@deepstrike/wasm 0.2.49 → 0.2.51

package/dist/runtime/session-log.d.ts

@@ -1,11 +1,7 @@
 import type { ProviderReplay, ToolCall, ToolErrorKind } from "../types.js";
 import type { MemoryRecall, MemoryScope } from "../memory/index.js";
 import type { KernelPrimitive } from "./kernel-event-log.js";
-import type { DurableAppendReceipt, KernelGenesisReceipt, KernelOperationGenesis, KernelTransaction } from "./kernel-transaction-log.js";
-export interface KernelTransactionEntry {
-    log_seq: number;
-    transaction: KernelTransaction;
-}
+import type { KernelJournal } from "./kernel-journal.js";
 export type RollbackReason = {
     kind: "fatal_tool_error";
     tool_name: string;
@@ -98,14 +94,6 @@ export type SessionEvent = {
     kind: "page_in";
     turn: number;
     entry_count: number;
-} | {
-    kind: "large_result_spooled";
-    turn: number;
-    call_id: string;
-    tool: string;
-    original_size: number;
-    preview_size: number;
-    spool_ref?: string;
 } | {
     kind: "rollbacked";
     turn: number;
@@ -204,7 +192,9 @@ export type SessionEvent = {
     kind: "agent_process_changed";
     turn: number;
     agent_id: string;
-    parent_session_id: string;
+    parent_task_id?: string;
+    /** Host audit identity; canonical kernel observations never populate it. */
+    parent_session_id?: string;
     role: string;
     isolation: string;
     context_inheritance: string;
@@ -267,6 +257,11 @@ export type SessionEvent = {
     turn: number;
     node_outcomes: import("./types/agent.js").KernelWorkflowNodeOutcome[];
     total_nodes: number;
+} | {
+    kind: "kernel_observation";
+    turn: number;
+    observation_kind: string;
+    raw: Record<string, unknown>;
 } | {
     kind: "run_terminal";
     reason: string;
@@ -277,6 +272,11 @@ export type SessionEvent = {
     compressed_seq: number;
     summary: string;
 };
+/**
+ * The business-projection log (spec §9.2): run started/terminal, stream events, observations,
+ * provider/tool presentation, and audit metadata. Canonical durable records live exclusively in
+ * `KernelJournal` (spec §9.1).
+ */
 export interface SessionLog {
     append(sessionId: string, event: SessionEvent): Promise<number>;
     read(sessionId: string, fromSeq?: number, primitiveFilter?: KernelPrimitive): Promise<Array<{
@@ -284,18 +284,20 @@ export interface SessionLog {
         event: SessionEvent;
     }>>;
     latestSeq(sessionId: string): Promise<number>;
-    appendKernelGenesis(sessionId: string, genesis: KernelOperationGenesis): Promise<KernelGenesisReceipt>;
-    readKernelGenesis(sessionId: string, operationId: string): Promise<KernelOperationGenesis | undefined>;
-    compareAndAppendKernelTransaction(sessionId: string, expectedTransactionHead: string, transaction: KernelTransaction): Promise<DurableAppendReceipt>;
-    readKernelTransactions(sessionId: string, operationId: string, fromStepSeq?: number): Promise<KernelTransactionEntry[]>;
-    kernelTransactionHead(sessionId: string, operationId: string): Promise<string | undefined>;
 }
+/**
+ * **Single-isolate dev/test implementation** of both capabilities (spec §9.4: one class may
+ * implement several capabilities; the *interfaces* stay separate). Its `KernelJournal` half is
+ * `InMemoryKernelJournal`, whose CAS is atomic within one isolate only. A host whose journal must
+ * outlive its isolate — or be shared with another one — injects a `DriverKernelJournal` over a
+ * durable `JournalStorageDriver` instead.
+ */
 export declare class InMemorySessionLog implements SessionLog {
     private store;
+    /** Business event sequence space only — journal records number themselves by `step_seq`. */
     private seqCounters;
-    private genesisStore;
-    private transactionStore;
-    private operationKey;
+    /** The durable transaction capability, held rather than inherited (spec §9.1/§9.4). */
+    readonly kernelJournal: KernelJournal;
     private nextSeq;
     append(sessionId: string, event: SessionEvent): Promise<number>;
     read(sessionId: string, fromSeq?: number, primitiveFilter?: KernelPrimitive): Promise<Array<{
@@ -303,9 +305,4 @@ export declare class InMemorySessionLog implements SessionLog {
         event: SessionEvent;
     }>>;
     latestSeq(sessionId: string): Promise<number>;
-    appendKernelGenesis(sessionId: string, genesis: KernelOperationGenesis): Promise<KernelGenesisReceipt>;
-    readKernelGenesis(sessionId: string, operationId: string): Promise<KernelOperationGenesis | undefined>;
-    compareAndAppendKernelTransaction(sessionId: string, expectedTransactionHead: string, transaction: KernelTransaction): Promise<DurableAppendReceipt>;
-    readKernelTransactions(sessionId: string, operationId: string, fromStepSeq?: number): Promise<KernelTransactionEntry[]>;
-    kernelTransactionHead(sessionId: string, operationId: string): Promise<string | undefined>;
 }

