@deepstrike/wasm 0.2.63 → 0.2.65

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { RuntimeRunner, collectText, runAgent, runFanout, InMemorySessionLog, SESSION_EVENT_KINDS, LocalExecutionPlane, DEFAULT_NATIVE_SIGNAL_POLICY, DEFAULT_NATIVE_GOVERNANCE_POLICY, DEFAULT_SANDBOX_POLICY, assertNativeProfile, osProfile, validateDeclarativePolicy, ReplayProvider, extractRecordedMessages, judge, buildEvalMessages, parseVerdict, verdictOutputSchema, } from "./runtime/index.js";
+export { RuntimeRunner, collectText, runAgent, runFanout, InMemorySessionLog, assertCanonicalProviderAttemptRecord, SESSION_EVENT_KINDS, LocalExecutionPlane, DEFAULT_NATIVE_SIGNAL_POLICY, DEFAULT_NATIVE_GOVERNANCE_POLICY, DEFAULT_SANDBOX_POLICY, assertNativeProfile, osProfile, validateDeclarativePolicy, ReplayProvider, extractRecordedMessages, judge, buildEvalMessages, parseVerdict, verdictOutputSchema, } from "./runtime/index.js";
 export { DriverKernelJournal, InMemoryJournalDriver, InMemoryKernelJournal, JournalCasConflictError, JournalIntegrityError, JournalIoError, } from "./runtime/kernel-journal.js";
 export type { CheckpointCandidate, InstalledCheckpoint, JournalAppendReceipt, JournalEntry, JournalHead, JournalPruneReceipt, JournalRecordInput, JournalStorageDriver, KernelJournal, } from "./runtime/kernel-journal.js";
 export { CANONICAL_CONTENT_PARTS_PREFIX, encodeCanonicalContentParts, decodeCanonicalContentParts, } from "./runtime/kernel-step.js";
@@ -42,7 +42,7 @@ export type { RuntimeSignal, SignalSource } from "./signals/index.js";
 export { PermissionManager, PermissionMode } from "./safety/index.js";
 export { createProviderRequestPlan, createProviderRequestPlanForProvider, estimateProviderPromptTokens, measurementForPlan, normalizeProviderUsage, priceProviderUsage, recordPromptMeasurement } from "./providers/request-plan.js";
 export type { CostObservation, NormalizedProviderUsage, PricingSnapshot, ProviderRequestEndpoint, ProviderRequestPlan, ProviderUsage, RecordedPromptMeasurement, ResolvedProviderRoute } from "./providers/request-plan.js";
-export type { ProviderAttempt, ProviderAttemptRecord, ProviderAttemptStatus, ModelInvocation, InvocationOutcome, UsageSettlement, UsageAccountingPolicy, } from "./runtime/execution-evidence.js";
+export type { ProviderAttempt, ProviderAttemptRecord, ProviderAttemptStatus, ModelInvocation, InvocationOutcome, ModelUsageSettlement, UsageAccountingPolicy, } from "./runtime/execution-evidence.js";
 export { FULL_FOOTPRINT_USAGE_ACCOUNTING_POLICY, providerAttemptToRecord, tryNormalizeProviderUsage } from "./runtime/execution-evidence.js";
 export { decodeCanonicalStopReason, normalizeProviderStopReason } from "./providers/stop-reason.js";
 export type { CanonicalStopReason } from "./providers/stop-reason.js";

package/dist/index.js

@@ -1,4 +1,4 @@
-export { RuntimeRunner, collectText, runAgent, runFanout, InMemorySessionLog, SESSION_EVENT_KINDS, LocalExecutionPlane, DEFAULT_NATIVE_SIGNAL_POLICY, DEFAULT_NATIVE_GOVERNANCE_POLICY, DEFAULT_SANDBOX_POLICY, assertNativeProfile, osProfile, validateDeclarativePolicy, ReplayProvider, extractRecordedMessages, judge, buildEvalMessages, parseVerdict, verdictOutputSchema, } from "./runtime/index.js";
+export { RuntimeRunner, collectText, runAgent, runFanout, InMemorySessionLog, assertCanonicalProviderAttemptRecord, SESSION_EVENT_KINDS, LocalExecutionPlane, DEFAULT_NATIVE_SIGNAL_POLICY, DEFAULT_NATIVE_GOVERNANCE_POLICY, DEFAULT_SANDBOX_POLICY, assertNativeProfile, osProfile, validateDeclarativePolicy, ReplayProvider, extractRecordedMessages, judge, buildEvalMessages, parseVerdict, verdictOutputSchema, } from "./runtime/index.js";
 // ── Durable transaction capability (Canonical Kernel ABI §9.1) ──────────────
 export { DriverKernelJournal, InMemoryJournalDriver, InMemoryKernelJournal, JournalCasConflictError, JournalIntegrityError, JournalIoError, } from "./runtime/kernel-journal.js";
 // ── content-parts-v1 registered encoding (F14/B5; byte-pinned by sdk-conformance) ──

