@deepstrike/sdk 0.2.9 → 0.2.11

package/dist/harness/harness.d.ts

@@ -26,6 +26,8 @@ export interface HarnessOutcome {
     overallScore?: number;
     feedback?: string;
     details?: CriterionResult[];
+    /** R3-1: nodes the agent submitted via `submit_workflow_nodes` while running under the harness. */
+    submittedNodes?: import("../types/agent.js").WorkflowNodeSpec[];
 }
 export interface Verdict {
     passed: boolean;
@@ -55,6 +57,9 @@ export type HarnessEvent = {
     callId: string;
     content: string;
     isError: boolean;
+} | {
+    type: "workflow_nodes_submitted";
+    nodes: import("../types/agent.js").WorkflowNodeSpec[];
 } | {
     type: "supervising";
 } | {

package/dist/harness/harness.js

@@ -61,8 +61,14 @@ export class HarnessLoop {
     }
     async run(request) {
         let last;
-        for await (const evt of this.stream(request))
+        // R3-1: collect nodes the agent submitted while running under the harness, so dynamic fan-out
+        // works in harness mode too (not just the plain streaming path).
+        const submittedNodes = [];
+        for await (const evt of this.stream(request)) {
             last = evt;
+            if (evt.type === "workflow_nodes_submitted")
+                submittedNodes.push(...evt.nodes);
+        }
         const done = last?.type === "done" ? last : undefined;
         return {
             result: "",
@@ -73,6 +79,7 @@ export class HarnessLoop {
             overallScore: done?.verdict.overallScore,
             feedback: done?.verdict.feedback,
             details: done?.verdict.details,
+            ...(submittedNodes.length ? { submittedNodes } : {}),
         };
     }
     async *stream(request) {
@@ -107,6 +114,10 @@ export class HarnessLoop {
                     const tr = evt;
                     yield { type: "tool_result", callId: tr.callId, content: tr.content, isError: tr.isError };
                 }
+                else if (evt.type === "workflow_nodes_submitted") {
+                    const ws = evt;
+                    yield { type: "workflow_nodes_submitted", nodes: ws.nodes };
+                }
                 else if (evt.type === "done") {
                     const d = evt;
                     lastIterations = d.iterations;

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 export { RuntimeRunner, collectText } from "./runtime/runner.js";
 export type { RuntimeOptions, SchedulerBudget } from "./runtime/runner.js";
+export { builtinReducers, resolveReducer } from "./runtime/reducers.js";
+export type { Reducer, ReducerRegistry, ReducerInput } from "./runtime/reducers.js";
 export type { MemoryPolicy, MemoryWriteRateLimit, ResourceQuota } from "./kernel.js";
 export { KernelPrimitivesDashboard } from "./runtime/kernel-primitives-dashboard.js";
 export { FilteredExecutionPlane } from "./runtime/filtered-plane.js";
@@ -61,7 +63,7 @@ export { SinglePassHarness, EvalLoopHarness, HarnessLoop } from "./harness/harne
 export type { HarnessRequest, HarnessOutcome, HarnessLoopOptions, QualityGate } from "./harness/harness.js";
 export type { Message, ToolCall, ToolResult, ToolSchema, ContentPart, TextPart, ImagePart, AudioPart, StreamEvent, TextDelta, ThinkingDelta, ToolCallEvent, ToolChunk, ToolDeltaEvent, ToolSuspendEvent, ToolResultEvent, DoneEvent, ErrorEvent, PermissionRequestEvent, PermissionResolvedEvent, PermissionResponse, LLMProvider, RetryConfig, TokenUsage, ProviderToolSpec, ProviderRunState, ProviderReplay, RenderedContext, ReplayabilityAssessment, } from "./types.js";
 export type { AgentCapabilityFilter, AgentIdentity, AgentIsolation, AgentRunSpec, AgentProcessChangedObservation, ContextInheritance, KernelAgentRole, LoopResult, MilestoneCheckResult, MilestoneContract, MilestonePhase, MilestonePolicy, SubAgentResult, TerminationReason, WorkflowSpec, WorkflowNodeSpec, WorkflowTaskSpec, WorkflowSpawnInfo, } from "./types/agent.js";
-export { agentIdentitySub, agentRunSpecToKernel, milestoneCheckFail, milestoneCheckPass, milestoneCheckResultToKernel, subAgentResultToKernel, workflowSpecToKernel, fanoutSynthesize, generateAndFilter, verifyRules, } from "./types/agent.js";
+export { agentIdentitySub, agentRunSpecToKernel, milestoneCheckFail, milestoneCheckPass, milestoneCheckResultToKernel, subAgentResultToKernel, workflowSpecToKernel, workflowNodeSpecToKernel, submitWorkflowNodesToKernel, submitWorkflowNodesTool, fanoutSynthesize, generateAndFilter, verifyRules, } from "./types/agent.js";
 export type { AcceptanceCriterion, VerificationContract, ContractCheckResult, } from "./collaboration/contract.js";
 export { ContractBuilder, formatContractForSystemPrompt, contractToCriteriaStrings, } from "./collaboration/contract.js";
 export { AgentPool } from "./collaboration/pool.js";

package/dist/index.js

@@ -1,5 +1,6 @@
 // ── Runtime (Layer 1.5) ────────────────────────────────────────────────────
 export { RuntimeRunner, collectText } from "./runtime/runner.js";
+export { builtinReducers, resolveReducer } from "./runtime/reducers.js";
 export { KernelPrimitivesDashboard } from "./runtime/kernel-primitives-dashboard.js";
 export { FilteredExecutionPlane } from "./runtime/filtered-plane.js";
 export { SubAgentOrchestrator, defaultSubAgentOrchestrator, spawnStandalone } from "./runtime/sub-agent-orchestrator.js";
@@ -41,7 +42,7 @@ export { PermissionManager, PermissionMode } from "./safety/permissions.js";
 export { Governance, governancePolicyToKernelEvent } from "./governance.js";
 // ── Harness ────────────────────────────────────────────────────────────────
 export { SinglePassHarness, EvalLoopHarness, HarnessLoop } from "./harness/harness.js";
-export { agentIdentitySub, agentRunSpecToKernel, milestoneCheckFail, milestoneCheckPass, milestoneCheckResultToKernel, subAgentResultToKernel, workflowSpecToKernel, fanoutSynthesize, generateAndFilter, verifyRules, } from "./types/agent.js";
+export { agentIdentitySub, agentRunSpecToKernel, milestoneCheckFail, milestoneCheckPass, milestoneCheckResultToKernel, subAgentResultToKernel, workflowSpecToKernel, workflowNodeSpecToKernel, submitWorkflowNodesToKernel, submitWorkflowNodesTool, fanoutSynthesize, generateAndFilter, verifyRules, } from "./types/agent.js";
 export { ContractBuilder, formatContractForSystemPrompt, contractToCriteriaStrings, } from "./collaboration/contract.js";
 export { AgentPool } from "./collaboration/pool.js";
 export { KERNEL_ROLE_MAP } from "./collaboration/pool.js";

