@deepstrike/wasm 0.2.15 → 0.2.17

package/dist/index.d.ts

@@ -4,7 +4,8 @@ export { FilteredExecutionPlane } from "./runtime/filtered-plane.js";
 export { SubAgentOrchestrator, defaultSubAgentOrchestrator, spawnStandalone } from "./runtime/sub-agent-orchestrator.js";
 export type { SubAgentRunContext } from "./runtime/sub-agent-orchestrator.js";
 export type { AgentCapabilityFilter, AgentIdentity, AgentIsolation, AgentRunSpec, AgentProcessChangedObservation, ContextInheritance, KernelAgentRole, LoopResult, MilestoneCheckResult, MilestoneContract, MilestonePhase, MilestonePolicy, SubAgentResult, TerminationReason, WorkflowSpec, WorkflowNodeSpec, WorkflowTaskSpec, WorkflowSpawnInfo, } from "./runtime/types/agent.js";
-export { workflowSpecToKernel, workflowNodeSpecToKernel, submitWorkflowNodesToKernel, submitWorkflowNodesTool, fanoutSynthesize, generateAndFilter, verifyRules } from "./runtime/types/agent.js";
+export { workflowSpecToKernel, workflowNodeSpecToKernel, submitWorkflowNodesToKernel, submitWorkflowToKernel, submitWorkflowNodesTool, startWorkflowTool, fanoutSynthesize, generateAndFilter, verifyRules } from "./runtime/types/agent.js";
+export { loopInstruction, classifyInstruction, judgeGoal, extractLoopContinue, extractClassifyBranch, extractJudgeWinner, } from "./runtime/workflow-control-flow.js";
 export { Governance } from "./governance.js";
 export type { GovernanceVerdict } from "./governance.js";
 export { AnthropicProvider } from "./providers/anthropic.js";

package/dist/index.js

@@ -1,7 +1,8 @@
 export { RuntimeRunner, collectText, InMemorySessionLog, LocalExecutionPlane, DEFAULT_NATIVE_ATTENTION_POLICY, DEFAULT_NATIVE_GOVERNANCE_POLICY, DEFAULT_SANDBOX_POLICY, assertNativeProfile, osProfile, validateDeclarativePolicy, } from "./runtime/index.js";
 export { FilteredExecutionPlane } from "./runtime/filtered-plane.js";
 export { SubAgentOrchestrator, defaultSubAgentOrchestrator, spawnStandalone } from "./runtime/sub-agent-orchestrator.js";
-export { workflowSpecToKernel, workflowNodeSpecToKernel, submitWorkflowNodesToKernel, submitWorkflowNodesTool, fanoutSynthesize, generateAndFilter, verifyRules } from "./runtime/types/agent.js";
+export { workflowSpecToKernel, workflowNodeSpecToKernel, submitWorkflowNodesToKernel, submitWorkflowToKernel, submitWorkflowNodesTool, startWorkflowTool, fanoutSynthesize, generateAndFilter, verifyRules } from "./runtime/types/agent.js";
+export { loopInstruction, classifyInstruction, judgeGoal, extractLoopContinue, extractClassifyBranch, extractJudgeWinner, } from "./runtime/workflow-control-flow.js";
 export { Governance } from "./governance.js";
 export { AnthropicProvider } from "./providers/anthropic.js";
 export { OpenAIProvider, QwenProvider, DeepSeekProvider, MiniMaxProvider, KimiProvider } from "./providers/openai.js";

package/dist/providers/anthropic.d.ts

@@ -9,6 +9,6 @@ export declare class AnthropicProvider implements LLMProvider {
     peekProviderReplay(message: Pick<Message, "content" | "toolCalls">): ProviderReplay | undefined;
     seedProviderReplay(message: Pick<Message, "content" | "toolCalls">, replay: ProviderReplay): void;
     complete(context: RenderedContext, tools: ToolSchema[], extensions?: Record<string, unknown>): Promise<Message>;
-    stream(context: RenderedContext, tools: ToolSchema[], extensions?: Record<string, unknown>): AsyncIterable<StreamEvent>;
+    stream(context: RenderedContext, tools: ToolSchema[], extensions?: Record<string, unknown>, _state?: unknown, signal?: AbortSignal): AsyncIterable<StreamEvent>;
     private rememberNativeBlocks;
 }

package/dist/providers/anthropic.js

@@ -109,7 +109,7 @@ export class AnthropicProvider {
     async complete(context, tools, extensions) {
         return collectStreamMessage(this.stream(context, tools, extensions));
     }
-    async *stream(context, tools, extensions) {
+    async *stream(context, tools, extensions, _state, signal) {
         const systemBlocks = [];
         if (context.systemStable) {
             systemBlocks.push({ type: "text", text: context.systemStable, cache_control: { type: "ephemeral" } });
@@ -150,6 +150,7 @@ export class AnthropicProvider {
                 "anthropic-beta": "prompt-caching-2024-07-31",
             },
             body: JSON.stringify(body),
+            ...(signal ? { signal } : {}), // #2-B-ii: a preempt aborts the in-flight request at the socket.
         });
         if (!resp.ok)
             throw new Error(`Anthropic ${resp.status}: ${await resp.text()}`);

package/dist/providers/openai.d.ts

@@ -13,20 +13,20 @@ export declare class OpenAIProvider implements LLMProvider {
         };
     }[];
     complete(context: RenderedContext, tools: ToolSchema[], extensions?: Record<string, unknown>): Promise<Message>;
-    protected streamInner(context: RenderedContext, tools: ToolSchema[], extraBody: Record<string, unknown>, exposeReasoning?: boolean): AsyncIterable<StreamEvent>;
-    stream(context: RenderedContext, tools: ToolSchema[], extensions?: Record<string, unknown>): AsyncIterable<StreamEvent>;
+    protected streamInner(context: RenderedContext, tools: ToolSchema[], extraBody: Record<string, unknown>, exposeReasoning?: boolean, signal?: AbortSignal): AsyncIterable<StreamEvent>;
+    stream(context: RenderedContext, tools: ToolSchema[], extensions?: Record<string, unknown>, _state?: unknown, signal?: AbortSignal): AsyncIterable<StreamEvent>;
 }
 export declare class QwenProvider extends OpenAIProvider {
     constructor(apiKey: string, model?: string);
-    stream(context: RenderedContext, tools: ToolSchema[], extensions?: Record<string, unknown>): AsyncIterable<StreamEvent>;
+    stream(context: RenderedContext, tools: ToolSchema[], extensions?: Record<string, unknown>, _state?: unknown, signal?: AbortSignal): AsyncIterable<StreamEvent>;
 }
 export declare class DeepSeekProvider extends OpenAIProvider {
     constructor(apiKey: string, model?: string);
-    stream(context: RenderedContext, tools: ToolSchema[], extensions?: Record<string, unknown>): AsyncIterable<StreamEvent>;
+    stream(context: RenderedContext, tools: ToolSchema[], extensions?: Record<string, unknown>, _state?: unknown, signal?: AbortSignal): AsyncIterable<StreamEvent>;
 }
 export declare class MiniMaxProvider extends OpenAIProvider {
     constructor(apiKey: string, model?: string);
-    stream(context: RenderedContext, tools: ToolSchema[], extensions?: Record<string, unknown>): AsyncIterable<StreamEvent>;
+    stream(context: RenderedContext, tools: ToolSchema[], extensions?: Record<string, unknown>, _state?: unknown, signal?: AbortSignal): AsyncIterable<StreamEvent>;
 }
 export declare class KimiProvider extends OpenAIProvider {
     constructor(apiKey: string, model?: string);