package/dist/runtime/session-log.js

@@ -1,13 +1,18 @@
 import { primitiveForKind } from "./kernel-event-log.js";
-import { KernelLogConflictError, KernelLogIntegrityError, verifyKernelOperationGenesis, verifyKernelTransaction, verifyKernelTransactionSuccessor, } from "./kernel-transaction-log.js";
+import { InMemoryKernelJournal } from "./kernel-journal.js";
+/**
+ * **Single-isolate dev/test implementation** of both capabilities (spec §9.4: one class may
+ * implement several capabilities; the *interfaces* stay separate). Its `KernelJournal` half is
+ * `InMemoryKernelJournal`, whose CAS is atomic within one isolate only. A host whose journal must
+ * outlive its isolate — or be shared with another one — injects a `DriverKernelJournal` over a
+ * durable `JournalStorageDriver` instead.
+ */
 export class InMemorySessionLog {
     store = new Map();
+    /** Business event sequence space only — journal records number themselves by `step_seq`. */
     seqCounters = new Map();
-    genesisStore = new Map();
-    transactionStore = new Map();
-    operationKey(sessionId, operationId) {
-        return `${sessionId}\u0000${operationId}`;
-    }
+    /** The durable transaction capability, held rather than inherited (spec §9.1/§9.4). */
+    kernelJournal = new InMemoryKernelJournal();
     nextSeq(sessionId) {
         const seq = this.seqCounters.get(sessionId) ?? 0;
         this.seqCounters.set(sessionId, seq + 1);
@@ -34,50 +39,4 @@ export class InMemorySessionLog {
     async latestSeq(sessionId) {
         return (this.seqCounters.get(sessionId) ?? 0) - 1;
     }
-    async appendKernelGenesis(sessionId, genesis) {
-        await verifyKernelOperationGenesis(genesis);
-        const operationKey = this.operationKey(sessionId, genesis.operation_id);
-        const existing = this.genesisStore.get(operationKey);
-        if (existing) {
-            if (existing.genesis.genesis_digest !== genesis.genesis_digest) {
-                throw new KernelLogConflictError("session already has a different kernel operation genesis");
-            }
-            return { log_seq: existing.log_seq, genesis_digest: genesis.genesis_digest };
-        }
-        const log_seq = this.nextSeq(sessionId);
-        this.genesisStore.set(operationKey, { log_seq, genesis });
-        return { log_seq, genesis_digest: genesis.genesis_digest };
-    }
-    async readKernelGenesis(sessionId, operationId) {
-        return this.genesisStore.get(this.operationKey(sessionId, operationId))?.genesis;
-    }
-    async compareAndAppendKernelTransaction(sessionId, expectedTransactionHead, transaction) {
-        await verifyKernelTransaction(transaction);
-        const operationKey = this.operationKey(sessionId, transaction.operation_id);
-        const genesis = this.genesisStore.get(operationKey)?.genesis;
-        if (!genesis)
-            throw new KernelLogIntegrityError("kernel transaction requires a durable genesis");
-        if (transaction.operation_id !== genesis.operation_id) {
-            throw new KernelLogIntegrityError("kernel transaction operation_id does not match genesis");
-        }
-        const head = await this.kernelTransactionHead(sessionId, transaction.operation_id);
-        if (head !== expectedTransactionHead || transaction.previous_transaction_digest !== head) {
-            throw new KernelLogConflictError("kernel transaction head changed before compare-and-append");
-        }
-        const entries = this.transactionStore.get(operationKey) ?? [];
-        verifyKernelTransactionSuccessor(entries.at(-1)?.transaction, transaction);
-        const log_seq = this.nextSeq(sessionId);
-        entries.push({ log_seq, transaction });
-        this.transactionStore.set(operationKey, entries);
-        return { log_seq, transaction_digest: transaction.transaction_digest };
-    }
-    async readKernelTransactions(sessionId, operationId, fromStepSeq = 1) {
-        return (this.transactionStore.get(this.operationKey(sessionId, operationId)) ?? []).filter(entry => entry.transaction.step_seq >= fromStepSeq);
-    }
-    async kernelTransactionHead(sessionId, operationId) {
-        const operationKey = this.operationKey(sessionId, operationId);
-        const entries = this.transactionStore.get(operationKey) ?? [];
-        return entries.at(-1)?.transaction.transaction_digest
-            ?? this.genesisStore.get(operationKey)?.genesis.genesis_digest;
-    }
 }

