@deepstrike/wasm 0.2.62 → 0.2.64

package/LICENSE

@@ -0,0 +1,106 @@
+DeepStrike License (Dual License)
+Version 1.0 — 2026-09-01
+
+Copyright (c) 2025-2026 DeepStrike Contributors
+Project: https://github.com/kongusen/deepstrike
+
+======================================================================
+中文摘要（便于理解，不具有法律效力；以下英文条款为准）
+======================================================================
+
+本软件采用双授权模式：
+
+1. 个人，以及上一财年总营收低于 1,000,000 美元的组织（含其关联方），
+   可按 MIT 条款免费使用本软件（见第 2 节），包括使用、复制、修改、
+   合并、发布、分发、再授权及销售的权利。
+2. 上一财年总营收达到或超过 1,000,000 美元的组织（含其关联方），
+   在使用本软件之前（包括内部使用、基于本软件开发的项目、以及对外
+   分发此类产品或服务）须向作者获取商业授权（见第 3 节）。
+   获取方式：发送邮件至 wanghaishan0210@gmail.com，或通过
+   https://github.com/kongusen/deepstrike 提交 Issue / Discussion
+   联系作者。出于评估目的的试用不超过 30 天除外。
+3. 当组织的年营收增长至达到或超过该阈值时，自该时点起第 2 节的免费
+   授权终止，须获取商业授权后方可继续使用。
+4. v0.2.62 及之前已经以 MIT 协议发布的版本继续适用 MIT 协议，不受
+   本协议影响。本协议仅适用于随其一同分发的版本。
+
+======================================================================
+TERMS AND CONDITIONS
+======================================================================
+
+1. DEFINITIONS
+
+"Software" means the DeepStrike software and associated documentation
+files distributed by the Licensor, including all copies and substantial
+portions thereof.
+
+"Licensor" means the copyright holders of the Software (the DeepStrike
+Contributors), represented by the project maintainer at
+https://github.com/kongusen/deepstrike.
+
+"You" (or "Licensee") means the individual or legal entity exercising
+permissions granted by this License, including, where that entity is an
+organization, all entities that control, are controlled by, or are under
+common control with that entity ("Affiliates"). "Control" means ownership
+of more than fifty percent (50%) of the equity or voting interests, or
+the power to direct management and policies.
+
+"Annual Revenue" means the total gross revenue of You and Your Affiliates
+for the most recently completed fiscal year, expressed in US dollars or
+converted into US dollars at prevailing exchange rates.
+
+2. FREE LICENSE FOR INDIVIDUALS AND SMALL ORGANIZATIONS
+
+If You are an individual, or a legal entity whose Annual Revenue is less
+than one million US dollars (USD 1,000,000), the Licensor hereby grants
+You, free of charge, permission to deal in the Software without
+restriction, including without limitation the rights to use, copy, modify,
+merge, publish, distribute, sublicense, and/or sell copies of the
+Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+(a) The above copyright notice and this License shall be included in all
+    copies or substantial portions of the Software.
+
+(b) If Your Annual Revenue reaches or exceeds USD 1,000,000, the grant in
+    this Section 2 terminates for You, and Section 3 applies from that
+    point on.
+
+3. COMMERCIAL LICENSE REQUIRED (ANNUAL REVENUE >= USD 1,000,000)
+
+If Your Annual Revenue equals or exceeds one million US dollars
+(USD 1,000,000), You must obtain a commercial license from the Licensor
+before using the Software. This applies to every form of use, including
+internal use, use within products or services developed based on the
+Software, and distribution or provision of such products or services to
+third parties.
+
+Exception: You may use the Software without a commercial license solely
+for evaluation purposes, for a period of up to thirty (30) days.
+
+To obtain a commercial license, contact the Licensor at
+wanghaishan0210@gmail.com, or via the project repository at
+https://github.com/kongusen/deepstrike (open an issue or discussion).
+Commercial terms, including fees, are set by individual agreement with
+the Licensor.
+
+Any use of the Software requiring a commercial license under this
+Section 3 without one is unlicensed use and constitutes copyright
+infringement.
+
+4. PRIOR VERSIONS
+
+Versions of the Software released before this License took effect (up to
+and including version 0.2.62) were released under the MIT License and
+remain available under the terms of the MIT License. This License applies
+only to versions of the Software distributed together with it.
+
+5. NO WARRANTY
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

package/dist/index.d.ts

@@ -1,8 +1,9 @@
-export { RuntimeRunner, collectText, runAgent, runFanout, InMemorySessionLog, LocalExecutionPlane, DEFAULT_NATIVE_SIGNAL_POLICY, DEFAULT_NATIVE_GOVERNANCE_POLICY, DEFAULT_SANDBOX_POLICY, assertNativeProfile, osProfile, validateDeclarativePolicy, ReplayProvider, extractRecordedMessages, judge, buildEvalMessages, parseVerdict, verdictOutputSchema, } from "./runtime/index.js";
+export { RuntimeRunner, collectText, runAgent, runFanout, InMemorySessionLog, assertCanonicalProviderAttemptRecord, SESSION_EVENT_KINDS, LocalExecutionPlane, DEFAULT_NATIVE_SIGNAL_POLICY, DEFAULT_NATIVE_GOVERNANCE_POLICY, DEFAULT_SANDBOX_POLICY, assertNativeProfile, osProfile, validateDeclarativePolicy, ReplayProvider, extractRecordedMessages, judge, buildEvalMessages, parseVerdict, verdictOutputSchema, } from "./runtime/index.js";
 export { DriverKernelJournal, InMemoryJournalDriver, InMemoryKernelJournal, JournalCasConflictError, JournalIntegrityError, JournalIoError, } from "./runtime/kernel-journal.js";
 export type { CheckpointCandidate, InstalledCheckpoint, JournalAppendReceipt, JournalEntry, JournalHead, JournalPruneReceipt, JournalRecordInput, JournalStorageDriver, KernelJournal, } from "./runtime/kernel-journal.js";
+export { CANONICAL_CONTENT_PARTS_PREFIX, encodeCanonicalContentParts, decodeCanonicalContentParts, } from "./runtime/kernel-step.js";
 export type { ReplayProviderOpts, Criterion, Verdict, VerdictDetail, JudgeArgs, } from "./runtime/index.js";
-export type { NativeOsProfile, OsProfileId, MemoryPolicy, MemoryWriteRateLimit, ResourceQuota, RuntimeOptions, PromptBudget, SchedulerPolicy, SignalPolicy, SessionEvent, SessionLog, RunContext, ExecutionPlane, KernelEventCategory, KernelPrimitive, } from "./runtime/index.js";
+export type { NativeOsProfile, OsProfileId, MemoryPolicy, MemoryWriteRateLimit, ResourceQuota, RuntimeOptions, PromptBudget, SchedulerPolicy, SignalPolicy, SessionEvent, SessionEventKind, SessionLog, RunContext, ExecutionPlane, KernelEventCategory, KernelPrimitive, } from "./runtime/index.js";
 export { primitiveForCategory, primitiveForKind } from "./runtime/index.js";
 export { FilteredExecutionPlane } from "./runtime/filtered-plane.js";
 export { SubAgentOrchestrator, defaultSubAgentOrchestrator, spawnStandalone } from "./runtime/sub-agent-orchestrator.js";
@@ -40,12 +41,14 @@ export { ScheduledPrompt } from "./signals/index.js";
 export type { RuntimeSignal, SignalSource } from "./signals/index.js";
 export { PermissionManager, PermissionMode } from "./safety/index.js";
 export { createProviderRequestPlan, createProviderRequestPlanForProvider, estimateProviderPromptTokens, measurementForPlan, normalizeProviderUsage, priceProviderUsage, recordPromptMeasurement } from "./providers/request-plan.js";
-export type { CostObservation, NormalizedProviderUsage, PricingSnapshot, ProviderRequestEndpoint, ProviderRequestPlan, ProviderUsage, RecordedPromptMeasurement } from "./providers/request-plan.js";
+export type { CostObservation, NormalizedProviderUsage, PricingSnapshot, ProviderRequestEndpoint, ProviderRequestPlan, ProviderUsage, RecordedPromptMeasurement, ResolvedProviderRoute } from "./providers/request-plan.js";
+export type { ProviderAttempt, ProviderAttemptRecord, ProviderAttemptStatus, ModelInvocation, InvocationOutcome, ModelUsageSettlement, UsageAccountingPolicy, } from "./runtime/execution-evidence.js";
+export { FULL_FOOTPRINT_USAGE_ACCOUNTING_POLICY, providerAttemptToRecord, tryNormalizeProviderUsage } from "./runtime/execution-evidence.js";
 export { decodeCanonicalStopReason, normalizeProviderStopReason } from "./providers/stop-reason.js";
 export type { CanonicalStopReason } from "./providers/stop-reason.js";
 export { ContentPolicyError, contentDispositionFor, requireContentDisposition } from "./providers/content-policy.js";
 export type { ContentDisposition, ContentPlacement, InputModality } from "./providers/content-policy.js";
 export type { PermissionDecision } from "./safety/index.js";
-export type { Message, ToolCall, ToolResult, ToolSchema, RenderedContext, ProviderRunState, StreamEvent, TextDelta, ThinkingDelta, ToolCallEvent, ToolResultEvent, ToolAuditFailedEvent, DoneEvent, ErrorEvent, PermissionRequestEvent, PermissionResolvedEvent, PermissionResponse, EntropySample, EntropySampleEvent, EntropyAlertEvent, EntropyWatchOptions, LLMProvider, CacheBreakpointStrategy, } from "./types.js";
+export type { Message, ToolCall, ToolResult, ToolSchema, RenderedContext, ProviderRunState, StreamEvent, TextDelta, ThinkingDelta, ToolCallEvent, ToolResultEvent, ToolAuditFailedEvent, DoneEvent, ErrorEvent, PermissionRequestEvent, PermissionResolvedEvent, PermissionResponse, EntropySample, EntropySampleEvent, EntropyAlertEvent, EntropyWatchOptions, LLMProvider, CacheBreakpointStrategy, ProviderWireEvidence, ProviderTransportTelemetry, } from "./types.js";
 export { DurableContentError, decodeDurableContent, decodeDurableToolResult, encodeDurableContent, encodeDurableToolResult, toolOutputBlocksToDurable, durableBlocksToToolOutput } from "./runtime/durable-content.js";
 export type { DurableContent, DurableContentBlock, DurableSource, DurableToolResult } from "./runtime/durable-content.js";

