactors — they change what you can bui
 **Kernel-mediated runtime (M0–M4)**  
 Tool calls, spawns, compression, and signals pass through one kernel gate with an explicit lifecycle (Ready / Running / Blocked / Suspended). You implement I/O; the kernel decides *when* and *whether*. Node, Python, and Rust share the same decision path, so `wake(sessionId)` and cross-language tooling see consistent behavior.
 
-**Longer, sturdier sessions (Layer-1 spool + semantic page-out)**  
-Oversized tool results (> 50 KB) stay in context as a preview plus a `.spool/` reference — the model reads the full payload on demand via ordinary file tools. When pressure triggers semantic eviction, the SDK summarizes archived content into `DreamStore`. Long tasks survive token pressure instead of failing mid-run.
+**Longer, sturdier sessions (external payloads + semantic page-out)**
+The host atomically persists oversized tool results before submitting an `External` result. Core journals only the opaque locator, digest, size, and preview; `read_result` becomes a correlated `LoadPayload` effect. When pressure triggers semantic eviction, the SDK summarizes archived content into `DreamStore`.
 
 **Safety and governance by default (OS native profile)**  
 Every run loads declarative `governancePolicy` (deny / ask_user / rate-limit / param rules) and in-kernel signal routing (`signalPolicy`, default queue 64). Dangerous tools, external interrupts, and approval flows are policy — not ad-hoc `if` checks in your handlers.
 
 **Long-term memory as syscalls (Phase-7)**  
-`writeMemory` and `queryMemory` run outside the main tool loop: kernel validation before `DreamStore.commit`, search → `selectMemories` → `memory_retrieval_result` on query. Failed writes emit `memory_validation_failed` for audit; good memory is durable without polluting history.
+`writeMemory` and `queryMemory` run outside the main tool loop: kernel validation happens before `DreamStore.upsert`, while queries call `DreamStore.search` and journal `memory_retrieval_result`. Failed writes emit `memory_validation_failed` for audit; good memory is durable without polluting history.
 
 **Multi-agent and multi-signal orchestration**  
 Sub-agents register in the kernel process table (`agent_process_changed`); parent runs suspend explicitly until `sub_agent_completed`. Signals get disposition (Interrupt / Queue / Observe / Dropped) in-kernel, so gateways, cron, and heartbeats compose with the main loop instead of racing it.
 
 **Observable like an OS log**  
-Spool, page-out, signals, processes, budgets, and memory events land in `SessionLog` with categories. Rebuild an OS snapshot (`pageOutCount`, `spoolCount`, `processByAgent`, memory counters) from one event stream — replay still strips audit events when reconstructing LLM messages.
+Page-out, signals, processes, budgets, and memory events land in `SessionLog` with categories. Rebuild an OS snapshot (`pageOutCount`, `processByAgent`, memory counters) from one event stream; payload residency stays in the canonical journal.
 
 | You need… | Use… |
 |---|---|
 | Policy before tools run | `governancePolicy` (default: allow-all native profile) |
 | External interrupts | `signalSource` + in-kernel `signalPolicy` |
-| Huge tool output | Automatic Layer-1 spool; optional custom `resultSpool` |
+| Huge tool output | Canonical external payload; optional custom `payloadStore` |
 | Durable recall across runs | `DreamStore` + semantic `page_out` via `dreamSummarizer` |
 | Programmatic memory I/O | `runner.writeMemory()` / `runner.queryMemory()` |
 | Debug / compliance | `SessionLog` events + OS snapshot helpers |
@@ -228,27 +228,56 @@ const outcome = await runner.runWorkflow({
     { task: "Skeptic: which flags are real violations?",  role: "verify", dependsOn: [0, 1, 2] },
   ],
 })
-// → { completed: ["wf-node0", … ], failed: [], outputs: { "wf-node3": "…" } }
+const completed = outcome.nodeOutcomes.filter(node => node.status === "completed")
+const partial = outcome.nodeOutcomes.filter(node => node.status === "completed_partial")
+const failed = outcome.nodeOutcomes.filter(node => node.status === "failed")
+// outcome.outputs["wf-node3"] contains the skeptic's final text.
+// outcome.rejection is present only when the whole workflow was rejected before any node ran.
 ```
 
-`runWorkflow` works **standalone** — call it on a freshly-constructed runner (e.g. inside a stateless HTTP handler) and it auto-bootstraps a kernel that owns the DAG, drives it under the same governance/quota/attention policies a full `run()` gets, and tears it down on completion. Called *during* a `run()`, it instead drives the workflow on the active kernel. Either way every node's final text comes back in `outputs`, keyed by node agent-id. To resume an interrupted standalone run, pass the prior session id: `runner.resumeWorkflow(spec, { sessionId })`.
+`runWorkflow` works **standalone** — call it on a freshly-constructed runner (e.g. inside a stateless HTTP handler) and it auto-bootstraps a kernel that owns the DAG, drives it under the same governance/quota/attention policies a full `run()` gets, and tears it down on completion. Called *during* a `run()`, it instead drives the workflow on the active kernel. Either way every node's final text comes back in `outputs`, keyed by node agent-id.