package/dist/runtime/session-repair.d.ts

@@ -37,8 +37,7 @@ export declare function buildRunTerminalEvent(input: {
 }): Extract<SessionEvent, {
     kind: "run_terminal";
 }>;
-/** Build workflow_node_completed for persistence after a node finishes. W-1: carries the
- *  result-borne control signals + output so resume replays control flow and re-seeds outputs. */
+/** Build the audit projection emitted after a workflow node finishes. */
 export declare function buildWorkflowNodeCompletedEvent(input: {
     turn: number;
     agentId: string;
@@ -51,29 +50,7 @@ export declare function buildWorkflowNodeCompletedEvent(input: {
 }): Extract<SessionEvent, {
     kind: "workflow_node_completed";
 }>;
-/** One recovered node completion: the agent id plus its persisted control signals and output. */
-export interface RecoveredNodeOutcome {
-    agentId: string;
-    status: WorkflowNodeStatus;
-    termination: string;
-    classifyBranch?: string;
-    tournamentWinner?: string;
-    loopContinue?: boolean;
-    output?: Message;
-}
-/**
- * Recover completed workflow node records from a session event stream. Scans for
- * workflow_node_completed events with termination "completed" and returns them WITH their
- * result-borne control signals (W-1) — resumeWorkflow lowers these to the kernel's
- * `resumed_outcomes` so a classifier re-prunes and a loop stop is honored, and re-seeds the
- * driver's outputs map from the persisted output text.
- */
-export declare function recoverWorkflowNodeOutcomes(events: Array<{
-    seq: number;
-    event: SessionEvent;
-}>): RecoveredNodeOutcome[];
-/** R3-1: build workflow_nodes_submitted for persistence after a runtime submission, so resume can
- *  re-apply it. `nodes` is the kernel-shape (snake_case) submitted node array. */
+/** Build the audit projection emitted after a runtime workflow submission. */
 export declare function buildWorkflowNodesSubmittedEvent(input: {
     turn: number;
     nodes: Record<string, unknown>[];
@@ -82,14 +59,3 @@ export declare function buildWorkflowNodesSubmittedEvent(input: {
 }): Extract<SessionEvent, {
     kind: "workflow_nodes_submitted";
 }>;
-/** R3-1: recover the runtime submission batches (in order) to rebuild `resumed_submissions` for
- *  resumeWorkflow, so dynamically-appended nodes are reconstructed.
- *  `submitters` is parallel to `submissions` (undefined = host/bootstrap submission). */
-export declare function recoverSubmittedWorkflowNodes(events: Array<{
-    seq: number;
-    event: SessionEvent;
-}>): {
-    submissions: Record<string, unknown>[][];
-    bases: number[];
-    submitters: Array<string | undefined>;
-};

