@inixiative/foundry-core 0.4.0 → 0.5.0

package/src/feedback/correction.ts

@@ -0,0 +1,366 @@
+import { createHash } from 'node:crypto';
+
+// The Prospector's correction detection (moved from Oracle's session miner), shared by Oracle's
+// `oracle mine`, Foundry's live feedback capture and `foundry repeats`. Data and pure functions only:
+// callers bring the transcript turns and the model call.
+
+/** Why a message became a candidate, strongest first. */
+export type CorrectionSignal = 'repeat' | 'explicit' | 'interruption' | 'opener';
+
+/** One turn of a transcript, whatever harness wrote it. */
+export interface TranscriptTurn {
+  role: 'user' | 'assistant';
+  /** The harness's record id for the turn. */
+  id?: string;
+  /** ISO time, or '' when the record has none. */
+  timestamp: string;
+  /** What the person typed (user) or the agent's prose (assistant). */
+  text: string;
+  /** The person interrupted the agent just before this turn. */
+  interrupted?: boolean;
+  /** Where the turn sits in its source, e.g. `line:42`. */
+  sourceRef?: string;
+}
+
+export interface CorrectionEvent {
+  /** Stable identity: `<sessionId>:<messageId>`, or a content digest when the record has no id. */
+  readonly id: string;
+  readonly sessionId: string;
+  readonly messageId?: string;
+  readonly sourceRef?: string;
+  readonly timestamp: string;
+  /** What the agent said right before the correction ('' at the start of a session). */
+  readonly before: string;
+  /** The person's message. */
+  readonly correction: string;
+  /** The strongest signal, and every signal that fired. */
+  readonly signal: CorrectionSignal;
+  readonly signals: readonly CorrectionSignal[];
+  /** The matched phrase of the strongest pattern signal. */
+  readonly phrase?: string;
+  /** 0–1 rank among candidates. */
+  readonly score: number;
+}
+
+export interface CorrectionDetection {
+  hit: boolean;
+  signal?: CorrectionSignal;
+  signals: CorrectionSignal[];
+  phrase?: string;
+  score: number;
+}
+
+/** Data, so every caller filters with exactly these. Tuned on a 19.8k-message scan against an Opus read. */
+export const CORRECTION_PATTERNS: Readonly<
+  Record<Exclude<CorrectionSignal, 'interruption'>, RegExp>
+> = {
+  /** The person says this already failed. A bare "again" is handled by `AGAIN_CORRECTION`, not here. */
+  repeat:
+    /\b(?:i thought we|didn'?t we|did(?:n'?t| not) (?:i|we) (?:say|tell|ask|agree|decide)|i (?:already )?(?:told|asked) you|once and for all|how many times|(?:keeps?|kept) (?:doing|adding|making|asking|forgetting|happening)|i keep (?:saying|telling|having|asking)|same (?:mistake|lessons?)|as i said|like i said|we(?:'ve| have) (?:talked|been over|discussed|decided)|over and over|who keeps|still (?:seeing|doing|using|adding)|gentle reminder|reminder:)/i,
+  /** A standing instruction, a challenge, a reuse hint or a verdict on what the agent did. */
+  explicit:
+    /\b(?:from now on|going forward|in the future|always|never|remember (?:that|to|this)|make sure (?:you|to|that)|stop \w+ing|do not|don'?t (?:ever|make|add|do|use|ask|touch|create|build|write|need|be|put|bother)|please (?:don'?t|use|run|just)|you (?:should|shouldn'?t|need to|have to|must|can (?:just|always)|don'?t (?:need|have) to)|we (?:should(?:n'?t)?|don'?t|never|always)|should (?:just|not|never|always)|shouldn'?t|no need to|just (?:merge|use|do|call|fix|throw|delete|go|run|ship)|stop asking|why (?:would|did|are|do) (?:you|u)|why not just|why can'?t we just|get rid of|(?:is|are)n'?t needed|(?:does|do)n'?t make sense|i (?:really )?don'?t like|weird pattern|we (?:already )?have (?:a |an |the )?(?:native |existing |shared )?\w+(?: \w+)? (?:for|that|utils?|helpers?)|isn'?t there (?:already )?a|already (?:exists|have|has)|use (?:the )?(?:existing|internal|shared)|follow (?:what|how) \w+ (?:is doing|does)|are (?:you|u) assuming|did (?:you|u) (?:actually|read|check|test|run|verify)|i don'?t trust|have (?:you|u) (?:restarted|tested|run|checked|verified)|in both repos|backport|backprop|use (?:the )?logger)\b/i,