package/dist/index.js

@@ -1,6 +1,8 @@
-export { RuntimeRunner, collectText, runAgent, runFanout, InMemorySessionLog, LocalExecutionPlane, DEFAULT_NATIVE_SIGNAL_POLICY, DEFAULT_NATIVE_GOVERNANCE_POLICY, DEFAULT_SANDBOX_POLICY, assertNativeProfile, osProfile, validateDeclarativePolicy, ReplayProvider, extractRecordedMessages, judge, buildEvalMessages, parseVerdict, verdictOutputSchema, } from "./runtime/index.js";
+export { RuntimeRunner, collectText, runAgent, runFanout, InMemorySessionLog, assertCanonicalProviderAttemptRecord, SESSION_EVENT_KINDS, LocalExecutionPlane, DEFAULT_NATIVE_SIGNAL_POLICY, DEFAULT_NATIVE_GOVERNANCE_POLICY, DEFAULT_SANDBOX_POLICY, assertNativeProfile, osProfile, validateDeclarativePolicy, ReplayProvider, extractRecordedMessages, judge, buildEvalMessages, parseVerdict, verdictOutputSchema, } from "./runtime/index.js";
 // ── Durable transaction capability (Canonical Kernel ABI §9.1) ──────────────
 export { DriverKernelJournal, InMemoryJournalDriver, InMemoryKernelJournal, JournalCasConflictError, JournalIntegrityError, JournalIoError, } from "./runtime/kernel-journal.js";
+// ── content-parts-v1 registered encoding (F14/B5; byte-pinned by sdk-conformance) ──
+export { CANONICAL_CONTENT_PARTS_PREFIX, encodeCanonicalContentParts, decodeCanonicalContentParts, } from "./runtime/kernel-step.js";
 export { primitiveForCategory, primitiveForKind } from "./runtime/index.js";
 export { FilteredExecutionPlane } from "./runtime/filtered-plane.js";
 export { SubAgentOrchestrator, defaultSubAgentOrchestrator, spawnStandalone } from "./runtime/sub-agent-orchestrator.js";
@@ -23,6 +25,7 @@ export { AttemptLoop, RuntimeAttemptBody, VerdictFnJudge, LlmEvalJudge, HybridJu
 export { ScheduledPrompt } from "./signals/index.js";
 export { PermissionManager, PermissionMode } from "./safety/index.js";
 export { createProviderRequestPlan, createProviderRequestPlanForProvider, estimateProviderPromptTokens, measurementForPlan, normalizeProviderUsage, priceProviderUsage, recordPromptMeasurement } from "./providers/request-plan.js";
+export { FULL_FOOTPRINT_USAGE_ACCOUNTING_POLICY, providerAttemptToRecord, tryNormalizeProviderUsage } from "./runtime/execution-evidence.js";
 export { decodeCanonicalStopReason, normalizeProviderStopReason } from "./providers/stop-reason.js";
 export { ContentPolicyError, contentDispositionFor, requireContentDisposition } from "./providers/content-policy.js";
 export { DurableContentError, decodeDurableContent, decodeDurableToolResult, encodeDurableContent, encodeDurableToolResult, toolOutputBlocksToDurable, durableBlocksToToolOutput } from "./runtime/durable-content.js";

package/dist/providers/request-plan.d.ts

@@ -1,4 +1,4 @@
-import type { RenderedContext, ToolSchema } from "../types.js";
+import type { ProviderProtocol, RenderedContext, ToolSchema } from "../types.js";
 export interface ProviderRequestEndpoint {
     id: string;
     protocol: string;
@@ -36,6 +36,16 @@ export interface ProviderUsage {
     cacheCreationInputTokens?: number;
     reasoningTokens?: number;
 }
+/** P4 §1.3 mirror of the node ResolvedProviderRoute (content-addressed route evidence). */
+export interface ResolvedProviderRoute {
+    routeId: string;
+    provider: string;
+    protocol: ProviderProtocol;
+    model: string;
+    endpoint: ProviderRequestEndpoint;
+    adapterVersion: string;
+    capabilitiesRef: string;
+}
 export interface NormalizedProviderUsage extends ProviderUsage {
     uncachedInputTokens: number;
 }
@@ -85,3 +95,26 @@ export declare function recordPromptMeasurement(plan: Pick<ProviderRequestPlan,
 export declare function measurementForPlan(plan: Pick<ProviderRequestPlan, "fingerprint">, record: RecordedPromptMeasurement | undefined): RecordedPromptMeasurement | undefined;
 export declare function normalizeProviderUsage(usage: ProviderUsage): NormalizedProviderUsage;
 export declare function priceProviderUsage(usage: NormalizedProviderUsage, snapshot: PricingSnapshot, observedAt?: string | Date): CostObservation;
+/**
+ * P4-S1: assemble the run's route once at runner construction (P4 §0.2 — the provider is
+ * fixed for the run today; a future failover resolver re-evaluates per attempt with the same
+ * shape). Never throws: evidence assembly degrades to "unknown" fields rather than breaking a
+ * run. The wasm bundle cannot read its own package manifest at runtime (browser targets), so
+ * adapterVersion is honestly "unknown" — the field is a report, not a gate.
+ */
+export declare function resolveProviderRoute(provider: {
+    descriptor?(): {
+        provider: string;
+        protocol: string;
+        model: string;
+    };
+    requestPlanIdentity?(): {
+        providerId?: string;
+        modelId?: string;
+        endpoint?: {
+            id?: string;
+            protocol?: string;
+            baseURL?: string;
+        };
+    };
+}): ResolvedProviderRoute;

