@rulvar/core 1.49.0 → 1.50.0

package/dist/index.d.ts

@@ -28,7 +28,7 @@ type WireError = {
 * 'agent' is carried by the AgentError value projection, not by a
 * RulvarError subclass.
 */
-type ErrorCode = "agent" | "config" | "non_serializable_value" | "script_rejected" | "journal_compat" | "invalid_resolution" | "journal_order_violation" | "plan_invariant" | "replay_plan_hash_mismatch" | "orchestrator_cap_config" | "journal_miss" | "budget_exhausted" | "fail_run" | "admission_rejected" | "sandbox_limit" | "lease_held" | "knowledge_cas";
+type ErrorCode = "agent" | "config" | "non_serializable_value" | "script_rejected" | "journal_compat" | "invalid_resolution" | "journal_order_violation" | "plan_invariant" | "replay_plan_hash_mismatch" | "orchestrator_cap_config" | "journal_miss" | "budget_exhausted" | "fail_run" | "admission_rejected" | "sandbox_limit" | "lease_held" | "knowledge_cas" | "determinism";
 /** An alias for the registry type; both names are public. */
 type RulvarErrorCode = ErrorCode;
 /**
@@ -264,6 +264,25 @@ declare class KnowledgeCasError extends RulvarError {
   });
 }
 /**
+* A workflow-origin bare-nondeterminism violation under
+* `determinism.mode: 'error'` (RV-209): bare `Date.now()` or
+* `Math.random()` called from workflow code inside a run. Thrown at the
+* offending call site (and re-thrown at settle if the workflow swallowed
+* it), so the run rejects instead of recording a value replay cannot
+* reproduce. `data` carries the structured localization: `category`,
+* `frame`, and the parsed `file`/`line`/`column` when the frame names
+* one. Never journaled as its own entry; the run settles 'error' with
+* this wire error. Exempt provenances (installed dependencies, Node
+* runtime frames, allowlisted patterns) never raise it.
+*/
+declare class DeterminismError extends RulvarError {
+  readonly code = "determinism";
+  constructor(message: string, opts?: {
+    data?: Json;
+    cause?: unknown;
+  });
+}
+/**
 * The vendored Standard Schema issue shape: validation issues carried
 * on AgentError and surfaced to the
 * model during bounded schema re-prompts.
@@ -4531,6 +4550,34 @@ type ToolEvents = {
   advisory?: Json;
 };
 /**
+* Bare-nondeterminism detection (RV-209). Emitted LIVE by the segment
+* that observed the call, at most once per (category, provenance) per
+* execution segment; never journaled and never re-emitted with the
+* `replayed` flag. Because replay re-executes the workflow body, a
+* violation that survives in the code fires again on every replay of
+* the run, so the event appears organically in both live and replayed
+* streams. Exempt provenances (installed dependencies under
+* node_modules and Node runtime frames) never emit: they are
+* classified and silenced, which is what keeps an SDK's internal
+* `Math.random()` from branding the run nondeterministic.
+*/
+type DeterminismEvents = {
+  type: "determinism:warning"; /** Which patched global fired. */
+  category: "bare-date-now" | "bare-math-random";
+  /**
+  * 'workflow': the caller is workflow-origin code (the violation the
+  * guard exists for; rejects the run under `determinism.mode:
+  * 'error'`). 'allowlisted': the caller matched a configured
+  * `determinism.allowlist` pattern and is exempt by explicit host
+  * decision; emitted for visibility, never rejects.
+  */
+  provenance: "workflow" | "allowlisted"; /** The calling stack frame, after the configured redaction hook. */
+  frame: string; /** Parsed location when the frame carries one, after redaction. */
+  file?: string;
+  line?: number;
+  column?: number;
+};
+/**
 * Adaptive orchestration, resolutions, and
 * accounting: emitted only by runs where the corresponding machinery is
 * active (applicability per mode:
@@ -4677,7 +4724,7 @@ type AdaptiveEvents = {
   found: number;
   window: [number, number];
 };
-type WorkflowEventBody = CoreEvents | AgentEvents | ToolEvents | AdaptiveEvents;
+type WorkflowEventBody = CoreEvents | AgentEvents | ToolEvents | DeterminismEvents | AdaptiveEvents;
 /**
 * The envelope: seq is an independent per-run
 * telemetry counter, strictly increasing in emission order and DISTINCT
@@ -4810,13 +4857,15 @@ type OnEscalation = (result: EscalatedResult<unknown>) => EscalationDecision | P
 /**
 * The mode (a) runner for human-authored closures. Determinism is enforced
 * by convention, lint, and the ctx shims, NOT by a VM: only the sequence
-* of keys must be stable. Dev mode (NODE_ENV !== 'production') detects
-* bare Date.now and Math.random and emits one warning per run pointing at
-* ctx.now()/ctx.random(). Detection is attributed by AsyncLocalStorage:
-* only code inside the workflow body's async context can trigger it, so
-* host code running concurrently, engine internals outside the body, and
-* other runs never produce a false warning, and nothing is ever restored,
-* so concurrent executes cannot race the patch state.
