@tangle-network/agent-runtime 0.219.0 → 0.220.1

package/dist/{supervise-W_mtzswa.js → supervise-CSYu0BeH.js}

@@ -1,10 +1,10 @@
-import { $ as createExecutor, $r as attestRuntimeOwnedScopeOwner, A as scopeRetainedOwnerPriorSpend, An as unmeteredSpend, Bn as retainedExecutorSeamKey, Ct as spendFromUsageEvents, D as consumeScopeRetainedOwnerResult, Fn as withBudgetResources, Fr as defineProfileMaterializationContract, Gr as unsupportedProfileDimensions, Gt as bridgeModelRouteRefusal, Ir as fullProfileMaterialization, J as teardownExecutor, Lr as profileMaterializationAxes$1, Mn as zeroSpend, Nn as addResourceSpend, Nr as assertProfileMaterialization, Nt as createInbox, O as prepareScopeRetainedOwnerTask, Pn as resourceTelemetry, Pr as controlProfileMaterialization, Rr as promptControlProfileMaterialization, Ur as renderUnsupported, Vn as RunCancellationReason, Wn as runAbortable, Wt as bridgeAdmissionRefusal, X as captureReusableExecutorConfig, Xt as bridgeRuntimeAttachmentsKey, Y as bindReusableExecutorExecutionId, Zt as bridgeStopSignalKey, _ as recordScopeOwnerMaterialization, bt as contentAddress, c as driverChild, ci as runtimeOwnedDriveHarnessProviderEvidence, cn as routerBrain, cr as createOtelExporter, di as runtimeOwnedExecutorProviderEvidence, dr as generateSpanId, f as beginScopeOwnerAttempt, fi as runtimeOwnedPendingExecutorMaterialization, g as meterRuntimeOwnedProviderAttempt, gn as resolveAgentEnvironmentProvider, h as meterRuntimeOwnedAccounting, hr as toOtelAttributes, j as scopeRetainedOwnerResult, jn as withTimeout, k as scopeRetainedOwnerContext, l as driverExecutorFactory, li as runtimeOwnedExecutorExecutionBinding, m as deriveNodeExecutionIdentity, n as createSupervisor, ni as inheritRuntimeOwnedExecutorAttestation, o as runFinalizer, oi as providerAttemptEvidence, pi as runtimeOwnedScopeOwnerRuntime, q as DEFAULT_SUCCESSFUL_SHUTDOWN_MS, qr as worktreeCliProfileMaterialization, r as bestDelivered, s as runTree, si as recordRuntimeOwnedDriveHarnessProviderEvidence, t as createRootHandle, tt as snapshotExecutorConfig, u as isDriverSpec, ui as runtimeOwnedExecutorMaterialization, v as restoreScopeOwnerAcceptedExecution, vn as addSpend, wt as WORKER_TRACE_PROPAGATION, xt as assertValidBudget, y as scopeOwnerExecutorNodeContext, yi as detachedSnapshot, zn as registerRetainedExecutorPreparation, zr as promptModelProfileMaterialization } from "./supervisor-WRrw0nlk.js";
-import { f as RuntimeRunStateError, i as ConfigError, m as ValidationError, r as BackendTransportError, t as AgentEvalError } from "./errors-DodWX-cb.js";
+import { $ as bindReusableExecutorExecutionId, Br as fullProfileMaterialization, C as scopeOwnerExecutorNodeContext, Ci as detachedSnapshot, Dt as spendFromUsageEvents, F as scopeRetainedOwnerResult, Fn as withTimeout, Gn as RunCancellationReason, Hr as promptControlProfileMaterialization, In as zeroSpend, Jn as runAbortable, Jt as bridgeAdmissionRefusal, Ln as addResourceSpend, Lr as assertProfileMaterialization, Lt as createInbox, M as prepareScopeRetainedOwnerTask, N as scopeRetainedOwnerContext, Ot as WORKER_TRACE_PROPAGATION, P as scopeRetainedOwnerPriorSpend, Pn as unmeteredSpend, Q as teardownExecutor, Rn as resourceTelemetry, Rr as controlProfileMaterialization, S as restoreScopeOwnerAcceptedExecution, Sn as addSpend, Tt as assertValidBudget, Un as registerRetainedExecutorPreparation, Ur as promptModelProfileMaterialization, Vr as profileMaterializationAxes$1, Wn as retainedExecutorSeamKey, Yr as unsupportedProfileDimensions, Yt as bridgeModelRouteRefusal, Z as DEFAULT_SUCCESSFUL_SHUTDOWN_MS, Zr as worktreeCliProfileMaterialization, _i as runtimeOwnedScopeOwnerRuntime, at as snapshotExecutorConfig, b as meterRuntimeOwnedProviderAttempt, bn as resolveAgentEnvironmentProvider, d as runDriverWithRetry, di as recordRuntimeOwnedDriveHarnessProviderEvidence, en as bridgeRuntimeAttachmentsKey, et as captureReusableExecutorConfig, f as driverChild, fi as runtimeOwnedDriveHarnessProviderEvidence, fn as routerBrain, fr as createOtelExporter, g as beginScopeOwnerAttempt, gi as runtimeOwnedPendingExecutorMaterialization, hi as runtimeOwnedExecutorProviderEvidence, hr as generateSpanId, j as consumeScopeRetainedOwnerResult, m as isDriverSpec, mi as runtimeOwnedExecutorMaterialization, n as createSupervisor, o as runFinalizer, oi as inheritRuntimeOwnedExecutorAttestation, p as driverExecutorFactory, pi as runtimeOwnedExecutorExecutionBinding, qr as renderUnsupported, r as bestDelivered, ri as attestRuntimeOwnedScopeOwner, rt as createExecutor, s as runTree, t as createRootHandle, tn as bridgeStopSignalKey, u as defaultUnmetContractSteer, ui as providerAttemptEvidence, v as deriveNodeExecutionIdentity, wt as contentAddress, x as recordScopeOwnerMaterialization, y as meterRuntimeOwnedAccounting, yr as toOtelAttributes, zn as withBudgetResources, zr as defineProfileMaterializationContract } from "./supervisor-n8DDNGli.js";
+import { i as ConfigError, m as ValidationError } from "./errors-DodWX-cb.js";
 import { a as concreteProfileModel, c as profileModelExecutionSettings, d as agentHarness, f as harnessRunsAgent, n as assertModelAllowed, o as enforceTokenLimits, r as assertProfileModelsAllowed, s as profileBridgeWireModel, t as assertExecutableAgentProfile } from "./model-policy-DKDyr-fc.js";
 import { t as composeRuntimeHooks } from "./runtime-hooks-tXpAarhW.js";
-import { k as writeRunCancellation, o as readRunCancelRequest, s as readRunCancellation } from "./run-layout-hZREkcfu.js";
-import { C as createCoordinationTools, F as watchRunCancellation, M as createInMemoryRunContext, P as applyRunCancellation, S as coordinationVerbNames, c as createProgressTracker, d as progressStop, j as createFileRunContext, r as driverAgent, y as DEFAULT_AWAIT_EVENT_TIMEOUT_MS } from "./coordination-driver-CvinSUI-.js";
 import { t as createStdioToolServer } from "./tool-server-BJbCPhoW.js";
+import { D as coordinationVerbNames, O as createCoordinationTools, S as watchRunCancellation, c as createProgressTracker, d as progressStop, r as driverAgent, v as createFileRunContext, w as DEFAULT_AWAIT_EVENT_TIMEOUT_MS, x as applyRunCancellation, y as createInMemoryRunContext } from "./coordination-driver-BxGh-Tnj.js";
+import { k as writeRunCancellation, o as readRunCancelRequest, s as readRunCancellation } from "./run-layout-hZREkcfu.js";
 import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, canonicalCandidateJson, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { resolve } from "node:path";
@@ -154,357 +154,43 @@ function isAsyncIterable$2(v) {
 	return v != null && typeof v[Symbol.asyncIterator] === "function";
 }
 //#endregion
-//#region src/runtime/supervise/otel-spans.ts
-/**
-* Supervisor tree → OTLP spans. OPT-IN, off by default.
-*
-* WHY. A supervised tree is legible today only by parsing this package's own spawn journal, so
-* every other multi-agent shape on the machine (a coding-CLI's subagents, a pi fanout, ad-hoc tool
-* parallelism) needs its own bespoke reader. A span carrying `parent_span_id` IS a tree, and any
-* system can emit one — so emitting spans makes the supervisor readable by the same viewer as
-* everything else, with no per-system reader.
-*
-* WHAT IT IS NOT. This is telemetry, never the record of truth. The spawn journal remains the sole
-* durable ledger for replay/resume and for cost; nothing here is read back, and a run whose export
-* fails is unaffected in every observable way. The two data models are deliberately separate.
-*
-* HOW IT ATTACHES. This is a pure `RuntimeHooks` observer over the lifecycle events `Scope` ALREADY
-* emits — `agent.spawn` (a node opened), `agent.child` (a node settled), `agent.turn` (a driver
-* inference turn was metered). It adds no event, mutates no journal, and changes no result. Because
-* `Scope` re-seeds the same hooks into every nested scope (`makeNestedScopeSeam`), one observer sees
-* the WHOLE recursion at arbitrary depth.