package/dist/runtime/session-repair.js

@@ -48,8 +48,7 @@ export function buildRunTerminalEvent(input) {
         total_tokens: Math.max(0, input.totalTokens),
     };
 }
-/** Build workflow_node_completed for persistence after a node finishes. W-1: carries the
- *  result-borne control signals + output so resume replays control flow and re-seeds outputs. */
+/** Build the audit projection emitted after a workflow node finishes. */
 export function buildWorkflowNodeCompletedEvent(input) {
     return {
         kind: "workflow_node_completed",
@@ -63,32 +62,7 @@ export function buildWorkflowNodeCompletedEvent(input) {
         ...(input.output ? { output: input.output } : {}),
     };
 }
-/**
- * Recover completed workflow node records from a session event stream. Scans for
- * workflow_node_completed events with termination "completed" and returns them WITH their
- * result-borne control signals (W-1) — resumeWorkflow lowers these to the kernel's
- * `resumed_outcomes` so a classifier re-prunes and a loop stop is honored, and re-seeds the
- * driver's outputs map from the persisted output text.
- */
-export function recoverWorkflowNodeOutcomes(events) {
-    const completed = [];
-    for (const { event } of events) {
-        if (event.kind === "workflow_node_completed") {
-            completed.push({
-                agentId: event.agent_id,
-                status: event.status,
-                termination: event.termination,
-                ...(event.classify_branch !== undefined ? { classifyBranch: event.classify_branch } : {}),
-                ...(event.tournament_winner !== undefined ? { tournamentWinner: event.tournament_winner } : {}),
-                ...(event.loop_continue !== undefined ? { loopContinue: event.loop_continue } : {}),
-                ...(event.output !== undefined ? { output: event.output } : {}),
-            });
-        }
-    }
-    return completed;
-}
-/** R3-1: build workflow_nodes_submitted for persistence after a runtime submission, so resume can
- *  re-apply it. `nodes` is the kernel-shape (snake_case) submitted node array. */
+/** Build the audit projection emitted after a runtime workflow submission. */
 export function buildWorkflowNodesSubmittedEvent(input) {
     return {
         kind: "workflow_nodes_submitted",
@@ -98,22 +72,3 @@ export function buildWorkflowNodesSubmittedEvent(input) {
         ...(input.submitterAgentId !== undefined ? { submitter_agent_id: input.submitterAgentId } : {}),
     };
 }
-/** R3-1: recover the runtime submission batches (in order) to rebuild `resumed_submissions` for
- *  resumeWorkflow, so dynamically-appended nodes are reconstructed.
- *  `submitters` is parallel to `submissions` (undefined = host/bootstrap submission). */
-export function recoverSubmittedWorkflowNodes(events) {
-    const submissions = [];
-    const bases = [];
-    const submitters = [];
-    for (const { event } of events) {
-        if (event.kind === "workflow_nodes_submitted") {
-            submissions.push(event.nodes);
-            submitters.push(event.submitter_agent_id);
-            if (event.base_index === undefined) {
-                throw new Error("workflow_nodes_submitted is missing required base_index");
-            }
-            bases.push(event.base_index);
-        }
-    }
-    return { submissions, bases, submitters };
-}

package/dist/runtime/sub-agent-orchestrator.d.ts

@@ -39,5 +39,5 @@ export declare class SubAgentOrchestrator {
     run(ctx: SubAgentRunContext): Promise<SubAgentResult>;
 }
 export declare const defaultSubAgentOrchestrator: SubAgentOrchestrator;
-/** Kernel spawn without an active parent run loop (harness / coordinator use). */
-export declare function spawnStandalone(parentOpts: RuntimeOptions, parentSessionId: string, spec: AgentRunSpec, orchestrator?: SubAgentOrchestrator): Promise<SubAgentResult>;
+/** Canonical single-node root workflow for harness / coordinator use. */
+export declare function spawnStandalone(parentOpts: RuntimeOptions, parentSessionId: string, spec: AgentRunSpec, orchestrator?: SubAgentOrchestrator, contextInput?: string): Promise<SubAgentResult>;