+* of keys must be stable. Bare-nondeterminism detection is ENGINE-owned
+* since RV-209: the engine wraps its `execute` call in
+* `withDeterminismDetection` (runner/determinism.ts), which classifies
+* bare Date.now/Math.random callers, emits the structured
+* `determinism:warning` event on the run's stream, and under
+* `determinism.mode: 'error'` rejects the run with a typed
+* DeterminismError. The runner itself is a pure executor, so the frozen
+* ScriptRunner seam carries no detection surface; a standalone execute
+* outside an engine runs without detection.
 */
 declare class InProcessRunner implements ScriptRunner {
   private readonly onEscalation?;
@@ -4828,6 +4877,39 @@ declare class InProcessRunner implements ScriptRunner {
   execute<A, R>(wf: Workflow<A, R> | CompiledWorkflow, ctx: Ctx<never>, args: A): Promise<R>;
 }
 //#endregion
+//#region src/runner/determinism.d.ts
+/**
+* Detection modes. 'off': never detect. 'warn' (the default, and the
+* pre-RV-209 behavior): detect outside production (NODE_ENV !==
+* 'production'), emit one `determinism:warning` event and one process
+* warning per category per segment, never reject. 'error': detect in
+* EVERY environment including production, and reject the run at the
+* first workflow-origin call with a typed DeterminismError (the strict
+* gate for replay-verified pipelines).
+*/
+type DeterminismMode = "off" | "warn" | "error";
+/** Host configuration for the guard (CreateEngineOptions.determinism). */
+interface DeterminismConfig {
+  mode?: DeterminismMode;
+  /**
+  * Caller frames matching any pattern are exempt by explicit host
+  * decision: classified 'allowlisted' in the emitted event, never a
+  * process warning, never a rejection. A string matches as a
+  * substring of the frame; a RegExp matches by test. Patterns match
+  * the RAW frame, before any redaction. Installed dependencies
+  * (node_modules) and Node runtime frames (`node:` specifiers) are
+  * exempt WITHOUT configuration and emit nothing at all.
+  */
+  allowlist?: ReadonlyArray<string | RegExp>;
+  /**
+  * Redaction hook for public telemetry: applied to the frame and the
+  * parsed file path before they leave in events, process warnings, and
+  * DeterminismError data, so absolute host paths need not reach an
+  * OTel backend. Default: identity.
+  */
+  redact?: (frame: string) => string;
+}
+//#endregion
 //#region src/model/pricing.d.ts
 interface PriceTable {
   /** Monotonic version string; recorded in decision entries. */
@@ -4975,6 +5057,18 @@ interface CreateEngineOptions {
   redaction?: {
     maskEvents?: boolean;
   };
+  /**
+  * Bare-nondeterminism detection over in-process workflow bodies
+  * (RV-209): mode 'off' | 'warn' (default; detects outside production)
+  * | 'error' (detects everywhere and rejects the run at the first
+  * workflow-origin bare Date.now/Math.random with a typed
+  * DeterminismError), plus the frame `allowlist` for confirmed-safe
+  * callers and the `redact` hook for public telemetry. Workflow-origin
+  * violations emit the structured `determinism:warning` event with the
+  * caller frame and parsed file/line; installed dependencies and Node
+  * runtime frames are classified exempt and stay silent.
+  */
+  determinism?: DeterminismConfig;
 }
 interface RunOptions {
   /** Explicit id; otherwise the engine mints a ULID. */
@@ -5124,6 +5218,19 @@ declare function workflowSourceRef(runId: string): string;
 * `argsHash` field docs).
 */
 declare function hashRunArgs(args: unknown): string | undefined;
+/**
+* sha256 hex over the JCS canonical serialization of a run's result
+* value: the digest the engine records as `outputHash` on the journaled
+* run-settle decision when the settling segment computed a value, and
+* the value `rulvar replay --compare-output-hash` compares a replayed
+* result against (RV-209). Best-effort by design: returns undefined for
+* undefined values and for values JCS cannot serialize (functions,
+* cycles, non-finite numbers), so an unhashable result records no
+* baseline rather than failing the settle. Like `hashRunArgs`, the
+* digest is deterministic and unsalted: treat it as sensitive-derived
+* metadata for low-entropy results.
