@deepstrike/wasm 0.2.78 → 0.2.80

package/dist/index.d.ts

@@ -58,3 +58,4 @@ export { memoryFetchRecall } from "./memory/recall-projection.js";
 export type { MemoryCandidate, MemoryCandidateReceipt, MemoryCandidateSink, MemoryCandidateSource } from "./memory/candidate-sink.js";
 export { resolveMemoryRuntimePolicy } from "./memory/runtime-policy.js";
 export type { MemoryRuntimePolicy, MemoryRetrievalPolicy, MemoryWritePolicy, ResolvedMemoryRuntimePolicy } from "./memory/runtime-policy.js";
+export { DynamicWorkflowContextImpl, DynamicWorkflowLimitError, dynamicAgentTask, type DynamicWorkflowAgentOptions, type DynamicWorkflowAgentRequest, type DynamicWorkflowAgentResult, type DynamicWorkflowBlackboard, type DynamicWorkflowContext, type DynamicWorkflowLimits, type DynamicWorkflowProgress, type DynamicWorkflowRun, } from "./runtime/dynamic-workflow.js";

package/dist/index.js

@@ -31,3 +31,4 @@ export { DurableContentError, decodeDurableContent, decodeDurableToolResult, enc
 export { InMemoryMemoryCandidateSink, memoryCandidateDuplicateReason, memoryCandidateId, memoryCandidatePayloadDigest } from "./memory/candidate-sink.js";
 export { memoryFetchRecall } from "./memory/recall-projection.js";
 export { resolveMemoryRuntimePolicy } from "./memory/runtime-policy.js";
+export { DynamicWorkflowContextImpl, DynamicWorkflowLimitError, dynamicAgentTask, } from "./runtime/dynamic-workflow.js";

package/dist/runtime/canonical-kernel-step.d.ts

@@ -155,6 +155,12 @@ export declare class CanonicalRunnerRuntime {
     resumeAction(): KernelRunnerAction | null;
     startAgent(taskValue: Record<string, unknown>, runSpecValue?: Record<string, unknown>): Promise<KernelRunnerAction | null>;
     startWorkflow(specValue: Record<string, unknown>): Promise<KernelRunnerAction | null>;
+    /** Plan task 6.3 · open a dynamic workflow root: the host program appends nodes to it. */
+    startDynamicWorkflow(): Promise<KernelRunnerAction | null>;
+    /** Append host-program nodes to the active dynamic workflow root. */
+    appendWorkflowNodes(specValue: Record<string, unknown>, plan?: Record<string, unknown>): Promise<KernelRunnerAction | null>;
+    /** Close the dynamic workflow root so the kernel commits its terminal. */
+    completeDynamicWorkflow(): Promise<KernelRunnerAction | null>;
     private appendBase;
     applyHostEvent(event: Record<string, unknown>): Promise<KernelRunnerAction | null>;
     private ensureConfigured;

package/dist/runtime/canonical-kernel-step.js

@@ -532,6 +532,7 @@ function canonicalProviderMessage(raw, appendBase = 0) {
             }
             : {}),
         ...(raw.token_count !== undefined ? { tokens: Number(raw.token_count) } : {}),
+        ...(raw.replay && typeof raw.replay === "object" ? { replay: raw.replay } : {}),
     };
 }
 function canonicalProviderToolArguments(name, argumentsValue, appendBase) {
@@ -913,6 +914,36 @@ export class CanonicalRunnerRuntime {
         this.workflowNodeCount = spec.nodes.length;
         return action;
     }
+    /** Plan task 6.3 · open a dynamic workflow root: the host program appends nodes to it. */
+    async startDynamicWorkflow() {
+        await this.ensureConfigured();
+        const action = await this.commit({
+            kind: "start_operation",
+            entry: { kind: "dynamic_workflow" },
+            initial_context: this.initialContext,
+        });
+        this.started = true;
+        this.workflowNodeCount = 0;
+        return action;
+    }
+    /** Append host-program nodes to the active dynamic workflow root. */
+    async appendWorkflowNodes(specValue, plan) {
+        await this.ensureConfigured();
+        if (!this.started)
+            throw new Error("cannot append dynamic workflow nodes before operation start");
+        return this.commit({
+            kind: "host_control",
+            command: {
+                kind: "append_workflow_nodes",
+                nodes: canonicalWorkflowSpec(specValue, true, this.appendBase()).nodes,
+                ...(plan ? { plan } : {}),
+            },
+        });
+    }
+    /** Close the dynamic workflow root so the kernel commits its terminal. */
+    async completeDynamicWorkflow() {
+        return this.commit({ kind: "host_control", command: { kind: "complete_dynamic_workflow" } });
+    }
     appendBase() {
         return this.workflowNodeCount ?? `wf-append-${crypto.randomUUID().slice(0, 8)}`;
     }
@@ -960,6 +991,13 @@ export class CanonicalRunnerRuntime {
                                 ...(providerStopReason(event.stop_reason)
                                     ? { stop_reason: providerStopReason(event.stop_reason) }
                                     : {}),
+                                // Plan task 5.1 · what the provider did to the context server-side.
+                                ...(event.provider_compaction && typeof event.provider_compaction === "object"
+                                    ? { provider_compaction: event.provider_compaction }
+                                    : {}),
+                                ...(Array.isArray(event.cleared_tool_results) && event.cleared_tool_results.length
+                                    ? { cleared_tool_results: event.cleared_tool_results.map(String) }
+                                    : {}),
                             },
                         },
                     },