package/dist/runtime/sub-agent-orchestrator.js

@@ -1,6 +1,4 @@
-import { agentRunSpecToKernel, findSpawnProcessObservation, spawnObservationToManifest } from "./types/agent.js";
 import { FilteredExecutionPlane } from "./filtered-plane.js";
-import { kernelApply } from "./kernel-step.js";
 /** #2-B-ii: bridge a parent AbortSignal to a child runner's `interrupt()` (fires now if already aborted). */
 function linkAbort(signal, runner) {
     if (!signal)
@@ -121,8 +119,6 @@ export class SubAgentOrchestrator {
             dreamStore: metaTools.has("memory") ? ctx.parentOpts.dreamStore : undefined,
             knowledgeSource: metaTools.has("knowledge") ? ctx.parentOpts.knowledgeSource : undefined,
             enablePlanTool: metaTools.has("update_plan") ? ctx.parentOpts.enablePlanTool : undefined,
-            // M5 v2.1: a workflow node's `start_workflow` flattens to the parent kernel (no nested pivot).
-            isWorkflowNode: ctx.isWorkflowNode,
             // The child runs under ITS OWN spec, never the parent's: the spread above would otherwise
             // leak the parent's `runSpec` (identity, capability filter — and an armed `loopRound`,
             // giving every child a phantom pace tool). A loop-node iteration carries its own minimal
@@ -167,42 +163,42 @@ export class SubAgentOrchestrator {
     }
 }
 export const defaultSubAgentOrchestrator = new SubAgentOrchestrator();
-/** Kernel spawn without an active parent run loop (harness / coordinator use). */
-export async function spawnStandalone(parentOpts, parentSessionId, spec, orchestrator = defaultSubAgentOrchestrator) {
-    const kernel = await (await import("./kernel.js")).getKernel();
-    const runtime = new kernel.KernelRuntime({
-        maxTokens: parentOpts.maxTokens,
-        maxTurns: parentOpts.maxTurns ?? 25,
-        timeoutMs: parentOpts.timeoutMs,
-    });
-    const pending = [];
-    kernelApply(runtime, pending, { kind: "start_run", task: { goal: "coordinator", criteria: [] } });
-    const observations = kernelApply(runtime, pending, {
-        kind: "spawn_sub_agent",
-        spec: agentRunSpecToKernel(spec),
-        parent_session_id: parentSessionId,
-    });
-    const spawned = findSpawnProcessObservation(observations);
-    if (!spawned) {
-        throw new Error("spawn_sub_agent did not emit agent_process_changed");
+/** Canonical single-node root workflow for harness / coordinator use. */
+export async function spawnStandalone(parentOpts, parentSessionId, spec, orchestrator = defaultSubAgentOrchestrator, contextInput) {
+    if (spec.tokenBudget !== undefined || spec.maxTurns !== undefined || spec.maxWallMs !== undefined) {
+        throw new Error("spawnStandalone cannot represent per-node resource caps under canonical ABI v3");
     }
-    const manifest = spawnObservationToManifest(spawned, spec, parentSessionId);
-    await parentOpts.sessionLog.append(parentSessionId, {
-        kind: "agent_process_changed",
-        turn: manifest.turn ?? 0,
-        agent_id: manifest.agent_id,
-        parent_session_id: manifest.parent_session_id,
-        role: manifest.role,
-        isolation: manifest.isolation,
-        context_inheritance: manifest.context_inheritance,
-        state: "running",
-        permitted_capability_ids: manifest.permitted_capability_ids ?? [],
-    });
-    return orchestrator.run({
-        parentOpts,
-        parentSessionId,
-        spec,
-        manifest,
-        sessionLog: parentOpts.sessionLog,
+    const { RuntimeRunner } = await import("./runner.js");
+    let captured;
+    const bridge = {
+        async run(ctx) {
+            const child = await orchestrator.run({
+                ...ctx,
+                parentSessionId,
+                spec,
+                manifest: {
+                    ...ctx.manifest,
+                    agent_id: spec.identity.agentId,
+                    parent_session_id: parentSessionId,
+                },
+                ...(contextInput ? { contextInput } : {}),
+            });
+            captured = child;
+            return { ...child, agentId: ctx.manifest.agent_id };
+        },
+    };
+    const runner = new RuntimeRunner({ ...parentOpts, subAgentOrchestrator: bridge });
+    const outcome = await runner.runWorkflow({
+        nodes: [{
+                task: spec.goal,
+                role: spec.role,
+                isolation: spec.isolation,
+                ...(spec.modelHint ? { modelHint: spec.modelHint } : {}),
+            }],
     });
+    if (outcome.rejection)
+        throw new Error(`canonical standalone spawn rejected: ${outcome.rejection.reason}`);
+    if (!captured)
+        throw new Error("canonical standalone spawn completed without a child result");
+    return captured;
 }

