@modelprofile.com/flexharness 5.4.0 → 6.1.0

package/.smartconfig.json

@@ -1,34 +0,0 @@
-{
-  "@git.zone/cli": {
-    "schemaVersion": 2,
-    "projectType": "npm",
-    "module": {
-      "githost": "code.foss.global",
-      "gitscope": "modelprofile.com",
-      "gitrepo": "flexharness",
-      "description": "Provider-neutral model-session runtime with durable history, permissions, typed events, and pluggable local or remote tool execution.",
-      "npmPackagename": "@modelprofile.com/flexharness",
-      "license": "MIT",
-      "projectDomain": "modelprofile.com"
-    },
-    "release": {
-      "targets": {
-        "git": {
-          "enabled": true,
-          "remote": "origin",
-          "pushBranch": true,
-          "pushTags": true
-        },
-        "npm": {
-          "enabled": true,
-          "registries": [
-            "https://verdaccio.lossless.digital",
-            "https://registry.npmjs.org"
-          ],
-          "accessLevel": "public",
-          "alreadyPublished": "success"
-        }
-      }
-    }
-  }
-}

package/changelog.md

@@ -1,273 +0,0 @@
-# Changelog
-
-## 2026-09-02 - 5.4.0
-
-### Features
-
-- add configurable reversion maintenance timeout (reversion)
-  - Add a top-level reversionMaintenanceTimeoutMs harness option with bounded positive safe-integer validation up to 30 minutes.
-  - Use the new timeout for turn-reversion inspection, recovery, finalization, and release maintenance signals before falling back to the legacy generation lease cleanup timeout and 30 second default.
-  - Update documentation and tests for the new timeout behavior and refreshed dependency expectations.
-
-## 2026-09-01 - 5.3.3
-
-### Fixes
-
-- use provider-compatible object schemas for project tools (project-management)
-  - Flatten task, goal, and scratchpad schemas to object roots without union combinators while preserving action-specific validation.
-  - Reject invalid project tool action shapes before state mutation.
-  - Preserve valid empty scratchpad set and append operations.
-
-## 2026-08-31 - 5.3.2
-
-### Fixes
-
-- allow delegate taskId to remain optional (subagents)
-  - Set the delegate tool definition to non-strict so new child creation can omit taskId.
-  - Add coverage for delegate schema required fields and invalid taskId inputs without acquiring delegated run admission.
-
-## 2026-08-30 - 5.3.1
-
-### Fixes
-
-- complete delegated child provenance for host authorization (subagents)
-  - Expose immutable creation origin separately from the current parent delegate invocation and include the reserved child ID in subagent.start permission metadata.
-  - Carry atomic parent generation, origin, agent, and actual-depth provenance through the optional third `load` and fifth `tombstoneSession` project-management context arguments.
-  - Persist that provenance in new child cleanup tombstones; older strict schema-1 readers reject the new key, so rollback or mixed-version readers are unsupported after such a snapshot is written.
-
-## 2026-08-30 - 5.3.0
-
-### Features
-
-- add delegated child-run admission leases (subagents)
-  - Add a frozen exact child/current-parent admission context and an optional delegatedRunAdmissionProvider for internally delegated runs.
-  - Acquire before generation-side reversion, compaction, model, tool, and resource callbacks, while retaining generation-scoped ownership through terminal reversion finalization.
-  - Close before canonical acceptance or failed/cancelled finalization, preserve abort progress across late acquisition, and retry failed idempotent closes during exact deletion, retirement, or disposal.
-  - Explain new-child versus later-run resume semantics in the model-visible delegate schema and return safe corrective feedback for unknown task IDs.
-
-## 2026-08-26 - 5.2.0
-
-### Features
-
-- add generation-fenced session cohort deletion (session-generation)
-  - Add deleteSessionGenerationCohort with strict root and authorized cohort validation.
-  - Allow createSession callers to provide a validated sessionGenerationId while preserving harness-assigned sequences.
