@inflexa-ai/harness 0.42.2 → 0.43.1

package/dist/tasks/derive-table-exec.js

@@ -1,22 +1,17 @@
 /**
  * The container of one report-session derivation, as a registered DBOS workflow.
  *
- * The `derive_table` tool runs inside one live chat turn, and a chat turn is not a workflow body. An await
- * of an exec under the callback transport calls `DBOS.recv`, which a workflow body alone can call. Thus the
+ * The `derive_table` tool runs inside one live chat turn, and a chat turn is not a workflow. An exec runs as
+ * a durable step of a workflow, and the reaper maps each container to the workflow that owns it. Thus the
  * container lives here, behind a registered workflow, and the tool starts it and awaits the handle.
  *
  * The shape is the shape of `tasks/extract-values.ts`: a body that a test drives directly, a registration
  * that closes over the construction-time deps, and a trigger that starts the workflow and gives the result
  * back. The tool holds the trigger as a plain function, thus no module under `tools/` imports DBOS.
  *
- * The body owns the whole machine lifetime. It creates the container, submits one exec, awaits the terminal
+ * The body owns the whole machine lifetime. It creates the container, runs one exec to its terminal
  * result, and tears the container down on both paths. A teardown fault reaches the log alone, because the
  * work is done by then.
- *
- * The exec id is `${workflowId}:${stepId}:${fnId}`, the one shape that `workflowIdFromExec` parses. A
- * callback host reads the owner workflow out of the exec id alone, thus a flat id makes the completion
- * callback unroutable and it lands as a `400`. The pull backstop still settles such an exec, but it pays
- * the quiet interval first.
  */
 import { DBOS } from "@dbos-inc/dbos-sdk";
 import { err, ok } from "neverthrow";
@@ -26,7 +21,7 @@ import { mintSandboxIdentity } from "../sandbox/identity.js";
 import { keepSuspendingRefusal } from "../sandbox/sandbox-error.js";
 import { suspensionOfSpawnRefusal } from "../workflows/suspension.js";
 import { buildDerivationExec, DERIVATION_DEADLINE_MS, DERIVATION_RESOURCES, DERIVE_RUN_LITERAL, DERIVE_STEP_LITERAL, } from "../tools/report-session/derive-table.js";
-/** The awaitExec callback. A derivation reports no live activity, thus the callback drops each event. */
+/** The exec progress callback. A derivation reports no live activity, thus the callback drops each event. */
 const noopEmit = () => { };
 /**
  * The body, exported so a test drives it without a registered workflow.
@@ -39,9 +34,6 @@ const noopEmit = () => { };
 export async function runDeriveTableExecBody(input, deps) {
     const logger = (deps.logger ?? createNoopLogger()).named("derive-table-exec").with({ analysisId: input.analysisId });
     const workflowId = DBOS.workflowID ?? deriveTableExecWorkflowId(input.executionId);
-    // One workflow submits one exec, thus the function id is a constant. The three segments are what a
-    // callback host parses to find the workflow that awaits this exec.
-    const execId = `${workflowId}:${DERIVE_STEP_LITERAL}:fn-0`;
     const spawned = keepSuspendingRefusal(await deps.sandboxClient.createSandbox(forStep(input.runSession, DERIVE_STEP_LITERAL), { childWorkflowId: workflowId, resources: DERIVATION_RESOURCES, writableTail: input.writableTail }, mintSandboxIdentity(DERIVE_RUN_LITERAL)));
     if (spawned.isErr()) {
         const suspension = suspensionOfSpawnRefusal(spawned.error);
@@ -50,17 +42,15 @@ export async function runDeriveTableExecBody(input, deps) {
     }
     const sandbox = spawned.value;
     try {
-        // A checkpointed clock, not `Date.now()`: the await gates on this absolute deadline, and a
-        // wall-clock deadline that grew on replay would shift which loop iteration crosses it.
+        // A checkpointed clock, not `Date.now()`: a wall-clock deadline would grow on each recovery.
         const deadline = (await (deps.now ?? (() => DBOS.now()))()) + DERIVATION_DEADLINE_MS;
-        await deps.sandboxClient.submitExec(sandbox, buildDerivationExec({
+        const request = buildDerivationExec({
             script: input.script,
-            execId,
             workingDir: input.workingDir,
             inputs: input.inputs,
             output: input.output,
-        }));
-        return ok(await deps.sandboxClient.awaitExec(sandbox, execId, noopEmit, deadline));
+        });
+        return ok(await deps.sandboxClient.exec(sandbox, request, noopEmit, deadline));
     }
     finally {
         try {
@@ -78,12 +68,7 @@ export async function runDeriveTableExecBody(input, deps) {
 export function registerDeriveTableExecWorkflow(deps) {
     return DBOS.registerWorkflow((input) => runDeriveTableExecBody(input, deps), { name: "derive-table-exec" });
 }
-/**
- * The workflow id of one derivation.
- *
- * It carries exactly one colon, because `workflowIdFromExec` recovers the id by a strip of the last two
- * colon-delimited segments of the exec id. The execution id is unique already, thus no nonce joins it.
- */
+/** The workflow id of one derivation. The execution id is unique already, thus no nonce joins it. */
 export function deriveTableExecWorkflowId(executionId) {
     return `${DERIVE_RUN_LITERAL}:${executionId}`;
 }