package/dist/providers/request-plan.js

@@ -106,6 +106,55 @@ function sanitizeEndpoint(endpoint) {
         return { ...clone(endpoint), baseURL: "" };
     }
 }
+const KNOWN_GENERATION_PROTOCOLS = new Set([
+    "anthropic-messages",
+    "openai-chat",
+    "openai-responses",
+    "gemini",
+    "ollama-chat",
+]);
+/**
+ * P4-S1: assemble the run's route once at runner construction (P4 §0.2 — the provider is
+ * fixed for the run today; a future failover resolver re-evaluates per attempt with the same
+ * shape). Never throws: evidence assembly degrades to "unknown" fields rather than breaking a
+ * run. The wasm bundle cannot read its own package manifest at runtime (browser targets), so
+ * adapterVersion is honestly "unknown" — the field is a report, not a gate.
+ */
+export function resolveProviderRoute(provider) {
+    try {
+        const descriptor = provider.descriptor?.() ?? { provider: "unknown", protocol: "unknown", model: "unknown" };
+        const identity = provider.requestPlanIdentity?.();
+        const protocolRaw = identity?.endpoint?.protocol ?? descriptor.protocol;
+        // Evidence records what the descriptor said, even when a foreign provider speaks a protocol
+        // outside the in-tree vocabulary — the field is a report, not a gate.
+        const protocol = protocolRaw;
+        const route = {
+            provider: identity?.providerId ?? descriptor.provider,
+            protocol,
+            model: identity?.modelId ?? descriptor.model,
+            endpoint: sanitizeEndpoint({
+                id: identity?.endpoint?.id ?? `${descriptor.provider}.${descriptor.protocol}`,
+                protocol: protocolRaw,
+                baseURL: identity?.endpoint?.baseURL ?? "",
+            }),
+            adapterVersion: "unknown",
+            capabilitiesRef: KNOWN_GENERATION_PROTOCOLS.has(protocolRaw) ? protocolRaw : "unknown",
+        };
+        // §1.3: content addressing covers every field EXCEPT capabilitiesRef (a reference, not content).
+        const { capabilitiesRef: _ref, ...addressed } = route;
+        return { ...route, routeId: sha256Hex(stableJson(addressed)) };
+    }
+    catch {
+        const fallback = {
+            provider: "unknown",
+            protocol: "unknown",
+            model: "unknown",
+            endpoint: { id: "unknown", protocol: "unknown", baseURL: "" },
+            adapterVersion: "unknown",
+        };
+        return { ...fallback, capabilitiesRef: "unknown", routeId: sha256Hex(stableJson(fallback)) };
+    }
+}
 function sanitizeMaterialValue(value) {
     if (value === undefined || typeof value === "function")
         return undefined;

package/dist/runtime/execution-evidence.d.ts

@@ -0,0 +1,118 @@
+/**
+ * P4 (0.2.64 Execution Evidence Plane): wasm mirror of the host-side object model connecting
+ * kernel-minted effects to real provider execution — ModelInvocation / ProviderAttempt /
+ * ResolvedProviderRoute / UsageAccountingPolicy. Everything here is L2 host evidence (B7):
+ * it lands in SessionLog for cross-verification against the journal (C6/C8) and is NEVER
+ * fed back as kernel input (B4/DEC-2 discipline: wall-clock and wire facts stay host-side).
+ */
+import type { ProviderWireEvidence } from "../types.js";
+import type { NormalizedProviderUsage, ResolvedProviderRoute } from "../providers/request-plan.js";
+/** Canonical stop-reason vocabulary already carried on the wire usage frame (types.ts). */
+export type CanonicalStopReason = "end_turn" | "max_tokens" | "stop_sequence" | "tool_use" | "content_filtered";
+/**
+ * P4 §1.1: one logical model call = the fact-connected chain of CallProvider effects the
+ * kernel walked to obtain one turn of model output. Derived identity, zero minting:
+ * `invocationId` IS the first effect's effect_id. Authority = journal; the SessionLog
+ * projection (`llm_completed.invocation_id`) is evidence only.
+ */
+export interface ModelInvocation {
+    invocationId: string;
+    turn: number;
+    /** Every effect_id on the chain, in order. Length 1 = first attempt succeeded. */
+    effectChain: string[];
+    outcome?: InvocationOutcome;
+}
+/** P4 §1.4: the invocation's terminal projection. */
+export interface InvocationOutcome {
+    invocationId: string;
+    /** The effect the kernel adopted as the outcome (the successful one). */
+    selectedEffectId: string;
+    stopReason?: CanonicalStopReason;
+    /** Absent on a failed chain (nothing settled). */
+    settlement?: ModelUsageSettlement;
+}
+export type ProviderAttemptStatus = "success" | "transport_exhausted" | "aborted" | "rejected";
+/**
+ * P4 §1.2: one effect's execution against one route, one physical attempt. The kernel-minted
+ * `effectId` is the primary key (H7 — no parallel id minting). Transport-ladder rungs are
+ * summarized as a count plus the final error class; rung-level evidence belongs to adapter
+ * debug logs, not SessionLog.
+ */
+export interface ProviderAttempt {
+    effectId: string;
+    /** Failover sequence within one effect execution (1-based). Always 1 today (P4 §0.2). */
+    attemptSeq: number;
+    route: ResolvedProviderRoute;
+    /** → ProviderRequestPlan.fingerprint (G2). */
+    requestFingerprint: string;
+    status: ProviderAttemptStatus;
+    transportRungs: number;
+    /** classifyProviderError's class, never the raw vendor text (B1 spirit). */
+    lastErrorClass?: string;
+    /** Host wall-clock, pure evidence, never kernel input (DEC-2 discipline). */
+    startedAtMs: number;
+    finishedAtMs: number;
+    /** Full measurement fields (P4 §2); only the settlement crosses the kernel boundary (B4). */
+    usage?: NormalizedProviderUsage;
+    wireEvidence?: ProviderWireEvidence;
+}
+/**
+ * The SessionLog wire payload of a ProviderAttempt (P4 §3): the §1.2 fields flattened into
+ * the event, snake_case per SessionLog convention. Nested objects keep their native shape
+ * (same convention as `prompt_measured.measurement`).
+ */
+export interface ProviderAttemptRecord {
+    effect_id: string;
+    attempt_seq: number;
+    route: ResolvedProviderRoute;
+    request_fingerprint: string;
+    status: ProviderAttemptStatus;
+    transport_rungs: number;
+    last_error_class?: string;
+    started_at_ms: number;
+    finished_at_ms: number;
+    usage?: NormalizedProviderUsage;
+    wire_evidence?: ProviderWireEvidence;
+    /** P4 §2.1: the accounting policy this attempt's settlement was/will be derived with —
+     *  pinned on the attempt so settlement is deterministically recomputable from
+     *  (measurement, policy_id). */
+    accounting_policy_id?: string;
+}
+export declare function providerAttemptToRecord(attempt: ProviderAttempt, accountingPolicyId?: string): ProviderAttemptRecord;
+/**
+ * P4 §2: the only two numbers that cross the kernel boundary (B4). Field names match the
+ * existing ResolveEffect wire shape — this is what the runner already feeds the kernel as
+ * `observed_input_tokens` / `observed_output_tokens`.
+ */
+export interface ModelUsageSettlement {
+    observed_input_tokens: number;
+    observed_output_tokens: number;
+}
+/**
+ * P4 §2.1: the named, pinnable, replayable policy turning a measurement into a settlement.
+ * `settle` must be a pure function of the measurement — given (usage, policyId) any auditor
+ * recomputes the identical settlement.
+ */
+export interface UsageAccountingPolicy {
+    policyId: string;
+    settle(usage: NormalizedProviderUsage): ModelUsageSettlement;
+}
+/**
+ * The default policy = today's implicit runner behavior exactly (full input footprint + full
+ * output footprint — the two numbers the runner has always fed `observed_*`). P4 changes no
+ * default numbers; it only makes the conversion a named object. The date stamp is the
+ * policy's identity: any future semantics change MUST ship under a new policyId.
+ */
+export declare const FULL_FOOTPRINT_USAGE_ACCOUNTING_POLICY: UsageAccountingPolicy;
+/**
+ * Defensive measurement assembly for the attempt evidence path: an invalid frame (cache
+ * subsets exceeding input, etc.) degrades to NO measurement instead of breaking the run —
+ * evidence is never worth a run failure, and the settlement falls back to the raw counts.
+ */
+export declare function tryNormalizeProviderUsage(usage: {
+    inputTokens: number;
+    outputTokens: number;
+    cacheReadInputTokens?: number;
+    cacheCreationInputTokens?: number;
+    reasoningTokens?: number;
+}): NormalizedProviderUsage | undefined;

