@tangle-network/agent-runtime 0.128.0 → 0.131.1

package/dist/{index-BhZhQw77.d.ts → index-CoO7atyo.d.ts}

@@ -1,14 +1,14 @@
-import { d as AgentTaskStatus, f as BackendErrorDetail, i as AgentExecutionBackend, x as RuntimeStreamEvent } from "./types-C9j4qg6l.js";
+import { C as MountRecorder, D as SelectionReceipt, E as SandboxClient, a as Iteration, b as LoopTraceEvent, d as LoopLineageOptions, i as ExecCtx, it as RuntimeStreamEvent, k as Validator, m as LoopResult, r as Driver, t as AgentRunSpec, w as OutputAdapter, x as LoopWinner, y as LoopTraceEmitter } from "./types-ebIY0dMG.js";
 import { n as AnalystRegistryLike } from "./types-zWfqDjeL.js";
 import { l as RuntimeHooks } from "./runtime-hooks-sbRpjStq.js";
-import { C as MountRecorder, D as SelectionReceipt, E as SandboxClient, a as Iteration, b as LoopTraceEvent, d as LoopLineageOptions, i as ExecCtx, k as Validator, m as LoopResult, r as Driver, t as AgentRunSpec, w as OutputAdapter, x as LoopWinner, y as LoopTraceEmitter } from "./types-DnNGJ5Gz.js";
-import { B as DefaultVerdict, Cn as PendingWait, Ct as SupervisedResult, En as WaitProbeRegistry, Et as TreeView, Gn as ExecutorProgress, H as Executor, I as Agent, K as ExecutorFactory, L as AgentExecutionRef, Nt as WorkerTraceResolver, Ot as UsageEvent, R as AgentSpec, Rn as TraceSource, Rt as TraceContext, St as SteerableRootHandle, V as ExecutionBindingReceipt, Xt as OtelExportConfig, Y as ExecutorRegistry, Zt as OtelExporter, _t as SpawnJournal, at as ProfileMaterializationReceipt, ct as ResumedKeyState, gt as SpawnEvent, ht as Settled, i as AgentEnvironmentProvider, jt as WorkerTraceEvidence, mt as Scope, nt as NodeId, o as AgentEnvironmentProviderRegistry, pt as Runtime, qn as WorkerProgress, rt as NodeSnapshot, st as ResultBlobStore, tt as NodeExecutionIdentity, ut as RootHandle, vt as SpawnOpts, w as ProviderExecutorOptions, wt as Supervisor, xt as Spend, z as Budget } from "./environment-provider-CUFsyymu.js";
+import { B as Spend, D as ResumedKeyState, E as ResultBlobStore, F as SpawnEvent, G as TreeView, Gt as WaitProbeRegistry, H as SupervisedResult, Ht as PendingWait, I as SpawnJournal, L as SpawnOpts, M as Runtime, N as Scope, P as Settled, Q as WorkerTraceResolver, S as NodeSnapshot, U as Supervisor, V as SteerableRootHandle, X as WorkerTraceEvidence, a as DefaultVerdict, b as NodeExecutionIdentity, d as ExecutorFactory, fn as WorkerProgress, gt as OtelExporter, h as ExecutorResult, ht as OtelExportConfig, i as Budget, k as RootHandle, m as ExecutorRegistry, n as AgentExecutionRef, o as ExecutionBindingReceipt, q as UsageEvent, r as AgentSpec, rn as TraceSource, rt as TraceContext, s as Executor, t as Agent, w as ProfileMaterializationReceipt, x as NodeId } from "./types-C6Q-J0Dt.js";
 import { o as UiLens, r as UiFinding, s as CoderTask } from "./substrate-BcnuSHXm.js";
-import { E as ToolLoopCompactionOptions, f as runLocalHarness, h as RouterConfig, n as CodexExecutionPolicy, o as LocalHarness, r as CodexTokenUsage, v as ToolSpec, w as ToolLoopChat } from "./local-harness-BIajef4A.js";
-import { AgentEvalError, AgentEvalError as AgentEvalError$1, AgentEvalErrorCode, AgentProfile, AnalystFinding, AnalystFinding as AnalystFinding$1, AnalystFinding as AnalystFinding$2, AnalystRunInputs, ChatClient, ConfigError, DetectorSignal, HarnessType, JudgeError, MaximumCharge, NotFoundError, ProposalFinding, RankTestMethod, RunRecord, StreamingDetector, ToolSpan, TraceAnalysisStore, ValidationError, buildTrajectory, computeFindingId as computeFindingId$1, makeFinding as makeFinding$1 } from "@tangle-network/agent-eval";
-import { DispatchFn, JudgeConfig, ProfileDispatchFn, RunProfileMatrixOptions, RunProfileMatrixResult, Scenario } from "@tangle-network/agent-eval/campaign";
-import { AGENT_PROFILE_MATERIALIZATION_AXES, AgentProfile as AgentProfile$1, AgentProfile as AgentProfile$2, AgentProfile as AgentProfile$3, AgentProfileMcpServer, AgentProfileModelHints, AgentProfilePrompt, AgentProfileResources, AgentProfileSecurityPolicy, CanonicalAgentProfileMaterializationAxis, Sha256Digest, profileMaterializationAxes } from "@tangle-network/agent-interface";
-import { WorkspacePlanReceipt } from "@tangle-network/agent-profile-materialize";
+import { B as GitRunner, C as WorktreeHarnessResult, I as runLocalHarness, K as RouterTransportConfig, Y as ToolLoopChat, Z as ToolLoopCompactionOptions, a as ExecutorConfig, c as RouterToolsSeam, q as ToolSpec, v as Inbox, x as WorktreeCheckRunner } from "./runtime-D-QfLbSd.js";
+import "./environment-provider-CxvSd1W6.js";
+import "./stream-agent-turn-C852AgMT.js";
+import { AgentEvalError, AgentEvalError as AgentEvalError$1, AgentEvalErrorCode, AgentProfile, AnalystFinding, AnalystFinding as AnalystFinding$1, AnalystFinding as AnalystFinding$2, AnalystRunInputs, ChatClient, ConfigError, CustomTokenPricing, DetectorSignal, HarnessType, JudgeError, MaximumCharge, NotFoundError, ProposalFinding, RankTestMethod, RunRecord, StreamingDetector, ToolSpan, TraceAnalysisStore, ValidationError, buildTrajectory, computeFindingId as computeFindingId$1, makeFinding as makeFinding$1 } from "@tangle-network/agent-eval";
+import { DispatchFn, ExternalOptimizerModelCall, JudgeConfig, ProfileDispatchFn, RunProfileMatrixOptions, RunProfileMatrixResult, Scenario } from "@tangle-network/agent-eval/campaign";
+import { AGENT_PROFILE_MATERIALIZATION_AXES, AgentProfile as AgentProfile$1, AgentProfile as AgentProfile$2, AgentProfile as AgentProfile$3, AgentProfileMcpServer, AgentProfilePrompt, AgentProfileSecurityPolicy, CanonicalAgentProfileMaterializationAxis, Sha256Digest, profileMaterializationAxes as profileMaterializationAxes$1 } from "@tangle-network/agent-interface";
 import { BackendType, CreateSandboxOptions, CreateSandboxOptions as CreateSandboxOptions$1, PromptOptions, SandboxEvent, SandboxEvent as SandboxEvent$1, SandboxInstance, SandboxInstance as SandboxInstance$1 } from "@tangle-network/sandbox";
 import { stuckLoopView, toolWasteView } from "@tangle-network/agent-eval/pipelines";
 //#region src/agent/profile-materialization.d.ts
@@ -73,10 +73,10 @@ declare const promptControlProfileMaterialization: ProfileMaterializationContrac
  * Materialization contract for `createSandboxAct`.
  *
  * `createSandboxAct` hands the whole `AgentProfile` to the sandbox as `backend.profile`, so every
- * profile leaf crosses the boundary. `buildBackendOptions` resolves the runner from an explicit
- * `sandboxOverrides.backend.type`, then `profile.metadata.backendType`, then `profile.harness`,
- * so a candidate that changes only `harness` runs on the harness it declares — and one declaring
- * a harness the sandbox cannot run throws rather than running elsewhere and reporting success.
+ * profile leaf crosses the boundary. `buildBackendOptions` resolves the runner only from
+ * `profile.harness`; an explicit `sandboxOverrides.backend.type` may confirm that choice but cannot
+ * replace it. A candidate declaring a harness the sandbox cannot run throws rather than running
+ * elsewhere and reporting success.
  */
 declare const sandboxActProfileMaterialization: ProfileMaterializationContract;
 /** Materialization contract for a run path that only injects prompt text. */
@@ -157,6 +157,8 @@ interface SpawnForest {
  * In-memory `ResultBlobStore`. Content-addressed: `put` verifies the supplied
  * `outRef` matches the artifact's hash so a stale/forged ref fails loud rather than
  * silently rehydrating the wrong payload. Idempotent on an identical re-put.
+ *
+ * @stable
  */
 declare class InMemoryResultBlobStore implements ResultBlobStore {
   private readonly blobs;
@@ -167,6 +169,8 @@ declare class InMemoryResultBlobStore implements ResultBlobStore {
  * FS `ResultBlobStore`. One JSON file per artifact under `dir`, named by a
  * filesystem-safe encoding of the `outRef` (`sha256:<hex>` → `sha256-<hex>.json`).
  * `put` fsyncs so a crash between writes never loses an acknowledged blob.
+ *
+ * @stable
  */
 declare class FileResultBlobStore implements ResultBlobStore {
   private readonly dir;
@@ -181,6 +185,8 @@ declare class FileResultBlobStore implements ResultBlobStore {
  *  - an event before `beginTree` is a corrupted tree (fail loud),
  *  - a duplicate `seq` within a tree is a corrupted cursor (fail loud) — two
  *    settlements cannot share the cursor position replay orders by.
+ *
+ * @stable
  */
 declare class InMemorySpawnJournal implements SpawnJournal {
   private readonly trees;
@@ -194,6 +200,8 @@ declare class InMemorySpawnJournal implements SpawnJournal {
  * filtering by `root`, and applies the same begin-precedes-events + unique-seq
  * corruption guards as the in-memory impl. Each append fsyncs so a crash between
  * writes never loses an acknowledged event.
+ *
+ * @stable
  */
 declare class FileSpawnJournal implements SpawnJournal {
   private readonly path;
@@ -234,6 +242,8 @@ declare function loadSpawnForest(journal: SpawnJournal, root: NodeId): Promise<S
  * resolves. `at` (wall-clock) is never a replay input. Fail loud on a tree that was
  * never begun, a settled-done event missing its `outRef`, or a blob the store can't
  * rehydrate — a silent gap would let `act` branch on the wrong evidence.
+ *
+ * @stable
  */
 declare function replaySpawnTree(journal: SpawnJournal, blobs: ResultBlobStore, root: NodeId): Promise<Settled<unknown>[]>;
 /**
@@ -270,6 +280,18 @@ interface DeliverableSpec<Out = unknown> {
  * executor has produced its output. The inner `score` is preserved; only `valid` is gated.
  */
 declare function gateOnDeliverable<Out>(inner: Executor<Out>, deliverable: DeliverableSpec<Out>): Executor<Out>;
+interface ExecutorResultMapping<Out> {
+  outRef: string;
+  out: Out;
+  verdict?: DefaultVerdict;
+}
+/**
+ * Transform a Runtime executor's terminal artifact without losing its private
+ * profile-materialization attestation or altering its measured spend. This is
+ * the composition point for deterministic post-processing and grading; callers
+ * must not rebuild an Executor around a model transport merely to change `out`.
+ */
+declare function mapExecutorResult<In, Out>(inner: Executor<In>, map: (result: ExecutorResult<In>, task: unknown) => ExecutorResultMapping<Out> | Promise<ExecutorResultMapping<Out>>): Executor<Out>;
 //#endregion
 //#region src/runtime/supervise/detector-monitor.d.ts
 interface WatchTraceOptions {
@@ -343,6 +365,9 @@ interface BusStats {
   /** Count published per event `type`. */
   readonly byKind: Readonly<Record<string, number>>;
 }
+/** The child→parent coordination bus surface: publish, priority-ordered pull, pass-through subscribe, history, and stats.
+ * @experimental In-process only — the durable cross-process mailbox this interface is designed
+ * to admit is not implemented (docs/agent-managed-compute/README.md). */
 interface EventBus<E extends BusEvent> {
   /** Stamp the event, await every subscriber in order, then make it pull-visible. A subscriber
    *  failure leaves the event invisible and retrying the SAME event object reuses the exact stamp.
@@ -361,7 +386,8 @@ interface EventBus<E extends BusEvent> {
   /** Throughput counters for observability dashboards. */
   stats(): BusStats;
 }
-/** Create the child→parent coordination bus: one typed pipe for settled outputs, questions, and analyst findings, with a priority-ordered pull queue and a pass-through subscribe lane. */
+/** Create the child→parent coordination bus: one typed pipe for settled outputs, questions, and analyst findings, with a priority-ordered pull queue and a pass-through subscribe lane.
+ * @experimental In-process queue; durability is a transport swap that does not exist yet. */
 declare function createEventBus<E extends BusEvent>(now?: () => number): EventBus<E>;
 //#endregion
 //#region src/mcp/detached-coder.d.ts
@@ -445,7 +471,7 @@ declare class PlannerError extends AgentEvalError {
 }
 //#endregion
 //#region src/mcp/delegation-store.d.ts
-/** @experimental */
+/** @stable */
 interface DelegationStore {
   /**
    * Read every persisted record. Called once, by
@@ -474,7 +500,7 @@ interface DelegationStore {
  * (the bin maps `AGENT_RUNTIME_DELEGATION_STATE_RECOVER=1` onto it),
  * which archives the corrupt file and starts fresh.
  *
- * @experimental
+ * @stable
  */
 declare class DelegationStateCorruptError extends AgentEvalError$1 {
   constructor(message: string, options?: {
@@ -487,14 +513,14 @@ declare class DelegationStateCorruptError extends AgentEvalError$1 {
  * accepting new submissions — accepting work it cannot journal would
  * silently demote durable mode to in-memory mode.
  *
- * @experimental
+ * @stable
  */
 declare class DelegationPersistenceError extends AgentEvalError$1 {
   constructor(message: string, options?: {
     cause?: unknown;
   });
 }
-/** In-memory `DelegationStore` — suitable for single-process use and tests. @experimental */
+/** In-memory `DelegationStore` — suitable for single-process use and tests. @stable */
 declare class InMemoryDelegationStore implements DelegationStore {
   private readonly records;
   loadAll(): Promise<DelegationRecord[]>;
@@ -502,7 +528,7 @@ declare class InMemoryDelegationStore implements DelegationStore {
   lookupIdempotencyKey(key: string): Promise<string | undefined>;
   remove(taskIds: readonly string[]): Promise<void>;
 }
-/** @experimental */
+/** @stable */
 interface FileDelegationStoreOptions {
   /** Absolute path of the JSON state file. Parent directories are created on first write. */
   filePath: string;
@@ -524,7 +550,7 @@ interface FileDelegationStoreOptions {
  * records): full-snapshot writes keep the format trivially inspectable
  * and corruption-detectable without a database dependency.
  *
- * @experimental
+ * @stable
  */
 declare class FileDelegationStore implements DelegationStore {
   private readonly filePath;
@@ -656,9 +682,8 @@ interface DelegateCodeArgs {
   /** Optional free-form context the agent surfaces in the prompt prelude. */
   contextHint?: string;
   /**
-   * When > 1, dispatches `multiHarnessCoderFanout` across N harnesses
-   * (claude-code, codex, opencode-glm) and picks the highest-scoring
-   * passing patch. Default 1.
+   * When > 1, dispatches `multiHarnessCoderFanout` across the delegate's configured exact profiles
+   * and picks the highest-scoring passing patch. Default 1.
    */
   variants?: number;
   /** Validator + prompt overrides the agent knows for this repo. */
@@ -904,13 +929,13 @@ interface DelegationHistoryResult {
 }
 //#endregion
 //#region src/mcp/task-queue.d.ts
-/** Arguments accepted by the durable delegation queue. @experimental */
+/** Arguments accepted by the durable delegation queue. @stable */
 type DelegationArgs = DelegateCodeArgs | DelegateResearchArgs | DelegateUiAuditArgs;
 /**
  * Must be JSON-safe end to end (`args`, `result`, `error`, `feedback`) —
  * persistent stores round-trip records through `JSON.stringify`.
  *
- * @experimental
+ * @stable
  */
 interface DelegationRecord {
   taskId: string;
@@ -954,7 +979,7 @@ interface DelegationRecord {
   /** Caller span that dispatched the delegation, when one was inherited. */
   parentSpanId?: string;
 }
-/** @experimental */
+/** @stable */
 interface SubmitInput<Args extends DelegationArgs> {
   profile: DelegationProfile;
   args: Args;
@@ -975,7 +1000,7 @@ interface SubmitInput<Args extends DelegationArgs> {
    */
   run: (ctx: DelegationRunContext) => Promise<DelegationResultPayload['output']>;
 }
-/** @experimental Context handed to a `SubmitInput.run` function. */
+/** @stable Context handed to a `SubmitInput.run` function. */
 interface DelegationRunContext {
   signal: AbortSignal;
   report(progress: DelegationProgress): void;
@@ -1000,7 +1025,7 @@ interface DelegationRunContext {
    */
   traceEmitter?: LoopTraceEmitter;
 }
-/** @experimental */
+/** @stable */
 interface SubmitOutput {
   taskId: string;
   /** True when a prior matching `idempotencyKey` returned an existing record. */
@@ -1012,7 +1037,7 @@ interface SubmitOutput {
  * completed | running | failed per pass). `running` schedules another tick
  * after `intervalMs`; `completed` / `failed` settle the record.
  *
- * @experimental
+ * @stable
  */
 type DelegationResumeTick = {
   state: 'running';
@@ -1024,7 +1049,7 @@ type DelegationResumeTick = {
   state: 'failed';
   error: DelegationError;
 };
-/** @experimental */
+/** @stable */
 interface DelegationResumeContext {
   /** Fired by `cancel(taskId)`; the driver should stop the remote run when it can. */
   signal: AbortSignal;
@@ -1038,7 +1063,7 @@ interface DelegationResumeContext {
  * thrown error settles the record as failed; `failed` ticks are treated as
  * terminal and are not retried.
  *
- * @experimental
+ * @stable
  */
 interface DelegationResumeDriver {
   tick(task: {
@@ -1048,7 +1073,7 @@ interface DelegationResumeDriver {
   /** Delay between `running` ticks, in milliseconds. Default 5000. */
   intervalMs?: number;
 }
-/** @experimental */
+/** @stable */
 interface DelegationTaskQueueOptions {
   /** ID generator override; default `randomTaskId`. */
   generateId?: () => string;
@@ -1086,7 +1111,7 @@ interface DelegationTaskQueueOptions {
    */
   traceContext?: TraceContext;
 }
-/** In-process queue for async delegation tasks — submit, cancel, poll status, and read history. @experimental */
+/** In-process queue for async delegation tasks — submit, cancel, poll status, and read history. @stable */
 declare class DelegationTaskQueue {
   private readonly records;
   private readonly controllers;
@@ -1182,7 +1207,7 @@ declare class DelegationTaskQueue {
  * Best-effort stable hash for use as `idempotencyKey`. Not cryptographic;
  * collisions only affect dedupe, never correctness.
  *
- * @experimental
+ * @stable
  */
 declare function hashIdempotencyInput(value: unknown): string;
 //#endregion
@@ -1289,8 +1314,8 @@ interface RunDetachedTurnOptions {
    * `'detached-turn'`) so trace-context inheritance survives the detached
    * path — the same events the streaming `runAgentRounds` path would emit, minus
    * per-token telemetry: `driveTurn` yields one terminal payload, so token
-   * and cost figures are structurally unavailable and reported as 0 under
-   * this driver tag.
+   * and cost figures are structurally unavailable; zero observed subtotals are
+   * marked incomplete under this driver tag.
    */
   traceEmitter?: LoopTraceEmitter;
   /** Physical placement stamped on the synthesized dispatch event. Default `'sibling'`. */
@@ -1459,10 +1484,8 @@ interface DelegateRunCtx {
 type CoderDelegate = (args: DelegateCodeArgs, ctx: DelegateRunCtx) => Promise<CoderOutput>;
 /**
  * UI-auditor delegate — fully consumer-injected. agent-runtime ships no
- * default factory because the inputs are workspace path + judge function
- * + (optionally) a `SandboxClient`, and the judge is the consumer's
- * model seam. See `createInProcessUiAuditClient` + `uiAuditorProfile` in
- * `@tangle-network/agent-runtime/profiles` for the canonical wiring.
+ * default factory because execution belongs to a caller-supplied exact
+ * agent profile and Runtime executor.
  *
  * @experimental
  */
@@ -1513,27 +1536,13 @@ interface DetachedSessionDelegateOptions {
    */
   sandboxClient?: SandboxClient;
   /**
-   * The worker's authored `AgentProfile` (§1.5: the system authors profiles). Spread onto the
-   * sandbox-session run spec → `runAgentRounds` → the executor's `harnessInvocation`, so the harness runs
-   * under the caller's stance. Omit to use a minimal model-only default (no hardcoded skills/tools);
-   * `harness` / `model` / `systemPrompt` below are convenience overrides layered onto whichever
-   * profile is used.
-   */
-  workerProfile?: AgentProfile$1;
-  /** Backend harness for the single-coder path (sets `metadata.backendType`). Default `claude-code`. */
-  harness?: string;
-  /** Model override for the single-coder path. */
-  model?: string;
-  /**
-   * The worker's authored system prompt (§1.5). Flows onto the run spec's
-   * `profile.prompt.systemPrompt` → through `runAgentRounds` → the executor's `harnessInvocation`, so the
-   * harness runs under this stance. Omit to keep the profile's own prompt.
+   * The worker's exact authored `AgentProfile` (§1.5: the system authors profiles). It is the sole
+   * harness/provider/model/prompt authority for the single-coder path and the default identity for
+   * repeated fanout shots.
    */
-  systemPrompt?: string;
-  /** Default `['claude-code', 'codex', 'opencode/zai-coding-plan/glm-5.1']` when variants > 1. */
-  fanoutHarnesses?: string[];
-  /** Optional per-harness model override for `variants > 1`. */
-  fanoutModels?: (string | undefined)[];
+  workerProfile: AgentProfile$1;
+  /** Optional exact identities for heterogeneous fanout. Omit to repeat `workerProfile`. */
+  fanoutProfiles?: ReadonlyArray<AgentProfile$1>;
   /** Hard cap on the kernel's per-batch concurrency. Default 4. */
   maxConcurrency?: number;
   /**
@@ -1595,8 +1604,6 @@ interface SettleDetachedCoderTurnOptions {
   /** Session id of the detached turn — used as the synthesized event id. */
   sessionId: string;
   signal: AbortSignal;
-  harness?: string;
-  model?: string;
   /** Same gate as the streaming path: an unapproved candidate cannot win. */
   reviewer?: CoderReviewer;
 }
@@ -1618,7 +1625,7 @@ interface SettleDetachedCoderTurnOptions {
 declare function settleDetachedCoderTurn(turn: DetachedTurn, options: SettleDetachedCoderTurnOptions): Promise<CoderOutput>;
 //#endregion
 //#region src/mcp/feedback-store.d.ts
-/** @experimental */
+/** @stable */
 interface FeedbackEvent {
   id: string;
   refersTo: DelegateFeedbackArgs['refersTo'];
@@ -1627,7 +1634,7 @@ interface FeedbackEvent {
   capturedAt: string;
   namespace?: string;
 }
-/** @experimental */
+/** @stable */
 interface FeedbackStore {
   /** Append a new event. Never dedupes — every rating is its own event. */
   put(event: FeedbackEvent): Promise<void>;
@@ -1640,7 +1647,7 @@ interface FeedbackStore {
     refersToRef?: string;
   }): Promise<FeedbackEvent[]>;
 }
-/** In-memory `FeedbackStore` — suitable for single-process use and tests. @experimental */
+/** In-memory `FeedbackStore` — suitable for single-process use and tests. @stable */
 declare class InMemoryFeedbackStore implements FeedbackStore {
   private readonly events;
   put(event: FeedbackEvent): Promise<void>;
@@ -1653,7 +1660,7 @@ declare class InMemoryFeedbackStore implements FeedbackStore {
  * Project a `FeedbackEvent` down to the snapshot shape carried on
  * `delegation_history` entries.