package/dist/tasks/extract-values.d.ts

@@ -18,7 +18,7 @@ import type { Logger } from "../lib/logger.js";
 import type { ExtractionArm, ExtractionArtifact, ExtractionRequest } from "../report-model/production-resolver.js";
 import type { SandboxClient } from "../sandbox/client.js";
 import { type Suspension } from "../workflows/suspension.js";
-import type { ExecResult, SubmitExecBody } from "../sandbox/types.js";
+import type { ExecRequest, ExecResult } from "../sandbox/types.js";
 import { type ExtractValuesResult } from "./extract-values-script.js";
 export type { ExtractValuesResult } from "./extract-values-script.js";
 /**
@@ -60,7 +60,7 @@ export interface ExtractValuesWorkflowInput {
  *
  * The function is pure, thus a test asserts the command shape without a sandbox.
  */
-export declare function buildExtractionExec(analysisId: string, requests: readonly ExtractionRequest[], execId: string): SubmitExecBody;
+export declare function buildExtractionExec(analysisId: string, requests: readonly ExtractionRequest[]): ExecRequest;
 /**
  * Parse the script output from the exec result. A synthetic failure, a timeout, and a non-zero exit each
  * throw, because each means the script did not emit its map. A stdout that is not the map shape throws too.

package/dist/tasks/extract-values.js

@@ -35,7 +35,7 @@ const EXTRACTION_DEADLINE_MS = 300_000;
  * carries no file size. A later change can size it from the batch.
  */
 const EXTRACTION_RESOURCES = { cpu: 2, memoryGb: 8 };
-/** The awaitExec callback. The extraction pass reports no live activity, thus the callback drops each event. */
+/** The exec progress callback. The extraction pass reports no live activity, thus the callback drops each event. */
 const noopEmit = () => { };
 /**
  * Build the sandbox exec for one extraction pass. The command runs the fixed script through `python3 -c`.
@@ -50,11 +50,10 @@ const noopEmit = () => { };
  *
  * The function is pure, thus a test asserts the command shape without a sandbox.
  */
-export function buildExtractionExec(analysisId, requests, execId) {
+export function buildExtractionExec(analysisId, requests) {
     const scriptRequests = requests.map((request) => ({ path: request.path, format: request.format, hash: request.hash }));
     return {
         command: ["python3", "-c", EXTRACTION_SCRIPT],
-        execId,
         cwd: `/${analysisId}`,
         env: { [EXTRACTION_INPUT_ENV]: JSON.stringify(scriptRequests) },
         timeoutSeconds: Math.floor(EXTRACTION_DEADLINE_MS / 1000),
@@ -113,11 +112,9 @@ export async function runExtractValuesBody(input, deps) {
         }
         const sandbox = spawned.value;
         try {
-            // A checkpointed clock, not `Date.now()`: the await gates on this absolute deadline, and a
-            // wall-clock deadline that grew on replay would shift which loop iteration crosses it.
+            // A checkpointed clock, not `Date.now()`: a wall-clock deadline would grow on each recovery.
             const deadlineAbs = (await DBOS.now()) + EXTRACTION_DEADLINE_MS;
-            await deps.sandboxClient.submitExec(sandbox, buildExtractionExec(analysisId, requests, executionId));
-            const result = await deps.sandboxClient.awaitExec(sandbox, executionId, noopEmit, deadlineAbs);
+            const result = await deps.sandboxClient.exec(sandbox, buildExtractionExec(analysisId, requests), noopEmit, deadlineAbs);
             const map = parseExtractionOutput(result);
             await revoke("extract-values-completed");
             return ok(map);

