@hicaru/pi-rlm 0.1.8 → 0.2.0

package/src/core/gates.ts

@@ -78,6 +78,35 @@ export function countHeadingsOutsideFences(content: string, re: RegExp): number
   return count;
 }
 
+/** Count newlines without materialising a line array. */
+export function lineCountOf(text: string): number {
+  let count = 1;
+  for (let i = 0; i < text.length; i++) if (text.charCodeAt(i) === 10) count++;
+  return count;
+}
+
+/** Names of `## Phase N:` sections that contain no `### Success Criteria` heading. */
+export function phasesMissingSuccessCriteria(content: string): readonly string[] {
+  const missing: string[] = [];
+  let currentPhase: string | undefined;
+  let sawCriteria = false;
+  const flush = (): void => {
+    if (currentPhase !== undefined && !sawCriteria) missing.push(currentPhase);
+  };
+  forEachLineOutsideFences(content, (line) => {
+    const phase = /^## Phase (\d+):/.exec(line);
+    if (phase) {
+      flush();
+      currentPhase = `Phase ${phase[1] ?? "?"}`;
+      sawCriteria = false;
+      return;
+    }
+    if (currentPhase !== undefined && /^### Success Criteria/.test(line)) sawCriteria = true;
+  });
+  flush();
+  return Object.freeze(missing);
+}
+
 /**
  * Fence-aware count of top-level (column-0) `- ` bullets under a `## <heading>` section.
  * Nested/indented sub-bullets are ignored. The next `## ` heading ends the section.
@@ -106,7 +135,7 @@ export function sectionHasNonEmptyBody(content: string, heading: string): boolea
   const headingRe = new RegExp(`^##\\s+${escapeRegExp(heading)}\\s*$`);
   let inSection = false;
   let seen = false; // first match wins — do not re-enter on a later duplicate heading
-  let body = "";
+  let hasBody = false; // only emptiness matters — never accumulate the body itself
   forEachLineOutsideFences(content, (line) => {
     if (/^##\s+/.test(line)) {
       if (inSection) {
@@ -119,9 +148,9 @@ export function sectionHasNonEmptyBody(content: string, heading: string): boolea
       }
       return;
     }
-    if (inSection) body += `${line}\n`;
+    if (inSection && line.trim().length > 0) hasBody = true;
   });
-  return body.trim().length > 0;
+  return hasBody;
 }
 
 function escapeRegExp(s: string): string {
@@ -207,7 +236,7 @@ export function verifyCitations(body: string, cwd: string): GateResult<undefined
     }
     let lineCount: number;
     try {
-      lineCount = readFileSync(abs, "utf-8").split("\n").length;
+      lineCount = lineCountOf(readFileSync(abs, "utf-8"));
     } catch {
       errors.push(`unbacked citation ${key} — file could not be read`);
       continue;

package/src/core/limits.ts

@@ -13,6 +13,24 @@ export interface Limits {
   readonly maxErrors?: number;
 }
 
+/** Pick the limit caps out of a config (`RlmConfig` satisfies this structurally). */
+export function limitsFromConfig(config: Limits): Limits {
+  return {
+    maxBudgetUsd: config.maxBudgetUsd,
+    maxTimeoutMs: config.maxTimeoutMs,
+    maxTokens: config.maxTokens,
+    maxErrors: config.maxErrors,
+  };
+}
+
+/** Point-in-time totals for a run. */
+export interface UsageSnapshot {
+  readonly inputTokens: number;
+  readonly outputTokens: number;
+  readonly costUsd: number;
+  readonly durationMs: number;
+}
+
 export class LimitError extends Error {
   constructor(
     public readonly kind: "timeout" | "tokens" | "budget" | "errors",
@@ -71,7 +89,7 @@ export class LimitGuard {
     }
   }
 