+  /** A message that opens by pushing back (the Prospector's corrective openers). */
+  opener:
+    /^\s*(?:no\b|no,|nope|don'?t|dont\b|stop\b|wait\b|wrong\b|not what|that'?s not|thats not|actually,?\s|instead\b|undo\b|revert\b|why (?:did|would|are|is|do) (?:you|u)|why not|what the (?:fuck|hell)|wtf|that'?s wrong|you'?re wrong|i said)/i,
+};
+
+/**
+ * "Again" marks a repeat only beside a negation or a challenge in the same sentence ("again, we
+ * shouldn't…", "not again"). Retries ("try it again", "run again") and filler don't count.
+ */
+export const AGAIN_CORRECTION = {
+  word: /\bagain\b/i,
+  retry:
+    /\b(?:try|run|do|check|show|send|ask|say|test|start|restart|look|read|load|open|build|deploy|push|pull|merge|call|post|go)(?: (?:it|that|this|them|me|the \w+))? again\b|^\W*again\W*$/i,
+  opening: /^\W*(?:no,?\s+)?again\s*[,:;—-]\s*\S/i,
+  context:
+    /\b(?:don'?t|do not|not|never|shouldn'?t|stop|why|wrong|told|said|no longer|keep|still|same|we'?re|you'?re|you)\b/i,
+} as const;
+
+/** What a signal says, most telling first: the `signal` a caller acts on (a repeat can block). */
+const MEANING: readonly CorrectionSignal[] = ['repeat', 'explicit', 'interruption', 'opener'];
+/** Measured precision per signal, for `score`: openers hold best, interruptions worst. */
+const WEIGHT: Record<CorrectionSignal, number> = {
+  opener: 0.8,
+  repeat: 0.7,
+  explicit: 0.6,
+  interruption: 0.5,
+};
+/** The agent ended on a question, so a bare "no" answers it rather than corrects it. */
+const ASKED = /\?\s*[)*`]*\s*$/;
+const INTERRUPTED = /^\s*\[Request interrupted by user/;
+const INTERRUPTED_MARKER = /^\s*\[Request interrupted by user[^\]]*\]\s*/;
+
+/** The person's own prose: pasted code, quotes and log lines are someone else's words. */
+export function proseOf(text: string): string {
+  return text
+    .replace(/```[\s\S]*?(?:```|$)/g, ' ')
+    .split('\n')
+    .filter(
+      (line) =>
+        !/^\s*>/.test(line) &&
+        !/^\s*(?:\[?\d{4}-\d{2}-\d{2}[T ]\d|\d{1,2}:\d{2}(?::\d{2})?\s|[\w.-]+:\d+(?::\d+)?\s)/.test(
+          line,
+        ),
+    )
+    .join('\n');
+}
+
+function againPhrase(prose: string): string | undefined {
+  for (const sentence of prose.split(/(?<=[.!?\n])\s+/)) {
+    if (!AGAIN_CORRECTION.word.test(sentence) || AGAIN_CORRECTION.retry.test(sentence)) continue;
+    // "Again, merge it yourself." opens with the marker: a repeat whatever follows.
+    if (AGAIN_CORRECTION.opening.test(sentence)) return 'again';
+    if (AGAIN_CORRECTION.context.test(sentence.replace(AGAIN_CORRECTION.word, ''))) return 'again';
+  }
+  return undefined;
+}
+
+export function detectCorrection(
+  text: string,
+  before = '',
+  options: { interrupted?: boolean } = {},
+): CorrectionDetection {
+  const prose = proseOf(text);
+  const found = new Map<CorrectionSignal, string | undefined>();
+  for (const signal of ['opener', 'repeat', 'explicit'] as const) {
+    const match = CORRECTION_PATTERNS[signal].exec(prose);
+    if (match) found.set(signal, match[0].trim());
+  }
+  const again = againPhrase(prose);
+  if (again && !found.has('repeat')) found.set('repeat', again);
+  if (options.interrupted) found.set('interruption', undefined);