+*/
+declare function hashRunOutput(value: unknown): string | undefined;
 declare function createEngine(options: CreateEngineOptions): Engine;
 //#endregion
 //#region src/orchestrator/finish-validators.d.ts
@@ -6904,10 +7011,16 @@ declare function assertFencedWrites(stores: {
 //#region src/stores/reconcile.d.ts
 /** The decisionType of the journaled run settle entry. */
 declare const RUN_SETTLE_DECISION_TYPE = "run_settle";
-/** The last journaled run settle of a journal, if any. */
+/**
+* The last journaled run settle of a journal, if any. `outputHash` is
+* present when that settle recorded the result digest (RV-209; settles
+* written before it, or over undefined/non-serializable results, carry
+* none).
+*/
 declare function lastRunSettle(entries: readonly JournalEntry[]): {
   runStatus: RunStatus;
   seq: number;
+  outputHash?: string;
 } | undefined;
 type RunAuditVerdict = "consistent" | "meta-behind" | "stranded" | "suspect";
 interface RunStateAudit {
@@ -7483,4 +7596,4 @@ interface SandboxBridge {
 declare const SANDBOX_AGENT_OPT_KEYS: readonly string[];
 declare function createSandboxBridge(ctx: Ctx<never>, options: SandboxBridgeOptions): SandboxBridge;
 //#endregion
-export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, type AgentInvocationRow, AgentOpts, AgentProfile, AgentProfilePermissions, AgentResult, AgentResultMeta, AgentStatus, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, AuditRunsOptions, BUDGET_ABORT_REASON, BaseAppend, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetExhaustionDiagnostics, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildArtifactPage, ChildIdentityInput, ChildResultPage, type ClaimClass, type ClaimOp, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ConfigError, type CoreEvents, CostAttribution, CostAttributionFacts, CostReport, CreateEngineOptions, Ctx, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DebitResult, DeclaredLadder, DedupIndex, DedupNote, DerivedKey, DeriverRegistry, DispositionRule, DispositionTable, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EntryKind, EntryRef, EntryStatus, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDecisionAbortedError, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, type EvidenceRef, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, FinishInfo, FinishValidationChild, FinishValidationInput, FinishValidationSpec, FinishValidationVerdict, FinishValidator, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, INBOX_PROPOSAL_TTL_DAYS, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, InvocationRole, type InvocationTable, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, JournalSerializationHook, type JournalStore, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalTaskId, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, MatchResult, McpConfig, McpToolSource, MechanicalGateProfile, MechanicalGateVerdict, type MetaLookupStore, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateAcceptance, OrchestrateOptions, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, type PhaseRow, PhaseTarget, PipelineCollected, PipelineOpts, PlanInvariantError, PriceTable, PricedUsage, type Pricing, type PricingTier, type ProviderAdapter, QualityFloors, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, RandIdentityInput, RandPayload, ReconcileOptions, ReconcileResult, RefEntryAppender, RefEntryClassification, RefusalInfo, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunAuditVerdict, RunBudget, RunEventSink, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStateAudit, RunStatus, RuntimeEventSink, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, Semaphore, SerializationHook, Settled, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StepIdentityInput, StructuredOutputTier, SuspendedAppend, SuspensionState, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TerminalPatch, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, UsageSlice, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readRunMeta, readTerminationInit, reconcileRunMeta, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, requiredFieldsValidator, requiredSectionsValidator, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, type AgentInvocationRow, AgentOpts, AgentProfile, AgentProfilePermissions, AgentResult, AgentResultMeta, AgentStatus, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, AuditRunsOptions, BUDGET_ABORT_REASON, BaseAppend, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetExhaustionDiagnostics, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildArtifactPage, ChildIdentityInput, ChildResultPage, type ClaimClass, type ClaimOp, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ConfigError, type CoreEvents, CostAttribution, CostAttributionFacts, CostReport, CreateEngineOptions, Ctx, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DebitResult, DeclaredLadder, DedupIndex, DedupNote, DerivedKey, DeriverRegistry, type DeterminismConfig, DeterminismError, type DeterminismEvents, type