@deepstrike/wasm 0.2.6 → 0.2.8

package/dist/index.d.ts

@@ -3,7 +3,8 @@ export type { NativeOsProfile, OsProfileId, MemoryPolicy, MemoryWriteRateLimit,
 export { FilteredExecutionPlane } from "./runtime/filtered-plane.js";
 export { SubAgentOrchestrator, defaultSubAgentOrchestrator, spawnStandalone } from "./runtime/sub-agent-orchestrator.js";
 export type { SubAgentRunContext } from "./runtime/sub-agent-orchestrator.js";
-export type { AgentCapabilityFilter, AgentIdentity, AgentIsolation, AgentRunSpec, AgentProcessChangedObservation, ContextInheritance, KernelAgentRole, LoopResult, MilestoneCheckResult, MilestoneContract, MilestonePhase, MilestonePolicy, SubAgentResult, TerminationReason, } from "./runtime/types/agent.js";
+export type { AgentCapabilityFilter, AgentIdentity, AgentIsolation, AgentRunSpec, AgentProcessChangedObservation, ContextInheritance, KernelAgentRole, LoopResult, MilestoneCheckResult, MilestoneContract, MilestonePhase, MilestonePolicy, SubAgentResult, TerminationReason, WorkflowSpec, WorkflowNodeSpec, WorkflowTaskSpec, WorkflowSpawnInfo, } from "./runtime/types/agent.js";
+export { workflowSpecToKernel, fanoutSynthesize, generateAndFilter, verifyRules } from "./runtime/types/agent.js";
 export { Governance } from "./governance.js";
 export type { GovernanceVerdict } from "./governance.js";
 export { AnthropicProvider } from "./providers/anthropic.js";

package/dist/index.js

@@ -1,6 +1,7 @@
 export { RuntimeRunner, collectText, InMemorySessionLog, LocalExecutionPlane, DEFAULT_NATIVE_ATTENTION_POLICY, DEFAULT_NATIVE_GOVERNANCE_POLICY, DEFAULT_SANDBOX_POLICY, assertNativeProfile, osProfile, validateDeclarativePolicy, } from "./runtime/index.js";
 export { FilteredExecutionPlane } from "./runtime/filtered-plane.js";
 export { SubAgentOrchestrator, defaultSubAgentOrchestrator, spawnStandalone } from "./runtime/sub-agent-orchestrator.js";
+export { workflowSpecToKernel, fanoutSynthesize, generateAndFilter, verifyRules } from "./runtime/types/agent.js";
 export { Governance } from "./governance.js";
 export { AnthropicProvider } from "./providers/anthropic.js";
 export { OpenAIProvider, QwenProvider, DeepSeekProvider, MiniMaxProvider, KimiProvider } from "./providers/openai.js";

package/dist/providers/anthropic.d.ts

@@ -1,10 +1,11 @@
-import type { RenderedContext, ToolSchema, StreamEvent, LLMProvider, Message, ProviderReplay } from "../types.js";
+import type { RenderedContext, ToolSchema, StreamEvent, LLMProvider, Message, ProviderDescriptor, ProviderReplay } from "../types.js";
 export declare class AnthropicProvider implements LLMProvider {
     private readonly apiKey;
     private readonly model;
     private readonly maxTokens;
     private nativeAssistantBlocks;
     constructor(apiKey: string, model?: string, maxTokens?: number);
+    descriptor(): ProviderDescriptor;
     peekProviderReplay(message: Pick<Message, "content" | "toolCalls">): ProviderReplay | undefined;
     seedProviderReplay(message: Pick<Message, "content" | "toolCalls">, replay: ProviderReplay): void;
     complete(context: RenderedContext, tools: ToolSchema[], extensions?: Record<string, unknown>): Promise<Message>;

