@deepstrike/wasm 0.2.49 → 0.2.51

package/dist/runtime/runner.d.ts

@@ -6,12 +6,12 @@ import type { SignalSource, RuntimeSignal } from "../signals/index.js";
 import type { SessionLog, SessionEvent } from "./session-log.js";
 import type { ExecutionPlane } from "./execution-plane.js";
 import { type GovernancePolicy } from "../governance.js";
-import { type RecoveredNodeOutcome } from "./session-repair.js";
-import type { AgentRunSpec, SubAgentResult, MilestonePolicy, MilestoneContract, MilestoneCheckResult, WorkflowSpec, WorkflowOutcome } from "./types/agent.js";
+import type { KernelJournal } from "./kernel-journal.js";
+import type { AgentRunSpec, MilestonePolicy, MilestoneContract, MilestoneCheckResult, WorkflowSpec, WorkflowOutcome } from "./types/agent.js";
 import { type SubAgentOrchestrator } from "./sub-agent-orchestrator.js";
 import { type ReducerRegistry } from "./reducers.js";
 import { type NativeOsProfile, type OsProfileId, type SignalPolicy } from "./os-profile.js";
-import { LargeResultSpool } from "./large-result-spool.js";
+import { PayloadStore } from "./payload-store.js";
 import { type ContextPolicyOverridesV1 } from "./context-policy.js";
 export interface MemoryWriteRateLimit {
     maxWrites: number;
@@ -44,11 +44,10 @@ export interface PromptBudget {
 /**
  * Long-term memory policy (`set_memory_policy`) — opt-in, kernel-enforced. `validationEnabled:
  * false` admits writes without validation, `maxContentBytes` / `maxNameLength` override the
- * validation limits, and `retrievalTopK` caps `query_memory` breadth. `memoryPath` /
- * `staleWarningDays` are carried for SDK recall I/O. Omitted fields keep the kernel defaults.
+ * validation limits, and `retrievalTopK` caps `query_memory` breadth. Host storage is configured
+ * on the `DreamStore` and never enters this contract. Omitted fields keep the kernel defaults.
  */
 export interface MemoryPolicy {
-    memoryPath?: string;
     staleWarningDays?: number;
     retrievalTopK?: number;
     validationEnabled?: boolean;
@@ -56,19 +55,10 @@ export interface MemoryPolicy {
     maxNameLength?: number;
 }
 export interface KernelReliabilityOptions {
-    eventReplayCapacity?: number;
-    completedEffectReplayCapacity?: number;
     providerRecoveryAttempts?: number;
     outputRecoveryAttempts?: number;
-    hostEffectRetryAttempts?: number;
-    spoolThresholdBytes?: number;
-    spoolPreviewBytes?: number;
-    /** Max accepted ABI transactions retained for a portable KernelSnapshot rebuild. */
-    snapshotInputLimit?: number;
     /** Max canonical JSON bytes accepted for one kernel input, 256..64MiB. */
     maxInputBytes?: number;
-    /** Max canonical JSON bytes retained by the snapshot journal, 256..1GiB. */
-    snapshotJournalBytesLimit?: number;
 }
 export interface ArchiveStore {
     write(sessionId: string, startSeq: number, messages: Message[]): Promise<string | undefined>;
@@ -105,6 +95,8 @@ export interface ToolResultHookDecision {
 }
 export interface RuntimeOptions {
     provider: LLMProvider;
+    /** Required for ABI-v3 operation recovery unless the SessionLog embeds one. */
+    kernelJournal?: KernelJournal;
     /** M1/G3 intelligence routing: resolve a per-node provider from a workflow node's `modelHint`.