DeterminismMode, DispositionRule, DispositionTable, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EntryKind, EntryRef, EntryStatus, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDecisionAbortedError, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, type EvidenceRef, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, FinishInfo, FinishValidationChild, FinishValidationInput, FinishValidationSpec, FinishValidationVerdict, FinishValidator, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, INBOX_PROPOSAL_TTL_DAYS, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, InvocationRole, type InvocationTable, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, JournalSerializationHook, type JournalStore, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalTaskId, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, MatchResult, McpConfig, McpToolSource, MechanicalGateProfile, MechanicalGateVerdict, type MetaLookupStore, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateAcceptance, OrchestrateOptions, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, type PhaseRow, PhaseTarget, PipelineCollected, PipelineOpts, PlanInvariantError, PriceTable, PricedUsage, type Pricing, type PricingTier, type ProviderAdapter, QualityFloors, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, RandIdentityInput, RandPayload, ReconcileOptions, ReconcileResult, RefEntryAppender, RefEntryClassification, RefusalInfo, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunAuditVerdict, RunBudget, RunEventSink, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStateAudit, RunStatus, RuntimeEventSink, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, Semaphore, SerializationHook, Settled, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StepIdentityInput, StructuredOutputTier, SuspendedAppend, SuspensionState, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TerminalPatch, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, UsageSlice, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readRunMeta, readTerminationInit, reconcileRunMeta, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, requiredFieldsValidator, requiredSectionsValidator, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };

package/dist/index.js

@@ -289,6 +289,27 @@ var KnowledgeCasError = class extends RulvarError {
 	}
 };
 /**
+* A workflow-origin bare-nondeterminism violation under
+* `determinism.mode: 'error'` (RV-209): bare `Date.now()` or
+* `Math.random()` called from workflow code inside a run. Thrown at the
+* offending call site (and re-thrown at settle if the workflow swallowed
+* it), so the run rejects instead of recording a value replay cannot
+* reproduce. `data` carries the structured localization: `category`,
+* `frame`, and the parsed `file`/`line`/`column` when the frame names
+* one. Never journaled as its own entry; the run settles 'error' with
+* this wire error. Exempt provenances (installed dependencies, Node
+* runtime frames, allowlisted patterns) never raise it.
+*/
+var DeterminismError = class extends RulvarError {
+	code = "determinism";
+	constructor(message, opts) {
+		super(message, {
+			retryable: false,
+			...opts
+		});
+	}
+};
+/**
 * Projects an AgentError to its WireError form: code 'agent', with kind,
 * retryAfterMs, and issues carried in data. Issue paths are flattened to
 * JSON-safe segments.
@@ -6580,7 +6601,12 @@ const TERMINAL = /* @__PURE__ */ new Set([
 	"exhausted"
 ]);
 const wallClock = Date.now.bind(globalThis);
-/** The last journaled run settle of a journal, if any. */
+/**
+* The last journaled run settle of a journal, if any. `outputHash` is
+* present when that settle recorded the result digest (RV-209; settles
+* written before it, or over undefined/non-serializable results, carry
+* none).
+*/
 function lastRunSettle(entries) {
 	for (let i = entries.length - 1; i >= 0; i -= 1) {
 		const entry = entries[i];
@@ -6588,7 +6614,8 @@ function lastRunSettle(entries) {
 		const value = entry.value;
 		if (value?.decisionType === "run_settle" && typeof value.runStatus === "string" && RUN_STATUSES.has(value.runStatus)) return {
 			runStatus: value.runStatus,
-			seq: entry.seq
+			seq: entry.seq,
+			...typeof value.outputHash === "string" ? { outputHash: value.outputHash } : {}
 		};
 	}
 }
@@ -14538,46 +14565,172 @@ function assertSafeRunId(runId, context) {
 //#endregion
 //#region src/runner/inprocess.ts
 /**
-* ScriptRunner SPI and InProcessRunner (M1-T11).
+* The mode (a) runner for human-authored closures. Determinism is enforced
+* by convention, lint, and the ctx shims, NOT by a VM: only the sequence
+* of keys must be stable. Bare-nondeterminism detection is ENGINE-owned
+* since RV-209: the engine wraps its `execute` call in
+* `withDeterminismDetection` (runner/determinism.ts), which classifies
+* bare Date.now/Math.random callers, emits the structured
+* `determinism:warning` event on the run's stream, and under
+* `determinism.mode: 'error'` rejects the run with a typed
+* DeterminismError. The runner itself is a pure executor, so the frozen
+* ScriptRunner seam carries no detection surface; a standalone execute
+* outside an engine runs without detection.