package/dist/runtime/output-schema.d.ts

@@ -0,0 +1,14 @@
+export interface SchemaValidation {
+    ok: boolean;
+    errors: string[];
+}
+type JsonSchema = Record<string, unknown>;
+/** Validate `value` against `schema` (the supported subset). `path` is for error messages. */
+export declare function validateAgainstSchema(value: unknown, schema: JsonSchema, path?: string): SchemaValidation;
+/** The instruction appended to a node's goal so its agent produces schema-conforming JSON. */
+export declare function schemaInstruction(schema: JsonSchema): string;
+/** A stronger re-prompt for a retry after a validation failure. */
+export declare function schemaRetryInstruction(schema: JsonSchema, errors: string[]): string;
+/** Best-effort extraction of a JSON value from agent output (raw, fenced, or embedded). */
+export declare function extractJsonValue(text: string): unknown;
+export {};

package/dist/runtime/output-schema.js

@@ -0,0 +1,113 @@
+// G3 structured output: a small, dependency-free JSON-Schema subset validator + helpers used by the
+// workflow runner to enforce a node's `output_schema`. The kernel carries the schema verbatim (it is
+// zero-I/O and never validates); enforcement lives here, SDK-side, where the agent output exists.
+//
+// Supported keywords (the common structured-output subset): `type` (object | array | string |
+// number | integer | boolean | null), `required`, `properties` (recursive), `items` (recursive),
+// `enum`. Unknown keywords are ignored rather than rejected — a permissive superset of these specs
+// still validates, matching "instruct the model, then check the shape" rather than full JSON Schema.
+function typeOfValue(v) {
+    if (v === null)
+        return "null";
+    if (Array.isArray(v))
+        return "array";
+    return typeof v; // "object" | "string" | "number" | "boolean"
+}
+function matchesType(v, t) {
+    switch (t) {
+        case "integer":
+            return typeof v === "number" && Number.isInteger(v);
+        case "number":
+            return typeof v === "number";
+        case "object":
+            return typeOfValue(v) === "object";
+        default:
+            return typeOfValue(v) === t;
+    }
+}
+/** Validate `value` against `schema` (the supported subset). `path` is for error messages. */
+export function validateAgainstSchema(value, schema, path = "$") {
+    const errors = [];
+    const type = schema.type;
+    if (typeof type === "string" && !matchesType(value, type)) {
+        errors.push(`${path}: expected ${type}, got ${typeOfValue(value)}`);
+        return { ok: false, errors }; // type mismatch ⇒ stop; deeper checks are meaningless
+    }
+    if (Array.isArray(type) && !type.some(t => typeof t === "string" && matchesType(value, t))) {
+        errors.push(`${path}: expected one of [${type.join(", ")}], got ${typeOfValue(value)}`);
+        return { ok: false, errors };
+    }
+    if (Array.isArray(schema.enum) && !schema.enum.some(e => e === value)) {
+        errors.push(`${path}: value not in enum`);
+    }
+    if (typeOfValue(value) === "object") {
+        const obj = value;
+        const required = Array.isArray(schema.required) ? schema.required : [];
+        for (const key of required) {
+            if (!(key in obj))
+                errors.push(`${path}.${key}: required property missing`);
+        }
+        const properties = schema.properties ?? {};
+        for (const [key, sub] of Object.entries(properties)) {
+            if (key in obj) {
+                const r = validateAgainstSchema(obj[key], sub, `${path}.${key}`);
+                if (!r.ok)
+                    errors.push(...r.errors);
+            }
+        }
+    }
+    if (typeOfValue(value) === "array" && schema.items && typeof schema.items === "object") {
+        const items = schema.items;
+        value.forEach((el, i) => {
+            const r = validateAgainstSchema(el, items, `${path}[${i}]`);
+            if (!r.ok)
+                errors.push(...r.errors);
+        });
+    }
+    return { ok: errors.length === 0, errors };
+}
+/** The instruction appended to a node's goal so its agent produces schema-conforming JSON. */
+export function schemaInstruction(schema) {
+    return ("You MUST return ONLY a single JSON value that conforms to this JSON Schema, with no prose, " +
+        "no markdown, and no code fences:\n" +
+        JSON.stringify(schema));
+}
+/** A stronger re-prompt for a retry after a validation failure. */
+export function schemaRetryInstruction(schema, errors) {
+    return (`${schemaInstruction(schema)}\n\nYour previous output did NOT conform: ${errors.join("; ")}. ` +
+        "Return ONLY the corrected JSON value.");
+}
+/** Best-effort extraction of a JSON value from agent output (raw, fenced, or embedded). */
+export function extractJsonValue(text) {
+    const trimmed = (text ?? "").trim();
+    if (!trimmed)
+        return undefined;
+    const tryParse = (s) => {
+        try {
+            return JSON.parse(s);
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const whole = tryParse(trimmed);
+    if (whole !== undefined)
+        return whole;
+    const fence = trimmed.match(/```(?:json)?\s*([\s\S]*?)```/i);
+    if (fence) {
+        const fenced = tryParse(fence[1].trim());
+        if (fenced !== undefined)
+            return fenced;
+    }
+    // Fall back to the first balanced {...} or [...] slice.
+    for (const [open, close] of [["{", "}"], ["[", "]"]]) {
+        const start = trimmed.indexOf(open);
+        const end = trimmed.lastIndexOf(close);
+        if (start !== -1 && end > start) {
+            const slice = tryParse(trimmed.slice(start, end + 1));
+            if (slice !== undefined)
+                return slice;
+        }
+    }
+    return undefined;
+}