-  - Propagate session generation metadata through model resolver contexts, permission requests, and emitted events.
-
-## 2026-08-26 - 5.1.0
-
-### Features
-
-- expose session generation in host-operation callback contexts (harness)
-  - Add sessionGenerationId and sessionGenerationSequence to tool-provider, resource-resolver, slash-command handler, and turn-reversion contexts.
-  - Propagate session generation through reversion recovery and deleted-session tombstone cleanup.
-  - Document generation-aware callback contexts and add coverage for providers, slash commands, and reversion cleanup.
-
-## 2026-08-21 - 5.0.0
-
-### Breaking Changes
-
-- stream exact text and reasoning part deltas (events)
-  - Replace cumulative part.delta payloads with exact untruncated deltas and incremental UTF-8 byte coordinates.
-  - Separate snapshot and delta event interfaces under TFlexPartEvent and remove IFlexPartChangedEvent.
-  - Emit empty part.started snapshots before the first text or reasoning delta.
-
-## 2026-08-21 - 4.1.2
-
-### Fixes
-
-- emit immediate snapshots for streamed tool outputs (tool-streaming)
-  - Bump @push.rocks/smartagent to ^5.0.1.
-  - Verify each distinct async-iterable tool output emits a bounded running part.updated snapshot, including the final yielded value.
-  - Update documentation for transient streamed tool output behavior.
-
-## 2026-08-16 - 4.1.1
-
-### Fixes
-
-- extract harness boundary utilities (harness)
-  - Move option normalization, validation, transfer bounds, tool output normalization, and store codecs into dedicated internal modules.
-  - Centralize reserved slash-command name policy and reusable store codec helpers.
-  - Update package manager metadata to pnpm 11.22.0.
-
-## 2026-08-15 - 4.1.0
-
-### Features
-
-- stream transient tool output through cumulative part updates (events)
-  - Upgrade to SmartAgent 5 and project preliminary tool outputs as bounded immutable `part.updated` snapshots without per-update projection writes.
-  - Preserve JSON normalization for direct, promise-resolved, and callable async iterables while keeping terminal output authoritative and removing previews on failure or cancellation.
-  - Document the transient output boundary and cover update ordering, bounds, callback overflow, and final-output replacement.
-
-### Fixes
-
-- remove duplicate transient output release note (changelog)
-  - Remove the repeated transient tool output changelog entry.
-
-## 2026-08-14 - 4.0.2
-
-### Fixes
-
-- pass session generation to project management store loads (project-management)
-  - Expose IFlexSessionGeneration and add it as an optional third argument to IFlexProjectManagementStore.load.
-  - Supply a frozen current generation when FlexHarness loads project management records for state reloads and tombstone cleanup.
-  - Document and test compatibility with existing two-argument callers and stores.
-
-## 2026-08-14 - 4.0.1
-
-### Fixes
-
-- preserve large controller scratchpads in project-management state (project-management)
-  - Increase the project scratchpad limit to 128 KiB and the serialized snapshot limit to 1 MiB so worst-case JSON escaping remains valid.
-  - Add coverage for maximum UTF-8 and escaped scratchpad payloads.
-
-## 2026-08-14 - 4.0.0
-
-### Breaking Changes
-
-- rename the foreground subagent tool and add opt-in project-management tools (harness)
-  - Rename the foreground subagent wire tool from `task` to `delegate` while retaining durable `taskId` input/output and child-session persistence semantics.
-  - Add configurable `task`, `goal`, `scratchpad`, and `rename_session` built-ins backed by strict session-local CAS state, public controller APIs, attribution context, and durable deletion fencing.
-  - Require `IFlexHarnessStores.projectManagement` independently of tool enablement, with generation-aware CAS tombstones and explicit whole-namespace purge.
-  - Add random durable session generation identity, deterministic legacy backfill, and monotonic generation sequencing so explicit session IDs can be safely reused without stale writes.
-  - Reserve built-in names only while enabled and reject collisions from application and resource providers before model execution.