+*/
+var InProcessRunner = class {
+	onEscalation;
+	constructor(o) {
+		if (o?.onEscalation !== void 0) this.onEscalation = o.onEscalation;
+	}
+	/** The hook is read by the escalation delivery path from M3 onward. */
+	get escalationHook() {
+		return this.onEscalation;
+	}
+	async execute(wf, ctx, args) {
+		if (wf.kind !== "workflow") throw new TypeError("InProcessRunner executes closure Workflow values only; CompiledWorkflow runs in the worker sandbox (@rulvar/planner, M6)");
+		return await wf.body(ctx, args);
+	}
+};
+//#endregion
+//#region src/runner/determinism.ts
+/**
+* Bare-nondeterminism detection (RV-209): the engine-owned guard that
+* classifies bare `Date.now()`/`Math.random()` calls observed inside a
+* run, localizes workflow-origin ones to a file and line, emits the
+* structured `determinism:warning` event, and under `mode: 'error'`
+* rejects the run with a typed DeterminismError instead of letting a
+* value replay cannot reproduce into the result.
 *
-* Script runner contract: https://docs.rulvar.com/guide/planner
-* Workflow (a closure value) runs in process only; CompiledWorkflow is the
-* only form admissible to the worker sandbox and first exists at M6
-* (compileScript in @rulvar/planner), so until then the engine accepts
-* only in-process Workflow values. The SPI's L0 listing refers
-* to its frozen-seam status; the declaration lives here with its types.
+* The machinery began life inside InProcessRunner (dev-mode process
+* warnings only); it lives here so the engine can thread the run's
+* event channel and the host's DeterminismConfig without touching the
+* frozen ScriptRunner seam: the engine wraps the in-process
+* `runner.execute(...)` call in `withDeterminismDetection`, and the
+* runner itself stays a pure executor.
+*
+* Attribution is by AsyncLocalStorage: only code inside the wrapped
+* execution inherits the detection store, so host code running
+* concurrently, engine internals outside the body, and other runs never
+* false-warn. The globals are patched ONCE per process and never
+* restored (outside a detection context the patch is a transparent
+* passthrough); the previous per-execute patch/restore pair could race
+* under concurrent runs (the false RULVAR_BARE_DATE_NOW class the 1.5.2
+* review reproduced). Rulvar's own internals never reach the check:
+* every internal real-time read binds the module-load clock
+* (l0/real-clock.ts and the ULID factory default), never the live
+* global (v1.18.0 review P2-6).
 */
 const detection = new AsyncLocalStorage();
 let globalsPatched = false;
+const MODES = /* @__PURE__ */ new Set([
+	"off",
+	"warn",
+	"error"
+]);
 /**
-* Stack line 0 names the Error, line 1 this helper, line 2 the patched
-* global, line 3 the caller whose provenance decides (the layout is
-* pinned by construction: this helper is only ever called by the two
-* patched globals). Two origins are exempt: installed dependencies (a
-* provider SDK, any transitive package, rulvar's own published dist),
-* which live under node_modules, and Node's own machinery (the undici
-* transport behind fetch, timers, stream internals), whose frames carry
-* `node:` specifiers and inherit the run's async context. The guard
-* exists for workflow code, which imports from both but lives in
-* neither. Rulvar's own internals never reach this check at all: every
-* internal real-time read binds the module-load clock (l0/real-clock.ts
-* and the ULID factory default), never the live global, so frames from
-* workspace dists or this repo's sources cannot false-warn (v1.18.0
-* review P2-6).
+* Fail-loud validation at engine construction: an invalid mode, a
+* non-function redact hook, or a malformed allowlist entry is a
+* ConfigError before any run can start under it.
+*/
+function validateDeterminismConfig(config) {
+	if (config === void 0) return;
+	if (config.mode !== void 0 && !MODES.has(config.mode)) throw new ConfigError(`determinism.mode must be 'off', 'warn', or 'error'; got '${String(config.mode)}'`);
+	if (config.allowlist !== void 0) {
+		for (const pattern of config.allowlist) if (typeof pattern !== "string" && !(pattern instanceof RegExp)) throw new ConfigError("determinism.allowlist entries must be strings (substring match) or RegExp values");
+	}
+	if (config.redact !== void 0 && typeof config.redact !== "function") throw new ConfigError("determinism.redact must be a function (frame: string) => string");
+}
+function resolveConfig(config) {
+	return {
+		mode: config?.mode ?? "warn",
+		allowlist: config?.allowlist ?? [],
+		redact: config?.redact ?? ((frame) => frame)
+	};
+}
+/**
+* The trailing `path:line:column` of a V8 stack frame, in both layouts:
+* `at fn (/abs/path.ts:12:5)` and `at file:///abs/path.ts:12:5`. Frames
+* without one (native frames, nested eval) yield undefined and the
+* event carries the frame string alone.