package/dist/tools/define-tool.d.ts

@@ -8,7 +8,7 @@
  * captures its deps and calls `defineTool`.
  *
  * `ToolContext` carries only request-scoped values every tool may need
- * (`invocationId`, `session`, `signal`, `emit`, `runStep`, `ask`, `turnUsage`) — no pool, no sandbox, no
+ * (`invocationId`, `session`, `signal`, `emit`, `ask`, `turnUsage`) — no pool, no sandbox, no
  * logger. The error contract: an expected
  * outcome ("not found", "no results") stays in the ok channel as a data
  * variant (`ok({ found: false })`); an unexpected failure is an `err(ToolError)`
@@ -19,7 +19,7 @@ import type { Result } from "neverthrow";
 import { z } from "zod";
 import type { AgentSession } from "../auth/types.js";
 import type { AgentRunUsage } from "../loop/metrics.js";
-import type { EmitFn, RunStep } from "../loop/types.js";
+import type { EmitFn } from "../loop/types.js";
 import type { AskApproval, AskRequest } from "./approval/contract.js";
 export type { EmitFn };
 /**
@@ -35,7 +35,13 @@ export interface ToolError {
     readonly retryable: boolean;
     readonly cause?: unknown;
 }
-export type ToolExecutionMode = "step" | "workflow" | "inline";
+/**
+ * How the loop runs a tool call. `step` (the default) wraps the whole call in
+ * one durable step, thus a replay returns the cached result and never runs the
+ * body again. `inline` runs the call with no step, for a tool whose effects are
+ * not durable work.
+ */
+export type ToolExecutionMode = "step" | "inline";
 /** Runtime guard — does a `Result`'s error value carry the `ToolError` shape? */
 export declare function isToolError(value: unknown): value is ToolError;
 /**
@@ -78,13 +84,37 @@ export declare function withToolResultImages<T extends object>(value: T, images:
  * in the same shape.
  */
 export declare function readToolResultImages(value: unknown): ToolResultImage[];
+/**
+ * The reserved key that carries the call record on a tool ok value.
+ *
+ * A call record is what a call leaves for process-local state, for example the
+ * lineage collector of a sandbox step. A replay returns the cached result of a
+ * step-mode call and never runs its body, thus a side effect of the body on
+ * such state is lost on recovery. The record goes into the cached dispatch
+ * instead, and the loop hands it to `foldCallRecord` after the call settles, on
+ * the first run and on each replay alike.
+ *
+ * It is a symbol, thus `JSON.stringify` omits it and the model never reads it.
+ * The record itself must be plain JSON, because the step cache serializes it.
+ */
+export declare const toolCallRecordKey: unique symbol;
+/** A tool ok value that carries a call record under the reserved key. */
+export type WithToolCallRecord<T, R> = T & {
+    readonly [toolCallRecordKey]: R;
+};
+/** The type of the call record that a tool ok type carries. A variant with no record contributes nothing. */
+export type ToolCallRecordOf<Output> = Output extends {
+    readonly [toolCallRecordKey]: infer R;
+} ? R : never;
+/** Attach a call record to a tool ok value. The value keeps its own fields. */
+export declare function withToolCallRecord<T extends object, R>(value: T, record: R): WithToolCallRecord<T, R>;
+/** Read the call record that a tool ok value carries, or `undefined` when it carries none. */
+export declare function readToolCallRecord(value: unknown): unknown;