package/dist/providers/request-plan.d.ts

@@ -1,4 +1,4 @@
-import type { RenderedContext, ToolSchema } from "../types.js";
+import type { ProviderProtocol, RenderedContext, ToolSchema } from "../types.js";
 export interface ProviderRequestEndpoint {
     id: string;
     protocol: string;
@@ -40,7 +40,7 @@ export interface ProviderUsage {
 export interface ResolvedProviderRoute {
     routeId: string;
     provider: string;
-    protocol: string;
+    protocol: ProviderProtocol;
     model: string;
     endpoint: ProviderRequestEndpoint;
     adapterVersion: string;
@@ -95,3 +95,26 @@ export declare function recordPromptMeasurement(plan: Pick<ProviderRequestPlan,
 export declare function measurementForPlan(plan: Pick<ProviderRequestPlan, "fingerprint">, record: RecordedPromptMeasurement | undefined): RecordedPromptMeasurement | undefined;
 export declare function normalizeProviderUsage(usage: ProviderUsage): NormalizedProviderUsage;
 export declare function priceProviderUsage(usage: NormalizedProviderUsage, snapshot: PricingSnapshot, observedAt?: string | Date): CostObservation;
+/**
+ * P4-S1: assemble the run's route once at runner construction (P4 §0.2 — the provider is
+ * fixed for the run today; a future failover resolver re-evaluates per attempt with the same
+ * shape). Never throws: evidence assembly degrades to "unknown" fields rather than breaking a
+ * run. The wasm bundle cannot read its own package manifest at runtime (browser targets), so
+ * adapterVersion is honestly "unknown" — the field is a report, not a gate.
+ */
+export declare function resolveProviderRoute(provider: {
+    descriptor?(): {
+        provider: string;
+        protocol: string;
+        model: string;
+    };
+    requestPlanIdentity?(): {
+        providerId?: string;
+        modelId?: string;
+        endpoint?: {
+            id?: string;
+            protocol?: string;
+            baseURL?: string;
+        };
+    };
+}): ResolvedProviderRoute;

package/dist/providers/request-plan.js

@@ -106,6 +106,55 @@ function sanitizeEndpoint(endpoint) {
         return { ...clone(endpoint), baseURL: "" };
     }
 }
+const KNOWN_GENERATION_PROTOCOLS = new Set([
+    "anthropic-messages",
+    "openai-chat",
+    "openai-responses",
+    "gemini",
+    "ollama-chat",
+]);
+/**
+ * P4-S1: assemble the run's route once at runner construction (P4 §0.2 — the provider is
+ * fixed for the run today; a future failover resolver re-evaluates per attempt with the same
+ * shape). Never throws: evidence assembly degrades to "unknown" fields rather than breaking a
+ * run. The wasm bundle cannot read its own package manifest at runtime (browser targets), so
+ * adapterVersion is honestly "unknown" — the field is a report, not a gate.
+ */
+export function resolveProviderRoute(provider) {
+    try {
+        const descriptor = provider.descriptor?.() ?? { provider: "unknown", protocol: "unknown", model: "unknown" };
+        const identity = provider.requestPlanIdentity?.();
+        const protocolRaw = identity?.endpoint?.protocol ?? descriptor.protocol;
+        // Evidence records what the descriptor said, even when a foreign provider speaks a protocol
+        // outside the in-tree vocabulary — the field is a report, not a gate.
+        const protocol = protocolRaw;
+        const route = {
+            provider: identity?.providerId ?? descriptor.provider,
+            protocol,
+            model: identity?.modelId ?? descriptor.model,
+            endpoint: sanitizeEndpoint({
+                id: identity?.endpoint?.id ?? `${descriptor.provider}.${descriptor.protocol}`,
+                protocol: protocolRaw,
+                baseURL: identity?.endpoint?.baseURL ?? "",
+            }),
+            adapterVersion: "unknown",
+            capabilitiesRef: KNOWN_GENERATION_PROTOCOLS.has(protocolRaw) ? protocolRaw : "unknown",
+        };
+        // §1.3: content addressing covers every field EXCEPT capabilitiesRef (a reference, not content).
+        const { capabilitiesRef: _ref, ...addressed } = route;
+        return { ...route, routeId: sha256Hex(stableJson(addressed)) };
+    }
+    catch {
+        const fallback = {
+            provider: "unknown",
+            protocol: "unknown",
+            model: "unknown",
+            endpoint: { id: "unknown", protocol: "unknown", baseURL: "" },
+            adapterVersion: "unknown",
+        };
+        return { ...fallback, capabilitiesRef: "unknown", routeId: sha256Hex(stableJson(fallback)) };
+    }
+}
 function sanitizeMaterialValue(value) {
     if (value === undefined || typeof value === "function")
         return undefined;

