@namzu/sdk 43.0.0 → 44.1.0

package/src/runtime/query/iteration/phases/tool-review.ts

@@ -1,7 +1,7 @@
 import type { AuthorizationGate } from '../../../../authorization/index.js'
 import type { ToolCallSummary } from '../../../../types/hitl/index.js'
 import type { ChatCompletionResponse } from '../../../../types/provider/index.js'
-import type { RunEvent } from '../../../../types/run/index.js'
+import type { SessionEvent } from '../../../../types/session/index.js'
 import type { PreparedToolBatch, ToolCallDenials } from '../../executor.js'
 import {
 	awaitProjectInstructionCallback,
@@ -50,7 +50,7 @@ export async function* runToolReview(
 	ctx: VerificationAwareContext,
 	response: ChatCompletionResponse,
 	iterationNum: number,
-): AsyncGenerator<RunEvent, ToolReviewOutcome> {
+): AsyncGenerator<SessionEvent, ToolReviewOutcome> {
 	let executed: readonly import('../../executor.js').ToolCallOutcome[] = []
 	let toolMs = 0
 
@@ -85,6 +85,7 @@ export async function* runToolReview(
 		return calls.map((tc) => {
 			const tool = ctx.tools.get(tc.name)
 			const isDestructive = tool?.isDestructive ? tool.isDestructive(tc.input) : false
+			const escalation = 'escalation' in tc ? tc.escalation : undefined
 
 			return {
 				id: tc.id,
@@ -92,10 +93,13 @@ export async function* runToolReview(
 				input: tc.input,
 				isDestructive,
 				authorization: { decision: 'review' },
+				...(escalation ? { escalation } : {}),
 			}
 		})
 	}
 	let toolCallSummaries = summariesFor(preparedBatch)
+	const escalated = (): ToolCallSummary[] =>
+		toolCallSummaries.filter((tc) => tc.escalation !== undefined)
 
 	/**
 	 * A call that has failed identically too many times in a row is answered
@@ -157,7 +161,7 @@ export async function* runToolReview(
 			),
 			notices,
 		)) {
-			ctx.runMgr.pushMessage(msg)
+			ctx.recorder.pushMessage(msg)
 		}
 		// The complete tool-result batch is already in history before host policy
 		// may react, so a replacement cannot split provider-required adjacency.
@@ -169,7 +173,7 @@ export async function* runToolReview(
 				const signal = ctx.abortController.signal
 				const snapshot = await awaitProjectInstructionCallback(signal, () =>
 					ctx.projectInstructionContext?.observeToolResult(observation, {
-						messages: [...ctx.runMgr.messages],
+						messages: [...ctx.recorder.messages],
 						signal,
 					}),
 				)
@@ -177,8 +181,8 @@ export async function* runToolReview(
 				// microtasks. Authority may be withdrawn between them.
 				signal.throwIfAborted()
 				if (snapshot !== undefined) {
-					ctx.runMgr.replaceMessages(
-						replaceProjectInstructionSnapshot(ctx.runMgr.messages, snapshot),
+					ctx.recorder.replaceMessages(
+						replaceProjectInstructionSnapshot(ctx.recorder.messages, snapshot),
 					)
 				}
 			}
@@ -195,10 +199,43 @@ export async function* runToolReview(
 	const denyAll = (reason: string): ToolCallDenials =>
 		new Map(toolCalls.map((tc) => [tc.id, reason]))
 
+	/**
+	 * A crossing that was asked about and refused, on the record as a
+	 * refusal whoever refused it — a person answering No, a policy with
+	 * nobody to ask, a rule. An absent record would read the same as a
+	 * crossing nobody asked for.
+	 */
+	const recordRefusedEscalation = async (tc: ToolCallSummary, reason: string): Promise<void> => {
+		if (tc.escalation?.sandboxEscape) {
+			await ctx.recorder.recordAudit({
+				what: { action: 'sandbox_escape', tool: tc.name },
+				outcome: 'refused',
+				reason,
+			})
+		}
+		for (const path of tc.escalation?.outsidePaths ?? []) {
+			await ctx.recorder.recordAudit({
+				what: { action: 'outside_root_access', tool: tc.name, resource: path },
+				outcome: 'refused',
+				reason,
+			})
+		}
+	}
+
 	// Gate-denied ids survive the whole function: a later human approval
 	// must not be able to release them.
 	const gateDenied = new Map<string, string>()
 