package/dist/runtime/dynamic-workflow.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Plan task 6.3 · dynamic workflows: a host program decides, step by step, which agents to run.
+ *
+ * Each `agent` (or `parallelAgents` batch) becomes one submission the kernel admits onto the
+ * operation's dynamic workflow root — the kernel still owns the DAG, its budgets and every spawn —
+ * and the program awaits the typed result before deciding what comes next. The vocabulary matches
+ * the Node SDK's `runDynamicWorkflow`; replay of a saved run and the sandboxed script executors are
+ * Node-only (they need a filesystem and `node:vm`).
+ */
+import type { KernelAgentRole, WorkflowNodeSpec, WorkflowOutcome, WorkflowSpec } from "./types/agent.js";
+export interface DynamicWorkflowLimits {
+    maxAgentsPerRun?: number;
+    maxConcurrentAgents?: number;
+    maxBatchSize?: number;
+}
+export interface DynamicWorkflowAgentOptions {
+    label?: string;
+    role?: KernelAgentRole;
+    modelHint?: string;
+    trust?: WorkflowNodeSpec["trust"];
+    isolation?: WorkflowNodeSpec["isolation"];
+    outputSchema?: Record<string, unknown>;
+    tokenBudget?: number;
+    maxTurns?: number;
+    maxWallMs?: number;
+}
+export interface DynamicWorkflowAgentRequest {
+    prompt: string;
+    options?: DynamicWorkflowAgentOptions;
+}
+export interface DynamicWorkflowAgentResult<T = string> {
+    value: T;
+    text: string;
+    nodeId: string;
+    status: string;
+    termination?: string;
+}
+export interface DynamicWorkflowPhaseProgress {
+    name: string;
+    status: "running" | "completed" | "failed";
+    agentsStarted: number;
+    agentsCompleted: number;
+}
+export interface DynamicWorkflowProgress {
+    runId: string;
+    agentsStarted: number;
+    agentsCompleted: number;
+    activeAgents: number;
+    phase?: string;
+    phases: DynamicWorkflowPhaseProgress[];
+    logs: Array<{
+        message: string;
+        fields?: Record<string, unknown>;
+    }>;
+}
+export interface DynamicWorkflowRun<T> {
+    runId: string;
+    value: T;
+    progress: DynamicWorkflowProgress;
+}
+/** Plan task 6.2 · state the program shares with the agents it runs (see the Node SDK). */
+export interface DynamicWorkflowBlackboard {
+    put(key: string, value: unknown, options?: {
+        scope?: "workflow" | "phase";
+    }): Promise<void>;
+    get(key: string): unknown;
+    delete(key: string): Promise<void>;
+}
+export interface DynamicWorkflowContext<TArgs extends Record<string, unknown> = Record<string, unknown>> {
+    readonly args: Readonly<TArgs>;
+    readonly progress: DynamicWorkflowProgress;
+    readonly blackboard: DynamicWorkflowBlackboard;
+    agent<T = string>(prompt: string, options?: DynamicWorkflowAgentOptions): Promise<DynamicWorkflowAgentResult<T> | null>;
+    parallelAgents<T>(items: readonly T[], worker: (item: T, index: number) => DynamicWorkflowAgentRequest): Promise<Array<DynamicWorkflowAgentResult | null>>;
+    parallel<T, R>(items: readonly T[], worker: (item: T, index: number) => Promise<R> | R): Promise<R[]>;
+    pipeline<T, R>(items: readonly T[], worker: (item: T, index: number) => Promise<R> | R): Promise<R[]>;
+    phase<T>(name: string, body: () => Promise<T> | T): Promise<T>;
+    log(message: string, fields?: Record<string, unknown>): void;
+}
+export declare class DynamicWorkflowLimitError extends Error {
+    readonly code: "dynamic_workflow_limit";
+}
+/** What the context needs from the runner: admit and drive one submission, write the blackboard. */
+export interface DynamicWorkflowHost {
+    runWorkflow(spec: WorkflowSpec, plan: Record<string, unknown>): Promise<WorkflowOutcome>;
+    writeBlackboard(key: string, content: string | undefined): Promise<void>;
+}
+export declare function dynamicAgentTask(prompt: string, options?: DynamicWorkflowAgentOptions): DynamicWorkflowAgentRequest;
+export declare class DynamicWorkflowContextImpl<TArgs extends Record<string, unknown>> implements DynamicWorkflowContext<TArgs> {
+    private readonly host;
+    readonly args: Readonly<TArgs>;
+    readonly progress: DynamicWorkflowProgress;
+    private readonly limits;
+    private readonly phaseStack;
+    private readonly board;
+    private nextNode;
+    private sequence;
+    private activeSlots;
+    private readonly waitingSlots;
+    readonly blackboard: DynamicWorkflowBlackboard;
+    constructor(host: DynamicWorkflowHost, runId: string, args: TArgs, limits?: DynamicWorkflowLimits);
+    agent<T = string>(prompt: string, options?: DynamicWorkflowAgentOptions): Promise<DynamicWorkflowAgentResult<T> | null>;
+    parallelAgents<T>(items: readonly T[], worker: (item: T, index: number) => DynamicWorkflowAgentRequest): Promise<Array<DynamicWorkflowAgentResult | null>>;
+    parallel<T, R>(items: readonly T[], worker: (item: T, index: number) => Promise<R> | R): Promise<R[]>;
+    pipeline<T, R>(items: readonly T[], worker: (item: T, index: number) => Promise<R> | R): Promise<R[]>;
+    phase<T>(name: string, body: () => Promise<T> | T): Promise<T>;
+    log(message: string, fields?: Record<string, unknown>): void;
+    private assertBatch;
+    private blackboardPut;
+    private blackboardDelete;
+    private acquireSlot;
+    private releaseSlot;
+    private runBatch;
+}