-*
-* SPAN SHAPE. One span per supervised node, opened at spawn and closed at settle, parented to its
-* parent node's span; the run root is the trace. Driver inference rides as an `LLM` child span under
-* the node that metered it. Attributes reuse the vocabulary the rest of the stack already reads
-* (`openinference.span.kind`, `agent.name`, `llm.token_count.*`, `llm.cost_usd`, `tangle.cost.usd`)
-* — see `@tangle-network/agent-eval`'s `src/trace/attribute-vocabulary.ts`, which is the consumer.
-*
-* UNKNOWN IS NEVER ZERO. `Spend.tokensKnown === false` / `usdKnown === false` mark work that
-* HAPPENED with an unreported count. Those spans OMIT the token/cost attribute entirely and set
-* `tangle.supervise.tokens_known` / `tangle.supervise.cost_known` to `false`, so a reader can never
-* mistake an unmeasured turn for a free one.
-*/
-/** OTEL status codes (`UNSET` / `OK` / `ERROR`) — the numeric wire values `OtelSpan.status` carries. */
-const STATUS_UNSET = 0;
-const STATUS_OK = 1;
-const STATUS_ERROR = 2;
-/** Longest string attribute value written from free-form detail, so an oversized turn payload
-*  cannot inflate a span. Identity/label attributes we control are never truncated. */
-const MAX_DETAIL_CHARS = 256;
-/**
-* Build the span recorder for one supervised run, or `undefined` when no exporter resolves — the
-* off-by-default path. A run that passes no `exporter` and no `exportConfig` never reaches this
-* function at all; one that passes an `exportConfig` with no endpoint (and no env endpoint) gets
-* `undefined` here, so "configured but unreachable" also costs nothing.
-*/
-function createSupervisorSpanRecorder(opts) {
-	const exporter = opts.exporter ?? createOtelExporter(opts.exportConfig);
-	if (!exporter) return void 0;
-	const ownsExporter = opts.exporter === void 0;
-	const now = opts.now ?? Date.now;
-	const traceId = normalizeTraceId(opts.traceId, opts.runId);
-	const rootSpanId = generateSpanId();
-	const rootStartMs = now();
-	const base = {
-		"tangle.run.id": opts.runId,
-		"tangle.sessionId": opts.runId,
-		...opts.attributes ?? {}
-	};
-	/** Node id → its open span. Seeded with the run id ⇒ the root span, because a depth-0 spawn's
-	*  `parentId` is the run id itself and every deeper spawn's is a real node id. */
-	const open = /* @__PURE__ */ new Map();
-	const spanIdOf = /* @__PURE__ */ new Map([[opts.runId, rootSpanId]]);
-	let finished = false;
-	/** Every export is best-effort: a throwing exporter must never reach the run. */
-	const emit = (span) => {
-		try {
-			exporter.exportSpan(span);
-		} catch {}
+//#region src/runtime/supervise/coordination-http.ts
+function coordinationHttpLimits(options) {
+	const positive = (name, value, fallback) => {
+		const resolved = value ?? fallback;
+		if (!Number.isSafeInteger(resolved) || resolved <= 0) throw new ConfigError(`coordination ${name} must be a positive safe integer`);
+		return resolved;
 	};
-	const span = (spanId, parentSpanId, name, startMs, endMs, attrs, status, message) => ({
-		traceId,
-		spanId,
-		...parentSpanId ? { parentSpanId } : {},
-		name,
-		kind: 1,
-		startTimeUnixNano: msToNano(startMs),
-		endTimeUnixNano: msToNano(Math.max(startMs, endMs)),
-		attributes: toOtelAttributes(attrs),
-		status: {
-			code: status,
-			...message ? { message } : {}
-		}
-	});
-	function onSpawn(event) {
-		const p = record(event.payload);
-		const childId = str(p.childId);
-		if (!childId) return;
-		const label = str(p.label) ?? "node";
-		const runtime = str(p.runtime);
-		const isWait = runtime === "wait";
-		const attrs = {
-			...base,
-			"openinference.span.kind": isWait ? "CHAIN" : "AGENT",
-			"agent.name": label,
-			"tangle.supervise.node.id": childId,
-			"tangle.supervise.node.label": label,
-			"tangle.supervise.node.kind": isWait ? "wait" : "agent",
-			"tangle.supervise.tree.root": event.runId
-		};
-		if (event.parentId) attrs["tangle.supervise.node.parent_id"] = event.parentId;
-		if (runtime) attrs["tangle.supervise.node.runtime"] = runtime;
-		if (typeof p.depth === "number") attrs["tangle.supervise.node.depth"] = p.depth;
-		if (typeof event.stepIndex === "number") attrs["tangle.supervise.node.ordinal"] = event.stepIndex;
-		if (p.resumed === true) attrs["tangle.supervise.node.resumed"] = true;
-		assignBudget(attrs, p.budget);
-		const spanId = generateSpanId();
-		spanIdOf.set(childId, spanId);
-		open.set(childId, {
-			spanId,
-			parentSpanId: event.parentId && spanIdOf.get(event.parentId) || rootSpanId,
-			name: label,
-			startMs: event.timestamp,
-			attrs
-		});
-	}
-	function onSettled(event) {
-		const p = record(event.payload);
-		const childId = str(p.childId);
-		if (!childId) return;
-		const node = open.get(childId);
-		if (!node) return;
-		open.delete(childId);
-		const status = str(p.status);
-		const down = status === "down";
-		const attrs = {
-			...node.attrs,
-			"tangle.supervise.node.status": status ?? "done"
-		};
-		if (typeof event.stepIndex === "number") attrs["tangle.supervise.node.seq"] = event.stepIndex;
-		if (typeof p.outRef === "string") attrs["tangle.supervise.node.out_ref"] = p.outRef;
-		if (typeof p.valid === "boolean") attrs["tangle.supervise.verdict.valid"] = p.valid;
-		if (typeof p.score === "number") attrs["tangle.supervise.verdict.score"] = p.score;
-		if (down) {
-			attrs["error.type"] = p.infra === true ? "infra" : "child-down";
-			const reason = str(p.reason);
-			if (reason) attrs["error.message"] = truncate(reason);
-			if (typeof p.infra === "boolean") attrs["tangle.supervise.node.infra"] = p.infra;
-		}
-		const wokeBy = str(record(p.wait).settled);
-		if (wokeBy) attrs["tangle.supervise.wait.settled"] = wokeBy;
-		assignSpend(attrs, p.spent);
-		emit(span(node.spanId, node.parentSpanId, node.name, node.startMs, event.timestamp, attrs, down ? STATUS_ERROR : STATUS_OK, down ? str(p.reason) ?? "child down" : void 0));
-	}
-	function onTurn(event) {
-		const p = record(event.payload);
-		const parentId = event.parentId;
-		const parentSpanId = parentId && spanIdOf.get(parentId) || rootSpanId;
-		const attrs = {
-			...base,
-			"openinference.span.kind": "LLM",
-			"inference.observation_kind": "LLM",
-			"tangle.supervise.node.kind": "inference"
-		};
-		if (parentId) attrs["tangle.supervise.node.id"] = parentId;
-		for (const [key, value] of Object.entries(p)) {
-			if (key === "spend") continue;
-			if (key === "driver" && typeof value === "string") {
-				attrs["agent.name"] = value;
-				attrs["inference.agent_name"] = value;
-				continue;
-			}
-			if (key === "model" && typeof value === "string") {
-				attrs["llm.model_name"] = value;
-				continue;
-			}
-			if (Array.isArray(value)) {
-				const scalars = value.filter((v) => typeof v === "string" || typeof v === "number");
-				if (scalars.length > 0) attrs[`tangle.supervise.turn.${key}`] = truncate(scalars.join(","));
-				continue;
-			}
-			if (typeof value === "string") attrs[`tangle.supervise.turn.${key}`] = truncate(value);
-			else if (typeof value === "number" || typeof value === "boolean") attrs[`tangle.supervise.turn.${key}`] = value;
-		}
-		const spend = assignSpend(attrs, p.spend);
-		const endMs = event.timestamp + (spend?.ms ?? 0);
-		emit(span(generateSpanId(), parentSpanId, "gen_ai.client.inference", event.timestamp, endMs, attrs, STATUS_OK));
+	const origins = new Set(options.allowedOrigins ?? []);
+	for (const origin of origins) {
+		const parsed = new URL(origin);
+		if (parsed.origin !== origin || !["http:", "https:"].includes(parsed.protocol)) throw new ConfigError("coordination allowedOrigins must contain canonical HTTP origins");
 	}
+	const requestTimeoutMs = positive("requestTimeoutMs", options.requestTimeoutMs, 3e4);
+	if (requestTimeoutMs > 2147483647) throw new ConfigError("coordination requestTimeoutMs exceeds the timer limit");
 	return {
-		hooks: { onEvent(event) {
-			if (finished) return;
-			try {
-				if (event.phase !== "after") return;
-				if (event.target === "agent.spawn") onSpawn(event);
-				else if (event.target === "agent.child") onSettled(event);
-				else if (event.target === "agent.turn") onTurn(event);
-			} catch {}
-		} },
-		traceId,
-		rootSpanId,
-		workerTrace(spawningNodeId) {
-			return {
-				traceId,
-				parentSpanId: spanIdOf.get(spawningNodeId) ?? rootSpanId
-			};
-		},
-		async finish(outcome) {
-			if (finished) return;
-			finished = true;
-			const endMs = now();
-			try {
-				for (const [nodeId, node] of open) emit(span(node.spanId, node.parentSpanId, node.name, node.startMs, endMs, {
-					...node.attrs,
-					"tangle.supervise.node.status": "unsettled",
-					"tangle.supervise.node.settled": false,
-					"tangle.supervise.node.id": nodeId
-				}, STATUS_UNSET));
-				open.clear();
-				emit(span(rootSpanId, opts.parentSpanId, "supervisor.run", rootStartMs, endMs, rootAttrs(base, opts.agentName ?? "supervisor", outcome), rootStatus(outcome), rootMessage(outcome)));
-				await exporter.flush();
-				if (ownsExporter) await exporter.shutdown();
-			} catch {}
-		}
+		maxRequestBytes: positive("maxRequestBytes", options.maxRequestBytes, 1024 * 1024),
+		requestTimeoutMs,
+		maxConcurrentRequests: positive("maxConcurrentRequests", options.maxConcurrentRequests, 32),