-  usage() {
+  usage(): UsageSnapshot {
     return {
       inputTokens: this.inputTokens,
       outputTokens: this.outputTokens,

package/src/core/pipeline-handlers.ts

@@ -0,0 +1,319 @@
+/**
+ * The phase pipeline's stateful half: the `save_artifact` / `advance_phase` sandbox handlers
+ * and the validate-phase finalize routing.
+ *
+ * Pulled out of the engine's run closure so the pipeline's mutable state (current phase, the
+ * per-phase latest save, serviced ask rounds, accumulated warnings, a pending history reset)
+ * lives in one owner instead of six `let`s threaded through a 640-line function.
+ *
+ * Two invariants this file exists to protect:
+ *  - Gates measure the CURRENT phase's latest save (`lastSaved`) only — never
+ *    `phase.artifacts`, whose paths are the completed channel and go stale across a
+ *    corrective loop-back.
+ *  - `lastSaved` and `askRounds` are session-only. They are never rehydrated from the trail,
+ *    so a resumed run must genuinely re-save and re-interview rather than re-gate stale work.
+ */
+
+import type { ChatMsg } from "../bridge/model.ts";
+import type { RlmEmitter } from "../tool/rlm-events.ts";
+import type { PhaseRecon } from "../state/resume.ts";
+import { formatError } from "../util/errors.ts";
+import { readArtifact, saveArtifact, type GoalCapture } from "./artifacts.ts";
+import { critiqueArtifact, formatCritique } from "./critique.ts";
+import {
+  advancePhase as validatePhaseTransition,
+  initialPhaseState,
+  isPhase,
+  PHASES,
+  reconcilePhase,
+  routeAfterValidate,
+  stageForArtifactKind,
+  STAGES,
+  type ArtifactRef,
+  type Phase,
+  type PhaseState,
+  type SavedArtifact,
+  type StageGateData,
+} from "./pipeline.ts";
+
+/** Builds the fresh-session history for a phase. Supplied by the engine (its own policy). */
+export type ResetHistoryForPhase = (
+  state: PhaseState,
+  options: { readonly goal?: GoalCapture; readonly validation?: import("./gates.ts").ValidationGateData; readonly notice?: string },
+) => ChatMsg[];
+
+/** Appends a `phase` row to the run trail. Supplied by the engine (owns persistence state). */
+export type PersistPhaseRow = (
+  state: PhaseState,
+  artifactPath: string | undefined,
+  artifactPhase: Phase | undefined,
+  gateData: StageGateData | undefined,
+  supersededPath?: string,
+) => Promise<void>;
+
+export interface PipelineDeps {
+  /** Repo root that artifact paths are resolved against. */
+  readonly runCwd: string;
+  readonly maxBackwardJumps: number;
+  readonly emitter: RlmEmitter;
+  /** Turns completed so far — phase rows and `advancedAt` are stamped with it. */
+  readonly completedTurns: () => number;
+  readonly resetHistoryForPhase: ResetHistoryForPhase;
+  readonly persistPhaseRow: PersistPhaseRow;
+}
+
+/** What the engine should do with a finalize submitted while in the `validate` phase. */
+export type ValidateOutcome =
+  /** Not finalizable yet — feed `error` back as the next turn's REPL output. */
+  | { readonly kind: "reject"; readonly error: string }
+  /** Blockers found — re-enter `blueprint` with this fresh history. */
+  | { readonly kind: "loop-back"; readonly history: ChatMsg[] }
+  /** Backward-jump cap reached — terminate with this report. */
+  | { readonly kind: "halt"; readonly report: string }
+  /** Validation passed — take the model's final answer. */
+  | { readonly kind: "accept" };
+
+/** The sandbox handlers the pipeline contributes. Shape-compatible with `SubLlmHandlers`. */
+export interface PipelineHandlers {
+  saveArtifact(kind: string, content: string): Promise<string>;
+  advancePhase(phase: string, summary: string | undefined): Promise<string>;
+}
+
+export class PipelineController {
+  /** Current phase state; `undefined` until seeded. Read by the engine for gate prompts/rows. */
+  phase: PhaseState | undefined;
+
+  /**
+   * Latest save per phase: path plus an optional gate memo, as ONE record so the two cannot
+   * desync. Cleared on phase exit and on loop-back.
+   */
+  private lastSaved: Partial<Record<Phase, SavedArtifact>> = {};
+
+  /** Serviced ask_user_question rounds in the current phase (session-only). */
+  private askRounds = 0;
+
+  /** Advisory critique warnings accumulated across saves (surfaced in the TUI). */
+  private warnings: readonly string[] = [];
+
+  /** History replacement scheduled by advance_phase; the engine drains it at a turn boundary. */
+  private pendingReset: ChatMsg[] | undefined;
+
+  private goal: GoalCapture | undefined;
+
+  constructor(private readonly deps: PipelineDeps) {}
+
+  /** Called after each successfully serviced root-depth ask_user_question round. */