+  const signals = MEANING.filter((signal) => found.has(signal));
+  const [strongest] = signals;
+  if (!strongest) return { hit: false, signals, score: 0 };
+  let score = Math.max(...signals.map((signal) => WEIGHT[signal])) + 0.1 * (signals.length - 1);
+  if (signals.length === 1 && strongest === 'opener' && ASKED.test(before)) score -= 0.4;
+  const phrase = found.get(strongest) ?? signals.map((signal) => found.get(signal)).find(Boolean);
+  return {
+    hit: true,
+    signal: strongest,
+    signals,
+    ...(phrase ? { phrase } : {}),
+    score: Math.round(Math.min(1, score) * 100) / 100,
+  };
+}
+
+export function correctionId(
+  sessionId: string,
+  event: Pick<CorrectionEvent, 'messageId' | 'timestamp' | 'before' | 'correction'>,
+): string {
+  if (event.messageId) return `${sessionId}:${event.messageId}`;
+  const digest = createHash('sha256')
+    .update(`${event.timestamp}\0${event.before}\0${event.correction}`)
+    .digest('hex')
+    .slice(0, 16);
+  return `${sessionId}:sha256-${digest}`;
+}
+
+/** Correction candidates in one session's turns, secrets scrubbed. */
+export function extractCorrections(
+  sessionId: string,
+  turns: Iterable<TranscriptTurn>,
+  options: { minScore?: number } = {},
+): { corrections: CorrectionEvent[]; secretsScrubbed: number } {
+  const minScore = options.minScore ?? 0;
+  const corrections: CorrectionEvent[] = [];
+  let before = '';
+  let pendingInterruption = false;
+  let secretsScrubbed = 0;
+  // An identical message resent within ten minutes is one correction, not a repeat.
+  const recent = new Map<string, number>();
+  for (const turn of turns) {
+    if (turn.role === 'assistant') {
+      if (turn.text.trim()) before = turn.text;
+      continue;
+    }
+    if (turn.interrupted || INTERRUPTED.test(turn.text)) pendingInterruption = true;
+    const text = turn.text.replace(INTERRUPTED_MARKER, '');
+    if (!text.trim()) continue;
+    const detection = detectCorrection(text, before, { interrupted: pendingInterruption });
+    pendingInterruption = false;
+    const key = text.toLowerCase().replace(/\s+/g, ' ').trim();
+    const at = Date.parse(turn.timestamp);
+    const sent = recent.get(key);
+    recent.set(key, at);
+    if (sent !== undefined && Number.isFinite(at) && at - sent < 600_000) continue;
+    if (!detection.hit || !detection.signal || detection.score < minScore) continue;
+    // Scrub before truncating, so a cut can't leave part of a secret unmatched.
+    const scrubbedBefore = scrubSecrets(before);
+    const scrubbedText = scrubSecrets(text.trim());
+    secretsScrubbed += scrubbedBefore.hits + scrubbedText.hits;
+    const event = {
+      ...(turn.id ? { messageId: turn.id } : {}),
+      ...(turn.sourceRef ? { sourceRef: turn.sourceRef } : {}),
+      timestamp: turn.timestamp,
+      before: scrubbedBefore.text.slice(-2000),
+      correction: scrubbedText.text.slice(0, 4000),
+      signal: detection.signal,
+      signals: detection.signals,
+      ...(detection.phrase ? { phrase: detection.phrase } : {}),
+      score: detection.score,
+    };
+    corrections.push({ id: correctionId(sessionId, event), sessionId, ...event });
+  }
+  return { corrections, secretsScrubbed };
+}
+
+const SECRET_PATTERNS: ReadonlyArray<readonly [RegExp, string]> = [
+  [/sk-ant-[A-Za-z0-9_-]{8,}/g, '[REDACTED:anthropic-key]'],
+  [/sk-[A-Za-z0-9_-]{20,}/g, '[REDACTED:api-key]'],
+  [/gh[pousr]_[A-Za-z0-9]{20,}/g, '[REDACTED:github-token]'],
+  [/github_pat_[A-Za-z0-9_]{20,}/g, '[REDACTED:github-token]'],
+  [/AIza[A-Za-z0-9_-]{30,}/g, '[REDACTED:google-key]'],