 
-A node's `kind` selects the control-flow shape; the same executor drives them all, every spawn passing the syscall gate:
+A workflow node has no public `kind` field. Its control-flow shape is selected by one of four
+mutually exclusive fields; omit all four for a normal spawn. The same executor drives every shape,
+and every spawn passes the syscall gate:
 
-| Node `kind` | Behavior |
+| Public `WorkflowNodeSpec` field | Behavior |
 |---|---|
-| `{ type: "spawn" }` (default) | Run the node's agent once |
-| `{ type: "loop", maxIters }` | Re-run until the agent signals it's done, capped at `maxIters` |
-| `{ type: "classify", branches }` | The classifier's result selects one branch; the rest are pruned |
-| `{ type: "tournament", entrants }` | Generate N entrants, then a pairwise-judge bracket to one winner |
-| `{ type: "reduce", reducer }` | **Tokenless host-compute** — a pure function (`dedupe_lines` / `merge_json_arrays` / `concat` / `count`, or your own via the `reducers` runner option) over the node's dependency outputs |
+| none (default) | Run the node's agent once |
+| `loop: { maxIters }` | Re-run until the agent signals it's done, capped at `maxIters` |
+| `classify: { branches }` | The classifier's result selects one branch; the rest are pruned |
+| `tournament: { entrants }` | Generate N entrants, then a pairwise-judge bracket to one winner |
+| `reducer: "concat"` | **Tokenless host-compute** — a pure function (`dedupe_lines` / `merge_json_arrays` / `concat` / `count`, or your own via the `reducers` runner option) over the node's `dependsOn` outputs |
 
-### 0.2.11 capabilities
+Dependencies use `dependsOn: number[]`, where each number is a node index, and `depPolicy` controls
+how upstream terminal states gate the node (`all_success` by default, plus `accept_partial`,
+`all_terminal`, and `optional`).
 
-- **Runtime fan-out** — give a node the `submitWorkflowNodesTool` and its agent can append nodes to the live DAG mid-run (true loop-until-done; one verifier per claim it discovers). Recorded and replayed on `resumeWorkflow`. Governance rejection fails the submitting node instead of acknowledging work that was never appended.
+### Workflow capabilities (v0.2.50)
+
+- **Runtime fan-out** — register `submitWorkflowNodesTool` on the parent execution plane and a trusted node can append nodes to the live DAG mid-run (true loop-until-done; one verifier per discovered claim). The tool schema is exported from `@deepstrike/sdk/workflow`, not the package root. Submission events remain audit projections; checkpoint state owns recovery. Governance rejection fails the submitting node instead of acknowledging work that was never appended.
 - **Quarantine, no escape** — set `trust: "quarantined"` on a node that reads untrusted content; it's denied write-capable isolation in-kernel, and any nodes it submits are coerced to quarantined too (no privilege escalation).
 - **Structured output** — set `outputSchema` on a node; the runner instructs the agent, validates the result against the JSON-Schema subset, and re-runs once with the errors on mismatch. A node that never conforms fails (its dependents starve).
-- **Budget as signal** — with a `maxWorkflowNodes` / `maxConcurrentSubagents` quota installed, each spawned node's goal carries its remaining headroom so a coordinator can size its fan-out to fit.
+- **Budget as signal** — set `resourceQuota.maxWorkflowNodes` and/or `resourceQuota.maxConcurrentSubagents`; each spawned node's goal carries its remaining headroom so a coordinator can size its fan-out to fit.
+
+`submitWorkflowNodesTool` is a `ToolSchema`, while execution planes register `RegisteredTool`
+instances. Adapt it once on the parent plane; the runner intercepts the call before the placeholder
+handler executes:
+
+```typescript
+import { tool } from "@deepstrike/sdk"
+import { submitWorkflowNodesTool } from "@deepstrike/sdk/workflow"
+
+plane.register(tool(
+  submitWorkflowNodesTool.name,
+  submitWorkflowNodesTool.description,
+  JSON.parse(submitWorkflowNodesTool.parameters),
+  async () => "", // intercepted by RuntimeRunner
+))
+```
+
+Trusted workflow nodes inherit the parent plane, so the tool is visible to all of them. There is no
+per-node tool allowlist on `WorkflowNodeSpec`; quarantined nodes use a filtered, deny-all plane.
 
 ---
 
@@ -337,7 +366,7 @@ Full reference: [docs/concepts/context-slots-compression.md](../docs/concepts/co
 import {
   DEFAULT_NATIVE_GOVERNANCE_POLICY,
   DEFAULT_NATIVE_SIGNAL_POLICY,
-} from "@deepstrike/sdk"
+} from "@deepstrike/sdk/os"
 
 const runner = new RuntimeRunner({
   provider,
@@ -359,14 +388,15 @@ const runner = new RuntimeRunner({
   // Resource quotas (M2) — enforced at the kernel syscall trap. Opt-in; omit for unbounded.
   resourceQuota: {
     maxConcurrentSubagents: 4,                       // deny spawn while at cap
+    maxTotalSubagents: 20,                           // cumulative cap across the RunGroup
     maxSpawnDepth: 2,                                // deny spawn past nesting depth
+    maxWorkflowNodes: 32,                            // cap one live DAG, including submitted nodes
     memoryWritesPerWindow: { maxWrites: 20, windowMs: 60_000 }, // rate-limit writeMemory
   },
 
-  // Long-term memory policy (set_memory_policy) — opt-in, kernel-enforced; omit for defaults.