package/dist/providers/openai.js

@@ -17,7 +17,7 @@ export class OpenAIProvider {
     async complete(context, tools, extensions) {
         return collectStreamMessage(this.stream(context, tools, extensions));
     }
-    async *streamInner(context, tools, extraBody, exposeReasoning = false) {
+    async *streamInner(context, tools, extraBody, exposeReasoning = false, signal) {
         const body = {
             model: this.model,
             messages: toOpenAIMessages(context),
@@ -29,6 +29,7 @@ export class OpenAIProvider {
             method: "POST",
             headers: { "Authorization": `Bearer ${this.apiKey}`, "Content-Type": "application/json" },
             body: JSON.stringify(body),
+            ...(signal ? { signal } : {}), // #2-B-ii: a preempt aborts the in-flight request at the socket.
         });
         if (!resp.ok)
             throw new Error(`OpenAI ${resp.status}: ${await resp.text()}`);
@@ -79,16 +80,16 @@ export class OpenAIProvider {
             yield { type: "tool_call", id: tb.id, name: tb.name, arguments: args };
         }
     }
-    async *stream(context, tools, extensions) {
+    async *stream(context, tools, extensions, _state, signal) {
         const { expose_reasoning: _, exposeReasoning: __, ...passthrough } = extensions ?? {};
-        yield* this.streamInner(context, tools, passthrough);
+        yield* this.streamInner(context, tools, passthrough, false, signal);
     }
 }
 export class QwenProvider extends OpenAIProvider {
     constructor(apiKey, model = "qwen-max") {
         super(apiKey, model, "https://dashscope.aliyuncs.com/compatible-mode/v1");
     }
-    async *stream(context, tools, extensions) {
+    async *stream(context, tools, extensions, _state, signal) {
         const enableThinking = Boolean(extensions?.enableThinking);
         const thinkingBudget = extensions?.thinkingBudget;
         const { enableThinking: _, thinkingBudget: __, expose_reasoning: ___, exposeReasoning: ____, ...passthrough } = extensions ?? {};
@@ -96,31 +97,31 @@ export class QwenProvider extends OpenAIProvider {
             ...passthrough,
             ...(enableThinking ? { enable_thinking: true, ...(thinkingBudget ? { thinking_budget: thinkingBudget } : {}) } : {}),
         };
-        yield* this.streamInner(context, tools, extra, enableThinking);
+        yield* this.streamInner(context, tools, extra, enableThinking, signal);
     }
 }
 export class DeepSeekProvider extends OpenAIProvider {
     constructor(apiKey, model = "deepseek-chat") {
         super(apiKey, model, "https://api.deepseek.com/v1");
     }
-    async *stream(context, tools, extensions) {
+    async *stream(context, tools, extensions, _state, signal) {
         const exposeReasoning = Boolean(extensions?.exposeReasoning);
         const isReasoner = DEEPSEEK_REASONERS.has(this.model);
         const filteredTools = isReasoner ? [] : tools;
         const { exposeReasoning: _, expose_reasoning: __, ...passthrough } = extensions ?? {};
-        yield* this.streamInner(context, filteredTools, passthrough, exposeReasoning);
+        yield* this.streamInner(context, filteredTools, passthrough, exposeReasoning, signal);
     }
 }
 export class MiniMaxProvider extends OpenAIProvider {
     constructor(apiKey, model = "MiniMax-Text-01") {
         super(apiKey, model, "https://api.minimax.chat/v1");
     }
-    async *stream(context, tools, extensions) {
+    async *stream(context, tools, extensions, _state, signal) {
         const exposeReasoning = Boolean(extensions?.exposeReasoning);
         const isReasoner = MINIMAX_REASONERS.has(this.model);
         const filteredTools = isReasoner ? [] : tools;
         const { exposeReasoning: _, expose_reasoning: __, ...passthrough } = extensions ?? {};
-        yield* this.streamInner(context, filteredTools, passthrough, exposeReasoning);
+        yield* this.streamInner(context, filteredTools, passthrough, exposeReasoning, signal);
     }
 }
 export class KimiProvider extends OpenAIProvider {

package/dist/runtime/execution-plane.d.ts

@@ -18,6 +18,9 @@ export interface RunContext {
     onToolSuspend?: (event: ToolSuspendEvent) => Promise<unknown> | unknown;
     onPermissionRequest?: (event: PermissionRequestEvent) => Promise<PermissionResponse | boolean> | PermissionResponse | boolean;
     resultSpool?: LargeResultSpool;
+    /** M3/G4: working directory a tool should run in. WASM has no filesystem, so this is carried for
+     *  tool-ABI parity with Node/Python rather than consumed by a worktree plane. */
+    cwd?: string;
 }
 export interface ExecutionPlane {
     register(...tools: RegisteredTool[]): this;

package/dist/runtime/execution-plane.js

@@ -73,7 +73,9 @@ export class LocalExecutionPlane {
             }
             try {
                 const args = JSON.parse(call.arguments || "{}");
-                const output = await registered.execute(args);
+                // M3/G4: pass the run context for tool-ABI parity with Node/Python (`RunContext` is
+                // structurally assignable to the tool's `ToolExecContext`).
+                const output = await registered.execute(args, ctx);
                 yield { type: "tool_result", callId: call.id, name: call.name, content: String(output), isError: false };
             }
             catch (err) {

package/dist/runtime/kernel-step.js

@@ -112,12 +112,19 @@ function kernelMessageToSdk(raw) {
     return message;
 }
 function renderedContextToSdk(raw) {
-    return {
+    const rawStateTurn = (raw.state_turn ?? raw.stateTurn);
+    const frozenLen = (raw.frozen_prefix_len ?? raw.frozenPrefixLen);
+    const ctx = {
         systemText: String(raw.system_text ?? raw.systemText ?? ""),
         systemStable: String(raw.system_stable ?? raw.systemStable ?? ""),
         systemKnowledge: String(raw.system_knowledge ?? raw.systemKnowledge ?? ""),
         turns: (raw.turns ?? []).map(kernelMessageToSdk),
     };
+    if (rawStateTurn)
+        ctx.stateTurn = kernelMessageToSdk(rawStateTurn);
+    if (typeof frozenLen === "number")
+        ctx.frozenPrefixLen = frozenLen;
+    return ctx;
 }
 function mapKernelAction(raw) {
     switch (raw.kind) {

package/dist/runtime/runner.d.ts

@@ -42,6 +42,12 @@ export interface MemoryPolicy {
 }
 export interface RuntimeOptions {
     provider: LLMProvider;
+    /** M1/G3 intelligence routing: resolve a per-node provider from a workflow node's `modelHint`.
+     *  Returns undefined ⇒ fall back to `provider`. Without this hook the hint is a no-op. */
+    providerFor?: (modelHint: string) => LLMProvider | undefined;
+    /** M4/G5: cumulative token cap for this run (the kernel's `max_total_tokens`); a node's `tokenBudget`
+     *  flows here for its child run. Undefined ⇒ the kernel default. */
+    maxTotalTokens?: number;
     sessionLog: SessionLog;
     executionPlane: ExecutionPlane;
     maxTokens: number;
@@ -70,6 +76,10 @@ export interface RuntimeOptions {
     onToolSuspend?: (event: ToolSuspendEvent) => Promise<unknown> | unknown;
     onPermissionRequest?: (event: PermissionRequestEvent) => Promise<PermissionResponse | boolean> | PermissionResponse | boolean;
     subAgentOrchestrator?: SubAgentOrchestrator;
+    /** M5 v2.1: marks this runner as a workflow node (child of the workflow driver). A workflow node's
+     *  `start_workflow` FLATTENS to the parent kernel; a top-level run (unset) AUTO-PIVOTS — bootstraps +
+     *  drives the authored workflow in its own kernel, then resumes the reason loop with the outcome. */
+    isWorkflowNode?: boolean;
     /** G2: custom reducers for `NodeKind::Reduce` workflow nodes, merged over the built-ins. */
     reducers?: ReducerRegistry;
     milestonePolicy?: MilestonePolicy;
@@ -88,11 +98,16 @@ export interface RuntimeOptions {
 export declare class RuntimeRunner {
     private readonly opts;
     private interrupted;
+    /** #2-B-ii: aborts the in-flight provider stream on interrupt/preempt. Recreated per `execute`. */
+    private abortController;
     private pendingObservations;
     private activeKernel;
     private currentSessionId;
     private nextArchiveStart;
     private localPageOutCache;
+    /** M5 v2.1: sub-workflow specs a top-level agent authored via `start_workflow`, awaiting auto-drive
+     *  at the next safe point (after the tool turn resolves, kernel back in Reason). */
+    private pendingAuthoredWorkflows;
     private pendingSpoolOutputs;
     constructor(opts: RuntimeOptions);
     get hostOptions(): RuntimeOptions;
@@ -140,7 +155,42 @@ export declare class RuntimeRunner {
     }): Promise<{
         completed: string[];
         failed: string[];
+        outputs: Record<string, string>;
     }>;
+    /**
+     * M5/G1: bootstrap an **agent-authored** workflow ("the model writes its own harness"). Routes the
+     * spec through the agent-reachable `Syscall::LoadWorkflow` (`submit_workflow`): with no workflow
+     * active the kernel bootstraps the DAG, else it flattens onto the running one (bootstrap-or-flatten —
+     * one kernel, one quota). The same shared driver runs the resulting batches.
+     */
+    bootstrapWorkflow(spec: WorkflowSpec, opts?: {
+        submitterAgentId?: string;
+    }): Promise<{
+        completed: string[];
+        failed: string[];
+        outputs: Record<string, string>;
+    }>;
+    /**
+     * M5 v2.1: drive the sub-workflow(s) a top-level agent authored via `start_workflow`, at the safe
+     * point (tool turn resolved → kernel in Reason). Each runs in THIS kernel (the kernel resumes the
+     * reason loop on `workflow_completed`), then the outcome is injected as a user message and a fresh
+     * `call_provider` is synthesized from the updated context (the workflow drive consumed its own
+     * kernel actions — same re-render pattern as the reactive-compact retry path).
+     */
+    private driveAuthoredWorkflows;
+    /**
+     * #2-B-ii: while a workflow batch is in flight, poll the signal source; a Critical `InterruptNow`
+     * routes through the kernel (root in `SubAgentAwait` → preempt → `AgentPreempted` + tears the
+     * `WorkflowRun` down), and we abort the matching children's in-flight LLM calls. Returns the
+     * torn-down outcome on preemption, else `null`. No-op without a signal source.
+     */
+    private monitorWorkflowPreemption;
+    /**
+     * Shared workflow driver for `runWorkflow` (host `load_workflow`) and `bootstrapWorkflow` (agent
+     * `submit_workflow`): run each kernel-emitted batch in parallel, feed completions back (appending any
+     * agent-submitted nodes first), and loop until the kernel reports the workflow complete.
+     */
+    private driveWorkflow;
     /**
      * Resume a workflow from the parent session's completed nodes.
      * Reads the session log, extracts completed workflow node agent_ids, and