+  [/xox[baprs]-[A-Za-z0-9-]{10,}/g, '[REDACTED:slack-token]'],
+  [/AKIA[A-Z0-9]{16}/g, '[REDACTED:aws-key]'],
+  [
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+    '[REDACTED:private-key]',
+  ],
+  [/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g, '[REDACTED:jwt]'],
+  [/\b[a-z]+_(?:live|test|prod|runtime)_[A-Za-z0-9]{16,}/g, '[REDACTED:token]'],
+  [/\b(?:npm_|glpat-|hf_)[A-Za-z0-9_-]{20,}/g, '[REDACTED:token]'],
+  [/hooks\.slack\.com\/services\/[A-Za-z0-9/]+/g, '[REDACTED:slack-webhook]'],
+  [/\bASIA[A-Z0-9]{16}/g, '[REDACTED:aws-key]'],
+  [/\b(Bearer|Basic|DPoP)\s+[A-Za-z0-9._~+/=-]{16,}/g, '$1 [REDACTED:credential]'],
+  [/\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)[^\s@/]+@/gi, '$1[REDACTED:password]@'],
+  [
+    /\b([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD)[A-Z0-9_]*\s*[=:]\s*)["']?[^\s"']{8,}["']?/g,
+    '$1[REDACTED:value]',
+  ],
+  [
+    /(["']?)\b(password|passwd|api[_-]?key|secret|(?:access|auth|refresh)?[_-]?token)\1(\s*[:=]\s*)["']?[^\s"',}]{8,}["']?/gi,
+    '$1$2$1$3[REDACTED:value]',
+  ],
+];
+
+/** Replace credential-shaped substrings. Transcripts are exactly where leaked keys live. */
+export function scrubSecrets(text: string): { text: string; hits: number } {
+  let hits = 0;
+  let out = text;
+  for (const [pattern, replacement] of SECRET_PATTERNS)
+    out = out.replace(pattern, (...match: unknown[]) => {
+      hits++;
+      return replacement.replace(/\$(\d)/g, (_, group: string) => {
+        const value = match[Number(group)];
+        return typeof value === 'string' ? value : '';
+      });
+    });
+  return { text: out, hits };
+}
+
+/** FEEDBACK-LOG's tags plus process: the closed list feedback items and repeat rules are tagged with. */
+export const FEEDBACK_TAGS = [
+  'hygiene',
+  'naming',
+  'merge',
+  'reuse',
+  'overbuild',
+  'architecture',
+  'data',
+  'product',
+  'coordination',
+  'communication',
+  'tooling',
+  'security',
+  'process',
+] as const;
+export type FeedbackTag = (typeof FEEDBACK_TAGS)[number];
+
+export const CORRECTION_CATEGORIES = ['approach', 'scope', 'convention', 'fact', 'other'] as const;
+export type CorrectionCategory = (typeof CORRECTION_CATEGORIES)[number];
+
+export interface CorrectionClassification {
+  isCorrection: boolean;
+  category: CorrectionCategory;
+  /** Imperative rules, each at most 160 characters and saying when it applies; empty when none. */
+  statements: string[];
+  /** False when it is a correction but no crisp rule can be stated. */
+  sharp: boolean;
+}
+
+export const CORRECTION_CLASSIFY_PROMPT = `You classify messages a person typed to an AI coding agent. Each message comes with the agent's previous message, and each is judged on its own.
+
+A CORRECTION is feedback about how the agent works: the person redirects, fixes or rejects what the agent did, or states a rule or preference the agent should keep following beyond this task. These are NOT corrections: a new task or question, an answer to the agent's question, approving or reviewing one specific item, design discussion, status chatter.
+
+For a correction, write each rule it carries as a statement: one imperative sentence of at most 160 characters that says when it applies ("When X, do Y." or "Never X."), general enough to hold next time, in plain words without quoting the message. At most three statements per message. Use names (products, tools, terms) only when the rule is about them.
+
+Respond with JSON only, one result per message id:
+{ "results": { "<id>": { "isCorrection": boolean, "category": "approach" | "scope" | "convention" | "fact" | "other", "statements": string[], "sharp": boolean } } }