package/dist/providers/anthropic.js

@@ -17,6 +17,22 @@ export class AnthropicProvider {
         this.model = model;
         this.maxTokens = maxTokens;
     }
+    descriptor() {
+        return {
+            provider: "anthropic",
+            protocol: "anthropic-messages",
+            model: this.model,
+            reasoning: {
+                supported: true,
+                preserveAcrossToolTurns: true,
+                requiresReplayForToolTurns: true,
+            },
+            toolCalls: {
+                supported: true,
+                requiresStrictPairing: true,
+            },
+        };
+    }
     peekProviderReplay(message) {
         const blocks = this.nativeAssistantBlocks.get(assistantReplayKey(message));
         return blocks?.length ? { native_blocks: blocks } : undefined;
@@ -24,7 +40,13 @@ export class AnthropicProvider {
     seedProviderReplay(message, replay) {
         if (replay.native_blocks?.length) {
             this.nativeAssistantBlocks.set(assistantReplayKey(message), replay.native_blocks);
+            return;
         }
+        // Legacy log without persisted native blocks: reconstruct neutral
+        // text + tool_use blocks so a tool-use turn can be replayed.
+        const blocks = reconstructAnthropicBlocks(message);
+        if (blocks.length)
+            this.nativeAssistantBlocks.set(assistantReplayKey(message), blocks);
     }
     async complete(context, tools, extensions) {
         return collectStreamMessage(this.stream(context, tools, extensions));
@@ -154,3 +176,26 @@ export class AnthropicProvider {
         this.nativeAssistantBlocks.set(assistantReplayKey(message), blocks);
     }
 }
+/**
+ * Reconstruct Anthropic assistant content blocks from a neutral transcript when
+ * no provider replay was persisted. Only meaningful for tool-use turns.
+ */
+function reconstructAnthropicBlocks(message) {
+    const toolCalls = message.toolCalls ?? [];
+    if (!toolCalls.length)
+        return [];
+    const blocks = [];
+    if (message.content)
+        blocks.push({ type: "text", text: message.content });
+    for (const tc of toolCalls) {
+        let input = {};
+        try {
+            input = JSON.parse(tc.arguments || "{}");
+        }
+        catch {
+            input = {};
+        }
+        blocks.push({ type: "tool_use", id: tc.id, name: tc.name, input });
+    }
+    return blocks;
+}

package/dist/runtime/kernel-event-log.js

@@ -198,6 +198,26 @@ export function kernelObservationToSessionEvent(obs, turn, opts = {}) {
                 memory_id: obs.memory_id ?? "",
                 error: obs.error ?? "",
             });
+        case "workflow_batch_spawned": {
+            const nodes = obs.nodes ?? [];
+            return withCategory({
+                kind: "workflow_batch_spawned",
+                turn: t,
+                node_count: nodes.length,
+                node_ids: nodes.map((n) => n.agent_id ?? ""),
+            });
+        }
+        case "workflow_completed": {
+            const completed = obs.completed ?? [];
+            const failed = obs.failed ?? [];
+            return withCategory({
+                kind: "workflow_completed",
+                turn: t,
+                completed,
+                failed,
+                total_nodes: completed.length + failed.length,
+            });
+        }
         default:
             return null;
     }

package/dist/runtime/kernel-step.d.ts

@@ -93,6 +93,16 @@ export interface KernelObservation {
     requires_async_response?: boolean;
     /** memory_validation_failed (Phase 7). */
     error?: string;
+    nodes?: Array<{
+        agent_id: string;
+        goal: string;
+        role: string;
+        isolation: string;
+        context_inheritance: string;
+        model_hint?: string;
+    }>;
+    completed?: string[];
+    failed?: string[];
 }
 export declare function toolSchemaToKernel(schema: ToolSchema): Record<string, unknown>;
 export declare function skillMetadataToKernel(skill: SkillMetadata): Record<string, unknown>;