+  noteAskRound(): void {
+    this.askRounds++;
+  }
+
+  /** Take and clear the scheduled fresh-session history, if advance_phase left one. */
+  takePendingReset(): ChatMsg[] | undefined {
+    const reset = this.pendingReset;
+    this.pendingReset = undefined;
+    return reset;
+  }
+
+  /** Seed a fresh run: capture goal, enter `startPhase`, and build the opening history. */
+  seedFresh(startPhase: Phase, goal: GoalCapture | undefined, notice: string | undefined): ChatMsg[] {
+    this.goal = goal;
+    this.phase = initialPhaseState(0, startPhase);
+    return this.deps.resetHistoryForPhase(this.phase, { goal, notice });
+  }
+
+  /**
+   * Rehydrate phase state from a trail. `lastSaved`/`askRounds` stay empty by design: a
+   * resume must re-save and re-interview rather than re-gate work from a previous process.
+   */
+  seedFromResume(recon: PhaseRecon): void {
+    const artifacts: Partial<Record<Phase, ArtifactRef>> = {};
+    for (const [key, value] of Object.entries(recon.artifacts ?? {})) {
+      if (value === undefined || !isPhase(key)) continue;
+      artifacts[key] = Object.freeze({
+        path: value.path,
+        status: value.superseded ? ("superseded" as const) : ("active" as const),
+      });
+    }
+    this.phase = {
+      current: reconcilePhase(recon.current),
+      advancedAt: recon.advancedAt,
+      summary: recon.summary,
+      artifacts,
+      backwardJumps: recon.backwardJumps ?? 0,
+    };
+    this.lastSaved = {};
+    this.askRounds = 0;
+  }
+
+  handlers(): PipelineHandlers {
+    return {
+      saveArtifact: (kind, content) => this.handleSaveArtifact(kind, content),
+      advancePhase: (phase, summary) => this.handleAdvancePhase(phase, summary),
+    };
+  }
+
+  // ── save_artifact ──
+
+  private async handleSaveArtifact(kind: string, content: string): Promise<string> {
+    const stage = stageForArtifactKind(kind);
+    if (stage === undefined) {
+      return formatError(`unknown artifact kind '${kind}' (valid: clarification, research, plan, validation)`);
+    }
+    const current = this.currentPhase();
+    if (stage.phase !== current) {
+      return formatError(`artifact kind '${kind}' belongs to phase '${stage.phase}', but the pipeline is in '${current}'`);
+    }
+    const saved = saveArtifact(this.deps.runCwd, stage.artifactDir, kind, content);
+    if (!saved.ok) return formatError(saved.error);
+
+    // Preflight: run the SAME gate advance_phase will run, now instead of a turn later, and
+    // memoize the verdict so the transition does not re-read and re-gate the file.
+    const critique = critiqueArtifact(stage, content, saved.path, this.deps.runCwd);
+    this.lastSaved = {
+      ...this.lastSaved,
+      [stage.phase]: Object.freeze({ path: saved.path, gateData: critique.gateData }),
+    };
+    if (critique.warnings.length > 0) {
+      this.warnings = Object.freeze([...this.warnings, ...critique.warnings]);
+      this.deps.emitter.emitWarnings(this.warnings);
+    }
+    return `ok — saved ${saved.path}.\n${formatCritique(critique)}`;
+  }
+
+  // ── advance_phase ──
+
+  private async handleAdvancePhase(phase: string, summary: string | undefined): Promise<string> {
+    const current = this.currentPhase();
+    const outcome = validatePhaseTransition(current, phase);
+    if (!outcome.ok) return formatError(outcome.error);
+
+    // Clarify interview gate: the engine counts serviced rounds itself, so the model cannot
+    // advance by merely claiming to have interviewed the user.
+    if (current === "clarify" && this.askRounds === 0) {
+      return formatError("clarify requires at least one ask_user_question round — interview the user before advancing");
+    }
+
+    const gated = this.gateCurrentPhase(current);
+    if (!gated.ok) return formatError(gated.error);
+    const { artifactPath, gateData } = gated;
+
+    const nextArtifacts: Partial<Record<Phase, ArtifactRef>> = { ...(this.phase?.artifacts ?? {}) };
+    if (artifactPath !== undefined) {
+      nextArtifacts[current] = Object.freeze({ path: artifactPath, status: "active" });
+    }
+    this.phase = {
+      current: outcome.phase,
+      advancedAt: this.deps.completedTurns(),
+      summary,
+      artifacts: nextArtifacts,
+      backwardJumps: this.phase?.backwardJumps ?? 0,
+    };
+    await this.deps.persistPhaseRow(this.phase, artifactPath, artifactPath !== undefined ? current : undefined, gateData);
+    this.clearLastSaved(current);
+    this.askRounds = 0;
+    this.pendingReset = this.deps.resetHistoryForPhase(this.phase, { goal: this.goal });
+    return `ok — phase advanced to '${outcome.phase}' (was '${current}'${summary ? `, summary: ${summary.slice(0, 80)}` : ""})`;