package/dist/runtime/execution-evidence.js

@@ -0,0 +1,45 @@
+import { normalizeProviderUsage } from "../providers/request-plan.js";
+export function providerAttemptToRecord(attempt, accountingPolicyId) {
+    return {
+        effect_id: attempt.effectId,
+        attempt_seq: attempt.attemptSeq,
+        route: attempt.route,
+        request_fingerprint: attempt.requestFingerprint,
+        status: attempt.status,
+        transport_rungs: attempt.transportRungs,
+        ...(attempt.lastErrorClass !== undefined ? { last_error_class: attempt.lastErrorClass } : {}),
+        started_at_ms: attempt.startedAtMs,
+        finished_at_ms: attempt.finishedAtMs,
+        ...(attempt.usage !== undefined ? { usage: attempt.usage } : {}),
+        ...(attempt.wireEvidence !== undefined ? { wire_evidence: attempt.wireEvidence } : {}),
+        ...(accountingPolicyId !== undefined ? { accounting_policy_id: accountingPolicyId } : {}),
+    };
+}
+/**
+ * The default policy = today's implicit runner behavior exactly (full input footprint + full
+ * output footprint — the two numbers the runner has always fed `observed_*`). P4 changes no
+ * default numbers; it only makes the conversion a named object. The date stamp is the
+ * policy's identity: any future semantics change MUST ship under a new policyId.
+ */
+export const FULL_FOOTPRINT_USAGE_ACCOUNTING_POLICY = {
+    policyId: "deepstrike.full-footprint@2026-09-15",
+    settle(usage) {
+        return {
+            observed_input_tokens: usage.inputTokens,
+            observed_output_tokens: usage.outputTokens,
+        };
+    },
+};
+/**
+ * Defensive measurement assembly for the attempt evidence path: an invalid frame (cache
+ * subsets exceeding input, etc.) degrades to NO measurement instead of breaking the run —
+ * evidence is never worth a run failure, and the settlement falls back to the raw counts.
+ */
+export function tryNormalizeProviderUsage(usage) {
+    try {
+        return normalizeProviderUsage(usage);
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/runtime/index.d.ts

@@ -1,5 +1,6 @@
-export type { SessionEvent, SessionLog } from "./session-log.js";
-export { InMemorySessionLog } from "./session-log.js";
+export type { SessionEvent, SessionEventKind, SessionLog } from "./session-log.js";
+export { InMemorySessionLog, assertCanonicalProviderAttemptRecord } from "./session-log.js";
+export { SESSION_EVENT_KINDS } from "./session-log.js";
 export { DriverKernelJournal, InMemoryJournalDriver, InMemoryKernelJournal, JournalCasConflictError, JournalIntegrityError, JournalIoError, } from "./kernel-journal.js";
 export type { CheckpointCandidate, InstalledCheckpoint, JournalAppendReceipt, JournalEntry, JournalHead, JournalPruneReceipt, JournalRecordInput, JournalStorageDriver, KernelJournal, } from "./kernel-journal.js";
 export * from "./context-policy.js";

package/dist/runtime/index.js

@@ -1,4 +1,6 @@
-export { InMemorySessionLog } from "./session-log.js";
+export { InMemorySessionLog, assertCanonicalProviderAttemptRecord } from "./session-log.js";
+// Registered session-event vocabulary (F9/S3; manifest-pinned by sdk-conformance, P7-S4)
+export { SESSION_EVENT_KINDS } from "./session-log.js";
 // Durable transaction capability (Canonical Kernel ABI §9.1)
 export { DriverKernelJournal, InMemoryJournalDriver, InMemoryKernelJournal, JournalCasConflictError, JournalIntegrityError, JournalIoError, } from "./kernel-journal.js";
 export * from "./context-policy.js";

package/dist/runtime/kernel-step.d.ts

@@ -22,6 +22,11 @@ export declare const CANONICAL_CONTENT_PARTS_PREFIX = "[[deepstrike-content-part
 /**
  * Browser/worker-safe transport for typed content. `btoa` and `atob` operate on
  * binary strings, so explicitly bridge UTF-8 bytes rather than assuming Latin-1.
+ *
+ * Byte contract (content-parts-v1, F14/B5): compact JSON with literal UTF-8, insertion key
+ * order, **base64url alphabet, no padding** — identical bytes to the Node and Python SDKs.
+ * Decode stays lenient (both alphabets, optional padding) so payloads written before the
+ * url-alphabet alignment remain readable.
  */
 export declare function encodeCanonicalContentParts(parts: unknown[]): string;
 export declare function decodeCanonicalContentParts(content: string): Array<Record<string, unknown>> | undefined;

package/dist/runtime/kernel-step.js

@@ -2,19 +2,28 @@ export const CANONICAL_CONTENT_PARTS_PREFIX = "[[deepstrike-content-parts]]";
 /**
  * Browser/worker-safe transport for typed content. `btoa` and `atob` operate on
  * binary strings, so explicitly bridge UTF-8 bytes rather than assuming Latin-1.
+ *
+ * Byte contract (content-parts-v1, F14/B5): compact JSON with literal UTF-8, insertion key
+ * order, **base64url alphabet, no padding** — identical bytes to the Node and Python SDKs.
+ * Decode stays lenient (both alphabets, optional padding) so payloads written before the
+ * url-alphabet alignment remain readable.
  */
 export function encodeCanonicalContentParts(parts) {
     const bytes = new TextEncoder().encode(JSON.stringify(parts));
     let binary = "";
     for (const byte of bytes)
         binary += String.fromCharCode(byte);
-    return `${CANONICAL_CONTENT_PARTS_PREFIX}${btoa(binary)}`;
+    const payload = btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+    return `${CANONICAL_CONTENT_PARTS_PREFIX}${payload}`;
 }
 export function decodeCanonicalContentParts(content) {
     if (!content.startsWith(CANONICAL_CONTENT_PARTS_PREFIX))
         return undefined;
     try {
-        const binary = atob(content.slice(CANONICAL_CONTENT_PARTS_PREFIX.length));
+        const raw = content.slice(CANONICAL_CONTENT_PARTS_PREFIX.length);
+        const standard = raw.replaceAll("-", "+").replaceAll("_", "/");
+        const padded = standard + "=".repeat((4 - (standard.length % 4)) % 4);
+        const binary = atob(padded);
         const bytes = Uint8Array.from(binary, character => character.charCodeAt(0));
         const decoded = JSON.parse(new TextDecoder().decode(bytes));
         return Array.isArray(decoded)

package/dist/runtime/runner.d.ts

@@ -13,6 +13,7 @@ import { type ReducerRegistry } from "./reducers.js";
 import { type NativeOsProfile, type OsProfileId, type SignalPolicy } from "./os-profile.js";
 import { PayloadStore } from "./payload-store.js";
 import { type ContextPolicyOverrides } from "./context-policy.js";
+import { type UsageAccountingPolicy } from "./execution-evidence.js";
 export interface MemoryWriteRateLimit {
     maxWrites: number;
     windowMs: number;
@@ -140,6 +141,10 @@ export interface RuntimeOptions {
     governancePolicy?: GovernancePolicy;
     signalPolicy?: SignalPolicy;
     promptBudget?: PromptBudget;
+    /** P4 §2.1: the named policy turning a provider measurement into the two observed_* numbers
+     *  that cross the kernel boundary. Undefined ⇒ FULL_FOOTPRINT (the numbers the runner has
+     *  always fed); only makes the conversion named, pinnable on `provider_attempt`, replayable. */
+    usageAccountingPolicy?: UsageAccountingPolicy;
     /** Stable replayable context behavior; ratios are normalized to integer ppm. */
     contextPolicy?: ContextPolicyOverrides;
     schedulerPolicy?: SchedulerPolicy;
@@ -281,7 +286,24 @@ export declare class RuntimeRunner {
     private activePageOutArchive;
     /** Provider continuation emitted after a canonical nested workflow completes. */
     private workflowContinuation;
+    /** P4 (0.2.64 Evidence Plane): the resolved route every provider attempt is pinned to —
+     *  resolved once so evidence identity is byte-stable across the run (C6.3 pins in-run
+     *  route stability). */
+    private readonly providerRoute;
+    private readonly usageAccountingPolicy;
+    /** P4 §1.1: the active invocation's derived identity = its chain's FIRST effect_id. Tracked
+     *  across the kernel-recovered retry loop; a fresh call_provider with no pending retry opens
+     *  a new invocation. */
+    private providerRetryPending;
+    private activeProviderInvocationId;
     constructor(opts: RuntimeOptions);
+    /**
+     * P4-S1 (G1): land one provider_attempt evidence record per effect execution. Pure host
+     * evidence (B7) — appended AFTER the transport fact exists (success/failure/abort), never
+     * consulted for kernel input. The accounting policy id pins only when a measurement exists,
+     * so (usage, policy_id) deterministically recomputes the settlement that crossed the wire.
+     */
+    private appendProviderAttempt;
     private resolveKernelJournal;
     private createCanonicalRuntime;
     private commitKernelApply;