+  // Canonical long-term memory policy — opt-in, kernel-enforced; omit for defaults.
   memoryPolicy: {
-    memoryPath: "./.memory",     // where the SDK persists/scans memories (SDK-consumed)
-    staleWarningDays: 30,        // flag recalled memories older than this (SDK-consumed)
+    staleWarningDays: 30,        // flag recalled memories older than this
     retrievalTopK: 5,            // kernel caps query_memory requested_k to this
     validationEnabled: true,     // false → admit writes without validation
     maxContentBytes: 10_000,     // override write_memory content-size limit
@@ -414,13 +444,14 @@ const runner = new RuntimeRunner({
 
 | Option | Purpose |
 |--------|---------|
-| `governancePolicy` | Declarative deny / ask_user / rate-limit / param rules loaded into the kernel before `start_run` |
+| `governancePolicy` | Declarative deny / ask_user / rate-limit / param rules installed before canonical root start |
 | `signalPolicy` | Versioned in-kernel signal queue/TTL policy (default queue 64) |
 | `promptBudget` | Provider-envelope overhead, output reserve, and safety margin deducted from the context window |
-| `resourceQuota` | M2 declarative limits — `maxConcurrentSubagents` / `maxSpawnDepth` / `memoryWritesPerWindow` — enforced at the kernel syscall trap (`set_resource_quota`); over-quota spawns roll back, over-rate writes surface as `memory_validation_failed` |
-| `memoryPolicy` | Long-term memory config sent as `set_memory_policy` and **kernel-enforced**: `validationEnabled: false` admits writes without validation, `maxContentBytes` / `maxNameLength` override validation limits, `retrievalTopK` caps `query_memory` breadth; `memoryPath` / `staleWarningDays` are SDK-consumed (requires `dreamStore` + `agentId` to enable memory) |
+| `resourceQuota` | M2 declarative limits — `maxConcurrentSubagents` / `maxTotalSubagents` / `maxSpawnDepth` / `maxWorkflowNodes` / `memoryWritesPerWindow` — enforced at the kernel syscall trap (`set_resource_quota`); over-quota spawns roll back, over-rate writes surface as `memory_validation_failed` |
+| `memoryPolicy` | Canonical long-term memory policy: `validationEnabled: false` admits writes without validation, `maxContentBytes` / `maxNameLength` override validation limits, `retrievalTopK` caps `query_memory` breadth, and `staleWarningDays` controls stale recall policy. Storage belongs to the configured `dreamStore`. |
 | `onPermissionRequest` | Resolves `tool_gated` + `suspended` → kernel `resume` with approved/denied call IDs |
 | `compressionStore` | Writes archived messages on `compressed` observations |
+| `payloadStore` | Resolves canonical opaque payload locators (default: `.payloads/`) |
 | `asyncSummarizer` | Background LLM summary after compression; stored as `summary_upgraded` |
 | `dreamSummarizer` | Summarizes `page_out { tier_hint: "semantic" }` into `DreamStore` during a run |
 | `dreamProvider` | Separate LLM for `dream()` idle consolidation (falls back to `provider`) |
@@ -428,37 +459,33 @@ const runner = new RuntimeRunner({
 Rebuild an OS diagnostics snapshot from session events:
 
 ```typescript
-import { rebuildOsSnapshotFromSessionEvents } from "@deepstrike/sdk"
+import { rebuildOsSnapshotFromSessionEvents } from "@deepstrike/sdk/os"
 
 const events = (await sessionLog.read(sessionId)).map(e => e.event)
 const snap = rebuildOsSnapshotFromSessionEvents(events)
-// snap.pageOutCount, snap.spoolCount, snap.signals, snap.processByAgent, …
+// snap.pageOutCount, snap.signals, snap.processByAgent, …
 ```
 
 ---
 
-## Large result spool (Layer 1)
+## External tool payloads
 
-When a single tool result exceeds **50 KB**, the kernel keeps a short preview in context and emits `large_result_spooled`. The SDK writes the full payload to `.spool/` under the process cwd (SHA-256 keyed files) and logs `spool_ref` in the session.
+When a tool result exceeds the configured inline threshold, the SDK persists the full body before sending the canonical `External` result. The kernel receives only `payload_ref`, `digest`, `original_size`, and a bounded preview.
 
-The model can retrieve full content via ordinary read tools — `LocalExecutionPlane` transparently resolves paths under `.spool/`:
+The locator is opaque and never passed to ordinary file tools. The model calls `read_result`; core authorizes the reachable handle and emits `LoadPayload`, which the runner resolves through `PayloadStore`.