 /**
  * The request-scoped values passed to every tool's `execute`. No injected
  * dependencies (see the harness-durable-runtime spec) — invocation identity,
- * `session`, `signal`, `emit`, the `runStep`
- * durability seam (`passthroughStep` in chat, `DBOS.runStep` in workflows) a
- * tool uses to wrap its own durable work, the `ask` user-approval seam, and the
- * turn's usage accumulator a sub-agent-running tool hands to its child loop.
+ * `session`, `signal`, `emit`, the `ask` user-approval seam, and the turn's
+ * usage accumulator a sub-agent-running tool hands to its child loop.
  */
 export interface ToolContext {
     /** Stable identity of this AI SDK tool call. Redelivery preserves it; a new
@@ -93,11 +123,6 @@ export interface ToolContext {
     readonly session: AgentSession;
     readonly signal: AbortSignal;
     readonly emit: EmitFn;
-    /**
-     * Wrap durable work in a replay-cached step. The loop namespaces the name
-     * under the tool's own step name, so a tool just passes a short local label.
-     */
-    readonly runStep: RunStep;
     /**
      * Pause for an explicit user decision on a concrete action. Resolves with the
      * approval (`once`/`always`) or throws `AskRejectedError` on denial. Resolves
@@ -117,7 +142,7 @@ export interface ToolContext {
 }
 /**
  * A packaged tool: identity, the Zod input contract, the emitted AI SDK input
- * schema, execution mode, the optional call-description hook, and the executor.
+ * schema, execution mode, the optional hooks, and the executor.
  */
 export interface Tool<Input = unknown, Output = unknown> {
     readonly id: string;
@@ -129,6 +154,11 @@ export interface Tool<Input = unknown, Output = unknown> {
     describeCall?(input: Input): string;
     /** See {@link ToolDefinition.describeResult}. Absent when the tool declares none. */
     describeResult?(input: Input, result: Output): string;
+    /**
+     * See {@link ToolDefinition.foldCallRecord}. The record arrives untyped: the
+     * loop passes back only what the `execute` of the same tool attached.
+     */
+    foldCallRecord?(record: unknown): void;
     execute(input: Input, ctx: ToolContext): Promise<Result<Output, ToolError>>;
 }
 export interface ToolDefinition<Schema extends z.ZodType, Output> {
@@ -199,6 +229,19 @@ export interface ToolDefinition<Schema extends z.ZodType, Output> {
      * The hook never reaches the model.
      */
     readonly describeResult?: (input: z.infer<Schema>, result: Output) => string;
+    /**
+     * Fold the call record of one settled call into process-local state. The
+     * record is the one that `execute` attached with `withToolCallRecord`.
+     *
+     * The loop runs the hook after the round settles, in the order of the tool
+     * calls, on the first run and on each replay alike. Thus state that a
+     * replay rebuilds from scratch sees the same records in the same order. A
+     * call whose ok value carries no record, and a failed call, never reach it.
+     *
+     * The hook is synchronous. It must never fail a call: the call has settled,
+     * and its result may already be cached. The loop logs a throw and goes on.
+     */
+    readonly foldCallRecord?: (record: ToolCallRecordOf<Output>) => void;
     execute(input: z.infer<Schema>, ctx: ToolContext): Promise<Result<Output, ToolError>>;
 }
 /**