package/dist/runtime/execution-evidence.d.ts

@@ -29,7 +29,7 @@ export interface InvocationOutcome {
     selectedEffectId: string;
     stopReason?: CanonicalStopReason;
     /** Absent on a failed chain (nothing settled). */
-    settlement?: UsageSettlement;
+    settlement?: ModelUsageSettlement;
 }
 export type ProviderAttemptStatus = "success" | "transport_exhausted" | "aborted" | "rejected";
 /**
@@ -84,7 +84,7 @@ export declare function providerAttemptToRecord(attempt: ProviderAttempt, accoun
  * existing ResolveEffect wire shape — this is what the runner already feeds the kernel as
  * `observed_input_tokens` / `observed_output_tokens`.
  */
-export interface UsageSettlement {
+export interface ModelUsageSettlement {
     observed_input_tokens: number;
     observed_output_tokens: number;
 }
@@ -95,7 +95,7 @@ export interface UsageSettlement {
  */
 export interface UsageAccountingPolicy {
     policyId: string;
-    settle(usage: NormalizedProviderUsage): UsageSettlement;
+    settle(usage: NormalizedProviderUsage): ModelUsageSettlement;
 }
 /**
  * The default policy = today's implicit runner behavior exactly (full input footprint + full

package/dist/runtime/index.d.ts

@@ -1,5 +1,5 @@
 export type { SessionEvent, SessionEventKind, SessionLog } from "./session-log.js";
-export { InMemorySessionLog } from "./session-log.js";
+export { InMemorySessionLog, assertCanonicalProviderAttemptRecord } from "./session-log.js";
 export { SESSION_EVENT_KINDS } from "./session-log.js";
 export { DriverKernelJournal, InMemoryJournalDriver, InMemoryKernelJournal, JournalCasConflictError, JournalIntegrityError, JournalIoError, } from "./kernel-journal.js";
 export type { CheckpointCandidate, InstalledCheckpoint, JournalAppendReceipt, JournalEntry, JournalHead, JournalPruneReceipt, JournalRecordInput, JournalStorageDriver, KernelJournal, } from "./kernel-journal.js";

package/dist/runtime/index.js

@@ -1,4 +1,4 @@
-export { InMemorySessionLog } from "./session-log.js";
+export { InMemorySessionLog, assertCanonicalProviderAttemptRecord } from "./session-log.js";
 // Registered session-event vocabulary (F9/S3; manifest-pinned by sdk-conformance, P7-S4)
 export { SESSION_EVENT_KINDS } from "./session-log.js";
 // Durable transaction capability (Canonical Kernel ABI §9.1)

package/dist/runtime/runner.d.ts

@@ -13,6 +13,7 @@ import { type ReducerRegistry } from "./reducers.js";
 import { type NativeOsProfile, type OsProfileId, type SignalPolicy } from "./os-profile.js";
 import { PayloadStore } from "./payload-store.js";
 import { type ContextPolicyOverrides } from "./context-policy.js";
+import { type UsageAccountingPolicy } from "./execution-evidence.js";
 export interface MemoryWriteRateLimit {
     maxWrites: number;
     windowMs: number;
@@ -140,6 +141,10 @@ export interface RuntimeOptions {
     governancePolicy?: GovernancePolicy;
     signalPolicy?: SignalPolicy;
     promptBudget?: PromptBudget;
+    /** P4 §2.1: the named policy turning a provider measurement into the two observed_* numbers
+     *  that cross the kernel boundary. Undefined ⇒ FULL_FOOTPRINT (the numbers the runner has
+     *  always fed); only makes the conversion named, pinnable on `provider_attempt`, replayable. */
+    usageAccountingPolicy?: UsageAccountingPolicy;
     /** Stable replayable context behavior; ratios are normalized to integer ppm. */
     contextPolicy?: ContextPolicyOverrides;
     schedulerPolicy?: SchedulerPolicy;
@@ -281,7 +286,24 @@ export declare class RuntimeRunner {
     private activePageOutArchive;
     /** Provider continuation emitted after a canonical nested workflow completes. */
     private workflowContinuation;
+    /** P4 (0.2.64 Evidence Plane): the resolved route every provider attempt is pinned to —
+     *  resolved once so evidence identity is byte-stable across the run (C6.3 pins in-run
+     *  route stability). */
+    private readonly providerRoute;
+    private readonly usageAccountingPolicy;
+    /** P4 §1.1: the active invocation's derived identity = its chain's FIRST effect_id. Tracked
+     *  across the kernel-recovered retry loop; a fresh call_provider with no pending retry opens
+     *  a new invocation. */
+    private providerRetryPending;
+    private activeProviderInvocationId;
     constructor(opts: RuntimeOptions);
+    /**
+     * P4-S1 (G1): land one provider_attempt evidence record per effect execution. Pure host
+     * evidence (B7) — appended AFTER the transport fact exists (success/failure/abort), never
+     * consulted for kernel input. The accounting policy id pins only when a measurement exists,
+     * so (usage, policy_id) deterministically recomputes the settlement that crossed the wire.
+     */
+    private appendProviderAttempt;
     private resolveKernelJournal;
     private createCanonicalRuntime;
     private commitKernelApply;