package/dist/runtime/reducers.d.ts

@@ -0,0 +1,15 @@
+/** One dependency's contribution to a reduce: the producing node's agent id and its output text. */
+export interface ReducerInput {
+    agentId: string;
+    output: string;
+}
+/** A pure function over a reduce node's dependency outputs → the reduce node's output string. */
+export type Reducer = (inputs: ReducerInput[]) => string;
+export type ReducerRegistry = Record<string, Reducer>;
+/**
+ * Built-in reducers, available to every workflow without registration. A user-supplied registry is
+ * merged over these (so a custom reducer can shadow a built-in of the same name).
+ */
+export declare const builtinReducers: ReducerRegistry;
+/** Resolve a reducer by name from the built-ins overlaid with a user registry. */
+export declare function resolveReducer(name: string, user?: ReducerRegistry): Reducer | undefined;

package/dist/runtime/reducers.js

@@ -0,0 +1,57 @@
+// G2 deterministic compute: the host-side reducer registry. A `NodeKind::Reduce` workflow node runs
+// no LLM agent — the kernel hands the SDK a reducer name + its dependency outputs, and the SDK runs
+// the named pure function here. This is the "ordinary code between stages" (dedupe / filter / merge /
+// early-exit) of the code-orchestration model, expressed deterministically as a DAG node.
+import { extractJsonValue } from "./output-schema.js";
+/** Non-empty, trimmed lines of a string. */
+function lines(s) {
+    return s
+        .split("\n")
+        .map(l => l.trim())
+        .filter(l => l.length > 0);
+}
+/**
+ * Built-in reducers, available to every workflow without registration. A user-supplied registry is
+ * merged over these (so a custom reducer can shadow a built-in of the same name).
+ */
+export const builtinReducers = {
+    /** Concatenate every input's output, separated by blank lines, in dependency order. */
+    concat: inputs => inputs.map(i => i.output).join("\n\n"),
+    /** Union of non-empty lines across all inputs, first-seen order preserved (dedupe a fan-out). */
+    dedupe_lines: inputs => {
+        const seen = new Set();
+        const out = [];
+        for (const i of inputs) {
+            for (const line of lines(i.output)) {
+                if (!seen.has(line)) {
+                    seen.add(line);
+                    out.push(line);
+                }
+            }
+        }
+        return out.join("\n");
+    },
+    /** Parse each input as a JSON array, concatenate, dedupe by canonical JSON → a JSON array string. */
+    merge_json_arrays: inputs => {
+        const seen = new Set();
+        const merged = [];
+        for (const i of inputs) {
+            const v = extractJsonValue(i.output);
+            const arr = Array.isArray(v) ? v : v !== undefined ? [v] : [];
+            for (const el of arr) {
+                const key = JSON.stringify(el);
+                if (!seen.has(key)) {
+                    seen.add(key);
+                    merged.push(el);
+                }
+            }
+        }
+        return JSON.stringify(merged);
+    },
+    /** The number of inputs that produced any non-empty output — handy for early-exit/branch gates. */
+    count: inputs => String(inputs.filter(i => i.output.trim().length > 0).length),
+};
+/** Resolve a reducer by name from the built-ins overlaid with a user registry. */
+export function resolveReducer(name, user) {
+    return user?.[name] ?? builtinReducers[name];
+}

package/dist/runtime/runner.d.ts

@@ -8,6 +8,7 @@ import type { ExecutionPlane } from "./execution-plane.js";
 import { type MemoryPolicy, type ResourceQuota } from "../kernel.js";
 import type { AgentRunSpec, MilestoneCheckResult, MilestoneContract, MilestonePolicy, WorkflowSpec } from "../types/agent.js";
 import { type SubAgentOrchestrator } from "./sub-agent-orchestrator.js";
+import { type ReducerRegistry } from "./reducers.js";
 import { type GovernancePolicy } from "../governance.js";
 import { type NativeOsProfile, type OsProfileId } from "./os-profile.js";
 import { LargeResultSpool } from "./large-result-spool.js";
@@ -97,6 +98,9 @@ export interface RuntimeOptions {
         evalProvider: LLMProvider;
         maxAttempts?: number;
     };
+    /** G2: custom reducers for `NodeKind::Reduce` workflow nodes, merged over the built-ins
+     *  (`concat` / `dedupe_lines` / `merge_json_arrays` / `count`). A reduce node runs no LLM. */
+    reducers?: ReducerRegistry;
     /** Optional system prompt injected into the dream synthesis call. */
     dreamSystemPrompt?: string;
     /** Custom LLM provider used for background memory consolidation (dream loop). */
@@ -159,6 +163,22 @@ export declare class RuntimeRunner {
      * Requires an active parent run (`run()` / `wake()` in progress or paused at milestone).
      */
     spawnSubAgent(spec: AgentRunSpec): AsyncIterable<StreamEvent>;
+    /**
+     * G3: run one workflow node, enforcing its `output_schema` (if any). Without a schema this is a
+     * plain `orchestrator.run`. With one, the node's agent is instructed to emit conforming JSON, its
+     * output is validated (the supported JSON-Schema subset), and on mismatch the node is re-run once
+     * with the validation errors fed back. If it still does not conform, the node is failed with the
+     * validation reason — a node that cannot meet its declared output contract starves its dependents,
+     * exactly as a denied spawn does.
+     */
+    private runWorkflowNode;
+    /**
+     * G2: execute a deterministic reduce node. Looks up the named reducer (built-ins overlaid with
+     * `opts.reducers`), runs it over the node's dependency outputs (gathered from `outputs`), and
+     * returns a synthetic completion carrying the reducer's output — no LLM, zero tokens. An unknown
+     * reducer or a thrown reducer fails the node (`Error` termination → the kernel starves dependents).
+     */
+    private runReduceNode;
     /**
      * W0-ABI: run a declarative workflow DAG. The kernel owns the DAG and gates every node spawn
      * through the syscall trap; this driver runs each kernel-emitted batch of nodes in parallel,
@@ -167,6 +187,7 @@ export declare class RuntimeRunner {
      */
     runWorkflow(spec: WorkflowSpec, opts?: {
         resumedCompleted?: string[];
+        resumedSubmissions?: Record<string, unknown>[][];
     }): Promise<{
         completed: string[];
         failed: string[];