package/dist/runtime/provider-replay.d.ts

@@ -1,6 +1,12 @@
-import type { LLMProvider, Message, ProviderReplay, ToolCall } from "../types.js";
+import type { LLMProvider, Message, ProviderDescriptor, ProviderReplay, ToolCall } from "../types.js";
 import type { SessionEvent } from "./session-log.js";
 export declare function assistantReplayKey(message: Pick<Message, "content" | "toolCalls">): string;
+/**
+ * A stored replay may only be seeded into a provider speaking the same wire
+ * protocol; on a cross-protocol fallback the incompatible envelope is skipped so
+ * the new provider re-serializes neutral context instead.
+ */
+export declare function isReplayCompatibleWithProvider(replay: ProviderReplay, descriptor: ProviderDescriptor | undefined): boolean;
 export declare function seedProviderReplayFromEvents(provider: LLMProvider, events: Array<{
     event: SessionEvent;
 }>): void;

package/dist/runtime/provider-replay.js

@@ -1,21 +1,46 @@
-import { effectiveProviderReplay } from "./session-repair.js";
 export function assistantReplayKey(message) {
     return JSON.stringify({
         content: message.content,
         toolCalls: message.toolCalls ?? [],
     });
 }
+/** Infer the wire protocol a stored replay envelope belongs to (explicit, or by shape for legacy logs). */
+function replayProtocol(replay) {
+    if (replay.protocol)
+        return replay.protocol;
+    if (replay.native_blocks?.length)
+        return "anthropic-messages";
+    if (replay.reasoning_content != null || replay.reasoning_details !== undefined)
+        return "openai-chat";
+    return undefined;
+}
+/**
+ * A stored replay may only be seeded into a provider speaking the same wire
+ * protocol; on a cross-protocol fallback the incompatible envelope is skipped so
+ * the new provider re-serializes neutral context instead.
+ */
+export function isReplayCompatibleWithProvider(replay, descriptor) {
+    if (!descriptor)
+        return true;
+    const protocol = replayProtocol(replay);
+    if (!protocol)
+        return true;
+    return protocol === descriptor.protocol;
+}
 export function seedProviderReplayFromEvents(provider, events) {
     if (!provider.seedProviderReplay)
         return;
+    const descriptor = provider.descriptor?.();
     for (const { event } of events) {
         if (event.kind !== "llm_completed")
             continue;
         const toolCalls = event.tool_calls ?? [];
-        const replay = effectiveProviderReplay(event.content, toolCalls, event.provider_replay);
-        if (!replay)
+        const stored = event.provider_replay;
+        if (stored && !isReplayCompatibleWithProvider(stored, descriptor))
             continue;
-        provider.seedProviderReplay({ content: event.content, toolCalls }, replay);
+        // Pass the message even with no persisted replay: a provider may reconstruct
+        // a legacy replay (e.g. Anthropic native_blocks) from the neutral transcript.
+        provider.seedProviderReplay({ content: event.content, toolCalls }, stored ?? {});
     }
 }
 export function peekProviderReplay(provider, content, toolCalls) {

package/dist/runtime/runner.d.ts

@@ -6,7 +6,7 @@ import type { SignalSource } from "../signals/index.js";
 import type { SessionLog, SessionEvent } from "./session-log.js";
 import type { ExecutionPlane } from "./execution-plane.js";
 import { type GovernancePolicy } from "../governance.js";
-import type { AgentRunSpec, SubAgentResult, MilestonePolicy, MilestoneContract, MilestoneCheckResult } from "./types/agent.js";
+import type { AgentRunSpec, SubAgentResult, MilestonePolicy, MilestoneContract, MilestoneCheckResult, WorkflowSpec } from "./types/agent.js";
 import { type SubAgentOrchestrator } from "./sub-agent-orchestrator.js";
 import { type NativeOsProfile, type OsProfileId } from "./os-profile.js";
 import { LargeResultSpool } from "./large-result-spool.js";
@@ -113,6 +113,26 @@ export declare class RuntimeRunner {
     dream(agentId: string, nowMs?: number): Promise<DreamResult>;
     private execute;
     spawnSubAgent(spec: AgentRunSpec): Promise<SubAgentResult>;
+    /**
+     * W0-ABI: run a declarative workflow DAG. The kernel owns the DAG and gates every node spawn
+     * through the syscall trap; this driver runs each kernel-emitted batch of nodes in parallel,
+     * feeds their results back, and loops until the kernel reports the workflow complete.
+     */
+    runWorkflow(spec: WorkflowSpec, opts?: {
+        resumedCompleted?: string[];
+    }): Promise<{
+        completed: string[];
+        failed: string[];
+    }>;
+    /**
+     * Resume a workflow from the parent session's completed nodes.
+     * Reads the session log, extracts completed workflow node agent_ids, and
+     * calls runWorkflow with resumedCompleted so the kernel skips those nodes.
+     */
+    resumeWorkflow(spec: WorkflowSpec): Promise<{
+        completed: string[];
+        failed: string[];
+    }>;
     private appendObservations;
     private archiveSemanticPageOut;
 }