  *
- * @experimental
+ * @stable
  */
 declare function eventToSnapshot(event: FeedbackEvent): DelegationFeedbackSnapshot;
 //#endregion
@@ -1697,570 +1704,12 @@ interface JsonRpcResponse {
   };
 }
 //#endregion
-//#region src/mcp/worktree.d.ts
-/**
- *
- * Git worktree helpers for the in-process delegation executor. Each
- * delegation runs in its own worktree so multiple parallel harness
- * subprocesses (claude / codex / opencode in a 3-way fanout) don't clobber
- * each other's edits on the shared workspace.
- *
- * Worktrees live under `<repoRoot>/.agent-worktrees/<runId>/`. After the
- * harness exits + the diff is captured, the worktree is removed.
- *
- * All operations spawn `git` via `child_process.spawn` synchronously
- * (via a `runGit` helper). Stays narrow on purpose: no commits, no rebases.
- * Diff capture stages all changes (`git add -A`) into the ephemeral worktree's
- * index so created (untracked) files appear in the `--cached` diff.
- *
- * @experimental
- */
-/** @experimental */
-interface WorktreeHandle {
-  /** Absolute path to the worktree directory. */
-  path: string;
-  /** SHA the worktree was created at. */
-  baseSha: string;
-  /** Branch name created for this worktree (typically `delegate/<runId>`). */
-  branch: string;
-}
-/** @experimental */
-interface CreateWorktreeOptions {
-  /** Absolute path to the main git checkout. */
-  repoRoot: string;
-  /** Unique id for the worktree path + branch. Use the delegation run id. */
-  runId: string;
-  /** Parent directory the worktree lives under. Defaults to `.agent-worktrees`. */
-  variantsDir?: string;
-  /** Override the base ref (default `HEAD`). */
-  baseRef?: string;
-  /** Test seam — inject a custom git runner. */
-  runGit?: GitRunner;
-}
-/** @experimental */
-interface DiffOptions {
-  /** Worktree to diff. */
-  worktree: WorktreeHandle;
-  /** What to compare against. Default `worktree.baseSha`. */
-  baseRef?: string;
-  /**
-   * Repository-relative input paths to omit from the captured worker patch.
-   * Paths are passed to Git with literal exclusion magic, so profile-provided
-   * `*`, `?`, `[` and `:` characters can never expand into broader pathspecs.
-   */
-  excludePaths?: ReadonlyArray<string>;
-  /** Test seam. */
-  runGit?: GitRunner;
-}
-/** @experimental */
-interface DiffResult {
-  patch: string;
-  stats: {
-    filesChanged: number;
-    insertions: number;
-    deletions: number;
-  };
-}
-/** @experimental */
-interface RemoveWorktreeOptions {
-  worktree: WorktreeHandle;
-  repoRoot: string;
-  /** Force removal even if dirty (default true; the loser of a fanout has uncommitted changes). */
-  force?: boolean;
-  /** Test seam. */
-  runGit?: GitRunner;
-}
-/** Pluggable git runner (sync) — replaceable in tests. */
-type GitRunner = (args: ReadonlyArray<string>, opts: {
-  cwd: string;
-}) => {
-  stdout: string;
-  stderr: string;
-  exitCode: number;
-};
-/** Checkout a fresh git worktree for a delegation run on a new branch under `variantsDir`. @experimental */
-declare function createWorktree(options: CreateWorktreeOptions): Promise<WorktreeHandle>;
-/** Stage worker changes and return the diff + shortstat, excluding declared input paths. @experimental */
-declare function captureWorktreeDiff(options: DiffOptions): Promise<DiffResult>;
-/**
- * Remove a git worktree and delete its branch. Already-removed paths are harmless; every other
- * Git failure rejects so callers cannot report a worktree as destroyed when cleanup failed.
- * @experimental
- */
-declare function removeWorktree(options: RemoveWorktreeOptions): Promise<void>;
-//#endregion
-//#region src/mcp/worktree-harness.d.ts
-/** Outcome of one verification command run in the worktree (test or typecheck). */
-interface WorktreeCommandResult {
-  /** The shell command line that was run. */
-  command: string;
-  /** Did the command exit 0? The PASS signal a deliverable gate / coder output reads. */
-  passed: boolean;
-  /** OS exit code, or `null` when killed before exit. */
-  exitCode: number | null;
-  /** Combined stdout+stderr (capped) — surfaced in traces for diagnosis. */
-  output: string;
-}
-/** Proof of the profile inputs delivered before the worker process started. */
-interface WorktreeProfileMaterializationReceipt {
-  /** Digest of the exact materializer plan: files, modes, environment, flags, and unsupported rows. */
-  workspacePlanDigest: string;
-  /** Repository-relative profile input files written into the worker worktree. */
-  writtenPaths: string[];
-  /** Must be empty on a successful run because this path fails closed. */
-  unsupported: WorkspacePlanReceipt['unsupported'];
-  /** Environment variable names added to the worker process. Values remain out of telemetry. */
-  environmentNames: string[];
-  /** Exact additional CLI arguments emitted by the materializer. */
-  flags: string[];
-  /** `resources.instructions` bypasses native project files so reproducible Codex cannot drop it. */
-  resourceInstructions: {
-    delivery: 'none' | 'invocation-prompt';
-    sha256: string | null;
-    byteLength: number;
-  };
-}
-/** The canonical result of one worktree-harness run, projected by each port to its own shape. */
-interface WorktreeHarnessResult {
-  /** The branch the worktree was cut on (`delegate/<runId>`). */
-  branch: string;
-  /** `git diff` of the worktree against its base — the unified patch the harness produced. */
-  patch: string;
-  /** Shortstat-derived change counts. */
-  stats: {
-    filesChanged: number;
-    insertions: number;
-    deletions: number;
-  };
-  /**
-   * Exact profile materialization applied before the harness launched.
-   * Absent on transports that cannot return a materializer receipt; never fabricated.
-   */
-  profileMaterialization?: WorktreeProfileMaterializationReceipt;
-  /** The harness subprocess outcome. */
-  harness: {
-    name: LocalHarness | 'bridge';
-    exitCode: number | null;
-    timedOut: boolean;
-    killedBySignal: NodeJS.Signals | null;
-    durationMs: number;
-    stdout: string;
-    stderr: string;
-    /** Exact Codex JSONL usage when reproducible mode is enabled. */
-    usage?: CodexTokenUsage;
-    /** Installed CLI version captured immediately before execution. */
-    cliVersion?: string;
-    /** SHA-256 of the native Codex executable staged read-only in the candidate worktree. */
-    executableSha256?: string;
-    /** SHA-256 of the exact composed prompt argument proved present in Codex's rendered prompt. */
-    requestedPromptSha256?: string;
-    /** SHA-256 of `codex debug prompt-input` output for the exact isolated prompt. */
-    effectivePromptSha256?: string;
-    /** SHA-256 of the exact executable + argv with prompt content replaced by `<PROMPT>`. */
-    nonPromptArgsSha256?: string;
-    /** SHA-256 of the isolated config that fixes permissions and shell environment. */
-    controlledConfigSha256?: string;
-    /** SHA-256 of the normalized caller-supplied host read-denial paths. */
-    readDeniedPathsSha256?: string;
-    /** Sorted normalized caller-supplied host read-denial paths. */
-    readDeniedPaths?: string[];
-    /** Number of normalized caller-supplied host read-denial paths. */
-    readDeniedPathCount?: number;
-    /** Explicit isolation claims checked before model execution. */
-    executionPolicy?: CodexExecutionPolicy;
-  };
-  /** Verification signals derived in the live worktree (present only when commands were given). */
-  checks?: {
-    tests?: WorktreeCommandResult;
-    typecheck?: WorktreeCommandResult;
-  };
-}
-/** The single shell-command-in-worktree runner seam (replaces the per-executor copies). */
-type WorktreeCheckRunner = (opts: {
-  command: string;
-  cwd: string;
-  timeoutMs: number;
-  signal?: AbortSignal;
-}) => Promise<{
-  exitCode: number | null;
-  output: string;
-}>;
-//#endregion
-//#region src/runtime/supervise/inbox.d.ts
-/**
- *
- * The worker-side receive end of the down-leg: a per-worker inbox an executor exposes as
- * `Executor.deliver`. The driver's `steer_agent` / `answer_question` land here,
- * and the worker's agent loop drains them at two points (Drew's two delivery modes):
- *
- *   - QUEUED (default): the message accumulates and is FLUSHED at the next step boundary — folded
- *     into the conversation before the next think. A worker is also forced to flush BEFORE it may
- *     settle, so it can never finish while a steer/answer it never read is still pending.
- *   - FORCEFUL (`interrupt: true`): trips `freshInterrupt()`'s signal so the loop can abort its
- *     in-flight turn immediately, then re-plan with the message folded in — breaking the worker out
- *     of a wrong path mid-task instead of waiting for it to finish the step.
- *
- * `deliver` never throws — a malformed message is ignored and returns `false`, so no caller can
- * report delivery for bytes this inbox discarded.
- *
- * @experimental
- */
-interface InboxMessage {
-  readonly kind: 'steer' | 'answer';
-  readonly text: string;
-  /** Forceful messages abort the in-flight turn; queued ones wait for the boundary flush. */
-  readonly interrupt: boolean;
-  /** Present for an `answer` — the question id it resolves. */
-  readonly questionId?: string;
-}
-interface Inbox {
-  /** The `Executor.deliver` implementation. Returns false when the raw message is malformed and
-   * therefore was not queued; callers must not acknowledge a message this inbox discarded. */
-  deliver(msg: unknown): boolean;
-  /** Remove and return all pending messages (the flush). */
-  drain(): InboxMessage[];
-  pending(): number;
-  /** Open a fresh per-turn interrupt signal; a later forceful `deliver` aborts it. The loop links
-   *  this into the signal it passes to its inference call, then re-plans when it fires. */
-  freshInterrupt(): AbortSignal;
-  /** Render drained messages as ONE operator turn to fold into the worker's conversation. */
-  fold(messages: ReadonlyArray<InboxMessage>): string;
-}
-/** Create the worker-side inbox for the down-leg: the driver's `steer_agent` / `answer_question` messages queue here and the worker's loop drains them at step boundaries and before settle. */
-declare function createInbox(): Inbox;
-//#endregion
-//#region src/runtime/supervise/sandbox-session.d.ts
-/** Ceiling on continuation turns. Turn 0 is the task; every later turn is a folded steer, so
- *  this bounds how many times a supervisor may redirect ONE worker before it must respawn. */
-declare const DEFAULT_SANDBOX_STEERING_MAX_TURNS = 24;
-/** Opt-in configuration for the steerable sandbox worker (`SandboxSeam.steering`). Absent, the
- *  sandbox executor keeps its historical single-shot `runAgentRounds` composition verbatim. */
-interface SandboxSteeringOptions {
-  /** Max turns for one worker (turn 0 + folded steers). Default {@link DEFAULT_SANDBOX_STEERING_MAX_TURNS}. */
-  readonly maxTurns?: number;
-  /** How many recent tool/turn notes `progress()` reports. Default 12. */
-  readonly activityWindow?: number;
-  /** Per-turn wall-clock ceiling; the turn's stream is aborted when it elapses. */
-  readonly turnTimeoutMs?: number;
-}
-/** What the steerable session exposes to its executor: the usage stream plus the live reads. */
-interface SteerableSandboxSession {
-  /** Drive the worker to settlement. `signal` is the spawn-scoped abort handed to `execute`. */
-  stream(task: unknown, signal: AbortSignal): AsyncIterable<UsageEvent>;
-  progress(): ExecutorProgress;
-  traceSource(): TraceSource;
-  artifact(): {
-    outRef: string;
-    out: unknown;
-    spent: Spend;
-  } | undefined;
-  teardown(): Promise<void>;
-}
-interface SteerableSandboxArgs {
-  readonly controller: AbortController;
-  readonly profile: AgentProfile$1;
-  readonly harness: BackendType;
-  readonly sandboxClient: SandboxClient;
-  readonly inbox: Inbox;
-  readonly taskToPrompt: (task: unknown) => string;
-  readonly options?: SandboxSteeringOptions;
-  readonly loopCtx?: Partial<Omit<ExecCtx, 'sandboxClient' | 'signal'>>;
-  /**
-   * Inherited `TRACE_ID` / `PARENT_SPAN_ID` for the box, merged into `CreateSandboxOptions.env` so
-   * the remote worker's own spans join the supervisor's trace under the spawning node's span.
-   * Absent when the run records no spans — the create options are then untouched.
-   */
-  readonly traceEnv?: Record<string, string>;
-  readonly contentRef: (prefix: string, value: unknown) => string;
-  readonly now?: () => number;
-}
-/** One steerable sandbox worker. The returned session is inert until `stream()` is drained. */
-declare function createSteerableSandboxSession(args: SteerableSandboxArgs): SteerableSandboxSession;
-//#endregion
-//#region src/runtime/supervise/runtime.d.ts
-/**
- * Router/inline connection seam. A direct OpenAI-compatible Router endpoint —
- * the cheapest leaf, no box, no tools. `model` overrides the profile's model
- * hint when present; otherwise the profile's `model.default` is required.
- */
-interface RouterSeam {
-  routerBaseUrl: string;
-  routerKey: string;
-  model?: string;
-}
-/**
- * Sandbox executor seam. The `sandboxClient` the composed `runAgentRounds` creates
- * boxes through, plus the optional trace/run/lineage wiring forwarded into the
- * loop. `lineage` is opaque here (PR #150's `RunAgentRoundsOptions.lineage`): forwarded
- * forward-compatibly, never inspected — this executor does NOT reinvent
- * checkpoint/fork.
- */
-interface SandboxSeam {
-  sandboxClient: SandboxClient;
-  /** Forwarded into the composed `runAgentRounds`'s `ctx` (trace emitter, run handle, etc.). */
-  loopCtx?: Partial<Omit<ExecCtx, 'sandboxClient' | 'signal'>>;
-  /** PR #150 `RunAgentRoundsOptions.lineage` passthrough — opaque; forwarded, not parsed. */
-  lineage?: unknown;
-  /** Hard cap on the composed loop's iterations. The budget pool reserves against
-   *  the spawn `Budget.maxIterations`; this is the leaf's own ceiling. Default 1. */
-  maxIterations?: number;
-  /**
-   * OPT-IN: run this worker as a multi-turn, STEERABLE session instead of the historical
-   * single-shot `runAgentRounds` composition. Setting it gives the sandbox worker an `Executor.deliver`
-   * inbox (so `Scope.send` / `steer_agent` actually reach it), a live tool-activity trace, and a
-   * `progress()` read — turning the default cloud worker from something a supervisor can only
-   * wait on into something it can watch and correct.
-   *
-   * Absent, nothing changes: the same `runAgentRounds` leaf, no inbox, `steer_agent` still reports
-   * `delivered:false`. Opt-in because a steerable worker holds ONE box across several turns,
-   * which is a different resource profile from a fire-and-forget shot.
-   */
-  steering?: SandboxSteeringOptions;
-}
-/**
- * UNMETERED CLI subprocess seam. `bin` + `args` describe the process to spawn.
- *
- * READ THIS BEFORE CHOOSING `backend: 'cli'`. This backend pipes a prompt to a subprocess's stdin
- * and reads its stdout. It has no usage receipt of any kind, so it reports its spend with
- * `Spend.tokensKnown: false`: the work is recorded, its `{0,0}` tokens and `$0` are a FLOOR rather
- * than a measurement, and a ceiling priced from either is a ceiling that cannot fire. The executor
- * is also `budgetExempt: true`, which is why `driveHarnessFromBackend` refuses it outright rather
- * than pretending to budget it.
- *
- * If you need a metered harness worker, use `backend: 'bridge'` (a cli-bridge session, which
- * reports the harness's real per-turn tokens and cost) or `backend: 'cli-worktree'` with
- * `codexReproducible`. Reach for this seam only when the subprocess genuinely is not an inference
- * agent, or when you have accepted that its cost is invisible.
- *
- * `args` is argv for a LOCAL, in-process spawn under this process's own privileges. It is not a
- * remote channel and nothing forwards it over a wire.
- */
-interface CliSeam {
-  bin: string;
-  args?: string[];
-  /** Extra environment for the subprocess (merged over `process.env`). */
-  env?: Record<string, string>;
-  /** Working directory for the subprocess. */
-  cwd?: string;
-}
-/**
- * cli-worktree seam. A supervisor-authored `AgentProfile` driving a local coding-harness CLI
- * (claude / codex / opencode) on its own git worktree — the leaf `createWorktreeCliExecutor`
- * named as data. `harness` + `repoRoot` are required; the task comes from `Executor.execute`.
- * `taskPrompt` remains an optional direct-call fallback for callers that execute with `undefined`.
- * The authored
- * `profile.prompt.systemPrompt` + `profile.model.default` reach the harness via the §1.5
- * `harnessInvocation` mapper. Everything else mirrors `WorktreeCliExecutorOptions`.
- */
-interface CliWorktreeSeam {
-  repoRoot: string;
-  /** Local CLI harness transport. Omit when `bridge` is set. */
-  harness?: LocalHarness;
-  taskPrompt?: string;
-  runId?: string;
-  baseRef?: string;
-  harnessTimeoutMs?: number;
-  /** Isolated, network-off Codex execution with terminal JSONL usage capture. */
-  codexReproducible?: boolean;
-  /** Absolute host paths denied to reproducible Codex. */
-  codexReadDeniedPaths?: ReadonlyArray<string>;
-  testCmd?: string;
-  typecheckCmd?: string;
-  checkTimeoutMs?: number;
-  checkOutputCap?: number;
-  budgetExempt?: boolean;
-  /** Live cli-bridge transport inside the worktree. When set, the worktree leaf accepts
-   *  `deliver()` messages and resumes the same bridge session in this worktree cwd. */
-  bridge?: CliWorktreeBridgeSeam;
-  /** Test seam — forwarded to worktree helpers. */
-  runGit?: GitRunner;
-  /** Test seam — forwarded to verification checks. */
-  runCommand?: WorktreeCheckRunner;
-}
-interface CliWorktreeBridgeSeam {
-  bridgeUrl: string;
-  bridgeBearer: string;
-  /** Bridge model/harness id. Defaults to the profile's model hint when omitted. */
-  model?: string;
-  /** Canonical profile overlay merged over the spawned profile. */
-  agentProfile?: AgentProfile$1;
-  /** Caller-owned deadline for each bridge turn. Runtime enforces it locally and sends the
-   *  same value in `execution.timeoutMs` so cli-bridge cannot substitute its own cutoff. */
-  timeoutMs?: number;
-  /** Stable cli-bridge session id. Defaults to `bridge-worktree-${runId}`. */
-  sessionId?: string;
-  maxTurns?: number;
-}
-/**
- * cli-bridge seam. A local OpenAI-compatible bridge that fronts harness CLIs
- * (claude-code / opencode / kimi / pi) behind one HTTP surface; `model` doubles
- * as the harness selector (e.g. `claude-code/sonnet`, `opencode/<provider>/<model>`).
- * `agentProfile` is the bridge-dialect profile (metadata.disallowedTools, mcp)
- * forwarded verbatim per request — how an arm disables native tools or injects
- * a provider search MCP.
- *
- * The executor opens a resumable cli-bridge session. `sessionId` identifies the
- * harness conversation across turns; each turn also receives its own durable run id.
- * A dropped HTTP reader reattaches to that exact run and explicit cancel is the only
- * operation allowed to stop it. Omit `sessionId` and the executor mints one per spawn.
- *
- * ── HOW TO CONTROL WHAT THE HARNESS LOADS (there is no argv field, by design) ──
- *
- * A worker often needs the harness started in a KNOWN state — no ambient extensions, skills,
- * context files, or prompt templates — because ambient state is how a paired experiment silently
- * loses its pairing: an installed extension that persists memory across runs carries arm A's state
- * into arm B, and nothing reports it.
- *
- * That is what the `AgentProfile` on this seam (and on the spawn spec) is FOR. `agent_profile`
- * rides every request verbatim, and cli-bridge maps it onto each harness's own native controls:
- *
- *   - Materializing any profile at all already starts the harness isolated from ambient
- *     workspace state — for pi that is `--no-context-files --no-skills --no-prompt-templates`,
- *     applied to every request that carries an `agent_profile`.
- *   - `AgentProfile.extensions.<harness>` is the named, per-harness control channel. An explicit
- *     `extensions: { pi: { load: [] } }` disables ambient extension discovery outright
- *     (pi's `--no-extensions`); listing package names loads exactly those and nothing else.
- *   - `permissions` / `tools` / `mcp` map onto the harness's native tool and server controls.
- *
- * A caller therefore does NOT need to hand-roll an `Executor` to isolate a harness run, and the
- * profile expressing it stays portable: the same declaration means the same thing on a different
- * harness, whereas an argv string means nothing anywhere else.
- *
- * WHY NOT A GENERAL ARGV PASSTHROUGH. `bridgeUrl` addresses a process-spawning server. Forwarding
- * an arbitrary argv array to it would let any caller holding a bearer token choose the flags of a
- * process on the bridge host — which for real harness CLIs includes flags that load code from a
- * path, read a file into the prompt, redirect the working directory, or turn off the isolation the
- * bridge applies. cli-bridge deliberately confines workers (a filesystem jail and deny-by-default
- * network egress), and every one of those confinements is expressed as spawn configuration, so an
- * argv channel is a channel for unwinding them. It would also break this executor's own contract:
- * the durable-run replay protocol, session pinning, and streaming mode are all argv the bridge
- * owns, and a caller-supplied duplicate silently wins or corrupts the parse. The structured profile
- * channel is validated, per-harness, portable, and refuses controls it does not understand — keep
- * new harness capability there.
- */
-interface BridgeSeam {
-  bridgeUrl: string;
-  bridgeBearer: string;
-  /** Fallback bridge wire id. A spawned profile may select its own harness and model. */
-  model?: string;
-  /** Optional working directory forwarded to cli-bridge and persisted with the session. */
-  cwd?: string;
-  /** Canonical profile overlay merged over the spawned profile. */
-  agentProfile?: AgentProfile$1;
-  /** Caller-owned deadline for each bridge turn. Runtime enforces it locally and sends the
-   *  same value in `execution.timeoutMs` so the bridge-owned process follows the same policy. */
-  timeoutMs?: number;
-  /** Stable, caller-owned cli-bridge session id for harness-side resume. Defaults
-   *  to a freshly minted per-spawn id so each worker is its own resumable session. */
-  sessionId?: string;
-  /** Per-resume-turn inference cap before the worker settles on its last output.
-   *  Mirrors `routerToolsInlineExecutor.maxTurns`; default 200 (runaway backstop). */
-  maxTurns?: number;
-  /** Newest-last activity window `progress()` reports. Default 12 (matches `PiSeam`). */
-  activityWindow?: number;
-}
-/** Generic environment provider executor config. External packages implement
- *  `AgentEnvironmentProvider`; this built-in wrapper lets `createExecutor`
- *  consume them as backend data while preserving the existing usage channel. */
-interface ProviderSeam extends ProviderExecutorOptions {
-  provider: AgentEnvironmentProvider | string;
-  registry?: AgentEnvironmentProviderRegistry;
-  /**
-   * Compose the provider through the existing steerable sandbox session.
-   * The exact profile must name its harness, and the provider must expose live
-   * continuation plus session controls. The provider still owns environment
-   * creation and session semantics.
-   */
-  steering?: SandboxSteeringOptions;
-}
-/**
- * Router seam WITH tool use — the tool-using router backend. Same direct
- * OpenAI-compatible endpoint as `RouterSeam`, but each turn passes `tools`; when
- * the model emits tool_calls they run via `executeToolCall` ON THIS HOST and the
- * results fold back as `tool` messages, repeating until the model answers without
- * a tool or `maxTurns` is hit. A real agentic loop, OFF-BOX — no sandbox, so it
- * is unaffected by a box's egress allowlist. One turn = one completion = the
- * equal-compute unit. `executeToolCall` receives the task so per-task tool
- * surfaces (e.g. a gym keyed by task) can dispatch correctly.
- */
-interface RouterToolsSeam {
-  routerBaseUrl: string;
-  routerKey: string;
-  model?: string;
-  tools: ReadonlyArray<ToolSpec>;
-  executeToolCall: (name: string, args: Record<string, unknown>, task: unknown) => Promise<string>;
-  /** Online observer of each tool step — the seam a `DetectorMonitor` taps to watch the live pipe
-   *  (raise a `finding` when the worker loops/errors). Called after every tool call resolves, with
-   *  real per-call wall-clock (`startedAt`/`endedAt`/`durationMs`) so a push `TraceSource` can carry
-   *  non-zero span durations onto the unified timeline. */
-  onToolStep?: (step: {
-    toolName: string;
-    args: Record<string, unknown>;
-    status: 'ok' | 'error';
-    startedAt?: number;
-    endedAt?: number;
-    durationMs?: number;
-  }) => void;
-  /** Max inference turns. Default 200 (runaway backstop — set far above any
-   *  legitimate workflow). For tighter per-workflow limits use a cost budget
-   *  or wall-clock deadline at the call site. */
-  maxTurns?: number;
-}
-/**
- * The leaf `createWorktreeCliExecutor` as a backend-as-data factory: a supervisor-authored
- * `AgentProfile` driving claude / codex / opencode on its own worktree. `budgetExempt` like
- * the other CLI leaves; the authored systemPrompt + model reach the harness via §1.5.