package/dist/tools/define-tool.js

@@ -8,7 +8,7 @@
  * captures its deps and calls `defineTool`.
  *
  * `ToolContext` carries only request-scoped values every tool may need
- * (`invocationId`, `session`, `signal`, `emit`, `runStep`, `ask`, `turnUsage`) — no pool, no sandbox, no
+ * (`invocationId`, `session`, `signal`, `emit`, `ask`, `turnUsage`) — no pool, no sandbox, no
  * logger. The error contract: an expected
  * outcome ("not found", "no results") stays in the ok channel as a data
  * variant (`ok({ found: false })`); an unexpected failure is an `err(ToolError)`
@@ -62,6 +62,30 @@ export function readToolResultImages(value) {
     const entries = Array.isArray(carried) ? carried : [carried];
     return entries.filter(isToolResultImage);
 }
+/**
+ * The reserved key that carries the call record on a tool ok value.
+ *
+ * A call record is what a call leaves for process-local state, for example the
+ * lineage collector of a sandbox step. A replay returns the cached result of a
+ * step-mode call and never runs its body, thus a side effect of the body on
+ * such state is lost on recovery. The record goes into the cached dispatch
+ * instead, and the loop hands it to `foldCallRecord` after the call settles, on
+ * the first run and on each replay alike.
+ *
+ * It is a symbol, thus `JSON.stringify` omits it and the model never reads it.
+ * The record itself must be plain JSON, because the step cache serializes it.
+ */
+export const toolCallRecordKey = Symbol("toolCallRecord");
+/** Attach a call record to a tool ok value. The value keeps its own fields. */
+export function withToolCallRecord(value, record) {
+    return { ...value, [toolCallRecordKey]: record };
+}
+/** Read the call record that a tool ok value carries, or `undefined` when it carries none. */
+export function readToolCallRecord(value) {
+    if (typeof value !== "object" || value === null)
+        return undefined;
+    return value[toolCallRecordKey];
+}
 /**
  * Package a `Tool`. The emitted JSON Schema must have a top-level
  * `"type": "object"` — model tool calling rejects anything else. A `z.discriminatedUnion`
@@ -95,6 +119,9 @@ export function defineTool(def) {
         // declares no result hook carries no key, thus "has a hook" is one
         // property check on either side.
         ...(typeof def.describeResult === "function" ? { describeResult: def.describeResult } : {}),
+        // The loop passes back only a record that this tool's `execute`
+        // attached, thus the record has the declared type.
+        ...(typeof def.foldCallRecord === "function" ? { foldCallRecord: def.foldCallRecord } : {}),
         execute: def.execute,
     };
 }

package/dist/tools/execute-analysis.js

@@ -274,7 +274,7 @@ export function buildAdHocPlan(request, route, createdAt = new Date().toISOStrin
  * would pay a file read on every ad hoc launch to learn nothing — while the
  * router, with no resolution, already keeps every entry that parses.
  */
-function adHocPackageResolver(deps) {
+function adHocPackageResolver(deps, analysisId) {
     if (!deps.farmLockFile && !deps.imagePackagesFile && !deps.readPoolInventory)
         return undefined;
     const inventory = {
@@ -283,7 +283,7 @@ function adHocPackageResolver(deps) {
         ...(deps.readPoolInventory === undefined ? {} : { readPoolInventory: deps.readPoolInventory }),
     };
     return async (names) => {
-        const read = await readInventorySections(inventory);
+        const read = await readInventorySections(inventory, analysisId);
         // An inventory that cannot answer must not drop a name: the router
         // keeps every parsed entry, and the link pass judges at launch.
         if (read.kind === "unavailable")
@@ -296,7 +296,7 @@ async function persistedAdHocPlan(deps, args) {
     const existing = unwrapOrThrow(await loadPlan(deps.pool, args.planId, { analysisId: args.analysisId }));
     if (existing)
         return validateStoredPlan(existing, args.planId);
-    const resolvePackages = adHocPackageResolver(deps);
+    const resolvePackages = adHocPackageResolver(deps, args.analysisId);
     const route = await routeAdHocRequest({
         provider: deps.utilityProvider,
         model: deps.utilityModel,