      *  Returns undefined ⇒ fall back to `provider`. Without this hook the hint is a no-op. */
     providerFor?: (modelHint: string) => LLMProvider | undefined;
@@ -195,10 +187,6 @@ export interface RuntimeOptions {
     onToolSuspend?: (event: ToolSuspendEvent) => Promise<unknown> | unknown;
     onPermissionRequest?: (event: PermissionRequestEvent) => Promise<PermissionResponse | boolean> | PermissionResponse | boolean;
     subAgentOrchestrator?: SubAgentOrchestrator;
-    /** M5 v2.1: marks this runner as a workflow node (child of the workflow driver). A workflow node's
-     *  `start_workflow` FLATTENS to the parent kernel; a top-level run (unset) AUTO-PIVOTS — bootstraps +
-     *  drives the authored workflow in its own kernel, then resumes the reason loop with the outcome. */
-    isWorkflowNode?: boolean;
     /** G2: custom reducers for `NodeKind::Reduce` workflow nodes, merged over the built-ins. */
     reducers?: ReducerRegistry;
     milestonePolicy?: MilestonePolicy;
@@ -209,11 +197,52 @@ export interface RuntimeOptions {
         requiredEvidence: string[];
     }) => Promise<MilestoneCheckResult> | MilestoneCheckResult;
     runSpec?: AgentRunSpec;
-    /** P0-A tool gating: a static per-run tool profile — only these tool ids (plus the meta-tools)
-     *  are exposed to the model each turn. Lowers to the same `capability_filter` sub-agents use;
-     *  byte-stable across the run, so it never busts the prompt-cache prefix. Augments `runSpec`'s
-     *  filter when both set; synthesizes a minimal spec otherwise. Omitted/empty ⇒ no gating. */
+    /**
+     * The run's **exposure ceiling** — the outer bound on what this run may EVER advertise to the
+     * model. Not a static profile: it is an INTERSECTION applied on every turn (`exposed ⊆ ceiling`),
+     * so every narrowing mechanism operates *within* it and none can widen past it. Skills narrow
+     * inside the ceiling (`allowed_tools`), `baselineToolIds` selects which of the ceiling's tools are
+     * exposed before any skill activates, and `stableCoreToolIds` pins tools against skill narrowing.
+     *
+     * Exempt on the id axis: the kernel-owned meta-tools (`skill`, `memory`, `knowledge`,
+     * `update_plan`, `read_result`) stay exposed regardless of this list — a ceiling that hid `skill`
+     * would make progressive disclosure unreachable. The KIND axis
+     * (`runSpec.capabilityFilter.allowedKinds`) still applies to them.
+     *
+     * Byte-stable across the run, so it never busts the prompt-cache prefix. Lowers to the same
+     * `capability_filter` sub-agents use: augments `runSpec`'s filter when both are set, else
+     * synthesizes a minimal run spec. Omitted **or empty** ⇒ no ceiling (all registered tools) — the
+     * empty array is NOT a minimal surface here; use `baselineToolIds: []` for that.
+     *
+     * Enforcement: `toolDispatchGate` (default `"exposed"`) makes this a real boundary — a call to a
+     * tool outside the advertised set never executes.
+     */
     allowedToolIds?: string[];
+    /**
+     * The **pre-activation** exposure surface, selected from under the `allowedToolIds` ceiling.
+     * Makes the narrow→wide progressive-disclosure shape expressible: start the run advertising only
+     * these tools, and let a skill activation widen the surface by exactly its declared
+     * `allowed_tools` (still ∩ the ceiling). Per turn:
+     *
+     *   `exposed = meta ∪ ((baseline ∪ stableCore ∪ ⋃ activeSkills.allowed_tools) ∩ ceiling)`
+     *
+     * An active skill that declares no `allowed_tools` contributes nothing — with a baseline set the
+     * surface stays narrow (strict; the legacy errs-open widening is deliberately not inherited).
+     *
+     * `undefined` ⇒ legacy behavior, byte-identical. `[]` is a legitimate, distinct value: the minimal
+     * surface (meta-tools + `stableCoreToolIds` only) — the `allowedToolIds` "empty means no gating"
+     * trap does NOT recur here. Entries outside the ceiling silently intersect away.
+     */
+    baselineToolIds?: string[];
+    /**
+     * Dispatch enforcement for the exposure surface. `"exposed"` (default) is fail-closed: a tool call
+     * the model was never advertised this turn never reaches the host — the kernel commits a
+     * model-visible `governance_denied` result instead, which feeds the repeat fuse like any other
+     * denial. Allowed siblings in the same batch still execute; `pace` and the meta-tool family always
+     * pass through. `"registered"` is the escape hatch restoring the pre-gate permissive behavior (any
+     * registered tool the model names executes, even if it was gated out of the tools schema).