package/dist/runtime/runner.js

@@ -3,9 +3,9 @@ import { governancePolicyToKernelEvent } from "../governance.js";
 import { getKernel } from "./kernel.js";
 import { peekProviderReplay, seedProviderReplayFromEvents } from "./provider-replay.js";
 import { sanitizeReplayText } from "./replay-sanitize.js";
-import { buildLlmCompletedEvent, buildRunTerminalEvent, repairEventsForRecovery } from "./session-repair.js";
+import { buildLlmCompletedEvent, buildRunTerminalEvent, buildWorkflowNodeCompletedEvent, recoverCompletedWorkflowNodes, repairEventsForRecovery, } from "./session-repair.js";
 import { forceCompact, kernelAction, kernelApply, kernelMaybeAction, messageToKernelMessage, skillMetadataToKernel, toolResultToKernel, toolSchemaToKernel, } from "./kernel-step.js";
-import { agentRunSpecToKernel, findSpawnProcessObservation, milestoneCheckPass, milestoneCheckResultToKernel, spawnObservationToManifest, subAgentResultToKernel, } from "./types/agent.js";
+import { agentRunSpecToKernel, findSpawnProcessObservation, milestoneCheckPass, milestoneCheckResultToKernel, spawnObservationToManifest, subAgentResultToKernel, workflowNodeToManifest, workflowNodeToSpec, workflowSpecToKernel, } from "./types/agent.js";
 import { defaultSubAgentOrchestrator } from "./sub-agent-orchestrator.js";
 import { kernelObservationToSessionEvent, withCategory } from "./kernel-event-log.js";
 import { assertNativeProfile } from "./os-profile.js";
@@ -706,6 +706,68 @@ export class RuntimeRunner {
         });
         return result;
     }
+    /**
+     * W0-ABI: run a declarative workflow DAG. The kernel owns the DAG and gates every node spawn
+     * through the syscall trap; this driver runs each kernel-emitted batch of nodes in parallel,
+     * feeds their results back, and loops until the kernel reports the workflow complete.
+     */
+    async runWorkflow(spec, opts) {
+        if (!this.activeKernel || !this.currentSessionId) {
+            throw new Error("runWorkflow requires an active parent run");
+        }
+        const parentSessionId = this.currentSessionId;
+        const runtime = this.activeKernel;
+        const orchestrator = this.opts.subAgentOrchestrator ?? defaultSubAgentOrchestrator;
+        let observations = kernelApply(runtime, this.pendingObservations, {
+            kind: "load_workflow",
+            spec: workflowSpecToKernel(spec),
+            parent_session_id: parentSessionId,
+            // W0-ABI resume: skip nodes already completed before an interruption.
+            ...(opts?.resumedCompleted && opts.resumedCompleted.length ? { resumed_completed: opts.resumedCompleted } : {}),
+        });
+        for (;;) {
+            const done = observations.find(o => o.kind === "workflow_completed");
+            if (done)
+                return { completed: done.completed ?? [], failed: done.failed ?? [] };
+            const batch = observations.find(o => o.kind === "workflow_batch_spawned");
+            const nodes = batch?.nodes ?? [];
+            if (nodes.length === 0)
+                return { completed: [], failed: [] };
+            const results = await Promise.all(nodes.map(node => orchestrator.run({
+                parentOpts: this.opts,
+                parentSessionId,
+                spec: workflowNodeToSpec(node, parentSessionId),
+                manifest: workflowNodeToManifest(node, parentSessionId),
+                sessionLog: this.opts.sessionLog,
+            })));
+            observations = [];
+            for (const result of results) {
+                observations = kernelApply(runtime, this.pendingObservations, {
+                    kind: "sub_agent_completed",
+                    result: subAgentResultToKernel(result),
+                });
+                // Persist node completion for resume recovery.
+                await this.opts.sessionLog.append(parentSessionId, buildWorkflowNodeCompletedEvent({
+                    turn: runtime.turn(),
+                    agentId: result.agentId,
+                    termination: result.result.termination,
+                }));
+            }
+        }
+    }
+    /**
+     * Resume a workflow from the parent session's completed nodes.
+     * Reads the session log, extracts completed workflow node agent_ids, and
+     * calls runWorkflow with resumedCompleted so the kernel skips those nodes.
+     */
+    async resumeWorkflow(spec) {
+        if (!this.currentSessionId) {
+            throw new Error("resumeWorkflow requires an active parent run");
+        }
+        const events = await this.opts.sessionLog.read(this.currentSessionId);
+        const resumedCompleted = recoverCompletedWorkflowNodes(events);
+        return this.runWorkflow(spec, { resumedCompleted });
+    }
     async appendObservations(sessionId, runtime, nextArchiveStart) {
         const turn = runtime.turn();
         const preservedRefs = runtime.preservedRefs();