+	// Sampled once, the first time a shortcut asks, so both shortcuts below
+	// read the same answer for this batch. A policy stricter than the rules
+	// (a read-only mode) sees the batch rather than letting an allowance or a
+	// grant run it past the handler.
+	let reviewAllowedSample: boolean | undefined
+	const reviewAllowed = (): boolean => {
+		reviewAllowedSample ??= ctx.reviewAllowedCalls?.() === true
+		return reviewAllowedSample
+	}
+
 	// The operator's policy runs FIRST, and a grant cannot overrule it.
 	//
 	// The grant short-circuit used to sit above this block and return, so a
@@ -220,7 +257,20 @@ export async function* runToolReview(
 				toolDef: ctx.tools.get(tc.name),
 			}),
 		}))
-		for (const { toolCall, gateResult } of gateResults) {
+		for (const gr of gateResults) {
+			// An `allow` rule was written about a tool, not about a path outside
+			// the working directory or a command outside the sandbox, which
+			// were refused outright when it was written. So an escalated call
+			// is a question even where a rule would allow the tool; a `deny`
+			// still refuses it, because a deny is never widened.
+			if (gr.toolCall.escalation && gr.gateResult.decision === 'allow') {
+				gr.gateResult = {
+					decision: 'review',
+					matchedRule: gr.gateResult.matchedRule,
+					reason: `${gr.gateResult.reason}; but this call reaches past the turn's boundary, which a rule cannot approve on its own`,
+				}
+			}
+			const { toolCall, gateResult } = gr
 			toolCall.authorization = {
 				decision: gateResult.decision,
 				...(gateResult.reason ? { reason: gateResult.reason } : {}),
@@ -238,7 +288,7 @@ export async function* runToolReview(
 				// an absent record (LOG-14, design §5). Written here, once per
 				// denied call, regardless of which path the rest of this function
 				// takes afterwards.
-				await ctx.runMgr.recordAudit({
+				await ctx.recorder.recordAudit({
 					what: { action: 'tool_call', tool: gr.toolCall.name },
 					outcome: 'refused',
 					reason,
@@ -249,7 +299,7 @@ export async function* runToolReview(
 		const allAllowed = gateResults.every((gr) => gr.gateResult.decision === 'allow')
 		const allDenied = gateResults.every((gr) => gr.gateResult.decision === 'deny')
 
-		if (allAllowed) {
+		if (allAllowed && !reviewAllowed()) {
 			ctx.log.debug('Authorization gate: all tool calls pre-approved', {
 				'namzu.tool.names': gateResults.map((gr) => gr.toolCall.name),
 			})
@@ -262,6 +312,12 @@ export async function* runToolReview(
 			ctx.log.debug('Authorization gate: all tool calls denied', {
 				'namzu.tool.names': gateResults.map((gr) => gr.toolCall.name),
 			})
+			// Every escalated call here was refused by a rule, and a crossing
+			// refused by a rule is recorded like one a person refused.
+			for (const tc of escalated()) {
+				const reason = gateDenied.get(tc.id)
+				if (reason !== undefined) await recordRefusedEscalation(tc, reason)
+			}
 			await settle(gateDenied)
 			yield* ctx.drainPending()
 			return finish('rejected')
@@ -282,9 +338,15 @@ export async function* runToolReview(
 	// the widest option available: `bash: git status` re-prompted on every
 	// batch forever, and the only escape was a blanket session grant that
 	// also covered every destructive call.
+	//
+	// Except an escalated call: a grant is remembered at the scope of a tool
+	// or a command, and neither says anything about a path outside the
+	// working directory or a run outside the sandbox.
 	if (
 		ctx.toolGrants &&
+		!reviewAllowed() &&
 		gateDenied.size === 0 &&
+		escalated().length === 0 &&
 		toolCallSummaries.every((tc) => ctx.toolGrants?.covers(tc))
 	) {
 		ctx.log.debug('Every tool call is covered by an approval already granted', {
@@ -295,11 +357,11 @@ export async function* runToolReview(
 		return finish('executed')
 	}
 