-  - Bound existing `createSession()` and `updateSession()` title inputs to 2048 UTF-8 bytes.
-
-## 2026-08-14 - 3.8.0
-
-### Features
-
-- add workspace-required turn reversion (harness)
-  - Add a versioned provider contract for revertible, no-change, and nonrevertible workspace outcomes with bounded affected-workspace metadata.
-  - Add workspace-required history grouping, nonrevertible barriers, and public reversion information while preserving the existing transcript-optional policy.
-  - Upgrade projection persistence to schema version 3 with version 1 and 2 loading, durable cleanup ownership, and crash-safe apply and deletion recovery.
-
-## 2026-08-13 - 3.7.0
-
-### Features
-
-- add native slash commands and turn reversion (harness)
-  - Add built-in, template, and typed-handler slash commands with authoritative parsing, availability, execution, and literal unknown-command fallback.
-  - Add durable grouped undo and redo with optional workspace capture, crash recovery, branch commitment, release ownership, and archival horizons.
-  - Upgrade projection persistence to schema version 2 while preserving version 1 loading, and document the public command and reversion contracts.
-
-## 2026-08-13 - 3.6.0
-
-### Features
-
-- compose run-scoped resource tool providers (harness)
-  - Resolve fresh resource providers per run while preserving the existing application tool provider.
-  - Expose deterministic bounded tool namespaces and bind permissions to non-spoofable resource revision identity.
-  - Reject duplicate resources, namespaces, and exposed tools before execution, with complete retryable cleanup across failure, cancellation, retirement, and disposal.
-
-## 2026-08-13 - 3.5.0
-
-### Features
-
-- add first-class foreground subagent sessions (harness)
-  - Expose bounded configured subagents through a reserved permission-gated `task` tool with durable child sessions and later-run resume by `taskId`.
-  - Project child session and model metadata through cumulative `part.updated` events while preserving the terminal tool result.
-  - Validate persisted parent, origin, agent, depth, and tombstone relationships without changing the existing snapshot schema version.
-  - Cancel and delete complete session subtrees child-first with retryable cleanup ownership, exact alias contexts, and deadlock-safe namespace fencing.
-
-## 2026-08-13 - 3.4.0
-
-### Features
-
-- provide exact invocation context to session compactors (harness)
-  - Add resolved scope, storage namespace, and session identity to the existing compactor options.
-  - Keep storage-key aliases isolated across manual, retention, context-overflow, scheduled-cancellation, lifecycle, restoration, and autonomous job-event compaction.
-  - Emit one terminal part event for each callback-backed streamed text part before run completion.
-  - Document the projected inputs and no-event compaction case, with shared-storage regression coverage.
-
-## 2026-08-11 - 3.3.0
-
-### Features
-
-- allow title updates throughout the session lifecycle (sessions)
-  - Permit title-only updates while prompts are queued or running, while permission is pending, and after archival.
-  - Keep archive-bearing requests blocked and atomic while a session has outstanding work.
-  - Document the mutation boundary and cover active, queued, permission-waiting, archived, and post-run states.
-
-## 2026-08-11 - 3.2.0
-
-### Features
-
-- add bounded prompt queue APIs (harness)
-  - Introduce enqueuePrompt(), queue entry inspection, cancellation, and prompt queue events for FIFO session admission.
-  - Extend scheduled prompts to share queue ownership with stable schedule keys and cancellable queued work.
-  - Enforce pending admission, outstanding prompt, byte, and terminal retention limits while clearing private queue payloads at settlement.
-  - Document queue lifecycle behavior and add coverage for cancellation, disposal, retirement, limits, and immutable queued inputs.
-
-## 2026-08-11 - 3.1.0
-
-### Features
-
-- expose authoritative source coordinates on part events (events)
-  - Add zero-based message and part indexes to started, delta, and completed part events.
-  - Keep coordinates stable for every update to a part and across later runs.