+		requestsPerMinute: positive("requestsPerMinute", options.requestsPerMinute, 600),
+		origins
 	};
 }
-function rootAttrs(base, agentName, outcome) {
-	const attrs = {
-		...base,
-		"openinference.span.kind": "AGENT",
-		"inference.observation_kind": "AGENT",
-		"agent.name": agentName,
-		"inference.agent_name": agentName,
-		"tangle.supervise.node.kind": "root"
-	};
-	const result = outcome?.result;
-	if (result) {
-		attrs["tangle.supervise.result"] = result.kind;
-		if (result.kind === "no-winner") {
-			attrs["tangle.supervise.reason"] = result.reason;
-			attrs["tangle.supervise.down_count"] = result.downCount;
-			if (result.reason === "driver-failed") {
-				attrs["error.type"] = result.error.name;
-				attrs["error.message"] = truncate(result.error.message);
-			}
-		}
-		assignSpend(attrs, result.spentTotal);
-	}
-	if (outcome?.error !== void 0) {
-		attrs["tangle.supervise.result"] = "error";
-		const err = outcome.error;
-		attrs["error.type"] = err instanceof Error ? err.name : typeof err;
-		attrs["error.message"] = truncate(err instanceof Error ? err.message : String(err));
-	}
-	return attrs;
-}
-function rootStatus(outcome) {
-	if (outcome?.error !== void 0) return STATUS_ERROR;
-	if (!outcome?.result) return STATUS_UNSET;
-	return outcome.result.kind === "winner" ? STATUS_OK : STATUS_ERROR;
-}
-function rootMessage(outcome) {
-	if (outcome?.error !== void 0) return truncate(outcome.error instanceof Error ? outcome.error.message : String(outcome.error));
-	const result = outcome?.result;
-	return result && result.kind === "no-winner" ? result.reason : void 0;
-}
-/**
-* Write a `Spend` onto a span, honouring the "a missing measurement is never zero" invariant: a
-* channel marked NOT known contributes no number at all and instead flags itself, so nothing
-* downstream can sum an unmeasured turn as free. Returns the spend it read (for the duration).
-*/
-function assignSpend(attrs, value) {
-	if (!isRecord(value)) return void 0;
-	const spend = value;
-	const tokens = isRecord(spend.tokens) ? spend.tokens : void 0;
-	if (spend.tokensKnown === false) attrs["tangle.supervise.tokens_known"] = false;
-	else if (tokens) {
-		if (typeof tokens.input === "number") attrs["llm.token_count.prompt"] = tokens.input;
-		if (typeof tokens.output === "number") attrs["llm.token_count.completion"] = tokens.output;
-	}
-	if (spend.usdKnown === false) attrs["tangle.supervise.cost_known"] = false;
-	else if (typeof spend.usd === "number" && Number.isFinite(spend.usd)) {
-		attrs["llm.cost_usd"] = spend.usd;
-		attrs["tangle.cost.usd"] = spend.usd;
-	}
-	if (typeof spend.iterations === "number") attrs["tangle.supervise.iterations"] = spend.iterations;
-	if (typeof spend.ms === "number" && spend.ms > 0) attrs["tangle.supervise.duration_ms"] = spend.ms;
-	if (typeof spend.boxMinutes === "number" && Number.isFinite(spend.boxMinutes)) attrs["tangle.platform.box_minutes"] = spend.boxMinutes;
-	if (spend.boxMinutesProvenance !== void 0) {
-		attrs["tangle.platform.box_minutes_provenance"] = spend.boxMinutesProvenance;
-		attrs["tangle.platform.box_minutes_known"] = spend.boxMinutesKnown === true;
-	}
-	if (spend.tokensProvenance !== void 0) attrs["tangle.supervise.tokens_provenance"] = spend.tokensProvenance;
-	return spend;
-}
-function assignBudget(attrs, value) {
-	if (!isRecord(value)) return;
-	const budget = value;
-	if (typeof budget.maxTokens === "number") attrs["tangle.supervise.budget.max_tokens"] = budget.maxTokens;
-	if (typeof budget.maxIterations === "number") attrs["tangle.supervise.budget.max_iterations"] = budget.maxIterations;
-	if (typeof budget.maxUsd === "number") attrs["tangle.supervise.budget.max_usd"] = budget.maxUsd;
-}
-/**
-* A trace id must be 32 hex characters. A caller-supplied one is used verbatim when it already is;
-* anything else (and the default) is DERIVED from the run id by content address — deterministic, so
-* a resumed run rejoins the trace its first process opened rather than forking a new one.
-*/
-function normalizeTraceId(traceId, runId) {
-	if (traceId && /^[0-9a-f]{32}$/i.test(traceId)) return traceId.toLowerCase();
-	return contentAddress(traceId ?? runId).slice(7, 39);
-}
-function msToNano(ms) {
-	return (BigInt(Number.isFinite(ms) ? Math.floor(ms) : 0) * 1000000n).toString();
-}
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function record(value) {
-	return isRecord(value) ? value : {};
-}
-function str(value) {
-	return typeof value === "string" && value.length > 0 ? value : void 0;
-}
-function truncate(value) {
-	return value.length > MAX_DETAIL_CHARS ? `${value.slice(0, MAX_DETAIL_CHARS)}…` : value;
-}
-//#endregion
-//#region src/runtime/supervise/coordination-http.ts
-function coordinationHttpLimits(options) {
-	const positive = (name, value, fallback) => {
-		const resolved = value ?? fallback;
-		if (!Number.isSafeInteger(resolved) || resolved <= 0) throw new ConfigError(`coordination ${name} must be a positive safe integer`);
-		return resolved;
-	};
-	const origins = new Set(options.allowedOrigins ?? []);
-	for (const origin of origins) {
-		const parsed = new URL(origin);
-		if (parsed.origin !== origin || !["http:", "https:"].includes(parsed.protocol)) throw new ConfigError("coordination allowedOrigins must contain canonical HTTP origins");
-	}
-	const requestTimeoutMs = positive("requestTimeoutMs", options.requestTimeoutMs, 3e4);
-	if (requestTimeoutMs > 2147483647) throw new ConfigError("coordination requestTimeoutMs exceeds the timer limit");
-	return {
-		maxRequestBytes: positive("maxRequestBytes", options.maxRequestBytes, 1024 * 1024),
-		requestTimeoutMs,
-		maxConcurrentRequests: positive("maxConcurrentRequests", options.maxConcurrentRequests, 32),
-		requestsPerMinute: positive("requestsPerMinute", options.requestsPerMinute, 600),
-		origins
-	};
-}
-/** One bounded HTTP adapter around the existing JSON-RPC handler; it owns no run commands. */
-function coordinationHttpHandler(input) {
-	const limits = coordinationHttpLimits(input.options);
-	let active = 0;
-	let controlActive = 0;
-	let controlRequests = 0;
-	let windowStart = Date.now();
-	let requests = 0;
-	const audit = async (outcome, status, action) => {
-		await input.options.onAudit?.({
-			...input.identity,
-			outcome,
-			status,
-			...action ? { action } : {}
-		});
+/** One bounded HTTP adapter around the existing JSON-RPC handler; it owns no run commands. */
+function coordinationHttpHandler(input) {
+	const limits = coordinationHttpLimits(input.options);
+	let active = 0;
+	let controlActive = 0;
+	let controlRequests = 0;
+	let windowStart = Date.now();
+	let requests = 0;
+	const audit = async (outcome, status, action) => {
+		await input.options.onAudit?.({
+			...input.identity,
+			outcome,
+			status,
+			...action ? { action } : {}
+		});
 	};
 	return (req, res) => {
 		let finished = false;
@@ -904,6 +590,7 @@ async function serveCoordinationMcp(opts) {
 		...opts.priorAnalystDefinitions?.length ? { priorAnalystDefinitions: opts.priorAnalystDefinitions } : {},
 		...opts.preflightSpawn ? { preflightSpawn: opts.preflightSpawn } : {},
 		...opts.resolveSpawnProfile ? { resolveSpawnProfile: opts.resolveSpawnProfile } : {},
+		...opts.spawnResourceRoot ? { spawnResourceRoot: opts.spawnResourceRoot } : {},
 		...opts.peerMail ? { peerMail: typeof opts.peerMail === "object" && opts.peerMail.limits ? { limits: opts.peerMail.limits } : {} } : {}
 	});
 	await coord.ready();
@@ -989,397 +676,407 @@ async function serveCoordinationMcp(opts) {
 		get credentialExpiresAt() {
 			return credentialExpiresAt;
 		},
-		rotateCredential,
-		settled: () => coord.settled(),
-		submittedResult: () => coord.submittedResult(),
-		drainResolved: () => coord.drainResolved(),
-		isStopped: () => coord.isStopped(),
-		history: () => coord.history(),
-		stats: () => coord.stats(),
-		raiseFinding: (finding) => coord.raiseFinding(finding),
-		mailHistory: () => mailbox?.history() ?? [],
-		stopMailThread: (threadId) => mailbox?.stopThread(threadId) ?? false,
-		close: async () => {
-			closed = true;
-			await new Promise((resolve) => {
-				server.close(() => resolve());
-			});
-			await mailListener?.close();
+		rotateCredential,
+		settled: () => coord.settled(),
+		submittedResult: () => coord.submittedResult(),
+		drainResolved: () => coord.drainResolved(),
+		isStopped: () => coord.isStopped(),
+		history: () => coord.history(),
+		stats: () => coord.stats(),
+		raiseFinding: (finding) => coord.raiseFinding(finding),
+		mailHistory: () => mailbox?.history() ?? [],
+		stopMailThread: (threadId) => mailbox?.stopThread(threadId) ?? false,
+		close: async () => {
+			closed = true;
+			await new Promise((resolve) => {
+				server.close(() => resolve());
+			});
+			await mailListener?.close();
+		}
+	};
+}
+/**
+* Stand up the peer-mail capability listener: one HTTP server, one secret path per worker, and on
+* each path a tool server carrying ONLY `send_mail` / `read_mail` with that worker's identity
+* closed over. An unknown path is a flat 404 — the path is the credential, so a request that does
+* not present a minted one is not a client to reason with.