+  }
+
+  /**
+   * Measure the current phase's latest save. Deliberately reads `lastSaved` only — falling
+   * back to `phase.artifacts` would let a stale path from before a loop-back pass the gate.
+   */
+  private gateCurrentPhase(
+    current: Phase,
+  ): { ok: true; artifactPath: string | undefined; gateData: StageGateData | undefined } | { ok: false; error: string } {
+    const stage = STAGES[current];
+    if (stage.artifactDir === "") return { ok: true, artifactPath: undefined, gateData: undefined };
+
+    const savedEntry = this.lastSaved[current];
+    const artifactPath = savedEntry?.path;
+    if (artifactPath === undefined) {
+      return {
+        ok: false,
+        error: `phase '${current}' has no saved artifact — call save_artifact("${stage.artifactKind}", content) first`,
+      };
+    }
+    if (savedEntry?.gateData !== undefined) {
+      return { ok: true, artifactPath, gateData: savedEntry.gateData };
+    }
+    // No memo (e.g. the file was written outside save_artifact) — read and gate it now.
+    const content = readArtifact(this.deps.runCwd, artifactPath);
+    if (!content.ok) return { ok: false, error: content.error };
+    const gate = stage.gate(content.value, artifactPath, this.deps.runCwd);
+    if (!gate.ok) return { ok: false, error: gate.error };
+    this.lastSaved = {
+      ...this.lastSaved,
+      [current]: Object.freeze({ path: artifactPath, gateData: gate.value }),
+    };
+    return { ok: true, artifactPath, gateData: gate.value };
+  }
+
+  // ── validate-phase finalize ──
+
+  /**
+   * Decide what a finalize submitted during `validate` means. As with advance_phase, this
+   * measures THIS turn's validation save only, never `phase.artifacts`.
+   */
+  async finalizeInValidate(final: string): Promise<ValidateOutcome> {
+    const phase = this.phase;
+    if (phase === undefined) return { kind: "accept" };
+
+    const vPath = this.lastSaved.validate?.path;
+    if (vPath === undefined) {
+      return {
+        kind: "reject",
+        error: formatError(
+          'finalize rejected — save the validation artifact first via save_artifact("validation", content) with status: ready, blockers_count, and verdict',
+        ),
+      };
+    }
+    const content = readArtifact(this.deps.runCwd, vPath);
+    if (!content.ok) return { kind: "reject", error: formatError(content.error) };
+
+    const gate = STAGES.validate.gate(content.value, vPath, this.deps.runCwd);
+    if (!gate.ok) return { kind: "reject", error: formatError(gate.error) };
+    if (gate.value.kind !== "validation") {
+      return { kind: "reject", error: formatError("internal: validate gate did not return validation data") };
+    }
+
+    const { validation } = gate.value;
+    const route = routeAfterValidate(validation, phase.backwardJumps, this.deps.maxBackwardJumps);
+    if (route.kind === "halt") return { kind: "halt", report: `${route.reason}\n\n${final}` };
+    if (route.kind !== "loop-back") return { kind: "accept" };
+
+    // Loop back to blueprint. Prior artifacts are kept — the append-only journal marks the
+    // blueprint superseded by this validation rather than dropping it.
+    const prior = phase.artifacts.blueprint;
+    const nextArtifacts: Partial<Record<Phase, ArtifactRef>> = {
+      ...phase.artifacts,
+      validate: Object.freeze({ path: vPath, status: "active" }),
+    };
+    if (prior !== undefined) {
+      nextArtifacts.blueprint = Object.freeze({ path: prior.path, status: "superseded", supersededBy: vPath });
+    }
+    this.phase = {
+      current: "blueprint",
+      advancedAt: this.deps.completedTurns(),
+      summary: `loop-back: ${validation.blockersCount} blocker(s)`,
+      artifacts: nextArtifacts,
+      backwardJumps: phase.backwardJumps + 1,
+    };
+    await this.deps.persistPhaseRow(this.phase, vPath, "validate", gate.value, prior?.path);
+    // Clear BOTH so the re-entered blueprint must produce a genuinely fresh plan and a fresh
+    // validation of it, rather than re-gating what was just rejected.
+    this.clearLastSaved("blueprint", "validate");
+    this.askRounds = 0;
+    this.pendingReset = undefined;
+    return { kind: "loop-back", history: this.deps.resetHistoryForPhase(this.phase, { goal: this.goal, validation }) };
+  }
+
+  private currentPhase(): Phase {
+    return this.phase?.current ?? PHASES[0];
+  }
+
+  private clearLastSaved(...phases: readonly Phase[]): void {
+    const next: Partial<Record<Phase, SavedArtifact>> = { ...this.lastSaved };
+    for (const phase of phases) delete next[phase];
+    this.lastSaved = next;
+  }
+}