-
-## 2026-08-09 - 3.0.1
-
-### Fixes
-
-- repair crash-interrupted legacy runs during migration (migration)
-  - Mark running or waiting legacy sessions idle before writing migrated snapshots
-  - Cancel interrupted streaming messages and running tool or reasoning parts with deterministic recovery timestamps
-  - Document crash-interrupted migration repair and cover deterministic reruns with tests
-
-## 2026-08-09 - 3.0.0
-
-### Breaking Changes
-
-- migrate runtime to AgentSession-backed split stores (harness)
-  - Replaces the single legacy store and runner integration with domain-specific stores for scopes, projections, permissions, Agent events, and tool jobs.
-  - Adds scheduled prompts, runtime event APIs, uncertain tool-execution reconciliation, session compaction/archive support, and background execution controls.
-  - Introduces durable staged terminal recovery, session tombstones, retryable cleanup ownership, commit-uncertain store errors, and JSON store fsync/disposal handling.
-  - Adds a 2.x legacy snapshot migration export and updates documentation and tests for the 3.x persistence model.
-
-## 2026-08-08 - 2.1.0
-
-### Features
-
-- add storage namespace retirement (harness)
-  - Add retireScope() to stop runtime ownership for resolved storage namespaces without deleting durable snapshots.
-  - Fence stale scope resolution and late admissions while draining in-flight persistence, permissions, active runs, and tool cleanup.
-  - Coalesce retirement and disposal drains by storage namespace and preserve isolated cleanup error reporting.
-  - Document retirement behavior and add lifecycle/resolver tests for concurrency and cleanup paths.
-
-## 2026-08-07 - 2.0.0
-
-### Breaking Changes
-
-- project external run errors and add durable prompt/message APIs (harness)
-  - Convert untrusted resolver, runner, tool, cleanup, callback, and run-persistence failures to FlexHarnessExternalError before exposing them through completions, audit data, events, or disposal.
-  - Add externalErrorProjector support for application-approved external error projection.
-  - Add startPrompt() admission semantics plus cursor-based message paging and exact message lookup APIs.
-  - Add optional resolved model variant metadata and validate it in persisted/public message data.
-  - Harden permission rollback so failed persistence cannot leave remembered grants reusable.
-
-## 2026-08-05 - 1.0.1
-
-### Fixes
-
-- publish JSON Schema typings required by public model types (deps)
-  - Move @types/json-schema from devDependencies to dependencies so downstream consumers can resolve exported declaration types.
-
-## 2026-08-05 - 1.0.0
-
-### Breaking Changes
-
-- Establish the initial 1.0 public API for provider-neutral model sessions.
-- Persist successful-only private model history while keeping failed and cancelled prompts audit-visible.
-- Redact attachment payloads from public messages and events, exposing metadata only.
-- Add revisioned transactional stores, session-scoped permissions, typed immutable events, and explicit lifecycle cleanup.
-- Add minimal session title, archive, and deletion mutations with active-run safety.
-- Coordinate resolver failure without hanging on an unresponsive sibling and close detached late tool handles.
-- Coalesce model callbacks in a bounded run-local buffer instead of persisting every delta.
-- Distinguish owner cancellation from internal failure and require successful tool cleanup before appending history.
-- Terminalize in-memory audit state and emit terminal events once when final persistence fails.
-- Enforce JSON output byte limits incrementally while traversing large values.
-- Linearize cancellation at terminal persistence and keep disposal waiting for committing runs.
-- Serialize permission checks behind persistence so uncommitted remembered grants are never observable.
-- Track detached tool-provider cleanup through disposal and report late close failures.

package/readme.hints.md

@@ -1,71 +0,0 @@
-# readme.hints.md
-
-Implementation findings for flexharness.
-
-## Internal module boundaries
-
-- `classes.flexharness.ts` owns stateful coordination: admission, queues, canonical finalization, permissions, reversion, persistence reconciliation, resource cleanup, retirement, and disposal. Stateless boundary policy must not be added back to this class.