package/dist/runtime/runner.js

@@ -5,27 +5,33 @@ import { peekProviderReplay, seedProviderReplayFromEvents } from "./provider-rep
 import { sanitizeReplayText } from "./replay-sanitize.js";
 import { buildLlmCompletedEvent, buildRunTerminalEvent, buildWorkflowNodeCompletedEvent, buildWorkflowNodesSubmittedEvent, recoverCompletedWorkflowNodes, recoverSubmittedWorkflowNodes, repairEventsForRecovery, } from "./session-repair.js";
 import { forceCompact, kernelAction, kernelApply, kernelMaybeAction, messageToKernelMessage, skillMetadataToKernel, toolResultToKernel, toolSchemaToKernel, } from "./kernel-step.js";
-import { agentRunSpecToKernel, findSpawnProcessObservation, milestoneCheckPass, milestoneCheckResultToKernel, spawnObservationToManifest, subAgentResultToKernel, submitWorkflowNodesToKernel, workflowBudgetNote, workflowNodeToManifest, workflowNodeToSpec, workflowSpecToKernel, } from "./types/agent.js";
+import { agentRunSpecToKernel, findSpawnProcessObservation, milestoneCheckPass, milestoneCheckResultToKernel, spawnObservationToManifest, subAgentResultToKernel, submitWorkflowNodesToKernel, submitWorkflowToKernel, workflowBudgetNote, workflowNodeToManifest, workflowNodeToSpec, workflowSpecToKernel, } from "./types/agent.js";
 import { defaultSubAgentOrchestrator } from "./sub-agent-orchestrator.js";
 import { extractJsonValue, schemaInstruction, schemaRetryInstruction, validateAgainstSchema, } from "./output-schema.js";
 import { resolveReducer } from "./reducers.js";
+import { loopInstruction, classifyInstruction, judgeGoal, extractLoopContinue, extractClassifyBranch, extractJudgeWinner, } from "./workflow-control-flow.js";
 import { kernelObservationToSessionEvent, withCategory } from "./kernel-event-log.js";
 import { assertNativeProfile } from "./os-profile.js";
 import { LargeResultSpool } from "./large-result-spool.js";
 export class RuntimeRunner {
     opts;
     interrupted = false;
+    /** #2-B-ii: aborts the in-flight provider stream on interrupt/preempt. Recreated per `execute`. */
+    abortController = null;
     pendingObservations = [];
     activeKernel = null;
     currentSessionId = null;
     nextArchiveStart = 0;
     localPageOutCache = [];
+    /** M5 v2.1: sub-workflow specs a top-level agent authored via `start_workflow`, awaiting auto-drive
+     *  at the next safe point (after the tool turn resolves, kernel back in Reason). */
+    pendingAuthoredWorkflows = [];
     pendingSpoolOutputs = new Map();
     constructor(opts) {
         this.opts = opts;
     }
     get hostOptions() { return this.opts; }
-    interrupt() { this.interrupted = true; }
+    interrupt() { this.interrupted = true; this.abortController?.abort(); }
     async *run(req) {
         const prior = req.inheritEvents ?? await this.opts.sessionLog.read(req.sessionId);
         const midRun = isMidRun(prior);
@@ -245,6 +251,7 @@ export class RuntimeRunner {
     }
     async *execute(sessionId, goal, criteria, extensions, priorEvents, resumeMidRun = false) {
         this.interrupted = false;
+        this.abortController = new AbortController();
         this.pendingObservations = [];
         this.pendingSpoolOutputs.clear();
         this.currentSessionId = sessionId;
@@ -258,6 +265,8 @@ export class RuntimeRunner {
         const runtime = new kernel.KernelRuntime({
             maxTokens: this.opts.maxTokens,
             maxTurns: effectiveMaxTurns,
+            // M4/G5: per-node token cap → child run's cumulative token budget (wasm LoopPolicy.maxTotalTokens is f64).
+            ...(this.opts.maxTotalTokens !== undefined ? { maxTotalTokens: this.opts.maxTotalTokens } : {}),
             timeoutMs: effectiveTimeoutMs !== undefined ? BigInt(effectiveTimeoutMs) : undefined,
         });
         this.activeKernel = runtime;
@@ -407,24 +416,7 @@ export class RuntimeRunner {
             if (this.opts.signalSource) {
                 const sig = await this.opts.signalSource.nextSignal();
                 if (sig) {
-                    const id = crypto.randomUUID();
-                    const source = sig.source ?? "custom";
-                    const signalType = sig.signalType ?? "event";
-                    const urgency = sig.urgency ?? "normal";
-                    const summary = String(sig.payload?.goal ?? "signal");
-                    const sigAction = kernelMaybeAction(runtime, this.pendingObservations, {
-                        kind: "signal",
-                        signal: {
-                            id,
-                            source,
-                            signal_type: signalType,
-                            urgency,
-                            summary,
-                            payload: sig.payload ?? {},
-                            ...(sig.dedupeKey ? { dedupe_key: sig.dedupeKey } : {}),
-                            timestamp_ms: Date.now(),
-                        },
-                    });
+                    const sigAction = kernelMaybeAction(runtime, this.pendingObservations, signalToKernelEvent(sig));
                     if (sigAction)
                         action = sigAction;
                 }
@@ -432,6 +424,12 @@ export class RuntimeRunner {
             if (runtime.isTerminal())
                 break;
             if (action.kind === "call_provider") {
+                // M5 v2.1: top-level auto-pivot at the safe point (kernel in Reason, not suspended). Loop-top
+                // placement catches every path to `call_provider` (incl. post-approval-resume), so a queued
+                // authored spec is never stranded. Drains the queue; fires once per authored batch.
+                if (this.pendingAuthoredWorkflows.length > 0) {
+                    action = await this.driveAuthoredWorkflows(runtime, action);
+                }
                 const finalToolCalls = [];
                 let finalText = "";
                 const context = action.context;
@@ -440,8 +438,12 @@ export class RuntimeRunner {
                 let turnInputTokens = 0;
                 let turnOutputTokens = 0;
                 let shouldRetry = false;
+                const abortSignal = this.abortController?.signal;
                 try {
-                    for await (const evt of this.opts.provider.stream(context, tools, Object.keys(ext).length ? ext : undefined, providerState)) {
+                    for await (const evt of this.opts.provider.stream(context, tools, Object.keys(ext).length ? ext : undefined, providerState, abortSignal)) {
+                        // #2-B-ii: a preempting interrupt fires abortController — stop consuming the live stream.
+                        if (abortSignal?.aborted)
+                            break;
                         if (evt.type === "usage") {
                             const usageEvt = evt;
                             turnTokens = usageEvt.totalTokens;
@@ -459,6 +461,10 @@ export class RuntimeRunner {
                     }
                 }
                 catch (err) {
+                    // #2-B-ii: an aborted in-flight request surfaces as an AbortError — treat as an interrupt.
+                    if (abortSignal?.aborted) {
+                        this.interrupted = true;
+                    }
                     const errMsg = String(err).toLowerCase();
                     if ((errMsg.includes("413") || errMsg.includes("too long") || errMsg.includes("context length exceeded") || errMsg.includes("context_length_exceeded")) &&
                         !hasAttemptedReactiveCompact) {
@@ -474,6 +480,11 @@ export class RuntimeRunner {
                         break;
                     }
                 }
+                // #2-B-ii: stream aborted (preempt/interrupt) via the break path — end the turn now.
+                if (abortSignal?.aborted) {
+                    action = kernelAction(runtime, this.pendingObservations, { kind: "timeout" });
+                    break;
+                }
                 if (shouldRetry) {
                     action = {
                         kind: "call_provider",
@@ -532,10 +543,26 @@ export class RuntimeRunner {
                 // R3-1: intercept `submit_workflow_nodes` — it can't apply to this runner's kernel (when this
                 // runner is a workflow node, the workflow lives in the parent). Surface the nodes as an event;
                 // the orchestrator collects them and `runWorkflow` sends them to the parent kernel.
-                const submitCalls = allCalls.filter(c => c.name === "submit_workflow_nodes");
-                const normalCalls = allCalls.filter(c => c.name !== "submit_workflow_nodes");
+                // M5 v1: `start_workflow` (author a sub-workflow) flattens to the same append path.
+                const submitCalls = allCalls.filter(c => c.name === "submit_workflow_nodes" || c.name === "start_workflow");
+                const normalCalls = allCalls.filter(c => c.name !== "submit_workflow_nodes" && c.name !== "start_workflow");
                 for (const call of submitCalls) {
-                    const nodes = parseSubmitWorkflowNodesArgs(call.arguments);
+                    // M5 v2.1: a TOP-LEVEL agent authoring a whole sub-workflow via `start_workflow` — record the
+                    // spec and AUTO-PIVOT once this tool turn resolves. A workflow-NODE's `start_workflow` (and
+                    // every `submit_workflow_nodes`) instead FLATTENS for the parent `runWorkflow` to append.
+                    if (call.name === "start_workflow" && !this.opts.isWorkflowNode) {
+                        const spec = parseStartWorkflowSpec(call.arguments);
+                        if (spec) {
+                            this.pendingAuthoredWorkflows.push(spec);
+                            const out = "workflow authored; executing now";
+                            toolResults.push({ callId: call.id, output: out, isError: false });
+                            yield { type: "tool_result", callId: call.id, content: out, isError: false };
+                            continue;
+                        }
+                    }
+                    const nodes = call.name === "start_workflow"
+                        ? parseStartWorkflowArgs(call.arguments)
+                        : parseSubmitWorkflowNodesArgs(call.arguments);
                     yield { type: "workflow_nodes_submitted", nodes };
                     toolResults.push({ callId: call.id, output: "submitted", isError: false });
                     yield { type: "tool_result", callId: call.id, content: "submitted", isError: false };
@@ -725,7 +752,7 @@ export class RuntimeRunner {
      * fed back on mismatch. If it still does not conform, the node is failed with the validation
      * reason (an `Error`-terminated result fails the node in-kernel, starving its dependents).
      */
-    async runWorkflowNode(node, parentSessionId, orchestrator, budget, outputs) {
+    async runWorkflowNode(node, parentSessionId, orchestrator, budget, outputs, abortSignal) {
         // G2: a reduce node runs no LLM — execute the registered pure function over its dependency
         // outputs and feed the result back as an ordinary completion. Deterministic; no agent burned.
         if (node.reducer) {
@@ -742,7 +769,40 @@ export class RuntimeRunner {
             spec: { ...baseSpec, goal: withBudget(goal) },
             manifest,
             sessionLog: this.opts.sessionLog,
+            // M5 v2.1: this child IS a workflow node — its `start_workflow` flattens to this kernel.
+            isWorkflowNode: true,
+            // #2-B-ii: the per-node abort signal the driver fires when the kernel preempts this node.
+            ...(abortSignal ? { abortSignal } : {}),
         });
+        const textOf = (r) => {
+            const c = r.result.finalMessage?.content;
+            return typeof c === "string" ? c : c != null ? JSON.stringify(c) : "";