package/dist/runtime/runner.js

@@ -3,11 +3,13 @@ import { resolvePermissionRequest } from "./execution-plane.js";
 import { getKernel } from "../kernel.js";
 import { peekProviderReplay, seedProviderReplayFromEvents } from "./provider-replay.js";
 import { sanitizeReplayText } from "./replay-sanitize.js";
-import { buildLlmCompletedEvent, buildRunTerminalEvent, buildWorkflowNodeCompletedEvent, recoverCompletedWorkflowNodes, repairEventsForRecovery, } from "./session-repair.js";
+import { buildLlmCompletedEvent, buildRunTerminalEvent, buildWorkflowNodeCompletedEvent, buildWorkflowNodesSubmittedEvent, recoverCompletedWorkflowNodes, recoverSubmittedWorkflowNodes, repairEventsForRecovery, } from "./session-repair.js";
 import { KernelPrimitivesDashboard } from "./kernel-primitives-dashboard.js";
 import { capabilityMarker, capabilitySkill, capabilityTool, capabilityCommandMount, capabilityCommandUnmount, kernelAction, kernelApply, kernelMaybeAction, forceCompact, messageToKernelMessage, skillMetadataToKernel, taskUpdateToKernel, toolResultToKernel, toolSchemaToKernel, } from "./kernel-step.js";
-import { agentRunSpecToKernel, findSpawnProcessObservation, milestoneCheckPass, milestoneCheckResultToKernel, spawnObservationToManifest, subAgentResultToKernel, workflowNodeToManifest, workflowNodeToSpec, workflowSpecToKernel, } from "../types/agent.js";
+import { agentRunSpecToKernel, findSpawnProcessObservation, milestoneCheckPass, milestoneCheckResultToKernel, spawnObservationToManifest, subAgentResultToKernel, submitWorkflowNodesToKernel, workflowBudgetNote, workflowNodeToManifest, workflowNodeToSpec, workflowSpecToKernel, } from "../types/agent.js";
 import { defaultSubAgentOrchestrator } from "./sub-agent-orchestrator.js";
+import { extractJsonValue, schemaInstruction, schemaRetryInstruction, validateAgainstSchema, } from "./output-schema.js";
+import { resolveReducer } from "./reducers.js";
 import { governancePolicyToKernelEvent } from "../governance.js";
 import { kernelObservationToSessionEvent, withCategory } from "./kernel-event-log.js";
 import { assertNativeProfile } from "./os-profile.js";
@@ -256,6 +258,86 @@ export class RuntimeRunner {
         });
         yield { type: "done", iterations: result.result.turnsUsed, totalTokens: result.result.totalTokensUsed, status: result.result.termination };
     }
+    /**
+     * G3: run one workflow node, enforcing its `output_schema` (if any). Without a schema this is a
+     * plain `orchestrator.run`. With one, the node's agent is instructed to emit conforming JSON, its
+     * output is validated (the supported JSON-Schema subset), and on mismatch the node is re-run once
+     * with the validation errors fed back. If it still does not conform, the node is failed with the
+     * validation reason — a node that cannot meet its declared output contract starves its dependents,
+     * exactly as a denied spawn does.
+     */
+    async runWorkflowNode(node, parentSessionId, orchestrator, budget, outputs) {
+        // G2: a reduce node runs no LLM — execute the registered pure function over its dependency
+        // outputs and feed the result back as an ordinary completion. Deterministic; no agent burned.
+        if (node.reducer) {
+            return this.runReduceNode(node, outputs ?? new Map());
+        }
+        const baseSpec = workflowNodeToSpec(node, parentSessionId);
+        const manifest = workflowNodeToManifest(node, parentSessionId);
+        // G4: surface the workflow's remaining budget to the node's agent so a coordinator can size its
+        // `submit_workflow_nodes` batch to what is available (empty string ⇒ unbounded, no note).
+        const budgetNote = workflowBudgetNote(budget);
+        const withBudget = (goal) => (budgetNote ? `${goal}\n\n${budgetNote}` : goal);
+        const mkCtx = (goal) => ({
+            parentOpts: this.opts,
+            parentSessionId,
+            spec: { ...baseSpec, goal: withBudget(goal) },
+            manifest,
+            sessionLog: this.opts.sessionLog,
+            ...(this.opts.subAgentHarness ? { harness: this.opts.subAgentHarness } : {}),
+        });
+        const schema = node.output_schema;
+        if (!schema)
+            return orchestrator.run(mkCtx(baseSpec.goal));
+        const MAX_ATTEMPTS = 2;
+        let last;
+        let lastErrors = [];
+        for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
+            const goal = attempt === 1
+                ? `${baseSpec.goal}\n\n${schemaInstruction(schema)}`
+                : `${baseSpec.goal}\n\n${schemaRetryInstruction(schema, lastErrors)}`;
+            const result = await orchestrator.run(mkCtx(goal));
+            const content = result.result.finalMessage?.content;
+            const text = typeof content === "string" ? content : content != null ? JSON.stringify(content) : "";
+            const v = validateAgainstSchema(extractJsonValue(text), schema);
+            if (v.ok)
+                return result;
+            last = result;
+            lastErrors = v.errors;
+        }
+        const reason = `output_schema validation failed after ${MAX_ATTEMPTS} attempts: ${lastErrors.join("; ")}`;
+        const fallback = last;
+        return {
+            ...fallback,
+            result: {
+                ...fallback.result,
+                termination: "error",
+                finalMessage: { role: "assistant", content: reason, toolCalls: [] },
+            },
+        };
+    }
+    /**
+     * G2: execute a deterministic reduce node. Looks up the named reducer (built-ins overlaid with
+     * `opts.reducers`), runs it over the node's dependency outputs (gathered from `outputs`), and
+     * returns a synthetic completion carrying the reducer's output — no LLM, zero tokens. An unknown
+     * reducer or a thrown reducer fails the node (`Error` termination → the kernel starves dependents).
+     */
+    runReduceNode(node, outputs) {
+        const ok = (content, termination) => ({
+            agentId: node.agent_id,
+            result: { termination, finalMessage: { role: "assistant", content, toolCalls: [] }, turnsUsed: 0, totalTokensUsed: 0 },
+        });
+        const reducer = resolveReducer(node.reducer, this.opts.reducers);
+        if (!reducer)
+            return ok(`unknown reducer "${node.reducer}"`, "error");
+        const inputs = (node.input_agent_ids ?? []).map(agentId => ({ agentId, output: outputs.get(agentId) ?? "" }));
+        try {
+            return ok(reducer(inputs), "completed");
+        }
+        catch (err) {
+            return ok(`reducer "${node.reducer}" threw: ${err instanceof Error ? err.message : String(err)}`, "error");
+        }
+    }
     /**
      * W0-ABI: run a declarative workflow DAG. The kernel owns the DAG and gates every node spawn
      * through the syscall trap; this driver runs each kernel-emitted batch of nodes in parallel,
@@ -275,26 +357,30 @@ export class RuntimeRunner {
             parent_session_id: parentSessionId,
             // W0-ABI resume: skip nodes already completed before an interruption.
             ...(opts?.resumedCompleted?.length ? { resumed_completed: opts.resumedCompleted } : {}),
+            // R3-1: re-apply recorded runtime submissions so dynamically-appended nodes are reconstructed.
+            ...(opts?.resumedSubmissions?.length ? { resumed_submissions: opts.resumedSubmissions } : {}),
         });
         const collectNodes = (obs) => obs.find(o => o.kind === "workflow_batch_spawned")
             ?.nodes ?? [];
+        // G4: the batch observation also carries the workflow's remaining budget; track the latest so a