package/dist/runtime/types/agent.d.ts

@@ -41,6 +41,14 @@ export interface AgentRunSpec {
     /** ③ loop-agent rounds: presence makes this run ONE round of a paced loop (gates the
      *  kernel `pace` meta-tool and arms the pacing trap). */
     loopRound?: LoopRoundSpec;
+    /** Exposure baseline — the PRE-ACTIVATION tool surface *under* the `capabilityFilter` ceiling.
+     *  The ceiling bounds what this run may EVER expose; the baseline selects which of those are
+     *  advertised before any skill activates, so `exposed = meta ∪ ((baseline ∪ stableCore ∪
+     *  ⋃ activeSkills.allowed_tools) ∩ ceiling)`. That makes narrow→wide progressive disclosure
+     *  expressible. Absent ⇒ legacy behavior. `[]` is meaningful and distinct from absent: the minimal
+     *  surface (meta-tools + stable-core only). Entries outside the ceiling silently intersect away.
+     *  Lowered from `RuntimeOptions.baselineToolIds`. */
+    exposureBaseline?: string[];
     /** M1/G3: per-agent model preference; the host resolves it via `RuntimeOptions.providerFor`.
      *  Host-side routing only — not sent to the kernel. */
     modelHint?: string;
@@ -71,12 +79,6 @@ export interface AgentProcessChangedObservation {
     permitted_capability_ids?: string[];
     result_termination?: string;
 }
-/** Map kernel spawn observation → host manifest. */
-export declare function spawnObservationToManifest(obs: AgentProcessChangedObservation | Record<string, unknown>, spec: AgentRunSpec, parentSessionId: string): AgentProcessChangedObservation;
-export declare function findSpawnProcessObservation(observations: Array<{
-    kind: string;
-    agent_id?: string;
-}>): AgentProcessChangedObservation | undefined;
 export interface LoopResult {
     termination: TerminationReason | string;
     finalMessage?: Message;
@@ -125,6 +127,18 @@ export declare function milestoneCheckResultToKernel(result: MilestoneCheckResul
 export declare function subAgentResultToKernel(result: SubAgentResult): Record<string, unknown>;
 export declare function milestoneCheckPass(phaseId: string): MilestoneCheckResult;
 export declare function milestoneCheckFail(phaseId: string, reason: string): MilestoneCheckResult;
+/**
+ * R-B27: the conservative resolution the runner feeds back when an `evaluate_milestone` effect
+ * arrives with no phase `verifier` and no host `onMilestoneEvaluate` hook. Nothing can attest the
+ * phase, but the kernel is already holding the effect in its pending table — returning without an
+ * answer leaves a dangling effect that a logical-checkpoint recovery cannot resolve. The current
+ * `MilestoneResult` wire has no error field, so "could not be verified" is expressed with the
+ * shape the wire does have: `passed: false` (the phase does not advance — fail-closed).
+ *
+ * The string is part of the cross-SDK contract: Node (`node/src/types/agent.ts`),
+ * Python (`deepstrike/types/agent.py`) and Rust must feed back the byte-identical reason.
+ */
+export declare const MILESTONE_UNVERIFIED_REASON = "milestone unverified: no verifier configured and no host evaluation hook (fail-closed)";
 /** A task for a workflow node: a full object, or a bare goal string. */
 export type WorkflowTaskSpec = {
     goal: string;
@@ -267,19 +281,10 @@ export interface WorkflowBudget {
 }
 /** G4: a concise budget note appended to a coordinator node's goal. "" when nothing is bounded. */
 export declare function workflowBudgetNote(budget: WorkflowBudget | undefined): string;
-/** Map one host `WorkflowNodeSpec` to its snake_case kernel JSON. Shared by `load_workflow` and
+/** Map one host `WorkflowNodeSpec` to its snake_case canonical JSON. Shared by the workflow root and
  *  `submit_workflow_nodes` (R3-1) so the two encodings never drift. */
 export declare function workflowNodeSpecToKernel(n: WorkflowNodeSpec): Record<string, unknown>;
 export declare function workflowSpecToKernel(spec: WorkflowSpec): Record<string, unknown>;
-/** R3-1: map a batch of host nodes to the `submit_workflow_nodes` kernel event body. G1: pass
- *  `submitterAgentId` so the kernel enforces no-privilege-escalation (quarantined submitter ⇒ its
- *  nodes coerced to quarantined). Omitted ⇒ no coercion. */
-export declare function submitWorkflowNodesToKernel(nodes: WorkflowNodeSpec[], submitterAgentId?: string): Record<string, unknown>;
-/** M5/G1: map an agent-authored spec to the `submit_workflow` kernel event body (the agent-reachable
- *  `Syscall::LoadWorkflow`). The kernel bootstraps the DAG when none is active, else flattens onto it.
- *  `parentSessionId` seeds child session ids on bootstrap; `submitterAgentId` carries G1 trust coercion
- *  on the flatten case. */
-export declare function submitWorkflowToKernel(spec: WorkflowSpec, parentSessionId: string, submitterAgentId?: string): Record<string, unknown>;
 export declare const submitWorkflowNodesTool: ToolSchema;
 /** M5 v1 (flatten): the tool an agent calls to author a sub-workflow — a cohesive DAG of nodes
  *  composed onto the running workflow. Lowers to the same append path as `submit_workflow_nodes`