+category: approach = how to do the work; scope = what to do or not do; convention = naming, style, process or tooling rules; fact = something about the world or the codebase the agent got wrong; other = anything else.
+sharp: false when it is a correction but no crisp rule can be stated; then statements is empty.`;
+
+/** The stable start of every classify input: providers that prime a session reuse it (`stablePrefix`). */
+export const CORRECTION_CLASSIFY_PREFIX = 'Classify each message below.\n\n';
+
+/** The messages every caller sends for a batch of candidates (one is a batch of one). Ids are M1..Mn. */
+export function correctionClassifyMessages(
+  events: readonly Pick<CorrectionEvent, 'before' | 'correction'>[],
+  limits: { before?: number; correction?: number } = {},
+): { role: 'system' | 'user'; content: string }[] {
+  const before = limits.before ?? 1200;
+  const correction = limits.correction ?? 3000;
+  const body = events
+    .map(
+      (event, index) =>
+        `## M${index + 1}\n### Agent's prior message\n${event.before.slice(-before) || '(start of session)'}\n\n### Person's message\n${event.correction.slice(0, correction)}`,
+    )
+    .join('\n\n');
+  return [
+    { role: 'system', content: CORRECTION_CLASSIFY_PROMPT },
+    { role: 'user', content: `${CORRECTION_CLASSIFY_PREFIX}${body}` },
+  ];
+}
+
+function classification(value: unknown): CorrectionClassification | undefined {
+  if (!value || typeof value !== 'object') return undefined;
+  const item = value as Record<string, unknown>;
+  if (typeof item.isCorrection !== 'boolean') return undefined;
+  const category = CORRECTION_CATEGORIES.find((entry) => entry === item.category) ?? 'other';
+  const statements = Array.isArray(item.statements)
+    ? item.statements
+        .filter((entry): entry is string => typeof entry === 'string' && entry.trim().length > 0)
+        .map((entry) => entry.trim().slice(0, 160))
+        .slice(0, 3)
+    : [];
+  if (!item.isCorrection) return { isCorrection: false, category, statements: [], sharp: false };
+  const sharp = item.sharp !== false && statements.length > 0;
+  return { isCorrection: true, category, statements: sharp ? statements : [], sharp };
+}
+
+/** The first balanced `{...}` in a model answer, so prose or braces after it don't break parsing. */
+function firstJsonObject(content: string): string | undefined {
+  const start = content.indexOf('{');
+  if (start < 0) return undefined;
+  let depth = 0;
+  let quoted = false;
+  for (let i = start; i < content.length; i++) {
+    const char = content[i];
+    if (quoted) {
+      if (char === '\\') i++;
+      else if (char === '"') quoted = false;
+    } else if (char === '"') quoted = true;
+    else if (char === '{') depth++;
+    else if (char === '}' && --depth === 0) return content.slice(start, i + 1);
+  }
+  return undefined;
+}
+
+/** One answer per message of the batch, in order; undefined where the answer is missing or malformed. */
+export function parseCorrectionClassifications(
+  content: string,
+  count: number,
+): (CorrectionClassification | undefined)[] {
+  let raw: unknown;
+  try {
+    raw = JSON.parse(firstJsonObject(content) ?? '');
+  } catch {
+    return Array.from({ length: count }, () => undefined);
+  }
+  const results =
+    raw && typeof raw === 'object' ? (raw as { results?: unknown }).results : undefined;
+  const byId = results && typeof results === 'object' ? (results as Record<string, unknown>) : {};
+  return Array.from({ length: count }, (_, index) => classification(byId[`M${index + 1}`]));
+}