package/dist/tools/report-session/derive-table.d.ts

@@ -29,9 +29,9 @@
  * condition one time, up front, the same discipline as the eyes. A per-attempt failure would instead read as
  * a transient fault, and it would invite a repeat of a call that can never pass.
  *
- * The container runs behind a seam, and never in the turn. An await of an exec is a workflow-body call
- * under the callback transport, and a report turn is not a body. Thus the tool takes an injected runner,
- * and a registered workflow owns the container. The tool holds no sandbox client, and it imports no DBOS.
+ * The container runs behind a seam, and never in the turn. An exec is a durable step of a workflow, and a
+ * report turn is not a workflow. Thus the tool takes an injected runner, and a registered workflow owns the
+ * container. The tool holds no sandbox client, and it imports no DBOS.
  */
 import { type Result } from "neverthrow";
 import { z } from "zod";
@@ -40,7 +40,7 @@ import type { Suspension } from "../../workflows/suspension.js";
 import type { RunAuthorizer } from "../../execution/run-authorizer.js";
 import { type Logger } from "../../lib/logger.js";
 import type { ResourceSpec } from "../../config/resource-limits.js";
-import type { ExecResult, SubmitExecBody } from "../../sandbox/types.js";
+import type { ExecRequest, ExecResult } from "../../sandbox/types.js";
 import type { DerivationSource, ReportSessionStateStore } from "../../state/report-session-state.js";
 import { type ResolveWorkspaceRoot } from "../../workspace/paths.js";
 import { type Tool } from "../define-tool.js";
@@ -156,11 +156,10 @@ export interface DerivationInputMount {
  */
 export declare function buildDerivationExec(args: {
     readonly script: string;
-    readonly execId: string;
     readonly workingDir: string;
     readonly inputs: readonly DerivationInputMount[];
     readonly output: string;
-}): SubmitExecBody;
+}): ExecRequest;
 /**
  * Give the failure of an exec result, or `undefined` when the script ran to a clean exit.
  *
@@ -190,9 +189,9 @@ export interface DeriveTableExecInput {
 /**
  * Run one derivation exec and give the terminal result back.
  *
- * The composition realizes it over a registered workflow, thus the container lives inside a workflow body
- * and the await is legal under each transport. A fault of the sandbox rejects the promise, and the tool
- * turns that rejection into one short detail.
+ * The composition realizes it over a registered workflow, thus the container and its exec live inside a
+ * workflow. A fault of the sandbox rejects the promise, and the tool turns that rejection into one short
+ * detail.
  */
 export type DeriveTableRunner = (input: DeriveTableExecInput) => Promise<Result<ExecResult, Suspension>>;
 /**

package/dist/tools/report-session/derive-table.js

@@ -29,9 +29,9 @@
  * condition one time, up front, the same discipline as the eyes. A per-attempt failure would instead read as
  * a transient fault, and it would invite a repeat of a call that can never pass.
  *
- * The container runs behind a seam, and never in the turn. An await of an exec is a workflow-body call
- * under the callback transport, and a report turn is not a body. Thus the tool takes an injected runner,
- * and a registered workflow owns the container. The tool holds no sandbox client, and it imports no DBOS.
+ * The container runs behind a seam, and never in the turn. An exec is a durable step of a workflow, and a
+ * report turn is not a workflow. Thus the tool takes an injected runner, and a registered workflow owns the
+ * container. The tool holds no sandbox client, and it imports no DBOS.
  */
 import { ok } from "neverthrow";
 import { unlink } from "node:fs/promises";
@@ -90,7 +90,6 @@ const NO_SANDBOX_DETAIL = "the composition gives no sandbox, thus this session c
 export function buildDerivationExec(args) {
     return {
         command: ["python3", "-c", args.script],
-        execId: args.execId,
         cwd: args.workingDir,
         env: {
             [DERIVE_INPUT_ENV]: JSON.stringify(args.inputs.map((input) => ({ path: input.path, hash: input.hash }))),