package/dist/runtime/session-log.d.ts

@@ -232,6 +232,28 @@ export type SessionEvent = {
     primitive?: KernelPrimitive;
     memory_id: string;
     error: string;
+} | {
+    kind: "workflow_node_completed";
+    turn: number;
+    category?: KernelEventCategory;
+    primitive?: KernelPrimitive;
+    agent_id: string;
+    termination: string;
+} | {
+    kind: "workflow_batch_spawned";
+    turn: number;
+    category?: KernelEventCategory;
+    primitive?: KernelPrimitive;
+    node_count: number;
+    node_ids: string[];
+} | {
+    kind: "workflow_completed";
+    turn: number;
+    category?: KernelEventCategory;
+    primitive?: KernelPrimitive;
+    completed: string[];
+    failed: string[];
+    total_nodes: number;
 } | {
     kind: "run_terminal";
     reason: string;

package/dist/runtime/session-repair.d.ts

@@ -1,8 +1,13 @@
 import type { ProviderReplay, ToolCall } from "../types.js";
 import type { SessionEvent } from "./session-log.js";
 export { REPLAY_CONTENT_MAX_BYTES as RECOVERY_CONTENT_MAX_BYTES } from "./replay-sanitize.js";
-export declare function synthesizeProviderReplay(content: string, toolCalls: ToolCall[]): ProviderReplay | undefined;
-export declare function effectiveProviderReplay(content: string, toolCalls: ToolCall[], stored?: ProviderReplay): ProviderReplay | undefined;
+/**
+ * Normalize a persisted llm_completed event for recovery. Content is sanitized
+ * and token_count backfilled, but the stored `provider_replay` envelope is
+ * passed through verbatim — this layer is provider-neutral and never
+ * synthesizes protocol-specific replay shapes. Legacy reconstruction is the
+ * responsibility of the target provider's `seedProviderReplay`.
+ */
 export declare function normalizeLlmCompleted(event: Extract<SessionEvent, {
     kind: "llm_completed";
 }>, maxBytes?: number): Extract<SessionEvent, {
@@ -31,3 +36,19 @@ export declare function buildRunTerminalEvent(input: {
 }): Extract<SessionEvent, {
     kind: "run_terminal";
 }>;
+export declare function buildWorkflowNodeCompletedEvent(input: {
+    turn: number;
+    agentId: string;
+    termination: string;
+}): Extract<SessionEvent, {
+    kind: "workflow_node_completed";
+}>;
+/**
+ * Recover completed workflow node agent_ids from a session event stream.
+ * Scans for workflow_node_completed events and returns the agent_ids whose
+ * termination was "completed". Used to rebuild resumedCompleted for resumeWorkflow.
+ */
+export declare function recoverCompletedWorkflowNodes(events: Array<{
+    seq: number;
+    event: SessionEvent;
+}>): string[];