-	const reviewCheckpoint = await ctx.checkpointMgr.create(ctx.runMgr, iterationNum)
+	const reviewCheckpoint = await ctx.checkpointMgr.create(ctx.recorder, iterationNum)
 
 	await ctx.emitEvent({
 		type: 'tool_review_requested',
-		runId: ctx.runMgr.id,
+		turnId: ctx.recorder.turnId,
 		toolCalls: toolCallSummaries,
 		iteration: iterationNum,
 	})
@@ -307,22 +369,77 @@ export async function* runToolReview(
 
 	const reviewDecision = await awaitDecisionDurably(ctx, reviewCheckpoint, {
 		type: 'tool_review',
-		runId: ctx.runMgr.id,
+		sessionId: ctx.recorder.sessionId,
+		turnId: ctx.recorder.turnId,
 		checkpointId: reviewCheckpoint.id,
 		toolCalls: toolCallSummaries,
 	})
 
+	/**
+	 * The escalations this decision lets through, on the record, and the
+	 * escapes it did not confirm, refused.
+	 *
+	 * An approval that does not name an escape by id is not consent to it:
+	 * `approve_tools` is also what an auto mode, a remembered "approve all"
+	 * and a host's blanket handler answer, and none of those showed anybody
+	 * the escape. Refusing it here, beside the executor that would honour it,
+	 * makes that hold for every policy rather than for the shipped one only.
+	 */
+	const settleEscalations = async (
+		denials: Map<string, string>,
+		confirmed: readonly string[] | undefined,
+	): Promise<void> => {
+		for (const tc of escalated()) {
+			const denied = denials.get(tc.id)
+			if (denied !== undefined) {
+				// A crossing that was asked about and refused is on the record
+				// as a refusal, whoever refused it — a person answering No, a
+				// policy with nobody to ask, a rule. An absent record would read
+				// the same as a crossing nobody asked for.
+				await recordRefusedEscalation(tc, denied)
+				continue
+			}
+			if (tc.escalation?.sandboxEscape && !confirmed?.includes(tc.id)) {
+				const reason =
+					'Refused: running this command outside the sandbox needs a person to confirm it for this call, and this approval did not. Run it inside the sandbox, or ask the user to approve the escape when they can be asked.'
+				denials.set(tc.id, reason)
+				await ctx.recorder.recordAudit({
+					what: { action: 'sandbox_escape', tool: tc.name },
+					outcome: 'refused',
+					reason,
+				})
+				continue
+			}
+			if (tc.escalation?.sandboxEscape) {
+				await ctx.recorder.recordAudit({
+					what: { action: 'sandbox_escape', tool: tc.name },
+					outcome: 'approved',
+					reason: 'the reviewer confirmed this call by id',
+				})
+			}
+			for (const path of tc.escalation?.outsidePaths ?? []) {
+				await ctx.recorder.recordAudit({
+					what: { action: 'outside_root_access', tool: tc.name, resource: path },
+					outcome: 'approved',
+					reason: "the turn's review approved this call",
+				})
+			}
+		}
+	}
+
 	switch (reviewDecision.action) {
 		case 'reject_tools': {
 			await ctx.emitEvent({
 				type: 'tool_review_completed',
-				runId: ctx.runMgr.id,
+				turnId: ctx.recorder.turnId,
 				decision: 'rejected',
 			})
 			yield* ctx.drainPending()
 
 			const feedback = reviewDecision.feedback || 'The user rejected this tool call.'
-			await settle(denyAll(feedback))
+			const denials = new Map(denyAll(feedback))
+			await settleEscalations(denials, undefined)
+			await settle(denials)
 			yield* ctx.drainPending()
 			return finish('rejected')
 		}
@@ -330,7 +447,7 @@ export async function* runToolReview(
 		case 'modify_tools': {
 			await ctx.emitEvent({
 				type: 'tool_review_completed',
-				runId: ctx.runMgr.id,
+				turnId: ctx.recorder.turnId,
 				decision: 'modified',
 			})
 			yield* ctx.drainPending()
@@ -380,7 +497,7 @@ export async function* runToolReview(
 							? `Blocked by the authorization gate after the tool input was modified: ${gateResult.reason}`
 							: `Blocked by the authorization gate after the tool input was modified: the prepared value requires a new explicit approval. ${gateResult.reason}`
 					denials.set(summary.id, reason)
-					await ctx.runMgr.recordAudit({
+					await ctx.recorder.recordAudit({
 						what: { action: 'tool_call', tool: summary.name },
 						outcome: 'refused',
 						reason,
@@ -388,6 +505,7 @@ export async function* runToolReview(
 				}
 			}
 