+        };
+        const withSignal = (r, patch) => ({ ...r, result: { ...r.result, ...patch } });
+        // A#2 tournament judge: compare two entrants' produced outputs rather than running the node's own
+        // goal. Look up both candidates, judge over the controller's criterion, and report the winner's id.
+        if (node.judge_match) {
+            const out = outputs ?? new Map();
+            const left = out.get(node.judge_match.left) ?? "";
+            const right = out.get(node.judge_match.right) ?? "";
+            const result = await orchestrator.run(mkCtx(judgeGoal(baseSpec.goal, left, right)));
+            const winner = extractJudgeWinner(textOf(result));
+            const winnerId = winner === "right" ? node.judge_match.right : node.judge_match.left;
+            return withSignal(result, { tournamentWinner: winnerId });
+        }
+        // A#2 v2 loop iteration: run the increment, then extract a stop signal. No signal ⇒ run to cap.
+        if (node.loop_max_iters != null) {
+            const result = await orchestrator.run(mkCtx(`${baseSpec.goal}\n\n${loopInstruction(node.loop_max_iters)}`));
+            const cont = extractLoopContinue(textOf(result));
+            return cont === undefined ? result : withSignal(result, { loopContinue: cont });
+        }
+        // A#2 classify: run the classifier, then extract the chosen branch label (kernel prunes the rest).
+        if (node.classify_labels && node.classify_labels.length) {
+            const labels = node.classify_labels;
+            const result = await orchestrator.run(mkCtx(`${baseSpec.goal}\n\n${classifyInstruction(labels)}`));
+            const branch = extractClassifyBranch(textOf(result), labels);
+            return branch === undefined ? result : withSignal(result, { classifyBranch: branch });
+        }
         const schema = node.output_schema;
         if (!schema)
             return orchestrator.run(mkCtx(baseSpec.goal));
@@ -805,7 +865,6 @@ export class RuntimeRunner {
         }
         const parentSessionId = this.currentSessionId;
         const runtime = this.activeKernel;
-        const orchestrator = this.opts.subAgentOrchestrator ?? defaultSubAgentOrchestrator;
         const observations = kernelApply(runtime, this.pendingObservations, {
             kind: "load_workflow",
             spec: workflowSpecToKernel(spec),
@@ -815,22 +874,103 @@ export class RuntimeRunner {
             // R3-1: re-apply recorded runtime submissions so dynamically-appended nodes are reconstructed.
             ...(opts?.resumedSubmissions && opts.resumedSubmissions.length ? { resumed_submissions: opts.resumedSubmissions } : {}),
         });
+        return this.driveWorkflow(observations, parentSessionId, runtime);
+    }
+    /**
+     * M5/G1: bootstrap an **agent-authored** workflow ("the model writes its own harness"). Routes the
+     * spec through the agent-reachable `Syscall::LoadWorkflow` (`submit_workflow`): with no workflow
+     * active the kernel bootstraps the DAG, else it flattens onto the running one (bootstrap-or-flatten —
+     * one kernel, one quota). The same shared driver runs the resulting batches.
+     */
+    async bootstrapWorkflow(spec, opts) {
+        if (!this.activeKernel || !this.currentSessionId) {
+            throw new Error("bootstrapWorkflow requires an active parent run");
+        }
+        const parentSessionId = this.currentSessionId;
+        const runtime = this.activeKernel;
+        const observations = kernelApply(runtime, this.pendingObservations, submitWorkflowToKernel(spec, parentSessionId, opts?.submitterAgentId));
+        return this.driveWorkflow(observations, parentSessionId, runtime);
+    }
+    /**
+     * M5 v2.1: drive the sub-workflow(s) a top-level agent authored via `start_workflow`, at the safe
+     * point (tool turn resolved → kernel in Reason). Each runs in THIS kernel (the kernel resumes the
+     * reason loop on `workflow_completed`), then the outcome is injected as a user message and a fresh
+     * `call_provider` is synthesized from the updated context (the workflow drive consumed its own
+     * kernel actions — same re-render pattern as the reactive-compact retry path).
+     */
+    async driveAuthoredWorkflows(runtime, action) {
+        const specs = this.pendingAuthoredWorkflows;
+        this.pendingAuthoredWorkflows = [];
+        for (const spec of specs) {
+            const outcome = await this.bootstrapWorkflow(spec);
+            kernelApply(runtime, this.pendingObservations, {
+                kind: "add_history_message",
+                message: messageToKernelMessage({ role: "user", content: authoredWorkflowOutcomeNote(outcome) }),
+            });
+        }
+        return { kind: "call_provider", context: runtime.render(), tools: action.tools };
+    }
+    /**
+     * #2-B-ii: while a workflow batch is in flight, poll the signal source; a Critical `InterruptNow`
+     * routes through the kernel (root in `SubAgentAwait` → preempt → `AgentPreempted` + tears the
+     * `WorkflowRun` down), and we abort the matching children's in-flight LLM calls. Returns the
+     * torn-down outcome on preemption, else `null`. No-op without a signal source.
+     */
+    async monitorWorkflowPreemption(runtime, controllers, batchState) {
+        const source = this.opts.signalSource;
+        if (!source)
+            return null;
+        while (!batchState.settled) {
+            const sig = await source.nextSignal();
+            if (batchState.settled)
+                break;
+            if (!sig) {
+                await new Promise(resolve => setTimeout(resolve, 5));
+                continue;
+            }
+            const obs = kernelApply(runtime, this.pendingObservations, signalToKernelEvent(sig));
+            const preempted = obs.find(o => o.kind === "agent_preempted");
+            if (preempted) {
+                for (const id of preempted.agent_ids ?? [])
+                    controllers.get(id)?.abort();
+                const wc = obs.find(o => o.kind === "workflow_completed");
+                return { completed: wc?.completed ?? [], failed: wc?.failed ?? [] };
+            }
+        }
+        return null;
+    }
+    /**
+     * Shared workflow driver for `runWorkflow` (host `load_workflow`) and `bootstrapWorkflow` (agent
+     * `submit_workflow`): run each kernel-emitted batch in parallel, feed completions back (appending any
+     * agent-submitted nodes first), and loop until the kernel reports the workflow complete.
+     */
+    async driveWorkflow(initial, parentSessionId, runtime) {
+        const observations = initial;
+        const orchestrator = this.opts.subAgentOrchestrator ?? defaultSubAgentOrchestrator;
         const collectNodes = (obs) => obs.find(o => o.kind === "workflow_batch_spawned")?.nodes ?? [];
         // G4: the batch observation carries the workflow's remaining budget; track the latest.
         const collectBudget = (obs) => obs.find(o => o.kind === "workflow_batch_spawned")?.budget;
         const findDone = (obs) => obs.find(o => o.kind === "workflow_completed");
         let done = findDone(observations);
         if (done)
-            return { completed: done.completed ?? [], failed: done.failed ?? [] };
+            return { completed: done.completed ?? [], failed: done.failed ?? [], outputs: {} };
         let nodes = collectNodes(observations);
         let budget = collectBudget(observations);
         // G2: each completed node's output, keyed by agent id — a reduce node reads its deps' outputs.
         const outputs = new Map();
         for (;;) {
             if (nodes.length === 0)
-                return { completed: [], failed: [] };
+                return { completed: [], failed: [], outputs: Object.fromEntries(outputs) };
             const roundBudget = budget;
-            const results = await Promise.all(nodes.map(node => this.runWorkflowNode(node, parentSessionId, orchestrator, roundBudget, outputs)));
+            // #2-B-ii: per-node abort controllers + a concurrent preemption monitor (see node runner).
+            const controllers = new Map(nodes.map(n => [n.agent_id, new AbortController()]));
+            const batchState = { settled: false };
+            const monitor = this.monitorWorkflowPreemption(runtime, controllers, batchState);
+            const results = await Promise.all(nodes.map(node => this.runWorkflowNode(node, parentSessionId, orchestrator, roundBudget, outputs, controllers.get(node.agent_id)?.signal)));
+            batchState.settled = true;
+            const preempted = await monitor;
+            if (preempted)
+                return { ...preempted, outputs: Object.fromEntries(outputs) };
             // Accumulate next-batch nodes across feeds (per-node unblock can spawn dependents per feed).
             const nextNodes = [];
             done = undefined;
@@ -871,7 +1011,7 @@ export class RuntimeRunner {
                 }));
             }
             if (done && nextNodes.length === 0) {
-                return { completed: done.completed ?? [], failed: done.failed ?? [] };
+                return { completed: done.completed ?? [], failed: done.failed ?? [], outputs: Object.fromEntries(outputs) };
             }
             nodes = nextNodes;
         }
@@ -1090,3 +1230,61 @@ function parseSubmitWorkflowNodesArgs(argsStr) {
     }
     return Array.isArray(parsed.nodes) ? parsed.nodes : [];
 }
+/** M5 v1: parse `start_workflow` tool args (`{ spec: { nodes: WorkflowNodeSpec[] } }`) into the
+ *  spec's node batch — flattened onto the running workflow via the same append path. */
+function parseStartWorkflowArgs(argsStr) {
+    let parsed = {};
+    try {
+        parsed = JSON.parse(argsStr);
+    }
+    catch {
+        // Ignore parse error → no nodes.
+    }
+    const spec = parsed.spec;
+    return Array.isArray(spec?.nodes) ? spec.nodes : [];
+}
+/** M5 v2.1: parse the full `WorkflowSpec` from a top-level `start_workflow` call for the auto-pivot
+ *  drive. Returns `undefined` on a malformed / empty payload (caller falls back to the flatten path). */
+function parseStartWorkflowSpec(argsStr) {
+    try {
+        const parsed = JSON.parse(argsStr);
+        if (Array.isArray(parsed.spec?.nodes) && parsed.spec.nodes.length > 0) {
+            return { nodes: parsed.spec.nodes };
+        }
+    }
+    catch {
+        // Ignore parse error → undefined (fall back to flatten).
+    }
+    return undefined;
+}
+/** M5 v2.1: render an authored-workflow outcome into a user-message note injected back into the
+ *  agent's context, so its next turn continues with the sub-workflow's results in view. */
+function authoredWorkflowOutcomeNote(outcome) {
+    const lines = [
+        `[authored workflow result] ${outcome.completed.length} node(s) completed` +
+            (outcome.failed.length ? `, ${outcome.failed.length} failed` : "") + ".",
+    ];
+    for (const id of outcome.completed) {
+        const out = outcome.outputs[id];
+        if (out)
+            lines.push(`- ${id}: ${out.length > 500 ? out.slice(0, 500) + "…" : out}`);
+    }
+    return lines.join("\n");
+}
+/** Lower a host `RuntimeSignal` to the kernel's snake_case `signal` input event. Shared by the main
+ *  loop's per-turn poll and #2-B-ii's workflow-batch preemption monitor (so the two never drift). */
+function signalToKernelEvent(sig) {
+    return {
+        kind: "signal",
+        signal: {
+            id: crypto.randomUUID(),
+            source: sig.source ?? "custom",
+            signal_type: sig.signalType ?? "event",
+            urgency: sig.urgency ?? "normal",
+            summary: String(sig.payload?.goal ?? "signal"),
+            payload: sig.payload ?? {},
+            ...(sig.dedupeKey ? { dedupe_key: sig.dedupeKey } : {}),
+            timestamp_ms: Date.now(),
+        },
+    };
+}