package/dist/runtime/session-repair.js

@@ -3,40 +3,17 @@ export { REPLAY_CONTENT_MAX_BYTES as RECOVERY_CONTENT_MAX_BYTES } from "./replay
 function estimateTokenCount(text) {
     return Math.max(1, Math.ceil(text.length / 4));
 }
-function parseToolInput(args) {
-    try {
-        return JSON.parse(args || "{}");
-    }
-    catch {
-        return {};
-    }
-}
-export function synthesizeProviderReplay(content, toolCalls) {
-    if (!toolCalls.length)
-        return undefined;
-    const blocks = [];
-    if (content)
-        blocks.push({ type: "text", text: content });
-    for (const tc of toolCalls) {
-        blocks.push({
-            type: "tool_use",
-            id: tc.id,
-            name: tc.name,
-            input: parseToolInput(tc.arguments),
-        });
-    }
-    return { native_blocks: blocks };
-}
-export function effectiveProviderReplay(content, toolCalls, stored) {
-    if (stored?.native_blocks?.length || stored?.reasoning_content != null) {
-        return stored;
-    }
-    return synthesizeProviderReplay(content, toolCalls);
-}
+/**
+ * Normalize a persisted llm_completed event for recovery. Content is sanitized
+ * and token_count backfilled, but the stored `provider_replay` envelope is
+ * passed through verbatim — this layer is provider-neutral and never
+ * synthesizes protocol-specific replay shapes. Legacy reconstruction is the
+ * responsibility of the target provider's `seedProviderReplay`.
+ */
 export function normalizeLlmCompleted(event, maxBytes) {
     const content = sanitizeReplayText(event.content ?? "", maxBytes);
     const toolCalls = event.tool_calls ?? [];
-    const providerReplay = effectiveProviderReplay(content, toolCalls, event.provider_replay);
+    const providerReplay = event.provider_replay;
     return {
         kind: "llm_completed",
         turn: event.turn,
@@ -71,3 +48,25 @@ export function buildRunTerminalEvent(input) {
         total_tokens: Math.max(0, input.totalTokens),
     };
 }
+export function buildWorkflowNodeCompletedEvent(input) {
+    return {
+        kind: "workflow_node_completed",
+        turn: input.turn,
+        agent_id: input.agentId,
+        termination: input.termination,
+    };
+}
+/**
+ * Recover completed workflow node agent_ids from a session event stream.
+ * Scans for workflow_node_completed events and returns the agent_ids whose
+ * termination was "completed". Used to rebuild resumedCompleted for resumeWorkflow.
+ */
+export function recoverCompletedWorkflowNodes(events) {
+    const completed = [];
+    for (const { event } of events) {
+        if (event.kind === "workflow_node_completed" && event.termination === "completed") {
+            completed.push(event.agent_id);
+        }
+    }
+    return completed;
+}