 
-```typescript
-// Kernel context shows a preview + spool reference.
-// LLM calls read_file({ path: ".spool/abc123…" }) → full content returned.
-```
-
-No configuration is required; customize the directory by passing a `resultSpool` instance when constructing `RuntimeRunner` (see tests under `tests/runtime/large-result-spool.test.ts`).
+No configuration is required. Pass a `PayloadStore` through `RuntimeOptions.payloadStore` to use a different filesystem root or storage adapter.
 
 ---
 
 ## Tools
 
 ```typescript
-import { tool, readFile } from "@deepstrike/sdk"
+import { tool } from "@deepstrike/sdk"
+import { readFile } from "@deepstrike/sdk/workflow"
 
 plane.register(tool("search", "Search.", schema, async (args) => ...))
-plane.register(readFile)     // built-in: read files from disk (also resolves .spool/ refs)
+plane.register(readFile)     // built-in: read files explicitly named by the caller
 plane.unregister("search")
 ```
 
@@ -553,35 +580,31 @@ mem.clear()
 import type { DreamStore } from "@deepstrike/sdk/memory"
 
 class MyStore implements DreamStore {
-  async loadSessions(agentId) { ... }
-  async loadMemories(agentId) { ... }
-  async commit(agentId, result, existing) { ... }
-  async search(agentId, query) { ... } // Promise<MemoryRecall[]>
+  async upsert(agentId, record) { ... }      // the only durable memory mutation
+  async search(agentId, query) { ... }       // Promise<MemoryRecall[]>
+  async saveSession(session) { ... }         // completed transcript for extraction
 }
 
+const memoryScope = { tenant_id: "acme", namespace: "assistant" }
 const runner = new RuntimeRunner({
   provider,
   executionPlane: plane,
   sessionLog: new FileSessionLog(".deepstrike/sessions"),
   maxTokens: 4096,
   dreamStore: new MyStore(),
-  agentId: "my-agent",  // enables `memory` meta-tool + semantic page-out archival
+  agentId: "my-agent",
+  memoryScope,          // scopes run-start recall, queries, extraction, and semantic page-out
 })
 ```
 
-Three memory paths:
+Four memory paths:
 
 | Path | When | What happens |
 |------|------|--------------|
 | In-session `memory(query)` | LLM calls meta-tool | `DreamStore.search()` → history tool result |
 | `initialMemory` | Run start | Injected into Slot 2 (`systemKnowledge`) |
-| Semantic `page_out` | Kernel evicts with `tier_hint: "semantic"` | SDK summarizes via `dreamSummarizer` / `dreamProvider` → `DreamStore.commit()` |
-| `dream(agentId)` | Explicit idle call | `IdlePipeline` batch-consolidates past sessions |
-
-```typescript
-// Post-session batch consolidation
-const result = await runner.dream("my-agent", Date.now())
-```
+| `writeMemory(record)` | Host writes a durable record | Kernel validation / quota / dedup → `DreamStore.upsert()` |
+| Semantic `page_out` | Kernel evicts with `tier_hint: "semantic"` | SDK summarizes via `dreamSummarizer` / `dreamProvider` → gated `writeMemory()` |
 
 ### Phase-7 memory syscalls (`writeMemory` / `queryMemory`)
 
@@ -682,7 +705,7 @@ Inbound signals are routed by the in-kernel attention policy (default queue size
 | queue full | `dropped` |
 
 ```typescript
-import { SignalGateway, ScheduledPrompt } from "@deepstrike/sdk"
+import { SignalGateway, ScheduledPrompt } from "@deepstrike/sdk/os"
 
 const gw = new SignalGateway()
 gw.schedule(new ScheduledPrompt("standup", Date.now() + 3600_000))

package/dist/harness/manifest.d.ts

@@ -22,7 +22,7 @@ export declare function composeSystemPrompt(base: string | undefined, instructio
  * The exact `RuntimeOptions` fields a manifest may drive. Derived via `Pick` so field names and types
  * track `RuntimeOptions` verbatim; anything outside this set is rejected by `applyManifest`/`applyPatch`.
  */
-export type HarnessRuntimePatch = Pick<RuntimeOptions, "maxTurns" | "maxTotalTokens" | "criteriaGate" | "repeatFuse" | "entropyWatch" | "knowledgeBudgetRatio" | "skillLeaseTurns" | "allowedToolIds" | "stableCoreToolIds" | "enablePlanTool" | "skillFilter"> & Pick<MemoryPolicy, "retrievalTopK" | "promotionRecallThreshold">;
+export type HarnessRuntimePatch = Pick<RuntimeOptions, "maxTurns" | "maxTotalTokens" | "criteriaGate" | "repeatFuse" | "entropyWatch" | "knowledgeBudgetRatio" | "skillLeaseTurns" | "allowedToolIds" | "baselineToolIds" | "stableCoreToolIds" | "enablePlanTool" | "skillFilter"> & Pick<MemoryPolicy, "retrievalTopK" | "promotionRecallThreshold">;
 /**
  * The promotion tier of an editable surface — the SECOND axis of the safety boundary (the whitelist is
  * the first). Even a whitelisted surface may need a heavier gate than "typed validation passed".