-- Constructor policy belongs in `utils.harnessoptions.ts`; reusable public-input checks belong in `utils.validation.ts`; public projection and transfer bounds belong in `utils.transfer.ts`; tool-result normalization belongs in `utils.tooloutput.ts`.
-- Store adapters remain in `classes.stores.ts`, while strict Agent-event and Tool-job codecs belong in `utils.storecodecs.ts`. Store codecs do not own CAS, queue, filesystem, or provider lifecycle behavior.
-- Internal utility modules are implementation details and are not re-exported from `index.ts`. Shared policy such as reserved slash-command names and subagent name bounds has one owner and is imported by every caller.
-
-## SmartAgent boundary
-
-- SmartAgent is the canonical private conversation and execution runtime. FlexHarness creates one transactional `AgentSession` per public session and derives its public model, prompt, provider-option, tool-set, and result aliases from SmartAgent exports.
-- Non-empty SmartAgent text and reasoning callback deltas cross the public event boundary immediately and exactly once. Delta events never carry a cumulative part and are not subject to snapshot text truncation.
-- Public prompts remain JSON-safe. URL strings are converted to `URL` instances only at the private SmartAgent invocation boundary.
-- Prompt attachment payloads exist only in canonical private Agent events. Public messages, prompt results, projection snapshots, and events expose only `attachmentType`, source kind, optional media/name, and decoded size when determinable.
-- Resolver calls start in promise continuations so synchronous throws are observed. The first failure aborts the shared internal signal without awaiting an ignoring sibling; detached tool-provider settlement is observed and late handles are closed.
-- Resource tool composition resolves descriptors per run before provider acquisition, validates duplicate resources and derived namespaces as one set, preserves legacy tool names, and derives bounded resource names from canonical resource/revision and original-tool hashes. Permission identity uses the complete resource digest while provider metadata remains nested below harness-owned attachment metadata.
-- Enabled harness-built-in names are checked on every application and resource handle before model execution. The reserved set is run-specific, so a disabled project tool or depth-disabled delegate does not reserve its wire name.
-
-## Persistence boundary
-
-- Snapshot schema version 1 uses optimistic revisions. Harness mutations are serialized per resolved storage key, while the JSON store adds a process-wide per-file queue shared by all instances.
-- Every queued mutation snapshots its revision and domain state first. A thrown save is reconciled against the store before memory is restored: a proven prior snapshot rolls back, a proven new snapshot remains current, and an unknown or explicitly uncertain commit fences the namespace. Code that crosses the save `await` must re-fetch session records because a proven rollback intentionally restores them.
-- `JsonFileFlexHarnessStores` is intentionally not cross-process safe. It provides atomic rename and in-process CAS, not an operating-system lock.
-- Loaded state is repaired from canonical generation outcomes. Accepted hidden terminal stages are promoted, while interrupted or incomplete public messages and tool parts become cancelled so a restarted process never presents them as still running.
-- Session updates reject while runtime work is active. Deletion tombstones the session, cancels active work, and retains failed runtime cleanup for a later deletion, retirement, or disposal retry before removing destructive core domains and confirming the retained PM generation fence.
-- Tool close settles before canonical acceptance. A completed hidden terminal projection is staged first, the Agent generation is finalized second, and only then is the public projection promoted. Earlier execution failures finalize as interrupted and publish from that durable outcome.
-- Disposal waits admitted session initialization, finalizers, every loaded-state save tail, tombstone cleanup, provider release, and detached tool cleanup. Listeners always clear; state caches clear only after cleanup succeeds and otherwise remain owned for retry.
-- Canonical finalization is the cancellation linearization point. Abort returns false once a run starts committing, while the active-run entry continues to block new prompts until finalization and public promotion settle.
-- Permission callbacks wait for the current save tail and then revalidate their run before reading remembered grants, so neither uncommitted grants nor captured callbacks can authorize later work.
-- Detached tool-provider settlement remains tracked after prompt finalization. Failed late handle closure stays owned by its storage state and is retried by a later retirement or disposal call.