package/dist/runtime/runner.js

@@ -19,7 +19,8 @@ import { assertNativeProfile } from "./os-profile.js";
 import { classifyProviderError, providerErrorEventFields } from "../providers/provider-error.js";
 import { PayloadStore } from "./payload-store.js";
 import { contextPolicy, normalizeContextPolicy, } from "./context-policy.js";
-import { createProviderRequestPlanForProvider, estimateProviderPromptTokens, measurementForPlan, recordPromptMeasurement, } from "../providers/request-plan.js";
+import { createProviderRequestPlanForProvider, estimateProviderPromptTokens, measurementForPlan, recordPromptMeasurement, resolveProviderRoute, } from "../providers/request-plan.js";
+import { FULL_FOOTPRINT_USAGE_ACCOUNTING_POLICY, providerAttemptToRecord, tryNormalizeProviderUsage, } from "./execution-evidence.js";
 export function schedulerPolicyToKernel(policy) {
     const allowed = new Set([
         "criticalPathWeight", "fanoutWeight", "ageWeight", "tokenCostWeight",
@@ -121,12 +122,36 @@ export class RuntimeRunner {
     activePageOutArchive;
     /** Provider continuation emitted after a canonical nested workflow completes. */
     workflowContinuation = null;
+    /** P4 (0.2.64 Evidence Plane): the resolved route every provider attempt is pinned to —
+     *  resolved once so evidence identity is byte-stable across the run (C6.3 pins in-run
+     *  route stability). */
+    providerRoute;
+    usageAccountingPolicy;
+    /** P4 §1.1: the active invocation's derived identity = its chain's FIRST effect_id. Tracked
+     *  across the kernel-recovered retry loop; a fresh call_provider with no pending retry opens
+     *  a new invocation. */
+    providerRetryPending = false;
+    activeProviderInvocationId;
     constructor(opts) {
         this.opts = opts;
         const schemaAttempts = opts.workflowSchemaValidationAttempts ?? 2;
         if (!Number.isInteger(schemaAttempts) || schemaAttempts < 1 || schemaAttempts > 16) {
             throw new RangeError("workflowSchemaValidationAttempts must be an integer between 1 and 16");
         }
+        this.providerRoute = resolveProviderRoute(opts.provider);
+        this.usageAccountingPolicy = opts.usageAccountingPolicy ?? FULL_FOOTPRINT_USAGE_ACCOUNTING_POLICY;
+    }
+    /**
+     * P4-S1 (G1): land one provider_attempt evidence record per effect execution. Pure host
+     * evidence (B7) — appended AFTER the transport fact exists (success/failure/abort), never
+     * consulted for kernel input. The accounting policy id pins only when a measurement exists,
+     * so (usage, policy_id) deterministically recomputes the settlement that crossed the wire.
+     */
+    async appendProviderAttempt(sessionId, attempt) {
+        await this.opts.sessionLog.append(sessionId, {
+            kind: "provider_attempt",
+            ...providerAttemptToRecord(attempt, attempt.usage ? this.usageAccountingPolicy.policyId : undefined),
+        });
     }
     resolveKernelJournal() {
         const embedded = this.opts.sessionLog;
@@ -269,6 +294,7 @@ export class RuntimeRunner {
                 agent_id: this.opts.agentId,
                 system_prompt: this.opts.systemPrompt,
                 ...(attachments ? { attachments } : {}),
+                route: this.providerRoute,
             });
         }
         yield* this.execute(req.sessionId, runId, req.goal, req.criteria ?? [], req.extensions, prior.length > 0 ? prior : undefined, midRun, attachments);
@@ -355,7 +381,7 @@ export class RuntimeRunner {
         await this.commitKernelApply(this.activeKernel, this.pendingObservations, { kind: "skill_deactivated", name });
         this.knowledgePushedSkills.delete(name);
     }
-    async resolveKernelSuspend(requests, runtime, sessionId) {
+    async resolveKernelSuspend(requests, runtime, sessionId, effectId) {
         const approved = [];
         const denied = [];
         const events = [];
@@ -421,6 +447,8 @@ export class RuntimeRunner {
                 await this.opts.sessionLog.append(sessionId, {
                     kind: "tool_completed",
                     turn: runtime.turn(),
+                    // P4 §1.1: governance-denied completions carry the requesting effect's identity.
+                    ...(effectId !== undefined ? { effect_id: effectId } : {}),
                     results: [{
                             call_id: requestAction.callId,
                             output: `permission denied: ${denyReason}`,
@@ -638,6 +666,18 @@ export class RuntimeRunner {
                     break;
                 if (action.kind === "call_provider") {
                     const providerEffectId = action.effectId;
+                    // P4 §1.1: invocation identity is derived, never minted — the chain's FIRST effect_id.
+                    // A provider_error commit armed `providerRetryPending`, so this effect CONTINUES the
+                    // pending invocation; otherwise it opens a new one. The chain itself lives in the
+                    // journal (each hop a resolution input → new effect); this is the SessionLog evidence
+                    // projection of it.
+                    if (!this.providerRetryPending || this.activeProviderInvocationId === undefined) {
+                        this.activeProviderInvocationId = providerEffectId;
+                    }
+                    this.providerRetryPending = false;
+                    const invocationId = this.activeProviderInvocationId;
+                    // Host wall-clock, pure evidence (B7/DEC-2): never crosses into kernel input.
+                    const attemptStartedAtMs = Date.now();
                     const finalToolCalls = [];
                     let finalText = "";
                     // I5: governance schema-level pre-filter — see Node runner for full rationale.
@@ -684,7 +724,7 @@ export class RuntimeRunner {
                             });
                         }
                         recordedMeasurements.set(providerPlan.fingerprint, promptMeasurement);
-                        await this.opts.sessionLog.append(sessionId, { kind: "prompt_measured", turn: runtime.turn(), measurement: promptMeasurement });