package/dist/runtime/dynamic-workflow.js

@@ -0,0 +1,190 @@
+import { sha256Hex } from "./sha256.js";
+const DEFAULT_LIMITS = { maxAgentsPerRun: 64, maxConcurrentAgents: 8, maxBatchSize: 16 };
+export class DynamicWorkflowLimitError extends Error {
+    code = "dynamic_workflow_limit";
+}
+export function dynamicAgentTask(prompt, options) {
+    if (!prompt.trim())
+        throw new Error("dynamic workflow agent prompt must not be empty");
+    return { prompt, ...(options ? { options } : {}) };
+}
+export class DynamicWorkflowContextImpl {
+    host;
+    args;
+    progress;
+    limits;
+    phaseStack = [];
+    board = new Map();
+    nextNode = 0;
+    sequence = 0;
+    activeSlots = 0;
+    waitingSlots = [];
+    blackboard = Object.freeze({
+        put: (key, value, options) => this.blackboardPut(key, value, options),
+        get: (key) => this.board.get(key)?.value,
+        delete: (key) => this.blackboardDelete(key),
+    });
+    constructor(host, runId, args, limits) {
+        this.host = host;
+        this.args = Object.freeze({ ...args });
+        this.limits = { ...DEFAULT_LIMITS, ...limits };
+        this.progress = { runId, agentsStarted: 0, agentsCompleted: 0, activeAgents: 0, phases: [], logs: [] };
+    }
+    async agent(prompt, options) {
+        return (await this.runBatch([dynamicAgentTask(prompt, options)]))[0];
+    }
+    async parallelAgents(items, worker) {
+        this.assertBatch(items.length, "parallelAgents");
+        return this.runBatch(items.map((item, index) => worker(item, index)));
+    }
+    async parallel(items, worker) {
+        this.assertBatch(items.length, "parallel");
+        return Promise.all(items.map((item, index) => worker(item, index)));
+    }
+    async pipeline(items, worker) {
+        const out = [];
+        for (let index = 0; index < items.length; index++)
+            out.push(await worker(items[index], index));
+        return out;
+    }
+    async phase(name, body) {
+        if (!name.trim())
+            throw new Error("dynamic workflow phase name must not be empty");
+        const phase = { name, status: "running", agentsStarted: 0, agentsCompleted: 0 };
+        this.progress.phases.push(phase);
+        this.phaseStack.push(phase);
+        this.progress.phase = name;
+        try {
+            const result = await body();
+            phase.status = "completed";
+            return result;
+        }
+        catch (error) {
+            phase.status = "failed";
+            throw error;
+        }
+        finally {
+            this.phaseStack.pop();
+            this.progress.phase = this.phaseStack.at(-1)?.name;
+            for (const [key, entry] of [...this.board]) {
+                if (entry.phase === phase)
+                    await this.blackboardDelete(key);
+            }
+        }
+    }
+    log(message, fields) {
+        this.progress.logs.push({ message, ...(fields ? { fields } : {}) });
+    }
+    assertBatch(size, operation) {
+        if (size > this.limits.maxBatchSize) {
+            throw new DynamicWorkflowLimitError(`${operation} exceeded maxBatchSize (${this.limits.maxBatchSize})`);
+        }
+    }
+    async blackboardPut(key, value, options = {}) {
+        if (!/^[A-Za-z0-9_.:-]{1,128}$/.test(key)) {
+            throw new Error("dynamic workflow blackboard keys are 1-128 characters of letters, digits, _ . : -");
+        }
+        const scope = options.scope ?? "workflow";
+        if (scope !== "workflow" && scope !== "phase")
+            throw new Error(`unknown blackboard scope ${String(scope)}`);
+        const phase = scope === "phase" ? this.phaseStack.at(-1) : undefined;
+        if (scope === "phase" && !phase)
+            throw new Error("a phase-scoped blackboard entry needs an enclosing phase");
+        const content = typeof value === "string" ? value : JSON.stringify(value);
+        if (content === undefined)
+            throw new Error("dynamic workflow blackboard values must be serializable");
+        this.board.set(key, { value: typeof value === "string" ? value : JSON.parse(content), ...(phase ? { phase } : {}) });
+        await this.host.writeBlackboard(key, content);
+    }
+    async blackboardDelete(key) {
+        if (!this.board.delete(key))
+            return;
+        await this.host.writeBlackboard(key, undefined);
+    }
+    async acquireSlot() {
+        if (this.activeSlots < this.limits.maxConcurrentAgents) {
+            this.activeSlots += 1;
+            return;
+        }
+        await new Promise(resolve => this.waitingSlots.push(resolve));
+    }
+    releaseSlot() {
+        const next = this.waitingSlots.shift();
+        if (next)
+            next();
+        else
+            this.activeSlots -= 1;
+    }
+    async runBatch(requests) {
+        if (requests.length === 0)
+            return [];
+        if (this.progress.agentsStarted + requests.length > this.limits.maxAgentsPerRun) {
+            throw new DynamicWorkflowLimitError(`dynamic workflow exceeded maxAgentsPerRun (${this.limits.maxAgentsPerRun})`);
+        }
+        const sequence = this.sequence++;
+        const entries = requests.map(request => {
+            const options = request.options ?? {};
+            const nodeId = options.label?.trim() || `dynamic-agent-${this.nextNode++}`;
+            const fingerprint = `sha256:${sha256Hex(JSON.stringify({ prompt: request.prompt, options }))}`;
+            const node = {
+                nodeId,
+                task: request.prompt,
+                role: options.role ?? "implement",
+                ...(options.modelHint ? { modelHint: options.modelHint } : {}),
+                ...(options.trust ? { trust: options.trust } : {}),
+                ...(options.isolation ? { isolation: options.isolation } : {}),
+                ...(options.outputSchema ? { outputSchema: options.outputSchema } : {}),
+                ...(options.tokenBudget !== undefined ? { tokenBudget: options.tokenBudget } : {}),
+                ...(options.maxTurns !== undefined ? { maxTurns: options.maxTurns } : {}),
+                ...(options.maxWallMs !== undefined ? { maxWallMs: options.maxWallMs } : {}),
+            };
+            return { nodeId, request, fingerprint, node };
+        });
+        const phase = this.phaseStack.at(-1);
+        this.progress.agentsStarted += entries.length;
+        this.progress.activeAgents += entries.length;
+        if (phase)
+            phase.agentsStarted += entries.length;
+        await this.acquireSlot();
+        let outcome;
+        try {
+            outcome = await this.host.runWorkflow({ nodes: entries.map(entry => entry.node) }, {
+                run_id: this.progress.runId,
+                sequence,
+                nodes: entries.map(entry => ({ node_id: entry.nodeId, depends_on: [], prompt_fingerprint: entry.fingerprint, replay: "executed" })),
+            });
+        }
+        finally {
+            this.releaseSlot();
+            this.progress.activeAgents -= entries.length;
+        }
+        if (outcome.rejection)
+            throw new Error(`dynamic workflow submission rejected: ${outcome.rejection.reason}`);
+        const byNode = new Map(outcome.nodeOutcomes.map(node => [node.nodeId, node]));
+        return entries.map(entry => {
+            this.progress.agentsCompleted += 1;
+            if (phase)
+                phase.agentsCompleted += 1;
+            const node = byNode.get(entry.nodeId);
+            const text = outcome.outputs[entry.nodeId];
+            if (text === undefined && (!node || node.status !== "completed"))
+                return null;
+            let value = text ?? "";
+            if (entry.request.options?.outputSchema) {
+                try {
+                    value = JSON.parse(text ?? "");
+                }
+                catch {
+                    value = null;
+                }
+            }
+            return {
+                value,
+                text: text ?? "",
+                nodeId: entry.nodeId,
+                status: node?.status ?? "completed",
+                ...(node?.termination ? { termination: node.termination } : {}),
+            };
+        });
+    }
+}