package/dist/runtime/types/agent.d.ts

@@ -75,3 +75,47 @@ export declare function milestoneCheckResultToKernel(result: MilestoneCheckResul
 export declare function subAgentResultToKernel(result: SubAgentResult): Record<string, unknown>;
 export declare function milestoneCheckPass(phaseId: string): MilestoneCheckResult;
 export declare function milestoneCheckFail(phaseId: string, reason: string): MilestoneCheckResult;
+/** A task for a workflow node: a full object, or a bare goal string. */
+export type WorkflowTaskSpec = {
+    goal: string;
+    criteria?: string[];
+    lane?: string;
+} | string;
+/** One node in a declarative workflow DAG (camelCase host shape). */
+export interface WorkflowNodeSpec {
+    task: WorkflowTaskSpec;
+    role: KernelAgentRole;
+    isolation?: AgentIsolation;
+    contextInheritance?: ContextInheritance;
+    modelHint?: string;
+    /** Indices of nodes this node depends on. */
+    dependsOn?: number[];
+}
+/** A declarative workflow DAG the kernel runs node-by-node, gating each spawn. */
+export interface WorkflowSpec {
+    nodes: WorkflowNodeSpec[];
+}
+/** Per-node spawn descriptor carried in the `workflow_batch_spawned` observation. */
+export interface WorkflowSpawnInfo {
+    agent_id: string;
+    goal: string;
+    role: string;
+    isolation: string;
+    context_inheritance: string;
+    model_hint?: string;
+}
+/** Map a host `WorkflowSpec` to the snake_case kernel JSON (`load_workflow.spec`). */
+export declare function workflowSpecToKernel(spec: WorkflowSpec): Record<string, unknown>;
+/** Build a sub-agent run spec for a kernel-generated workflow node. */
+export declare function workflowNodeToSpec(node: WorkflowSpawnInfo, parentSessionId: string): AgentRunSpec;
+/** Build the host manifest for a kernel-generated workflow node. */
+export declare function workflowNodeToManifest(node: WorkflowSpawnInfo, parentSessionId: string): AgentProcessChangedObservation;
+/** N parallel read-only Explore workers feeding a single Plan synthesizer (barrier). */
+export declare function fanoutSynthesize(workers: WorkflowTaskSpec[], synthesize: WorkflowTaskSpec): WorkflowSpec;
+/** N parallel Implement generators feeding a single Verify filter/dedupe step (barrier). */
+export declare function generateAndFilter(generators: WorkflowTaskSpec[], filter: WorkflowTaskSpec): WorkflowSpec;
+/**
+ * One fresh-context verifier per rule/claim (parallel) + optional skeptic that depends on all and
+ * re-checks flags. Verifiers run read-only with no inherited author context (bias-resistant).
+ */
+export declare function verifyRules(rules: WorkflowTaskSpec[], skeptic?: WorkflowTaskSpec): WorkflowSpec;

package/dist/runtime/types/agent.js

@@ -94,3 +94,111 @@ export function milestoneCheckPass(phaseId) {
 export function milestoneCheckFail(phaseId, reason) {
     return { phaseId, passed: false, reason };
 }
+/** Map a host `WorkflowSpec` to the snake_case kernel JSON (`load_workflow.spec`). */
+export function workflowSpecToKernel(spec) {
+    return {
+        nodes: spec.nodes.map(n => {
+            const task = typeof n.task === "string" ? { goal: n.task } : n.task;
+            return {
+                task: {
+                    goal: task.goal,
+                    // `criteria` is required by the kernel's RuntimeTask serde (no default).
+                    criteria: task.criteria ?? [],
+                    ...(task.lane ? { lane: task.lane } : {}),
+                },
+                role: n.role,
+                isolation: n.isolation ?? "shared",
+                context_inheritance: n.contextInheritance ?? "none",
+                ...(n.modelHint ? { model_hint: n.modelHint } : {}),
+                ...(n.dependsOn && n.dependsOn.length ? { depends_on: n.dependsOn } : {}),
+            };
+        }),
+    };
+}
+/** Build a sub-agent run spec for a kernel-generated workflow node. */
+export function workflowNodeToSpec(node, parentSessionId) {
+    return {
+        identity: {
+            agentId: node.agent_id,
+            sessionId: `${parentSessionId}-${node.agent_id}`,
+            isSubAgent: true,
+            parentSessionId,
+        },
+        role: node.role,
+        isolation: node.isolation,
+        goal: node.goal,
+    };
+}
+/** Build the host manifest for a kernel-generated workflow node. */
+export function workflowNodeToManifest(node, parentSessionId) {
+    return {
+        kind: "agent_process_changed",
+        agent_id: node.agent_id,
+        parent_session_id: parentSessionId,
+        role: node.role,
+        isolation: node.isolation,
+        context_inheritance: node.context_inheritance,
+    };
+}
+// ─── W1/W2 workflow templates (the six patterns as one-liners) ───
+// Roles carry the kernel's role_defaults isolation/inheritance so host-built specs match the
+// core `orchestration::workflow` constructors (e.g. verifiers stay bias-resistant).
+function asTask(t) {
+    return typeof t === "string" ? { goal: t } : t;
+}
+/** N parallel read-only Explore workers feeding a single Plan synthesizer (barrier). */
+export function fanoutSynthesize(workers, synthesize) {
+    const nodes = workers.map(t => ({
+        task: asTask(t),
+        role: "explore",
+        isolation: "read_only",
+        contextInheritance: "system_only",
+    }));
+    nodes.push({
+        task: asTask(synthesize),
+        role: "plan",
+        isolation: "shared",
+        contextInheritance: "full",
+        dependsOn: workers.map((_, i) => i),
+    });
+    return { nodes };
+}
+/** N parallel Implement generators feeding a single Verify filter/dedupe step (barrier). */
+export function generateAndFilter(generators, filter) {
+    const nodes = generators.map(t => ({
+        task: asTask(t),
+        role: "implement",
+        isolation: "worktree",
+        contextInheritance: "full",
+    }));
+    nodes.push({
+        task: asTask(filter),
+        role: "verify",
+        isolation: "read_only",
+        contextInheritance: "none",
+        dependsOn: generators.map((_, i) => i),
+    });
+    return { nodes };
+}
+/**
+ * One fresh-context verifier per rule/claim (parallel) + optional skeptic that depends on all and
+ * re-checks flags. Verifiers run read-only with no inherited author context (bias-resistant).
+ */
+export function verifyRules(rules, skeptic) {
+    const nodes = rules.map(t => ({
+        task: asTask(t),
+        role: "verify",
+        isolation: "read_only",
+        contextInheritance: "none",
+    }));
+    if (skeptic !== undefined) {
+        nodes.push({
+            task: asTask(skeptic),
+            role: "verify",
+            isolation: "read_only",
+            contextInheritance: "none",
+            dependsOn: rules.map((_, i) => i),
+        });
+    }
+    return { nodes };
+}