package/dist/runtime/runner.js

@@ -19,7 +19,8 @@ import { assertNativeProfile } from "./os-profile.js";
 import { classifyProviderError, providerErrorEventFields } from "../providers/provider-error.js";
 import { PayloadStore } from "./payload-store.js";
 import { contextPolicy, normalizeContextPolicy, } from "./context-policy.js";
-import { createProviderRequestPlanForProvider, estimateProviderPromptTokens, measurementForPlan, recordPromptMeasurement, } from "../providers/request-plan.js";
+import { createProviderRequestPlanForProvider, estimateProviderPromptTokens, measurementForPlan, recordPromptMeasurement, resolveProviderRoute, } from "../providers/request-plan.js";
+import { FULL_FOOTPRINT_USAGE_ACCOUNTING_POLICY, providerAttemptToRecord, tryNormalizeProviderUsage, } from "./execution-evidence.js";
 export function schedulerPolicyToKernel(policy) {
     const allowed = new Set([
         "criticalPathWeight", "fanoutWeight", "ageWeight", "tokenCostWeight",
@@ -121,12 +122,36 @@ export class RuntimeRunner {
     activePageOutArchive;
     /** Provider continuation emitted after a canonical nested workflow completes. */
     workflowContinuation = null;
+    /** P4 (0.2.64 Evidence Plane): the resolved route every provider attempt is pinned to —
+     *  resolved once so evidence identity is byte-stable across the run (C6.3 pins in-run
+     *  route stability). */
+    providerRoute;
+    usageAccountingPolicy;
+    /** P4 §1.1: the active invocation's derived identity = its chain's FIRST effect_id. Tracked
+     *  across the kernel-recovered retry loop; a fresh call_provider with no pending retry opens
+     *  a new invocation. */
+    providerRetryPending = false;
+    activeProviderInvocationId;
     constructor(opts) {
         this.opts = opts;
         const schemaAttempts = opts.workflowSchemaValidationAttempts ?? 2;
         if (!Number.isInteger(schemaAttempts) || schemaAttempts < 1 || schemaAttempts > 16) {
             throw new RangeError("workflowSchemaValidationAttempts must be an integer between 1 and 16");
         }
+        this.providerRoute = resolveProviderRoute(opts.provider);
+        this.usageAccountingPolicy = opts.usageAccountingPolicy ?? FULL_FOOTPRINT_USAGE_ACCOUNTING_POLICY;
+    }
+    /**
+     * P4-S1 (G1): land one provider_attempt evidence record per effect execution. Pure host
+     * evidence (B7) — appended AFTER the transport fact exists (success/failure/abort), never
+     * consulted for kernel input. The accounting policy id pins only when a measurement exists,
+     * so (usage, policy_id) deterministically recomputes the settlement that crossed the wire.
+     */
+    async appendProviderAttempt(sessionId, attempt) {
+        await this.opts.sessionLog.append(sessionId, {
+            kind: "provider_attempt",
+            ...providerAttemptToRecord(attempt, attempt.usage ? this.usageAccountingPolicy.policyId : undefined),
+        });
     }
     resolveKernelJournal() {
         const embedded = this.opts.sessionLog;
@@ -269,6 +294,7 @@ export class RuntimeRunner {
                 agent_id: this.opts.agentId,
                 system_prompt: this.opts.systemPrompt,
                 ...(attachments ? { attachments } : {}),
+                route: this.providerRoute,
             });
         }
         yield* this.execute(req.sessionId, runId, req.goal, req.criteria ?? [], req.extensions, prior.length > 0 ? prior : undefined, midRun, attachments);
@@ -355,7 +381,7 @@ export class RuntimeRunner {
         await this.commitKernelApply(this.activeKernel, this.pendingObservations, { kind: "skill_deactivated", name });
         this.knowledgePushedSkills.delete(name);
     }
-    async resolveKernelSuspend(requests, runtime, sessionId) {
+    async resolveKernelSuspend(requests, runtime, sessionId, effectId) {
         const approved = [];
         const denied = [];
         const events = [];
@@ -421,6 +447,8 @@ export class RuntimeRunner {
                 await this.opts.sessionLog.append(sessionId, {
                     kind: "tool_completed",
                     turn: runtime.turn(),
+                    // P4 §1.1: governance-denied completions carry the requesting effect's identity.
+                    ...(effectId !== undefined ? { effect_id: effectId } : {}),
                     results: [{
                             call_id: requestAction.callId,
                             output: `permission denied: ${denyReason}`,
@@ -638,6 +666,18 @@ export class RuntimeRunner {
                     break;
                 if (action.kind === "call_provider") {
                     const providerEffectId = action.effectId;
+                    // P4 §1.1: invocation identity is derived, never minted — the chain's FIRST effect_id.
+                    // A provider_error commit armed `providerRetryPending`, so this effect CONTINUES the
+                    // pending invocation; otherwise it opens a new one. The chain itself lives in the
+                    // journal (each hop a resolution input → new effect); this is the SessionLog evidence
+                    // projection of it.
+                    if (!this.providerRetryPending || this.activeProviderInvocationId === undefined) {
+                        this.activeProviderInvocationId = providerEffectId;
+                    }
+                    this.providerRetryPending = false;
+                    const invocationId = this.activeProviderInvocationId;
+                    // Host wall-clock, pure evidence (B7/DEC-2): never crosses into kernel input.
+                    const attemptStartedAtMs = Date.now();
                     const finalToolCalls = [];
                     let finalText = "";
                     // I5: governance schema-level pre-filter — see Node runner for full rationale.
@@ -684,7 +724,7 @@ export class RuntimeRunner {
                             });
                         }
                         recordedMeasurements.set(providerPlan.fingerprint, promptMeasurement);
-                        await this.opts.sessionLog.append(sessionId, { kind: "prompt_measured", turn: runtime.turn(), measurement: promptMeasurement });
+                        await this.opts.sessionLog.append(sessionId, { kind: "prompt_measured", turn: runtime.turn(), measurement: promptMeasurement, effect_id: providerEffectId });
                     }
                     const reservedPromptTokens = (this.opts.promptBudget?.promptOverheadTokens ?? 0)
                         + (this.opts.promptBudget?.outputReserveTokens ?? 0)
@@ -693,11 +733,29 @@ export class RuntimeRunner {
                         && promptMeasurement.source.kind !== "heuristic"
                         && promptMeasurement.inputTokens + reservedPromptTokens > this.opts.maxTokens;
                     if (context.budgetOverflow || measuredOverflow) {
+                        // P4 §1.2: blocked BEFORE any transport — zero rungs, status rejected. The
+                        // fingerprint still binds the would-be request to its prompt_measured record (G2).
+                        await this.appendProviderAttempt(sessionId, {
+                            effectId: providerEffectId,
+                            attemptSeq: 1,
+                            route: this.providerRoute,
+                            requestFingerprint: providerPlan.fingerprint,
+                            status: "rejected",
+                            transportRungs: 0,
+                            lastErrorClass: "context_overflow",
+                            startedAtMs: attemptStartedAtMs,
+                            finishedAtMs: Date.now(),
+                            wireEvidence: {
+                                protocol: this.providerRoute.protocol,
+                                request_fingerprint: providerPlan.fingerprint,
+                            },
+                        });
                         action = await this.commitKernelAction(runtime, this.pendingObservations, {
                             kind: "provider_error", effect_id: providerEffectId,
                             message: "provider-visible prompt exceeds the configured context budget",
                             error_kind: "context_overflow", retryable: false,
                         });
+                        this.providerRetryPending = action.kind === "call_provider";
                         continue;
                     }
                     const abortSignal = this.abortController?.signal;
@@ -741,6 +799,23 @@ export class RuntimeRunner {
                         else {
                             const descriptor = this.opts.provider.descriptor?.();
                             const providerError = classifyProviderError(descriptor?.provider ?? "unknown", err);
+                            // P4 §1.2: the transport ladder is exhausted — one attempt record, error CLASS only
+                            // (B1: never the raw vendor text). The single-shot stream path reports 1 rung.
+                            await this.appendProviderAttempt(sessionId, {
+                                effectId: providerEffectId,
+                                attemptSeq: 1,
+                                route: this.providerRoute,