+        // coordinator node's prompt reflects current headroom when it decides how much to submit.
+        const collectBudget = (obs) => obs.find(o => o.kind === "workflow_batch_spawned")?.budget;
         const findDone = (obs) => obs.find(o => o.kind === "workflow_completed");
         let done = findDone(observations);
         if (done)
             return { completed: done.completed ?? [], failed: done.failed ?? [] };
         let nodes = collectNodes(observations);
+        let budget = collectBudget(observations);
+        // G2: each completed node's output, keyed by agent id — a reduce node reads its dependencies'
+        // outputs from here. Deps always complete in an earlier round than the reduce node that needs
+        // them (the kernel keeps the reduce node un-ready until its deps finish), so this is populated.
+        const outputs = new Map();
         for (;;) {
             if (nodes.length === 0)
                 return { completed: [], failed: [] }; // nothing to run (e.g. all gated)
             // Run the currently-runnable nodes in parallel — each is independent within a round.
-            const results = await Promise.all(nodes.map(node => orchestrator.run({
-                parentOpts: this.opts,
-                parentSessionId,
-                spec: workflowNodeToSpec(node, parentSessionId),
-                manifest: workflowNodeToManifest(node, parentSessionId),
-                sessionLog: this.opts.sessionLog,
-                ...(this.opts.subAgentHarness ? { harness: this.opts.subAgentHarness } : {}),
-            })));
+            const roundBudget = budget;
+            const results = await Promise.all(nodes.map(node => this.runWorkflowNode(node, parentSessionId, orchestrator, roundBudget, outputs)));
             // Feed completions back one at a time. The kernel's run-queue executor may spawn a node's
             // dependents the moment *that* node completes (per-node unblock), so each feed can emit its
             // own `workflow_batch_spawned`; ACCUMULATE them across the round rather than keeping only the
@@ -304,11 +390,32 @@ export class RuntimeRunner {
             const nextNodes = [];
             done = undefined;
             for (const result of results) {
+                // G2: record this node's output so a downstream reduce node can consume it.
+                const outContent = result.result.finalMessage?.content;
+                outputs.set(result.agentId, typeof outContent === "string" ? outContent : outContent != null ? JSON.stringify(outContent) : "");
+                // R3-1: if this node's agent submitted more nodes, append them to the parent DAG BEFORE
+                // reporting the node's completion — the workflow is still active (the kernel hasn't seen this
+                // node finish), so even a submission from the last running node keeps the DAG alive. The
+                // appended nodes' `workflow_batch_spawned` is collected into this round like any other.
+                if (result.submittedNodes?.length) {
+                    // G1: stamp the submitting node's agent id so the kernel can coerce a quarantined
+                    // submitter's nodes to quarantined (no topological privilege escalation).
+                    const submitEvent = submitWorkflowNodesToKernel(result.submittedNodes, result.agentId);
+                    const subObs = kernelApply(runtime, this.pendingObservations, submitEvent);
+                    nextNodes.push(...collectNodes(subObs));
+                    budget = collectBudget(subObs) ?? budget;
+                    // R3-1: persist the submission (kernel-shape nodes) so resume can re-apply it.
+                    await this.opts.sessionLog.append(parentSessionId, buildWorkflowNodesSubmittedEvent({
+                        turn: runtime.turn(),
+                        nodes: submitEvent.nodes ?? [],
+                    }));
+                }
                 const obs = kernelApply(runtime, this.pendingObservations, {
                     kind: "sub_agent_completed",
                     result: subAgentResultToKernel(result),
                 });
                 nextNodes.push(...collectNodes(obs));
+                budget = collectBudget(obs) ?? budget;
                 const d = findDone(obs);
                 if (d)
                     done = d;
@@ -336,7 +443,8 @@ export class RuntimeRunner {
         }
         const events = await this.opts.sessionLog.read(this.currentSessionId);
         const resumedCompleted = recoverCompletedWorkflowNodes(events);
-        return this.runWorkflow(spec, { resumedCompleted });
+        const resumedSubmissions = recoverSubmittedWorkflowNodes(events);
+        return this.runWorkflow(spec, { resumedCompleted, resumedSubmissions });
     }
     interrupt() { this.interrupted = true; }
     async *run(req) {
@@ -827,8 +935,9 @@ export class RuntimeRunner {
                     resultSpool: this.opts.resultSpool ?? new LargeResultSpool(),
                 };
                 const toolResults = [];
-                const normalCalls = allCalls.filter(c => c.name !== "update_plan");
+                const normalCalls = allCalls.filter(c => c.name !== "update_plan" && c.name !== "submit_workflow_nodes");
                 const planCalls = allCalls.filter(c => c.name === "update_plan");
+                const submitCalls = allCalls.filter(c => c.name === "submit_workflow_nodes");
                 for (const call of planCalls) {
                     const update = parseUpdatePlanArgs(call.arguments);
                     kernelApply(runtime, this.pendingObservations, {
@@ -839,6 +948,18 @@ export class RuntimeRunner {
                     toolResults.push(result);
                     yield { type: "tool_result", callId: call.id, content: "success", isError: false };
                 }
+                // R3-1: `submit_workflow_nodes` cannot be applied to this runner's kernel — when this runner
+                // is a workflow node, the workflow lives in the *parent* kernel. Surface the requested nodes
+                // as a stream event; the orchestrator collects them onto the node's result and `runWorkflow`
+                // sends `submit_workflow_nodes` to the parent kernel. (When not a workflow node, the event is
+                // simply unconsumed — a no-op.)
+                for (const call of submitCalls) {
+                    const nodes = parseSubmitWorkflowNodesArgs(call.arguments);
+                    yield { type: "workflow_nodes_submitted", nodes };
+                    const result = { callId: call.id, output: "submitted", isError: false };
+                    toolResults.push(result);
+                    yield { type: "tool_result", callId: call.id, content: "submitted", isError: false };
+                }
                 if (normalCalls.length > 0) {
                     for await (const evt of this.opts.executionPlane.executeAll(normalCalls, runCtx)) {
                         yield evt;
@@ -1317,3 +1438,16 @@ function parseUpdatePlanArgs(argsStr) {
             : parsed.blocked_on,
     };
 }
+/** R3-1: parse the `submit_workflow_nodes` tool arguments (`{ nodes: WorkflowNodeSpec[] }`). Node
+ *  shapes are trusted structurally here; the kernel validates them (dep range, quarantine, quota) on
+ *  append. A malformed payload yields no nodes rather than throwing. */
+function parseSubmitWorkflowNodesArgs(argsStr) {
+    let parsed = {};
+    try {
+        parsed = JSON.parse(argsStr);
+    }
+    catch {
+        // Ignore parse error → no nodes submitted.
+    }
+    return Array.isArray(parsed.nodes) ? parsed.nodes : [];
+}