+                        await this.opts.sessionLog.append(sessionId, { kind: "prompt_measured", turn: runtime.turn(), measurement: promptMeasurement, effect_id: providerEffectId });
                     }
                     const reservedPromptTokens = (this.opts.promptBudget?.promptOverheadTokens ?? 0)
                         + (this.opts.promptBudget?.outputReserveTokens ?? 0)
@@ -693,11 +733,29 @@ export class RuntimeRunner {
                         && promptMeasurement.source.kind !== "heuristic"
                         && promptMeasurement.inputTokens + reservedPromptTokens > this.opts.maxTokens;
                     if (context.budgetOverflow || measuredOverflow) {
+                        // P4 §1.2: blocked BEFORE any transport — zero rungs, status rejected. The
+                        // fingerprint still binds the would-be request to its prompt_measured record (G2).
+                        await this.appendProviderAttempt(sessionId, {
+                            effectId: providerEffectId,
+                            attemptSeq: 1,
+                            route: this.providerRoute,
+                            requestFingerprint: providerPlan.fingerprint,
+                            status: "rejected",
+                            transportRungs: 0,
+                            lastErrorClass: "context_overflow",
+                            startedAtMs: attemptStartedAtMs,
+                            finishedAtMs: Date.now(),
+                            wireEvidence: {
+                                protocol: this.providerRoute.protocol,
+                                request_fingerprint: providerPlan.fingerprint,
+                            },
+                        });
                         action = await this.commitKernelAction(runtime, this.pendingObservations, {
                             kind: "provider_error", effect_id: providerEffectId,
                             message: "provider-visible prompt exceeds the configured context budget",
                             error_kind: "context_overflow", retryable: false,
                         });
+                        this.providerRetryPending = action.kind === "call_provider";
                         continue;
                     }
                     const abortSignal = this.abortController?.signal;
@@ -741,6 +799,23 @@ export class RuntimeRunner {
                         else {
                             const descriptor = this.opts.provider.descriptor?.();
                             const providerError = classifyProviderError(descriptor?.provider ?? "unknown", err);
+                            // P4 §1.2: the transport ladder is exhausted — one attempt record, error CLASS only
+                            // (B1: never the raw vendor text). The single-shot stream path reports 1 rung.
+                            await this.appendProviderAttempt(sessionId, {
+                                effectId: providerEffectId,
+                                attemptSeq: 1,
+                                route: this.providerRoute,
+                                requestFingerprint: providerPlan.fingerprint,
+                                status: "transport_exhausted",
+                                transportRungs: 1,
+                                lastErrorClass: providerError.kind,
+                                startedAtMs: attemptStartedAtMs,
+                                finishedAtMs: Date.now(),
+                                wireEvidence: {
+                                    protocol: this.providerRoute.protocol,
+                                    request_fingerprint: providerPlan.fingerprint,
+                                },
+                            });
                             // Reactive recovery is now a kernel decision. Forward the raw provider error and
                             // dispatch whatever the kernel returns: `call_provider` to retry with a freshly
                             // compacted context, or `done` to terminate with an honest `ContextOverflow`. The
@@ -752,6 +827,9 @@ export class RuntimeRunner {
                                 message: providerError.message,
                                 ...providerErrorEventFields(providerError),
                             });
+                            // P4 §1.1: a kernel-recovered retry CONTINUES this invocation (the journal holds the
+                            // causation hop); a terminal closes it.
+                            this.providerRetryPending = action.kind === "call_provider";
                             // Withholding (query.ts parity): surface the raw provider error only when the kernel
                             // could NOT recover (it returned a terminal). On a recovered retry (`call_provider`)
                             // the error stays hidden. `continue` re-enters the loop: a recovered turn persists its
@@ -765,6 +843,21 @@ export class RuntimeRunner {
                     }
                     // #2-B-ii: stream aborted (preempt/interrupt) via the break path — end the turn now.
                     if (abortSignal?.aborted) {
+                        // P4 §1.2: host cancellation mid-stream — the attempt is evidence too.
+                        await this.appendProviderAttempt(sessionId, {
+                            effectId: providerEffectId,
+                            attemptSeq: 1,
+                            route: this.providerRoute,
+                            requestFingerprint: providerPlan.fingerprint,
+                            status: "aborted",
+                            transportRungs: 1,
+                            startedAtMs: attemptStartedAtMs,
+                            finishedAtMs: Date.now(),
+                            wireEvidence: {
+                                protocol: this.providerRoute.protocol,
+                                request_fingerprint: providerPlan.fingerprint,
+                            },
+                        });
                         action = await this.commitKernelAction(runtime, this.pendingObservations, {
                             kind: "cancel_operation",