 */
-function libraryCaller() {
+const FRAME_LOCATION = /(?:\(|at\s)([^()]+):(\d+):(\d+)\)?\s*$/;
+function parseFrameLocation(frame) {
+	const match = FRAME_LOCATION.exec(frame);
+	if (match === null) return;
+	return {
+		file: match[1].replace(/\?.*$/, ""),
+		line: Number(match[2]),
+		column: Number(match[3])
+	};
+}
+function matchesAllowlist(frame, allowlist) {
+	return allowlist.some((pattern) => typeof pattern === "string" ? frame.includes(pattern) : pattern.test(frame));
+}
+/**
+* Stack line 0 names the Error, line 1 this observer, line 2 the patched
+* global, line 3 the caller whose provenance decides (the layout is
+* pinned by construction: the observer is only ever called by the two
+* patched globals). Two origins are exempt without configuration:
+* installed dependencies (a provider SDK, any transitive package,
+* rulvar's own published dist), which live under node_modules, and
+* Node's own machinery (the undici transport behind fetch, timers,
+* stream internals), whose frames carry `node:` specifiers and inherit
+* the run's async context. The guard exists for workflow code, which
+* imports from both but lives in neither.
+*/
+function observeBareCall(category) {
+	const state = detection.getStore();
+	if (state === void 0) return;
 	const caller = (/* @__PURE__ */ new Error()).stack?.split("\n")[3];
-	if (caller === void 0) return false;
-	return caller.includes("node_modules") || /[(\s]node:/.test(caller);
+	if (caller === void 0) return;
+	if (caller.includes("node_modules") || /[(\s]node:/.test(caller)) return;
+	const frame = caller.trim();
+	const provenance = matchesAllowlist(frame, state.config.allowlist) ? "allowlisted" : "workflow";
+	const location = parseFrameLocation(frame);
+	const redact = state.config.redact;
+	const redactedFile = location === void 0 ? void 0 : redact(location.file);
+	const dedupeKey = `${category}:${provenance}`;
+	if (!state.emitted.has(dedupeKey)) {
+		state.emitted.add(dedupeKey);
+		state.emit({
+			type: "determinism:warning",
+			category,
+			provenance,
+			frame: redact(frame),
+			...location === void 0 || redactedFile === void 0 ? {} : {
+				file: redactedFile,
+				line: location.line,
+				column: location.column
+			}
+		});
+		if (provenance === "workflow" && state.config.mode === "warn") {
+			const globalName = category === "bare-date-now" ? "Date.now()" : "Math.random()";
+			const shim = category === "bare-date-now" ? "ctx.now()" : "ctx.random()";
+			const at = location === void 0 ? "" : ` at ${redactedFile}:${location.line}:${location.column}`;
+			process.emitWarning(`bare ${globalName} called inside a rulvar run${at}; use ${shim} so the value is journaled and stable on replay`, {
+				code: category === "bare-date-now" ? "RULVAR_BARE_DATE_NOW" : "RULVAR_BARE_MATH_RANDOM",
+				type: "RulvarWarning"
+			});
+		}
+	}
+	if (provenance === "workflow" && state.config.mode === "error") {
+		const error = new DeterminismError(`bare ${category === "bare-date-now" ? "Date.now()" : "Math.random()"} called inside a rulvar run${location === void 0 ? "" : ` at ${redactedFile}:${location.line}:${location.column}`} under determinism.mode 'error'; use ${category === "bare-date-now" ? "ctx.now()" : "ctx.random()"} or allowlist the frame`, { data: {
+			category,
+			frame: redact(frame),
+			...location === void 0 || redactedFile === void 0 ? {} : {
+				file: redactedFile,
+				line: location.line,
+				column: location.column
+			}
+		} });
+		state.rejection ??= error;
+		throw error;
+	}
 }
 /**
 * Patches Date.now and Math.random ONCE per process and never restores:
-* outside a workflow's async context the store is absent and the patch is
-* a transparent passthrough. The previous per-execute patch/restore pair
-* could race under concurrent runs (one run's restore removed another's
-* patch, and the second restore re-installed a stale patched function
-* PERMANENTLY, which could then warn on host code outside any run: the
-* false RULVAR_BARE_DATE_NOW class the 1.5.2 review reproduced).
+* outside a detection context the store is absent and the patch is a
+* transparent passthrough.