+			await settleEscalations(denials, reviewDecision.confirmedEscalations)
 			const everythingDenied = denials.size === toolCalls.length
 			await settle(denials)
 			yield* ctx.drainPending()
@@ -397,29 +515,29 @@ export async function* runToolReview(
 		case 'pause': {
 			await ctx.emitEvent({
 				type: 'tool_review_completed',
-				runId: ctx.runMgr.id,
+				turnId: ctx.recorder.turnId,
 				decision: 'rejected',
 			})
 			await ctx.emitEvent({
-				type: 'run_paused',
-				runId: ctx.runMgr.id,
+				type: 'turn_paused',
+				turnId: ctx.recorder.turnId,
 				checkpointId: reviewCheckpoint.id,
 				reason: reviewDecision.reason,
 			})
 			yield* ctx.drainPending()
-			ctx.runMgr.setStopReason('paused')
+			ctx.recorder.setStopReason('paused')
 			return finish('stop')
 		}
 
 		case 'abort': {
 			await ctx.emitEvent({
 				type: 'tool_review_completed',
-				runId: ctx.runMgr.id,
+				turnId: ctx.recorder.turnId,
 				decision: 'rejected',
 			})
 			yield* ctx.drainPending()
-			ctx.runMgr.setStopReason('cancelled')
-			ctx.runMgr.markCancelled()
+			ctx.recorder.setStopReason('cancelled')
+			ctx.recorder.markCancelled()
 			return finish('stop')
 		}
 
@@ -435,7 +553,7 @@ export async function* runToolReview(
 
 			await ctx.emitEvent({
 				type: 'tool_review_completed',
-				runId: ctx.runMgr.id,
+				turnId: ctx.recorder.turnId,
 				decision: 'approved',
 			})
 			yield* ctx.drainPending()
@@ -443,21 +561,28 @@ export async function* runToolReview(
 			// `gateDenied` is non-empty only on the gate's mixed-decision
 			// path. Passing it here is what stops a human "approve" from
 			// executing calls the gate refused.
-			await settle(gateDenied)
+			const denials = new Map(gateDenied)
+			await settleEscalations(
+				denials,
+				reviewDecision.action === 'approve_tools' ? reviewDecision.confirmedEscalations : undefined,
+			)
+			await settle(denials)
 			yield* ctx.drainPending()
-			return finish('executed')
+			return finish(denials.size === toolCalls.length ? 'rejected' : 'executed')
 		}
 
 		case 'approve_plan':
 		case 'reject_plan':
 		// 'answer_question' belongs to an ask_user_question park, not a
 		// tool review — like the misdirected plan decisions above, warn
-		// and proceed with execution rather than stalling the run.
+		// and proceed with execution rather than stalling the turn.
 		case 'answer_question': {
 			ctx.log.warn('Unexpected plan decision during tool review', {
 				'namzu.runtime.action': reviewDecision.action,
 			})
-			await settle(gateDenied)
+			const denials = new Map(gateDenied)
+			await settleEscalations(denials, undefined)
+			await settle(denials)
 			yield* ctx.drainPending()
 			return finish('executed')
 		}

package/src/runtime/query/iteration/phases/working-memory.ts

@@ -1,6 +1,7 @@
 import { renderPins } from '../../../../compaction/serializer.js'
 import { NAMZU } from '../../../../constants/telemetry/index.js'
-import { createSystemMessage } from '../../../../types/message/index.js'
+import { type Message, createSystemMessage } from '../../../../types/message/index.js'
+import { stepContextMessage } from '../step-context.js'
 import type { IterationContext } from './context.js'
 
 /**
@@ -26,15 +27,60 @@ export function isWorkingMemoryMessage(content: string | null | undefined): bool
 	return typeof content === 'string' && content.startsWith(WORKING_MEMORY_HEADER)
 }
 