- */
-declare const cliWorktreeExecutor: ExecutorFactory<unknown>;
-/**
- * Config for {@link createExecutor}: the backend is DATA — the cost dial a profile,
- * an experiment config, or a replay journal can name — not an import choice. Each
- * variant carries its backend's seam (router/router-tools/bridge/cli/cli-worktree/sandbox).
- */
-type ExecutorConfig = ({
-  backend: 'router';
-} & RouterSeam) | ({
-  backend: 'router-tools';
-} & RouterToolsSeam) | ({
-  backend: 'bridge';
-} & BridgeSeam) | ({
-  backend: 'cli';
-} & CliSeam) | ({
-  backend: 'cli-worktree';
-} & CliWorktreeSeam) | ({
-  backend: 'provider';
-} & ProviderSeam) | ({
-  backend: 'sandbox';
-  harness?: BackendType;
-} & SandboxSeam);
-/**
- * The single built-in executor factory. Picks a leaf backend by data (`config.backend`),
- * injects the matching seam, and delegates to that backend's built-in implementation.
- * The `Executor` port stays OPEN: bring-your-own agents implement `Executor` directly
- * and never pass through here. Use this (or `createExecutorRegistry`) instead of a
- * per-vendor adapter or a closed `inline|sandbox|cli` switch — those bypass the
- * `UsageEvent` reporting channel.
- */
-declare function createExecutor(config: ExecutorConfig): ExecutorFactory<unknown>;
-/**
- * The open resolver/registry. Pre-registers the three built-ins under their
- * runtime tags (`'router'`, `'sandbox'`, `'cli'`) and accepts `register(name,
- * factory)` for any additional runtime — and a BYO `AgentSpec.executor` resolves
- * without touching the registry at all. NOT a closed switch; registration + BYO
- * ARE the extension points.
- *
- * `resolve` precedence (frozen in `ExecutorRegistry`): a BYO `spec.executorFactory` →
- * `spec.executor` → `harness === null` → the `'router'` factory; else a registered factory for the
- * harness-derived runtime (`'sandbox'` for any `BackendType`); else fail loud.
- */
-declare function createExecutorRegistry(): ExecutorRegistry;
-//#endregion
 //#region src/mcp/tools/delegate.d.ts
-/** MCP tool name for the `delegate` generic-delegation tool. @experimental */
+/** MCP tool name for the `delegate` generic-delegation tool. @stable */
 declare const DELEGATE_TOOL_NAME = "delegate";
-/** Human-readable description of the `delegate` MCP tool, injected into the tool manifest. @experimental */
+/** Human-readable description of the `delegate` MCP tool, injected into the tool manifest. @stable */
 declare const DELEGATE_DESCRIPTION: string;
-/** JSON Schema for `delegate` tool arguments (`intent` + optional `model` and `runId`). @experimental */
+/** JSON Schema for `delegate` tool arguments (`intent` + optional trace id). @stable */
 declare const DELEGATE_INPUT_SCHEMA: {
   readonly type: "object";
   readonly properties: {
@@ -2268,10 +1717,6 @@ declare const DELEGATE_INPUT_SCHEMA: {
       readonly type: "string";
       readonly description: "What you want accomplished, as an outcome. The supervisor authors the worker.";
     };
-    readonly model: {
-      readonly type: "string";
-      readonly description: "Optional per-call override for the supervisor brain model.";
-    };
     readonly runId: {
       readonly type: "string";
       readonly description: "Optional trace-correlation id for this delegation.";
@@ -2283,10 +1728,9 @@ declare const DELEGATE_INPUT_SCHEMA: {
 /** Parsed `delegate` tool arguments. */
 interface DelegateArgs {
   intent: string;
-  model?: string;
   runId?: string;
 }
-/** Parse and validate raw MCP tool input into typed `DelegateArgs`; throws `TypeError` on bad input. @experimental */
+/** Parse and validate raw MCP tool input into typed `DelegateArgs`; throws `TypeError` on bad input. @stable */
 declare function validateDelegateArgs(raw: unknown): DelegateArgs;
 /** The synchronous result the `delegate` tool returns to the calling agent: the delivered output (or
  *  the no-winner reason) PLUS the conserved spend of the whole delegation. */
@@ -2308,16 +1752,16 @@ interface DelegateError {
   name: string;
   message: string;
 }
-/** @experimental */
+/** @stable */
 interface DelegateHandlerOptions {
   /** The supervisor brain's router substrate (REQUIRED — the default supervisor is router-brained). */
-  router: RouterConfig;
+  router: RouterTransportConfig;
+  /** Exact executable supervisor identity selected by the trusted composition root. */
+  supervisorProfile: AgentProfile$1;
   /** WHERE the authored workers run. Required for `supervise()` to spawn anything. */
   backend: ExecutorConfig;
   /** The completion oracle the authored workers settle against (settled ⟺ delivered). */
   deliverable?: DeliverableSpec;
-  /** Default supervisor brain model when a call omits `model`. */
-  model?: string;
   /** Restrict the run to this subset of models. */
   allowedModels?: readonly string[];
 }
@@ -2339,10 +1783,8 @@ interface McpServerOptions {
    */
   delegateSupervisor?: DelegateHandlerOptions;
   /**
-   * Required to enable delegate_ui_audit. Wire one that closes over your
-   * `runAgentRounds` + `uiAuditorProfile` + a `SandboxClient` (the
-   * canonical in-process choice is `createInProcessUiAuditClient` from
-   * `@tangle-network/agent-runtime/profiles`) + your vision judge.
+   * Required to enable delegate_ui_audit. Wire one that executes an exact
+   * agent profile through Runtime and returns the provider-neutral UI audit result.
    */
   uiAuditorDelegate?: UiAuditorDelegate;
   /** Override the default in-memory feedback store. */
@@ -2949,10 +2391,10 @@ interface AuditIntentInput {
   runId?: string;
 }
 interface AuditIntentOptions {
-  chat: ChatClient;
-  model?: string;
-  /** Override the auditor instruction (optimizable like any analyst prompt). */
-  auditorInstruction?: string;
+  /** Exact auditor identity. */
+  profile: AgentProfile$1;
+  /** Execution substrate. All behavior comes from the profile. */
+  executor: ExecutorConfig;
   /** Cap trace lines fed to the auditor. Default 80. */
   maxTraceLines?: number;
   signal?: AbortSignal;
@@ -3272,9 +2714,10 @@ interface LeaderboardSpec<TCase, TArtifact = string> {
     harnesses?: readonly HarnessType[];
     models?: readonly string[];
   };
-  /** Base profile the axes expand over (prompt/tools/skills held fixed).
-   *  Default: a minimal `{ name, model: { default: <first model> } }`. */
-  baseProfile?: AgentProfile;
+  /** Exact base profile the axes expand over (prompt/tools/skills held fixed).
+   *  Its provider remains authoritative while each axis cell replaces the
+   *  harness and concrete model. */
+  baseProfile: AgentProfile;
   /**
    * Execution-backend registry: `--backend <name>` picks the factory that
    * yields the `SandboxClient` every cell runs on. Merged over the defaults:
@@ -3287,10 +2730,6 @@ interface LeaderboardSpec<TCase, TArtifact = string> {
   backends?: Record<string, (() => SandboxClient) | undefined>;
   /** Extra `--flag value` CLI args `run()` parses and surfaces via `ctx.args`. */
   flags?: Record<string, LeaderboardFlagSpec>;
-  /** Extra fields merged into each cell's `backend.model` create override —
-   *  e.g. `{ provider: 'openai-compat', apiKey, baseUrl }` for a router-backed
-   *  sandbox. The cell's bare model id is set by the facade from the axis. */
-  modelBackend?: Record<string, unknown>;
   /** Runs once before the matrix (fetch fixtures, warm caches). */
   setup?: (ctx: LeaderboardRunContext) => Promise<void> | void;
   /** Runs once after the matrix, even on failure (reap boxes, close handles). */
@@ -3308,13 +2747,10 @@ interface LeaderboardSpec<TCase, TArtifact = string> {
    *  this (or a LEVEL-2 `dispatch`). */
   parseOutput?: (events: readonly SandboxEvent[], c: TCase) => TArtifact;
   /**
-   * Resolve the model the backend ACTUALLY served off a shot's raw events.
-   * Required for HARNESS_NATIVE_MODEL-snapped cells (a vendor-locked harness ×
-   * an out-of-family model expands to the `default` sentinel): the RunRecord
-   * must pin a real snapshot-bearing model id, which only the dispatch —
-   * reading the backend's usage/terminal events — can know. When this returns
-   * a value the default dispatch records it on the paid-call receipt;
-   * in-family cells (concrete declared model) never need it.
+   * Resolve the model the backend actually served from a shot's raw events.
+   * When this returns a value the default dispatch records it on the paid-call
+   * receipt. It cannot complete an inexact planning profile: every expanded
+   * cell must already declare a concrete model before backend work starts.
    */
   resolveModel?: (events: readonly SandboxEvent[]) => string | undefined;
   /** Result export. Default: write `matrix-result.json` under the run dir and
@@ -4089,9 +3525,10 @@ interface ObserveInput {
   runId?: string;
 }
 interface ObserveOptions {
-  /** The model-call seam (agent-eval `createChatClient`: router / cli-bridge / …). */
-  chat: ChatClient;
-  model?: string;
+  /** Exact analyst identity. */
+  profile: AgentProfile$1;
+  /** Execution substrate. All behavior comes from the profile. */
+  executor: ExecutorConfig;
   /** When set, learned facts are appended (idempotent) for the next run to read. */
   corpus?: Corpus;
   /** Tags written onto learned facts + used by the next run's corpus query. */
@@ -4099,12 +3536,6 @@ interface ObserveOptions {
   signal?: AbortSignal;
   /** Cap the trace lines fed to the observer (keeps the call cheap). Default 80. */
   maxTraceLines?: number;
-  /** Override the analyst's system instruction — the prompt that turns a trace into
-   *  findings + recommended_actions. The analyst IS the steerer, so this is the knob a
-   *  prompt optimizer (GEPA) tunes. Omitted ⇒ the default observer instruction. The
-   *  firewall (trace-only, never the verdict) is structural (input has no score), so a
-   *  custom instruction cannot break it. */
-  analystInstruction?: string;
 }
 /** The default observer instruction — exported so an optimizer can seed its population. */
 declare const defaultAnalystInstruction: string;
@@ -4114,6 +3545,12 @@ interface Observation {
   learned: CorpusRecord[];
   /** Operator-facing markdown: what the observer noticed + what to change. */
   report: string;
+  /** Measured model usage for this analysis turn. */
+  usage: {
+    input: number;
+    output: number;
+    known: boolean;
+  };
 }
 /** The third-person trace analyst: read a worker's trace and produce steer findings for the next attempt plus durable `learned` facts for the cross-run corpus. */
 declare function observe(input: ObserveInput, opts: ObserveOptions): Promise<Observation>;
@@ -4125,15 +3562,14 @@ declare function renderReport(findings: ReadonlyArray<AnalystFinding>): string;
 interface HarvestCorpusOptions {
   /** The completed runs to analyze — map your store's rows to `ObserveInput`. */
   runs: AsyncIterable<ObserveInput> | Iterable<ObserveInput>;
-  /** The model-call seam (agent-eval `createChatClient`). */
-  chat: ChatClient;
-  model?: string;
+  /** Exact analyst identity. */
+  profile: AgentProfile$1;
+  /** Execution substrate. All behavior comes from the profile. */
+  executor: ExecutorConfig;
   /** The durable corpus the facts accrete into. */
   corpus: Corpus;
   /** Tags written onto learned facts (the product/domain key the read side queries by). */
   tags?: ReadonlyArray<string>;
-  /** Override the analyst instruction (the GEPA-tunable knob). */
-  analystInstruction?: string;
   /** Runs analyzed in parallel. Default 4. */
   concurrency?: number;
   /** Hard cap on runs consumed from the stream (a cost guard for unbounded stores). */
@@ -4216,7 +3652,9 @@ declare function inProcessSandboxClient(options: InProcessSandboxClientOptions):
  * instantiated fresh per `streamPrompt` (mirrors the per-spawn executor lifecycle):
  * run once on the prompt, emit the terminal result event, tear down.
  */
-declare function inlineSandboxClient(factory: ExecutorFactory<unknown>): SandboxClient;
+declare function inlineSandboxClient(factory: ExecutorFactory<unknown>, defaults?: {
+  profile?: AgentProfile$1;
+}): SandboxClient;
 //#endregion
 //#region src/runtime/key-provider.d.ts
 /** Resolve named secrets. The ONE seam every secret store adapts to. */
@@ -4270,16 +3708,11 @@ declare function resolveMcpServerLaunch(server: AgentProfileMcpServer, keys: Key
 //#endregion
 //#region src/runtime/local-sandbox-client.d.ts
 interface LocalSandboxClientOptions {
-  /** The worker brain: router chat-completions with tool-calling. All three required. */
+  /** Router endpoint/auth. The exact per-create profile owns model and loop behavior. */
   router: {
     baseUrl: string;
     key: string;
-    model: string;
   };
-  /** Tool-loop turns per prompt. Default 8. */
-  maxTurns?: number;
-  /** Brain sampling temperature. Default: `routerBrain`'s (0.4). */
-  temperature?: number;
   /** Fallback profile when `create(options)` carries none on `backend.profile`. */
   profile?: AgentProfile$1;
   /** Resolves profile-declared MCP secret names at child-process spawn time. */
@@ -4294,7 +3727,7 @@ interface LocalSandboxClientOptions {
 declare function localSandboxClient(opts: LocalSandboxClientOptions): SandboxClient;
 //#endregion
 //#region src/runtime/run-loop.d.ts
-/** @experimental */
+/** @stable */
 interface RunAgentRoundsOptions<Task, Output, Decision> {
   driver: Driver<Task, Output, Decision>;
   /**
@@ -4370,7 +3803,7 @@ interface RunAgentRoundsOptions<Task, Output, Decision> {
  * folding the results back in until the model stops calling tools. No sandboxes, no
  * rounds, no winner selection.
  *
- * @experimental
+ * @stable
  */
 declare function runAgentRounds<Task, Output, Decision>(options: RunAgentRoundsOptions<Task, Output, Decision>): Promise<LoopResult<Task, Output, Decision>>;
 /**
@@ -4441,7 +3874,6 @@ declare function loopDispatch<Task, Output, Decision, TScenario extends Scenario
 //#region src/runtime/strategy.d.ts
 interface AgenticTask {
   readonly id: string;
-  readonly systemPrompt: string;
   readonly userPrompt: string;
   /** Opaque domain payload the surface reads (EOPS: servers/verifiers/tools). Drivers never read it. */
   readonly meta?: Record<string, unknown>;
@@ -4478,25 +3910,16 @@ interface AgenticSurface {
 interface AgenticOptions {
   routerBaseUrl: string;
   routerKey: string;
-  model: string;
+  /** Exact worker identity. Model and standing instructions are read only from this profile. */
+  workerProfile: AgentProfile$1;
   /** Optional completion transport (see `RouterConfig.complete`): when set, BOTH legs of an
    *  offline run use it instead of `fetch`-ing the router — the worker's tool loop (threaded into
    *  its `routerToolLoop` cfg) AND the analyst's critic (its `ChatClient` is bound to this same
    *  transport). One injected responder serves both, as a localhost mock endpoint would. Absent ⇒
    *  the live router fetch path (the default). */
   complete?: (body: Record<string, unknown>) => Promise<unknown>;
-  temperature?: number;
-  /** Completion cap per worker turn — REQUIRED for thinking models (they burn unbounded
-   *  budgets on reasoning and return empty content without it). Omitted ⇒ provider default. */
-  maxTokens?: number;
-  /** Turns the agent may take within ONE shot before the driver intervenes. */
-  innerTurns?: number;
-  /** The depth STEERER's analyst instruction (observe()'s system prompt). The knob a
-   *  prompt optimizer (GEPA) tunes — the analyst IS the steerer. Omitted ⇒ the default. */
-  analystInstruction?: string;
-  /** The critic's model — lets the analyst be a stronger (or cheaper) model than the
-   *  worker. Omitted ⇒ the worker's `model`. */
-  analystModel?: string;
+  /** Exact critic identity. Omitted means the exact worker profile also runs the critic. */
+  analystProfile?: AgentProfile$1;
   /** Across-run learning: when set, the analyst's observe() pass appends trace-derived
    *  facts here (the flywheel write side). Read-back is opt-in via `corpusReadback`
    *  because unconditional priming can pollute context on some domains. */
@@ -4537,14 +3960,15 @@ interface AgenticRunResult {
   /** DEPTH: score after each shot — the progress-over-rounds curve. BREADTH: best-so-far per rollout. */
   progression: number[];
   shots: number;
-  /** The cost vector, stamped by `runAgentic` from the Supervisor's conserved pool: real
-   *  router tokens, priced usd (0 when the model is unpriced — never fabricated), wall ms. */
+  /** Observed billed subtotal. `usdKnown:false` means it is incomplete, never a measured zero. */
   usd: number;
+  usdKnown: boolean;
   ms: number;
   tokens: {
     input: number;
     output: number;
   };
+  tokensKnown: boolean;
 }
 /** DEPTH: one persistent artifact, carried across analyst-steered shots. */
 declare function depthStrategy(surface: AgenticSurface, task: AgenticTask, opts: AgenticOptions, cfg: {
@@ -4575,21 +3999,13 @@ interface Strategy<Result extends StrategyResult = StrategyResult> {
 declare const sample: Strategy;
 /** Built-in `Strategy`: attempt → `observe()` reads the trace → steer the next attempt → repeat (deepen one lineage). */
 declare const refine: Strategy;
-/** A role for one shot — multi-agent loops (researcher + engineer, a panel of k
- *  researchers) give each shot its own system prompt and optionally its own model. */
-interface ShotPersona {
-  /** Replaces the task's systemPrompt for a FRESH shot; on a carried conversation it is
-   *  injected as a hand-off message (the transcript's earlier roles stay intact). */
-  systemPrompt?: string;
-  /** Per-shot model override (e.g. a stronger model for the engineer shot). */
-  model?: string;
-}
 interface ShotSpec {
   /** present ⇒ continue this artifact (depth); absent ⇒ the shot opens a fresh one (sample/restart). */
   handle?: ArtifactHandle;
   messages?: StrategyMessage[];
   steer?: string;
-  persona?: ShotPersona;
+  /** Exact profile for this shot. Omitted means `AgenticOptions.workerProfile`. */
+  profile?: AgentProfile$1;
   /** Restrict THIS shot to a subset of the domain's tools (by name) — focus a shot on
    *  the relevant capabilities. Restriction-only; unknown names throw. Omitted ⇒ all. */
   tools?: string[];
@@ -4724,11 +4140,13 @@ interface BenchmarkCell {
   /** The progress curve (refine: score per shot; sample: best-so-far per rollout). */
   progression: number[];
   usd: number;
+  usdKnown: boolean;
   ms: number;
   tokens: {
     input: number;
     output: number;
   };
+  tokensKnown: boolean;
 }
 interface BenchmarkTaskRow {
   taskId: string;
@@ -4748,6 +4166,8 @@ interface BenchmarkStrategySummary {
   resolved: number;
   /** Mean cost vector per task. */
   usd: number;
+  /** Fraction of task cells whose billed-dollar total was complete. */
+  usdKnownRate: number;
   ms: number;
 }
 /** Benchmark output: per-strategy means plus the full per-task × per-strategy losses table an optimizer mines. */
@@ -4897,6 +4317,8 @@ declare function selectValidWinner<D>(opts?: {
  * pool would not admit, or a stage whose `collect` chose to block) short-circuits — its blockers
  * ARE the pipeline's blockers, never coerced past a failed stage. The terminal stage's `done`
  * deliverable is the pipeline's deliverable.
+ *
+ * @stable
  */
 declare function pipeline<Task, D>(stages: ReadonlyArray<PipelineStage<Task, unknown, unknown>>): CombinatorShape<Task, D>;
 /**
@@ -4909,6 +4331,8 @@ declare function pipeline<Task, D>(stages: ReadonlyArray<PipelineStage<Task, unk
  * `opts.width` swaps the single round for `rollingDispatch`: at most `width` items live at once,
  * refilled the instant one settles. Selection, blockers, and the conserved pool are unchanged —
  * the refill behavior lives in the existing combinator rather than in a rival primitive.
+ *
+ * @stable
  */
 declare function fanout<Task, Item, D>(items: ReadonlyArray<Item>, opts: FanoutOptions<Item, D>): CombinatorShape<Task, D>;
 /**
@@ -4921,6 +4345,8 @@ declare function fanout<Task, Item, D>(items: ReadonlyArray<Item>, opts: FanoutO
  * `until` on the resulting trace-derived findings (the analyst spawns into THIS scope, so its
  * compute is conserved-pooled — equal-k holds by construction). Absent an analyst the findings
  * argument is the empty array — never a fabricated finding (fail-loud honesty over a silent default).
+ *
+ * @stable
  */
 declare function loopUntil<Task, State, D>(seed: State, spec: LoopUntilSpec<Task, State, D>): CombinatorShape<Task, D>;
 /**
@@ -4929,6 +4355,8 @@ declare function loopUntil<Task, State, D>(seed: State, spec: LoopUntilSpec<Task
  * reaches another judge's task; the merge never spawns or re-ranks). A `down` judge carries no
  * verdict and is excluded from the merge denominator. A panel that admitted no judge is a
  * concrete blocker before `merge` is consulted.
+ *
+ * @stable
  */
 declare function panel<Task, Artifact, D>(spec: PanelSpec<Artifact, D>): CombinatorShape<Task, D>;
 /**
@@ -4936,6 +4364,8 @@ declare function panel<Task, Artifact, D>(spec: PanelSpec<Artifact, D>): Combina
  * it; only a `valid` verifier verdict ships. Any other outcome (implement down, verifier down,
  * verifier verdict absent or not `valid`) is a concrete blocker carrying the failure verbatim —
  * never a coerced "done". The implement child does not grade itself.
+ *
+ * @stable
  */
 declare function verify<Task, Candidate, D>(spec: VerifySpec<Task, Candidate, D>): CombinatorShape<Task, D>;
 /**
@@ -4954,6 +4384,8 @@ declare function verify<Task, Candidate, D>(spec: VerifySpec<Task, Candidate, D>
  * the widen loop sees it. The shipped default (`flatWidenGate`) never widens, so no widen child is
  * ever live when the analyst runs and the wire is exact; a non-flat gate must drive the analyst on
  * a scope whose siblings are quiesced, or read findings without the shared-cursor drain.
+ *
+ * @stable
  */
 declare function widen<Task, Seed, D>(spec: WidenSpec<Seed, D>): CombinatorShape<Task, D>;
 /**
@@ -5019,6 +4451,8 @@ declare function renderCorpusToInstructions(opts: RenderCorpusToInstructionsOpti
  * Build a frozen `Persona`. Fails loud on the executors-supplied invariant: a persona with
  * neither a pre-built registry nor a seam bag cannot resolve its built-in runtimes, so it is
  * unrunnable — refuse it at definition time, not at the first spawn. Pure; no I/O.
+ *
+ * @stable
  */
 declare function definePersona<D = unknown>(input: DefinePersonaInput<D>): Persona<D>;
 /**
@@ -5027,6 +4461,8 @@ declare function definePersona<D = unknown>(input: DefinePersonaInput<D>): Perso
  * `ShapeContext`, and runs the resulting root `Agent` to a typed `SupervisedResult<Outcome>`.
  * Fail loud on an unknown shape name or an unresolvable persona registry — never a silent
  * default-shape fallback.
+ *
+ * @stable
  */
 declare function runPersonified<Task, D>(options: RunPersonifiedOptions<Task, D>): Promise<SupervisedResult<Outcome<D>>>;
 //#endregion
@@ -5061,6 +4497,36 @@ declare function trajectoryReport(journal: SpawnJournal, blobs: ResultBlobStore,
  */
 declare function equalKOnCost(arms: ReadonlyArray<EqualKArm>, options?: EqualKOnCostOptions): EqualKVerdict;
 //#endregion
+//#region src/runtime/supervise/model-policy.d.ts
+/**
+ * Throw a `ConfigError` when `allowed` is set, `model` is defined, and `model` is not a
+ * member of `allowed`. No-op when `allowed` is unset (the unrestricted default) or when
+ * `model` is undefined (nothing was configured to check).