+                                requestFingerprint: providerPlan.fingerprint,
+                                status: "transport_exhausted",
+                                transportRungs: 1,
+                                lastErrorClass: providerError.kind,
+                                startedAtMs: attemptStartedAtMs,
+                                finishedAtMs: Date.now(),
+                                wireEvidence: {
+                                    protocol: this.providerRoute.protocol,
+                                    request_fingerprint: providerPlan.fingerprint,
+                                },
+                            });
                             // Reactive recovery is now a kernel decision. Forward the raw provider error and
                             // dispatch whatever the kernel returns: `call_provider` to retry with a freshly
                             // compacted context, or `done` to terminate with an honest `ContextOverflow`. The
@@ -752,6 +827,9 @@ export class RuntimeRunner {
                                 message: providerError.message,
                                 ...providerErrorEventFields(providerError),
                             });
+                            // P4 §1.1: a kernel-recovered retry CONTINUES this invocation (the journal holds the
+                            // causation hop); a terminal closes it.
+                            this.providerRetryPending = action.kind === "call_provider";
                             // Withholding (query.ts parity): surface the raw provider error only when the kernel
                             // could NOT recover (it returned a terminal). On a recovered retry (`call_provider`)
                             // the error stays hidden. `continue` re-enters the loop: a recovered turn persists its
@@ -765,6 +843,21 @@ export class RuntimeRunner {
                     }
                     // #2-B-ii: stream aborted (preempt/interrupt) via the break path — end the turn now.
                     if (abortSignal?.aborted) {
+                        // P4 §1.2: host cancellation mid-stream — the attempt is evidence too.
+                        await this.appendProviderAttempt(sessionId, {
+                            effectId: providerEffectId,
+                            attemptSeq: 1,
+                            route: this.providerRoute,
+                            requestFingerprint: providerPlan.fingerprint,
+                            status: "aborted",
+                            transportRungs: 1,
+                            startedAtMs: attemptStartedAtMs,
+                            finishedAtMs: Date.now(),
+                            wireEvidence: {
+                                protocol: this.providerRoute.protocol,
+                                request_fingerprint: providerPlan.fingerprint,
+                            },
+                        });
                         action = await this.commitKernelAction(runtime, this.pendingObservations, {
                             kind: "cancel_operation",
                             reason: this.cancellationReason ?? "user",
@@ -778,22 +871,60 @@ export class RuntimeRunner {
                         toolCalls: finalToolCalls,
                         tokenCount: turnOutputTokens || turnTokens || undefined,
                     };
+                    // P4 §2: assemble the measurement from the exact numbers that cross the boundary today
+                    // (input/output turn counters + the cache split). An invalid frame degrades to no
+                    // measurement (evidence never breaks a run); the settlement then falls back to the raw
+                    // counts below.
+                    const attemptUsage = (turnInputTokens > 0 || turnOutputTokens > 0)
+                        ? tryNormalizeProviderUsage({
+                            inputTokens: turnInputTokens,
+                            outputTokens: turnOutputTokens,
+                            ...(turnCacheReadTokens > 0 ? { cacheReadInputTokens: turnCacheReadTokens } : {}),
+                            ...(turnCacheCreationTokens > 0 ? { cacheCreationInputTokens: turnCacheCreationTokens } : {}),
+                        })
+                        : undefined;
+                    const settlement = attemptUsage ? this.usageAccountingPolicy.settle(attemptUsage) : undefined;
                     const providerEvent = {
                         kind: "provider_result",
                         effect_id: providerEffectId,
                         message: messageToKernelMessage(assistantMessage),
-                        ...(turnInputTokens > 0 ? { observed_input_tokens: turnInputTokens } : {}),
-                        ...(turnOutputTokens > 0 ? { observed_output_tokens: turnOutputTokens } : {}),
+                        // P4-S2: observed_* now comes from the pinned policy's settlement of the measurement.
+                        // Under the default full-footprint policy these are provably the numbers the runner
+                        // has always fed (inputTokens/outputTokens verbatim under the same >0 gates).
+                        ...(turnInputTokens > 0 ? { observed_input_tokens: settlement?.observed_input_tokens ?? turnInputTokens } : {}),
+                        ...(turnOutputTokens > 0 ? { observed_output_tokens: settlement?.observed_output_tokens ?? turnOutputTokens } : {}),
                         ...(turnStopReason ? { stop_reason: turnStopReason } : {}),
                     };
-                    action = await this.commitKernelAction(runtime, this.pendingObservations, providerEvent);
+                    // P4-S1: land the attempt evidence BEFORE the kernel resolution commits — the record
+                    // describes the transport fact, which exists regardless of what the kernel decides next.
                     const providerReplay = peekProviderReplay(this.opts.provider, finalText, finalToolCalls);
+                    const wireEvidence = {
+                        protocol: this.providerRoute.protocol,
+                        request_fingerprint: providerPlan.fingerprint,
+                        ...(providerReplay !== undefined ? { replay_state: providerReplay } : {}),
+                    };
+                    await this.appendProviderAttempt(sessionId, {
+                        effectId: providerEffectId,
+                        attemptSeq: 1,
+                        route: this.providerRoute,
+                        requestFingerprint: providerPlan.fingerprint,
+                        status: "success",
+                        transportRungs: 1,
+                        startedAtMs: attemptStartedAtMs,
+                        finishedAtMs: Date.now(),
+                        ...(attemptUsage !== undefined ? { usage: attemptUsage } : {}),
+                        wireEvidence,
+                    });
+                    action = await this.commitKernelAction(runtime, this.pendingObservations, providerEvent);
                     await this.opts.sessionLog.append(sessionId, buildLlmCompletedEvent({
                         turn: runtime.turn(),
                         content: finalText,
                         tokenCount: turnOutputTokens || turnTokens || undefined,
                         toolCalls: finalToolCalls,
                         providerReplay,
+                        effectId: providerEffectId,
+                        invocationId,
+                        wireEvidence,
                     }));
                     // P0-C: per-turn tool-gating telemetry. `activeSkill` reflects the skill in effect GOING INTO
                     // this turn; a `skill` call here only takes effect next turn — emit first, then advance.
@@ -823,7 +954,7 @@ export class RuntimeRunner {
                     }
                 }
                 else if (action.kind === "request_approval") {
-                    const resolved = await this.resolveKernelSuspend(action.requests, runtime, sessionId);
+                    const resolved = await this.resolveKernelSuspend(action.requests, runtime, sessionId, action.effectId);
                     for (const evt of resolved.events)
                         yield evt;
                     action = await this.commitKernelAction(runtime, this.pendingObservations, {
@@ -1076,6 +1207,8 @@ export class RuntimeRunner {
                     await this.opts.sessionLog.append(sessionId, {
                         kind: "tool_completed",
                         turn: runtime.turn(),
+                        // P4 §1.1: the completion carries the execute_tools effect's identity.
+                        effect_id: toolEffectId,
                         results: toolResults.map(r => ({
                             call_id: r.callId,
                             output: r.output,
@@ -1530,6 +1663,7 @@ export class RuntimeRunner {
                 goal: `workflow:${spec.nodes.length} nodes`,
                 criteria: [],
                 ...(this.opts.agentId ? { agent_id: this.opts.agentId } : {}),
+                route: this.providerRoute,
             });
             await this.initializeWorkflowKernel(sessionId, runId);
         }