package/dist/harness/manifest.js

@@ -11,12 +11,16 @@
  * absent, so a proposer can never rewrite them (spec design principle: conservative promotion).
  *
  * Tool/skill surfaces add the SECOND safety invariant (spec design principle A — the capability
- * ceiling): `allowedToolIds`, `stableCoreToolIds`, and `skillFilter` fold onto the host baseline by
- * INTERSECTION, never assignment. A manifest can only NARROW the tools/skills the host already
- * exposes — never widen. Capability expansion (naming a tool the host does not expose) is therefore
- * structurally inexpressible, and the whole security audit stays O(1): read the whitelist, check the
- * one invariant. (`enablePlanTool` is exempt — it toggles a kernel-owned meta-tool, attention-shaping
- * not capability-granting, so it folds by plain assignment.)
+ * ceiling): `allowedToolIds`, `baselineToolIds`, `stableCoreToolIds`, and `skillFilter` fold onto the
+ * host baseline by INTERSECTION, never assignment. A manifest can only NARROW the tools/skills the
+ * host already exposes — never widen. Capability expansion (naming a tool the host does not expose) is
+ * therefore structurally inexpressible, and the whole security audit stays O(1): read the whitelist,
+ * check the one invariant. (`enablePlanTool` is exempt — it toggles a kernel-owned meta-tool,
+ * attention-shaping not capability-granting, so it folds by plain assignment.)
+ *
+ * `toolDispatchGate` is deliberately ABSENT from the whitelist and must stay so: it selects whether
+ * the kernel enforces the exposure surface at dispatch. A proposer that could set it to `"registered"`
+ * would disable the enforcement half of the ceiling it is otherwise structurally unable to widen.
  */
 import { createHash } from "node:crypto";
 import { validateNudgeRules } from "./nudge.js";
@@ -44,7 +48,12 @@ export function composeSystemPrompt(base, instructions) {
 }
 const MEMORY_POLICY_PATCH_KEYS = ["retrievalTopK", "promotionRecallThreshold"];
 /** Tool/skill surfaces whose fold is intersection-with-baseline (capability ceiling), not assignment. */
-const INTERSECTION_PATCH_KEYS = ["allowedToolIds", "stableCoreToolIds", "skillFilter"];
+const INTERSECTION_PATCH_KEYS = [
+    "allowedToolIds",
+    "baselineToolIds",
+    "stableCoreToolIds",
+    "skillFilter",
+];
 const RUNTIME_PATCH_KEYS = [
     "maxTurns",
     "maxTotalTokens",
@@ -54,12 +63,13 @@ const RUNTIME_PATCH_KEYS = [
     "knowledgeBudgetRatio",
     "skillLeaseTurns",
     "allowedToolIds",
+    "baselineToolIds",
     "stableCoreToolIds",
     "enablePlanTool",
     "skillFilter",
     ...MEMORY_POLICY_PATCH_KEYS,
 ];
-/** Bounds for the id-list surfaces (allowedToolIds / stableCoreToolIds / skillFilter). */
+/** Bounds for the id-list surfaces (allowedToolIds / baselineToolIds / stableCoreToolIds / skillFilter). */
 const MAX_TOOL_ID_CHARS = 128;
 const MAX_TOOL_LIST_ENTRIES = 128;
 /**
@@ -165,23 +175,19 @@ function validateRuntimePatch(runtime) {
         }
     }
 }
-/**
- * Validate an id-list surface: array of unique, non-empty strings (each ≤128 chars), ≤128 entries.
- * `allowEmpty` is the load-bearing asymmetry. For the tool-id arrays it is FALSE: the runner reads an
- * empty/absent `allowedToolIds` as "no gating — expose ALL registered tools", so an empty array would
- * WIDEN exposure to everything if it reached the runner (and a zero-tool run is the v0.2.46 pathology).
- * For `skillFilter` it is TRUE: the runner's no-gating sentinel is ONLY `undefined`, and an empty array
- * legitimately means "no skills available" (a proposer may find skills are a distraction) — a narrowing.