 */
 function patchGlobalsOnce() {
 	if (globalsPatched) return;
@@ -14585,60 +14738,36 @@ function patchGlobalsOnce() {
 	const priorNow = Date.now;
 	const priorRandom = Math.random;
 	Date.now = function rulvarPatchedDateNow() {
-		const state = detection.getStore();
-		if (state !== void 0 && !state.warnedNow && !libraryCaller()) {
-			state.warnedNow = true;
-			process.emitWarning("bare Date.now() called inside a rulvar run; use ctx.now() so the value is journaled and stable on replay", {
-				code: "RULVAR_BARE_DATE_NOW",
-				type: "RulvarWarning"
-			});
-		}
+		observeBareCall("bare-date-now");
 		return priorNow();
 	};
 	Math.random = function rulvarPatchedMathRandom() {
-		const state = detection.getStore();
-		if (state !== void 0 && !state.warnedRandom && !libraryCaller()) {
-			state.warnedRandom = true;
-			process.emitWarning("bare Math.random() called inside a rulvar run; use ctx.random() so the value is journaled and stable on replay", {
-				code: "RULVAR_BARE_MATH_RANDOM",
-				type: "RulvarWarning"
-			});
-		}
+		observeBareCall("bare-math-random");
 		return priorRandom();
 	};
 }
 /**
-* The mode (a) runner for human-authored closures. Determinism is enforced
-* by convention, lint, and the ctx shims, NOT by a VM: only the sequence
-* of keys must be stable. Dev mode (NODE_ENV !== 'production') detects
-* bare Date.now and Math.random and emits one warning per run pointing at
-* ctx.now()/ctx.random(). Detection is attributed by AsyncLocalStorage:
-* only code inside the workflow body's async context can trigger it, so
-* host code running concurrently, engine internals outside the body, and
-* other runs never produce a false warning, and nothing is ever restored,
-* so concurrent executes cannot race the patch state.
+* Runs `fn` (the in-process execution of a workflow body) under
+* bare-nondeterminism detection. Detection is active for mode 'warn'
+* outside production and for mode 'error' everywhere; otherwise `fn`
+* runs untouched with zero overhead. In error mode, a workflow-origin
+* violation swallowed by the body is re-thrown after the body settles,
+* so the segment rejects either way.
 */
-var InProcessRunner = class {
-	onEscalation;
-	constructor(o) {
-		if (o?.onEscalation !== void 0) this.onEscalation = o.onEscalation;
-	}
-	/** The hook is read by the escalation delivery path from M3 onward. */
-	get escalationHook() {
-		return this.onEscalation;
-	}
-	async execute(wf, ctx, args) {
-		if (wf.kind !== "workflow") throw new TypeError("InProcessRunner executes closure Workflow values only; CompiledWorkflow runs in the worker sandbox (@rulvar/planner, M6)");
-		if (process.env.NODE_ENV !== "production") {
-			patchGlobalsOnce();
-			return detection.run({
-				warnedNow: false,
-				warnedRandom: false
-			}, () => wf.body(ctx, args));
-		}
-		return await wf.body(ctx, args);
-	}
-};
+function withDeterminismDetection(config, emit, fn) {
+	const resolved = resolveConfig(config);
+	if (!(resolved.mode === "error" || resolved.mode === "warn" && process.env.NODE_ENV !== "production")) return fn();
+	patchGlobalsOnce();
+	const state = {
+		config: resolved,
+		emit,
+		emitted: /* @__PURE__ */ new Set()
+	};
+	return detection.run(state, fn).then((result) => {
+		if (state.rejection !== void 0) throw state.rejection;
+		return result;
+	});
+}
 //#endregion
 //#region src/engine/engine.ts
 /**
@@ -14710,6 +14839,26 @@ function hashRunArgs(args) {
 	if (args === void 0) return;
 	return createHash("sha256").update(jcsSerialize(args), "utf8").digest("hex");
 }
+/**
+* sha256 hex over the JCS canonical serialization of a run's result
+* value: the digest the engine records as `outputHash` on the journaled
+* run-settle decision when the settling segment computed a value, and
+* the value `rulvar replay --compare-output-hash` compares a replayed
+* result against (RV-209). Best-effort by design: returns undefined for
+* undefined values and for values JCS cannot serialize (functions,
+* cycles, non-finite numbers), so an unhashable result records no
+* baseline rather than failing the settle. Like `hashRunArgs`, the
+* digest is deterministic and unsalted: treat it as sensitive-derived
+* metadata for low-entropy results.