                             reason: this.cancellationReason ?? "user",
@@ -778,22 +871,60 @@ export class RuntimeRunner {
                         toolCalls: finalToolCalls,
                         tokenCount: turnOutputTokens || turnTokens || undefined,
                     };
+                    // P4 §2: assemble the measurement from the exact numbers that cross the boundary today
+                    // (input/output turn counters + the cache split). An invalid frame degrades to no
+                    // measurement (evidence never breaks a run); the settlement then falls back to the raw
+                    // counts below.
+                    const attemptUsage = (turnInputTokens > 0 || turnOutputTokens > 0)
+                        ? tryNormalizeProviderUsage({
+                            inputTokens: turnInputTokens,
+                            outputTokens: turnOutputTokens,
+                            ...(turnCacheReadTokens > 0 ? { cacheReadInputTokens: turnCacheReadTokens } : {}),
+                            ...(turnCacheCreationTokens > 0 ? { cacheCreationInputTokens: turnCacheCreationTokens } : {}),
+                        })
+                        : undefined;
+                    const settlement = attemptUsage ? this.usageAccountingPolicy.settle(attemptUsage) : undefined;
                     const providerEvent = {
                         kind: "provider_result",
                         effect_id: providerEffectId,
                         message: messageToKernelMessage(assistantMessage),
-                        ...(turnInputTokens > 0 ? { observed_input_tokens: turnInputTokens } : {}),
-                        ...(turnOutputTokens > 0 ? { observed_output_tokens: turnOutputTokens } : {}),
+                        // P4-S2: observed_* now comes from the pinned policy's settlement of the measurement.
+                        // Under the default full-footprint policy these are provably the numbers the runner
+                        // has always fed (inputTokens/outputTokens verbatim under the same >0 gates).
+                        ...(turnInputTokens > 0 ? { observed_input_tokens: settlement?.observed_input_tokens ?? turnInputTokens } : {}),
+                        ...(turnOutputTokens > 0 ? { observed_output_tokens: settlement?.observed_output_tokens ?? turnOutputTokens } : {}),
                         ...(turnStopReason ? { stop_reason: turnStopReason } : {}),
                     };
-                    action = await this.commitKernelAction(runtime, this.pendingObservations, providerEvent);
+                    // P4-S1: land the attempt evidence BEFORE the kernel resolution commits — the record
+                    // describes the transport fact, which exists regardless of what the kernel decides next.
                     const providerReplay = peekProviderReplay(this.opts.provider, finalText, finalToolCalls);
+                    const wireEvidence = {
+                        protocol: this.providerRoute.protocol,
+                        request_fingerprint: providerPlan.fingerprint,
+                        ...(providerReplay !== undefined ? { replay_state: providerReplay } : {}),
+                    };
+                    await this.appendProviderAttempt(sessionId, {
+                        effectId: providerEffectId,
+                        attemptSeq: 1,
+                        route: this.providerRoute,
+                        requestFingerprint: providerPlan.fingerprint,
+                        status: "success",
+                        transportRungs: 1,
+                        startedAtMs: attemptStartedAtMs,
+                        finishedAtMs: Date.now(),
+                        ...(attemptUsage !== undefined ? { usage: attemptUsage } : {}),
+                        wireEvidence,
+                    });
+                    action = await this.commitKernelAction(runtime, this.pendingObservations, providerEvent);
                     await this.opts.sessionLog.append(sessionId, buildLlmCompletedEvent({
                         turn: runtime.turn(),
                         content: finalText,
                         tokenCount: turnOutputTokens || turnTokens || undefined,
                         toolCalls: finalToolCalls,
                         providerReplay,
+                        effectId: providerEffectId,
+                        invocationId,
+                        wireEvidence,
                     }));
                     // P0-C: per-turn tool-gating telemetry. `activeSkill` reflects the skill in effect GOING INTO
                     // this turn; a `skill` call here only takes effect next turn — emit first, then advance.
@@ -823,7 +954,7 @@ export class RuntimeRunner {
                     }
                 }
                 else if (action.kind === "request_approval") {
-                    const resolved = await this.resolveKernelSuspend(action.requests, runtime, sessionId);
+                    const resolved = await this.resolveKernelSuspend(action.requests, runtime, sessionId, action.effectId);
                     for (const evt of resolved.events)
                         yield evt;
                     action = await this.commitKernelAction(runtime, this.pendingObservations, {
@@ -1076,6 +1207,8 @@ export class RuntimeRunner {
                     await this.opts.sessionLog.append(sessionId, {
                         kind: "tool_completed",
                         turn: runtime.turn(),
+                        // P4 §1.1: the completion carries the execute_tools effect's identity.
+                        effect_id: toolEffectId,
                         results: toolResults.map(r => ({
                             call_id: r.callId,
                             output: r.output,
@@ -1530,6 +1663,7 @@ export class RuntimeRunner {
                 goal: `workflow:${spec.nodes.length} nodes`,
                 criteria: [],
                 ...(this.opts.agentId ? { agent_id: this.opts.agentId } : {}),
+                route: this.providerRoute,
             });
             await this.initializeWorkflowKernel(sessionId, runId);
         }