-- A composed tool handle closes resource and application handles in reverse acquisition order. It attempts every close, aggregates failures, marks only successful handles complete, and retains the composite closure so later lifecycle drains retry exactly the failed handles.
-- Scope retirement fences older resolver calls and late state admissions, drains the complete resolved storage namespace, and evicts only the exact cached state promise. It never deletes the durable snapshot. Applications must close admission across every resolver alias before retirement because aliases are unknowable before resolution.
-- Context compaction runs under immutable async invocation context rather than storage-state scope hints. This keeps `scopeId`, `scope`, `storageKey`, and `sessionId` exact for manual, retention, and context-overflow compaction even when aliases share one cached namespace. Autonomous job callbacks use their immutable session-owner context because no later public invocation owns them.
-- Detached tool-provider cleanup and retained session cleanup are owned by the exact loaded storage state. Failed drains retain that ownership and the cached state for retry. Scope retirement cannot await or consume another namespace's cleanup, while full disposal settles all storage drains and orphaned initialization cleanup before aggregating failures.
-- JSON provider release hooks evict non-destructive session wrapper caches after AgentSession and execution-context ownership ends. Failed partial-initialization releases remain storage-scoped orphan ownership and are retried by retirement or disposal.
-- Turn-reversion capture release is idempotent and tombstone-owned. Session deletion aborts same-session commands, waits runtime settlement, releases every durable workspace capture, and only then removes projection data; a failed or unacknowledged release leaves the tombstone and projection available for retry.
-- Turn-reversion inspection, recovery, finalization, and release use a dedicated aggregate maintenance timeout. The top-level reversion option takes precedence over the legacy agent-session cleanup timeout fallback so hosts can order provider-call, aggregate-maintenance, and enclosing lifecycle deadlines independently.
-- Projection schemas 1 and 2 remain read-only compatibility inputs. Every projection write uses schema 3 with explicit protocol, provenance, and V2 disposition; schema-2 workspace references migrate as protocol-1 ownership without being discarded.
-- A loaded schema-1 or schema-2 projection retains its exact durable baseline until the first schema-3 save is confirmed, so a non-committing upgrade failure rolls back without fencing while a post-commit throw reconciles the new schema.
-- Workspace-required traversal keeps the cursor in completed-root group coordinates. Candidate operations may jump across trailing no-change groups, while pending, nonrevertible, mixed, and legacy transcript groups remain barriers without changing transcript-optional grouping.
-- `JsonFileFlexHarnessStores.dispose()` is the explicit final drain for file handles whose close failed on the last store operation; failed disposal retains the handle for another call.
-- Project-management state is a required exact `(storageKey, sessionId)` member of `IFlexHarnessStores`; `builtInTools.projectManagement` only controls tool exposure. Harness-local operations serialize without retrying external mutation conflicts, no-op mutations do not save, and tool writes retain agent/run/tool-call attribution. Session cleanup always runs, waits the local queue, and boundedly reloads before writing a generation-owned tombstone. Random generation identity plus a monotonic core-scope generation sequence permits a newer session to replace only an older PM tombstone while fencing stale saves and tombstones. Normal cleanup never removes the fence; `purgeNamespace()` is reserved for serialized application-owned whole-namespace destruction after non-destructive retirement and core-scope purge.
-
-## Tool output boundary
-
-- Every tool `execute` result and every async-iterable yield is converted to bounded JSON before SmartAgent observes it. Thrown errors and iterator failures are not converted or swallowed.
-- Every distinct SmartAgent streamed tool output mutates only the run-local running tool part and immediately emits a cumulative `part.updated` snapshot, including the final yielded value. Terminal success replaces it with the authoritative final output; failure, cancellation, and callback overflow remove transient output before persistence.
-- JSON byte limits are propagated through traversal. Large strings never enter normalized output, and array/object traversal stops once the remaining allowance is reserved for deterministic truncation metadata.