package/dist/tools/report-session/preview-report.js

@@ -52,7 +52,7 @@ import { referencedPaths, walkBlocks } from "../../report-model/block-walk.js";
 import { computeDraftHash } from "../../report-model/draft-hash.js";
 import { finishDraft } from "../../report-model/draft-finish.js";
 import { resolveDocumentReferences } from "../../report-model/validate.js";
-import { bridgeValues } from "../../report-render/value-bridge.js";
+import { bridgeValues, collectResolutions } from "../../report-render/value-bridge.js";
 import { resolvePageAssetFromInstallation } from "../../report-render/asset-lookup.js";
 import { ASSETS_DIR, DEPS_DIR, derivationScriptName, PAGE_ASSETS, stagedSource, tableSidecarName } from "../../report-render/assets.js";
 import { renderReportPage } from "../../report-render/render.js";
@@ -77,51 +77,6 @@ function assetFileName(file) {
 function figureSourcePolicy(file) {
     return `assets/${assetFileName(file)}`;
 }
-/**
- * Pair each block with the resolved value of its binding, in document order.
- *
- * A value-bearing kind carries the resolved value of its one reference, looked up by the block id from
- * the map that the resolution pass filled. A no-value kind carries none. Where a reference sits in a
- * block is the knowledge of `block-walk.ts`, thus this walk reads the block id alone and never a binding
- * field.
- *
- * The switch is exhaustive over the eight block kinds. A ninth kind reaches the end with no return, and
- * the declared return type fails the build. Thus the walk cannot drop a kind in silence. A value-bearing
- * block reaches here only when its reference resolved, because an unresolved reference short-circuits
- * before this walk.
- */
-function collectResolutions(blocks, resolvedByBlock) {
-    const resolutions = [];
-    const visit = (block) => {
-        switch (block.kind) {
-            case "section":
-                resolutions.push({ blockId: block.id, kind: "section" });
-                for (const child of block.blocks) {
-                    visit(child);
-                }
-                return;
-            case "text":
-            case "claim":
-            case "citation":
-                resolutions.push({ blockId: block.id, kind: block.kind });
-                return;
-            case "metric":
-            case "table":
-            case "chart":
-            case "figure": {
-                const resolved = resolvedByBlock.get(block.id);
-                if (resolved !== undefined) {
-                    resolutions.push({ blockId: block.id, kind: block.kind, resolved });
-                }
-                return;
-            }
-        }
-    };
-    for (const block of blocks) {
-        visit(block);
-    }
-    return resolutions;
-}
 /**
  * The sidecar of each table block of the document, in document order.
  *
@@ -201,11 +156,11 @@ function scriptAssets(records) {
  * references. On a clean pass the resolutions map onto the render model in document order.
  */
 async function resolveDocument(document, resolver, snapshot) {
-    const { resolvedByBlock, failures } = await resolveDocumentReferences(document.sections, snapshot, resolver);
+    const { resolvedByBlock, resolvedBySlot, failures } = await resolveDocumentReferences(document.sections, snapshot, resolver);
     if (failures.length > 0) {
         return { resolutions: [], unresolved: failures };
     }
-    return { resolutions: collectResolutions(document.sections, resolvedByBlock), unresolved: [] };
+    return { resolutions: collectResolutions(document.sections, resolvedByBlock, resolvedBySlot), unresolved: [] };
 }
 /**
  * Resolve the page root, stage each bound image and each manifest entry, and write the page.
@@ -456,7 +411,7 @@ export function createPreviewReportTool(deps) {
             // the renderer moves it into a data asset and no part of this path reads a field of it. Absence
             // gives a page with no provenance asset, and each other part of the render is unchanged.
             const provenance = await readProvenance(analysisId);
-            const rendered = renderReportPage(document, bridged.value, {
+            const rendered = await renderReportPage(document, bridged.value, {
                 records: snapshot.citationRecords,
                 derivations: used.map((record) => chainOf(record, sessionDir)),
                 provenance,

package/dist/tools/sandbox/list-available-packages.d.ts

@@ -140,7 +140,7 @@ export type InventoryRead = {
  * here, thus the census a model sees and the check a launch runs never
  * disagree about what the source holds.
  */
-export declare function readInventorySections(deps: ListAvailablePackagesDeps): Promise<InventoryRead>;
+export declare function readInventorySections(deps: ListAvailablePackagesDeps, analysisId: string): Promise<InventoryRead>;
 /**
  * Create the package inventory over the bound source: the pool-scope reader
  * when the embedder binds one (a conversation or planning surface), the

package/dist/tools/sandbox/list-available-packages.js

@@ -400,7 +400,7 @@ export function queryPackages(rawSections, { names, query, language, limit }) {
  * here, thus the census a model sees and the check a launch runs never
  * disagree about what the source holds.
  */
-export async function readInventorySections(deps) {
+export async function readInventorySections(deps, analysisId) {
     // The image record merges in when the host can read a valid one. An absent
     // record and an invalid record both merge nothing, and neither is an
     // error: the record is an enrichment, and the farm or pool inventory stays
@@ -422,8 +422,9 @@ export async function readInventorySections(deps) {
     }
     // Both farm container paths are tried when the host injects none, because
     // the path keys on the declared toolchain and this read carries none.
+    const farmLockFile = typeof deps.farmLockFile === "function" ? deps.farmLockFile(analysisId) : deps.farmLockFile;
     let lock = null;
-    for (const candidate of deps.farmLockFile ? [deps.farmLockFile] : DEFAULT_FARM_LOCK_FILES) {
+    for (const candidate of farmLockFile ? [farmLockFile] : DEFAULT_FARM_LOCK_FILES) {
         lock = readFarmLockFile(candidate).unwrapOr(null);
         if (lock !== null)
             break;
@@ -502,8 +503,8 @@ export function createListAvailablePackagesTool(deps = {}) {
                 return `${language} packages`;
             return "full package list";
         },
-        execute: async (input) => {
-            const read = await readInventorySections(deps);
+        execute: async (input, ctx) => {
+            const read = await readInventorySections(deps, ctx.session.scope.analysisId);
             // An unreadable inventory is an expected environment state — model it as an
             // `available: false` data variant telling the caller the set is UNKNOWN,
             // WITH the reason: without it, a structural fault (a damaged dependency