+     */
+    toolDispatchGate?: "exposed" | "registered";
     /** P0-C: optional per-turn metrics sink for tool-gating telemetry (see `TurnMetrics`). Pure
      *  observation; invoked once per LLM turn. Never throws into the run loop (errors are swallowed). */
     onTurnMetrics?: (metrics: TurnMetrics) => void;
@@ -224,7 +253,7 @@ export interface RuntimeOptions {
     dreamProvider?: LLMProvider;
     dreamSummarizer?: DreamSummarizer;
     dreamSystemPrompt?: string;
-    resultSpool?: LargeResultSpool;
+    payloadStore?: PayloadStore;
 }
 export type OperationCancellationReason = "user" | "deadline" | "lease_lost" | "host_shutdown";
 export declare class RuntimeRunner {
@@ -236,6 +265,7 @@ export declare class RuntimeRunner {
     private pendingObservations;
     private activeKernel;
     private currentSessionId;
+    private fallbackPayloadStore;
     /** O2 (system-reminder channel): host-pushed notes awaiting the next turn-boundary drain. */
     private injectedSignals;
     /** Skill names whose content has already been pushed into the durable `knowledge` slot this
@@ -249,11 +279,14 @@ export declare class RuntimeRunner {
     private nextArchiveStart;
     private pendingPageOutArchives;
     private activePageOutArchive;
-    /** M5 v2.1: sub-workflow specs a top-level agent authored via `start_workflow`, awaiting auto-drive
-     *  at the next safe point (after the tool turn resolves, kernel back in Reason). */
-    private pendingAuthoredWorkflows;
+    /** Provider continuation emitted after a canonical nested workflow completes. */
     private workflowContinuation;
     constructor(opts: RuntimeOptions);
+    private resolveKernelJournal;
+    private createCanonicalRuntime;
+    private commitKernelApply;
+    private commitKernelMaybeAction;
+    private commitKernelAction;
     get hostOptions(): RuntimeOptions;
     interrupt(reason?: OperationCancellationReason): void;
     /** Push a contextual note into the run's signal stream (the system-reminder channel): it drains at
@@ -290,23 +323,16 @@ export declare class RuntimeRunner {
     pushKnowledge(message: Message, tokens?: number, opts?: {
         key?: string;
         pinned?: boolean;
-    }): void;
+    }): Promise<void>;
+    private payloadStore;
     /** K1: mark a keyed knowledge entry for removal at the next compaction/renewal boundary.
      *  Errs-open: an unknown key is a kernel-side no-op. */
-    removeKnowledge(key: string): void;
+    removeKnowledge(key: string): Promise<void>;
     /** K3: host-driven skill deactivation — toolset re-widens at the next provider call, the
      *  skill's knowledge pin drops at the next boundary. Errs-open: not-active is a no-op. */
-    deactivateSkill(name: string): void;
+    deactivateSkill(name: string): Promise<void>;
     private resolveKernelSuspend;
-    /**
-     * O7: resolve a `read_result` meta-tool call to the full text of a previously-evicted tool
-     * output. Resolution order: (a) the result spool committed by `large_result_spool_result`,
-     * (b) a session-log scan for the original `tool_completed` event carrying that `call_id`.
-     * Slices the resolved text by `[offset, offset + maxBytes)` (plain string slice — "bytes-ish").
-     */
-    private resolveReadResult;
     private execute;
-    spawnSubAgent(spec: AgentRunSpec): Promise<SubAgentResult>;
     /**
      * G3: run one workflow node, enforcing its `output_schema` (if any) by instructing the agent,
      * validating its output (the supported JSON-Schema subset), and re-running once with the errors
@@ -327,44 +353,21 @@ export declare class RuntimeRunner {
      */
     /**
      * Lower the declarative governance / attention / scheduler-budget / resource-quota / memory policies
-     * into a freshly-created kernel. Shared by `execute()` (full run) and `bootstrapWorkflowKernel()`
+     * into a freshly-created kernel. Shared by `execute()` (full run) and `initializeWorkflowKernel()`
      * (standalone workflow) so a DAG's node spawns are gated and quota'd exactly as a mid-run spawn.