package/dist/runtime/sub-agent-orchestrator.d.ts

@@ -7,7 +7,16 @@ export interface SubAgentRunContext {
     spec: AgentRunSpec;
     manifest: AgentProcessChangedObservation;
     sessionLog: SessionLog;
+    /** M5 v2.1: set when this child is a workflow node — propagated so a nested `start_workflow`
+     *  FLATTENS to the parent kernel rather than auto-pivoting into its own bootstrap. */
+    isWorkflowNode?: boolean;
+    /** #2-B-ii: parent-controlled abort — when the kernel preempts this node (`AgentPreempted`), the
+     *  orchestrator interrupts the child runner, cancelling its in-flight LLM call. */
+    abortSignal?: AbortSignal;
 }
+/** M1/G3 intelligence routing: resolve the provider for a sub-agent from its spec's `modelHint`.
+ *  Falls back to the parent provider when there is no hint or no `providerFor` hook resolves it. */
+export declare function resolveProvider(opts: RuntimeOptions, modelHint?: string): RuntimeOptions["provider"];
 /** Host-side driver for kernel-isolated sub-agent runs. */
 export declare class SubAgentOrchestrator {
     run(ctx: SubAgentRunContext): Promise<SubAgentResult>;

package/dist/runtime/sub-agent-orchestrator.js

@@ -1,6 +1,16 @@
 import { agentRunSpecToKernel, findSpawnProcessObservation, spawnObservationToManifest } from "./types/agent.js";
 import { FilteredExecutionPlane } from "./filtered-plane.js";
 import { kernelApply } from "./kernel-step.js";
+/** #2-B-ii: bridge a parent AbortSignal to a child runner's `interrupt()` (fires now if already aborted). */
+function linkAbort(signal, runner) {
+    if (!signal)
+        return;
+    if (signal.aborted) {
+        runner.interrupt();
+        return;
+    }
+    signal.addEventListener("abort", () => runner.interrupt(), { once: true });
+}
 function terminationFromStatus(status) {
     const normalized = status.toLowerCase();
     if (normalized === "completed" ||
@@ -14,6 +24,16 @@ function terminationFromStatus(status) {
     }
     return status;
 }
+/** M1/G3 intelligence routing: resolve the provider for a sub-agent from its spec's `modelHint`.
+ *  Falls back to the parent provider when there is no hint or no `providerFor` hook resolves it. */
+export function resolveProvider(opts, modelHint) {
+    if (modelHint && opts.providerFor) {
+        const routed = opts.providerFor(modelHint);
+        if (routed)
+            return routed;
+    }
+    return opts.provider;
+}
 /** Derive which meta-tools a child runner should expose based on permitted IDs and available sources. */
 function deriveMetaTools(permitted, opts) {
     const metaTools = new Set();
@@ -48,6 +68,10 @@ export class SubAgentOrchestrator {
         const { RuntimeRunner } = await import("./runner.js");
         const childRunner = new RuntimeRunner({
             ...ctx.parentOpts,
+            // M1/G3: route to the node's hinted model (falls back to the parent provider).
+            provider: resolveProvider(ctx.parentOpts, ctx.spec.modelHint),
+            // M4/G5: cap the child run at the node's token budget (falls back to the inherited cap).
+            maxTotalTokens: ctx.spec.tokenBudget ?? ctx.parentOpts.maxTotalTokens,
             executionPlane: filteredPlane,
             agentId: ctx.spec.identity.agentId,
             systemPrompt,
@@ -56,7 +80,11 @@ export class SubAgentOrchestrator {
             dreamStore: metaTools.has("memory") ? ctx.parentOpts.dreamStore : undefined,
             knowledgeSource: metaTools.has("knowledge") ? ctx.parentOpts.knowledgeSource : undefined,
             enablePlanTool: metaTools.has("update_plan") ? ctx.parentOpts.enablePlanTool : undefined,
+            // M5 v2.1: a workflow node's `start_workflow` flattens to the parent kernel (no nested pivot).
+            isWorkflowNode: ctx.isWorkflowNode,
         });
+        // #2-B-ii: parent preempt → interrupt the child (cancels its in-flight LLM call).
+        linkAbort(ctx.abortSignal, childRunner);
         let done;
         let finalText = "";
         // R3-1: collect any nodes this node's agent submitted via the `submit_workflow_nodes` tool.