- */
-function validateIdList(key, value, allowEmpty) {
+/** Validate an id-list surface: array of unique, non-empty strings (each ≤128 chars), ≤128 entries. */
+function validateIdList(key, value, emptyPolicy) {
     if (!Array.isArray(value))
         throw new TypeError(`runtime.${key} must be a string[]`);
     if (value.length > MAX_TOOL_LIST_ENTRIES) {
         throw new RangeError(`runtime.${key} exceeds ${MAX_TOOL_LIST_ENTRIES} entries`);
     }
-    if (!allowEmpty && value.length === 0) {
+    if (emptyPolicy === "reject:widens" && value.length === 0) {
         throw new RangeError(`runtime.${key} must be a non-empty list — an empty array is read by the runner as "no gating" (expose all registered tools), which WIDENS exposure`);
     }
+    if (emptyPolicy === "reject:drastic" && value.length === 0) {
+        throw new RangeError(`runtime.${key} must be a non-empty list — an empty baseline collapses the pre-activation surface to meta-tools only, which stays a human/host decision`);
+    }
     const seen = new Set();
     for (const entry of value) {
         if (typeof entry !== "string" || entry.length === 0) {
@@ -219,10 +225,13 @@ function validateRuntimeValue(key, value) {
             return;
         case "allowedToolIds":
         case "stableCoreToolIds":
-            validateIdList(key, value, /* allowEmpty */ false);
+            validateIdList(key, value, "reject:widens");
+            return;
+        case "baselineToolIds":
+            validateIdList(key, value, "reject:drastic");
             return;
         case "skillFilter":
-            validateIdList(key, value, /* allowEmpty */ true);
+            validateIdList(key, value, "allow");
             return;
         case "knowledgeBudgetRatio":
             if (typeof value !== "number" || !(value > 0 && value <= 1)) {
@@ -335,7 +344,9 @@ export function applyManifest(manifest, base) {
 }
 /**
  * Fold one intersection surface (capability ceiling): effective = manifest ∩ host-baseline, so a
- * manifest can only NARROW. The empty-baseline meaning is surface-specific and load-bearing:
+ * manifest can only NARROW. The empty-baseline meaning is surface-specific and load-bearing — it
+ * tracks whatever the RUNNER's own no-gating sentinel is for that option, not whether the option
+ * happens to hold tool ids:
  *
  *   - allowedToolIds / stableCoreToolIds — the runner reads an empty OR absent baseline as
  *     "no gating = all registered tools" (the universe), so a non-array/empty baseline yields the
@@ -343,19 +354,22 @@ export function applyManifest(manifest, base) {
  *     empty intersection THROWS: a zero-tool run reprises the v0.2.46 pathology AND the runner would
  *     silently reinterpret the empty result as "no gating" (full exposure) — so we turn the candidate
  *     into a discardable error instead.
- *   - skillFilter — the runner's no-gating sentinel is ONLY `undefined`; an empty-array baseline is a
- *     genuine, maximally-tight ceiling (no skills). So ANY present array (even `[]`) is intersected,
- *     and an empty result is FINE (= no skills). This mirrors the validation asymmetry exactly.
+ *   - skillFilter / baselineToolIds — the runner's no-gating sentinel is ONLY `undefined`; an
+ *     empty-array baseline is a genuine, maximally-tight ceiling (no skills / the minimal meta-only
+ *     tool surface). So ANY present array (even `[]`) is intersected, and an empty result is FINE —
+ *     it reaches the runner as exactly that maximally-tight value, never as "no gating". This mirrors
+ *     the validation asymmetry exactly. `baselineToolIds` sits on THIS side despite being a tool-id
+ *     list: `[]` is its documented minimal surface (kernel `Some([])`), distinct from absent.
  */
 function foldIntersection(key, manifestList, baseList) {
-    const skillLike = key === "skillFilter";
-    // Is the host baseline a real constraining set?  Tool ids: non-empty array only (empty == universe).
-    // skillFilter: any array (empty == the empty set).
-    const constrained = Array.isArray(baseList) && (skillLike || baseList.length > 0);
+    // Is an EMPTY host baseline a maximally-tight ceiling (intersect it, empty result fine) or the
+    // universe (ignore it, empty result is a bug)?
+    const emptyBaselineIsTight = key === "skillFilter" || key === "baselineToolIds";
+    const constrained = Array.isArray(baseList) && (emptyBaselineIsTight || baseList.length > 0);
     const effective = constrained
         ? manifestList.filter(id => baseList.includes(id)) // manifest order → deterministic
         : manifestList;
-    if (!skillLike && effective.length === 0) {
+    if (!emptyBaselineIsTight && effective.length === 0) {
         throw new RangeError(`applyManifest: runtime.${key} intersection is empty — manifest [${manifestList.join(", ")}] ∩ ` +
             `host [${(baseList ?? []).join(", ")}] names no shared tool. A zero-tool run is rejected (it ` +
             `reprises the v0.2.46 pathology and the runner would read empty as "no gating" = full exposure).`);

package/dist/index.d.ts