package/dist/runtime/session-log.d.ts

@@ -1,8 +1,8 @@
-import type { ProviderReplay, ToolCall, ToolErrorKind } from "../types.js";
+import type { ProviderReplay, ProviderWireEvidence, ToolCall, ToolErrorKind } from "../types.js";
 import type { MemoryRecall, MemoryScope } from "../memory/index.js";
 import type { KernelPrimitive } from "./kernel-event-log.js";
 import type { KernelJournal } from "./kernel-journal.js";
-import type { RecordedPromptMeasurement } from "../providers/request-plan.js";
+import type { NormalizedProviderUsage, RecordedPromptMeasurement, ResolvedProviderRoute } from "../providers/request-plan.js";
 export type RollbackReason = {
     kind: "fatal_tool_error";
     tool_name: string;
@@ -22,6 +22,25 @@ export type RollbackReason = {
     kind: "malformed_replay";
     reason: string;
 };
+/**
+ * P4 §3 mirror: the SessionLog wire payload of a ProviderAttempt (P4 §1.2 fields, flattened,
+ * snake_case). Nested objects keep their native shape. The kernel-minted effect_id joins this
+ * host evidence to the journal effect chain 1:1 (C6); step_seq NEVER enters SessionLog (P2 §4).
+ */
+export interface ProviderAttemptRecord {
+    effect_id: string;
+    attempt_seq: number;
+    route: ResolvedProviderRoute;
+    request_fingerprint: string;
+    status: "success" | "transport_exhausted" | "aborted" | "rejected";
+    transport_rungs: number;
+    last_error_class?: string;
+    started_at_ms: number;
+    finished_at_ms: number;
+    usage?: NormalizedProviderUsage;
+    wire_evidence?: ProviderWireEvidence;
+    accounting_policy_id?: string;
+}
 export type SessionEvent = {
     kind: "run_started";
     run_id: string;
@@ -30,6 +49,7 @@ export type SessionEvent = {
     agent_id?: string;
     system_prompt?: string;
     attachments?: import("../types.js").ContentPart[];
+    route?: ResolvedProviderRoute;
 } | {
     kind: "llm_completed";
     turn: number;
@@ -37,11 +57,17 @@ export type SessionEvent = {
     token_count?: number;
     tool_calls: ToolCall[];
     provider_replay?: ProviderReplay;
+    effect_id?: string;
+    invocation_id?: string;
+    wire_evidence?: ProviderWireEvidence;
 } | {
     kind: "prompt_measured";
     turn: number;
     measurement: RecordedPromptMeasurement;
-} | {
+    effect_id?: string;
+} | ({
+    kind: "provider_attempt";
+} & ProviderAttemptRecord) | {
     kind: "tool_requested";
     turn: number;
     calls: ToolCall[];
@@ -59,6 +85,7 @@ export type SessionEvent = {
             blocks: Record<string, unknown>[];
         };
     }>;
+    effect_id?: string;
 } | {
     kind: "tool_argument_repaired";
     turn: number;
@@ -98,6 +125,18 @@ export type SessionEvent = {
     tier_hint?: string;
     message_count?: number;
     archive_ref?: string;
+} | {
+    kind: "semantic_archive_pending";
+    effect_id: string;
+    action?: string;
+} | {
+    kind: "semantic_archive_completed";
+    effect_id: string;
+    record_id: string;
+} | {
+    kind: "semantic_archive_failed";
+    effect_id: string;
+    error: string;
 } | {
     kind: "page_in";
     turn: number;
@@ -228,6 +267,17 @@ export type SessionEvent = {
     turn: number;
     record_id: string;
     error: string;
+} | {
+    kind: "memory_write_failed";
+    turn: number;
+    record_id: string;
+    error: string;
+} | {
+    kind: "memory_query_failed";
+    turn: number;
+    scope: MemoryScope;
+    query: string;
+    error: string;
 } | {
     kind: "memory_retrieval_result";
     hits: MemoryRecall[];
@@ -278,7 +328,39 @@ export type SessionEvent = {
     kind: "summary_upgraded";
     compressed_seq: number;
     summary: string;
+} | {
+    kind: "group_member_joined";
+    session_id: string;
+    role?: string;
+    member_kind?: "peer" | "vehicle";
+} | {
+    kind: "group_budget_charged";
+    tokens: number;
+    subagents: number;
+    rounds?: number;
+} | {
+    kind: "round_started";
+    /** 1-based round number within the loop. */
+    round: number;
+    goal: string;
+} | {
+    kind: "round_paced";
+    round: number;
+    action: "continue" | "sleep" | "stop";
+    delay_ms?: number;
+    /** Absolute wake time for sleep — lets a stateless host re-arm from the log alone. */
+    wake_at_ms?: number;
+    reason: string;
+    coerced_from?: string;
 };
+export type SessionEventKind = SessionEvent["kind"];
+/**
+ * The registered session-event vocabulary (F9 / S3, P7-S4). This list must equal the Node SDK's
+ * `SESSION_EVENT_KINDS` — the cross-SDK manifest fixture
+ * `tests/fixtures/sdk-conformance/canonical/session-event-vocabulary.json` pins both, and any
+ * same-commit desync turns conformance red. Declared in `SessionEvent` union order.
+ */
+export declare const SESSION_EVENT_KINDS: readonly ["run_started", "llm_completed", "prompt_measured", "provider_attempt", "tool_requested", "tool_completed", "tool_argument_repaired", "tool_denied", "permission_requested", "permission_resolved", "compressed", "page_out", "semantic_archive_pending", "semantic_archive_completed", "semantic_archive_failed", "page_in", "rollbacked", "capability_changed", "context_renewed", "suspended", "resumed", "tool_gated", "signal_delivery_disposed", "budget_exceeded", "budget_usage_reported", "operation_cancelled", "milestone_advanced", "milestone_blocked", "checkpoint_taken", "entropy_sample", "entropy_alert", "agent_process_changed", "memory_written", "memory_queried", "memory_validation_failed", "memory_write_failed", "memory_query_failed", "memory_retrieval_result", "workflow_node_completed", "workflow_nodes_submitted", "workflow_batch_spawned", "workflow_completed", "kernel_observation", "run_terminal", "summary_upgraded", "group_member_joined", "group_budget_charged", "round_started", "round_paced"];
 /**
  * The business-projection log (spec §9.2): run started/terminal, stream events, observations,
  * provider/tool presentation, and audit metadata. Canonical durable records live exclusively in
@@ -313,3 +395,11 @@ export declare class InMemorySessionLog implements SessionLog {
     }>>;
     latestSeq(sessionId: string): Promise<number>;
 }
+/**
+ * P4 §3 teeth, wasm mirror of the node/python persisted-record validator. The wasm SessionLog is
+ * in-memory only (no durable read path where validation would otherwise live), so the teeth are
+ * exported for hosts that bridge these events to durable storage — and for the conformance
+ * runner, which pins the rejection contract (`invalid_provider_attempt`) across all three
+ * JSON-projection SDKs. Same checks and message wording as node `assertCanonicalProviderAttempt`.
+ */
+export declare function assertCanonicalProviderAttemptRecord(event: Record<string, unknown>): void;