+/** Index of the pinned slot inside the leading system run, or -1. */
+function workingMemoryIndex(msgs: readonly Message[]): number {
+	// Bound the search to the LEADING system run (the compaction-preserved
+	// region). A working-memory header appearing later in the transcript (e.g.
+	// echoed by a tool result) must not be mistaken for the pinned slot.
+	for (let i = 0; i < msgs.length; i++) {
+		const m = msgs[i]
+		if (m?.role !== 'system') return -1
+		if (isWorkingMemoryMessage(m.content)) return i
+	}
+	return -1
+}
+
+/**
+ * Split the pinned slot out of a request's history.
+ *
+ * The slot keeps its place in the TURN's history, where compaction preserves
+ * it. The REQUEST carries it as request-only context instead: a runtime
+ * context message of kind `step-context`, after the history, holding the
+ * slot's content verbatim under the same "runtime-generated; not a new user
+ * request" label every other step-context message carries — so the header
+ * begins the message's second line, not its first. The slot changes whenever a pin does, and a
+ * driver that hoists system messages ahead of the conversation (one that
+ * renders tools, then system, then messages) would otherwise invalidate the
+ * cached conversation prefix on every such change. Every driver keeps
+ * request-only context after history, and a caching driver ends its
+ * breakpoint before it.
+ *
+ * Returns the input array unchanged, and no context, when there is no slot.
+ */
+export function splitWorkingMemoryForRequest(messages: readonly Message[]): {
+	readonly history: readonly Message[]
+	readonly context?: Message
+} {
+	const idx = workingMemoryIndex(messages)
+	const slot = idx >= 0 ? messages[idx] : undefined
+	if (!slot || typeof slot.content !== 'string') return { history: messages }
+	return {
+		history: [...messages.slice(0, idx), ...messages.slice(idx + 1)],
+		context: stepContextMessage(slot.content),
+	}
+}
+
 /**
  * Resolve the host's working-memory string and rewrite a single PINNED leading
  * system message in place. Insert-or-replace keyed by {@link WORKING_MEMORY_HEADER};
  * an empty/blank string removes the slot.
  *
  * The slot is an EPHEMERAL system message placed as the LAST leading system
- * message (after the cached static + dynamic system messages), so it never
- * busts the prompt-cache prefix yet still rides inside the compaction-preserved
- * leading-system run (the primacy edge Lost-in-the-Middle / Context-Rot need).
+ * message (after the cached static + dynamic system messages), so it rides
+ * inside the compaction-preserved leading-system run. That is its place in
+ * the turn's HISTORY only: a request carries it as request-only context after
+ * the history ({@link splitWorkingMemoryForRequest}), so a changed pin never
+ * busts the cached conversation prefix.
  *
  * Failure-isolated (the `web-search` seam rule): a throwing/slow provider
  * degrades to "no refresh this turn" (keeps the prior slot), never breaks the
@@ -53,12 +99,12 @@ export async function refreshWorkingMemory(ctx: IterationContext): Promise<void>
 		try {
 			block =
 				(await provider({
-					runId: ctx.runMgr.id,
-					iteration: ctx.runMgr.currentIteration,
+					turnId: ctx.recorder.turnId,
+					iteration: ctx.recorder.currentIteration,
 				})) ?? ''
 		} catch (err) {
 			ctx.log.warn('workingMemoryProvider failed; keeping prior slot', {
-				[NAMZU.RUN_ID]: ctx.runMgr.id,
+				[NAMZU.TURN_ID]: ctx.recorder.turnId,
 				'exception.message': err instanceof Error ? err.message : String(err),
 			})
 			return
@@ -66,22 +112,11 @@ export async function refreshWorkingMemory(ctx: IterationContext): Promise<void>
 	}
 	if (pinned) block = block.trim() ? `${block.trim()}\n\n${pinned}` : pinned
 
-	const msgs = ctx.runMgr.messages
+	const msgs = ctx.recorder.messages
 
-	// Bound the search to the LEADING system run (the compaction-preserved
-	// region). A working-memory header appearing later in the transcript (e.g.
-	// echoed by a tool result) must not be mistaken for the pinned slot.
 	let leadEnd = 0
 	while (leadEnd < msgs.length && msgs[leadEnd]?.role === 'system') leadEnd++
-
-	let idx = -1
-	for (let i = 0; i < leadEnd; i++) {
-		const m = msgs[i]
-		if (m && m.role === 'system' && isWorkingMemoryMessage(m.content)) {
-			idx = i
-			break
-		}
-	}
+	const idx = workingMemoryIndex(msgs)
 