package/dist/runtime/session-log.d.ts

@@ -395,3 +395,11 @@ export declare class InMemorySessionLog implements SessionLog {
     }>>;
     latestSeq(sessionId: string): Promise<number>;
 }
+/**
+ * P4 §3 teeth, wasm mirror of the node/python persisted-record validator. The wasm SessionLog is
+ * in-memory only (no durable read path where validation would otherwise live), so the teeth are
+ * exported for hosts that bridge these events to durable storage — and for the conformance
+ * runner, which pins the rejection contract (`invalid_provider_attempt`) across all three
+ * JSON-projection SDKs. Same checks and message wording as node `assertCanonicalProviderAttempt`.
+ */
+export declare function assertCanonicalProviderAttemptRecord(event: Record<string, unknown>): void;

package/dist/runtime/session-log.js

@@ -99,3 +99,75 @@ export class InMemorySessionLog {
         return (this.seqCounters.get(sessionId) ?? 0) - 1;
     }
 }
+const PROVIDER_ATTEMPT_KEYS = new Set([
+    "kind", "effect_id", "attempt_seq", "route", "request_fingerprint", "status", "transport_rungs",
+    "last_error_class", "started_at_ms", "finished_at_ms", "usage", "wire_evidence", "accounting_policy_id",
+]);
+const PROVIDER_ATTEMPT_STATUSES = new Set(["success", "transport_exhausted", "aborted", "rejected"]);
+const WIRE_EVIDENCE_KEYS = new Set(["protocol", "request_fingerprint", "response_id", "raw_usage", "replay_state"]);
+function assertCanonicalRoute(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("route must be an object");
+    const route = value;
+    for (const field of ["routeId", "provider", "protocol", "model", "adapterVersion", "capabilitiesRef"]) {
+        if (typeof route[field] !== "string" || route[field].length === 0) {
+            throw new Error(`route ${field} must be a non-empty string`);
+        }
+    }
+    if (!route.endpoint || typeof route.endpoint !== "object" || Array.isArray(route.endpoint)) {
+        throw new Error("route endpoint must be an object");
+    }
+}
+function assertCanonicalWireEvidence(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("wire evidence must be an object");
+    const evidence = value;
+    for (const key of Object.keys(evidence))
+        if (!WIRE_EVIDENCE_KEYS.has(key))
+            throw new Error(`wire evidence has unknown field ${key}`);
+    if (typeof evidence.protocol !== "string" || evidence.protocol.length === 0)
+        throw new Error("wire evidence protocol is required");
+    // G2: the fingerprint is mandatory non-empty — it is what binds this evidence to a request plan.
+    if (typeof evidence.request_fingerprint !== "string" || evidence.request_fingerprint.length === 0) {
+        throw new Error("wire evidence request_fingerprint is required");
+    }
+}
+/**
+ * P4 §3 teeth, wasm mirror of the node/python persisted-record validator. The wasm SessionLog is
+ * in-memory only (no durable read path where validation would otherwise live), so the teeth are
+ * exported for hosts that bridge these events to durable storage — and for the conformance
+ * runner, which pins the rejection contract (`invalid_provider_attempt`) across all three
+ * JSON-projection SDKs. Same checks and message wording as node `assertCanonicalProviderAttempt`.
+ */
+export function assertCanonicalProviderAttemptRecord(event) {
+    for (const key of Object.keys(event))
+        if (!PROVIDER_ATTEMPT_KEYS.has(key))
+            throw new Error(`provider_attempt has unknown field ${key}`);
+    if (typeof event.effect_id !== "string" || event.effect_id.length === 0)
+        throw new Error("provider_attempt effect_id is required");
+    if (!Number.isInteger(event.attempt_seq) || event.attempt_seq < 1)
+        throw new Error("provider_attempt attempt_seq must be a positive integer");
+    assertCanonicalRoute(event.route);
+    if (typeof event.request_fingerprint !== "string" || event.request_fingerprint.length === 0) {
+        throw new Error("provider_attempt request_fingerprint is required");
+    }
+    if (typeof event.status !== "string" || !PROVIDER_ATTEMPT_STATUSES.has(event.status)) {
+        throw new Error("provider_attempt status must be success|transport_exhausted|aborted|rejected");
+    }
+    if (!Number.isInteger(event.transport_rungs) || event.transport_rungs < 0) {
+        throw new Error("provider_attempt transport_rungs must be a non-negative integer");
+    }
+    if (event.last_error_class !== undefined && typeof event.last_error_class !== "string") {
+        throw new Error("provider_attempt last_error_class must be a string");
+    }
+    for (const field of ["started_at_ms", "finished_at_ms"]) {
+        if (typeof event[field] !== "number" || !Number.isFinite(event[field])) {
+            throw new Error(`provider_attempt ${field} must be a finite number`);
+        }
+    }
+    if (event.wire_evidence !== undefined)
+        assertCanonicalWireEvidence(event.wire_evidence);
+    if (event.accounting_policy_id !== undefined && typeof event.accounting_policy_id !== "string") {
+        throw new Error("provider_attempt accounting_policy_id must be a string");
+    }
+}