+*/
+function hashRunOutput(value) {
+	if (value === void 0) return;
+	try {
+		return createHash("sha256").update(jcsSerialize(value), "utf8").digest("hex");
+	} catch {
+		return;
+	}
+}
 function createEngine(options) {
 	const adapters = buildAdapterRegistry(options.adapters);
 	const rawJournal = options.stores?.journal ?? new InMemoryStore();
@@ -14738,6 +14887,7 @@ function createEngine(options) {
 		if (profile.escalation?.minSpendUsd !== void 0) requireNonNegativeNumber(profile.escalation.minSpendUsd, `createEngine defaults.profiles['${name}'].escalation.minSpendUsd`);
 		if (profile.compaction?.threshold !== void 0) requireFraction(profile.compaction.threshold, `createEngine defaults.profiles['${name}'].compaction.threshold`);
 	}
+	validateDeterminismConfig(options.determinism);
 	const knowledgeStore = options.stores?.modelKnowledge;
 	const knowledge = knowledgeStore === void 0 ? void 0 : { current: () => knowledgeStore.current() };
 	const runner = new InProcessRunner(options.onEscalation === void 0 ? void 0 : { onEscalation: options.onEscalation });
@@ -14951,7 +15101,8 @@ function createEngine(options) {
 					if (!validation.valid) throw new ConfigError(`arguments for workflow '${wf.name}' do not validate: ` + validation.issues.map((issue) => issue.message).join("; "));
 				}
 				const ctx = createCtx(internals, wf.kind === "workflow" ? wf : void 0);
-				const bodyPromise = (compiled === void 0 ? runner : options.runners?.sandbox).execute(wf, ctx, args);
+				const selectedRunner = compiled === void 0 ? runner : options.runners?.sandbox;
+				const bodyPromise = compiled === void 0 ? withDeterminismDetection(options.determinism, (event) => bus.emit(event, rootSpanId), () => selectedRunner.execute(wf, ctx, args)) : selectedRunner.execute(wf, ctx, args);
 				const raced = await Promise.race([bodyPromise.then((result) => ({
 					kind: "done",
 					result
@@ -15020,19 +15171,23 @@ function createEngine(options) {
 				const priorCount = resumeCtx?.priorEntries.length ?? 0;
 				const appendedHere = replayer.snapshot().length - priorCount;
 				const recorded = lastRunSettle(replayer.snapshot());
-				if (appendedHere > 0 || recorded !== void 0 && recorded.runStatus !== status) await replayer.appendSinglePhase({
-					scope: "",
-					key: deriverV2.deriveKey({ kind: "run-settle" }),
-					kind: "decision",
-					status: "ok",
-					spanId: rootSpanId,
-					site: "run-settle",
-					value: {
-						decisionType: RUN_SETTLE_DECISION_TYPE,
-						runStatus: status,
-						segment: segmentsBefore + 1
-					}
-				}).catch(() => void 0);
+				if (appendedHere > 0 || recorded !== void 0 && recorded.runStatus !== status) {
+					const outputHash = hashRunOutput(outcome.value);
+					await replayer.appendSinglePhase({
+						scope: "",
+						key: deriverV2.deriveKey({ kind: "run-settle" }),
+						kind: "decision",
+						status: "ok",
+						spanId: rootSpanId,
+						site: "run-settle",
+						value: {
+							decisionType: RUN_SETTLE_DECISION_TYPE,
+							runStatus: status,
+							segment: segmentsBefore + 1,
+							...outputHash === void 0 ? {} : { outputHash }
+						}
+					}).catch(() => void 0);
+				}
 			}
 			await putMeta(status).catch(() => void 0);
 			bus.emit({
@@ -15511,4 +15666,4 @@ function createSandboxBridge(ctx, options) {
 	};
 }
 //#endregion
-export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DedupIndex, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GitWorktreeProvider, INBOX_PROPOSAL_TTL_DAYS, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, PlanInvariantError, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SpanRegistry, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readRunMeta, readTerminationInit, reconcileRunMeta, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, requiredFieldsValidator, requiredSectionsValidator, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GitWorktreeProvider, INBOX_PROPOSAL_TTL_DAYS, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, PlanInvariantError, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SpanRegistry, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readRunMeta, readTerminationInit, reconcileRunMeta, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, requiredFieldsValidator, requiredSectionsValidator, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/core",
-  "version": "1.49.0",
+  "version": "1.50.0",
   "description": "Rulvar core: L0 contracts, journal kernel, ctx primitives, agent runtime, model router, tool system, dynamic orchestrator, InMemory and JSONL stores, event stream.",
   "type": "module",
   "license": "Apache-2.0",