package/src/core/pipeline.ts

@@ -1,11 +1,14 @@
 /**
  * RLM pipeline stage graph — data-driven transitions with deterministic gates.
  *
- * Stages: clarify → research → blueprint → implement → validate
+ * Stages: clarify → research → blueprint → validate
  * (clarify skipped when askUserQuestion is off).
  * The root RLM writes artifacts via save_artifact(); advance_phase() is gated by
  * TypeScript floors (never LLM judgment). Validate routes on measured
  * blockers_count with a bounded corrective loop back to blueprint.
+ * The pipeline is read-only by design: it produces a validated plan and does not
+ * write source. Accidental sandbox writes are blocked (open/pathlib/os.open);
+ * this is steering, not a hard security boundary.
  */
 import {
   checkStatusReady,
@@ -19,16 +22,31 @@ import {
   verifyCitations,
 } from "./gates.ts";
 
-export type Phase = "clarify" | "research" | "blueprint" | "implement" | "validate";
+export type Phase = "clarify" | "research" | "blueprint" | "validate";
 
 export const PHASES = Object.freeze([
   "clarify",
   "research",
   "blueprint",
-  "implement",
   "validate",
 ] as const satisfies readonly Phase[]);
 
+const PHASE_SET: ReadonlySet<string> = Object.freeze(new Set<string>(PHASES));
+
+export function isPhase(value: unknown): value is Phase {
+  return typeof value === "string" && PHASE_SET.has(value);
+}
+
+/**
+ * Map a persisted phase name onto the current graph. Trails written before the
+ * implement phase was retired resume at `blueprint` — the last phase whose
+ * artifact is still meaningful.
+ */
+export function reconcilePhase(persisted: unknown): Phase {
+  if (isPhase(persisted)) return persisted;
+  return "blueprint";
+}
+
 /** Kind string the model passes to save_artifact(kind, content). */
 export type ArtifactKind = "clarification" | "research" | "plan" | "validation";
 