package/dist/runtime/kernel-event-log.js

@@ -82,6 +82,8 @@ function projectKernelObservation(obs, turn, opts = {}) {
                 recall_expanded: obs.recall_expanded ?? 0,
                 ...(obs.items && obs.items.length > 0 ? { items: obs.items } : {}),
                 ...(obs.history && obs.history.length > 0 ? { history: obs.history } : {}),
+                ...(obs.history_items && obs.history_items.length > 0 ? { history_items: obs.history_items } : {}),
+                ...(obs.history_items_omitted ? { history_items_omitted: obs.history_items_omitted } : {}),
             };
         case "rollbacked":
             return {

package/dist/runtime/kernel-step.d.ts

@@ -1,5 +1,5 @@
 import type { ModelMessage, RenderedContext, ToolCall, ToolExecutionResult, ToolSchema } from "../types.js";
-import type { ContextItemRecord, ContextOriginTally, RollbackReason } from "./session-log.js";
+import type { ContextHistoryItemRecord, ContextItemRecord, ContextOriginTally, RollbackReason } from "./session-log.js";
 interface TaskUpdate {
     plan?: string[];
     currentStep?: number;
@@ -137,6 +137,8 @@ export interface KernelObservation {
     recall_expanded?: number;
     items?: ContextItemRecord[];
     history?: ContextOriginTally[];
+    history_items?: ContextHistoryItemRecord[];
+    history_items_omitted?: number;
     archived_count?: number;
     turn?: number;
     checkpoint_history_len?: number;

package/dist/runtime/kernel-step.js

@@ -220,6 +220,10 @@ export function kernelMessageToSdk(raw) {
                 isError: raw.is_error === true,
             }];
     }
+    if (typeof raw.item_id === "number")
+        message.itemId = raw.item_id;
+    if (raw.replay && typeof raw.replay === "object")
+        message.providerReplay = raw.replay;
     return message;
 }
 export function renderedContextToSdk(raw) {
@@ -235,5 +239,8 @@ export function renderedContextToSdk(raw) {
         ctx.stateTurn = kernelMessageToSdk(rawStateTurn);
     if (typeof frozenLen === "number")
         ctx.frozenPrefixLen = frozenLen;
+    const estimated = raw.estimated_tokens ?? raw.estimatedTokens;
+    if (typeof estimated === "number" && estimated > 0)
+        ctx.estimatedTokens = estimated;
     return ctx;
 }