+*
+* The host is the coordination host, which the caller has already had to justify: the loopback gate
+* above governs both listeners, and there is deliberately no way to bind mail somewhere else.
+*/
+async function servePeerMail(mailbox, host) {
+	const servers = /* @__PURE__ */ new Map();
+	const forCapability = (capabilityId) => {
+		const existing = servers.get(capabilityId);
+		if (existing) return existing;
+		const created = createStdioToolServer({
+			serverName: "peer-mail",
+			serverVersion: "1",
+			tools: mailbox.tools(capabilityId)
+		});
+		servers.set(capabilityId, created);
+		return created;
+	};
+	const listener = createServer((req, res) => {
+		const capabilityId = /^\/mail\/([0-9a-f]{32})$/.exec(req.url ?? "")?.[1];
+		if (req.method !== "POST" || capabilityId === void 0 || !mailbox.hasCapability(capabilityId)) {
+			res.writeHead(404).end();
+			return;
+		}
+		let body = "";
+		req.on("data", (chunk) => {
+			body += chunk;
+		});
+		req.on("end", () => {
+			(async () => {
+				try {
+					const message = JSON.parse(body);
+					const response = await forCapability(capabilityId).handle(message);
+					if (response === null) {
+						res.writeHead(202).end();
+						return;
+					}
+					res.writeHead(200, { "content-type": "application/json" });
+					res.end(JSON.stringify(response));
+				} catch (e) {
+					res.writeHead(200, { "content-type": "application/json" });
+					res.end(JSON.stringify({
+						jsonrpc: "2.0",
+						id: null,
+						error: {
+							code: -32700,
+							message: e instanceof Error ? e.message : "parse error"
+						}
+					}));
+				}
+			})();
+		});
+	});
+	const port = await new Promise((resolve, reject) => {
+		listener.once("error", reject);
+		listener.listen(0, host, () => {
+			const addr = listener.address();
+			resolve(typeof addr === "object" && addr ? addr.port : 0);
+		});
+	});
+	mailbox.setEndpoint(`http://${host}:${port}/mail`);
+	return { close: () => new Promise((resolve) => {
+		listener.close(() => resolve());
+	}) };
+}
+//#endregion
+//#region src/runtime/supervise/otel-spans.ts
+/**
+* Supervisor tree → OTLP spans. OPT-IN, off by default.
+*
+* WHY. A supervised tree is legible today only by parsing this package's own spawn journal, so
+* every other multi-agent shape on the machine (a coding-CLI's subagents, a pi fanout, ad-hoc tool
+* parallelism) needs its own bespoke reader. A span carrying `parent_span_id` IS a tree, and any
+* system can emit one — so emitting spans makes the supervisor readable by the same viewer as
+* everything else, with no per-system reader.
+*
+* WHAT IT IS NOT. This is telemetry, never the record of truth. The spawn journal remains the sole
+* durable ledger for replay/resume and for cost; nothing here is read back, and a run whose export
+* fails is unaffected in every observable way. The two data models are deliberately separate.
+*
+* HOW IT ATTACHES. This is a pure `RuntimeHooks` observer over the lifecycle events `Scope` ALREADY
+* emits — `agent.spawn` (a node opened), `agent.child` (a node settled), `agent.turn` (a driver
+* inference turn was metered). It adds no event, mutates no journal, and changes no result. Because
+* `Scope` re-seeds the same hooks into every nested scope (`makeNestedScopeSeam`), one observer sees
+* the WHOLE recursion at arbitrary depth.
+*
+* SPAN SHAPE. One span per supervised node, opened at spawn and closed at settle, parented to its
+* parent node's span; the run root is the trace. Driver inference rides as an `LLM` child span under
+* the node that metered it. Attributes reuse the vocabulary the rest of the stack already reads
+* (`openinference.span.kind`, `agent.name`, `llm.token_count.*`, `llm.cost_usd`, `tangle.cost.usd`)
+* — see `@tangle-network/agent-eval`'s `src/trace/attribute-vocabulary.ts`, which is the consumer.
+*
+* UNKNOWN IS NEVER ZERO. `Spend.tokensKnown === false` / `usdKnown === false` mark work that
+* HAPPENED with an unreported count. Those spans OMIT the token/cost attribute entirely and set
+* `tangle.supervise.tokens_known` / `tangle.supervise.cost_known` to `false`, so a reader can never
+* mistake an unmeasured turn for a free one.
+*/
+/** OTEL status codes (`UNSET` / `OK` / `ERROR`) — the numeric wire values `OtelSpan.status` carries. */
+const STATUS_UNSET = 0;
+const STATUS_OK = 1;
+const STATUS_ERROR = 2;
+/** Longest string attribute value written from free-form detail, so an oversized turn payload
+*  cannot inflate a span. Identity/label attributes we control are never truncated. */
+const MAX_DETAIL_CHARS = 256;
+/**
+* Build the span recorder for one supervised run, or `undefined` when no exporter resolves — the
+* off-by-default path. A run that passes no `exporter` and no `exportConfig` never reaches this
+* function at all; one that passes an `exportConfig` with no endpoint (and no env endpoint) gets
+* `undefined` here, so "configured but unreachable" also costs nothing.