+ */
+declare function assertModelAllowed(model: string | undefined, allowed: readonly string[] | undefined): void;
+/** Check every canonical model-bearing field in a complete profile, including the models a
+ * backend may select for cheap work, named subagents, or modes. */
+declare function assertProfileModelsAllowed(profile: AgentProfile$1, allowed: readonly string[] | undefined): void;
+//#endregion
+//#region src/runtime/profile-chat-client.d.ts
+/** Profile-exact adapter for packages that consume agent-eval's ChatClient contract.
+ * Every call still enters Runtime through createExecutor -> streamAgentTurn, and every
+ * behavioral field is checked against the exact AgentProfile before any transport runs. */
+declare function profileChatClient(args: {
+  profile: AgentProfile$1;
+  executor: ExecutorConfig;
+  context: string;
+}): ChatClient;
+/** Profile-exact adapter for agent-eval's external optimizer callback.
+ * Eval validates and freezes the provider-neutral request; Runtime owns the exact
+ * AgentProfile, execution route, retries, usage, and finite execution evidence. */
+declare function profileOptimizerModelCall(args: {
+  profile: AgentProfile$1;
+  executor: ExecutorConfig;
+  context: string;
+  pricing?: CustomTokenPricing;
+}): ExternalOptimizerModelCall;
+//#endregion
 //#region src/runtime/promotion-gate.d.ts
 interface PromotionGateOptions {
   /** The HOLDOUT report — must carry per-task cells for both strategy names. */
@@ -5128,21 +4594,18 @@ interface ResolveSandboxClientOptions {
   backend: 'sandbox' | 'bridge' | 'router' | 'local';
   /** `sandbox` backend: the caller's real Sandbox-backed client. Required for that backend. */
   sandboxClient?: SandboxClient;
-  /** `bridge` backend: local cli-bridge transport. `bearer` + `model` required. */
+  /** `bridge` backend: local cli-bridge transport. The per-create profile owns the model. */
   bridge?: {
     /** cli-bridge base URL. Defaults to `http://127.0.0.1:3355`. */
     url?: string;
     bearer: string;
-    /** Bridge model id, doubling as the harness selector (e.g. `claude-code/sonnet`). */
-    model: string;
     /** Per-turn deadline (ms). */
     timeoutMs?: number;
   };
-  /** `router` backend: router chat-completion transport. All three fields required. */
+  /** `router` backend: endpoint/auth only; the per-create profile owns behavior. */
   router?: {
     baseUrl: string;
     key: string;
-    model: string;
   };
   /** `local` backend: same-host pseudo-box — the router brain drives a tool loop
    *  with the profile's stdio MCP servers spawned as local children. */
@@ -5247,7 +4710,10 @@ declare function extractLlmCallEvent(event: SandboxEvent, agentRunName: string):
  *     receipt: (turn) => {
  *       const u = sumSandboxUsage(turn.events)
  *       return { model, inputTokens: u.input, outputTokens: u.output,
- *         ...(u.costUsd > 0 ? { actualCostUsd: u.costUsd } : {}) }
+ *         ...(u.tokensKnown === false ? { usageUnknown: true } : {}),
+ *         ...(u.usdKnown !== false && u.costUsd > 0 ? { actualCostUsd: u.costUsd } : {}),
+ *         ...(u.usdKnown === false ? { costUnknown: true } : {}),
+ *         ...(u.estimatedCostUsd !== undefined ? { estimatedCostUsd: u.estimatedCostUsd } : {}) }
  *     }
  *
  * Without this a cell reads `{tokens:0, cost:0}` and the backend-integrity guard correctly aborts the
@@ -5257,6 +4723,9 @@ declare function sumSandboxUsage(events: readonly SandboxEvent[], agentRunName?:
   input: number;
   output: number;
   costUsd: number;
+  tokensKnown?: false;
+  usdKnown?: false;
+  estimatedCostUsd?: number;
 };
 /**
  * Cross-event state for {@link mapSandboxToolEvent}. Sandbox backends emit a
@@ -5643,14 +5112,15 @@ declare function materializeLocalMcp(profile: AgentProfile$1, opts?: Materialize
 /** The compressed consumable a skill carries: everything an author needs to emit a loop. */
 declare const strategyAuthorContract = "\nYou author an OPTIMIZATION STRATEGY for an agentic loop system. A strategy decides how to\nspend a compute budget to beat a task's deployable check. You compose exactly two steps:\n\n  shot(spec?: { handle?, messages?, steer?, persona?, tools? }): Promise<ShotResult | null>\n    Runs ONE worker attempt (a bounded tool loop) over an artifact.\n    - omit handle  => the shot opens its OWN fresh artifact and closes it after (a sample).\n    - pass handle  => the shot CONTINUES that artifact (state accumulates across shots).\n    - messages     => the carried conversation (pass the previous ShotResult.messages to continue).\n    - steer        => a corrective instruction injected before the shot.\n    - persona      => { systemPrompt?, model? } — give THIS shot its own role and/or model\n      (multi-agent strategies: a researcher shot then an engineer shot, a panel of k\n      personas over one budget). On a fresh shot the systemPrompt replaces the task's; on\n      a carried conversation it arrives as a hand-off message. Same conserved budget.\n    - tools        => string[] — restrict THIS shot to a subset of the task's tools by\n      name (focus an explore shot on read-only tools, an execute shot on write tools).\n      Restriction-only; unknown names make the shot fail. ALWAYS select from\n      await listTools(handle) — never hardcode. Omitted => the shot sees every tool.\n    ShotResult = { messages, score (0..1 on the task's check), passes, total, completions, toolErrors }\n    Returns null if the attempt failed infra-wise.\n\n  critique(messages): Promise<string | null>\n    A firewalled trace-analyst reads the attempt's trajectory and returns ONE corrective\n    instruction (or null when it judges the work complete). Costs ~1 completion.\n\n  consult(messages, instruction): Promise<string | null>\n    The RAW analyst channel: the same firewalled critic answers YOUR instruction over the\n    trajectory verbatim (no reformatting) — use it when you need a specific reply format\n    (a decision, a prediction). Costs ~1 completion.\n\n  surface.open(task) / surface.close(handle)\n    Open a persistent artifact you manage yourself (remember to close in a finally).\n    close is idempotent — closing an already-closed handle is a safe no-op.\n\n  listTools(handle): Promise<Array<{ name, description? }>>\n    The tools THIS task actually offers. TOOL SETS VARY PER TASK — if you restrict a\n    shot with `tools`, you MUST pick names from await listTools(handle); hardcoding\n    names from an example kills your shots on every task whose tools differ.\n\nRules:\n- ALWAYS await every shot/critique/surface call — a floating promise that rejects\n  crashes the whole benchmark run.\n- Stay within ~budget total shots; every shot/critique spends from a conserved pool.\n- For a FRESH attempt OMIT `messages` entirely (never pass `[]` — an empty array is a\n  fresh conversation too, but be explicit). To CONTINUE, pass the previous\n  ShotResult.messages unchanged.\n- Return { score, resolved, completions, progression, shots } — score = the BEST checkpoint\n  you reached (keep-best, never final-state), progression = score after each shot.\n- The module must be EXACTLY this shape (no other imports, no commentary outside code):\n\nimport { defineStrategy } from '@tangle-network/agent-runtime/kernel'\nexport default defineStrategy('your-strategy-name', async ({ surface, task, budget, shot, critique, listTools }) => {\n  // your composition (listTools comes from the destructured context — it is NOT a global)\n})\n";
 interface AuthorStrategyOptions {
-  /** The model-call seam (agent-eval `createChatClient`). */
-  chat: ChatClient;
-  model?: string;
-  /** A NAMED fallback author tried once when the primary call fails or returns no code
+  /** Exact author identity. Runtime binds it to every authoring turn. */
+  profile: AgentProfile$1;
+  /** Execution substrate for the author. Behavioral settings are forbidden here. */
+  executor: ExecutorConfig;
+  /** An exact fallback author tried once when the primary call fails or returns no code
    *  block (thinking models time out at the edge on long authoring prompts, or return
    *  empty content without `maxTokens`). Opt-in — absent means the primary's failure
    *  propagates. */
-  fallbackModel?: string;
+  fallbackProfile?: AgentProfile$1;
   /** The contract text shown to the author. Default `strategyAuthorContract`. The
    *  meta-optimization coordinate: a GEPA/skill loop can evolve this text and gate each
    *  variant on the same frozen holdout as any strategy. */
@@ -5663,11 +5133,10 @@ interface AuthorStrategyOptions {
   budget: number;
   /** Where the authored module file is written (created if missing). */
   outDir: string;
-  temperature?: number;
-  /** Completion cap — required by thinking-model authors that stream reasoning first. */
-  maxTokens?: number;
   signal?: AbortSignal;
 }
+/** Standing behavior callers put in the strategy-author AgentProfile. */
+declare const strategyAuthorSystemPrompt: string;
 /** Static CONTRACT lint over an authored strategy module — the module-boundary
  *  enforcement of the harness's two measurement invariants:
  *    - author blindness: the only import allowed is the kernel surface. A body that could
@@ -5690,12 +5159,12 @@ declare function authorStrategy(opts: AuthorStrategyOptions): Promise<AuthoredSt
 //#endregion
 //#region src/runtime/strategy-evolution.d.ts
 interface EvolutionAuthor {
-  /** The model-call seam (agent-eval `createChatClient`). */
-  chat: ChatClient;
-  model?: string;
-  fallbackModel?: string;
-  temperature?: number;
-  maxTokens?: number;
+  /** Exact author identity. */
+  profile: AgentProfile$1;
+  /** Execution substrate. All behavior comes from the profile. */
+  executor: ExecutorConfig;
+  /** Optional exact fallback identity. */
+  fallbackProfile?: AgentProfile$1;
 }
 type ChampionPolicy = 'score' | 'costAware';
 interface StrategyEvolutionConfig {
@@ -5891,125 +5360,6 @@ declare function selectChampion(report: BenchmarkReport, fieldOrder: string[], p
 /** Multi-generation strategy search: author candidates from tournament losses, play them against the incumbent at equal budget, promote via `promotionGate` on an untouched holdout slice. */
 declare function runStrategyEvolution(cfg: StrategyEvolutionConfig): Promise<EvolutionReport>;
 //#endregion
-//#region src/runtime/stream-agent-turn.d.ts
-/**
- * The execution substrate one turn runs on — a closed discriminated union over
- * the three stream surfaces the runtime already owns.
- *
- * @experimental
- */
-type AgentTurnBackend = {
-  /** A live sandbox box: the turn is one `box.streamPrompt(prompt)` call. */
-  kind: 'box';
-  box: SandboxInstance;
-  /**
-   * Per-turn `PromptOptions` forwarded verbatim to `streamPrompt`
-   * (`sessionId`, `turnId`, `model`, `backend` profile, `timeoutMs`, …).
-   * The turn's derived abort signal (caller `signal` + `timeoutMs`
-   * deadline) is always installed as `signal` — pass cancellation through
-   * `StreamAgentTurnOptions`, not here.
-   */
-  options?: Omit<PromptOptions, 'signal'>;
-  /** Model label stamped on cost-only `llm_call` events. Default `'agent'`. */
-  agentRunName?: string;
-} | {
-  /**
-   * A one-shot `Executor` (cli-bridge / router / BYO): the factory is
-   * instantiated fresh for the turn via `inlineSandboxClient`, run once on
-   * the prompt, and torn down — the same per-spawn lifecycle the supervise
-   * runtime gives it.
-   */
-  kind: 'executor';
-  factory: ExecutorFactory<unknown>;
-  /** Model label stamped on cost-only `llm_call` events. Default `'agent'`. */
-  agentRunName?: string;
-} | {
-  /**
-   * An in-process `AgentExecutionBackend` (`resolveAgentBackend` output or
-   * any custom backend): the turn is one `backend.stream()` call.
-   */
-  kind: 'chat';
-  backend: AgentExecutionBackend;
-};
-/** @experimental */
-interface StreamAgentTurnOptions {
-  /** Caller-initiated cancellation. Terminates the stream with `final.status: 'aborted'`. */
-  signal?: AbortSignal;
-  /**
-   * Wall-clock deadline for the whole turn in ms. An expired deadline aborts
-   * the backend and terminates the stream with `final.status: 'failed'`
-   * (a blown deadline is a turn failure, not a caller cancellation).
-   */
-  timeoutMs?: number;
-  /**
-   * Opt-in tool-part projection for box and executor backends: sandbox tool
-   * parts additionally surface in-stream as
-   * `tool_call` / `tool_result` events (`mapSandboxToolEvent`), so a consumer
-   * rendering tool activity needs no bespoke sandbox-event parser. Default
-   * off — the stream vocabulary existing consumers see is unchanged. No-op
-   * for the `chat` kind (its backend emits `RuntimeStreamEvent`s directly,
-   * tool events included when the backend produces them).
-   */
-  preserveToolParts?: boolean;
-  /**
-   * Raw-event tap for box-kind backends: called (and awaited) with every
-   * unmapped `SandboxEvent` BEFORE it is projected, so a consumer can read
-   * parts the chat-UX projection drops (part ids, step markers, custom
-   * backend events) without forking the mapper. Purely observational — it
-   * cannot alter the mapped stream. Never called for the `chat` kind, which
-   * has no sandbox events.
-   */
-  onRawEvent?: (event: SandboxEvent) => void | Promise<void>;
-}
-/**
- * Metered usage of one turn, summed over every cost-bearing event the backend
- * emitted. `input`/`output` are token counts (0 when the backend reported
- * none — the honest sum, never a fabricated estimate). `costUsd`/`model` are
- * present only when the backend actually reported them.
- *
- * @experimental
- */
-interface AgentTurnUsage {
-  input: number;
-  output: number;
-  costUsd?: number;
-  model?: string;
-}
-/**
- * A drained turn: the terminal summary plus every event the stream yielded.
- * `status`/`error` mirror the terminal `final` event so a failed or aborted
- * turn stays inspectable without re-scanning `events`.
- *
- * @experimental
- */
-interface CollectedAgentTurn {
-  finalText: string;
-  usage: AgentTurnUsage;
-  events: RuntimeStreamEvent[];
-  status: AgentTaskStatus;
-  error?: BackendErrorDetail;
-}
-/**
- * Run ONE agent turn on any backend kind and stream its events. Yields the
- * `RuntimeStreamEvent` vocabulary incrementally and always ends with a `final`
- * event carrying the turn's text and usage (`metadata.tokenUsage`,
- * `metadata.costUsd?`, `metadata.model?`) — on success, failure, abort, and
- * timeout alike. The generator never throws; failures surface in-band as
- * `backend_error` + `final` with a typed `error` detail.
- *
- * @experimental
- */
-declare function streamAgentTurn(backend: AgentTurnBackend, prompt: string, opts?: StreamAgentTurnOptions): AsyncGenerator<RuntimeStreamEvent>;
-/**
- * Drain a `streamAgentTurn` stream (or any `RuntimeStreamEvent` stream that
- * honors its terminal contract) into the turn summary plus the full event
- * list. Fail-loud: throws when the stream ends without a terminal `final`
- * event — a stream that violates the contract must not read as an empty turn.
- *
- * @experimental
- */
-declare function collectAgentTurn(stream: AsyncIterable<RuntimeStreamEvent>): Promise<CollectedAgentTurn>;
-//#endregion
 //#region src/runtime/structural-rollout.d.ts
 /** Provider-neutral conversation records read by structural candidate extraction. */
 type StructuralRolloutMessage = Record<string, unknown>;
@@ -6027,8 +5377,6 @@ interface StructuralRolloutPolicy {
   /** Per-slot strategy-lens prefixes on the k samples (attacks the all-k-fail bucket).
    *  Measured as a paired null (+0.6pp) — kept as an optional knob, off by default. */
   diverse?: boolean;
-  /** Sampling temperature for every shot of this strategy; omitted ⇒ the worker default. */
-  temperature?: number;
 }
 /** The measured default recipe: 5 samples, 2 guarded repair rounds, 6 authored checks. */
 declare const defaultStructuralRolloutPolicy: StructuralRolloutPolicy;
@@ -6199,22 +5547,6 @@ type AuthoredProfile = AgentProfile$1 & {
 /** Narrow an untyped `spawn_agent` profile argument to an `AuthoredProfile`, or null if the
  *  supervisor failed to author one (empty/placeholder profile — a skill violation worth catching). */
 declare function asAuthoredProfile(raw: unknown): AuthoredProfile | null;
-/**
- * Lift a profile the supervisor AUTHORED into the canonical shape every executor reads.
- *
- * The skill asks for `systemPrompt` and `model` as flat fields — the vocabulary a model writes
- * well — while `AgentProfile` carries them as `prompt.systemPrompt` and `model.default`. Nothing
- * downstream reads the flat form: the router and cli-bridge leaves read `profile.prompt
- * .systemPrompt`, and the sandbox leaf hands the profile to a strict schema that REJECTS the flat
- * key outright (`Unrecognized key: "systemPrompt"`), which fails the worker's every round. Lift
- * both here, once, so what the supervisor writes is what the worker runs.
- *
- * Purely additive: a profile already canonical is returned untouched, and a flat field is dropped
- * only after its canonical slot is filled. Both spellings of the same standing instruction, set to
- * DIFFERENT text, is a contradiction with no safe reading — it fails loud, matching
- * `resolveSupervisorProfile`'s rule for the supervisor's own profile.
- */
-declare function canonicalizeAuthoredProfile(raw: unknown): AgentProfile$1;
 /** The supervisor SKILL — the how-to the supervisor reads (its system prompt). THE optimizable
  *  surface: editing this changes how the supervisor designs every agent it spawns.
  *
@@ -6225,14 +5557,6 @@ declare function canonicalizeAuthoredProfile(raw: unknown): AgentProfile$1;
 declare function supervisorInstructions(opts?: {
   goal?: string;
 }): string;
-/** Build a router-only worker from an authored profile. This helper executes the prompt/model axes;
- *  use `workerFromBackend` for full materialization of tools, MCP, resources, hooks, and subagents. */
-declare function authoredWorker(profile: AuthoredProfile, opts: {
-  cfg: RouterConfig;
-  taskPrompt: string;
-  deliverable: DeliverableSpec;
-  temperature?: number;
-}): Agent<unknown, unknown>;
 /** Thresholds below which a system prompt is treated as a thin stub. Tunable per call. */
 interface ProfileRichnessThresholds {
   /** A prompt shorter than this many characters is thin (default 600). */
@@ -6322,11 +5646,9 @@ type BudgetReadout = Readonly<{
   reservedTokens: number;
 }>;
 /** Why a reservation was refused. `budget-exhausted` means the pool ran out of a channel it
- *  budgets; `below-runtime-floor` means the request is under the amount that harness needs before
- *  it does any work at all, so it is unsatisfiable at that size and the fix is to RAISE it;
- *  `usd-unbudgeted` means the root declared no dollar ceiling, so a dollar request is
- *  unsatisfiable at any amount and the fix is to budget the root, not to ask for less. */
-type ReservationRejection = 'budget-exhausted' | 'usd-unbudgeted' | 'below-runtime-floor';
+ * budgets; `usd-unbudgeted` means the root declared no dollar ceiling, so a dollar request is
+ * unsatisfiable at any amount and the fix is to budget the root, not to ask for less. */
+type ReservationRejection = 'budget-exhausted' | 'usd-unbudgeted';
 /** State recovered from a prior process before new work is admitted. `committed` is measured spend
  * already present in the durable journal. Each `uncertainReservation` is a child that was recorded
  * as started but never recorded as settled: its full declared ceiling is charged conservatively,
@@ -6392,123 +5714,49 @@ declare function spendFromUsageEvents(events: UsageEvent[]): Spend;
 declare function createBudgetPool(root: Budget, now?: () => number, restore?: BudgetPoolRestore): BudgetPool;
 //#endregion
 //#region src/runtime/supervise/chat-transport-executor.d.ts
-/** One buffered chat-completions call: the OpenAI-shape request body in, the parsed completion
- *  JSON out. The ONE wire function of this module — the executor's default transport is built
- *  from it, and a harness that must prove two arms share a substrate (P1 parity) drives BOTH
- *  through the same instance. */
-type ChatCompletionsTransport = (body: Record<string, unknown>, signal?: AbortSignal) => Promise<unknown>;
-/** The default transport: POST `${url}/chat/completions` with an optional bearer. Fail-loud on
- *  any non-2xx — the status and body head become the settle reason. */
-declare function chatCompletionsTransport(opts: {
-  url: string;
-  bearer?: string;
-}): ChatCompletionsTransport;
-/** Conversation history keyed by the settled worker id — the resume substrate. The kernel owns
- *  identity, ordering, ledger truth, and spend continuity; this store owns only the message
- *  lists a `'resume'` spawn continues (`WorkerSpawnContext.resume.ofWorker` is the load key).
- *  PROCESS-LOCAL by the same boundary the kernel documents for resume itself: a prior process's
- *  workers are not resume targets. */
+/** Buffered OpenAI-compatible completion port used only for offline execution. */
+type ChatCompletionsTransport = NonNullable<RouterToolsSeam['complete']>;
+/** Conversation history keyed by the settled Runtime worker id. */
 interface ChatSessionStore {
-  load(workerId: string): ReadonlyArray<Record<string, unknown>> | undefined;
-  save(workerId: string, messages: ReadonlyArray<Record<string, unknown>>): void;
+  load(workerId: string): ReadonlyArray<Readonly<Record<string, unknown>>> | undefined;
+  save(workerId: string, messages: ReadonlyArray<Readonly<Record<string, unknown>>>): void;
 }
-/** In-memory `ChatSessionStore`. Entries are detached copies — a caller mutating a saved array
- *  cannot corrupt a recorded session. */
+/** In-memory, process-local conversation store with detached reads and writes. */
 declare function createChatSessionStore(): ChatSessionStore;
-/** One entry of the caller-provided tool table: the OpenAI function spec the model sees, and the
- *  host-side implementation run when the model calls it. */
+/** One profile-authorized function tool and its host implementation. */
 interface ChatTransportTool {
   readonly spec: ToolSpec;
-  /** Runs ON THIS HOST; the returned string folds back as the `tool` message. A throw is fed
-   *  back as an error message for the model to correct — a bad tool call is a real outcome, not
-   *  an infra fault. */
   readonly execute: (args: Record<string, unknown>, task: unknown) => Promise<string>;
 }
+/**
+ * Transport and session data for one exact profile-driven conversation.
+ * Behavioral controls belong only in `profile.model.metadata`.
+ */
 interface ChatTransportExecutorOptions {
-  /** OpenAI-compatible base URL (with or without `/v1`); the executor POSTs to
-   *  `${url}/chat/completions`. Ignored when `complete` is injected. */
-  url: string;
-  /** Bearer token for the default transport. Omit for an unauthenticated endpoint. */
-  bearer?: string;
-  /** The wire model id sent on every completion. */
-  model: string;
-  /** System prompt seeding a FRESH conversation. A resumed conversation keeps the system message
-   *  it was recorded with — a session continues; it is not re-primed. */
-  system?: string;
-  /** Tool table. Omitted = a pure conversation (no `tools` field on the wire). */
-  tools?: ReadonlyArray<ChatTransportTool>;
-  temperature?: number;
-  /** Output-token ceiling for ONE completion, sent as `max_tokens` on every request when set.