 	if (!provider && !pinned) {
 		if (!ctx.workingStateManager) return
@@ -93,7 +128,7 @@ export async function refreshWorkingMemory(ctx: IterationContext): Promise<void>
 		// Empty block ⇒ remove the slot (byte-identical-when-empty).
 		if (idx >= 0) {
 			msgs.splice(idx, 1)
-			ctx.runMgr.clearLastPromptTokens?.()
+			ctx.recorder.clearLastPromptTokens?.()
 		}
 		return
 	}
@@ -110,5 +145,5 @@ export async function refreshWorkingMemory(ctx: IterationContext): Promise<void>
 	}
 	// The old provider reading measured a different prefix, and an insertion
 	// also moves its tail watermark. Re-estimate until the next request reports.
-	ctx.runMgr.clearLastPromptTokens?.()
+	ctx.recorder.clearLastPromptTokens?.()
 }

package/src/runtime/query/iteration/step-context.ts

@@ -0,0 +1,17 @@
+import { createRuntimeContextMessage } from '../../../types/message/index.js'
+
+/**
+ * Request-only context, as the model reads it: a runtime-context user
+ * message of kind `step-context`, labelled so the model does not take it
+ * for something the operator just said.
+ *
+ * Its own module because two sides of an import cycle need it: the
+ * working-memory phase, which `step-shaping` reaches through the compaction
+ * phase, and `step-shaping` itself.
+ */
+export function stepContextMessage(content: string) {
+	return createRuntimeContextMessage(
+		`Current step context (runtime-generated; not a new user request):\n${content}`,
+		'step-context',
+	)
+}

package/src/runtime/query/iteration/step-shaping.ts

@@ -2,11 +2,10 @@ import { resolveContextWindow } from '../../../compaction/context-window.js'
 import { estimateMessageTokens } from '../../../compaction/token-estimate.js'
 import { NAMZU } from '../../../constants/telemetry/index.js'
 import { renderSkillsSection } from '../../../persona/assembler.js'
-import { PreparationContextError } from '../../../run/preparation-context-error.js'
+import { PreparationContextError } from '../../../turn/preparation-context-error.js'
 import {
 	type Message,
 	type UserMessage,
-	createRuntimeContextMessage,
 	createSystemMessage,
 } from '../../../types/message/index.js'
 import type { ToolChoice } from '../../../types/provider/chat.js'
@@ -15,12 +14,13 @@ import type {
 	PrepareStepResult,
 	StepResult,
 	StepVeto,
-} from '../../../types/run/index.js'
+} from '../../../types/session/index.js'
 import type { Skill } from '../../../types/skills/index.js'
 import { toErrorMessage } from '../../../utils/error.js'
 import { createCallbackInference } from '../callback-inference.js'
 import { measureContext } from './phases/compaction.js'
 import type { IterationContext } from './phases/index.js'
+import { stepContextMessage } from './step-context.js'
 
 /**
  * How the next request is shaped: admission, preparation, and the context
@@ -29,7 +29,7 @@ import type { IterationContext } from './phases/index.js'
  * Three of these read state the loop replaces or grows as it runs, so they
  * arrive as accessors rather than as values — `latestUserMessage` is replaced
  * on every operator turn and `steps` gains a member per step, and a captured
- * copy of either would describe an earlier return. `ctx` is the run's own
+ * copy of either would describe an earlier return. `ctx` is the turn's own
  * context object, passed through rather than re-derived, because
  * `selectContextModel` WRITES two of its fields (`contextModel` and
  * `activeProviderContextWindow`) for the compaction pass to read.
@@ -40,12 +40,7 @@ export interface StepShaping {
 	readonly steps: () => readonly StepResult[]
 }
 
-export function stepContextMessage(content: string) {
-	return createRuntimeContextMessage(
-		`Current step context (runtime-generated; not a new user request):\n${content}`,
-		'step-context',
-	)
-}
+export { stepContextMessage }
 
 /** Derived after request projection; never accumulates in canonical history or replaces operator intent. */
 export function appendWorkContext(
@@ -81,11 +76,11 @@ export function stepContext(
 ): PrepareStepContext {
 	const { ctx, latestUserMessage, steps } = shaping
 