+*/
+function createSupervisorSpanRecorder(opts) {
+	const exporter = opts.exporter ?? createOtelExporter(opts.exportConfig);
+	if (!exporter) return void 0;
+	const ownsExporter = opts.exporter === void 0;
+	const now = opts.now ?? Date.now;
+	const traceId = normalizeTraceId(opts.traceId, opts.runId);
+	const rootSpanId = generateSpanId();
+	const rootStartMs = now();
+	const base = {
+		"tangle.run.id": opts.runId,
+		"tangle.sessionId": opts.runId,
+		...opts.attributes ?? {}
+	};
+	/** Node id → its open span. Seeded with the run id ⇒ the root span, because a depth-0 spawn's
+	*  `parentId` is the run id itself and every deeper spawn's is a real node id. */
+	const open = /* @__PURE__ */ new Map();
+	const spanIdOf = /* @__PURE__ */ new Map([[opts.runId, rootSpanId]]);
+	let finished = false;
+	/** Every export is best-effort: a throwing exporter must never reach the run. */
+	const emit = (span) => {
+		try {
+			exporter.exportSpan(span);
+		} catch {}
+	};
+	const span = (spanId, parentSpanId, name, startMs, endMs, attrs, status, message) => ({
+		traceId,
+		spanId,
+		...parentSpanId ? { parentSpanId } : {},
+		name,
+		kind: 1,
+		startTimeUnixNano: msToNano(startMs),
+		endTimeUnixNano: msToNano(Math.max(startMs, endMs)),
+		attributes: toOtelAttributes(attrs),
+		status: {
+			code: status,
+			...message ? { message } : {}
+		}
+	});
+	function onSpawn(event) {
+		const p = record(event.payload);
+		const childId = str(p.childId);
+		if (!childId) return;
+		const label = str(p.label) ?? "node";
+		const runtime = str(p.runtime);
+		const isWait = runtime === "wait";
+		const attrs = {
+			...base,
+			"openinference.span.kind": isWait ? "CHAIN" : "AGENT",
+			"agent.name": label,
+			"tangle.supervise.node.id": childId,
+			"tangle.supervise.node.label": label,
+			"tangle.supervise.node.kind": isWait ? "wait" : "agent",
+			"tangle.supervise.tree.root": event.runId
+		};
+		if (event.parentId) attrs["tangle.supervise.node.parent_id"] = event.parentId;
+		if (runtime) attrs["tangle.supervise.node.runtime"] = runtime;
+		if (typeof p.depth === "number") attrs["tangle.supervise.node.depth"] = p.depth;
+		if (typeof event.stepIndex === "number") attrs["tangle.supervise.node.ordinal"] = event.stepIndex;
+		if (p.resumed === true) attrs["tangle.supervise.node.resumed"] = true;
+		assignBudget(attrs, p.budget);
+		const spanId = generateSpanId();
+		spanIdOf.set(childId, spanId);
+		open.set(childId, {
+			spanId,
+			parentSpanId: event.parentId && spanIdOf.get(event.parentId) || rootSpanId,
+			name: label,
+			startMs: event.timestamp,
+			attrs
+		});
+	}
+	function onSettled(event) {
+		const p = record(event.payload);
+		const childId = str(p.childId);
+		if (!childId) return;
+		const node = open.get(childId);
+		if (!node) return;
+		open.delete(childId);
+		const status = str(p.status);
+		const down = status === "down";
+		const attrs = {
+			...node.attrs,
+			"tangle.supervise.node.status": status ?? "done"
+		};
+		if (typeof event.stepIndex === "number") attrs["tangle.supervise.node.seq"] = event.stepIndex;
+		if (typeof p.outRef === "string") attrs["tangle.supervise.node.out_ref"] = p.outRef;
+		if (typeof p.valid === "boolean") attrs["tangle.supervise.verdict.valid"] = p.valid;
+		if (typeof p.score === "number") attrs["tangle.supervise.verdict.score"] = p.score;
+		if (down) {
+			attrs["error.type"] = p.infra === true ? "infra" : "child-down";
+			const reason = str(p.reason);
+			if (reason) attrs["error.message"] = truncate(reason);
+			if (typeof p.infra === "boolean") attrs["tangle.supervise.node.infra"] = p.infra;
+		}
+		const wokeBy = str(record(p.wait).settled);
+		if (wokeBy) attrs["tangle.supervise.wait.settled"] = wokeBy;
+		assignSpend(attrs, p.spent);
+		emit(span(node.spanId, node.parentSpanId, node.name, node.startMs, event.timestamp, attrs, down ? STATUS_ERROR : STATUS_OK, down ? str(p.reason) ?? "child down" : void 0));
+	}
+	function onTurn(event) {
+		const p = record(event.payload);
+		const parentId = event.parentId;
+		const parentSpanId = parentId && spanIdOf.get(parentId) || rootSpanId;
+		const attrs = {
+			...base,
+			"openinference.span.kind": "LLM",
+			"inference.observation_kind": "LLM",
+			"tangle.supervise.node.kind": "inference"
+		};
+		if (parentId) attrs["tangle.supervise.node.id"] = parentId;
+		for (const [key, value] of Object.entries(p)) {
+			if (key === "spend") continue;
+			if (key === "driver" && typeof value === "string") {
+				attrs["agent.name"] = value;
+				attrs["inference.agent_name"] = value;
+				continue;
+			}
+			if (key === "model" && typeof value === "string") {
+				attrs["llm.model_name"] = value;
+				continue;
+			}
+			if (Array.isArray(value)) {
+				const scalars = value.filter((v) => typeof v === "string" || typeof v === "number");
+				if (scalars.length > 0) attrs[`tangle.supervise.turn.${key}`] = truncate(scalars.join(","));
+				continue;
+			}
+			if (typeof value === "string") attrs[`tangle.supervise.turn.${key}`] = truncate(value);
+			else if (typeof value === "number" || typeof value === "boolean") attrs[`tangle.supervise.turn.${key}`] = value;
+		}
+		const spend = assignSpend(attrs, p.spend);
+		const endMs = event.timestamp + (spend?.ms ?? 0);
+		emit(span(generateSpanId(), parentSpanId, "gen_ai.client.inference", event.timestamp, endMs, attrs, STATUS_OK));
+	}
+	return {
+		hooks: { onEvent(event) {
+			if (finished) return;
+			try {
+				if (event.phase !== "after") return;
+				if (event.target === "agent.spawn") onSpawn(event);
+				else if (event.target === "agent.child") onSettled(event);
+				else if (event.target === "agent.turn") onTurn(event);
+			} catch {}
+		} },
+		traceId,
+		rootSpanId,
+		workerTrace(spawningNodeId) {
+			return {
+				traceId,
+				parentSpanId: spanIdOf.get(spawningNodeId) ?? rootSpanId
+			};
+		},
+		async finish(outcome) {
+			if (finished) return;
+			finished = true;
+			const endMs = now();
+			try {
+				for (const [nodeId, node] of open) emit(span(node.spanId, node.parentSpanId, node.name, node.startMs, endMs, {
+					...node.attrs,
+					"tangle.supervise.node.status": "unsettled",
+					"tangle.supervise.node.settled": false,
+					"tangle.supervise.node.id": nodeId
+				}, STATUS_UNSET));
+				open.clear();
+				emit(span(rootSpanId, opts.parentSpanId, "supervisor.run", rootStartMs, endMs, rootAttrs(base, opts.agentName ?? "supervisor", outcome), rootStatus(outcome), rootMessage(outcome)));
+				await exporter.flush();
+				if (ownsExporter) await exporter.shutdown();
+			} catch {}
 		}
 	};
 }
-/**
-* Stand up the peer-mail capability listener: one HTTP server, one secret path per worker, and on
-* each path a tool server carrying ONLY `send_mail` / `read_mail` with that worker's identity
-* closed over. An unknown path is a flat 404 — the path is the credential, so a request that does
-* not present a minted one is not a client to reason with.
-*
-* The host is the coordination host, which the caller has already had to justify: the loopback gate
-* above governs both listeners, and there is deliberately no way to bind mail somewhere else.
-*/
-async function servePeerMail(mailbox, host) {
-	const servers = /* @__PURE__ */ new Map();
-	const forCapability = (capabilityId) => {
-		const existing = servers.get(capabilityId);
-		if (existing) return existing;
-		const created = createStdioToolServer({
-			serverName: "peer-mail",
-			serverVersion: "1",
-			tools: mailbox.tools(capabilityId)
-		});
-		servers.set(capabilityId, created);
-		return created;
+function rootAttrs(base, agentName, outcome) {
+	const attrs = {
+		...base,
+		"openinference.span.kind": "AGENT",
+		"inference.observation_kind": "AGENT",
+		"agent.name": agentName,
+		"inference.agent_name": agentName,
+		"tangle.supervise.node.kind": "root"
 	};
-	const listener = createServer((req, res) => {
-		const capabilityId = /^\/mail\/([0-9a-f]{32})$/.exec(req.url ?? "")?.[1];
-		if (req.method !== "POST" || capabilityId === void 0 || !mailbox.hasCapability(capabilityId)) {
-			res.writeHead(404).end();
-			return;
+	const result = outcome?.result;
+	if (result) {
+		attrs["tangle.supervise.result"] = result.kind;
+		if (result.kind === "no-winner") {
+			attrs["tangle.supervise.reason"] = result.reason;
+			attrs["tangle.supervise.down_count"] = result.downCount;
+			if (result.reason === "driver-failed") {
+				attrs["error.type"] = result.error.name;
+				attrs["error.message"] = truncate(result.error.message);
+			}
 		}
-		let body = "";
-		req.on("data", (chunk) => {
-			body += chunk;
-		});
-		req.on("end", () => {
-			(async () => {
-				try {
-					const message = JSON.parse(body);
-					const response = await forCapability(capabilityId).handle(message);
-					if (response === null) {
-						res.writeHead(202).end();
-						return;
-					}
-					res.writeHead(200, { "content-type": "application/json" });
-					res.end(JSON.stringify(response));
-				} catch (e) {
-					res.writeHead(200, { "content-type": "application/json" });
-					res.end(JSON.stringify({
-						jsonrpc: "2.0",
-						id: null,
-						error: {
-							code: -32700,
-							message: e instanceof Error ? e.message : "parse error"
-						}
-					}));
-				}
-			})();
-		});
-	});
-	const port = await new Promise((resolve, reject) => {
-		listener.once("error", reject);
-		listener.listen(0, host, () => {
-			const addr = listener.address();
-			resolve(typeof addr === "object" && addr ? addr.port : 0);
-		});
-	});
-	mailbox.setEndpoint(`http://${host}:${port}/mail`);
-	return { close: () => new Promise((resolve) => {
-		listener.close(() => resolve());
-	}) };
-}
-//#endregion
-//#region src/runtime/supervise/driver-retry.ts
-/**
-* Root-driver retry — the root gets the same second chance a worker's transport already has.