-   *  Omitted = no field on the wire, so the endpoint's own default governs. A harness pairing
-   *  this executor against another sampling path (P1 parity) pins BOTH arms to one value. */
-  maxTokens?: number;
-  /** Inference-turn cap for ONE shot (one `execute`). Default 200 — a runaway backstop, not a
-   *  workflow limit (mirrors `routerToolsInlineExecutor.maxTurns`). */
-  maxTurnsPerShot?: number;
-  /** Injected buffered transport — the offline seam (mirrors `RouterConfig.complete`). When set,
-   *  `url`/`bearer` are unused and NO network is touched. */
-  complete?: ChatCompletionsTransport;
-  /** Session store backing continuity. Required to record this conversation (with `sessionKey`)
-   *  or to continue a prior one (with `resume`). */
-  sessions?: ChatSessionStore;
-  /** The id this worker's conversation is recorded under at settle — the kernel node id when
-   *  spawned through a scope, so a later `'resume'` spawn's `resume.ofWorker` finds it. */
-  sessionKey?: string;
-  /** The resume lineage from `WorkerSpawnContext.resume`: this shot continues `ofWorker`'s
-   *  recorded message list. Requires `sessions` holding that conversation — fails loud before
-   *  any spend when it does not. */
-  resume?: WorkerResumeContext;
-  /** Profile this executor materializes, for the kernel's materialization receipt. Omitted =
-   *  the node's receipt reads `executor-did-not-report` (a direct, unsupervised use). */
-  profile?: AgentProfile$1;
-  /** Kernel-minted attempt id (`ExecutorNodeContext.attemptId`) binding the receipt to this
-   *  exact spawn. */
-  attemptId?: string;
+  readonly profile: AgentProfile$1;
+  readonly url?: string;
+  readonly bearer?: string;
+  readonly tools?: ReadonlyArray<ChatTransportTool>;
+  readonly complete?: ChatCompletionsTransport;
+  readonly sessions?: ChatSessionStore;
+  readonly sessionKey?: string;
+  readonly resume?: WorkerResumeContext;
 }
 /**
- * Build the chat-transport `Executor`: one `execute` = one conversation SHOT — seed (fresh system
- * prompt, or the resumed session's recorded history) + the task as the next user message, then
- * loop completion → host tool calls → tool messages until the model answers without a tool call
- * (or the turn cap). Settles with the final assistant text as `out`.
- *
- * Fail-loud contract: transport failures (non-2xx, network faults, malformed completions) throw
- * `ValidationError`, which the scope settles as an INFRA failure (`Settled.down.infra`) — never a
- * fake success. The accumulated conversation is still recorded before the throw when a store is
- * configured, because the inference HAPPENED and a resume may continue a failed session (the
- * kernel deliberately allows resume-after-failure; the seam decides).
+ * Build one exact profile-driven chat executor through `createExecutor`.
+ * Prefer `chatWorkerSeam` for supervised work because it supplies trusted node identity.
  */
 declare function chatTransportExecutor(opts: ChatTransportExecutorOptions): Executor<string>;
+/** Transport/session configuration shared by every spawned exact profile. */
 interface ChatWorkerSeamOptions {
-  /** OpenAI-compatible base URL every spawned worker speaks. Unused when `complete` is set. */
-  url: string;
-  bearer?: string;
-  /** Fallback wire model when a spawned profile carries none (`profile.model.default` wins). */
-  model?: string;
-  tools?: ReadonlyArray<ChatTransportTool>;
-  temperature?: number;
-  /** Per-completion `max_tokens` for every spawned worker (see
-   *  {@link ChatTransportExecutorOptions.maxTokens}). */
-  maxTokens?: number;
-  maxTurnsPerShot?: number;
-  /** Injected buffered transport — the offline seam; no network is touched when set. */
-  complete?: ChatCompletionsTransport;
-  /** Session store backing continuity. Default: one fresh in-memory store PER SEAM, matching the
-   *  kernel's process-local resume boundary (one seam = one run's sessions). */
-  sessions?: ChatSessionStore;
-  /** The completion oracle: each worker settles `valid` ⟺ this check passes on its final
-   *  assistant text (`gateOnDeliverable` — settled ⟺ DELIVERED, exactly how `workerFromBackend`
-   *  composes it). Pass the graph's deliverable so a keep-best driver can pick a winner; omitted,
-   *  workers settle unverdicted and only a driver `submit_result` can win. */
-  deliverable?: DeliverableSpec<unknown>;
+  readonly url?: string;
+  readonly bearer?: string;
+  readonly tools?: ReadonlyArray<ChatTransportTool>;
+  readonly complete?: ChatCompletionsTransport;
+  readonly sessions?: ChatSessionStore;
+  readonly deliverable?: DeliverableSpec<unknown>;
 }
-/**
- * The `makeWorkerAgent` seam over {@link chatTransportExecutor} — the continuity consumer
- * `workerFromBackend` refuses to be. Every spawn becomes one conversation shot: the spawned
- * profile's system prompt + instructions (which is where a graph's delegates directive lands)
- * seed a fresh session, and a `'resume'` spawn re-attaches by loading `resume.ofWorker`'s
- * recorded message list from the seam's session store. Conversations are recorded under the
- * kernel node id, which is exactly what a later `resume.ofWorker` names.
- */
+/** Session-owning worker factory for graph continuity. */
 declare function chatWorkerSeam(opts: ChatWorkerSeamOptions): MakeWorkerAgent;
 //#endregion
 //#region src/runtime/supervise/coordination-log.d.ts
@@ -6777,6 +6025,9 @@ interface DriverAgentOptions {
    *  (the canonical `ToolLoopChat`): a scripted mock offline, the router's tool-calling in
    *  production, or a sandboxed harness. The same seam every tool-loop uses; no bespoke shape. */
   readonly brain: ToolLoopChat;
+  /** Profile-declared model for a production Router brain. When set, every turn must report this
+   * exact provider-observed model before its output is accepted. Omitted by scripted test brains. */
+  readonly expectedModel?: string;
   /** Shared blob store — `observe_agent` reads settled outputs through it. */
   readonly blobs: ResultBlobStore;
   /** Resolve a spawned `profile` to a worker LEAF or a driver child (the recursion seam). */
@@ -6971,13 +6222,278 @@ declare function serveCoordinationMcp(opts: {
   nodeTools?: ReadonlyArray<McpToolDescriptor$1>;
 }): Promise<CoordinationMcpHandle>;
 //#endregion
+//#region src/runtime/supervise/driver-retry.d.ts
+/** How hard the root driver is retried after a transient failure. The defaults retry; a caller
+ *  that wants the pre-#741 behavior sets `enabled: false` and owns the consequence. */
+interface DriverRetryPolicy {
+  /** `false` restores the historical behavior: the first driver failure ends the run. */
+  readonly enabled?: boolean;
+  /** Consecutive failures that changed NOTHING (no metered spend, no settlement, no submission)
+   *  before the run gives up. Default 3. A failure that made progress resets the count. */
+  readonly maxConsecutiveFailures?: number;
+  /** Absolute ceiling on attempts, regardless of progress. Default 8. The barren counter alone
+   *  cannot bound a driver that crashes every turn AFTER metering a little: each attempt looks like
+   *  progress, so without this backstop such a run would retry until it had eaten the entire
+   *  envelope. A caller who wants budget-only bounding sets this high deliberately. */
+  readonly maxAttempts?: number;
+  /** Backoff before the first retry, doubling per consecutive failure. Default 2000ms. */
+  readonly initialBackoffMs?: number;
+  /** Ceiling on the doubling. Default 30000ms. */
+  readonly maxBackoffMs?: number;
+}
+/** Why the retry loop stopped. `completed` is the only non-failure. */
+type DriverAttemptStop = 'completed' | 'terminal-error' | 'retry-disabled' | 'aborted' | 'budget-exhausted' | 'deadline' | 'no-progress' | 'max-attempts';
+/** One attempt's record — the legible failure the issue's third ask names. Emitted per attempt so
+ *  an operator sees `driver failed after N attempts` instead of one opaque `pi exit unknown`. */
+interface DriverAttemptRecord {
+  /** 1-based. */
+  readonly attempt: number;
+  readonly durationMs: number;
+  /** Absent when the attempt completed. */
+  readonly error?: string;
+  readonly classification?: 'transient' | 'terminal';
+  /** Did anything change since the previous attempt (spend, settlement, submission)? */
+  readonly madeProgress: boolean;
+  /** Set when this attempt ended the loop. */
+  readonly stop?: DriverAttemptStop;
+  /** Set when another attempt follows. */
+  readonly retryInMs?: number;
+}
+/** The comparable mark used to decide whether an attempt did anything at all. Any field moving
+ *  counts as progress — a driver that metered one turn before dying is not dead on arrival. */
+interface DriverProgressMark {
+  /** Monotone total of POOL spend since the first reading, in tokens — the driver's own metered
+   *  turns AND any child settlement, because the conserved pool is shared. Deliberately not
+   *  driver-only: a child that settled during the attempt is progress by any reading, and the
+   *  coarser signal can only bias toward rescuing a run, never toward abandoning one. */
+  readonly poolTokensSpent: number;
+  /** Monotone count of settled children. */
+  readonly settledCount: number;
+  /** Whether an accepted deliverable exists. */
+  readonly submitted: boolean;
+}
+/**
+ * Classify one driver failure. Runtime's own typed refusals are decisions and stay terminal;
+ * anything foreign is an accident and is retryable. A `BackendTransportError` is split by status
+ * because the taxonomy already promises consumers may branch on it: a 5xx/429/408 is the upstream
+ * having a bad moment, while a 401/404/422 is a request that will fail identically forever.
+ */
+declare function classifyDriverFailure(error: unknown, signal?: AbortSignal): 'transient' | 'terminal';
+/** The error a give-up throws: the original cause, re-described with the attempt history so
+ *  `driver-failed` carries a diagnosable message instead of one backend's last words. */
+declare class DriverAttemptsExhaustedError extends RuntimeRunStateError {
+  readonly attempts: readonly DriverAttemptRecord[];
+  readonly stop: DriverAttemptStop;
+  constructor(cause: unknown, attempts: readonly DriverAttemptRecord[], stop: DriverAttemptStop);
+}
+//#endregion
+//#region src/runtime/supervise/supervisor-agent.d.ts
+/** A supervisor is an exact canonical AgentProfile; no looser model/prompt shape exists. */
+type SupervisorProfile = AgentProfile$1;
+/** The exact profile fields consumed by supervisor materialization. */
+interface ResolvedSupervisorProfile {
+  readonly name: string;
+  readonly harness: string | null;
+  readonly modelId: string;
+  readonly systemPrompt?: string;
+}
+/**
+ * Reduce one canonical executable profile to the scalars the two brain arms consume.
+ */
+declare function resolveSupervisorProfile(profile: SupervisorProfile): ResolvedSupervisorProfile;
+/** Where the coordination MCP binds. Omit = an ephemeral port on `127.0.0.1` (the local-harness
+ *  default); set `host` when the root or the harness runs off-host. */
+interface CoordinationBinding {
+  readonly host?: string;
+  readonly port?: number;
+  /** Explicit acknowledgment required to bind a NON-loopback host — see
+   *  {@link assertCoordinationBinding} for what is being accepted. */
+  readonly allowUnauthenticatedRemote?: boolean;
+}
+/**
+ * Fail closed on a non-loopback coordination bind. `serveCoordinationMcp` mounts spawn_agent /
+ * steer_agent / stop with NO authentication of any kind (it is a bare JSON-RPC-over-HTTP handler),
+ * so a non-loopback bind lets anyone who can reach the port spawn agents and spend the run's
+ * conserved budget. There is no token to require yet, so the only honest options are loopback or an
+ * explicit, recorded acknowledgment — never a silent bind.
+ */
+declare function assertCoordinationBinding(binding: CoordinationBinding | undefined): void;
+/** Trusted run/node identity Runtime binds to one manager. Model-authored tool arguments cannot
+ *  provide or replace any of these fields. */
+interface SupervisorNodeContext {
+  readonly runId: string;
+  /** Stable across a durable restart; unique per in-memory invocation. */
+  readonly runNamespace: string;
+  /** Concrete Scope node that owns this manager's coordination stream. */
+  readonly nodeId: string;
+  /** Stable identity of this manager's coordination stream. */
+  readonly ownerId: string;
+  readonly depth: number;
+  readonly identity: NodeExecutionIdentity;
+  /** Assignment identity within the parent manager; absent only for the root. */
+  readonly assignmentId?: string;
+  readonly profile: SupervisorProfile;
+  readonly task: unknown;
+}
+/** Context known before `Agent.act`; Runtime adds the concrete node, profile, and task. */
+type SupervisorNodeContextSeed = Omit<SupervisorNodeContext, 'nodeId' | 'profile' | 'task'>;
+/** Trusted context for one product-tool invocation. The node identity remains the same detached,
+ * immutable snapshot supplied to the resolver; `signal` is the one live control reference Runtime
+ * adds. It aborts when this manager's scope is cancelled by the caller, RootHandle, deadline,
+ * breaker, or a recursive parent. */
+interface SupervisorToolInvocationContext extends SupervisorNodeContext {
+  readonly signal: AbortSignal;
+}
+/** One product-owned tool. It reuses the canonical MCP descriptor fields while Runtime supplies
+ *  the trusted invocation context as a separate argument and binds the result for either
+ *  transport. Existing handlers remain compatible: the second argument only gains `signal`. */
+interface SupervisorToolDescriptor extends Omit<McpToolDescriptor$1, 'handler'> {
+  readonly handler: (raw: unknown, context: SupervisorToolInvocationContext) => Promise<unknown>;
+}
+/** Product policy for the tools one exact supervisor node may call. Resolved once per node. */
+type ResolveSupervisorTools = (context: SupervisorNodeContext) => ReadonlyArray<SupervisorToolDescriptor> | Promise<ReadonlyArray<SupervisorToolDescriptor>>;
+/** Context-aware observer used internally to bind product transactions to the actual live node. */
+type ObserveSupervisorNodeEvent = (context: SupervisorNodeContext, event: CoordinationEvent, record: BusRecord<CoordinationEvent>) => void | Promise<void>;
+/** How to run an external harness as the DRIVER, with the coordination verbs mounted — the substrate
+ *  seam the caller supplies (mirrors `makeWorkerAgent` for spawned children). It runs `profile` on
+ *  `task` in its backend (remote sandbox or local CLI bridge) with `coordinationMcpUrl` mounted as an MCP server,
+ *  so the harness calls spawn_agent / await_event / stop as native tools over the live scope. */
+interface DriveHarness {
+  (args: {
+    /** The caller's profile, EXACTLY as passed to `supervisorAgent` — never rewritten. A canonical
+     *  `AgentProfile` stays schema-valid here (the canonical schema rejects unknown top-level keys,
+     *  so hoisting a resolved prompt onto it would make a profile its own validator refuses). */
+    readonly profile: SupervisorProfile;
+    /** The standing instruction assembled from the profile: its system prompt in either spelling,
+     *  plus the `prompt.instructions` and `resources.instructions` lines. Absent when the profile
+     *  names none — the harness's own default then applies. This, not `profile.systemPrompt`, is
+     *  what the harness should run under. */
+    readonly systemPrompt?: string;
+    readonly task: unknown;
+    readonly scope: Scope<unknown>;
+    readonly coordinationMcpUrl: string;
+    /** Data-only product tool surface mounted on the coordination MCP. Runtime-owned drivers include
+     *  this in their materialization evidence without persisting executable handlers. */
+    readonly coordinationTools: ReadonlyArray<Omit<McpToolDescriptor$1, 'handler'>>;
+  }): Promise<void>;
+  /** Optional live inbox for the manager session this adapter currently drives. Return `false`
+   * when no executor inbox is active instead of claiming a message was delivered. */
+  deliver?(message: unknown): boolean;
+}
+/** Trusted manager identity available before its external harness starts. A product uses this to
+ * return one independently steerable harness session per recursive manager. */
+type DriveHarnessOwnerContext = Omit<SupervisorNodeContext, 'nodeId'>;
+/** Resolve an external harness for one exact Runtime-owned manager identity. */
+type ResolveDriveHarness = (context: DriveHarnessOwnerContext) => DriveHarness;
+interface SupervisorAgentDeps {
+  readonly blobs: ResultBlobStore;
+  /** Resolve a spawned worker `profile` to a leaf agent — the recursion seam (same for both arms). */
+  readonly makeWorkerAgent: MakeWorkerAgent;
+  /** Product authorization for every down-leg continuation to a child. */
+  readonly authorizeDownMessage?: AuthorizeDownMessage;
+  /** Per-child budget reserved from the conserved pool on each spawn. */
+  readonly perWorker: Budget;
+  /** Independent completion check for direct driver work (`submit_result`). */
+  readonly deliverable?: DeliverableSpec<unknown>;
+  /** Hard cap on simultaneously-LIVE workers across both arms — `spawn_agent` fails closed once
+   *  this many are in flight (a concurrency fence on top of the conserved-pool fence; bounds live
+   *  boxes/sandboxes, not total work). Omit/`<= 0` = no cap. */
+  readonly maxLiveWorkers?: number;
+  /** Router substrate for a router-brained supervisor (`harness` omitted or `cli-base`). The
+   *  profile's model wins. */
+  readonly router?: RouterTransportConfig;
+  /** Required to run an external-harness supervisor: runs the harness as the driver. */
+  readonly driveHarness?: DriveHarness;
+  /** How hard a transiently-failed EXTERNAL driver is re-entered before the run ends
+   *  `driver-failed` (#741). Retries reuse the same scope, coordination server, and live children;
+   *  the bridge backend reattaches the harness session by its durable execution id. Omit = retry
+   *  under the defaults; `{ enabled: false }` = the historical first-failure-ends-the-run behavior.
+   *  The router arm is unaffected: its transport already retries. */
+  readonly driverRetry?: DriverRetryPolicy;
+  /** Per-attempt record for the external driver — how an operator sees "failed after N attempts"
+   *  instead of one backend's last words. */
+  readonly onDriverAttempt?: (record: DriverAttemptRecord) => void | Promise<void>;
+  /** Trusted identity for this manager. Required with node-scoped tools or observation. */
+  readonly nodeContext?: SupervisorNodeContextSeed;
+  /** Resolve product-owned tools for this exact manager. Static `extraTools` remain a router-only
+   *  compatibility seam and deliberately receive no new recursive authority. */
+  readonly resolveSupervisorTools?: ResolveSupervisorTools;
+  /** Awaited product observation, enriched with this manager's actual live node context. */
+  readonly observeNodeEvent?: ObserveSupervisorNodeEvent;
+  /** Replay resume-time settlements through `observeNodeEvent` before the manager starts. */
+  readonly replaySettlements?: boolean;
+  /** WORK tools the supervisor may call DIRECTLY (router arm) — so it can do simple work ITSELF and
+   *  only delegate when it needs parallelism. Pair with `executeExtraTool`. */
+  readonly extraTools?: ReadonlyArray<{
+    readonly name: string;
+    readonly description?: string;
+    readonly parameters: Record<string, unknown>;
+  }>;
+  /** Runs an `extraTools` call; null/undefined falls through to the coordination dispatch. */
+  readonly executeExtraTool?: (name: string, args: Record<string, unknown>) => Promise<string | null | undefined>;
+  /** Analyst lenses available to the driver (both arms). Required for `analyzeOnSettle`. */
+  readonly analysts?: AnalystRegistry;
+  /** Analyst kinds run on each worker-settle → a `finding` the driver composes its next steer from
+   *  (the self-improving UP-leg). Unset/empty = status quo (no analyst feed). Requires `analysts`. */
+  readonly analyzeOnSettle?: ReadonlyArray<string | AnalyzeOnSettleRoute>;
+  /** Run the ONLINE detector panel over each worker's LIVE tool trace (both arms) so the driver
+   *  learns a worker is looping mid-run instead of at settle. Omit = no online watching. */
+  readonly watchWorkers?: WorkerWatchOptions;
+  /** Idle time after which `observe_agent` reports a worker as stalled. Omit = runtime default. */
+  readonly stallAfterMs?: number;
+  /** Default continuity per worker PROFILE NAME (both arms) — `'resume'` re-attaches spawns of
+   *  that name to the node's latest settled worker; `spawn_agent`'s per-call `continuity`
+   *  overrides. Omit = every spawn fresh (status quo). */
+  readonly continuityByProfile?: Readonly<Record<string, ContinuityMode>>;
+  /** PROGRESS-derived stop rule (router arm). Ends a run that has stopped learning BEFORE it
+   *  exhausts a ceiling; it can never keep a run alive past one. Build it with `plateau` /
+   *  `noProgressFor` / `allWorkersStalled` from `supervise/stop-rules` — the thresholds are the
+   *  caller's judgment. Omit = ceilings only. */
+  readonly stopRule?: StopRule;
+  /** One-shot notification of WHY a `stopRule` ended the run. */
+  readonly onProgressStop?: (reason: string) => void;
+  readonly maxTurns?: number;
+  /** Give the supervisor brain a chapter-lifecycle on its OWN context window (router arm only) — it
+   *  distills its coordination transcript to a compact progress note once it exceeds the threshold,
+   *  instead of re-billing the whole thing every turn. See `DriverAgentOptions.compaction`. */
+  readonly compaction?: ToolLoopCompactionOptions;
+  /** Pass-through subscriber for every coordination bus event (both arms) — the seam a durable
+   *  caller hooks its coordination log onto. */
+  readonly onEvent?: (event: CoordinationEvent, record: BusRecord<CoordinationEvent>) => void | Promise<void>;
+  /** Questions, findings, and authorized continuation receipts loaded from a prior process.
+   *  Router arm: questions seed the ledger and all evidence enters the resume brief. External arm:
+   *  questions seed the ledger; receipts remain durable evidence and are never auto-delivered. */
+  readonly priorCoordination?: PriorCoordination;
+  /** Deferred owner-scoped replay for a recursive supervisor. Its stable owner is known while the
+   * parent authorizes the child, but loading remains asynchronous; Runtime calls this before the
+   * nested brain can publish or act on coordination state. */
+  readonly loadPriorCoordination?: () => Promise<PriorCoordination>;
+  /** How the settled ledger becomes the run's output (both arms). Default `bestDelivered` — the
+   *  exact keep-best every existing caller had. Always runs under the delivered-only invariant. */
+  readonly finalizer?: SupervisorFinalizer;
+  /** Where the coordination MCP binds (external arm). Omit = an ephemeral loopback port, which is
+   *  unreachable from an off-host harness. A non-loopback host fails closed — see
+   *  {@link assertCoordinationBinding}. */
+  readonly coordination?: CoordinationBinding;
+}
+/** Test-only dependency shape. It is exported only through the package's explicit `/testing`
+ * entry; production supervisor surfaces cannot replace profile-derived model execution. */
+interface SupervisorAgentTestDeps extends SupervisorAgentDeps {
+  readonly brain: ToolLoopChat;
+}
+/** Build a supervisor `Agent` from its profile: the brain resolves from `profile.harness`
+ * (backend-as-data), the same resolution rule as every worker. */
+declare function supervisorAgent(profile: SupervisorProfile, deps: SupervisorAgentDeps): Agent<unknown, unknown>;
+/** Scripted-brain construction for deterministic tests. Not exported from Runtime's main entry. */
+declare function supervisorAgentWithTestBrain(profile: SupervisorProfile, deps: SupervisorAgentTestDeps): Agent<unknown, unknown>;
+//#endregion
 //#region src/runtime/supervise/delegate.d.ts
 /** The conserved pool a `delegate()` call applies when the caller does not pass its own `budget`.
  *  A modest token ceiling + a small iteration ceiling — generous enough for a few-worker decompose,
  *  bounded enough that an unsupervised intent cannot run away. Callers override via `opts.budget`. */
 declare const defaultDelegateBudget: Budget;
 /** Inputs to {@link delegate}. The intent is the first positional arg; everything here is optional
- *  with sensible defaults, so the common call is `delegate(intent, { backend, router })`. */
+ *  with explicit execution identity, so the common call names one exact supervisor profile. */
 interface DelegateOptions<Out = unknown> {
   /** The completion oracle (settled ⟺ delivered) the authored workers settle against. Strongly
    *  recommended — without it the supervisor trusts a worker's self-report. For a code intent,
@@ -6989,21 +6505,10 @@ interface DelegateOptions<Out = unknown> {
   readonly backend?: ExecutorConfig;
   /** The conserved compute pool for the whole delegation. Defaults to {@link defaultDelegateBudget}. */
   readonly budget?: Budget;
-  /** The model the supervisor BRAIN runs on (the router model). The brain must tool-call
-   *  (`spawn_agent` / `await_event`), so a delegator model, not a hidden-reasoning model. */
-  readonly model?: string;
-  /** The supervisor brain's router substrate. REQUIRED for the default router-brained supervisor
-   *  (the brain is resolved from this), unless a test injects `brain` directly. `model` overrides
-   *  `router.model`. (Design delta vs the bare `supervise()` profile: the brain needs a router.) */
-  readonly router?: RouterConfig;
-  /** Inject the supervisor brain directly (tests / advanced) instead of resolving it from `router`. */
-  readonly brain?: ToolLoopChat;
-  /** Override the default authoring-supervisor profile (name / extra system-prompt stance). The
-   *  default already carries the authoring skill; override only to add a goal or rename. */
-  readonly supervisor?: {
-    readonly name?: string;
-    readonly systemPrompt?: string;
-  };
+  /** Exact executable authoring supervisor. Model, prompt, harness, and provider live here. */
+  readonly supervisorProfile: SupervisorProfile;
+  /** Router endpoint/auth for a `cli-base` supervisor; contains no behavioral settings. */
+  readonly router: RouterTransportConfig;
   /** Restrict the run to this subset of models (forwarded to `supervise()`). */
   readonly allowedModels?: readonly string[];
   readonly runId?: string;
@@ -7015,7 +6520,7 @@ interface DelegateOptions<Out = unknown> {
  * `result.spentTotal` reports what the whole delegation actually cost. A `winner` result carries the
  * authored worker's delivered output; a `no-winner` result names why (never a fabricated success).