package/dist/runtime/runner.d.ts

@@ -9,7 +9,8 @@ import type { SessionLog, SessionEvent } from "./session-log.js";
 import type { ExecutionPlane } from "./execution-plane.js";
 import { type GovernancePolicy, type LivePolicyPatch } from "../governance.js";
 import type { KernelJournal } from "./kernel-journal.js";
-import type { AgentRunSpec, MilestonePolicy, MilestoneContract, MilestoneCheckResult, WorkflowSpec, WorkflowOutcome } from "./types/agent.js";
+import { type DynamicWorkflowContext, type DynamicWorkflowLimits, type DynamicWorkflowRun } from "./dynamic-workflow.js";
+import type { AgentRunSpec, MilestonePolicy, MilestoneContract, MilestoneCheckResult, WorkflowSpec, InheritedKnowledge, WorkflowOutcome } from "./types/agent.js";
 import { type SubAgentOrchestrator } from "./sub-agent-orchestrator.js";
 import { type NativeOsProfile, type OsProfileId, type SignalPolicy } from "./os-profile.js";
 import { PayloadStore } from "./payload-store.js";
@@ -141,6 +142,9 @@ export interface RuntimeOptions {
     /** Plan task 3.1 · outputs of the workflow nodes this run depends on, by agent id. The kernel
      *  holds them; the model reads one with `read_result(call_id="dep:<agent_id>")`. */
     dependencyOutputs?: Record<string, string>;
+    /** Plan task 1.1 · the parent knowledge a child run starts with, chosen by the kernel from the
+     *  items' scope and the node's context inheritance. Set by the workflow driver. */
+    inheritedKnowledge?: InheritedKnowledge[];
     /** Skill name → markdown body (WASM has no filesystem). */
     skillContentMap?: Map<string, string>;
     memoryRuntimePolicy?: MemoryRuntimePolicy;
@@ -456,6 +460,18 @@ export declare class RuntimeRunner {
         /** Standalone session id when bootstrapping (no active parent run). Defaults to a fresh uuid. */
         sessionId?: string;
     }): Promise<WorkflowOutcome>;
+    /**
+     * Plan task 6.3 · run a host program that decides which agents to run as it goes. Each
+     * `agent` / `parallelAgents` call is admitted by the kernel onto this operation's dynamic
+     * workflow root and driven to its typed outcome before the call returns; submissions and
+     * blackboard writes reach the kernel one at a time, in program order. Requires a standalone runner.
+     */
+    runDynamicWorkflow<TArgs extends Record<string, unknown>, T>(program: (context: DynamicWorkflowContext<TArgs>) => Promise<T> | T, opts?: {
+        sessionId?: string;
+        runId?: string;
+        args?: TArgs;
+        limits?: DynamicWorkflowLimits;
+    }): Promise<DynamicWorkflowRun<T>>;
     /**
      * #2-B-ii: while a workflow batch is in flight, poll the signal source; a Critical `InterruptNow`
      * routes through the kernel (root in `SubAgentAwait` → preempt → `AgentPreempted` + tears the