package/dist/runtime/session-log.js

@@ -1,5 +1,64 @@
 import { primitiveForKind } from "./kernel-event-log.js";
 import { InMemoryKernelJournal } from "./kernel-journal.js";
+/**
+ * The registered session-event vocabulary (F9 / S3, P7-S4). This list must equal the Node SDK's
+ * `SESSION_EVENT_KINDS` — the cross-SDK manifest fixture
+ * `tests/fixtures/sdk-conformance/canonical/session-event-vocabulary.json` pins both, and any
+ * same-commit desync turns conformance red. Declared in `SessionEvent` union order.
+ */
+export const SESSION_EVENT_KINDS = [
+    "run_started",
+    "llm_completed",
+    "prompt_measured",
+    "provider_attempt",
+    "tool_requested",
+    "tool_completed",
+    "tool_argument_repaired",
+    "tool_denied",
+    "permission_requested",
+    "permission_resolved",
+    "compressed",
+    "page_out",
+    "semantic_archive_pending",
+    "semantic_archive_completed",
+    "semantic_archive_failed",
+    "page_in",
+    "rollbacked",
+    "capability_changed",
+    "context_renewed",
+    "suspended",
+    "resumed",
+    "tool_gated",
+    "signal_delivery_disposed",
+    "budget_exceeded",
+    "budget_usage_reported",
+    "operation_cancelled",
+    "milestone_advanced",
+    "milestone_blocked",
+    "checkpoint_taken",
+    "entropy_sample",
+    "entropy_alert",
+    "agent_process_changed",
+    "memory_written",
+    "memory_queried",
+    "memory_validation_failed",
+    "memory_write_failed",
+    "memory_query_failed",
+    "memory_retrieval_result",
+    "workflow_node_completed",
+    "workflow_nodes_submitted",
+    "workflow_batch_spawned",
+    "workflow_completed",
+    "kernel_observation",
+    "run_terminal",
+    "summary_upgraded",
+    "group_member_joined",
+    "group_budget_charged",
+    "round_started",
+    "round_paced",
+];
+const _vocabularyCoversUnion = true;
+void _vocabularyCoversUnion;
 /**
  * **Single-isolate dev/test implementation** of both capabilities (spec §9.4: one class may
  * implement several capabilities; the *interfaces* stay separate). Its `KernelJournal` half is
@@ -40,3 +99,75 @@ export class InMemorySessionLog {
         return (this.seqCounters.get(sessionId) ?? 0) - 1;
     }
 }
+const PROVIDER_ATTEMPT_KEYS = new Set([
+    "kind", "effect_id", "attempt_seq", "route", "request_fingerprint", "status", "transport_rungs",
+    "last_error_class", "started_at_ms", "finished_at_ms", "usage", "wire_evidence", "accounting_policy_id",
+]);
+const PROVIDER_ATTEMPT_STATUSES = new Set(["success", "transport_exhausted", "aborted", "rejected"]);
+const WIRE_EVIDENCE_KEYS = new Set(["protocol", "request_fingerprint", "response_id", "raw_usage", "replay_state"]);
+function assertCanonicalRoute(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("route must be an object");
+    const route = value;
+    for (const field of ["routeId", "provider", "protocol", "model", "adapterVersion", "capabilitiesRef"]) {
+        if (typeof route[field] !== "string" || route[field].length === 0) {
+            throw new Error(`route ${field} must be a non-empty string`);
+        }
+    }
+    if (!route.endpoint || typeof route.endpoint !== "object" || Array.isArray(route.endpoint)) {
+        throw new Error("route endpoint must be an object");
+    }
+}
+function assertCanonicalWireEvidence(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("wire evidence must be an object");
+    const evidence = value;
+    for (const key of Object.keys(evidence))
+        if (!WIRE_EVIDENCE_KEYS.has(key))
+            throw new Error(`wire evidence has unknown field ${key}`);
+    if (typeof evidence.protocol !== "string" || evidence.protocol.length === 0)
+        throw new Error("wire evidence protocol is required");
+    // G2: the fingerprint is mandatory non-empty — it is what binds this evidence to a request plan.
+    if (typeof evidence.request_fingerprint !== "string" || evidence.request_fingerprint.length === 0) {
+        throw new Error("wire evidence request_fingerprint is required");
+    }
+}
+/**
+ * P4 §3 teeth, wasm mirror of the node/python persisted-record validator. The wasm SessionLog is
+ * in-memory only (no durable read path where validation would otherwise live), so the teeth are
+ * exported for hosts that bridge these events to durable storage — and for the conformance
+ * runner, which pins the rejection contract (`invalid_provider_attempt`) across all three
+ * JSON-projection SDKs. Same checks and message wording as node `assertCanonicalProviderAttempt`.
+ */
+export function assertCanonicalProviderAttemptRecord(event) {
+    for (const key of Object.keys(event))
+        if (!PROVIDER_ATTEMPT_KEYS.has(key))
+            throw new Error(`provider_attempt has unknown field ${key}`);
+    if (typeof event.effect_id !== "string" || event.effect_id.length === 0)
+        throw new Error("provider_attempt effect_id is required");
+    if (!Number.isInteger(event.attempt_seq) || event.attempt_seq < 1)
+        throw new Error("provider_attempt attempt_seq must be a positive integer");
+    assertCanonicalRoute(event.route);
+    if (typeof event.request_fingerprint !== "string" || event.request_fingerprint.length === 0) {
+        throw new Error("provider_attempt request_fingerprint is required");
+    }
+    if (typeof event.status !== "string" || !PROVIDER_ATTEMPT_STATUSES.has(event.status)) {
+        throw new Error("provider_attempt status must be success|transport_exhausted|aborted|rejected");
+    }
+    if (!Number.isInteger(event.transport_rungs) || event.transport_rungs < 0) {
+        throw new Error("provider_attempt transport_rungs must be a non-negative integer");
+    }
+    if (event.last_error_class !== undefined && typeof event.last_error_class !== "string") {
+        throw new Error("provider_attempt last_error_class must be a string");
+    }
+    for (const field of ["started_at_ms", "finished_at_ms"]) {
+        if (typeof event[field] !== "number" || !Number.isFinite(event[field])) {
+            throw new Error(`provider_attempt ${field} must be a finite number`);
+        }
+    }
+    if (event.wire_evidence !== undefined)
+        assertCanonicalWireEvidence(event.wire_evidence);
+    if (event.accounting_policy_id !== undefined && typeof event.accounting_policy_id !== "string") {
+        throw new Error("provider_attempt accounting_policy_id must be a string");
+    }
+}

package/dist/runtime/session-repair.d.ts

@@ -1,4 +1,4 @@
-import type { Message, ProviderReplay, ToolCall } from "../types.js";
+import type { Message, ProviderReplay, ProviderWireEvidence, ToolCall } from "../types.js";
 import type { SessionEvent } from "./session-log.js";
 import type { WorkflowNodeStatus } from "./types/agent.js";
 export { REPLAY_CONTENT_MAX_BYTES as RECOVERY_CONTENT_MAX_BYTES } from "./replay-sanitize.js";
@@ -27,6 +27,9 @@ export declare function buildLlmCompletedEvent(input: {
     tokenCount?: number;
     toolCalls: ToolCall[];
     providerReplay?: ProviderReplay;
+    effectId?: string;
+    invocationId?: string;
+    wireEvidence?: ProviderWireEvidence;
 }): Extract<SessionEvent, {
     kind: "llm_completed";
 }>;

package/dist/runtime/session-repair.js

@@ -21,6 +21,11 @@ export function normalizeLlmCompleted(event, maxBytes) {
         tool_calls: toolCalls,
         token_count: event.token_count ?? estimateTokenCount(content),
         ...(providerReplay ? { provider_replay: providerReplay } : {}),
+        // P4 §3: the evidence-plane fields ride along verbatim — recovery never reads them
+        // (SessionLog is evidence, not authority), so normalize must neither synthesize nor drop them.
+        ...(event.effect_id !== undefined ? { effect_id: event.effect_id } : {}),
+        ...(event.invocation_id !== undefined ? { invocation_id: event.invocation_id } : {}),
+        ...(event.wire_evidence !== undefined ? { wire_evidence: event.wire_evidence } : {}),
     };
 }
 export function repairEventsForRecovery(events, maxBytes) {
@@ -38,6 +43,9 @@ export function buildLlmCompletedEvent(input) {
         tool_calls: input.toolCalls ?? [],
         token_count: input.tokenCount,
         provider_replay: input.providerReplay,
+        ...(input.effectId !== undefined ? { effect_id: input.effectId } : {}),
+        ...(input.invocationId !== undefined ? { invocation_id: input.invocationId } : {}),
+        ...(input.wireEvidence !== undefined ? { wire_evidence: input.wireEvidence } : {}),
     });
 }
 export function buildRunTerminalEvent(input) {

package/dist/types.d.ts

@@ -273,6 +273,21 @@ export interface ProviderReplay {
     native_message?: unknown;
     tool_calls?: unknown[];
 }
+/** P3 §3.3 (D1) mirror of the node ProviderWireEvidence — SessionLog wire evidence bundle. */
+export interface ProviderWireEvidence {
+    protocol: ProviderProtocol;
+    /** → ProviderRequestPlan.fingerprint. Mandatory non-empty (G2). */
+    request_fingerprint: string;
+    response_id?: string;
+    /** BoundedJson semantics: producers truncate to ≤4KB. */
+    raw_usage?: unknown;
+    replay_state?: ProviderReplay;
+}
+/** P4 §1.2 mirror: host-observed transport facts for one provider execution. */
+export interface ProviderTransportTelemetry {
+    rungs: number;
+    responseId?: string;
+}
 export interface LLMProvider {
     createRunState?(): ProviderRunState;
     runtimePolicy?(): {
@@ -291,6 +306,8 @@ export interface LLMProvider {
     };
     peekProviderReplay?(message: Pick<Message, "content" | "toolCalls">): ProviderReplay | undefined;
     seedProviderReplay?(message: Pick<Message, "content" | "toolCalls">, replay: ProviderReplay): void;
+    /** P4-S1 mirror: transport facts of the most recent execution (host evidence only, B7). */
+    peekTransportTelemetry?(): ProviderTransportTelemetry | undefined;
     countTokens?(context: RenderedContext, tools: ToolSchema[], extensions?: Record<string, unknown>): Promise<PromptMeasurement>;
     complete(context: RenderedContext, tools: ToolSchema[], extensions?: Record<string, unknown>): Promise<Message>;
     stream(context: RenderedContext, tools: ToolSchema[], extensions?: Record<string, unknown>, state?: ProviderRunState, 

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@deepstrike/wasm",
-  "version": "0.2.62",
+  "version": "0.2.64",
   "description": "DeepStrike WASM SDK — browser, Cloudflare Workers, Deno Deploy",
+  "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -13,10 +14,10 @@
     "build:wasm": "wasm-pack build ../crates/deepstrike-wasm --target bundler --out-dir ../../wasm/pkg",
     "build": "tsc",
     "test": "node --experimental-vm-modules node_modules/.bin/jest",
-    "test:canonical-binding": "wasm-pack build ../crates/deepstrike-wasm --target nodejs --dev --out-dir ../../wasm/pkg-node && node tests/canonical-binding.node.cjs"
+    "test:canonical-binding": "wasm-pack build ../crates/deepstrike-wasm --target nodejs --dev --out-dir ../../wasm/pkg-node && node tests/canonical-binding.node.cjs && node tests/golden-fixtures-sweep.node.cjs"
   },
   "dependencies": {
-    "@deepstrike/wasm-kernel": "0.2.62"
+    "@deepstrike/wasm-kernel": "0.2.64"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",