  */
-declare function delegate<Out = unknown>(intent: string, opts?: DelegateOptions<Out>): Promise<SupervisedResult<Out>>;
+declare function delegate<Out = unknown>(intent: string, opts: DelegateOptions<Out>): Promise<SupervisedResult<Out>>;
 //#endregion
 //#region src/runtime/supervise/dispatch.d.ts
 /** One unit of queued work: the agent to run, its task, and the spawn options (budget + label).
@@ -7270,252 +6775,6 @@ interface SupervisorSpanRecorder {
  */
 declare function createSupervisorSpanRecorder(opts: SupervisorSpanOptions): SupervisorSpanRecorder | undefined;
 //#endregion
-//#region src/runtime/supervise/supervisor-agent.d.ts
-/**
- * The supervisor's profile — the subset of an `AgentProfile` that selects + shapes its brain.
- * `harness` is the backend-as-data discriminant; `systemPrompt` is the standing instruction.
- *
- * A canonical `AgentProfile` from `@tangle-network/agent-interface` satisfies this interface
- * structurally: its `model` is a hints OBJECT and its system prompt lives at `prompt.systemPrompt`,
- * so both spellings are accepted here and reduced by {@link resolveSupervisorProfile}. Before that,
- * a canonical profile's model object reached `RouterConfig.model` (a string) as an object and its
- * `prompt.systemPrompt` was dropped — a request the provider rejects, and a supervisor running the
- * default strategy while its profile named another.
- *
- * WHAT EACH ARM HONORS — the two brains read different amounts of a profile, so state it rather
- * than let a caller infer that a field took effect:
- *
- *  - ROUTER arm (`harness` null): only `name`, the resolved model id (`model`, or
- *    `model.default`), and the resolved system prompt (`prompt.systemPrompt`/`systemPrompt` plus
- *    `prompt.instructions` and `resources.instructions`) reach the brain. A full `AgentProfile`'s
- *    `tools`, `mcp`, `permissions`, `resources.skills`/`files`, `hooks`, `modes`, `subagents`,
- *    `model.provider`, `model.small` and `model.reasoningEffort` are NOT honored here: the router
- *    brain is one `ToolLoopChat` over the coordination verbs, and neither of its two tool-calling
- *    transports (`routerChatWithTools` buffered, `streamRouterChatWithTools` when
- *    `RouterConfig.stream` is set) has a parameter for any of them.
- *  - HARNESS arm (`harness` set): the WHOLE profile object is handed to `deps.driveHarness`
- *    untouched, plus the resolved system prompt as a separate argument. Everything the profile
- *    declares is the harness's to materialize; this module changes none of it.
- */
-interface SupervisorProfile {
-  readonly name?: string;
-  /** null/undefined/`cli-base` → router brain (in-process tool-loop); a coding-CLI harness → an
-   *  external harness brain. */
-  readonly harness?: string | null;
-  /** The router model when the brain is router-driven: a model id, or a canonical profile's model
-   *  hints whose `default` IS the id. Absent (including a hints object with no `default`) → the
-   *  deps router config's model applies. Other hints (`small`, `provider`, `reasoningEffort`) are
-   *  harness-arm material only. */
-  readonly model?: string | AgentProfileModelHints;
-  /** Canonical `AgentProfile` prompt shaping. `prompt.systemPrompt` and the top-level `systemPrompt`
-   *  are the same standing instruction in two spellings; disagreeing values are a fault, not a pick.
-   *  `prompt.instructions` lines are appended to the resolved prompt, one per line. */
-  readonly prompt?: AgentProfilePrompt;
-  /** Canonical `AgentProfile` resources. Only `instructions` shapes the brain here (appended to the
-   *  resolved system prompt); every other resource is the harness's to materialize. */
-  readonly resources?: AgentProfileResources;
-  /** The standing instructions ("you delegate, you do not solve"). */
-  readonly systemPrompt?: string;
-}
-/** A `SupervisorProfile` reduced to the scalars the two brain arms consume. `modelId`/`systemPrompt`
- *  stay `undefined` when the profile named none — the caller's fallback (`deps.router.model`,
- *  the built-in default supervisor prompt) then applies, and this type cannot hide which happened.
- *
- *  There is deliberately no `reasoningEffort` here: the router brain runs on `chatWithTools` (the
- *  buffered/streamed switch in the router client), and neither transport has a `reasoning_effort`
- *  parameter — only the chat-only `routerChatWithUsage` does — so a field carrying it would be a
- *  public promise nothing keeps. `model.reasoningEffort` still reaches the harness arm inside the
- *  profile. */
-interface ResolvedSupervisorProfile {
-  readonly name: string;
-  readonly harness: string | null;
-  readonly modelId?: string;
-  readonly systemPrompt?: string;
-}
-/**
- * Reduce either profile spelling — a hand-written `SupervisorProfile` or a canonical `AgentProfile`
- * — to the scalars the brain arms consume:
- *
- *  - `modelId`: a string `model` verbatim, else `model.default`. Absent or unresolvable → the
- *    router config's own model applies unchanged.
- *  - `systemPrompt`: the system prompt plus the `prompt.instructions` and `resources.instructions`
- *    lines, one per line.
- *
- * `supervisorAgent` resolves each piece only where it is consumed (the model id on the router arm
- * only); this whole-profile reduction is the caller-facing view of the same rules.
- */
-declare function resolveSupervisorProfile(profile: SupervisorProfile): ResolvedSupervisorProfile;
-/** Where the coordination MCP binds. Omit = an ephemeral port on `127.0.0.1` (the local-harness
- *  default); set `host` when the root or the harness runs off-host. */
-interface CoordinationBinding {
-  readonly host?: string;
-  readonly port?: number;
-  /** Explicit acknowledgment required to bind a NON-loopback host — see
-   *  {@link assertCoordinationBinding} for what is being accepted. */
-  readonly allowUnauthenticatedRemote?: boolean;
-}
-/**
- * Fail closed on a non-loopback coordination bind. `serveCoordinationMcp` mounts spawn_agent /
- * steer_agent / stop with NO authentication of any kind (it is a bare JSON-RPC-over-HTTP handler),
- * so a non-loopback bind lets anyone who can reach the port spawn agents and spend the run's
- * conserved budget. There is no token to require yet, so the only honest options are loopback or an
- * explicit, recorded acknowledgment — never a silent bind.
- */
-declare function assertCoordinationBinding(binding: CoordinationBinding | undefined): void;
-/** Trusted run/node identity Runtime binds to one manager. Model-authored tool arguments cannot
- *  provide or replace any of these fields. */
-interface SupervisorNodeContext {
-  readonly runId: string;
-  /** Stable across a durable restart; unique per in-memory invocation. */
-  readonly runNamespace: string;
-  /** Concrete Scope node that owns this manager's coordination stream. */
-  readonly nodeId: string;
-  /** Stable identity of this manager's coordination stream. */
-  readonly ownerId: string;
-  readonly depth: number;
-  readonly identity: NodeExecutionIdentity;
-  /** Assignment identity within the parent manager; absent only for the root. */
-  readonly assignmentId?: string;
-  readonly profile: SupervisorProfile;
-  readonly task: unknown;
-}
-/** Context known before `Agent.act`; Runtime adds the concrete node, profile, and task. */
-type SupervisorNodeContextSeed = Omit<SupervisorNodeContext, 'nodeId' | 'profile' | 'task'>;
-/** Trusted context for one product-tool invocation. The node identity remains the same detached,
- * immutable snapshot supplied to the resolver; `signal` is the one live control reference Runtime
- * adds. It aborts when this manager's scope is cancelled by the caller, RootHandle, deadline,
- * breaker, or a recursive parent. */
-interface SupervisorToolInvocationContext extends SupervisorNodeContext {
-  readonly signal: AbortSignal;
-}
-/** One product-owned tool. It reuses the canonical MCP descriptor fields while Runtime supplies
- *  the trusted invocation context as a separate argument and binds the result for either
- *  transport. Existing handlers remain compatible: the second argument only gains `signal`. */
-interface SupervisorToolDescriptor extends Omit<McpToolDescriptor$1, 'handler'> {
-  readonly handler: (raw: unknown, context: SupervisorToolInvocationContext) => Promise<unknown>;
-}
-/** Product policy for the tools one exact supervisor node may call. Resolved once per node. */
-type ResolveSupervisorTools = (context: SupervisorNodeContext) => ReadonlyArray<SupervisorToolDescriptor> | Promise<ReadonlyArray<SupervisorToolDescriptor>>;
-/** Context-aware observer used internally to bind product transactions to the actual live node. */
-type ObserveSupervisorNodeEvent = (context: SupervisorNodeContext, event: CoordinationEvent, record: BusRecord<CoordinationEvent>) => void | Promise<void>;
-/** How to run an external harness as the DRIVER, with the coordination verbs mounted — the substrate
- *  seam the caller supplies (mirrors `makeWorkerAgent` for spawned children). It runs `profile` on
- *  `task` in its backend (remote sandbox or local CLI bridge) with `coordinationMcpUrl` mounted as an MCP server,
- *  so the harness calls spawn_agent / await_event / stop as native tools over the live scope. */
-interface DriveHarness {
-  (args: {
-    /** The caller's profile, EXACTLY as passed to `supervisorAgent` — never rewritten. A canonical
-     *  `AgentProfile` stays schema-valid here (the canonical schema rejects unknown top-level keys,
-     *  so hoisting a resolved prompt onto it would make a profile its own validator refuses). */
-    readonly profile: SupervisorProfile;
-    /** The standing instruction assembled from the profile: its system prompt in either spelling,
-     *  plus the `prompt.instructions` and `resources.instructions` lines. Absent when the profile
-     *  names none — the harness's own default then applies. This, not `profile.systemPrompt`, is
-     *  what the harness should run under. */
-    readonly systemPrompt?: string;
-    readonly task: unknown;
-    readonly scope: Scope<unknown>;
-    readonly coordinationMcpUrl: string;
-    /** Data-only product tool surface mounted on the coordination MCP. Runtime-owned drivers include
-     *  this in their materialization evidence without persisting executable handlers. */
-    readonly coordinationTools: ReadonlyArray<Omit<McpToolDescriptor$1, 'handler'>>;
-  }): Promise<void>;
-  /** Optional live inbox for the manager session this adapter currently drives. Return `false`
-   * when no executor inbox is active instead of claiming a message was delivered. */
-  deliver?(message: unknown): boolean;
-}
-/** Trusted manager identity available before its external harness starts. A product uses this to
- * return one independently steerable harness session per recursive manager. */
-type DriveHarnessOwnerContext = Omit<SupervisorNodeContext, 'nodeId'>;
-/** Resolve an external harness for one exact Runtime-owned manager identity. */
-type ResolveDriveHarness = (context: DriveHarnessOwnerContext) => DriveHarness;
-interface SupervisorAgentDeps {
-  readonly blobs: ResultBlobStore;
-  /** Resolve a spawned worker `profile` to a leaf agent — the recursion seam (same for both arms). */
-  readonly makeWorkerAgent: MakeWorkerAgent;
-  /** Product authorization for every down-leg continuation to a child. */
-  readonly authorizeDownMessage?: AuthorizeDownMessage;
-  /** Per-child budget reserved from the conserved pool on each spawn. */
-  readonly perWorker: Budget;
-  /** Independent completion check for direct driver work (`submit_result`). */
-  readonly deliverable?: DeliverableSpec<unknown>;
-  /** Hard cap on simultaneously-LIVE workers across both arms — `spawn_agent` fails closed once
-   *  this many are in flight (a concurrency fence on top of the conserved-pool fence; bounds live
-   *  boxes/sandboxes, not total work). Omit/`<= 0` = no cap. */
-  readonly maxLiveWorkers?: number;
-  /** Router substrate for a router-brained supervisor (`harness` omitted or `cli-base`). The
-   *  profile's model wins. */
-  readonly router?: RouterConfig;
-  /** Inject the brain directly (tests / advanced) instead of resolving `routerBrain` from the profile. */
-  readonly brain?: ToolLoopChat;
-  /** Required to run an external-harness supervisor: runs the harness as the driver. */
-  readonly driveHarness?: DriveHarness;
-  /** Trusted identity for this manager. Required with node-scoped tools or observation. */
-  readonly nodeContext?: SupervisorNodeContextSeed;
-  /** Resolve product-owned tools for this exact manager. Static `extraTools` remain a router-only
-   *  compatibility seam and deliberately receive no new recursive authority. */
-  readonly resolveSupervisorTools?: ResolveSupervisorTools;
-  /** Awaited product observation, enriched with this manager's actual live node context. */
-  readonly observeNodeEvent?: ObserveSupervisorNodeEvent;
-  /** Replay resume-time settlements through `observeNodeEvent` before the manager starts. */
-  readonly replaySettlements?: boolean;
-  /** WORK tools the supervisor may call DIRECTLY (router arm) — so it can do simple work ITSELF and
-   *  only delegate when it needs parallelism. Pair with `executeExtraTool`. */
-  readonly extraTools?: ReadonlyArray<{
-    readonly name: string;
-    readonly description?: string;
-    readonly parameters: Record<string, unknown>;
-  }>;
-  /** Runs an `extraTools` call; null/undefined falls through to the coordination dispatch. */
-  readonly executeExtraTool?: (name: string, args: Record<string, unknown>) => Promise<string | null | undefined>;
-  /** Analyst lenses available to the driver (both arms). Required for `analyzeOnSettle`. */
-  readonly analysts?: AnalystRegistry;
-  /** Analyst kinds run on each worker-settle → a `finding` the driver composes its next steer from
-   *  (the self-improving UP-leg). Unset/empty = status quo (no analyst feed). Requires `analysts`. */
-  readonly analyzeOnSettle?: ReadonlyArray<string | AnalyzeOnSettleRoute>;
-  /** Run the ONLINE detector panel over each worker's LIVE tool trace (both arms) so the driver
-   *  learns a worker is looping mid-run instead of at settle. Omit = no online watching. */
-  readonly watchWorkers?: WorkerWatchOptions;
-  /** Idle time after which `observe_agent` reports a worker as stalled. Omit = runtime default. */
-  readonly stallAfterMs?: number;
-  /** Default continuity per worker PROFILE NAME (both arms) — `'resume'` re-attaches spawns of
-   *  that name to the node's latest settled worker; `spawn_agent`'s per-call `continuity`
-   *  overrides. Omit = every spawn fresh (status quo). */
-  readonly continuityByProfile?: Readonly<Record<string, ContinuityMode>>;
-  /** PROGRESS-derived stop rule (router arm). Ends a run that has stopped learning BEFORE it
-   *  exhausts a ceiling; it can never keep a run alive past one. Build it with `plateau` /
-   *  `noProgressFor` / `allWorkersStalled` from `supervise/stop-rules` — the thresholds are the
-   *  caller's judgment. Omit = ceilings only. */
-  readonly stopRule?: StopRule;
-  /** One-shot notification of WHY a `stopRule` ended the run. */
-  readonly onProgressStop?: (reason: string) => void;
-  readonly maxTurns?: number;
-  /** Give the supervisor brain a chapter-lifecycle on its OWN context window (router arm only) — it
-   *  distills its coordination transcript to a compact progress note once it exceeds the threshold,
-   *  instead of re-billing the whole thing every turn. See `DriverAgentOptions.compaction`. */
-  readonly compaction?: ToolLoopCompactionOptions;
-  /** Pass-through subscriber for every coordination bus event (both arms) — the seam a durable
-   *  caller hooks its coordination log onto. */
-  readonly onEvent?: (event: CoordinationEvent, record: BusRecord<CoordinationEvent>) => void | Promise<void>;
-  /** Questions, findings, and authorized continuation receipts loaded from a prior process.
-   *  Router arm: questions seed the ledger and all evidence enters the resume brief. External arm:
-   *  questions seed the ledger; receipts remain durable evidence and are never auto-delivered. */
-  readonly priorCoordination?: PriorCoordination;
-  /** Deferred owner-scoped replay for a recursive supervisor. Its stable owner is known while the
-   * parent authorizes the child, but loading remains asynchronous; Runtime calls this before the
-   * nested brain can publish or act on coordination state. */
-  readonly loadPriorCoordination?: () => Promise<PriorCoordination>;
-  /** How the settled ledger becomes the run's output (both arms). Default `bestDelivered` — the
-   *  exact keep-best every existing caller had. Always runs under the delivered-only invariant. */
-  readonly finalizer?: SupervisorFinalizer;
-  /** Where the coordination MCP binds (external arm). Omit = an ephemeral loopback port, which is
-   *  unreachable from an off-host harness. A non-loopback host fails closed — see
-   *  {@link assertCoordinationBinding}. */
-  readonly coordination?: CoordinationBinding;
-}
-/** Build a supervisor `Agent` from its profile: the brain resolves from `profile.harness` (backend-as-data), the same resolution rule as every worker. */
-declare function supervisorAgent(profile: SupervisorProfile, deps: SupervisorAgentDeps): Agent<unknown, unknown>;
-//#endregion
 //#region src/runtime/supervise/supervise.d.ts
 /**
  * Build the worker seam from a backend (WHERE workers run) + an optional completion oracle (the
@@ -7631,12 +6890,35 @@ interface SuperviseOptions {
   readonly isDriverProfile?: (input: AuthorizedSpawnContext) => boolean;
   /** The supervisor's router substrate (`profile.harness` omitted or `cli-base`). The profile's
    *  model wins. */
-  readonly router?: RouterConfig;
-  /** Inject the supervisor brain directly (tests / advanced). */
-  readonly brain?: ToolLoopChat;
+  readonly router?: RouterTransportConfig;
   /** Run an external-harness supervisor explicitly. Required for a remote sandbox; optional as a
    *  caller-owned override for a local bridge. */
   readonly driveHarness?: DriveHarness;
+  /**
+   * How hard a transiently-failed EXTERNAL driver is re-entered before the run ends
+   * `driver-failed`. A harness process SIGKILLed at a bridge timeout, a stream cut mid-turn, or an
+   * upstream 5xx used to end a run of arbitrary length while its budget and deadline sat almost
+   * untouched (#741). A retry re-enters the driver over the SAME scope, coordination server, and
+   * live children; the bridge backend reattaches the harness session by its durable execution id.
+   *
+   * Runtime's own refusals (a validation guard, an exhausted budget, an abort, a client-side
+   * transport status) are never retried — they were decisions. Retries stop at the budget, the
+   * deadline, an abort, or a run of attempts that changed nothing at all.
+   *
+   * Omit = retry under the defaults. `{ enabled: false }` = the historical behavior where the first
+   * driver failure ends the run. Applies to the root manager and every recursive manager under it.
+   */
+  readonly driverRetry?: DriverRetryPolicy;
+  /** Per-attempt record for every external driver in the tree — what makes "failed after N
+   *  attempts, last cause X" visible instead of one backend's last words. */
+  readonly onDriverAttempt?: (record: DriverAttemptRecord) => void | Promise<void>;
+  /**
+   * How long live children may keep running after the ROOT DRIVER FAILED, before the join barrier
+   * cascades the abort into them. A root that died did not make its children unhealthy: a child
+   * mid-unit holds work already paid for, and an immediate cascade discards everything it has not
+   * yet written. Bounded by the run's own deadline. Omit/`0` = immediate teardown.
+   */
+  readonly childSettleGraceMs?: number;
   /** Resolve one custom external-harness session per trusted manager identity. Use this instead of
    * `driveHarness` when recursive managers must be independently steerable. */
   readonly resolveDriveHarness?: ResolveDriveHarness;
@@ -7806,8 +7088,14 @@ interface AuthorizedSpawnContext {
 }
 /** Exact trusted context for selecting one backend-derived leaf's completion check. */
 type DeliverableResolutionInput = AuthorizedSpawnContext;
-/** One-call supervisor: build + run a supervisor from its profile with sensible defaults; the raw `supervisorAgent` + `createSupervisor().run` seams stay available for power use. */
+/** Test-only one-call shape, exported only through the package's explicit `/testing` entry. */
+interface SuperviseTestOptions extends SuperviseOptions {
+  readonly brain: ToolLoopChat;
+}
+/** One-call supervisor: build + run a supervisor from its exact profile. @stable */
 declare function supervise(profile: SupervisorProfile, task: unknown, opts: SuperviseOptions): Promise<SupervisedResult<unknown>>;
+/** Deterministic scripted-brain path for tests. Not exported from Runtime's main entry. */
+declare function superviseWithTestBrain(profile: SupervisorProfile, task: unknown, opts: SuperviseTestOptions): Promise<SupervisedResult<unknown>>;
 //#endregion
 //#region src/runtime/supervise/graph.d.ts
 /** A graph node: an id and a canonical `AgentProfile`. The profile is the ONLY way a node is
@@ -7909,13 +7197,11 @@ interface RunGraphOptions {
    *  directive delivery, and the edge ledger AROUND this seam — only the leaf `act` is yours. */
   readonly makeWorkerAgent?: MakeWorkerAgent;
   /** The driver brain's router substrate (`profile.harness` omitted or `cli-base`). */
-  readonly router?: RouterConfig;
+  readonly router?: RouterTransportConfig;
   /** Caller-side runtime hooks (telemetry, policy, product extensions). Composed AFTER the
    *  graph's own spawn-binding hook on the SAME event stream — the graph never swallows the
    *  seam supervise() exposes. */
   readonly hooks?: RuntimeHooks;
-  /** Inject the driver brain directly (offline tests / advanced). */
-  readonly brain?: ToolLoopChat;
   /** The analyst lens registry `analyzes` edges resolve against. ENVIRONMENT — needed only for
    *  lens analysts; an analyzes edge naming a graph NODE as its analyst needs no registry. */
   readonly analysts?: AnalystRegistry;
@@ -7957,6 +7243,10 @@ interface GraphResult<Out = unknown> {
   readonly exhaustedEdges: ReadonlyArray<string>;
   readonly runId: string;
 }
+/** Test-only graph options, exported only through the package's explicit `/testing` entry. */
+interface RunGraphTestOptions extends RunGraphOptions {
+  readonly brain: ToolLoopChat;
+}
 /**
  * Execute an {@link AgentGraph}. The root node becomes the supervisor (`supervise()` — the
  * execution core), each worker node is spawnable BY NODE ID (`spawn_agent` with
@@ -7966,17 +7256,8 @@ interface GraphResult<Out = unknown> {
  * traversal is ledgered and journaled.
  */
 declare function runGraph(graph: AgentGraph, opts: RunGraphOptions): Promise<GraphResult>;
-//#endregion
-//#region src/runtime/supervise/model-policy.d.ts
-/**
- * Throw a `ConfigError` when `allowed` is set, `model` is defined, and `model` is not a
- * member of `allowed`. No-op when `allowed` is unset (the unrestricted default) or when
- * `model` is undefined (nothing was configured to check).
- */
-declare function assertModelAllowed(model: string | undefined, allowed: readonly string[] | undefined): void;
-/** Check every canonical model-bearing field in a complete profile, including the models a
- * backend may select for cheap work, named subagents, or modes. */
-declare function assertProfileModelsAllowed(profile: AgentProfile$1, allowed: readonly string[] | undefined): void;
+/** Deterministic scripted-brain path for graph tests. Not exported from Runtime's main entry. */
+declare function runGraphWithTestBrain(graph: AgentGraph, opts: RunGraphTestOptions): Promise<GraphResult>;
 //#endregion
 //#region src/runtime/supervise/patch-checks.d.ts
 /** @experimental The per-task constraints the mechanical gate enforces. */
@@ -8002,8 +7283,6 @@ interface WorktreeCliExecutorOptions {
    * cannot honor them. Harness-specific values the materializer cannot preserve also fail closed.
    */
   profile: AgentProfile$1;
-  /** Local CLI for this leaf. This explicit choice overrides `profile.harness`. */
-  harness: LocalHarness;
   /** Default instruction for direct `execute(undefined, signal)` calls. An execution-time task
    *  is authoritative. Omit when the caller always supplies the task to `execute`. */
   taskPrompt?: string;
@@ -8014,7 +7293,7 @@ interface WorktreeCliExecutorOptions {
   /** Wall-clock cap per harness subprocess (ms). Default 5 min (the `runLocalHarness` default). */
   harnessTimeoutMs?: number;
   /** Run Codex with an ephemeral session, isolated config/instructions, network disabled, and
-   *  JSONL usage capture. Requires `harness: 'codex'`; metered by default. */
+   *  JSONL usage capture. Requires `profile.harness: 'codex'`; metered by default. */
   codexReproducible?: boolean;
   /** Absolute host paths denied to reproducible Codex (for benchmark answer copies, credentials,
    *  or other task-specific ambient state). */
@@ -8050,9 +7329,10 @@ interface WorktreeCliExecutorOptions {
  * Build a worktree-CLI leaf `Executor`. Per-spawn (a fresh worktree + abort + teardown each), so a
  * fanout of N profiles = N parallel worktrees that never clobber each other.