package/dist/types.d.ts

@@ -112,9 +112,31 @@ export interface ToolArgumentRepairedEvent extends StreamEvent {
  * The framework creates and threads this object; providers may read/write it.
  */
 export type ProviderRunState = Record<string, unknown>;
+export type ProviderProtocol = "anthropic-messages" | "openai-chat" | "openai-responses" | "gemini";
+export interface ProviderDescriptor {
+    provider: string;
+    protocol: ProviderProtocol;
+    model: string;
+    reasoning: {
+        supported: boolean;
+        preserveAcrossToolTurns: boolean;
+        requiresReplayForToolTurns?: boolean;
+    };
+    toolCalls: {
+        supported: boolean;
+        requiresStrictPairing: boolean;
+    };
+}
 export interface ProviderReplay {
+    schema_version?: 1 | 2;
+    provider?: string;
+    protocol?: ProviderProtocol;
+    model?: string;
     native_blocks?: Array<Record<string, unknown>>;
     reasoning_content?: string;
+    reasoning_details?: unknown;
+    native_message?: unknown;
+    tool_calls?: unknown[];
 }
 export interface LLMProvider {
     createRunState?(): ProviderRunState;
@@ -122,6 +144,7 @@ export interface LLMProvider {
         maxTurns?: number;
         timeoutMs?: number;
     };
+    descriptor?(): ProviderDescriptor;
     peekProviderReplay?(message: Pick<Message, "content" | "toolCalls">): ProviderReplay | undefined;
     seedProviderReplay?(message: Pick<Message, "content" | "toolCalls">, replay: ProviderReplay): void;
     complete(context: RenderedContext, tools: ToolSchema[], extensions?: Record<string, unknown>): Promise<Message>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepstrike/wasm",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "DeepStrike WASM SDK — browser, Cloudflare Workers, Deno Deploy",
   "type": "module",
   "main": "dist/index.js",
@@ -15,7 +15,7 @@
     "test": "node --experimental-vm-modules node_modules/.bin/jest"
   },
   "dependencies": {
-    "@deepstrike/wasm-kernel": "0.2.6"
+    "@deepstrike/wasm-kernel": "0.2.8"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",