package/dist/tools/workspace/edit-file.d.ts

@@ -11,10 +11,11 @@
  * (compiled with the `gm` flags — multiline anchors), `new_string` may use
  * capture-group references, and exactly one of `replace_all=true` or
  * `expected_matches` gates the write. Provenance hashes the post-edit
- * content — recorded by the mutator.
+ * content — the mutator records it through the fold of this tool.
  */
+import { type WithToolCallRecord } from "../define-tool.js";
 import type { WorkspaceFilesystem } from "../../workspace/filesystem.js";
-import type { WorkspaceMutator, WriteFileResult } from "./mutator.js";
+import type { WorkspaceMutator, WriteFileResult, WriteRecord } from "./mutator.js";
 /** Outcome of an `edit_file` call — expected outcomes are data variants, never throws. */
 export type EditFileResult = {
     readonly status: "file_not_found";
@@ -43,14 +44,14 @@ export type EditFileResult = {
     readonly lines: readonly number[];
 } | Exclude<WriteFileResult, {
     status: "ok";
-}> | {
+}> | WithToolCallRecord<{
     readonly status: "ok";
     readonly path: string;
     readonly replacements: number;
     readonly bytesWritten: number;
     /** Regex mode only: 1-based line numbers where the matches started. */
     readonly lines?: readonly number[];
-};
+}, WriteRecord>;
 export interface EditFileDeps {
     readonly mutator: WorkspaceMutator;
     /** Read seam used to fetch current file content for search/replace. */

package/dist/tools/workspace/edit-file.js

@@ -11,11 +11,11 @@
  * (compiled with the `gm` flags — multiline anchors), `new_string` may use
  * capture-group references, and exactly one of `replace_all=true` or
  * `expected_matches` gates the write. Provenance hashes the post-edit
- * content — recorded by the mutator.
+ * content — the mutator records it through the fold of this tool.
  */
 import { ok } from "neverthrow";
 import { z } from "zod";
-import { defineTool } from "../define-tool.js";
+import { defineTool, withToolCallRecord } from "../define-tool.js";
 import { unwrapOrThrow } from "../../lib/result.js";
 const EditFileInputSchema = z.object({
     path: z
@@ -108,9 +108,6 @@ function replaceRegex(content, pattern, replacement, expected) {
 export function createEditFileTool(deps) {
     return defineTool({
         id: "edit_file",
-        // The mutator wraps the disk mutation in `ctx.runStep` itself, so the
-        // body runs unwrapped in the workflow body (see the harness-tools spec).
-        executionMode: "workflow",
         description: "Edit a file in your working directory by replacing specific text. " +
             "Read the file first to get the exact text. When replace_all is false " +
             "(default), old_string must occur exactly once. For a bulk pattern " +
@@ -166,24 +163,24 @@ export function createEditFileTool(deps) {
                     lines: replaced.lines,
                 });
             }
-            const result = await deps.mutator.writeFile({
+            const write = await deps.mutator.writeFile({
                 path,
                 content: replaced.content,
                 toolName: "edit_file",
                 invocationId: ctx.invocationId,
-                runStep: ctx.runStep,
                 session: ctx.session,
             });
-            if (result.status !== "ok")
-                return ok(result);
+            if (write.status !== "ok")
+                return ok(write);
             const lines = replaced.lines;
-            return ok({
+            return ok(withToolCallRecord({
                 status: "ok",
-                path: result.path,
+                path: write.path,
                 replacements: replaced.replacements,
-                bytesWritten: result.bytesWritten,
+                bytesWritten: write.bytesWritten,
                 ...(lines === undefined ? {} : { lines }),
-            });
+            }, write.record));
         },
+        foldCallRecord: (record) => deps.mutator.recordWrite(record),
     });
 }