package/dist/runtime/session-log.d.ts

@@ -243,6 +243,13 @@ export type SessionEvent = {
     primitive?: KernelPrimitive;
     agent_id: string;
     termination: string;
+} | {
+    kind: "workflow_nodes_submitted";
+    turn: number;
+    category?: KernelEventCategory;
+    primitive?: KernelPrimitive;
+    /** Kernel-shape (snake_case) submitted node specs — persisted so resume can re-apply them. */
+    nodes: Record<string, unknown>[];
 } | {
     kind: "workflow_batch_spawned";
     turn: number;

package/dist/runtime/session-repair.d.ts

@@ -58,3 +58,17 @@ export declare function recoverCompletedWorkflowNodes(events: Array<{
     seq: number;
     event: SessionEvent;
 }>): string[];
+/** R3-1: build workflow_nodes_submitted for persistence after a runtime submission, so resume can
+ *  re-apply it. `nodes` is the kernel-shape (snake_case) submitted node array. */
+export declare function buildWorkflowNodesSubmittedEvent(input: {
+    turn: number;
+    nodes: Record<string, unknown>[];
+}): Extract<SessionEvent, {
+    kind: "workflow_nodes_submitted";
+}>;
+/** R3-1: recover the runtime submission batches (in order) from a session event stream, to rebuild
+ *  `resumed_submissions` for resumeWorkflow so dynamically-appended nodes are reconstructed. */
+export declare function recoverSubmittedWorkflowNodes(events: Array<{
+    seq: number;
+    event: SessionEvent;
+}>): Record<string, unknown>[][];

package/dist/runtime/session-repair.js

@@ -76,3 +76,18 @@ export function recoverCompletedWorkflowNodes(events) {
     }
     return completed;
 }
+/** R3-1: build workflow_nodes_submitted for persistence after a runtime submission, so resume can
+ *  re-apply it. `nodes` is the kernel-shape (snake_case) submitted node array. */
+export function buildWorkflowNodesSubmittedEvent(input) {
+    return { kind: "workflow_nodes_submitted", turn: input.turn, nodes: input.nodes };
+}
+/** R3-1: recover the runtime submission batches (in order) from a session event stream, to rebuild
+ *  `resumed_submissions` for resumeWorkflow so dynamically-appended nodes are reconstructed. */
+export function recoverSubmittedWorkflowNodes(events) {
+    const submissions = [];
+    for (const { event } of events) {
+        if (event.kind === "workflow_nodes_submitted")
+            submissions.push(event.nodes);
+    }
+    return submissions;
+}

package/dist/runtime/sub-agent-orchestrator.js

@@ -74,15 +74,24 @@ export class SubAgentOrchestrator {
                     totalTokensUsed: outcome.totalTokens,
                     ...(outcome.result ? { finalMessage: { role: "assistant", content: outcome.result, toolCalls: [] } } : {}),
                 },
+                // R3-1: surface nodes the agent submitted under the harness so `runWorkflow` appends them.
+                ...(outcome.submittedNodes?.length ? { submittedNodes: outcome.submittedNodes } : {}),
             };
         }
         let done;
         let finalText = "";
+        // R3-1: collect any nodes this node's agent submitted via the `submit_workflow_nodes` tool (the
+        // runner surfaces them as `workflow_nodes_submitted` because the workflow lives in the parent
+        // kernel, not this child's). `runWorkflow` sends them to the parent kernel.
+        const submittedNodes = [];
         for await (const evt of this.stream(ctx)) {
             if (evt.type === "text_delta")
                 finalText += evt.delta;
             if (evt.type === "done")
                 done = evt;
+            if (evt.type === "workflow_nodes_submitted") {
+                submittedNodes.push(...evt.nodes);
+            }
         }
         const loopResult = {
             termination: terminationFromStatus(done?.status ?? "error"),
@@ -90,7 +99,11 @@ export class SubAgentOrchestrator {
             totalTokensUsed: done?.totalTokens ?? 0,
             ...(finalText ? { finalMessage: { role: "assistant", content: finalText, toolCalls: [] } } : {}),
         };
-        return { agentId: ctx.spec.identity.agentId, result: loopResult };
+        return {
+            agentId: ctx.spec.identity.agentId,
+            result: loopResult,
+            ...(submittedNodes.length ? { submittedNodes } : {}),
+        };
     }
 }
 export const defaultSubAgentOrchestrator = new SubAgentOrchestrator();