package/src/harness.ts

@@ -137,6 +137,13 @@ interface SendOptions {
   onDelta?: (text: string) => void;
   /** Final trace for this attempt, independent of the bounded history cache. */
   onTrace?: (trace: Trace) => void;
+  /**
+   * The executor has prepared its input after every middleware ran and is handing it to its
+   * provider. Fires once per message, before any provider call.
+   */
+  onExecutorInput?: () => void;
+  /** The payload the execute stage's agent receives instead of `message.payload` (see DispatchOptions.agentPayload). */
+  executorPayload?: unknown;
 }
 
 /**
@@ -480,6 +487,7 @@ export class Harness {
     const requestedAgents = new Set<string>();
     const requestedLayers = new Set<string>();
     const stageResults = new Map<string, ExecutionResult>();
+    let executorInput = false;
 
     let classification: Decision<Classification> | undefined;
     let route: Decision<Route> | undefined;
@@ -655,11 +663,19 @@ export class Harness {
         // classifier/router/enricher output isn't user-visible content.
         const result = await this.thread.dispatch(agentId, stagePayload, layerFilter, {
           onDelta: stage.role === 'execute' ? opts?.onDelta : undefined,
+          requestLayer: (layerId) => requestedLayers.add(layerId),
           role: stage.role,
           messageId: message.id,
           invocation: stage.invocation,
+          ...(stage.role === 'execute' && opts?.executorPayload !== undefined
+            ? { agentPayload: opts.executorPayload }
+            : {}),
           recordInjection: (artifact) => {
             stageSpan.annotations.injection = artifact;
+            if (stage.role === 'execute' && !executorInput) {
+              executorInput = true;
+              opts?.onExecutorInput?.();
+            }
           },
           nativeObservation: opts?.nativeObservation,
           recordNative: (evidence) => {

package/src/index.ts

@@ -33,7 +33,45 @@ export {
   validateMemorySelection,
 } from './adapters/file-memory';
 export { HttpMemory } from './adapters/http-memory';
-export { claudemdSource, MarkdownDocs } from './adapters/markdown-docs';
+export {
+  claudemdSource,
+  formatInstructionFiles,
+  type InstructionFile,
+  type InstructionReadOptions,
+  instructionImports,
+  MarkdownDocs,
+  readInstructionFile,
+  resolveInstructionImport,
+  secretInstructionPath,
+  stripInstructionComments,
+  withinAny,
+  withinPath,
+} from './adapters/markdown-docs';
+export {
+  dedupeHierarchy,
+  dedupeHierarchySlots,
+  discoverHierarchy,
+  expandHierarchyPath,
+  type HierarchyDedupeOptions,
+  type HierarchyDiscoverOptions,
+  type HierarchyDuplicate,
+  type HierarchyDuplicateKind,
+  type HierarchyFile,
+  type HierarchyFileSource,
+  type HierarchyLocation,
+  type HierarchyMatch,
+  type HierarchyNode,
+  type HierarchyRefusal,
+  type HierarchySlotDuplicate,
+  type HierarchySource,
+  type HierarchySpan,
+  type HierarchyStack,
+  type HierarchyWalkSource,
+  hierarchyFingerprint,
+  markdownSections,
+  type SelectedHierarchyNode,
+  selectHierarchyNodes,
+} from './adapters/markdown-hierarchy';
 export { type SqliteEntry, SqliteMemory } from './adapters/sqlite-memory';
 // Agent primitives
 export {
@@ -60,6 +98,7 @@ export {
   type GateContext,
   type PermissionLevel,
   type PermissionPolicy,
+  permissionLevel,
   RESTRICTED_POLICY,
 } from './capability';
 export {
@@ -122,6 +161,29 @@ export {
 // Observability
 export { EventStream, type SessionEvent, type StreamEvent } from './event-stream';
 export { type ExecuteHandler, type ExecuteMeta, Executor, type ExecutorConfig } from './executor';
+// Feedback: correction detection (the Prospector's), shared by Oracle, live capture and `foundry repeats`
+export {
+  AGAIN_CORRECTION,
+  CORRECTION_CATEGORIES,
+  CORRECTION_CLASSIFY_PREFIX,
+  CORRECTION_CLASSIFY_PROMPT,
+  CORRECTION_PATTERNS,
+  type CorrectionCategory,
+  type CorrectionClassification,
+  type CorrectionDetection,
+  type CorrectionEvent,
+  type CorrectionSignal,
+  correctionClassifyMessages,
+  correctionId,
+  detectCorrection,
+  extractCorrections,
+  FEEDBACK_TAGS,
+  type FeedbackTag,
+  parseCorrectionClassifications,
+  proseOf,
+  scrubSecrets,
+  type TranscriptTurn,
+} from './feedback/correction';
 export {
   type FlowConfig,
   type FlowStage,
@@ -132,7 +194,6 @@ export {
   type PipelineStep,
   type RequestContext,
 } from './harness';
-
 // Lifecycle Hooks (registry only — built-in hooks in @inixiative/foundry)
 export {
   type HookContext,
@@ -205,20 +266,23 @@ export {
   type RuntimeKind,
   registryModel,
   resolveDecisionModel,
+  SUBSCRIPTION_DECISION_MODELS,
 } from './model-registry';
 export * from './native-evidence';
-// Permission middleware
-export {
-  type PermissionCheck,
-  type PermissionCheckResult,
-  type PermissionMiddlewareConfig,
-  permissionMiddleware,
-} from './permission-middleware';
 // Retry middleware
 export { type RetryConfig, retryMiddleware } from './retry';
 export { type Route, type RouteHandler, Router, type RouterConfig } from './router';
 // Ownership scope — which thread/project owns a source read or tool call
 export { normalizeScope, type OwnershipScope } from './scope';
+export {
+  type DeliveredPart,
+  layerPart,
+  type SessionDelivery,
+  type SessionDeliveryReport,
+  type StandingPart,
+  standingPart,
+  standingParts,
+} from './session-delivery';
 // Signals
 export { type Signal, SignalBus, type SignalHandler, type SignalKind } from './signal';
 // Orchestration