package/dist/runtime/runner.js

@@ -11,6 +11,7 @@ import { memoryFetchRecall } from "../memory/recall-projection.js";
 import { MemoryWriter } from "../memory/writer.js";
 import { CanonicalRunnerRuntime, canonicalKernelAction, canonicalKernelApply, isInvalidInputError, canonicalKernelMaybeAction, canonicalStartAgent, canonicalStartWorkflow, sha256 as canonicalSha256, } from "./canonical-kernel-step.js";
 import { peekProviderReplay, seedProviderReplayFromEvents } from "./provider-replay.js";
+import { DynamicWorkflowContextImpl, } from "./dynamic-workflow.js";
 import { sanitizeReplayText } from "./replay-sanitize.js";
 import { decodeDurableContent, decodeDurableToolResult, durableBlocksToToolOutput, toolOutputBlocksToDurable } from "./durable-content.js";
 import { formatToolError } from "../tools/errors.js";
@@ -758,6 +759,15 @@ export class RuntimeRunner {
                     content,
                 });
             }
+            for (const entry of this.opts.inheritedKnowledge ?? []) {
+                await this.commitKernelApply(runtime, this.pendingObservations, {
+                    kind: "add_knowledge_message",
+                    content: entry.content,
+                    ...(entry.key ? { key: entry.key } : {}),
+                    tokens: entry.tokens ?? Math.max(1, Math.ceil(entry.content.length / 4)),
+                    ...(entry.pinned ? { pinned: true } : {}),
+                });
+            }
             if (this.opts.initialMemory) {
                 for (const mem of this.opts.initialMemory) {
                     await this.commitKernelApply(runtime, this.pendingObservations, {
@@ -948,6 +958,12 @@ export class RuntimeRunner {
                     // I5: the kernel itself withholds statically denied tools (`hide_denied_tools`) and renders
                     // the denial note — the host sends exactly the context and surface the kernel committed.
                     const context = action.context;
+                    // Plan task 1.1c · the kernel keeps provider replay with each turn's item; hand it to the
+                    // provider keyed by the turn exactly as rendered, so its own lookup finds it.
+                    for (const turn of context.turns) {
+                        if (turn.providerReplay)
+                            this.opts.provider.seedProviderReplay?.(turn, turn.providerReplay);
+                    }
                     const tools = action.tools;
                     let turnTokens = 0;
                     let turnInputTokens = 0;
@@ -1152,6 +1168,21 @@ export class RuntimeRunner {
                     // P4-S1: land the attempt evidence BEFORE the kernel resolution commits — the record
                     // describes the transport fact, which exists regardless of what the kernel decides next.
                     const providerReplay = peekProviderReplay(this.opts.provider, finalText, finalToolCalls);
+                    // Plan task 1.1c · the kernel keeps the replay with the turn's item from here on.
+                    if (providerReplay !== undefined) {
+                        providerEvent.message = { ...providerEvent.message, replay: providerReplay };
+                    }
+                    // Plan task 5.1 · server-side context edits become facts the kernel absorbs.
+                    const contextEdits = this.opts.provider.takeContextEdits?.();
+                    if (contextEdits?.compaction) {
+                        providerEvent.provider_compaction = {
+                            through_item: contextEdits.compaction.throughItem,
+                            replay: contextEdits.compaction.replay,
+                            summary_tokens: contextEdits.compaction.summaryTokens,
+                        };
+                    }
+                    if (contextEdits?.clearedToolResults?.length)
+                        providerEvent.cleared_tool_results = contextEdits.clearedToolResults;
                     const wireEvidence = {
                         protocol: this.providerRoute.protocol,
                         request_fingerprint: providerPlan.fingerprint,
@@ -1674,6 +1705,7 @@ export class RuntimeRunner {
             ...(node.dependency_outputs
                 ? { dependencyOutputs: node.dependency_outputs }
                 : {}),
+            ...(node.inherited_knowledge?.length ? { inheritedKnowledge: node.inherited_knowledge } : {}),
             manifest,
             sessionLog: this.opts.sessionLog,
             // This child is a workflow node, so capability resolution applies workflow-node quarantine
@@ -1878,6 +1910,86 @@ export class RuntimeRunner {
             }
         }
     }
+    /**
+     * Plan task 6.3 · run a host program that decides which agents to run as it goes. Each
+     * `agent` / `parallelAgents` call is admitted by the kernel onto this operation's dynamic
+     * workflow root and driven to its typed outcome before the call returns; submissions and
+     * blackboard writes reach the kernel one at a time, in program order. Requires a standalone runner.
+     */
+    async runDynamicWorkflow(program, opts = {}) {
+        if (this.activeKernel || this.currentSessionId) {
+            throw new Error("dynamic workflows require a standalone RuntimeRunner");
+        }
+        const sessionId = opts.sessionId ?? `dw-${crypto.randomUUID()}`;
+        const runId = opts.runId ?? crypto.randomUUID();
+        try {
+            await this.opts.sessionLog.append(sessionId, {
+                kind: "run_started",
+                run_id: runId,
+                goal: "dynamic-workflow",
+                criteria: [],
+                ...(this.opts.agentId ? { agent_id: this.opts.agentId } : {}),
+                route: this.providerRoute,
+            });
+            const runtime = await this.initializeWorkflowKernel(sessionId, runId);
+            await runtime.startDynamicWorkflow();
+            runtime.drainHostObservations();
+            let tail = Promise.resolve();
+            const exclusive = (work) => {
+                const next = tail.then(work);
+                tail = next.catch(() => undefined);
+                return next;
+            };
+            const host = {
+                runWorkflow: (spec, plan) => exclusive(async () => {
+                    const start = this.pendingObservations.length;
+                    const action = await runtime.appendWorkflowNodes(workflowSpecToKernel(spec), plan);
+                    this.pendingObservations.push(...runtime.drainHostObservations());
+                    const observations = this.pendingObservations.slice(start);
+                    const rejected = observations.find(o => o.kind === "control_request_rejected");
+                    if (!action || rejected) {
+                        return { nodeOutcomes: [], outputs: {}, rejection: { operation: "submit_workflow_nodes", reason: rejected?.reason ?? "the kernel admitted no nodes" } };
+                    }
+                    const submitted = observations.find(o => o.kind === "workflow_nodes_submitted");
+                    const base = Number.isInteger(submitted?.base) ? submitted.base : 0;
+                    const outcome = await this.driveWorkflow(action, observations, sessionId, runtime, new Map());
+                    // The kernel names appended nodes by position (wf-node<base+i>); the program by its own ids.
+                    const toHost = new Map(spec.nodes.map((node, index) => [`wf-node${base + index}`, node.nodeId ?? `wf-node${base + index}`]));
+                    return {
+                        ...outcome,
+                        nodeOutcomes: outcome.nodeOutcomes.map(node => ({ ...node, nodeId: toHost.get(node.nodeId) ?? node.nodeId })),
+                        outputs: Object.fromEntries(Object.entries(outcome.outputs).map(([id, output]) => [toHost.get(id) ?? id, output])),
+                    };
+                }),
+                // Plan task 6.2 · a keyed kernel item on this operation; agents spawned later inherit it.
+                writeBlackboard: (key, content) => exclusive(async () => {
+                    await this.commitKernelApply(runtime, this.pendingObservations, content === undefined
+                        ? { kind: "remove_knowledge", key: `blackboard:${key}` }
+                        : { kind: "add_knowledge_message", key: `blackboard:${key}`, content, tokens: Math.max(1, Math.ceil(content.length / 4)) });
+                }),
+            };
+            const context = new DynamicWorkflowContextImpl(host, runId, (opts.args ?? {}), opts.limits);
+            const value = await program(context);
+            const closing = await exclusive(async () => {
+                const action = await runtime.completeDynamicWorkflow();
+                this.pendingObservations.push(...runtime.drainHostObservations());
+                return action;
+            });
+            const terminal = closing ?? runtime.resumeAction();
+            if (!terminal || terminal.kind !== "done") {
+                throw new Error("dynamic workflow close did not produce a terminal kernel action");
+            }
+            await this.appendObservations(sessionId, runtime, 0);
+            return { runId, value, progress: context.progress };
+        }
+        finally {
+            this.rejectPendingControl("the run ended before the control command was applied");
+            this.activeKernel = null;
+            this.currentSessionId = null;
+            this.abortController = null;
+            this.pendingObservations = [];
+        }
+    }
     /**
      * #2-B-ii: while a workflow batch is in flight, poll the signal source; a Critical `InterruptNow`
      * routes through the kernel (root in `SubAgentAwait` → preempt → `AgentPreempted` + tears the