@@ -37,8 +55,7 @@ export type StageGateData =
   | { readonly kind: "clarification"; readonly clarification: ClarificationGateData }
   | { readonly kind: "research" }
   | { readonly kind: "plan"; readonly plan: PlanGateData }
-  | { readonly kind: "validation"; readonly validation: ValidationGateData }
-  | { readonly kind: "side-effect" };
+  | { readonly kind: "validation"; readonly validation: ValidationGateData };
 
 export interface StageDef {
   readonly phase: Phase;
@@ -90,13 +107,6 @@ export const STAGES: Readonly<Record<Phase, StageDef>> = Object.freeze({
   clarify: { phase: "clarify", artifactDir: "clarifications", artifactKind: "clarification", gate: clarifyGate },
   research: { phase: "research", artifactDir: "research", artifactKind: "research", gate: researchGate },
   blueprint: { phase: "blueprint", artifactDir: "plans", artifactKind: "plan", gate: blueprintGate },
-  // implement is a side-effect stage; exit is engine-driven (serial fanout).
-  implement: {
-    phase: "implement",
-    artifactDir: "",
-    artifactKind: "",
-    gate: (): GateResult<StageGateData> => ({ ok: true, value: { kind: "side-effect" } }),
-  },
   validate: { phase: "validate", artifactDir: "validations", artifactKind: "validation", gate: validateGate },
 });
 
@@ -115,12 +125,27 @@ export function stageForArtifactKind(kind: string): StageDef | undefined {
   return undefined;
 }
 
+/** An artifact path plus its lifecycle status — append-only, never deleted. */
+export interface ArtifactRef {
+  readonly path: string;
+  readonly status: "active" | "superseded";
+  /** Path of the artifact that superseded this one (the rejecting validation). */
+  readonly supersededBy?: string;
+}
+
+/** The latest artifact saved for a stage, plus its gate result when it passed. */
+export interface SavedArtifact {
+  readonly path: string;
+  /** Gate payload when the artifact passed; undefined ⇒ advance_phase must re-gate. */
+  readonly gateData?: StageGateData;
+}
+
 export interface PhaseState {
   readonly current: Phase;
   readonly advancedAt: number;
   readonly summary?: string;
   /** Artifact each completed stage produced — the named channels. */
-  readonly artifacts: Readonly<Partial<Record<Phase, string>>>;
+  readonly artifacts: Readonly<Partial<Record<Phase, ArtifactRef>>>;
   /** Corrective validate→blueprint re-entries taken so far. */
   readonly backwardJumps: number;
 }
@@ -183,7 +208,7 @@ export function advancePhase(
   current: Phase | undefined,
   target: string,
 ): AdvancePhaseOutcome {
-  if (!PHASES.includes(target as Phase)) {
+  if (!isPhase(target)) {
     return {
       ok: false,
       error: `unknown phase '${target}'; valid phases: ${PHASES.join(", ")}`,
@@ -206,7 +231,7 @@ export function advancePhase(
       phase: from,
     };
   }
-  return { ok: true, phase: target as Phase };
+  return { ok: true, phase: target };
 }
 
 /** Return the current phase (defaults to first phase if undefined). */

package/src/core/types.ts

@@ -1,7 +1,7 @@
 /** Shared configuration + runtime types for the RLM engine. */
 
 import type { ThinkingLevel } from "@earendil-works/pi-ai";
-import type { AskAnswer, AskQuestion, ProposedEdit } from "../sandbox/protocol.ts";
+import type { AskAnswer, AskQuestion } from "../sandbox/protocol.ts";
 import type { ReconstructResult } from "../state/resume.ts";
 
 export interface Sampling {
@@ -10,8 +10,6 @@ export interface Sampling {
   readonly reasoning?: ThinkingLevel;
 }
 
-type MutableSampling = { -readonly [Key in keyof Sampling]?: Sampling[Key] };
-
 export interface RunLogConfig {
   /** Default: true — always-on, opt-out. */
   readonly enabled?: boolean;
@@ -25,59 +23,59 @@ export interface RunLogConfig {
 