package/dist/types/agent.d.ts

@@ -1,4 +1,4 @@
-import type { Message } from "../types.js";
+import type { Message, ToolSchema } from "../types.js";
 export type KernelAgentRole = "explore" | "plan" | "implement" | "verify" | "custom";
 export type AgentIsolation = "shared" | "read_only" | "worktree" | "remote";
 export type ContextInheritance = "none" | "system_only" | "full";
@@ -52,6 +52,11 @@ export interface LoopResult {
 export interface SubAgentResult {
     agentId: string;
     result: LoopResult;
+    /** R3-1: nodes this node's agent asked to append to the parent workflow DAG (via the
+     *  `submit_workflow_nodes` tool). Surfaced by the orchestrator; the `runWorkflow` driver sends
+     *  them to the parent kernel before this node's completion. SDK-internal — not sent over the wire
+     *  on the kernel `SubAgentResult` (see `subAgentResultToKernel`). */
+    submittedNodes?: WorkflowNodeSpec[];
 }
 export interface MilestoneCheckResult {
     phaseId: string;
@@ -92,6 +97,12 @@ export interface WorkflowNodeSpec {
     modelHint?: string;
     /** W3: `quarantined` nodes read untrusted content and must run without privileges. */
     trust?: NodeTrust;
+    /** G3: JSON Schema the node's output must conform to. The kernel carries it to the spawn
+     *  descriptor; the runner instructs the agent and validates + retries once on mismatch. */
+    outputSchema?: Record<string, unknown>;
+    /** G2: make this a deterministic *reduce* node — it runs no LLM agent. The runner routes it to the
+     *  registered reducer of this name, over its `dependsOn` nodes' outputs (dedupe / filter / merge). */
+    reducer?: string;
     /** Indices of nodes this node depends on. */
     dependsOn?: number[];
 }
@@ -109,9 +120,40 @@ export interface WorkflowSpawnInfo {
     model_hint?: string;
     /** W3 trust level: `"trusted"` | `"quarantined"`. */
     trust?: string;
+    /** G3: JSON Schema the node's output must conform to (carried verbatim from the spec). */
+    output_schema?: Record<string, unknown>;
+    /** G2: for a reduce node, the name of the registered host function to run (no LLM). */
+    reducer?: string;
+    /** G2: the dependency agent ids whose outputs a reduce node consumes. */
+    input_agent_ids?: string[];
 }
+/** G4 budget-as-signal: the workflow's remaining headroom under the active quota, carried on the
+ *  `workflow_batch_spawned` observation so a coordinator node can scale its next submission. */
+export interface WorkflowBudget {
+    nodes_used: number;
+    nodes_max?: number;
+    nodes_remaining?: number;
+    running_subagents: number;
+    max_concurrent_subagents?: number;
+    concurrency_remaining?: number;
+}
+/** G4: a concise, human-readable budget note appended to a coordinator node's goal, so its agent can
+ *  size a `submit_workflow_nodes` batch to what is actually available. Returns "" when nothing is
+ *  bounded (no quota ⇒ no signal). */
+export declare function workflowBudgetNote(budget: WorkflowBudget | undefined): string;
+/** Map one host `WorkflowNodeSpec` to its snake_case kernel JSON. Shared by `load_workflow` (the
+ *  whole spec) and `submit_workflow_nodes` (R3-1 runtime append) so the two encodings never drift. */
+export declare function workflowNodeSpecToKernel(n: WorkflowNodeSpec): Record<string, unknown>;
 /** Map a host `WorkflowSpec` to the snake_case kernel JSON (`load_workflow.spec`). */
 export declare function workflowSpecToKernel(spec: WorkflowSpec): Record<string, unknown>;
+/** R3-1: map a batch of host nodes to the `submit_workflow_nodes` kernel event body. G1: pass
+ *  `submitterAgentId` (the node that requested the append) so the kernel can enforce no-privilege-
+ *  escalation — a quarantined submitter's nodes are coerced to quarantined. Omitted ⇒ no coercion. */
+export declare function submitWorkflowNodesToKernel(nodes: WorkflowNodeSpec[], submitterAgentId?: string): Record<string, unknown>;
+/** R3-1: the tool a workflow-coordinator node's agent calls to append work to the running DAG
+ *  (true loop-until-done / dynamic fan-out). Give it to nodes meant to fan out; the runner intercepts
+ *  the call and routes the nodes to the parent kernel (the child's own kernel holds no workflow). */
+export declare const submitWorkflowNodesTool: ToolSchema;
 /** Build a sub-agent run spec for a kernel-generated workflow node. */
 export declare function workflowNodeToSpec(node: WorkflowSpawnInfo, parentSessionId: string): AgentRunSpec;
 /** Build the host manifest for a kernel-generated workflow node. */