package/src/messages.ts

@@ -96,7 +96,7 @@ export interface DeliveryRecord {
     readonly assessedHash?: string;
     /** Owner revision the decorator assessed, for owner-versioned layers. */
     readonly assessedRevision?: number;
-    /** Hash the executor assembled and sent. */
+    /** Hash the executor assembled; a session provider sends only what `session` lists. */
     readonly deliveredHash: string;
     /** Owner revision of the bytes actually assembled, from the layer's own version mark at assembly. */
     readonly deliveredRevision?: number;
@@ -110,6 +110,8 @@ export interface DeliveryRecord {
   }>;
   /** Layer ids committed to the delivery ledger. */
   readonly committed: string[];
+  /** What a session provider delivered (its base context and this turn's sent parts), when one ran. */
+  readonly session?: import('./session-delivery').SessionDeliveryReport;
   /**
    * How the turn treated learning still pending from earlier work:
    * `pending` means preparation continued immediately with committed knowledge.
@@ -143,6 +145,10 @@ export interface InjectionArtifact {
   readonly executorContext?: string;
   /** Initial provider messages, before native-runtime wrapping or tool followups. */
   readonly providerMessages?: LLMMessage[];
+  /** What a session provider delivered: its system prompt parts and the parts sent with this turn. */
+  readonly sessionDelivery?: import('./session-delivery').SessionDeliveryReport;
+  /** Every standing part the executor assembled (layer with its prompt), by id and hash. */
+  readonly standingParts?: Array<import('./session-delivery').DeliveredPart>;
   readonly layers?: Array<
     LayerInstanceState & {
       id: string;

package/src/middleware.ts

@@ -18,6 +18,11 @@ export interface DispatchContext<TPayload = unknown> {
   readonly messageId?: string;
   /** Identity of this dispatch; tool observations for it carry the same id. */
   readonly dispatchId?: string;
+  /**
+   * Include an on-demand layer in this dispatch's context (the routing plan asked for it). Present
+   * when a Harness stage dispatched it; layers of other activation modes are unaffected.
+   */
+  readonly requestLayer?: (layerId: string) => void;
 }
 
 export interface DispatchOutcome<TResult = unknown> {

package/src/model-registry.ts

@@ -225,11 +225,17 @@ export interface ModelSweepOption {
 export const MODEL_REGISTRY_UPDATED_AT = '2026-09-24';
 