 export interface RlmConfig {
   /** Persistent editor-routing mode; when enabled, plain interactive prompts use RLM. */
-  enabled: boolean;
+  readonly enabled: boolean;
   /** Max recursion depth. depth >= maxDepth ⇒ rlm_query falls back to a plain llm_query. */
-  maxDepth: number;
+  readonly maxDepth: number;
   /** Max turns before the engine must finalize. */
-  maxIterations: number;
+  readonly maxIterations: number;
   /** Per-`repl`-block wall-clock timeout inside the worker (seconds). */
-  execTimeoutS: number;
+  readonly execTimeoutS: number;
   /** Parent-side watchdog per sandbox request (ms). */
-  requestTimeoutMs: number;
+  readonly requestTimeoutMs: number;
   /** Concurrency pool for *_batched sub-calls. */
-  maxConcurrentSubcalls: number;
+  readonly maxConcurrentSubcalls: number;
   /** Reject sub-LLM prompts larger than this many chars. */
-  maxPromptChars: number;
+  readonly maxPromptChars: number;
   /** Max USD spend across the whole tree before the engine stops (undefined = no cap). */
-  maxBudgetUsd?: number;
+  readonly maxBudgetUsd?: number;
   /** Max wall-clock ms across the whole tree before the engine stops (undefined = no cap). */
-  maxTimeoutMs?: number;
+  readonly maxTimeoutMs?: number;
   /** Max total input+output tokens across the whole tree before the engine stops (undefined = no cap). */
-  maxTokens?: number;
+  readonly maxTokens?: number;
   /** Max consecutive error turns before the engine stops (undefined = no cap). */
-  maxErrors?: number;
+  readonly maxErrors?: number;
   /** Append the orchestrator addendum to the system prompt. */
-  orchestrator: boolean;
+  readonly orchestrator: boolean;
   /** Enable the phase pipeline (advance_phase + stall nags) at depth 0. */
-  pipeline: boolean;
+  readonly pipeline: boolean;
   /** Max validate→blueprint corrective re-entries when validation reports blockers (default 2). */
-  maxBackwardJumps: number;
+  readonly maxBackwardJumps: number;
   /** Summarize the trajectory when it grows past the threshold (keeps the root window small). */
-  compaction: boolean;
+  readonly compaction: boolean;
   /** Compact when estimated history tokens reach this fraction of the model's context window. */
-  compactionThresholdPct: number;
+  readonly compactionThresholdPct: number;
   /** Python executable used to launch the sandbox worker. */
-  python: string;
+  readonly python: string;
   /** Worker startup wait before treating sandbox init as failed (ms). */
-  sandboxInitTimeoutMs: number;
+  readonly sandboxInitTimeoutMs: number;
   /** Allow ask_user_question() calls from the root REPL. */
-  askUserQuestion: boolean;
+  readonly askUserQuestion: boolean;
   /** Allow todo() calls from the REPL. */
-  todo: boolean;
+  readonly todo: boolean;
   /** Enable the load_library() REPL scaffold (external dirs/files/git repos as extra context slots). */
-  libraryLoader: boolean;
+  readonly libraryLoader: boolean;
   /** ThinkingLevel for the root smart model (set via /rlm-config). */
-  smartReasoning?: ThinkingLevel;
+  readonly smartReasoning?: ThinkingLevel;
   /** Output token cap + temperature for the root smart model per turn.
    *  Keeps each turn short so the next turn's input stays manageable.
    *  `reasoning` is read from `smartReasoning` if omitted here. */
-  rootSampling?: Readonly<Sampling>;
+  readonly rootSampling?: Readonly<Sampling>;
   /** System prompt injected into every llm_query / llm_query_batched sub-call.
    *  Instructs the worker model to respond concisely.
    *  undefined = no system prompt (raw completion). */
-  subSystemPrompt?: string;
+  readonly subSystemPrompt?: string;
   /** Sampling for sub-LLM (worker) calls. */
-  subSampling: MutableSampling;
+  readonly subSampling: Readonly<Sampling>;
   /** Optional run-state persistence configuration. Enabled by default. */
   readonly runLog?: RunLogConfig;
 }
@@ -105,8 +103,6 @@ export interface RlmInput {
 /** Result of a completed RLM run. */
 export interface RlmResult {
   readonly answer: string;
-  /** Legacy anchor edits retained for compatibility while older run-state rows exist. */
-  readonly edits?: readonly ProposedEdit[];
   readonly iterations: number;
   readonly costUsd: number;
   readonly inputTokens: number;