package/dist/runtime/session-repair.d.ts

@@ -1,4 +1,4 @@
-import type { Message, ProviderReplay, ToolCall } from "../types.js";
+import type { Message, ProviderReplay, ProviderWireEvidence, ToolCall } from "../types.js";
 import type { SessionEvent } from "./session-log.js";
 import type { WorkflowNodeStatus } from "./types/agent.js";
 export { REPLAY_CONTENT_MAX_BYTES as RECOVERY_CONTENT_MAX_BYTES } from "./replay-sanitize.js";
@@ -27,6 +27,9 @@ export declare function buildLlmCompletedEvent(input: {
     tokenCount?: number;
     toolCalls: ToolCall[];
     providerReplay?: ProviderReplay;
+    effectId?: string;
+    invocationId?: string;
+    wireEvidence?: ProviderWireEvidence;
 }): Extract<SessionEvent, {
     kind: "llm_completed";
 }>;

package/dist/runtime/session-repair.js

@@ -21,6 +21,11 @@ export function normalizeLlmCompleted(event, maxBytes) {
         tool_calls: toolCalls,
         token_count: event.token_count ?? estimateTokenCount(content),
         ...(providerReplay ? { provider_replay: providerReplay } : {}),
+        // P4 §3: the evidence-plane fields ride along verbatim — recovery never reads them
+        // (SessionLog is evidence, not authority), so normalize must neither synthesize nor drop them.
+        ...(event.effect_id !== undefined ? { effect_id: event.effect_id } : {}),
+        ...(event.invocation_id !== undefined ? { invocation_id: event.invocation_id } : {}),
+        ...(event.wire_evidence !== undefined ? { wire_evidence: event.wire_evidence } : {}),
     };
 }
 export function repairEventsForRecovery(events, maxBytes) {
@@ -38,6 +43,9 @@ export function buildLlmCompletedEvent(input) {
         tool_calls: input.toolCalls ?? [],
         token_count: input.tokenCount,
         provider_replay: input.providerReplay,
+        ...(input.effectId !== undefined ? { effect_id: input.effectId } : {}),
+        ...(input.invocationId !== undefined ? { invocation_id: input.invocationId } : {}),
+        ...(input.wireEvidence !== undefined ? { wire_evidence: input.wireEvidence } : {}),
     });
 }
 export function buildRunTerminalEvent(input) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepstrike/wasm",
-  "version": "0.2.63",
+  "version": "0.2.65",
   "description": "DeepStrike WASM SDK — browser, Cloudflare Workers, Deno Deploy",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -17,7 +17,7 @@
     "test:canonical-binding": "wasm-pack build ../crates/deepstrike-wasm --target nodejs --dev --out-dir ../../wasm/pkg-node && node tests/canonical-binding.node.cjs && node tests/golden-fixtures-sweep.node.cjs"
   },
   "dependencies": {
-    "@deepstrike/wasm-kernel": "0.2.63"
+    "@deepstrike/wasm-kernel": "0.2.65"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",