-	const model = prepared.model ?? ctx.runConfig.model
+	const model = prepared.model ?? ctx.turnConfig.model
 	const window = resolveContextWindow(
 		ctx.compactionConfig?.contextWindowTokens,
 		model,
-		model === ctx.runConfig.model
+		model === ctx.turnConfig.model
 			? ctx.providerContextWindow
 			: model === ctx.contextModel
 				? ctx.activeProviderContextWindow
@@ -97,14 +92,16 @@ export function stepContext(
 		(preamble ? estimateMessageTokens(createSystemMessage(preamble)) : 0) +
 		(prepared.context ? estimateMessageTokens(stepContextMessage(prepared.context)) : 0)
 	const responseReserve = Math.min(
-		prepared.maxResponseTokens ?? ctx.runConfig.maxResponseTokens ?? Math.floor(window.tokens / 4),
+		prepared.maxResponseTokens ?? ctx.turnConfig.maxResponseTokens ?? Math.floor(window.tokens / 4),
 		Math.floor(window.tokens / 4),
 	)
 	return {
-		runId: ctx.runMgr.id,
+		sessionId: ctx.recorder.sessionId,
+		turnId: ctx.recorder.turnId,
+		turnStartedAt: ctx.recorder.turnStartedAt,
 		stepNumber,
-		messages: ctx.runMgr.messages,
-		...(ctx.captureRunEvidence ? { captureRunEvidence: ctx.captureRunEvidence } : {}),
+		messages: ctx.recorder.messages,
+		...(ctx.captureSessionEvidence ? { captureSessionEvidence: ctx.captureSessionEvidence } : {}),
 		...(latestUserMessage() ? { latestUserMessage: latestUserMessage() } : {}),
 		signal: ctx.abortController.signal,
 		contextBudget: {
@@ -163,7 +160,7 @@ export async function prepareStep(
 	for (const stage of stages) {
 		const inference = createCallbackInference(
 			ctx,
-			result.model ?? ctx.runConfig.model,
+			result.model ?? ctx.turnConfig.model,
 			'preparation',
 		)
 		try {
@@ -172,12 +169,12 @@ export async function prepareStep(
 				generateText: inference.generateText,
 			})
 			if (decided) result = { ...result, ...decided }
-			await selectContextModel(shaping, result.model ?? ctx.runConfig.model)
+			await selectContextModel(shaping, result.model ?? ctx.turnConfig.model)
 		} catch (err) {
 			// Skipped, and the rest still run: one broken concern must
 			// not silently disable the others it was declared beside.
 			ctx.log.error('a prepareStep stage threw — skipping it', {
-				[NAMZU.RUN_ID]: ctx.runMgr.id,
+				[NAMZU.TURN_ID]: ctx.recorder.turnId,
 				'namzu.runtime.step_number': stepNumber,
 				'exception.message': toErrorMessage(err),
 			})
@@ -222,7 +219,7 @@ export async function prepareStep(
 			// honest reading of "only these tools" when none of them exist,
 			// and is not what a reader of "ignoring them" would expect.
 			//
-			// Widening back to the run's list would be worse: it grants
+			// Widening back to the turn's list would be worse: it grants
 			// exactly the tools the caller asked to exclude, on the grounds
 			// that their own list failed. A step that can call nothing is
 			// constrained; a step that can call everything is a control
@@ -232,7 +229,7 @@ export async function prepareStep(
 					? 'prepareStep named only tools that are not registered — this step can call nothing'
 					: 'prepareStep named tools that are not registered — ignoring them'
 			ctx.log.warn(message, {
-				[NAMZU.RUN_ID]: ctx.runMgr.id,
+				[NAMZU.TURN_ID]: ctx.recorder.turnId,
 				'namzu.runtime.step_number': stepNumber,
 				'namzu.runtime.unknown': unknown,
 				'namzu.runtime.remaining': known.length,
@@ -259,13 +256,13 @@ export async function selectContextModel(
 ): Promise<void> {
 	const { ctx } = shaping
 
-	if (model !== (ctx.contextModel ?? ctx.runConfig.model)) {
+	if (model !== (ctx.contextModel ?? ctx.turnConfig.model)) {
 		// A measurement from another tokenizer cannot price the new request.
-		ctx.runMgr.clearLastPromptTokens()
+		ctx.recorder.clearLastPromptTokens()
 	}
 	ctx.contextModel = model
 	ctx.activeProviderContextWindow =
-		model && model !== ctx.runConfig.model && !ctx.compactionConfig?.contextWindowTokens
+		model && model !== ctx.turnConfig.model && !ctx.compactionConfig?.contextWindowTokens
 			? await ctx.resolveModelContextWindow?.(model)
 			: undefined
 }