@@ -4,20 +4,18 @@ export type { LoopSpec, LoopOutcome } from "./runtime/loop-driver.js";
 export type { RunAgentOptions, RunFanoutOptions } from "./runtime/facade.js";
 export { RuntimeRunner, collectText } from "./runtime/runner.js";
 export type { RuntimeOptions, KernelReliabilityOptions, OperationCancellationReason, PromptBudget, SchedulerPolicy } from "./runtime/runner.js";
+export { PayloadStore } from "./runtime/payload-store.js";
+export type { PayloadStoreConfig } from "./runtime/payload-store.js";
 export type { InstructionProfile, NudgeRule, NudgeTrigger } from "./harness/public.js";
 export type { SignalPolicy } from "./runtime/os-profile.js";
-export { readKernelDiagnostics, restoreKernelRuntime, snapshotKernelRuntime } from "./runtime/kernel-step.js";
-export type { KernelDiagnostics, KernelSnapshot } from "./runtime/kernel-step.js";
-export { rebuildKernelRuntime } from "./runtime/kernel-rebuild.js";
-export type { KernelRebuildResult } from "./runtime/kernel-rebuild.js";
 export { CONTEXT_POLICY_VERSION, DEFAULT_CONTEXT_POLICY_V1, PPM_SCALE, contextPolicyV1, normalizeContextPolicyV1, ratioToPpm, } from "./runtime/context-policy.js";
 export type { ContextPolicyOverridesV1, ContextPolicyV1, ContextPolicyWireV1, ContextPressureThresholdsV1, } from "./runtime/context-policy.js";
 export { LocalExecutionPlane } from "./runtime/execution-plane.js";
 export type { ExecutionPlane, RunContext } from "./runtime/execution-plane.js";
 export { InMemorySessionLog, FileSessionLog } from "./runtime/session-log.js";
-export type { KernelTransactionEntry, SessionLog, SessionEvent } from "./runtime/session-log.js";
-export { KERNEL_LOG_RECORD_VERSION, KernelLogConflictError, KernelLogIntegrityError, canonicalKernelJson, createKernelOperationGenesis, createKernelTransaction, kernelRecordDigest, verifyKernelOperationGenesis, verifyKernelTransaction, verifyKernelTransactionStream, verifyKernelTransactionSuccessor, } from "./runtime/kernel-transaction-log.js";
-export type { DurableAppendReceipt, KernelGenesisReceipt, KernelOperationCursor, KernelOperationGenesis, KernelOperationGenesisBody, KernelTransaction, KernelTransactionBody, } from "./runtime/kernel-transaction-log.js";
+export type { SessionLog, SessionEvent } from "./runtime/session-log.js";
+export { FileKernelJournal, InMemoryKernelJournal, JournalCasConflictError, JournalIntegrityError, JournalIoError, } from "./runtime/kernel-journal.js";
+export type { CheckpointCandidate, InstalledCheckpoint, JournalAppendReceipt, JournalEntry, JournalHead, JournalPruneReceipt, JournalRecordInput, KernelJournal, } from "./runtime/kernel-journal.js";
 export { InMemoryGroupBudgetStore, GroupBudgetScope } from "./runtime/run-group.js";
 export type { RunGroup, GroupBudgetStore, GroupLedger, GroupCharge, GroupMember, GroupBudgetRequest, GroupBudgetReservation, } from "./runtime/run-group.js";
 export { InMemoryEventStream, isVisibleTo } from "./runtime/event-stream.js";

package/dist/index.js

@@ -15,13 +15,13 @@ export { runAgent, runFanout } from "./runtime/facade.js";
 // ③ dynamic loop agents: self-pacing rounds over the kernel pacing trap.
 export { runLoop, LoopDriver, foldLoopState } from "./runtime/loop-driver.js";
 export { RuntimeRunner, collectText } from "./runtime/runner.js";
-export { readKernelDiagnostics, restoreKernelRuntime, snapshotKernelRuntime } from "./runtime/kernel-step.js";
-export { rebuildKernelRuntime } from "./runtime/kernel-rebuild.js";
+export { PayloadStore } from "./runtime/payload-store.js";
 export { CONTEXT_POLICY_VERSION, DEFAULT_CONTEXT_POLICY_V1, PPM_SCALE, contextPolicyV1, normalizeContextPolicyV1, ratioToPpm, } from "./runtime/context-policy.js";
 // ── Execution plane + session log (the defaults) ────────────────────────────
 export { LocalExecutionPlane } from "./runtime/execution-plane.js";
 export { InMemorySessionLog, FileSessionLog } from "./runtime/session-log.js";
-export { KERNEL_LOG_RECORD_VERSION, KernelLogConflictError, KernelLogIntegrityError, canonicalKernelJson, createKernelOperationGenesis, createKernelTransaction, kernelRecordDigest, verifyKernelOperationGenesis, verifyKernelTransaction, verifyKernelTransactionStream, verifyKernelTransactionSuccessor, } from "./runtime/kernel-transaction-log.js";
+// ── Durable transaction capability (Canonical Kernel ABI §9.1) ──────────────
+export { FileKernelJournal, InMemoryKernelJournal, JournalCasConflictError, JournalIntegrityError, JournalIoError, } from "./runtime/kernel-journal.js";
 export { InMemoryGroupBudgetStore, GroupBudgetScope } from "./runtime/run-group.js";
 export { InMemoryEventStream, isVisibleTo } from "./runtime/event-stream.js";
 export { ManagedTaskScope, operationAbortSignal } from "./runtime/reliability.js";

package/dist/kernel.d.ts

@@ -1,4 +1,4 @@
-import type { Message, RenderedContext } from "./types.js";
+import type { Message } from "./types.js";
 export interface GovernanceVerdict {
     kind: "allow" | "deny" | "rate_limited" | "ask_user";
     reason?: string;
@@ -33,16 +33,12 @@ export interface ResourceQuota {
 /**
  * Long-term memory policy — declarative knobs for the kernel's memory subsystem.