package/dist/runtime/types/agent.js

@@ -1,22 +1,4 @@
 import { getKernel } from "../kernel.js";
-/** Map kernel spawn observation → host manifest. */
-export function spawnObservationToManifest(obs, spec, parentSessionId) {
-    const o = obs;
-    return {
-        kind: "agent_process_changed",
-        turn: o.turn,
-        agent_id: String(o.agent_id ?? spec.identity.agentId),
-        parent_session_id: String(o.parent_session_id ?? parentSessionId),
-        role: String(o.role ?? spec.role),
-        isolation: String(o.isolation ?? spec.isolation ?? "shared"),
-        context_inheritance: String(o.context_inheritance ?? "none"),
-        permitted_capability_ids: o.permitted_capability_ids ?? [],
-    };
-}
-export function findSpawnProcessObservation(observations) {
-    const hit = observations.find(o => o.kind === "agent_process_changed" && typeof o.agent_id === "string");
-    return hit;
-}
 export function agentIdentitySub(agentId, sessionId, parentSessionId) {
     return {
         agentId,
@@ -54,6 +36,11 @@ export function agentRunSpecToKernel(spec) {
             ...(spec.loopRound.defaultAction !== undefined ? { default_action: spec.loopRound.defaultAction } : {}),
         };
     }
+    // Exposure baseline: `undefined` ⇒ omit the field entirely (kernel `None` = legacy behavior);
+    // `[]` ⇒ send `[]` (kernel `Some([])` = the minimal surface). The unset/minimal distinction is
+    // load-bearing, so this is deliberately NOT the `length > 0` idiom `allowedToolIds` uses.
+    if (spec.exposureBaseline !== undefined)
+        out.exposure_baseline = [...spec.exposureBaseline];
     return out;
 }
 export function milestoneContractToKernel(contract) {
@@ -91,6 +78,9 @@ export function subAgentResultToKernel(result) {
     const finalMessage = result.result.finalMessage;
     return {
         agent_id: result.agentId,
+        ...(result.submittedNodes?.length
+            ? { submitted_nodes: result.submittedNodes.map(workflowNodeSpecToKernel) }
+            : {}),
         result: {
             termination: result.result.termination,
             final_message: finalMessage
@@ -121,6 +111,18 @@ export function milestoneCheckPass(phaseId) {
 export function milestoneCheckFail(phaseId, reason) {
     return { phaseId, passed: false, reason };
 }
+/**
+ * R-B27: the conservative resolution the runner feeds back when an `evaluate_milestone` effect
+ * arrives with no phase `verifier` and no host `onMilestoneEvaluate` hook. Nothing can attest the
+ * phase, but the kernel is already holding the effect in its pending table — returning without an
+ * answer leaves a dangling effect that a logical-checkpoint recovery cannot resolve. The current
+ * `MilestoneResult` wire has no error field, so "could not be verified" is expressed with the
+ * shape the wire does have: `passed: false` (the phase does not advance — fail-closed).
+ *
+ * The string is part of the cross-SDK contract: Node (`node/src/types/agent.ts`),
+ * Python (`deepstrike/types/agent.py`) and Rust must feed back the byte-identical reason.
+ */
+export const MILESTONE_UNVERIFIED_REASON = "milestone unverified: no verifier configured and no host evaluation hook (fail-closed)";
 export function workflowNodeStatusFromTermination(termination) {
     if (termination === "completed")
         return "completed";
@@ -197,7 +199,7 @@ function nodeKindToKernel(n) {
         return { type: "tournament", entrants: n.tournament.entrants.map(workflowTaskToKernel) };
     return undefined;
 }