  *
- * Fail-loud: an empty `repoRoot`/`harness` or an explicitly empty `taskPrompt` throws at
- * construction. Calling `execute(undefined, signal)` without a configured prompt throws before a
- * worktree is created. `resultArtifact()` before `execute()` resolves throws.
+ * Fail-loud: an empty `repoRoot`, an incomplete/unsupported profile, a separate harness override,
+ * or an explicitly empty `taskPrompt` throws at construction. Calling `execute(undefined, signal)`
+ * without a configured prompt throws before a worktree is created. `resultArtifact()` before
+ * `execute()` resolves throws.
  *
  * @experimental
  */
@@ -8527,15 +7807,13 @@ declare function settledWorkerOut(input: {
 declare function closingWorkerNote(stdout: string, stderr: string): string | undefined;
 //#endregion
 //#region src/runtime/supervise/worktree-fanout.d.ts
-/** @experimental One authored harness profile in a worktree fanout: the §1.5 profile + which local
- *  harness CLI drives it. The supervisor authors `profile` per sub-task; `harness` chooses the leaf. */
+/** @experimental One authored profile in a worktree fanout. Its exact `harness` field chooses the
+ * local CLI; the supervisor authors the complete profile per sub-task. */
 interface AuthoredHarness {
   /** A short label for the worktree branch + trace node. */
   name: string;
   /** The supervisor-authored `AgentProfile` (systemPrompt + model reach the harness via §1.5). */
   profile: AgentProfile$1;
-  /** Which local harness CLI drives this leaf. */
-  harness: LocalHarness;
   /** Require measured usage from this leaf. Budgeted supervision refuses the default unmetered
    *  local-CLI mode; set false only when the selected runner actually returns token usage. */
   budgetExempt?: WorktreeCliExecutorOptions['budgetExempt'];
@@ -8603,8 +7881,9 @@ declare function failuresAnalyst(): AnalystRegistry;
 interface SurfaceWorkerConfig {
   readonly routerBaseUrl: string;
   readonly routerKey: string;
-  readonly model: string;
-  readonly maxTokens?: number;
+  /** Exact worker behavior, tools, and model. */
+  readonly profile: AgentProfile$1;
+  readonly analystProfile?: AgentProfile$1;
   readonly innerTurns?: number;
   /** Refine-shot budget for ONE worker attempt (max steered shots). Default 1. */
   readonly budget?: number;
@@ -8617,9 +7896,8 @@ interface SuperviseSurfaceOptions {
   /** The conserved compute pool for the whole supervised run. Default: sized off the worker's inner-loop
    *  bounds for a handful of worker spawns — raise it to let the driver try more. */
   readonly budget?: Budget;
-  /** The driver brain's router substrate (its own inference). Default: the worker's router + model — the
-   *  driver and workers share one router unless you separate them (e.g. a stronger driver model). */
-  readonly router?: RouterConfig;
+  /** The driver brain's Router endpoint/auth. Model and behavior remain owned by `profile`. */
+  readonly router?: RouterTransportConfig;
   /** The self-improvement lens fed to the driver on each settled worker. Default `failuresAnalyst()`
    *  (target the still-failing tests). Pass a custom registry to change it, or `null` to turn the
    *  within-run self-improvement OFF (the driver sees raw settled outputs). */
@@ -8659,5 +7937,5 @@ interface VerifierEnvironmentOptions {
 /** Any checkable task as an `Environment`, no tool surface required: the artifact is the worker's answer and the domain is one deployable `check` over it. */
 declare function createVerifierEnvironment(opts: VerifierEnvironmentOptions): Environment;
 //#endregion
-export { legacySupervisorRunsRoot as $, BenchmarkTaskRow as $a, WaterfallReport as $c, capDelegationTrace as $d, assertProfileMaterialization as $f, ForkCapableBox as $i, SandboxSeam as $l, sampleFromSettled as $n, harvestCorpus as $o, compareCheckOutcomes as $r, RunPersonified as $s, SupervisorToolInvocationContext as $t, DriveTurnTick as $u, GitWorkspaceOptions as A, fanout as Aa, PairwiseVerdict as Ac, DelegationFeedbackSnapshot as Ad, FileSpawnJournal as Af, selectChampion as Ai, createCoordinationTools as Al, DelegateOptions as An, LoopOptionsForDispatch as Ao, AuthoredProfile as Ar, RenderCorpusToInstructionsOptions as As, defaultEdgeTraversalCap as At, InMemoryFeedbackStore as Au, analyzeTrace as B, assertTraceDerivedFindings as Ba, AuditIntentOptions as Bc, FeedbackRating as Bd, materializeTreeView as Bf, StdioMcpConnection as Bi, DelegateError as Bl, PlateauOptions as Bn, envKeyProvider as Bo, CheckExecChannel as Br, VerifySpec as Bs, workerFromBackend as Bt, coderTaskFromArgs as Bu, closingWorkerNote as C, createShapeRegistry as Ca, AxisScoresOf as Cc, DelegateResearchConfig as Cd, createEventBus as Cf, EvolutionGeneration as Ci, QuestionRecord as Cl, DispatchStopReason as Cn, depthStrategy as Co, BudgetPool as Cr, Panel as Cs, EdgeTraversal as Ct, removeWorktree as Cu, UntrackedCopyStats as D, FileCorpus as Da, LeaderboardOptions as Dc, DelegateUiAuditResult as Dd, DeliverableSpec as Df, discriminatingMeans as Di, WorkerSpawnContext as Dl, freeSlots as Dn, sampleThenRefine as Do, ReservationTicket as Dr, Pipeline as Ds, GraphResult as Dt, McpTransport as Du, CopyOptions as E, runPersonified as Ea, Leaderboard as Ec, DelegateUiAuditConfig as Ed, watchTrace as Ef, StrategyEvolutionConfig as Ei, WorkerResumeContext as El, effectiveConcurrency as En, sample as Eo, ReservationRejection as Er, PanelVerdict as Es, GraphNode as Et, McpToolDescriptor$1 as Eu, gitWorkspace as F, selectValidWinner as Fa, renderLeaderboardHtml as Fc, DelegationProgress as Fd, SpawnForestInDoubtNode as Ff, strategyAuthorContract as Fi, createMcpServer as Fl, DriverAgentOptions as Fn, runAgentRounds as Fo, authoredWorker as Fr, TrajectoryNode as Fs, DeliverableResolutionInput as Ft, DelegateRunCtx as Fu, workerTraceAnalysisStore as G, McpEnvironmentOptions as Ga, AnytimeStrategySummary as Gc, UiAuditorDelegationOutput as Gd, AgentProfileMaterializationAxis as Gf, OpenSandboxRunBeforeStartContext as Gi, BridgeSeam as Gl, StopDecision as Gn, inlineSandboxClient as Go, CheckSourceCtx as Gr, WinnerStrategy as Gs, ResolveDriveHarness as Gt, FleetWorkspaceExecutorOptions as Gu, WorkerToolTraceArtifact as H, createScopeAnalyst as Ha, auditIntent as Hc, ResearchOutputShape as Hd, replaySpawnTree as Hf, connectStdioMcp as Hi, DelegateResult as Hl, ProgressTracker as Hn, resolveMcpServerLaunch as Ho, CheckRunContext as Hr, WidenDecision as Hs, DriveHarness as Ht, settleDetachedCoderTurn as Hu, jjWorkspace as I, verify as Ia, renderLeaderboardMarkdown as Ic, DelegationResultPayload as Id, SpawnForestMissingTree as If, LocalMcpMaterialization as Ii, DELEGATE_DESCRIPTION as Il, driverAgent as In, LocalSandboxClientOptions as Io, canonicalizeAuthoredProfile as Ir, TrajectoryReport as Is, SuperviseOptions as It, DetachedSessionDelegateOptions as Iu, ScopeArgs as J, BenchmarkCell as Ja, areaUnderCurve as Jc, DELEGATION_TRACE_MAX_SPANS as Jd, DefineProfileMaterializationContractOptions as Jf, SandboxRun as Ji, CliWorktreeSeam as Jl, allWorkersStalled as Jn, InProcessSandboxClientOptions as Jo, StructuralRolloutMessage as Jr, LoopShape as Js, SupervisorAgentDeps as Jt, createSiblingSandboxExecutor as Ju, createRootHandle as K, createMcpEnvironment as Ka, AnytimeTaskCurve as Kc, CappedDelegationTrace as Kd, AssertProfileMaterializationOptions as Kf, OpenSandboxRunOptions as Ki, CliSeam as Kl, StopRule as Kn, InProcessOnPrompt as Ko, RepairStop as Kr, DefinePersona as Ks, ResolveSupervisorTools as Kt, SiblingSandboxExecutorOptions as Ku, localShell as L, widen as La, renderLeaderboardSvg as Lc, DelegationStatus as Ld, SpawnForestNode as Lf, MaterializeLocalMcpOptions as Li, DELEGATE_INPUT_SCHEMA as Ll, finalizeBestDelivered as Ln, localSandboxClient as Lo, defaultProfileRichnessThresholds as Lr, TrajectoryReportFn as Ls, SuperviseRegistry as Lt, DetachedWinnerSelection as Lu, Workspace as M, loopUntil as Ma, ScoreOf as Mc, DelegationHistoryEntry as Md, InMemorySpawnJournal as Mf, AuthoredStrategy as Mi, McpServer as Ml, delegate as Mn, loopDispatch as Mo, ProfileRichnessThresholds as Mr, ScopeAnalyzeInput as Ms, AuthorizedSpawn as Mt, CoderDelegate as Mu, WorkspaceCommit as N, panel as Na, leaderboard as Nc, DelegationHistoryResult as Nd, SpawnForest as Nf, assertStrategyContract as Ni, McpServerOptions as Nl, CoordinationMcpHandle as Nn, RunAgentRoundsOptions as No, asAuthoredProfile as Nr, ScopeWidenGate as Ns, AuthorizedSpawnContext as Nt, CoderReview as Nu, copyUntrackedIntoClone as O, InMemoryCorpus as Oa, LeaderboardRow as Oc, DelegateUiAuditRoute as Od, gateOnDeliverable as Of, pickChampion as Oi, WorkerWatchOptions as Ol, queueOf as On, LoopCampaignDispatchOptions as Oo, createBudgetPool as Or, PipelineStage as Os, RunGraphOptions as Ot, FeedbackEvent as Ou, WorkspaceRun as P, pipeline as Pa, pairwiseSignificance as Pc, DelegationProfile as Pd, SpawnForestEvent as Pf, authorStrategy as Pi, createInProcessTransport as Pl, serveCoordinationMcp as Pn, defaultSelectWinner as Po, assessAuthoredProfile as Pr, SteerContext as Ps, DEFAULT_AUTHORED_PROFILE_SECURITY_POLICY as Pt, CoderReviewer as Pu, legacySupervisorRunDir as Q, BenchmarkStrategySummary as Qa, WaterfallCollector as Qc, buildDelegationTraceSpans as Qd, ValidateProfileMaterializationOptions as Qf, CheckpointCapableBox as Qi, RouterToolsSeam as Ql, plateau as Qn, HarvestReport as Qo, canDisplace as Qr, PersonaExecutors as Qs, SupervisorToolDescriptor as Qt, DriveTurnCapableBox as Qu, runInWorkspace as R, CreateScopeAnalystOptions as Ra, renderPairwiseMarkdown as Rc, DelegationStatusArgs as Rd, SpawnForestTree as Rf, McpSpawnFault as Ri, DELEGATE_TOOL_NAME as Rl, AllWorkersStalledOptions as Rn, KeyProvider as Ro, profileRichnessFinding as Rr, TrajectoryReportOptions as Rs, SuperviseRegistryTable as Rt, SettleDetachedCoderTurnOptions as Ru, WorkerEvidenceInput as S, builtinShapes as Sa, stopSentinel as Sc, DelegateResearchArgs as Sd, PublishOptions as Sf, EvolutionCandidate as Si, QuestionPolicy as Sl, DispatchReport as Sn, defineStrategy as So, createChatSessionStore as Sr, LoopUntilState as Ss, EdgeDeliveryOutcome as St, createWorktree as Su, settledWorkerOut as T, definePersona as Ta, Interval as Tc, DelegateUiAuditArgs as Td, defaultToolDetectors as Tf, ReproductionCheck as Ti, SettledWorker as Tl, RollingDispatchOptions as Tn, runAgentic as To, BudgetReadout as Tr, PanelSpec as Ts, GraphEdgeCapError as Tt, JsonRpcResponse as Tu, captureWorkerTraceEvidence as U, registryScopeAnalyst as Ua, defaultAuditorInstruction as Uc, ResearchSource as Ud, contentAddress as Uf, materializeLocalMcp as Ui, createDelegateHandler as Ul, ProgressTrackerOptions as Un, resolveSecretEnv as Uo, CheckRunner as Ur, WidenLineage as Us, DriveHarnessOwnerContext as Ut, DelegationExecutor as Uu, WORKER_TOOL_TRACE_SCHEMA_VERSION as V, buildSteerContext as Va, IntentAudit as Vc, FeedbackRefersTo as Vd, pendingWaits as Vf, StdioMcpServerSpec as Vi, DelegateHandlerOptions as Vl, ProgressSample as Vn, mcpSecretEnvMetadataKey as Vo, CheckOutcome as Vr, Widen as Vs, CoordinationBinding as Vt, detachedSessionDelegate as Vu, parseWorkerToolTraceArtifact as W, McpEndpoint as Wa, AnytimeReport as Wc, UiAuditLensFilter as Wd, AGENT_PROFILE_MATERIALIZATION_AXES as Wf, Deliverable as Wi, validateDelegateArgs as Wl, ProgressView as Wn, secretEnvOfMcpServer as Wo, CheckSource as Wr, WidenSpec as Ws, ObserveSupervisorNodeEvent as Wt, FleetHandle as Wu, settledToIteration as X, BenchmarkLift as Xa, plateauLength as Xc, DelegationTraceCollector as Xd, ProfileMaterializationContract as Xf, TurnResult as Xi, ProviderSeam as Xl, createProgressTracker as Xn, HarvestCorpusOptions as Xo, StructuralRolloutResult as Xr, Persona as Xs, SupervisorNodeContextSeed as Xt, DetachedTurn as Xu, createScope as Y, BenchmarkConfig as Ya, bestSoFar as Yc, DelegationTraceCaps as Yd, KnownAgentProfileMaterializationAxis as Yf, SandboxRunAbortError as Yi, ExecutorConfig as Yl, anyOf as Yn, inProcessSandboxClient as Yo, StructuralRolloutPolicy as Yr, Outcome as Ys, SupervisorNodeContext as Yt, DetachedSessionRefParts as Yu, WorkerSteerRequest as Z, BenchmarkReport as Za, renderAnytimeTable as Zc, DelegationTraceSpan as Zd, ProfileMaterializationIssue as Zf, openSandboxRun as Zi, RouterSeam as Zl, noProgressFor as Zn, HarvestFailure as Zo, VisibleCheck as Zr, PersonaContext as Zs, SupervisorProfile as Zt, DetachedTurnResumeDriverOptions as Zu, WorktreeFanoutOptions as _, PromotionGateOptions as _a, CompletionPolicy as _c, DelegateCodeArgs as _d, CoderOutput as _f, ChampionPick as _i, MakeWorkerAgent as _l, kernelPromptRegistry as _n, StrategyResult as _o, ChatTransportTool as _r, FanoutSynthesis as _s, WorktreePatchArtifact as _t, DiffResult as _u, SandboxInstance$1 as a, createSandboxToolPartState as aa, LeaderboardBenchScore as ac, runDetachedTurn as ad, FileDelegationStore as af, officialChecksFromMeta as ai, AuthorizeDownMessage as al, SupervisorSpanOutcome as an, AgenticSurface as ao, promptModelProfileMaterialization as ap, collectDelivered as ar, renderReport as as, workerControlLogFile as at, SteerableSandboxArgs as au, NOTE_MAX_CHARS as b, equalKOnCost as ba, deterministicCompletion as bc, DelegateFeedbackArgs as bd, BusStats as bf, EvolutionAuthor as bi, QuestionLevel as bl, supervisorPolicyPrompt as bn, adaptiveRefine as bo, chatTransportExecutor as br, LoopUntil as bs, assertProfileModelsAllowed as bt, WorktreeHandle as bu, VerifierEnvironmentOptions as c, mapSandboxToolEvent as ca, LeaderboardFlagSpec as cc, DelegationResumeContext as cd, AgentEvalError$1 as cf, selectBestIndex as ci, ContinuityMode as cl, PromptHandle as cn, ArtifactHandle as co, renderProfileMaterializationIssues as cp, runTree as cr, Corpus as cs, writeWorkerSteer as ct, Inbox as cu, SuperviseSurfaceResult as d, SandboxCapabilities as da, LeaderboardScenario as dc, DelegationRunContext as dd, ConfigError as df, AgentTurnBackend as di, CoordinationToolsOptions as dl, analyzesFindingsReportPrompt as dn, ShotPersona as do, worktreeCliProfileMaterialization as dp, CoordinationOwnerId as dr, EqualKArm as ds, RunContext as dt, WorktreeCheckRunner as du, SandboxLineage as ea, RunPersonifiedOptions as ec, RunDetachedTurnOptions as ed, composeLoopTraceEmitters as ef, composeCheckSources as ei, WaterfallSpan as el, assertCoordinationBinding as en, Environment as eo, controlProfileMaterialization as ep, DeliveredOutput as er, Observation as es, readWorkerSteerRequests as et, cliWorktreeExecutor as eu, SurfaceWorkerConfig as f, probeSandboxCapabilities as fa, LeaderboardScore as fc, DelegationTaskQueue as fd, JudgeError as ff, AgentTurnUsage as fi, DEFAULT_AWAIT_EVENT_TIMEOUT_MS as fl, createPromptRegistry as fn, ShotSpec as fo, FileCoordinationLog as fr, EqualKOnCost as fs, createFileRunContext as ft, WorktreeCommandResult as fu, AuthoredHarness as g, resolveSandboxClient as ga, CompletionEvidence as gc, hashIdempotencyInput as gd, ValidationError as gf, streamAgentTurn as gi, DownMessageEvent as gl, formatPromptHandle as gn, StrategyMessage as go, ChatTransportExecutorOptions as gr, FanoutOptions as gs, WorktreeCliExecutorOptions as gt, DiffOptions as gu, superviseSurface as h, ResolveSandboxClientOptions as ha, CompletionAnalyst as hc, SubmitOutput as hd, RuntimeRunStateError as hf, collectAgentTurn as hi, DownMessageDeliveryOutcome as hl, dumbContinuationPassPrompt as hn, StrategyCtx as ho, ChatSessionStore as hr, Fanout as hs, patchDelivered as ht, CreateWorktreeOptions as hu, SandboxEvent$1 as i, SandboxToolPartState as ia, DefinedLeaderboard as ic, parseDetachedSessionRef as id, DelegationStore as if, modelAuthoredChecks as ii, AnalyzeOnSettleRoute as il, SupervisorSpanOptions as in, AgenticRunResult as io, promptControlProfileMaterialization as ip, bestDelivered as ir, observe as is, supervisorWorkersDir as it, SandboxSteeringOptions as iu, Shell as j, flatWidenGate as ja, ProfileKeyOf as jc, DelegationHistoryArgs as jd, InMemoryResultBlobStore as jf, AuthorStrategyOptions as ji, normalizeAnalyzeOnSettle as jl, defaultDelegateBudget as jn, loopCampaignDispatch as jo, ProfileRichness as jr, ScopeAnalyst as js, runGraph as jt, eventToSnapshot as ju, withUntrackedArtifacts as k, renderCorpusToInstructions as ka, PairwiseOptions as kc, DelegationError as kd, FileResultBlobStore as kf, runStrategyEvolution as ki, canonicalFindingEvent as kl, rollingDispatch as kn, LoopDispatchOptions as ko, spendFromUsageEvents as kr, RenderCorpusToInstructions as ks, TraversalContinuity as kt, FeedbackStore as ku, createVerifierEnvironment as l, sumSandboxUsage as la, LeaderboardIterationInfo as lc, DelegationResumeDriver as ld, AgentEvalErrorCode as lf, structuralRollout as li, CoordinationEvent as ll, PromptRegistry as ln, CorpusReadbackOptions as lo, sandboxActProfileMaterialization as lp, CoordinationDeliveryEvidence as lr, CorpusFilter as ls, InMemoryRunContext as lt, InboxMessage as lu, failuresAnalyst as m, acquireSandbox as ma, defineLeaderboard as mc, SubmitInput as md, PlannerError as mf, StreamAgentTurnOptions as mi, DownMessageDeliveryAttempt as ml, dumbContinuationFailPrompt as mn, StrategyArtifacts as mo, ChatCompletionsTransport as mr, EqualKVerdict as ms, PatchDeliverableOptions as mt, WorktreeProfileMaterializationReceipt as mu, AnalystFinding$1 as n, SessionCapableBox as na, ShapeContext as nc, detachedTurnEvents as nd, DelegationPersistenceError as nf, defaultStructuralRolloutPolicy as ni, AnalystFindingEvent as nl, supervisorAgent as nn, runBenchmark as no, fullProfileMaterialization as np, FinalizerSettled as nr, ObserveOptions as ns, supervisorRunDir as nt, createExecutorRegistry as nu, computeFindingId$1 as o, extractLlmCallEvent as oa, LeaderboardBenchTask as oc, DelegationArgs as od, FileDelegationStoreOptions as of, resolveEntrySymbol as oi, AuthorizedDownMessage as ol, SupervisorSpanRecorder as on, AgenticTask as oo, promptOnlyProfileMaterialization as op, pickBestDelivered as or, AssertTraceDerivedFindings as os, workerInboxFile as ot, SteerableSandboxSession as ou, SurfaceWorkerOut as p, AcquireOptions as pa, LeaderboardSpec as pc, DelegationTaskQueueOptions as pd, NotFoundError as pf, CollectedAgentTurn as pi, DownMessageAuthorizationInput as pl, delegatesWorkerBriefPrompt as pn, Strategy as po, PriorCoordination as pr, EqualKOnCostOptions as ps, createInMemoryRunContext as pt, WorktreeHarnessResult as pu, createSupervisor as q, sanitizeMcpToolSchema as qa, anytimeReport as qc, DELEGATION_TRACE_MAX_BYTES as qd, CanonicalAgentProfileMaterializationAxis as qf, OpenSandboxRunPromptOptions as qi, CliWorktreeBridgeSeam as ql, allOf as qn, InProcessPromptCtx as qo, StructuralRolloutConfig as qr, DefinePersonaInput as qs, ResolvedSupervisorProfile as qt, createFleetWorkspaceExecutor as qu, CreateSandboxOptions$1 as r, createSandboxLineage as ra, ShapeRegistry as rc, formatDetachedSessionRef as rd, DelegationStateCorruptError as rf, filterAuthoredAsserts as ri, AnalystRegistry as rl, SupervisorSpanAttributes as rn, AgenticOptions as ro, profileMaterializationAxes as rp, SupervisorFinalizer as rr, defaultAnalystInstruction as rs, supervisorRunsRoot as rt, DEFAULT_SANDBOX_STEERING_MAX_TURNS as ru, makeFinding$1 as s, mapSandboxEvent as sa, LeaderboardBenchmarkAdapter as sc, DelegationRecord as sd, InMemoryDelegationStore as sf, sandboxCheckRunner as si, ContinuationInstruction as sl, createSupervisorSpanRecorder as sn, AgenticTool as so, promptResourceProfileMaterialization as sp, runFinalizer as sr, CombinatorShape as ss, workerInboxFileFromEventDir as st, createSteerableSandboxSession as su, AgentProfile$2 as t, SandboxLineageHandle as ta, ShapeBudget as tc, createDetachedTurnResumeDriver as td, createDelegationTraceCollector as tf, defaultExtractCandidate as ti, createWaterfallCollector as tl, resolveSupervisorProfile as tn, printBenchmarkReport as to, defineProfileMaterializationContract as tp, FinalizeContext as tr, ObserveInput as ts, safeWorkerFile as tt, createExecutor as tu, SuperviseSurfaceOptions as u, CriuCapableClient as ua, LeaderboardRunContext as uc, DelegationResumeTick as ud, BackendTransportError as uf, visibleCheckScore as ui, CoordinationTools as ul, RegisteredPrompt as un, RunAgenticOptions as uo, validateProfileMaterialization as up, CoordinationLog as ur, CorpusRecord as us, InMemoryRunContextOptions as ut, createInbox as uu, worktreeFanout as v, PromotionVerdict as va, CompletionVerdict as vc, DelegateCodeConfig as vd, BusEvent as vf, ChampionPolicy as vi, Question as vl, naiveContinuationPrompt as vn, StrategyShotResult as vo, ChatWorkerSeamOptions as vr, FanoutWinnerSelector as vs, createWorktreeCliExecutor as vt, GitRunner as vu, composeWorkerEvidence as w, registerShape as wa, GroupOf as wc, DelegateResearchResult as wd, WatchTraceOptions as wf, EvolutionReport as wi, QuestionUrgency as wl, DispatchUnit as wn, refine as wo, BudgetPoolRestore as wr, PanelJudge as ws, GraphEdge as wt, JsonRpcMessage as wu, VERIFY_TAIL_CHARS as x, trajectoryReport as xa, sentinelCompletion as xc, DelegateFeedbackResult as xd, EventBus as xf, EvolutionBandInfo as xi, QuestionOption as xl, ConcurrencyCaps as xn, breadthStrategy as xo, chatWorkerSeam as xr, LoopUntilSpec as xs, AgentGraph as xt, captureWorktreeDiff as xu, EVIDENCE_MAX_CHARS as y, promotionGate as ya, completionAuthorizes as yc, DelegateCodeResult as yd, BusRecord as yf, EvolutionArchiveNode as yi, QuestionDecision as yl, promptHandle as yn, SurfaceScore as yo, chatCompletionsTransport as yr, FlatWidenGate as ys, assertModelAllowed as yt, RemoveWorktreeOptions as yu, TrajectoryAnalysis as z, RegistryAnalyzeProjection as za, AuditIntentInput as zc, DelegationStatusResult as zd, loadSpawnForest as zf, McpToolDescriptor as zi, DelegateArgs as zl, NoProgressForOptions as zn, ResolvedMcpServerLaunch as zo, supervisorInstructions as zr, Verify as zs, supervise as zt, UiAuditorDelegate as zu };