package/dist/runtime/types/agent.d.ts

@@ -23,6 +23,11 @@ export interface AgentRunSpec {
     capabilityFilter?: AgentCapabilityFilter;
     milestones?: MilestoneContract;
     metadata?: Record<string, unknown>;
+    /** M1/G3: per-agent model preference; the host resolves it via `RuntimeOptions.providerFor`.
+     *  Host-side routing only — not sent to the kernel. */
+    modelHint?: string;
+    /** M4/G5: cumulative token cap for this sub-agent's run (sets the child kernel's `maxTotalTokens`). */
+    tokenBudget?: number;
 }
 /** Kernel process-table observation (Phase 3 canonical spawn signal). */
 export interface AgentProcessChangedObservation {
@@ -48,6 +53,14 @@ export interface LoopResult {
     finalMessage?: Message;
     turnsUsed: number;
     totalTokensUsed: number;
+    /** A#2 v2 loop stop signal: a loop iteration sets `false` to end the loop before `max_iters`.
+     *  `undefined` (every non-loop result) ⇒ no opinion → run to the cap. Sent only when set. */
+    loopContinue?: boolean;
+    /** A#2 classify routing: a classifier node reports the chosen branch label here; the kernel runs
+     *  that branch and prunes the rest. Sent only when set. */
+    classifyBranch?: string;
+    /** A#2 tournament verdict: a judge reports the winning entrant's agent id here. Sent only when set. */
+    tournamentWinner?: string;
 }
 export interface SubAgentResult {
     agentId: string;
@@ -99,6 +112,26 @@ export interface WorkflowNodeSpec {
     /** G2: make this a deterministic reduce node — runs no LLM; the runner routes it to the registered
      *  reducer of this name over its `dependsOn` nodes' outputs. */
     reducer?: string;
+    /** A#2 v2: make this a *loop* node — re-run its agent up to `maxIters` times. An iteration may end
+     *  the loop early by reporting `loopContinue: false` (the runner solicits this from the agent). */
+    loop?: {
+        maxIters: number;
+    };
+    /** A#2: make this a *classify* node — its agent picks exactly one branch `label`; that branch's
+     *  nodes run and the others are pruned. Each branch node must list this node's index in `dependsOn`. */
+    classify?: {
+        branches: Array<{
+            label: string;
+            nodes: number[];
+        }>;
+    };
+    /** A#2: make this a *tournament controller* — generate each `entrants` candidate in parallel, then
+     *  pairwise-judge them to one winner (this node's `task.goal` is the judging criterion). ≥2 entrants. */
+    tournament?: {
+        entrants: WorkflowTaskSpec[];
+    };
+    /** M4/G5: cap this node's child run at `tokenBudget` cumulative tokens (the per-node "use N tokens"). */
+    tokenBudget?: number;
     /** Indices of nodes this node depends on. */
     dependsOn?: number[];
 }
@@ -120,6 +153,20 @@ export interface WorkflowSpawnInfo {
     reducer?: string;
     /** G2: the dependency agent ids whose outputs a reduce node consumes. */
     input_agent_ids?: string[];
+    /** A#2: present only for a tournament *judge* spawn — the two entrant agent ids whose produced
+     *  outputs this judge compares. The runner looks them up and reports the winner as `tournamentWinner`. */
+    judge_match?: {
+        left: string;
+        right: string;
+    };
+    /** A#2 v2: present only for a *loop* iteration spawn — the loop's `max_iters`. Marks the spawn as a
+     *  loop iteration so the runner solicits + reports a `loopContinue` stop signal. */
+    loop_max_iters?: number;
+    /** A#2: present only for a *classify* spawn — the branch labels the classifier must choose among.
+     *  Non-empty marks the spawn as a classifier so the runner instructs the agent + reports `classifyBranch`. */
+    classify_labels?: string[];
+    /** M4/G5: the node's per-node cumulative token cap, if set — the runner caps the child run here. */
+    token_budget?: number;
 }
 /** G4 budget-as-signal: the workflow's remaining headroom under the active quota, carried on the
  *  `workflow_batch_spawned` observation so a coordinator node can scale its next submission. */
@@ -130,10 +177,14 @@ export interface WorkflowBudget {
     running_subagents: number;
     max_concurrent_subagents?: number;
     concurrency_remaining?: number;
+    /** M4/G5 token headroom: tokens used / run-level cap / tokens remaining, so a coordinator can scale
+     *  a submission to "use N tokens". */
+    tokens_used?: number;
+    tokens_max?: number;
+    tokens_remaining?: number;
 }
 /** G4: a concise budget note appended to a coordinator node's goal. "" when nothing is bounded. */
 export declare function workflowBudgetNote(budget: WorkflowBudget | undefined): string;
-/** Map a host `WorkflowSpec` to the snake_case kernel JSON (`load_workflow.spec`). */
 /** Map one host `WorkflowNodeSpec` to its snake_case kernel JSON. Shared by `load_workflow` and
  *  `submit_workflow_nodes` (R3-1) so the two encodings never drift. */
 export declare function workflowNodeSpecToKernel(n: WorkflowNodeSpec): Record<string, unknown>;
@@ -142,8 +193,16 @@ export declare function workflowSpecToKernel(spec: WorkflowSpec): Record<string,
  *  `submitterAgentId` so the kernel enforces no-privilege-escalation (quarantined submitter ⇒ its
  *  nodes coerced to quarantined). Omitted ⇒ no coercion. */
 export declare function submitWorkflowNodesToKernel(nodes: WorkflowNodeSpec[], submitterAgentId?: string): Record<string, unknown>;
-/** R3-1: the tool a workflow-coordinator node's agent calls to append work to the running DAG. */
+/** M5/G1: map an agent-authored spec to the `submit_workflow` kernel event body (the agent-reachable
+ *  `Syscall::LoadWorkflow`). The kernel bootstraps the DAG when none is active, else flattens onto it.
+ *  `parentSessionId` seeds child session ids on bootstrap; `submitterAgentId` carries G1 trust coercion
+ *  on the flatten case. */
+export declare function submitWorkflowToKernel(spec: WorkflowSpec, parentSessionId: string, submitterAgentId?: string): Record<string, unknown>;
 export declare const submitWorkflowNodesTool: ToolSchema;
+/** M5 v1 (flatten): the tool an agent calls to author a sub-workflow — a cohesive DAG of nodes
+ *  composed onto the running workflow. Lowers to the same append path as `submit_workflow_nodes`
+ *  (a `WorkflowSpec` is a node batch). v2 adds top-level bootstrap (the `LoadWorkflow` syscall). */
+export declare const startWorkflowTool: ToolSchema;
 /** Build a sub-agent run spec for a kernel-generated workflow node. */
 export declare function workflowNodeToSpec(node: WorkflowSpawnInfo, parentSessionId: string): AgentRunSpec;
 /** Build the host manifest for a kernel-generated workflow node. */