package/dist/types/agent.js

@@ -94,29 +94,116 @@ export function milestoneCheckPass(phaseId) {
 export function milestoneCheckFail(phaseId, reason) {
     return { phaseId, passed: false, reason };
 }
+/** G4: a concise, human-readable budget note appended to a coordinator node's goal, so its agent can
+ *  size a `submit_workflow_nodes` batch to what is actually available. Returns "" when nothing is
+ *  bounded (no quota ⇒ no signal). */
+export function workflowBudgetNote(budget) {
+    if (!budget)
+        return "";
+    const parts = [];
+    if (budget.nodes_remaining != null && budget.nodes_max != null) {
+        parts.push(`nodes ${budget.nodes_used}/${budget.nodes_max} used, ${budget.nodes_remaining} remaining`);
+    }
+    if (budget.concurrency_remaining != null && budget.max_concurrent_subagents != null) {
+        parts.push(`concurrency ${budget.running_subagents}/${budget.max_concurrent_subagents} running, ${budget.concurrency_remaining} free`);
+    }
+    if (parts.length === 0)
+        return "";
+    return (`[workflow budget] ${parts.join(" · ")}. ` +
+        "If you submit more workflow nodes, keep the batch within the remaining node budget.");
+}
+/** Map one host `WorkflowNodeSpec` to its snake_case kernel JSON. Shared by `load_workflow` (the
+ *  whole spec) and `submit_workflow_nodes` (R3-1 runtime append) so the two encodings never drift. */
+export function workflowNodeSpecToKernel(n) {
+    const task = typeof n.task === "string" ? { goal: n.task } : n.task;
+    return {
+        task: {
+            goal: task.goal,
+            // `criteria` is required by the kernel's RuntimeTask serde (no default).
+            criteria: task.criteria ?? [],
+            ...(task.lane ? { lane: task.lane } : {}),
+        },
+        role: n.role,
+        // role/isolation/context_inheritance have no serde default in the kernel — always emit.
+        isolation: n.isolation ?? "shared",
+        context_inheritance: n.contextInheritance ?? "none",
+        ...(n.modelHint ? { model_hint: n.modelHint } : {}),
+        ...(n.trust && n.trust !== "trusted" ? { trust: n.trust } : {}),
+        ...(n.outputSchema ? { output_schema: n.outputSchema } : {}),
+        // G2: a reducer name lowers to the kernel's `NodeKind::Reduce` (serde-tagged by `type`).
+        ...(n.reducer ? { kind: { type: "reduce", reducer: n.reducer } } : {}),
+        ...(n.dependsOn && n.dependsOn.length ? { depends_on: n.dependsOn } : {}),
+    };
+}
 /** Map a host `WorkflowSpec` to the snake_case kernel JSON (`load_workflow.spec`). */
 export function workflowSpecToKernel(spec) {
+    return { nodes: spec.nodes.map(workflowNodeSpecToKernel) };
+}
+/** R3-1: map a batch of host nodes to the `submit_workflow_nodes` kernel event body. G1: pass
+ *  `submitterAgentId` (the node that requested the append) so the kernel can enforce no-privilege-
+ *  escalation — a quarantined submitter's nodes are coerced to quarantined. Omitted ⇒ no coercion. */
+export function submitWorkflowNodesToKernel(nodes, submitterAgentId) {
     return {
-        nodes: spec.nodes.map(n => {
-            const task = typeof n.task === "string" ? { goal: n.task } : n.task;
-            return {
-                task: {
-                    goal: task.goal,
-                    // `criteria` is required by the kernel's RuntimeTask serde (no default).
-                    criteria: task.criteria ?? [],
-                    ...(task.lane ? { lane: task.lane } : {}),
-                },
-                role: n.role,
-                // role/isolation/context_inheritance have no serde default in the kernel — always emit.
-                isolation: n.isolation ?? "shared",
-                context_inheritance: n.contextInheritance ?? "none",
-                ...(n.modelHint ? { model_hint: n.modelHint } : {}),
-                ...(n.trust && n.trust !== "trusted" ? { trust: n.trust } : {}),
-                ...(n.dependsOn && n.dependsOn.length ? { depends_on: n.dependsOn } : {}),
-            };
-        }),
+        kind: "submit_workflow_nodes",
+        nodes: nodes.map(workflowNodeSpecToKernel),
+        ...(submitterAgentId ? { submitter_agent_id: submitterAgentId } : {}),
     };
 }
+/** R3-1: the tool a workflow-coordinator node's agent calls to append work to the running DAG
+ *  (true loop-until-done / dynamic fan-out). Give it to nodes meant to fan out; the runner intercepts
+ *  the call and routes the nodes to the parent kernel (the child's own kernel holds no workflow). */
+export const submitWorkflowNodesTool = {
+    name: "submit_workflow_nodes",
+    description: "Append new nodes to the running workflow DAG (dynamic fan-out / loop-until-done). Each node " +
+        "spawns as a gated sub-agent. Use when you discover more work that should run as its own node.",
+    parameters: JSON.stringify({
+        type: "object",
+        properties: {
+            nodes: {
+                type: "array",
+                description: "Workflow nodes to append; each runs as a gated sub-agent.",
+                items: {
+                    type: "object",
+                    properties: {
+                        task: {
+                            description: "The node's goal: a string, or an object { goal, criteria?, lane? }.",
+                            oneOf: [
+                                { type: "string" },
+                                {
+                                    type: "object",
+                                    properties: {
+                                        goal: { type: "string" },
+                                        criteria: { type: "array", items: { type: "string" } },
+                                    },
+                                    required: ["goal"],
+                                },
+                            ],
+                        },
+                        role: { type: "string", enum: ["explore", "plan", "implement", "verify", "custom"] },
+                        isolation: { type: "string", enum: ["shared", "read_only", "worktree", "remote"] },
+                        contextInheritance: { type: "string", enum: ["none", "system_only", "full"] },
+                        trust: { type: "string", enum: ["trusted", "quarantined"] },
+                        outputSchema: {
+                            type: "object",
+                            description: "Optional JSON Schema the node's output must conform to (validated + retried SDK-side).",
+                        },
+                        reducer: {
+                            type: "string",
+                            description: "Make this a deterministic reduce node (no LLM); names a registered reducer.",
+                        },
+                        dependsOn: {
+                            type: "array",
+                            items: { type: "integer" },
+                            description: "Batch-relative, backward-only dependency indices within this submission.",
+                        },
+                    },
+                    required: ["task", "role"],
+                },
+            },
+        },
+        required: ["nodes"],
+    }),
+};
 /** Build a sub-agent run spec for a kernel-generated workflow node. */
 export function workflowNodeToSpec(node, parentSessionId) {
     return {

package/dist/types.d.ts

@@ -1,3 +1,4 @@
+import type { WorkflowNodeSpec } from "./types/agent.js";
 export interface TextPart {
     type: "text";
     text: string;
@@ -116,6 +117,13 @@ export interface ToolResultEvent extends StreamEvent {
     isFatal?: boolean;
     errorKind?: ToolErrorKind;
 }
+/** R3-1: a workflow node's agent called the `submit_workflow_nodes` tool. The runner intercepts it
+ *  (it cannot apply to the child's own kernel — the workflow lives in the parent) and surfaces the
+ *  requested nodes as this event; the `runWorkflow` driver sends them to the parent kernel. */
+export interface WorkflowNodesSubmittedEvent extends StreamEvent {
+    type: "workflow_nodes_submitted";
+    nodes: WorkflowNodeSpec[];
+}
 export interface DoneEvent extends StreamEvent {
     type: "done";
     iterations: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepstrike/sdk",
-  "version": "0.2.9",
+  "version": "0.2.11",
   "description": "DeepStrike Node.js SDK",
   "type": "module",
   "main": "dist/index.js",
@@ -20,7 +20,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.99.0",
-    "@deepstrike/core": "0.2.9",
+    "@deepstrike/core": "0.2.11",
     "@google/generative-ai": "^0.24.1",
     "openai": "^5.23.2"
   },