-//# sourceMappingURL=index-BhZhQw77.d.ts.map
+export { legacySupervisorRunsRoot as $, sanitizeMcpToolSchema as $a, areaUnderCurve as $c, DeliverableSpec as $d, openSandboxRun as $i, McpTransport as $l, ProgressTrackerOptions as $n, InProcessSandboxClientOptions as $o, RepairStop as $r, LoopShape as $s, delegatesWorkerBriefPrompt as $t, DelegateUiAuditResult as $u, GitWorkspaceOptions as A, registerShape as Aa, Interval as Ac, DelegationStore as Ad, fullProfileMaterialization as Af, runStrategyEvolution as Ai, SettledWorker as Al, SupervisorProfile as An, runAgentic as Ao, chatWorkerSeam as Ar, PanelSpec as As, runGraph as At, parseDetachedSessionRef as Au, analyzeTrace as B, pipeline as Ba, renderLeaderboardHtml as Bc, PlannerError as Bd, McpSpawnFault as Bi, createMcpServer as Bl, DriverProgressMark as Bn, runAgentRounds as Bo, ProfileRichness as Br, TrajectoryNode as Bs, supervise as Bt, SubmitInput as Bu, closingWorkerNote as C, profileOptimizerModelCall as Ca, CompletionVerdict as Cc, DelegationTraceSpan as Cd, KnownAgentProfileMaterializationAxis as Cf, EvolutionCandidate as Ci, Question as Cl, ResolveDriveHarness as Cn, StrategyShotResult as Co, PriorCoordination as Cr, FanoutWinnerSelector as Cs, GraphEdgeCapError as Ct, DetachedTurnResumeDriverOptions as Cu, UntrackedCopyStats as D, trajectoryReport as Da, stopSentinel as Dc, createDelegationTraceCollector as Dd, assertProfileMaterialization as Df, StrategyEvolutionConfig as Di, QuestionPolicy as Dl, SupervisorAgentTestDeps as Dn, defineStrategy as Do, ChatTransportTool as Dr, LoopUntilState as Ds, RunGraphTestOptions as Dt, createDetachedTurnResumeDriver as Du, CopyOptions as E, equalKOnCost as Ea, sentinelCompletion as Ec, composeLoopTraceEmitters as Ed, ValidateProfileMaterializationOptions as Ef, ReproductionCheck as Ei, QuestionOption as El, SupervisorAgentDeps as En, breadthStrategy as Eo, ChatTransportExecutorOptions as Er, LoopUntilSpec as Es, RunGraphOptions as Et, RunDetachedTurnOptions as Eu, gitWorkspace as F, renderCorpusToInstructions as Fa, PairwiseVerdict as Fc, AgentEvalErrorCode as Fd, promptResourceProfileMaterialization as Ff, authorStrategy as Fi, createCoordinationTools as Fl, supervisorAgent as Fn, LoopOptionsForDispatch as Fo, ReservationRejection as Fr, RenderCorpusToInstructionsOptions as Fs, DeliverableResolutionInput as Ft, DelegationResumeDriver as Fu, workerTraceAnalysisStore as G, RegistryAnalyzeProjection as Ga, AuditIntentOptions as Gc, BusRecord as Gd, materializeLocalMcp as Gi, DelegateError as Gl, DriverAgentOptions as Gn, envKeyProvider as Go, profileRichnessFinding as Gr, VerifySpec as Gs, SupervisorSpanOutcome as Gt, DelegateCodeResult as Gu, WorkerToolTraceArtifact as H, verify as Ha, renderLeaderboardSvg as Hc, ValidationError as Hd, StdioMcpConnection as Hi, DELEGATE_INPUT_SCHEMA as Hl, classifyDriverFailure as Hn, localSandboxClient as Ho, asAuthoredProfile as Hr, TrajectoryReportFn as Hs, workerFromBackend as Ht, hashIdempotencyInput as Hu, jjWorkspace as I, fanout as Ia, ProfileKeyOf as Ic, BackendTransportError as Id, renderProfileMaterializationIssues as If, strategyAuthorContract as Ii, normalizeAnalyzeOnSettle as Il, supervisorAgentWithTestBrain as In, loopCampaignDispatch as Io, ReservationTicket as Ir, ScopeAnalyst as Is, SuperviseOptions as It, DelegationResumeTick as Iu, ScopeArgs as J, createScopeAnalyst as Ja, defaultAuditorInstruction as Jc, PublishOptions as Jd, OpenSandboxRunOptions as Ji, createDelegateHandler as Jl, AllWorkersStalledOptions as Jn, resolveSecretEnv as Jo, CheckOutcome as Jr, WidenLineage as Js, PromptHandle as Jt, DelegateResearchArgs as Ju, createRootHandle as K, assertTraceDerivedFindings as Ka, IntentAudit as Kc, BusStats as Kd, Deliverable as Ki, DelegateHandlerOptions as Kl, driverAgent as Kn, mcpSecretEnvMetadataKey as Ko, supervisorInstructions as Kr, Widen as Ks, SupervisorSpanRecorder as Kt, DelegateFeedbackArgs as Ku, localShell as L, flatWidenGate as La, ScoreOf as Lc, ConfigError as Ld, sandboxActProfileMaterialization as Lf, strategyAuthorSystemPrompt as Li, McpServer as Ll, DriverAttemptRecord as Ln, loopDispatch as Lo, createBudgetPool as Lr, ScopeAnalyzeInput as Ls, SuperviseRegistry as Lt, DelegationRunContext as Lu, Workspace as M, runPersonified as Ma, LeaderboardOptions as Mc, FileDelegationStoreOptions as Md, promptControlProfileMaterialization as Mf, AuthorStrategyOptions as Mi, WorkerSpawnContext as Ml, SupervisorToolInvocationContext as Mn, sampleThenRefine as Mo, BudgetPool as Mr, Pipeline as Ms, AuthorizedSpawn as Mt, DelegationArgs as Mu, WorkspaceCommit as N, FileCorpus as Na, LeaderboardRow as Nc, InMemoryDelegationStore as Nd, promptModelProfileMaterialization as Nf, AuthoredStrategy as Ni, WorkerWatchOptions as Nl, assertCoordinationBinding as Nn, LoopCampaignDispatchOptions as No, BudgetPoolRestore as Nr, PipelineStage as Ns, AuthorizedSpawnContext as Nt, DelegationRecord as Nu, copyUntrackedIntoClone as O, builtinShapes as Oa, AxisScoresOf as Oc, DelegationPersistenceError as Od, controlProfileMaterialization as Of, discriminatingMeans as Oi, QuestionRecord as Ol, SupervisorNodeContext as On, depthStrategy as Oo, ChatWorkerSeamOptions as Or, Panel as Os, TraversalContinuity as Ot, detachedTurnEvents as Ou, WorkspaceRun as P, InMemoryCorpus as Pa, PairwiseOptions as Pc, AgentEvalError$1 as Pd, promptOnlyProfileMaterialization as Pf, assertStrategyContract as Pi, canonicalFindingEvent as Pl, resolveSupervisorProfile as Pn, LoopDispatchOptions as Po, BudgetReadout as Pr, RenderCorpusToInstructions as Ps, DEFAULT_AUTHORED_PROFILE_SECURITY_POLICY as Pt, DelegationResumeContext as Pu, legacySupervisorRunDir as Q, createMcpEnvironment as Qa, anytimeReport as Qc, watchTrace as Qd, TurnResult as Qi, McpToolDescriptor$1 as Ql, ProgressTracker as Qn, InProcessPromptCtx as Qo, CheckSourceCtx as Qr, DefinePersonaInput as Qs, createPromptRegistry as Qt, DelegateUiAuditConfig as Qu, runInWorkspace as R, loopUntil as Ra, leaderboard as Rc, JudgeError as Rd, validateProfileMaterialization as Rf, LocalMcpMaterialization as Ri, McpServerOptions as Rl, DriverAttemptStop as Rn, RunAgentRoundsOptions as Ro, spendFromUsageEvents as Rr, ScopeWidenGate as Rs, SuperviseRegistryTable as Rt, DelegationTaskQueue as Ru, WorkerEvidenceInput as S, profileChatClient as Sa, CompletionPolicy as Sc, DelegationTraceCollector as Sd, DefineProfileMaterializationContractOptions as Sf, EvolutionBandInfo as Si, MakeWorkerAgent as Sl, ObserveSupervisorNodeEvent as Sn, StrategyResult as So, FileCoordinationLog as Sr, FanoutSynthesis as Ss, GraphEdge as St, DetachedTurn as Su, settledWorkerOut as T, assertProfileModelsAllowed as Ta, deterministicCompletion as Tc, capDelegationTrace as Td, ProfileMaterializationIssue as Tf, EvolutionReport as Ti, QuestionLevel as Tl, ResolvedSupervisorProfile as Tn, adaptiveRefine as To, ChatSessionStore as Tr, LoopUntil as Ts, GraphResult as Tt, DriveTurnTick as Tu, captureWorkerTraceEvidence as U, widen as Ua, renderPairwiseMarkdown as Uc, CoderOutput as Ud, StdioMcpServerSpec as Ui, DELEGATE_TOOL_NAME as Ul, CoordinationMcpHandle as Un, KeyProvider as Uo, assessAuthoredProfile as Ur, TrajectoryReportOptions as Us, SupervisorSpanAttributes as Ut, DelegateCodeArgs as Uu, WORKER_TOOL_TRACE_SCHEMA_VERSION as V, selectValidWinner as Va, renderLeaderboardMarkdown as Vc, RuntimeRunStateError as Vd, McpToolDescriptor as Vi, DELEGATE_DESCRIPTION as Vl, DriverRetryPolicy as Vn, LocalSandboxClientOptions as Vo, ProfileRichnessThresholds as Vr, TrajectoryReport as Vs, superviseWithTestBrain as Vt, SubmitOutput as Vu, parseWorkerToolTraceArtifact as W, CreateScopeAnalystOptions as Wa, AuditIntentInput as Wc, BusEvent as Wd, connectStdioMcp as Wi, DelegateArgs as Wl, serveCoordinationMcp as Wn, ResolvedMcpServerLaunch as Wo, defaultProfileRichnessThresholds as Wr, Verify as Ws, SupervisorSpanOptions as Wt, DelegateCodeConfig as Wu, settledToIteration as X, McpEndpoint as Xa, AnytimeStrategySummary as Xc, WatchTraceOptions as Xd, SandboxRun as Xi, JsonRpcMessage as Xl, PlateauOptions as Xn, inlineSandboxClient as Xo, CheckRunner as Xr, WinnerStrategy as Xs, RegisteredPrompt as Xt, DelegateResearchResult as Xu, createScope as Y, registryScopeAnalyst as Ya, AnytimeReport as Yc, createEventBus as Yd, OpenSandboxRunPromptOptions as Yi, validateDelegateArgs as Yl, NoProgressForOptions as Yn, secretEnvOfMcpServer as Yo, CheckRunContext as Yr, WidenSpec as Ys, PromptRegistry as Yt, DelegateResearchConfig as Yu, WorkerSteerRequest as Z, McpEnvironmentOptions as Za, AnytimeTaskCurve as Zc, defaultToolDetectors as Zd, SandboxRunAbortError as Zi, JsonRpcResponse as Zl, ProgressSample as Zn, InProcessOnPrompt as Zo, CheckSource as Zr, DefinePersona as Zs, analyzesFindingsReportPrompt as Zt, DelegateUiAuditArgs as Zu, WorktreeFanoutOptions as _, ResolveSandboxClientOptions as _a, LeaderboardScore as _c, UiAuditorDelegationOutput as _d, contentAddress as _f, visibleCheckScore as _i, DEFAULT_AWAIT_EVENT_TIMEOUT_MS as _l, defaultDelegateBudget as _n, ShotSpec as _o, runFinalizer as _r, EqualKOnCost as _s, WorktreePatchArtifact as _t, FleetWorkspaceExecutorOptions as _u, SandboxInstance$1 as a, createSandboxLineage as aa, RunPersonifiedOptions as ac, DelegationHistoryResult as ad, InMemoryResultBlobStore as af, canDisplace as ai, WaterfallSpan as al, promptHandle as an, BenchmarkTaskRow as ao, anyOf as ar, Observation as as, workerControlLogFile as at, CoderReview as au, NOTE_MAX_CHARS as b, PromotionVerdict as ba, CompletionAnalyst as bc, DELEGATION_TRACE_MAX_SPANS as bd, AssertProfileMaterializationOptions as bf, EvolutionArchiveNode as bi, DownMessageDeliveryOutcome as bl, DriveHarness as bn, StrategyCtx as bo, CoordinationLog as br, Fanout as bs, EdgeDeliveryOutcome as bt, createSiblingSandboxExecutor as bu, VerifierEnvironmentOptions as c, extractLlmCallEvent as ca, ShapeRegistry as cc, DelegationResultPayload as cd, SpawnForestEvent as cf, defaultExtractCandidate as ci, AnalystRegistry as cl, DispatchReport as cn, runBenchmark as co, plateau as cr, defaultAnalystInstruction as cs, writeWorkerSteer as ct, DetachedSessionDelegateOptions as cu, SuperviseSurfaceResult as d, sumSandboxUsage as da, LeaderboardBenchTask as dc, DelegationStatusResult as dd, SpawnForestNode as df, modelAuthoredChecks as di, AuthorizedDownMessage as dl, RollingDispatchOptions as dn, AgenticSurface as do, FinalizeContext as dr, AssertTraceDerivedFindings as ds, RunContext as dt, UiAuditorDelegate as du, CheckpointCapableBox as ea, Outcome as ec, DelegateUiAuditRoute as ed, ExecutorResultMapping as ef, StructuralRolloutConfig as ei, bestSoFar as el, dumbContinuationFailPrompt as en, BenchmarkCell as eo, ProgressView as er, inProcessSandboxClient as es, readWorkerSteerRequests as et, FeedbackEvent as eu, SurfaceWorkerConfig as f, CriuCapableClient as fa, LeaderboardBenchmarkAdapter as fc, FeedbackRating as fd, SpawnForestTree as ff, officialChecksFromMeta as fi, ContinuationInstruction as fl, effectiveConcurrency as fn, AgenticTask as fo, FinalizerSettled as fr, CombinatorShape as fs, createFileRunContext as ft, coderTaskFromArgs as fu, AuthoredHarness as g, acquireSandbox as ga, LeaderboardScenario as gc, UiAuditLensFilter as gd, replaySpawnTree as gf, structuralRollout as gi, CoordinationToolsOptions as gl, DelegateOptions as gn, RunAgenticOptions as go, pickBestDelivered as gr, EqualKArm as gs, WorktreeCliExecutorOptions as gt, FleetHandle as gu, superviseSurface as h, AcquireOptions as ha, LeaderboardRunContext as hc, ResearchSource as hd, pendingWaits as hf, selectBestIndex as hi, CoordinationTools as hl, rollingDispatch as hn, CorpusReadbackOptions as ho, collectDelivered as hr, CorpusRecord as hs, patchDelivered as ht, DelegationExecutor as hu, SandboxEvent$1 as i, SessionCapableBox as ia, RunPersonified as ic, DelegationHistoryEntry as id, FileSpawnJournal as if, VisibleCheck as ii, WaterfallReport as il, naiveContinuationPrompt as in, BenchmarkStrategySummary as io, allWorkersStalled as ir, harvestCorpus as is, supervisorWorkersDir as it, CoderDelegate as iu, Shell as j, definePersona as ja, Leaderboard as jc, FileDelegationStore as jd, profileMaterializationAxes$1 as jf, selectChampion as ji, WorkerResumeContext as jl, SupervisorToolDescriptor as jn, sample as jo, createChatSessionStore as jr, PanelVerdict as js, runGraphWithTestBrain as jt, runDetachedTurn as ju, withUntrackedArtifacts as k, createShapeRegistry as ka, GroupOf as kc, DelegationStateCorruptError as kd, defineProfileMaterializationContract as kf, pickChampion as ki, QuestionUrgency as kl, SupervisorNodeContextSeed as kn, refine as ko, chatTransportExecutor as kr, PanelJudge as ks, defaultEdgeTraversalCap as kt, formatDetachedSessionRef as ku, createVerifierEnvironment as l, mapSandboxEvent as la, DefinedLeaderboard as lc, DelegationStatus as ld, SpawnForestInDoubtNode as lf, defaultStructuralRolloutPolicy as li, AnalyzeOnSettleRoute as ll, DispatchStopReason as ln, AgenticOptions as lo, sampleFromSettled as lr, observe as ls, InMemoryRunContext as lt, DetachedWinnerSelection as lu, failuresAnalyst as m, probeSandboxCapabilities as ma, LeaderboardIterationInfo as mc, ResearchOutputShape as md, materializeTreeView as mf, sandboxCheckRunner as mi, CoordinationEvent as ml, queueOf as mn, ArtifactHandle as mo, bestDelivered as mr, CorpusFilter as ms, PatchDeliverableOptions as mt, settleDetachedCoderTurn as mu, AnalystFinding$1 as n, SandboxLineage as na, PersonaContext as nc, DelegationFeedbackSnapshot as nd, mapExecutorResult as nf, StructuralRolloutPolicy as ni, renderAnytimeTable as nl, formatPromptHandle as nn, BenchmarkLift as no, StopRule as nr, HarvestFailure as ns, supervisorRunDir as nt, InMemoryFeedbackStore as nu, computeFindingId$1 as o, SandboxToolPartState as oa, ShapeBudget as oc, DelegationProfile as od, InMemorySpawnJournal as of, compareCheckOutcomes as oi, createWaterfallCollector as ol, supervisorPolicyPrompt as on, Environment as oo, createProgressTracker as or, ObserveInput as os, workerInboxFile as ot, CoderReviewer as ou, SurfaceWorkerOut as p, SandboxCapabilities as pa, LeaderboardFlagSpec as pc, FeedbackRefersTo as pd, loadSpawnForest as pf, resolveEntrySymbol as pi, ContinuityMode as pl, freeSlots as pn, AgenticTool as po, SupervisorFinalizer as pr, Corpus as ps, createInMemoryRunContext as pt, detachedSessionDelegate as pu, createSupervisor as q, buildSteerContext as qa, auditIntent as qc, EventBus as qd, OpenSandboxRunBeforeStartContext as qi, DelegateResult as ql, finalizeBestDelivered as qn, resolveMcpServerLaunch as qo, CheckExecChannel as qr, WidenDecision as qs, createSupervisorSpanRecorder as qt, DelegateFeedbackResult as qu, CreateSandboxOptions$1 as r, SandboxLineageHandle as ra, PersonaExecutors as rc, DelegationHistoryArgs as rd, FileResultBlobStore as rf, StructuralRolloutResult as ri, WaterfallCollector as rl, kernelPromptRegistry as rn, BenchmarkReport as ro, allOf as rr, HarvestReport as rs, supervisorRunsRoot as rt, eventToSnapshot as ru, makeFinding$1 as s, createSandboxToolPartState as sa, ShapeContext as sc, DelegationProgress as sd, SpawnForest as sf, composeCheckSources as si, AnalystFindingEvent as sl, ConcurrencyCaps as sn, printBenchmarkReport as so, noProgressFor as sr, ObserveOptions as ss, workerInboxFileFromEventDir as st, DelegateRunCtx as su, AgentProfile$2 as t, ForkCapableBox as ta, Persona as tc, DelegationError as td, gateOnDeliverable as tf, StructuralRolloutMessage as ti, plateauLength as tl, dumbContinuationPassPrompt as tn, BenchmarkConfig as to, StopDecision as tr, HarvestCorpusOptions as ts, safeWorkerFile as tt, FeedbackStore as tu, SuperviseSurfaceOptions as u, mapSandboxToolEvent as ua, LeaderboardBenchScore as uc, DelegationStatusArgs as ud, SpawnForestMissingTree as uf, filterAuthoredAsserts as ui, AuthorizeDownMessage as ul, DispatchUnit as un, AgenticRunResult as uo, DeliveredOutput as ur, renderReport as us, InMemoryRunContextOptions as ut, SettleDetachedCoderTurnOptions as uu, worktreeFanout as v, resolveSandboxClient as va, LeaderboardSpec as vc, CappedDelegationTrace as vd, AGENT_PROFILE_MATERIALIZATION_AXES as vf, ChampionPick as vi, DownMessageAuthorizationInput as vl, delegate as vn, Strategy as vo, runTree as vr, EqualKOnCostOptions as vs, createWorktreeCliExecutor as vt, SiblingSandboxExecutorOptions as vu, composeWorkerEvidence as w, assertModelAllowed as wa, completionAuthorizes as wc, buildDelegationTraceSpans as wd, ProfileMaterializationContract as wf, EvolutionGeneration as wi, QuestionDecision as wl, ResolveSupervisorTools as wn, SurfaceScore as wo, ChatCompletionsTransport as wr, FlatWidenGate as ws, GraphNode as wt, DriveTurnCapableBox as wu, VERIFY_TAIL_CHARS as x, promotionGate as xa, CompletionEvidence as xc, DelegationTraceCaps as xd, CanonicalAgentProfileMaterializationAxis as xf, EvolutionAuthor as xi, DownMessageEvent as xl, DriveHarnessOwnerContext as xn, StrategyMessage as xo, CoordinationOwnerId as xr, FanoutOptions as xs, EdgeTraversal as xt, DetachedSessionRefParts as xu, EVIDENCE_MAX_CHARS as y, PromotionGateOptions as ya, defineLeaderboard as yc, DELEGATION_TRACE_MAX_BYTES as yd, AgentProfileMaterializationAxis as yf, ChampionPolicy as yi, DownMessageDeliveryAttempt as yl, CoordinationBinding as yn, StrategyArtifacts as yo, CoordinationDeliveryEvidence as yr, EqualKVerdict as ys, AgentGraph as yt, createFleetWorkspaceExecutor as yu, TrajectoryAnalysis as z, panel as za, pairwiseSignificance as zc, NotFoundError as zd, worktreeCliProfileMaterialization as zf, MaterializeLocalMcpOptions as zi, createInProcessTransport as zl, DriverAttemptsExhaustedError as zn, defaultSelectWinner as zo, AuthoredProfile as zr, SteerContext as zs, SuperviseTestOptions as zt, DelegationTaskQueueOptions as zu };
+//# sourceMappingURL=index-CoO7atyo.d.ts.map