package/dist/runtime/types/agent.js

@@ -85,6 +85,11 @@ export function subAgentResultToKernel(result) {
                 : null,
             turns_used: result.result.turnsUsed,
             total_tokens_used: result.result.totalTokensUsed,
+            // A#2: control-flow signals — additive, omitted on the wire when unset so a plain spawn's
+            // result is byte-identical to before. The kernel reads each only for the matching node kind.
+            ...(result.result.loopContinue !== undefined ? { loop_continue: result.result.loopContinue } : {}),
+            ...(result.result.classifyBranch !== undefined ? { classify_branch: result.result.classifyBranch } : {}),
+            ...(result.result.tournamentWinner !== undefined ? { tournament_winner: result.result.tournamentWinner } : {}),
         },
     };
 }
@@ -105,31 +110,58 @@ export function workflowBudgetNote(budget) {
     if (budget.concurrency_remaining != null && budget.max_concurrent_subagents != null) {
         parts.push(`concurrency ${budget.running_subagents}/${budget.max_concurrent_subagents} running, ${budget.concurrency_remaining} free`);
     }
+    if (budget.tokens_remaining != null && budget.tokens_max != null) {
+        parts.push(`tokens ${budget.tokens_used ?? 0}/${budget.tokens_max} used, ${budget.tokens_remaining} remaining`);
+    }
     if (parts.length === 0)
         return "";
     return (`[workflow budget] ${parts.join(" · ")}. ` +
-        "If you submit more workflow nodes, keep the batch within the remaining node budget.");
+        "If you submit more workflow nodes, keep the batch within the remaining node and token budget.");
+}
+/** Normalize a `WorkflowTaskSpec` (object or bare goal string) to the kernel's `RuntimeTask` JSON. */
+function workflowTaskToKernel(t) {
+    const task = typeof t === "string" ? { goal: t } : t;
+    return {
+        goal: task.goal,
+        // `criteria` is required by the kernel's RuntimeTask serde (no default).
+        criteria: task.criteria ?? [],
+        ...(task.lane ? { lane: task.lane } : {}),
+    };
+}
+/** Lower a node's control-flow kind to the kernel's serde-tagged `NodeKind` JSON, or `undefined` for
+ *  a plain spawn. `reducer` / `loop` / `classify` / `tournament` are mutually exclusive. */
+function nodeKindToKernel(n) {
+    const declared = [n.reducer != null, n.loop != null, n.classify != null, n.tournament != null].filter(Boolean).length;
+    if (declared > 1) {
+        throw new Error("a workflow node may declare at most one of: reducer, loop, classify, tournament");
+    }
+    if (n.reducer != null)
+        return { type: "reduce", reducer: n.reducer };
+    if (n.loop != null)
+        return { type: "loop", max_iters: n.loop.maxIters };
+    if (n.classify != null) {
+        return { type: "classify", branches: n.classify.branches.map(b => ({ label: b.label, nodes: b.nodes })) };
+    }
+    if (n.tournament != null)
+        return { type: "tournament", entrants: n.tournament.entrants.map(workflowTaskToKernel) };
+    return undefined;
 }
-/** Map a host `WorkflowSpec` to the snake_case kernel JSON (`load_workflow.spec`). */
 /** Map one host `WorkflowNodeSpec` to its snake_case kernel JSON. Shared by `load_workflow` and
  *  `submit_workflow_nodes` (R3-1) so the two encodings never drift. */
 export function workflowNodeSpecToKernel(n) {
-    const task = typeof n.task === "string" ? { goal: n.task } : n.task;
+    const kind = nodeKindToKernel(n);
     return {
-        task: {
-            goal: task.goal,
-            // `criteria` is required by the kernel's RuntimeTask serde (no default).
-            criteria: task.criteria ?? [],
-            ...(task.lane ? { lane: task.lane } : {}),
-        },
+        task: workflowTaskToKernel(n.task),
         role: n.role,
         isolation: n.isolation ?? "shared",
         context_inheritance: n.contextInheritance ?? "none",
         ...(n.modelHint ? { model_hint: n.modelHint } : {}),
         ...(n.trust && n.trust !== "trusted" ? { trust: n.trust } : {}),
         ...(n.outputSchema ? { output_schema: n.outputSchema } : {}),
-        // G2: a reducer name lowers to the kernel's `NodeKind::Reduce` (serde-tagged by `type`).
-        ...(n.reducer ? { kind: { type: "reduce", reducer: n.reducer } } : {}),
+        // A#2/G2: loop / classify / tournament / reduce lower to a serde-tagged `NodeKind`; spawn omits it.
+        ...(kind ? { kind } : {}),
+        // M4/G5: per-node token cap (additive; omitted when unset).
+        ...(n.tokenBudget != null ? { token_budget: n.tokenBudget } : {}),
         ...(n.dependsOn && n.dependsOn.length ? { depends_on: n.dependsOn } : {}),
     };
 }
@@ -146,33 +178,113 @@ export function submitWorkflowNodesToKernel(nodes, submitterAgentId) {
         ...(submitterAgentId ? { submitter_agent_id: submitterAgentId } : {}),
     };
 }
+/** M5/G1: map an agent-authored spec to the `submit_workflow` kernel event body (the agent-reachable
+ *  `Syscall::LoadWorkflow`). The kernel bootstraps the DAG when none is active, else flattens onto it.
+ *  `parentSessionId` seeds child session ids on bootstrap; `submitterAgentId` carries G1 trust coercion
+ *  on the flatten case. */
+export function submitWorkflowToKernel(spec, parentSessionId, submitterAgentId) {
+    return {
+        kind: "submit_workflow",
+        spec: workflowSpecToKernel(spec),
+        parent_session_id: parentSessionId,
+        ...(submitterAgentId ? { submitter_agent_id: submitterAgentId } : {}),
+    };
+}
 /** R3-1: the tool a workflow-coordinator node's agent calls to append work to the running DAG. */
+/** Shared JSON-Schema for a workflow-node batch (a DAG). Used by both `submit_workflow_nodes`
+ *  (append) and `start_workflow` (M5 v1: author a sub-workflow), so the two tools never drift. */
+const workflowNodesArraySchema = {
+    type: "array",
+    items: {
+        type: "object",
+        properties: {
+            task: { description: "The node's goal: a string, or { goal, criteria?, lane? }." },
+            role: { type: "string", enum: ["explore", "plan", "implement", "verify", "custom"] },
+            isolation: { type: "string", enum: ["shared", "read_only", "worktree", "remote"] },
+            contextInheritance: { type: "string", enum: ["none", "system_only", "full"] },
+            trust: { type: "string", enum: ["trusted", "quarantined"] },
+            outputSchema: { type: "object", description: "Optional JSON Schema the node's output must conform to." },
+            modelHint: { type: "string", description: "Preferred model for this node (e.g. \"opus\"/\"sonnet\"); the host routes it." },
+            reducer: { type: "string", description: "Make this a deterministic reduce node (no LLM); names a registered reducer." },
+            loop: {
+                type: "object",
+                description: "Make this a loop node: re-run up to maxIters times, ending early when the agent reports done.",
+                properties: { maxIters: { type: "integer", description: "Hard iteration cap." } },
+                required: ["maxIters"],
+            },
+            classify: {
+                type: "object",
+                description: "Make this a classify node: pick one branch label; that branch's nodes run, the rest are pruned.",
+                properties: {
+                    branches: {
+                        type: "array",
+                        items: {
+                            type: "object",
+                            properties: {
+                                label: { type: "string" },
+                                nodes: { type: "array", items: { type: "integer" }, description: "Batch-relative node indices for this branch." },
+                            },
+                            required: ["label", "nodes"],
+                        },
+                    },
+                },
+                required: ["branches"],
+            },
+            tournament: {
+                type: "object",
+                description: "Make this a tournament controller: generate each entrant, then pairwise-judge to one winner.",
+                properties: {
+                    entrants: {
+                        type: "array",
+                        description: "≥2 candidate tasks to generate and judge.",
+                        items: {
+                            oneOf: [
+                                { type: "string" },
+                                { type: "object", properties: { goal: { type: "string" }, criteria: { type: "array", items: { type: "string" } } }, required: ["goal"] },
+                            ],
+                        },
+                    },
+                },
+                required: ["entrants"],
+            },
+            tokenBudget: { type: "integer", description: "Cap this node's child run at this many cumulative tokens." },
+            dependsOn: { type: "array", items: { type: "integer" } },
+        },
+        required: ["task", "role"],
+    },
+};
 export const submitWorkflowNodesTool = {
     name: "submit_workflow_nodes",
     description: "Append new nodes to the running workflow DAG (dynamic fan-out / loop-until-done). Each node " +
-        "spawns as a gated sub-agent. Use when you discover more work that should run as its own node.",
+        "spawns as a gated sub-agent. Use when you discover more work that should run as its own node. " +
+        "A node may declare ONE control-flow kind — `loop` / `classify` / `tournament` / `reducer` — " +
+        "otherwise it is a plain spawn. Within a submission, `dependsOn` and `classify.branches[].nodes` " +
+        "are batch-relative (index 0 = this batch's first node).",
+    parameters: JSON.stringify({
+        type: "object",
+        properties: { nodes: workflowNodesArraySchema },
+        required: ["nodes"],
+    }),
+};
+/** M5 v1 (flatten): the tool an agent calls to author a sub-workflow — a cohesive DAG of nodes
+ *  composed onto the running workflow. Lowers to the same append path as `submit_workflow_nodes`
+ *  (a `WorkflowSpec` is a node batch). v2 adds top-level bootstrap (the `LoadWorkflow` syscall). */
+export const startWorkflowTool = {
+    name: "start_workflow",
+    description: "Author and run a sub-workflow: a DAG of nodes (fan-out / classify / tournament / loop / reduce) " +
+        "composed onto the current run. Use to structure a multi-step task as its own harness. The nodes " +
+        "spawn as gated sub-agents; `dependsOn` / `classify.branches[].nodes` are spec-relative.",
     parameters: JSON.stringify({
         type: "object",
         properties: {
-            nodes: {
-                type: "array",
-                items: {
-                    type: "object",
-                    properties: {
-                        task: { description: "The node's goal: a string, or { goal, criteria?, lane? }." },
-                        role: { type: "string", enum: ["explore", "plan", "implement", "verify", "custom"] },
-                        isolation: { type: "string", enum: ["shared", "read_only", "worktree", "remote"] },
-                        contextInheritance: { type: "string", enum: ["none", "system_only", "full"] },
-                        trust: { type: "string", enum: ["trusted", "quarantined"] },
-                        outputSchema: { type: "object", description: "Optional JSON Schema the node's output must conform to." },
-                        reducer: { type: "string", description: "Make this a deterministic reduce node (no LLM); names a registered reducer." },
-                        dependsOn: { type: "array", items: { type: "integer" } },
-                    },
-                    required: ["task", "role"],
-                },
+            spec: {
+                type: "object",
+                description: "The workflow specification.",
+                properties: { nodes: workflowNodesArraySchema },
+                required: ["nodes"],
             },
         },
-        required: ["nodes"],
+        required: ["spec"],
     }),
 };
 /** Build a sub-agent run spec for a kernel-generated workflow node. */
@@ -187,6 +299,10 @@ export function workflowNodeToSpec(node, parentSessionId) {
         role: node.role,
         isolation: node.isolation,
         goal: node.goal,
+        // M1/G3: carry the node's model preference so the orchestrator can route to a provider.
+        ...(node.model_hint ? { modelHint: node.model_hint } : {}),
+        // M4/G5: carry the node's token cap so the orchestrator can bound the child run.
+        ...(node.token_budget != null ? { tokenBudget: node.token_budget } : {}),
     };
 }
 /** Build the host manifest for a kernel-generated workflow node. */