package/dist/runtime/session-event-registry.generated.d.ts

@@ -77,7 +77,7 @@ export declare const SESSION_EVENT_REGISTRY: {
     };
     readonly context_lifecycle_reported: {
         readonly required: readonly ["cache_loss_tokens", "knowledge_entries", "knowledge_referenced", "recall_expanded", "recalled", "regret", "turn", "waste_tokens"];
-        readonly optional: readonly ["history", "items"];
+        readonly optional: readonly ["history", "history_items", "history_items_omitted", "items"];
     };
     readonly suspended: {
         readonly required: readonly ["reason", "turn"];

package/dist/runtime/session-event-registry.generated.js

@@ -21,7 +21,7 @@ export const SESSION_EVENT_REGISTRY = {
     rollbacked: { required: ["checkpoint_history_len", "turn"], optional: ["reason"] },
     capability_changed: { required: ["added", "removed", "turn"], optional: ["capability_id", "change_kind", "mount_reason", "mounted_by", "version"] },
     context_renewed: { required: ["handoff_ref", "sprint", "turn"], optional: [] },
-    context_lifecycle_reported: { required: ["cache_loss_tokens", "knowledge_entries", "knowledge_referenced", "recall_expanded", "recalled", "regret", "turn", "waste_tokens"], optional: ["history", "items"] },
+    context_lifecycle_reported: { required: ["cache_loss_tokens", "knowledge_entries", "knowledge_referenced", "recall_expanded", "recalled", "regret", "turn", "waste_tokens"], optional: ["history", "history_items", "history_items_omitted", "items"] },
     suspended: { required: ["reason", "turn"], optional: ["pending_calls"] },
     resumed: { required: ["turn"], optional: ["approved", "denied"] },
     tool_gated: { required: ["call_id", "reason", "tool", "turn"], optional: [] },

package/dist/runtime/session-log.d.ts

@@ -54,7 +54,7 @@ export interface ContextOriginTally {
 /** One knowledge item's lifecycle in a `context_lifecycle_reported` event (plan task 4.1). */
 export interface ContextItemRecord {
     key?: string;
-    origin: "system" | "skill" | "memory_recall" | "reference" | "tool_result" | "dependency_output" | "user" | "assistant" | "task_state" | "signal" | "provider_summary";
+    origin: "system" | "skill" | "memory_recall" | "reference" | "blackboard" | "tool_result" | "dependency_output" | "user" | "assistant" | "task_state" | "signal" | "provider_summary";
     tokens: number;
     value: {
         injected_turn: number;
@@ -65,7 +65,18 @@ export interface ContextItemRecord {
         paged_in_after_evict?: boolean;
     };
     /** Why it left; absent while resident. */
-    end?: "evicted" | "expired" | "removed";
+    end?: "evicted" | "expired" | "removed" | "compacted" | "renewed";
+}
+/** One history item's lifecycle in a `context_lifecycle_reported` event (plan task 4.1). */
+export interface ContextHistoryItemRecord {
+    id: number;
+    origin: ContextItemRecord["origin"];
+    tokens: number;
+    injected_turn: number;
+    /** What it rendered when it left, or renders now; absent = full. */
+    fidelity?: "structured" | "excerpt" | "handle";
+    /** Why it left; absent while still in history. */
+    end?: "removed" | "compacted" | "renewed";
 }
 export type SessionEvent = {
     kind: "run_started";
@@ -202,6 +213,9 @@ export type SessionEvent = {
     items?: ContextItemRecord[];
     /** History items by origin: admitted, still in history at the end, read back with `read_result`. */
     history?: ContextOriginTally[];
+    /** The latest history items one by one (at most 128); older ones are only counted. */
+    history_items?: ContextHistoryItemRecord[];
+    history_items_omitted?: number;
 } | {
     kind: "suspended";
     turn: number;

package/dist/runtime/sub-agent-orchestrator.d.ts

@@ -1,4 +1,4 @@
-import type { AgentRunSpec, AgentProcessChangedObservation, SubAgentResult } from "./types/agent.js";
+import type { AgentRunSpec, AgentProcessChangedObservation, SubAgentResult, InheritedKnowledge } from "./types/agent.js";
 import type { RuntimeOptions } from "./runner.js";
 import type { SessionLog } from "./session-log.js";
 export interface SubAgentRunContext {
@@ -22,6 +22,8 @@ export interface SubAgentRunContext {
     abortSignal?: AbortSignal;
     /** Plan task 3.1 · the outputs of the workflow nodes this child depends on, by agent id. */
     dependencyOutputs?: Record<string, string>;
+    /** Plan task 1.1 · the parent knowledge the kernel lets this child inherit. */
+    inheritedKnowledge?: InheritedKnowledge[];
 }
 /** M1/G3 intelligence routing: resolve the provider for a sub-agent from its spec's `modelHint`.
  *  Falls back to the parent provider when there is no hint or no `providerFor` hook resolves it. */

package/dist/runtime/sub-agent-orchestrator.js

@@ -128,6 +128,8 @@ export class SubAgentOrchestrator {
                 : undefined,
             // A child reads only its own dependencies, never ones inherited from the parent's options.
             dependencyOutputs: ctx.dependencyOutputs,
+            // Likewise only the knowledge the kernel chose for this child, never the parent's own.
+            inheritedKnowledge: ctx.inheritedKnowledge,
         });
         // #2-B-ii: parent preempt → interrupt the child (cancels its in-flight LLM call).
         linkAbort(ctx.abortSignal, childRunner);