-*
-* A spawned child that dies is typed into a `down` settlement and the driver may re-spawn it. The
-* ROOT had no such path: one dropped connection, one SIGKILLed harness process, one upstream 5xx
-* ended a run of arbitrary length with `reason: 'driver-failed'`, and every live child was torn
-* down with it (#741). The driver's budget and deadline were usually almost untouched.
-*
-* This module supplies the missing arm: run the driver again, on the SAME scope, the SAME
-* coordination server and the SAME live children, until the budget or the deadline says stop.
-* Nothing here restarts children or replays work — it re-enters the driver, and the bridge backend
-* reattaches the harness session because the execution id is bound durably per node.
-*
-* Two classifications decide everything, and both are conservative:
-*
-*  - TERMINAL failures are Runtime's own refusals: a `ValidationError`/`ConfigError` guard, an
-*    exhausted budget, an abort, a client-side transport status (401/404/422). Runtime meant them,
-*    so retrying re-runs a decision rather than recovering from an accident. They fail immediately.
-*  - TRANSIENT failures are everything foreign: a harness process that exited without a reason, a
-*    stream that cut mid-turn, a 5xx, a socket reset. Those are accidents, and they are exactly
-*    what a retry exists for.
-*
-* The one loop the budget alone cannot bound is a driver that dies INSTANTLY and repeatedly — a
-* dead-on-arrival credential, a harness that refuses to start. Spending nothing, it would retry
-* until the deadline hours later. So progress is measured between attempts, and a run of attempts
-* that changes nothing stops at `maxConsecutiveFailures`. A failure that made progress resets that
-* counter: a long run may be rescued many times, a hopeless one gives up in seconds.
-*
-* WHAT COUNTS AS PROGRESS is the part this module got wrong first, and the correction is measured.
-* The original mark read metered spend, settled children, and an accepted submission — the
-* filesystem and the meter, never the goal. Across 1,422 settled discovery-lab runs (2026-09-01)
-* that reading retried the runs that had produced NOTHING 629 of 827 times (76.1%) while retrying
-* the runs that HAD left an artifact 21 of 399 times (5.3%): the loop spent its second chances on
-* the hopeless runs and measured persistence by burn rate. So when the caller declares a completion
-* check, spend and settlements alone are NOT progress while that check is unmet; only a delivery —
-* an accepted submission, a child that passed the check, or the contract turning met — resets the
-* barren counter. A caller that declares no check reports `contract: 'none'` and keeps the exact
-* historical reading.
-*
-* THE SECOND HALF of the same defect: `budgetStop` used to be consulted only after a failure, and a
-* driver that RETURNED with the contract unmet ended the run silently — 376 of 376 winning lab runs
-* ended on this loop's own `stop: 'completed'`, with the completion gate left to label the result
-* rather than to change it. A completed drive whose contract is unmet is now a first-class moment:
-* `reprompt.maxReprompts` re-enters the SAME live session with the unmet items, and every re-entry
-* crosses the same budget, deadline, abort, and attempt bounds a retry crosses.
-*/
-/**
-* The instruction a completed-but-undelivered drive is re-entered with when the caller supplies no
-* `onUnmetContract`. It states the verdict, names what is owed, reports the ledger, and gives the
-* three steps — the same shape `depthStrategy` re-prompts a resumed session with, said in the
-* driver's own terms.
-*/
-function defaultUnmetContractSteer(context) {
-	const owed = context.describe?.trim();
-	return [
-		"The completion check has not passed. This run has delivered nothing yet.",
-		owed === void 0 || owed.length === 0 ? "The deliverable this run owes is still missing." : `The deliverable this run owes: ${owed}`,
-		`Workers settled: ${context.progress.settledCount}. Workers that passed the check: ${context.progress.deliveredCount ?? 0}.`,
-		"Do the unfinished work with the tools.",
-		"Verify that the check passes.",
-		"Then submit the result.",
-		"Do not restate work you already did."
-	].join("\n");
-}
-const DEFAULT_MAX_CONSECUTIVE_FAILURES = 3;
-const DEFAULT_MAX_ATTEMPTS = 8;
-const DEFAULT_INITIAL_BACKOFF_MS$1 = 2e3;
-const DEFAULT_MAX_BACKOFF_MS$1 = 3e4;
-/**
-* Bridge error classes the bridge itself never retries: a request that fails identically on
-* every attempt, mapped below 5xx on its HTTP path (`parse_error` 400, the other two 501). On the
-* stream path the same failure arrives with no status at all — a profile that cannot materialize
-* is a `parse_error` — and the status split alone read it as a bad moment and re-drove it to the
-* attempt ceiling.
-*/
-const DETERMINISTIC_BRIDGE_CODES = /* @__PURE__ */ new Set([
-	"parse_error",
-	"not_configured",
-	"capability_denied"
-]);
-/**
-* Classify one driver failure. Runtime's own typed refusals are decisions and stay terminal;
-* anything foreign is an accident and is retryable. A `BackendTransportError` is split by status
-* because the taxonomy already promises consumers may branch on it: a 5xx/429/408 is the upstream
-* having a bad moment, while a 401/404/422 is a request that will fail identically forever. The
-* bridge's own never-retry classes are terminal whether or not a status rides with them.
-*/
-function classifyDriverFailure(error, signal) {
-	if (signal?.aborted) return "terminal";
-	if (error instanceof Error && error.name === "AbortError") return "terminal";
-	if (error instanceof BackendTransportError) {
-		if (error.upstreamCode !== void 0 && DETERMINISTIC_BRIDGE_CODES.has(error.upstreamCode)) return "terminal";
-		const status = error.status;
-		if (status === void 0) return "transient";
-		if (status === 408 || status === 429 || status >= 500) return "transient";
-		return "terminal";
+		assignSpend(attrs, result.spentTotal);
+	}
+	if (outcome?.error !== void 0) {
+		attrs["tangle.supervise.result"] = "error";
+		const err = outcome.error;
+		attrs["error.type"] = err instanceof Error ? err.name : typeof err;
+		attrs["error.message"] = truncate(err instanceof Error ? err.message : String(err));
 	}
-	if (error instanceof ValidationError || error instanceof ConfigError || error instanceof RuntimeRunStateError) return "terminal";
-	if (error instanceof AgentEvalError) return "terminal";
-	return "transient";
+	return attrs;
 }
-/** The budget's own verdict on whether another attempt may run at all. */
-function budgetStop(budget, atMs) {
-	if (budget.deadlineMs > 0 && atMs >= budget.deadlineMs) return "deadline";
-	if (budget.tokensLeft <= 0 || budget.iterationsLeft <= 0) return "budget-exhausted";
-	if (budget.usdCapped && budget.usdLeft <= 0) return "budget-exhausted";
-	if (budget.usdCapped && budget.usdKnown === false) return "budget-exhausted";
-	if (Object.values(budget.resources ?? {}).some((resource) => !resource.known || resource.remaining <= 0)) return "budget-exhausted";
+function rootStatus(outcome) {
+	if (outcome?.error !== void 0) return STATUS_ERROR;
+	if (!outcome?.result) return STATUS_UNSET;
+	return outcome.result.kind === "winner" ? STATUS_OK : STATUS_ERROR;
 }
-function contractOf(mark) {
-	return mark.contract ?? "none";
+function rootMessage(outcome) {
+	if (outcome?.error !== void 0) return truncate(outcome.error instanceof Error ? outcome.error.message : String(outcome.error));
+	const result = outcome?.result;
+	return result && result.kind === "no-winner" ? result.reason : void 0;
 }
 /**
-* Did this attempt move the run toward its DELIVERABLE?
-*
-* A delivery always counts: an accepted submission, one more child that passed the check, or the
-* contract turning met. Spend and settlements count only while no declared check is outstanding —
-* with a check unmet they are the burn-rate reading this module's header measures and rejects.
+* Write a `Spend` onto a span, honouring the "a missing measurement is never zero" invariant: a
+* channel marked NOT known contributes no number at all and instead flags itself, so nothing
+* downstream can sum an unmeasured turn as free. Returns the spend it read (for the duration).