package/dist/runtime/workflow-control-flow.d.ts

@@ -0,0 +1,17 @@
+/** Instruction appended to a loop node's goal: do the next increment, and signal when done. */
+export declare function loopInstruction(maxIters: number): string;
+/** Instruction appended to a classify node's goal: pick exactly one of the kernel's branch labels. */
+export declare function classifyInstruction(labels: string[]): string;
+/** Build a tournament judge's goal: the controller's criterion + the two candidates to compare. */
+export declare function judgeGoal(criterion: string, leftOutput: string, rightOutput: string): string;
+/** Extract a loop stop signal from a loop iteration's output. Returns the `loopContinue` value, or
+ *  `undefined` when the agent gave no clear signal (⇒ the kernel runs the loop to `max_iters`).
+ *  Accepts `{loop_continue: bool}` or, leniently, `{done: bool}` (continue = !done). */
+export declare function extractLoopContinue(text: string): boolean | undefined;
+/** Extract the chosen branch label from a classifier's output. Prefers `{branch: "..."}`; falls back
+ *  to a bare label string that exactly matches one of the valid labels. Returns `undefined` when no
+ *  recognizable choice was made (the kernel then prunes every branch — a safe "none matched"). */
+export declare function extractClassifyBranch(text: string, labels: string[]): string | undefined;
+/** Extract a tournament judge's verdict ("left" or "right"). Defaults to "left" when the verdict is
+ *  unparseable, so the bracket always advances to a champion rather than stalling with no winner. */
+export declare function extractJudgeWinner(text: string): "left" | "right";

package/dist/runtime/workflow-control-flow.js

@@ -0,0 +1,78 @@
+//! A#2: SDK-side execution of the kernel's control-flow workflow node kinds (Loop / Classify /
+//! Tournament). The kernel owns the scheduling — it re-arms loops, prunes classify branches, and
+//! runs the tournament bracket — and tells the SDK *which* kind a spawn is via the spawn descriptor
+//! (`loop_max_iters` / `classify_labels` / `judge_match`). This module is the SDK half of the "one
+//! agent per node + one additive result field" contract: it builds the prompt that solicits the
+//! decision from the node's agent and extracts the matching result signal (`loopContinue` /
+//! `classifyBranch` / `tournamentWinner`) the kernel reads back.
+import { extractJsonValue } from "./output-schema.js";
+/** Instruction appended to a loop node's goal: do the next increment, and signal when done. */
+export function loopInstruction(maxIters) {
+    return (`This task runs as a LOOP (up to ${maxIters} iterations total). Do the next increment of work now. ` +
+        `When you judge the overall task COMPLETE and no further iterations are needed, end your response ` +
+        `with a JSON object {"loop_continue": false}. To request another iteration, omit it or return ` +
+        `{"loop_continue": true}.`);
+}
+/** Instruction appended to a classify node's goal: pick exactly one of the kernel's branch labels. */
+export function classifyInstruction(labels) {
+    return (`Classify the input and choose EXACTLY ONE label from: ${labels.map(l => JSON.stringify(l)).join(", ")}. ` +
+        `Respond with ONLY a JSON object: {"branch": "<one of the labels>"}.`);
+}
+/** Build a tournament judge's goal: the controller's criterion + the two candidates to compare. */
+export function judgeGoal(criterion, leftOutput, rightOutput) {
+    return (`${criterion}\n\nCompare the two candidate outputs below and decide which one better satisfies the ` +
+        `criterion above.\n\n[CANDIDATE left]\n${leftOutput}\n\n[CANDIDATE right]\n${rightOutput}\n\n` +
+        `Respond with ONLY a JSON object: {"winner": "left"} or {"winner": "right"}.`);
+}
+/** Extract a loop stop signal from a loop iteration's output. Returns the `loopContinue` value, or
+ *  `undefined` when the agent gave no clear signal (⇒ the kernel runs the loop to `max_iters`).
+ *  Accepts `{loop_continue: bool}` or, leniently, `{done: bool}` (continue = !done). */
+export function extractLoopContinue(text) {
+    const v = extractJsonValue(text);
+    if (v && typeof v === "object" && !Array.isArray(v)) {
+        const o = v;
+        if (typeof o.loop_continue === "boolean")
+            return o.loop_continue;
+        if (typeof o.loopContinue === "boolean")
+            return o.loopContinue;
+        if (typeof o.done === "boolean")
+            return !o.done;
+    }
+    return undefined;
+}
+/** Extract the chosen branch label from a classifier's output. Prefers `{branch: "..."}`; falls back
+ *  to a bare label string that exactly matches one of the valid labels. Returns `undefined` when no
+ *  recognizable choice was made (the kernel then prunes every branch — a safe "none matched"). */
+export function extractClassifyBranch(text, labels) {
+    const v = extractJsonValue(text);
+    if (v && typeof v === "object" && !Array.isArray(v)) {
+        const o = v;
+        if (typeof o.branch === "string")
+            return o.branch;
+        if (typeof o.label === "string")
+            return o.label;
+    }
+    if (typeof v === "string" && labels.includes(v))
+        return v;
+    const trimmed = (text ?? "").trim();
+    if (labels.includes(trimmed))
+        return trimmed;
+    return undefined;
+}
+/** Extract a tournament judge's verdict ("left" or "right"). Defaults to "left" when the verdict is
+ *  unparseable, so the bracket always advances to a champion rather than stalling with no winner. */
+export function extractJudgeWinner(text) {
+    const v = extractJsonValue(text);
+    if (v && typeof v === "object" && !Array.isArray(v)) {
+        const w = v.winner;
+        if (w === "right")
+            return "right";
+        if (w === "left")
+            return "left";
+    }
+    const lowered = (text ?? "").toLowerCase();
+    // Last resort: a bare mention. Bias to "left" on ambiguity (both/neither mentioned).
+    if (lowered.includes("right") && !lowered.includes("left"))
+        return "right";
+    return "left";
+}

package/dist/tools/index.d.ts

@@ -1,9 +1,16 @@
 import type { ToolSchema, ToolResult } from "../types.js";
+/** M3/G4: the runtime context a tool may read when executing (carries the working directory). A
+ *  narrow, dependency-free shape; the execution plane's `RunContext` is structurally assignable to it.
+ *  (WASM has no filesystem, so worktree isolation is N/A here — this keeps the tool ABI in parity
+ *  with the Node/Python ports so a tool authored once works across all of them.) */
+export interface ToolExecContext {
+    cwd?: string;
+}
 export interface RegisteredTool {
     schema: ToolSchema;
-    execute(args: Record<string, unknown>): Promise<string>;
+    execute(args: Record<string, unknown>, ctx?: ToolExecContext): Promise<string>;
 }
-export declare function tool(name: string, description: string, parameters: Record<string, unknown>, fn: (args: Record<string, unknown>) => Promise<string> | string): RegisteredTool;
+export declare function tool(name: string, description: string, parameters: Record<string, unknown>, fn: (args: Record<string, unknown>, ctx?: ToolExecContext) => Promise<string> | string): RegisteredTool;
 export declare function executeTools(calls: {
     id: string;
     name: string;

package/dist/tools/index.js

@@ -1,7 +1,7 @@
 export function tool(name, description, parameters, fn) {
     return {
         schema: { name, description, parameters: JSON.stringify(parameters) },
-        async execute(args) { return fn(args); },
+        async execute(args, ctx) { return fn(args, ctx); },
     };
 }
 export async function executeTools(calls, registry) {

package/dist/types.d.ts

@@ -179,7 +179,11 @@ export interface LLMProvider {
     peekProviderReplay?(message: Pick<Message, "content" | "toolCalls">): ProviderReplay | undefined;
     seedProviderReplay?(message: Pick<Message, "content" | "toolCalls">, replay: ProviderReplay): void;
     complete(context: RenderedContext, tools: ToolSchema[], extensions?: Record<string, unknown>): Promise<Message>;
-    stream(context: RenderedContext, tools: ToolSchema[], extensions?: Record<string, unknown>, state?: ProviderRunState): AsyncIterable<StreamEvent>;
+    stream(context: RenderedContext, tools: ToolSchema[], extensions?: Record<string, unknown>, state?: ProviderRunState, 
+    /** #2-B-ii: when provided, a preempt (`interrupt()`) aborts the in-flight request. SDK-client
+     *  providers forward it via `{ signal }`; the runner also breaks the consume loop on abort, so
+     *  providers that ignore it still stop processing immediately. Optional ⇒ backward-compatible. */
+    signal?: AbortSignal): AsyncIterable<StreamEvent>;
 }
 export interface DreamSummarizer {
     summarize(archived: Message[], context: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepstrike/wasm",
-  "version": "0.2.15",
+  "version": "0.2.17",
   "description": "DeepStrike WASM SDK — browser, Cloudflare Workers, Deno Deploy",
   "type": "module",
   "main": "dist/index.js",
@@ -15,7 +15,7 @@
     "test": "node --experimental-vm-modules node_modules/.bin/jest"
   },
   "dependencies": {
-    "@deepstrike/wasm-kernel": "0.2.15"
+    "@deepstrike/wasm-kernel": "0.2.17"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",