 /**
- * Decision default: the cheapest current model tagged `judgment`. Held here
- * rather than in an adapter so one map answers "what runs decisions".
+ * Decision default: Claude Haiku 5.5, the cheapest current Claude model tagged `judgment`. Held here
+ * rather than in an adapter so one map answers "what runs decisions". DECISION_PROVIDER is the
+ * API-token path; subscription decisions pick their model per runtime from SUBSCRIPTION_DECISION_MODELS.
  */
-export const DECISION_PROVIDER = 'openai';
-export const DECISION_MODEL = 'gpt-6-luna';
+export const DECISION_PROVIDER = 'anthropic';
+export const DECISION_MODEL = 'claude-haiku-5-5';
+/** Subscription decision default per native runtime; settings choose the runtime. */
+export const SUBSCRIPTION_DECISION_MODELS = {
+  claude: DECISION_MODEL,
+  codex: 'gpt-6-luna',
+} as const;
 
 /** Tag rule: every model judges. Cheap models review and route; capable models execute and advise. */
 const FAST = ['judgment', 'learning-review', 'tool-use'] as ModelCapability[];
@@ -270,7 +276,7 @@ export const MODEL_REGISTRY: Record<string, FoundryProviderInfo> = {
       },
       {
         id: 'opus',
-        label: 'Opus 5',
+        label: 'Opus 5.5',
         tier: 'powerful',
         costTier: 'high',
         contextWindow: 1_000_000,
@@ -278,10 +284,11 @@ export const MODEL_REGISTRY: Record<string, FoundryProviderInfo> = {
         nativeAlias: true,
         capabilities: POWERFUL_REASONING,
         reasoning: CLAUDE_REASONING,
+        notes: 'Claude Code alias for claude-opus-5-5.',
       },
       {
         id: 'sonnet',
-        label: 'Sonnet 5',
+        label: 'Sonnet 5.5',
         tier: 'standard',
         costTier: 'medium',
         contextWindow: 1_000_000,
@@ -289,6 +296,39 @@ export const MODEL_REGISTRY: Record<string, FoundryProviderInfo> = {
         nativeAlias: true,
         capabilities: STANDARD_REASONING,
         reasoning: CLAUDE_REASONING,
+        notes: 'Claude Code alias for claude-sonnet-5-5.',
+      },
+      {
+        id: 'claude-haiku-5-5',
+        label: 'Haiku 5.5',
+        tier: 'fast',
+        costTier: 'low',
+        contextWindow: 1_000_000,
+        runtimeKind: 'native-harness',
+        capabilities: FAST_REASONING,
+        reasoning: { ...CLAUDE_REASONING, efforts: ['low', 'medium', 'high'] },
+        notes: "Foundry's decision model; the CLI reports this id as the served model.",
+      },
+      {
+        id: 'claude-opus-5-5',
+        label: 'Opus 5.5',
+        tier: 'powerful',
+        costTier: 'high',
+        contextWindow: 1_000_000,
+        runtimeKind: 'native-harness',
+        capabilities: POWERFUL_REASONING,
+        reasoning: CLAUDE_REASONING,
+      },
+      {
+        id: 'claude-fable-5-1',
+        label: 'Fable 5.1',
+        tier: 'powerful',
+        costTier: 'high',
+        contextWindow: 1_000_000,
+        maxOutputTokens: 128_000,
+        runtimeKind: 'native-harness',
+        capabilities: POWERFUL_REASONING,
+        reasoning: CLAUDE_REASONING,
       },
       {
         id: 'haiku',
@@ -325,6 +365,17 @@ export const MODEL_REGISTRY: Record<string, FoundryProviderInfo> = {
         reasoning: CLAUDE_REASONING,
         notes: 'Thinking is always on; steer with effort.',
       },
+      {
+        id: 'claude-opus-5-5',
+        label: 'Claude Opus 5.5',
+        tier: 'powerful',
+        costTier: 'high',
+        contextWindow: 1_000_000,
+        maxOutputTokens: 128_000,
+        runtimeKind: 'api',
+        capabilities: POWERFUL_REASONING,
+        reasoning: CLAUDE_REASONING,
+      },
       {
         id: 'claude-opus-5',
         label: 'Claude Opus 5',