 */
-function madeProgress(before, after) {
-	if (after.submitted && !before.submitted) return true;
-	if ((after.deliveredCount ?? 0) > (before.deliveredCount ?? 0)) return true;
-	if (contractOf(before) !== "met" && contractOf(after) === "met") return true;
-	if (contractOf(after) === "unmet") return false;
-	return after.poolTokensSpent > before.poolTokensSpent || after.settledCount > before.settledCount;
-}
-/** The error a give-up throws: the original cause, re-described with the attempt history so
-*  `driver-failed` carries a diagnosable message instead of one backend's last words. */
-var DriverAttemptsExhaustedError = class extends RuntimeRunStateError {
-	attempts;
-	stop;
-	constructor(cause, attempts, stop) {
-		const last = attempts[attempts.length - 1];
-		const causeText = cause instanceof Error ? `${cause.name}: ${cause.message}` : describeUnknown(cause);
-		super(`supervisor driver failed after ${attempts.length} attempt(s) — stopped by ${stop}; last cause: ${causeText}` + (last?.classification ? ` (classified ${last.classification})` : ""), { cause });
-		this.attempts = Object.freeze([...attempts]);
-		this.stop = stop;
+function assignSpend(attrs, value) {
+	if (!isRecord(value)) return void 0;
+	const spend = value;
+	const tokens = isRecord(spend.tokens) ? spend.tokens : void 0;
+	if (spend.tokensKnown === false) attrs["tangle.supervise.tokens_known"] = false;
+	else if (tokens) {
+		if (typeof tokens.input === "number") attrs["llm.token_count.prompt"] = tokens.input;
+		if (typeof tokens.output === "number") attrs["llm.token_count.completion"] = tokens.output;
 	}
-};
-function describeUnknown(value) {
-	if (typeof value === "string") return value;
-	try {
-		return JSON.stringify(value) ?? String(value);
-	} catch {
-		return String(value);
+	if (spend.usdKnown === false) attrs["tangle.supervise.cost_known"] = false;
+	else if (typeof spend.usd === "number" && Number.isFinite(spend.usd)) {
+		attrs["llm.cost_usd"] = spend.usd;
+		attrs["tangle.cost.usd"] = spend.usd;
 	}
+	if (typeof spend.iterations === "number") attrs["tangle.supervise.iterations"] = spend.iterations;
+	if (typeof spend.ms === "number" && spend.ms > 0) attrs["tangle.supervise.duration_ms"] = spend.ms;
+	if (typeof spend.boxMinutes === "number" && Number.isFinite(spend.boxMinutes)) attrs["tangle.platform.box_minutes"] = spend.boxMinutes;
+	if (spend.boxMinutesProvenance !== void 0) {
+		attrs["tangle.platform.box_minutes_provenance"] = spend.boxMinutesProvenance;
+		attrs["tangle.platform.box_minutes_known"] = spend.boxMinutesKnown === true;
+	}
+	if (spend.tokensProvenance !== void 0) attrs["tangle.supervise.tokens_provenance"] = spend.tokensProvenance;
+	return spend;
 }
-async function defaultSleep$1(ms, signal) {
-	if (ms <= 0 || signal.aborted) return;
-	await new Promise((resolve) => {
-		const done = () => {
-			clearTimeout(timer);
-			signal.removeEventListener("abort", done);
-			resolve();
-		};
-		const timer = setTimeout(done, ms);
-		if (typeof timer === "object" && timer !== null && "unref" in timer) timer.unref();
-		signal.addEventListener("abort", done, { once: true });
-	});
+function assignBudget(attrs, value) {
+	if (!isRecord(value)) return;
+	const budget = value;
+	if (typeof budget.maxTokens === "number") attrs["tangle.supervise.budget.max_tokens"] = budget.maxTokens;
+	if (typeof budget.maxIterations === "number") attrs["tangle.supervise.budget.max_iterations"] = budget.maxIterations;
+	if (typeof budget.maxUsd === "number") attrs["tangle.supervise.budget.max_usd"] = budget.maxUsd;
 }
 /**
-* Run the driver until it completes WITH ITS CONTRACT MET, or until the budget, the deadline, an
-* abort, a terminal error, or a ceiling stops it. Transient failures are retried. A drive that
-* returns with its completion check unmet is re-entered on the same live session with the unmet
-* items, up to `reprompt.maxReprompts`. Throws `DriverAttemptsExhaustedError` (cause = the last
-* real failure) when a FAILURE ends the loop; a completed drive returns, met contract or not,
-* because deciding what an undelivered run is worth belongs to the finalizer, not to this loop.
+* A trace id must be 32 hex characters. A caller-supplied one is used verbatim when it already is;
+* anything else (and the default) is DERIVED from the run id by content address — deterministic, so
+* a resumed run rejoins the trace its first process opened rather than forking a new one.
 */
-async function runDriverWithRetry(run) {
-	const now = run.now ?? Date.now;
-	const sleep = run.sleep ?? defaultSleep$1;
-	const policy = run.policy ?? {};
-	const retryEnabled = policy.enabled !== false;
-	const maxConsecutive = Math.max(0, policy.maxConsecutiveFailures ?? DEFAULT_MAX_CONSECUTIVE_FAILURES);
-	const maxAttempts = Math.max(1, policy.maxAttempts ?? DEFAULT_MAX_ATTEMPTS);
-	const initialBackoff = Math.max(0, policy.initialBackoffMs ?? DEFAULT_INITIAL_BACKOFF_MS$1);
-	const maxBackoff = Math.max(initialBackoff, policy.maxBackoffMs ?? DEFAULT_MAX_BACKOFF_MS$1);
-	const maxReprompts = Math.max(0, run.reprompt?.maxReprompts ?? 0);
-	const attempts = [];
-	let consecutiveBarren = 0;
-	let reprompts = 0;
-	let reentry;
-	const emit = async (record) => {
-		attempts.push(record);
-		await run.onAttempt?.(record);
-	};
-	/**
-	* Decide what a completed-but-undelivered drive does next. Every bound the FAILURE path applies
-	* is applied here too — that is the fix for `budgetStop` having lived only in the catch arm — and
-	* the caller's hook is consulted last, so no hook can talk the loop past a deadline.
-	*/
-	const decideReprompt = async (attempt, after) => {
-		if (reprompts >= maxReprompts) return { refusedBy: "reprompts-exhausted" };
-		if (run.signal.aborted) return { refusedBy: "aborted" };
-		const byBudget = budgetStop(run.budget(), now());
-		if (byBudget === "deadline" || byBudget === "budget-exhausted") return { refusedBy: byBudget };
-		if (attempt >= maxAttempts) return { refusedBy: "max-attempts" };
-		const context = {
-			attempt,
-			reprompts,
-			maxReprompts,
-			progress: after,
-			budget: run.budget(),
-			...run.reprompt?.describe === void 0 ? {} : { describe: run.reprompt.describe }
-		};
-		const decision = await run.reprompt?.onUnmetContract?.(context) ?? { steer: defaultUnmetContractSteer(context) };
-		if (decision === "stop") return { refusedBy: "caller-stop" };
-		const steer = typeof decision.steer === "string" ? decision.steer.trim() : "";
-		if (steer.length === 0) throw new ValidationError("runDriverWithRetry: onUnmetContract returned an empty steer — return a non-empty instruction or 'stop'");
-		return { steer };
-	};
-	for (let attempt = 1;; attempt += 1) {
-		const before = run.progress();
-		const startedAt = now();
-		try {
-			await run.drive(attempt, reentry);
-		} catch (error) {
-			const durationMs = now() - startedAt;
-			const classification = classifyDriverFailure(error, run.signal);
-			const progressed = madeProgress(before, run.progress());
-			const stop = (() => {
-				if (classification === "terminal") return "terminal-error";
-				if (!retryEnabled) return "retry-disabled";
-				if (run.signal.aborted) return "aborted";
-				const byBudget = budgetStop(run.budget(), now());
-				if (byBudget) return byBudget;
-				if (attempt >= maxAttempts) return "max-attempts";
-				if (progressed) return void 0;
-				return consecutiveBarren + 1 >= maxConsecutive ? "no-progress" : void 0;
-			})();
-			if (stop !== void 0) {
-				await emit({
-					attempt,
-					durationMs,
-					error: error instanceof Error ? error.message : describeUnknown(error),
-					classification,
-					madeProgress: progressed,
-					stop
-				});
-				throw new DriverAttemptsExhaustedError(error, attempts, stop);
-			}
-			consecutiveBarren = progressed ? 0 : consecutiveBarren + 1;
-			reentry = void 0;
-			const backoff = Math.min(maxBackoff, initialBackoff * 2 ** Math.max(0, consecutiveBarren - 1));
-			await emit({
-				attempt,
-				durationMs,
-				error: error instanceof Error ? error.message : describeUnknown(error),
-				classification,
-				madeProgress: progressed,
-				retryInMs: backoff
-			});
-			await sleep(backoff, run.signal);
-			if (run.signal.aborted) throw new DriverAttemptsExhaustedError(error, attempts, "aborted");
-			const afterWait = budgetStop(run.budget(), now());