package/dist/runtime/types/agent.d.ts

@@ -208,6 +208,13 @@ export interface WorkflowOutcome {
     rejection?: ControlRequestRejection;
 }
 export declare function workflowNodeOutcomeFromKernel(raw: KernelWorkflowNodeOutcome): WorkflowNodeOutcome;
+/** Plan task 1.1 · one parent knowledge item a child run starts with (kernel-chosen by scope). */
+export interface InheritedKnowledge {
+    content: string;
+    key?: string;
+    tokens?: number;
+    pinned?: boolean;
+}
 /** Per-node spawn descriptor carried in the `workflow_batch_spawned` observation. */
 export interface WorkflowSpawnInfo {
     agent_id: string;
@@ -227,6 +234,8 @@ export interface WorkflowSpawnInfo {
     input_agent_ids?: string[];
     /** The kernel-composed dependency section that follows the node's goal. */
     dependency_brief?: string;
+    /** Plan task 1.1 · the parent knowledge the kernel lets this node inherit (by item scope). */
+    inherited_knowledge?: InheritedKnowledge[];
     /** M4/G5: the node's per-node cumulative token cap, if set — the runner caps the child run here. */
     token_budget?: number;
     /** O3: per-node turn cap → the child run's `maxTurns`. */

package/dist/types.d.ts

@@ -46,6 +46,12 @@ export interface ModelMessage {
     /** Multimodal parts (text + image/audio). When present, providers render these
      *  instead of the plain `content` string. */
     contentParts?: ContentPart[];
+    /** The kernel item this rendered turn is (plan task 1.1c): stable across compaction, renewal
+     *  and restore. Absent on messages the kernel did not render. */
+    itemId?: number;
+    /** Provider state the kernel keeps with this turn's item (reasoning, native blocks) and renders
+     *  back with it; the runner seeds it into the provider before a call (plan task 1.1c). */
+    providerReplay?: ProviderReplay;
 }
 export interface ToolCall {
     id: string;
@@ -79,6 +85,9 @@ export interface RenderedContext {
      *  Anthropic pins a deep cache breakpoint here instead of the rolling pair. */
     frozenPrefixLen?: number;
     budgetOverflow?: ContextBudgetOverflow;
+    /** The kernel's estimate of this request's input tokens, tool schemas included, calibrated
+     *  against what the provider counted for earlier requests (plan task 5.1). */
+    estimatedTokens?: number;
 }
 export interface ContextBudgetOverflow {
     kind: "fixed_context" | "protected_tail";
@@ -269,6 +278,15 @@ export interface PromptMeasurement {
     source: MeasurementSource;
     confidence: MeasurementConfidence;
 }
+/** Server-side context edits a provider reports for one call (plan task 5.1). */
+export interface ProviderContextEdits {
+    compaction?: {
+        throughItem: number;
+        replay: ProviderReplay;
+        summaryTokens: number;
+    };
+    clearedToolResults?: string[];
+}
 export interface ProviderReplay {
     provider?: string;
     protocol: GenerationProtocol;
@@ -320,6 +338,10 @@ export interface LLMProvider {
         };
     };
     peekProviderReplay?(message: Pick<ModelMessage, "content" | "toolCalls">): ProviderReplay | undefined;
+    /** Plan task 5.1 · what the last call did to the context server-side, for the kernel to absorb:
+     *  a summary of history through `throughItem` (the `itemId` of the last rendered turn it covers)
+     *  and the call ids of tool results it cleared. Read once per completed call. */
+    takeContextEdits?(): ProviderContextEdits | undefined;
     seedProviderReplay?(message: Pick<ModelMessage, "content" | "toolCalls">, replay: ProviderReplay): void;
     /** P4-S1 mirror: transport facts of the most recent execution (host evidence only, B7). */
     peekTransportTelemetry?(): ProviderTransportTelemetry | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepstrike/wasm",
-  "version": "0.2.78",
+  "version": "0.2.80",
   "description": "DeepStrike WASM SDK — browser, Cloudflare Workers, Deno Deploy",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -14,10 +14,10 @@
     "build:wasm": "wasm-pack build ../crates/deepstrike-wasm --target bundler --out-dir ../../wasm/pkg",
     "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc",
     "test": "node --experimental-vm-modules node_modules/.bin/jest",
-    "test:canonical-binding": "wasm-pack build ../crates/deepstrike-wasm --target nodejs --dev --out-dir ../../wasm/pkg-node && node tests/canonical-binding.node.cjs && node tests/golden-fixtures-sweep.node.cjs && npm run build && node tests/boundary-p0-regressions.node.mjs && node tests/boundary-p1-regressions.node.mjs && node tests/boundary-p2-regressions.node.mjs && node tests/memory-candidate-binding.node.mjs && node tests/memory-recall-renewal.node.mjs"
+    "test:canonical-binding": "wasm-pack build ../crates/deepstrike-wasm --target nodejs --dev --out-dir ../../wasm/pkg-node && node tests/canonical-binding.node.cjs && node tests/golden-fixtures-sweep.node.cjs && npm run build && node tests/boundary-p0-regressions.node.mjs && node tests/boundary-p1-regressions.node.mjs && node tests/boundary-p2-regressions.node.mjs && node tests/memory-candidate-binding.node.mjs && node tests/memory-recall-renewal.node.mjs && node tests/dynamic-workflow.node.mjs"
   },
   "dependencies": {
-    "@deepstrike/wasm-kernel": "0.2.78"
+    "@deepstrike/wasm-kernel": "0.2.80"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",