-- Model callbacks use bounded synchronous run-local parts. Source text/reasoning deltas accumulate there without per-delta persistence, while public `part.delta` events retain each exact source delta. Per-part UTF-8 counters are updated incrementally, including correction when a source boundary splits a surrogate pair; cumulative text is never rescanned per token. Callback event, byte, or part overflow aborts internally and is classified as failure, not owner cancellation.
-
-## Prompt queue boundary
-
-- Each loaded session owns one bounded runtime FIFO. Queue records retain private normalized prompt input and options only until terminal settlement; public queue entries and events expose IDs, status, timestamps, schedule keys, and projected errors only.
-- Never-started queue entries are intentionally not persisted. Scope and projection stores are public/redacted, Agent events are canonical model transactions, and the SmartAgent job store is reserved for background execution state. Reusing any of them for queued prompt payloads would violate its trust or lifecycle contract.
-- `enqueuePrompt()` is the runtime acceptance point. Existing `startPrompt()` and `schedulePrompt()` wait for the same entry's durable promotion, preserving their canonical reservation guarantee.
-- Promotion installs active ownership before its first await and checks cancellation, lifecycle, and exact stored-session identity after every durable boundary. Cancellation before start events interrupts and rolls back the canonical claim; cancellation afterward uses the active AgentSession path.
-- Deletion tombstones before queue cancellation. Scope retirement, namespace fencing, and disposal fence promotion before cancelling queued and active entries. Queue listeners remain available through deletion and retirement and clear only after disposal has emitted terminal events.
-
-## Subagent ownership
-
-- Subagents are first-class FlexHarness sessions. Public callers cannot assign relationship fields; private creation persists a complete parent/origin/agent/depth relation under the storage-key scope mutation before runtime initialization.
-- The built-in `delegate` tool consumes its per-run call slot when schema-valid execution starts, before semantic validation. Tool-schema rejection never enters execution and consumes no slot. Successful semantic validation reserves the child ID before requesting `subagent.start` permission; bounded permission metadata includes that reserved ID, which remains consumed after rejection or failure even though permission rejection creates no child session. The ID is correlation rather than existence authority. New child IDs hash the version marker, raw storage key, parent session, parent run, and parent tool call; the storage key itself is never exposed.
-- SmartAgent's parent tool intent remains crash authority. A deterministic child with messages is treated as an uncertain prior execution, while explicit `taskId` resume is limited to a later run of the same parent and same configured agent.
-- The SmartAgent tool-start callback establishes the correlated running parent part before execution. Harness-owned child ID/model metadata mutates that part synchronously and emits cumulative `part.updated` snapshots within the existing callback budgets.
-- Parent abort listeners recheck immediately after registration and abort only the captured active child run ID. Listener removal is in `finally`, including child failures and cancellation.
-- Scope snapshots retain schema version 1. Strict validation accepts legacy roots without relationship/depth fields, while new roots use depth 0 and children require complete relations, a live parent, exact parent-plus-one depth, no duplicate origin, no cycle, and no tombstoned ancestor.
-- Deletion persists one root-keyed tombstone group for the requested live subtree and joins separately retained descendant groups without rewriting their root invariants. Tombstones retain bounded immutable immediate-parent ancestry plus one atomic child provenance block with exact parent generation, creation origin, agent, and actual session depth. Project-management cleanup receives a cloned, doubly frozen context reused by identity across one cleanup's CAS retries and reconstructed from persisted provenance after restart. Active runs are cancelled only after the save, explicit retries first retry orphaned late-initialization cleanup, initialization barriers settle before domain cleanup, and runtime plus domains proceed child-first. Any failure retains ownership; the requested root is removed only after every joined descendant group is clean.
-- Namespace fencing cancels all other runs immediately. It awaits only relationship-independent runs in the failing turn; ancestor and descendant runs settle through the owned storage drain after the current run rejects, preventing a child-to-parent wait cycle while preserving fail-closed disposal and retirement retry ownership.