-			if (afterWait) throw new DriverAttemptsExhaustedError(error, attempts, afterWait);
-			continue;
-		}
-		const durationMs = now() - startedAt;
-		const after = run.progress();
-		const progressed = madeProgress(before, after);
-		const contract = contractOf(after);
-		const contractField = contract === "none" ? {} : { contract };
-		if (contract === "unmet" && maxReprompts > 0) {
-			const decision = await decideReprompt(attempt, after);
-			if ("steer" in decision) {
-				reprompts += 1;
-				reentry = {
-					reason: "unmet-contract",
-					steer: decision.steer,
-					reprompt: reprompts
-				};
-				await emit({
-					attempt,
-					durationMs,
-					madeProgress: progressed,
-					...contractField,
-					reprompted: true,
-					retryInMs: 0
-				});
-				continue;
-			}
-			await emit({
-				attempt,
-				durationMs,
-				madeProgress: progressed,
-				...contractField,
-				repromptRefusedBy: decision.refusedBy,
-				stop: "completed"
-			});
-			return;
-		}
-		await emit({
-			attempt,
-			durationMs,
-			madeProgress: progressed,
-			...contractField,
-			stop: "completed"
-		});
-		return;
-	}
+function normalizeTraceId(traceId, runId) {
+	if (traceId && /^[0-9a-f]{32}$/i.test(traceId)) return traceId.toLowerCase();
+	return contentAddress(traceId ?? runId).slice(7, 39);
+}
+function msToNano(ms) {
+	return (BigInt(Number.isFinite(ms) ? Math.floor(ms) : 0) * 1000000n).toString();
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function record(value) {
+	return isRecord(value) ? value : {};
+}
+function str(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function truncate(value) {
+	return value.length > MAX_DETAIL_CHARS ? `${value.slice(0, MAX_DETAIL_CHARS)}…` : value;
 }
 //#endregion
 //#region src/runtime/supervise/supervisor-agent.ts
@@ -1621,6 +1318,7 @@ function buildSupervisorAgent(profile, deps, testBrain) {
 			...deps.continuityByProfile ? { continuityByProfile: deps.continuityByProfile } : {},
 			...deps.preflightSpawn ? { preflightSpawn: deps.preflightSpawn } : {},
 			...deps.resolveSpawnProfile ? { resolveSpawnProfile: deps.resolveSpawnProfile } : {},
+			...deps.spawnResourceRoot ? { spawnResourceRoot: deps.spawnResourceRoot } : {},
 			...deps.stopRule ? { stopRule: deps.stopRule } : {},
 			...deps.onProgressStop ? { onProgressStop: deps.onProgressStop } : {},
 			...deps.maxTurns !== void 0 ? { maxTurns: deps.maxTurns } : {},
@@ -1708,6 +1406,7 @@ function buildSupervisorAgent(profile, deps, testBrain) {
 				...deps.replaySettlements ? { replaySettlements: true } : {},
 				...deps.preflightSpawn ? { preflightSpawn: deps.preflightSpawn } : {},
 				...deps.resolveSpawnProfile ? { resolveSpawnProfile: deps.resolveSpawnProfile } : {},
+				...deps.spawnResourceRoot ? { spawnResourceRoot: deps.spawnResourceRoot } : {},
 				...deps.peerMail ? { peerMail: deps.peerMail } : {},
 				...priorCoordination?.questions.length ? { priorQuestions: priorCoordination.questions } : {},
 				...priorCoordination?.escalations?.length ? { priorEscalations: priorCoordination.escalations } : {},
@@ -2984,6 +2683,19 @@ function assertNoUncapturedExecutableOption(decisionData) {
 * detached and frozen; executable ports are copied as the exact references selected at intake.
 * Service internals intentionally remain live, while replacing a callback/service on the caller's
 * mutable options object can no longer change an in-flight run. */
+/** The directory a root manager's spawn may resolve an inline resource `path` under. Only a
+*  loopback bridge driver has one this process can read: its `cwd` is a directory on this host.
+*  A remote bridge, a provider sandbox, or an in-process driver with no cwd yields `undefined`. */
+function rootSpawnResourceRoot(backend) {
+	if (backend === void 0 || backend.backend !== "bridge" || backend.cwd === void 0) return void 0;
+	let host;
+	try {
+		host = new URL(backend.bridgeUrl).hostname;
+	} catch {
+		return;
+	}
+	return isLoopbackHost(host) ? resolve(backend.cwd) : void 0;
+}
 function captureSuperviseOptions(opts) {
 	assertSuperviseOptionKeys(opts, "supervise");
 	const { backend, coordination, driverBackend, deliverable, resolveDeliverable, router, compaction, watchWorkers, analysts, makeWorkerAgent, makeLeafAgent, resolveSpawnProfile, blobs, journal, probes, registry, hooks, otel, authorizeSpawn, authorizeMessage, driveHarness, resolveDriveHarness, resolveSupervisorTools, escalateQuestion, onCoordinationEvent, executeExtraTool, stopRule, onProgressStop, onDriverAttempt, onUnmetContract, workerRetry, onWorkerRetry, finalizer, now, signal, rootHandle, ...decisionData } = opts;
@@ -3301,6 +3013,7 @@ function superviseInternal(profile, task, opts, testBrain) {
 	const managerBackend = options.driverBackend ?? (options.rootDriverFromBackend === false ? void 0 : options.backend);
 	if (options.driveHarness && options.resolveDriveHarness) throw new ValidationError("supervise: provide driveHarness or resolveDriveHarness, not both");
 	const hasCustomDriveHarness = Boolean(options.driveHarness || options.resolveDriveHarness);
+	const spawnResourceRoot = hasCustomDriveHarness ? void 0 : rootSpawnResourceRoot(managerBackend);
 	const spawnPreflight = composeSpawnPreflights(profileToolSpawnPreflight(options.makeWorkerAgent === void 0, options.resolveSupervisorTools !== void 0), coordinationChannelSpawnPreflight(options.makeWorkerAgent === void 0, hasCustomDriveHarness, managerBackend, options.coordination), options.backend?.backend === "bridge" ? bridgeSpawnPreflight(options.backend) : void 0);
 	const driverMaterialization = hasCustomDriveHarness ? options.driveHarnessMaterialization ?? fullProfileMaterialization : managerBackend && automaticDriverBackendSupported(managerBackend, options.coordination) ? backendProfileMaterialization(managerBackend) : void 0;
 	if (isExternalSupervisor(canonicalProfile) && !options.driveHarness && !options.resolveDriveHarness && (!managerBackend || !automaticDriverBackendSupported(managerBackend, options.coordination))) throw new ValidationError(`supervise: external supervisor profile.harness=${JSON.stringify(canonicalProfile.harness)} requires a local bridge, a provider with authenticated coordination.publicUrl and runtime MCP attachments, or an explicit driveHarness with reachable coordination transport`);
@@ -3529,6 +3242,7 @@ function superviseInternal(profile, task, opts, testBrain) {
 			...options.coordination && isExternalSupervisor(canonicalProfile) ? { coordination: options.coordination } : {},
 			...spawnPreflight ? { preflightSpawn: spawnPreflight } : {},
 			...options.resolveSpawnProfile ? { resolveSpawnProfile: options.resolveSpawnProfile } : {},
+			...spawnResourceRoot === void 0 ? {} : { spawnResourceRoot },
 			...options.peerMail ? { peerMail: options.peerMail } : {},
 			...options.maxLiveWorkers !== void 0 ? { maxLiveWorkers: options.maxLiveWorkers } : {},
 			...options.router ? { router: options.router } : {},
@@ -3657,6 +3371,6 @@ function rootProviderModelEvidenceFromExecution(evidence) {
 	return evidence ?? rootProviderModelEvidence([]);
 }
 //#endregion
-export { serveCoordinationMcp as _, isPreSpawnExecutorFailure as a, mapExecutorResult as b, withWorkerSpawnRetry as c, resolveSupervisorProfile as d, supervisorAgent as f, defaultUnmetContractSteer as g, classifyDriverFailure as h, workerFromBackend as i, assertCoordinationBinding as l, DriverAttemptsExhaustedError as m, supervise as n, resolveWorkerSpawnRetry as o, supervisorAgentWithTestBrain as p, superviseWithTestBrain as r, retryPreSpawnRefusals as s, DEFAULT_AUTHORED_PROFILE_SECURITY_POLICY as t, coordinationProfileToolPrefix as u, createSupervisorSpanRecorder as v, gateOnDeliverable as y };
+export { mapExecutorResult as _, isPreSpawnExecutorFailure as a, withWorkerSpawnRetry as c, resolveSupervisorProfile as d, supervisorAgent as f, gateOnDeliverable as g, serveCoordinationMcp as h, workerFromBackend as i, assertCoordinationBinding as l, createSupervisorSpanRecorder as m, supervise as n, resolveWorkerSpawnRetry as o, supervisorAgentWithTestBrain as p, superviseWithTestBrain as r, retryPreSpawnRefusals as s, DEFAULT_AUTHORED_PROFILE_SECURITY_POLICY as t, coordinationProfileToolPrefix as u };
 
-//# sourceMappingURL=supervise-W_mtzswa.js.map
+//# sourceMappingURL=supervise-CSYu0BeH.js.map