-     * Must run BEFORE `start_run`. No config ⇒ native-profile defaults.
+     * Must run before the canonical root start. No config ⇒ native-profile defaults.
      */
     private applyKernelPolicies;
     /**
-     * Bootstrap a standalone kernel for a host-driven workflow with no active parent run — the path a
-     * stateless handler (browser/edge worker) takes when it calls `runWorkflow(spec)` directly. Mirrors
-     * `execute()`'s pre-run setup (policies via `applyKernelPolicies`, then `start_run`) and records a
-     * best-effort `run_started` so the run is resumable. `runWorkflow` tears the kernel down afterward.
+     * Bootstrap a standalone kernel for a host-driven workflow with no active parent run. The caller
+     * durably records `run_started` with the same `runId` before this method can create journal state.
+     * `StartOperation { Workflow }` is the sole root transition; `runWorkflow` tears the kernel down.
      */
-    private bootstrapWorkflowKernel;
+    private initializeWorkflowKernel;
     runWorkflow(spec: WorkflowSpec, opts?: {
-        /** Typed recovered terminal outcomes, including control signals and output. */
-        resumedOutcomes?: RecoveredNodeOutcome[];
-        resumedSubmissions?: Record<string, unknown>[][];
-        /** R3-1: original base index per submission batch (parallel to resumedSubmissions). */
-        resumedSubmissionBases?: number[];
         /** Standalone session id when bootstrapping (no active parent run). Defaults to a fresh uuid. */
         sessionId?: string;
     }): Promise<WorkflowOutcome>;
-    /**
-     * M5/G1: bootstrap an **agent-authored** workflow ("the model writes its own harness"). Routes the
-     * spec through the agent-reachable `Syscall::LoadWorkflow` (`submit_workflow`): with no workflow
-     * active the kernel bootstraps the DAG, else it flattens onto the running one (bootstrap-or-flatten —
-     * one kernel, one quota). The same shared driver runs the resulting batches.
-     */
-    bootstrapWorkflow(spec: WorkflowSpec, opts?: {
-        submitterAgentId?: string;
-    }): Promise<WorkflowOutcome>;
-    /**
-     * M5 v2.1: drive the sub-workflow(s) a top-level agent authored via `start_workflow`, at the safe
-     * point (tool turn resolved → kernel in Reason). Each runs in THIS kernel (the kernel resumes the
-     * reason loop on `workflow_completed`), then the outcome is injected as a user message and a fresh
-     * `call_provider` is synthesized from the updated context (the workflow drive consumed its own
-     * kernel actions — same re-render pattern as the reactive-compact retry path).
-     */
-    private driveAuthoredWorkflows;
     /**
      * #2-B-ii: while a workflow batch is in flight, poll the signal source; a Critical `InterruptNow`
      * routes through the kernel (root in `SubAgentAwait` → preempt → `AgentPreempted` + tears the
@@ -373,20 +376,10 @@ export declare class RuntimeRunner {
      */
     private monitorWorkflowPreemption;
     /**
-     * Shared workflow driver for `runWorkflow` (host `load_workflow`) and `bootstrapWorkflow` (agent
-     * `submit_workflow`): run each kernel-emitted batch in parallel, feed completions back (appending any
-     * agent-submitted nodes first), and loop until the kernel reports the workflow complete.
+     * Shared canonical workflow driver: run each kernel-emitted batch in parallel, feed completions
+     * back, and loop until the kernel reports the workflow complete.
      */
     private driveWorkflow;
-    /**
-     * Resume a workflow from the parent session's completed nodes.
-     * Reads the session log, extracts completed workflow node records (with their W-1 control
-     * signals + outputs), and calls runWorkflow so the kernel skips those nodes, replays control
-     * flow (classify prune / loop stop), and the driver re-seeds its outputs map.
-     */
-    resumeWorkflow(spec: WorkflowSpec, opts?: {
-        sessionId?: string;
-    }): Promise<WorkflowOutcome>;
     private appendObservations;
     /** I4 + K4: fetch long-term memory hits for the current goal and land them in `history` as an
      *  ordinary user turn — single-use retrieval content that decays with the compression pyramid,