-/** Map one host `WorkflowNodeSpec` to its snake_case kernel JSON. Shared by `load_workflow` and
+/** Map one host `WorkflowNodeSpec` to its snake_case canonical JSON. Shared by the workflow root and
  *  `submit_workflow_nodes` (R3-1) so the two encodings never drift. */
 export function workflowNodeSpecToKernel(n) {
     const kind = nodeKindToKernel(n);
@@ -223,28 +225,6 @@ export function workflowNodeSpecToKernel(n) {
 export function workflowSpecToKernel(spec) {
     return { nodes: spec.nodes.map(workflowNodeSpecToKernel) };
 }
-/** R3-1: map a batch of host nodes to the `submit_workflow_nodes` kernel event body. G1: pass
- *  `submitterAgentId` so the kernel enforces no-privilege-escalation (quarantined submitter ⇒ its
- *  nodes coerced to quarantined). Omitted ⇒ no coercion. */
-export function submitWorkflowNodesToKernel(nodes, submitterAgentId) {
-    return {
-        kind: "submit_workflow_nodes",
-        nodes: nodes.map(workflowNodeSpecToKernel),
-        ...(submitterAgentId ? { submitter_agent_id: submitterAgentId } : {}),
-    };
-}
-/** M5/G1: map an agent-authored spec to the `submit_workflow` kernel event body (the agent-reachable
- *  `Syscall::LoadWorkflow`). The kernel bootstraps the DAG when none is active, else flattens onto it.
- *  `parentSessionId` seeds child session ids on bootstrap; `submitterAgentId` carries G1 trust coercion
- *  on the flatten case. */
-export function submitWorkflowToKernel(spec, parentSessionId, submitterAgentId) {
-    return {
-        kind: "submit_workflow",
-        spec: workflowSpecToKernel(spec),
-        parent_session_id: parentSessionId,
-        ...(submitterAgentId ? { submitter_agent_id: submitterAgentId } : {}),
-    };
-}
 /** R3-1: the tool a workflow-coordinator node's agent calls to append work to the running DAG. */
 /** Shared JSON-Schema for a workflow-node batch (a DAG). Used by both `submit_workflow_nodes`
  *  (append) and `start_workflow` (M5 v1: author a sub-workflow), so the two tools never drift. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepstrike/wasm",
-  "version": "0.2.49",
+  "version": "0.2.51",
   "description": "DeepStrike WASM SDK — browser, Cloudflare Workers, Deno Deploy",
   "type": "module",
   "main": "dist/index.js",
@@ -12,10 +12,11 @@
   "scripts": {
     "build:wasm": "wasm-pack build ../crates/deepstrike-wasm --target bundler --out-dir ../../wasm/pkg",
     "build": "tsc",
-    "test": "node --experimental-vm-modules node_modules/.bin/jest"
+    "test": "node --experimental-vm-modules node_modules/.bin/jest",
+    "test:canonical-binding": "wasm-pack build ../crates/deepstrike-wasm --target nodejs --dev --out-dir ../../wasm/pkg-node && node tests/canonical-binding.node.cjs"
   },
   "dependencies": {
-    "@deepstrike/wasm-kernel": "0.2.49"
+    "@deepstrike/wasm-kernel": "0.2.51"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",

package/dist/runtime/kernel-rebuild.d.ts

@@ -1,8 +0,0 @@
-import type { KernelRuntimeHandle } from "./kernel-step.js";
-import { type KernelOperationCursor, type KernelOperationGenesis, type KernelTransaction } from "./kernel-transaction-log.js";
-export interface KernelRebuildResult {
-    runtime: KernelRuntimeHandle;
-    cursor: KernelOperationCursor;
-}
-/** Deterministically fold an authoritative stream into a fresh WASM runtime. */
-export declare function rebuildKernelRuntime(runtime: KernelRuntimeHandle, genesis: KernelOperationGenesis, transactions: readonly KernelTransaction[]): Promise<KernelRebuildResult>;