  *
- * Installed through the versioned JSON event ABI (`set_memory_policy`), the same channel as
- * governance / scheduler / quota config, so memory configuration is replayable and
- * session-loggable rather than a side-channel setter. Installing the policy is opt-in and
- * kernel-enforced; omitted fields fall back to the kernel defaults (empty path, 2-day stale
- * warning, top-5 retrieval, validation on). Enabling memory is still `dreamStore` + `agentId`.
+ * Included in canonical operation configuration, so memory policy is replayable and
+ * kernel-enforced. Omitted fields retain the canonical defaults. Host storage belongs to the
+ * configured `DreamStore`, never to this contract.
  */
 export interface MemoryPolicy {
-    /** Filesystem root the SDK uses to persist/scan memories; carried for SDK recall I/O. */
-    memoryPath?: string;
-    /** Age after which a recalled memory is flagged stale (days); consumed SDK-side. */
+    /** Age after which a recalled memory is flagged stale (days). */
     staleWarningDays?: number;
     /** Upper bound on retrieval breadth: the kernel clamps `query_memory` top-k to this. */
     retrievalTopK?: number;
@@ -108,31 +104,65 @@ export interface Verdict {
         content: string;
     };
 }
-export interface KernelRuntimeInstance {
-    step(inputJson: string): string;
-    prepareStep(inputJson: string): string;
-    commitPrepared(prepareToken: string): string;
-    abortPrepared(prepareToken: string): void;
-    snapshot(): string;
-    restore(snapshotJson: string): void;
-    diagnostics(): string;
-    isTerminal(): boolean;
-    turn(): number;
-    /** L1 (RunGroup): cumulative sub-agent spawns this run, for charging the group ledger at run end. */
-    localSubagentsSpawned(): number;
-    recoveryContentBytes(): number;
-    render(): RenderedContext;
-    drainNewMessages(): Message[];
-    preservedRefs(): string[];
+export interface CanonicalPrepared {
+    status: "prepared";
+    prepareToken: string;
+    stepSeq: string;
+    expectedHead?: string;
+    recordDigest: string;
+    recordBytes: Buffer;
+    plannedStepJson: string;
+}
+export interface CanonicalReplayed {
+    status: "replayed";
+    stepSeq: string;
+    expectedHead?: string;
+    recordDigest: string;
+    recordBytes?: Buffer;
+    plannedStepJson?: string;
+}
+export interface CanonicalRejected {
+    status: "rejected";
+    faultJson: string;
+}
+/** Closed §7.13 result; only `prepared` carries a token that may be committed or aborted. */
+export type CanonicalPreparation = CanonicalPrepared | CanonicalReplayed | CanonicalRejected;
+export interface CanonicalCommit {
+    stepSeq: string;
+    recordDigest: string;
+    plannedStepJson: string;
+    checkpointAdviceJson?: string;
+}
+export interface CanonicalCheckpoint {
+    checkpointBytes: Buffer;
+    throughStepSeq: string;
+    coveredHead: string;
+    stateDigest: string;
+    ackToken: string;
+}
+export interface CanonicalRestoreCost {
+    recordsBeforeCheckpoint: string;
+    tailInputsReplayed: string;
+    recordsAfterCheckpoint: string;
+    bytesRead: string;
+}
+export interface CanonicalKernelInstance {
+    prepare(inputJson: string): CanonicalPreparation;
+    commit(prepareToken: string, appendedHead: string): CanonicalCommit;
+    abort(prepareToken: string): void;
+    checkpointCandidate(): CanonicalCheckpoint;
+    checkpointRebase(checkpointBytes: Buffer): CanonicalCheckpoint;
+    ackCheckpoint(throughStepSeq: string, coveredHead: string): void;
+    /** Replaces native state in place; the JavaScript handle retains its identity. */
+    restore(checkpointBytes: Buffer | undefined, recordBytes: Buffer[]): CanonicalRestoreCost;
+    lifecycle(): "created" | "configured" | "running" | "suspended" | "completed" | "cancelled" | "failed";
+    pendingEffectsJson(): string;
+    terminalJson(): string | undefined;
 }
 interface KernelModule {
     Governance: new (defaultAction?: "allow" | "deny" | "ask_user") => GovernanceInstance;
-    KernelRuntime: new (policy: {
-        maxTokens: number;
-        maxTurns?: number;
-        maxTotalTokens?: bigint;
-        timeoutMs?: bigint;
-    }) => KernelRuntimeInstance;
+    CanonicalKernel: new () => CanonicalKernelInstance;
+    kernelAbiVersion(): number;
     SignalRouter: new (maxQueueSize: number) => SignalRouterInstance;
     buildEvalMessages(goal: string, criteria: NativeCriterion[], result: string, attempt: number, extractSkillOnPass: boolean): Message[];
     parseVerdict(content: string): Verdict;