@tangle-network/agent-runtime 0.322.4 → 0.323.0

package/dist/{supervise-DLezpJcp.js → supervise-CwWI7kIk.js}

@@ -1,10 +1,10 @@
-import { $i as runtimeOwnedExecutorMaterialization, A as scopeOwnerExecutorNodeContext, Ai as promptControlProfileMaterialization, An as resolveAgentEnvironmentProvider, Ar as persistHarnessTranscript, At as captureReusableExecutorConfig, B as consumeScopeRetainedOwnerResult, C as deriveNodeExecutionIdentity, Ct as createContinuationKeeper, D as recordScopeOwnerMaterialization, Di as defineProfileMaterializationContract, Dr as runAbortable, E as recordScopeOwnerDriverAttempt, Ei as controlProfileMaterialization, Er as linkAbort, F as seatExecutionProfile, Fi as renderUnsupported, Fn as retainedExecutorSeamKey, Ft as snapshotExecutorConfig, G as scopeRetainedOwnerContext, Gi as inheritRuntimeOwnedExecutorAttestation, H as prepareScopeRetainedOwnerSeatSwitch, Hi as authoredAgentIdentity, I as abandonScopeRetainedOwnerInvocation, J as scopeRetainedOwnerResourceReader, Jn as isNoEntError, Jt as createActivityLog, K as scopeRetainedOwnerJournalRoot, L as beginScopeRetainedOwnerDrive, Li as unsupportedProfileDimensions, M as SeatChain, N as SeatChainExhaustedError, Nt as createExecutor, O as recordScopeOwnerPause, Oi as fullProfileMaterialization, P as authoredSeatStages, Pn as registerRetainedExecutorPreparation, Pr as contentAddress, Qi as runtimeOwnedExecutorExecutionBinding, Qr as createOtelExporter, R as bindScopeRetainedOwnerEnvironmentId, St as checkVerdictOf, T as meterRuntimeOwnedProviderAttempt, U as prepareScopeRetainedOwnerTask, V as noteScopeRetainedOwnerCoordination, Vi as attestRuntimeOwnedScopeOwner, Vt as WORKER_TRACE_PROPAGATION, W as reconcileScopeRetainedOwnerEnvironment, X as scopeRetainedOwnerResult, Xi as recordRuntimeOwnedDriveHarnessProviderEvidence, Xn as readCommittedJsonLines, Xt as createInbox, Y as scopeRetainedOwnerRestorePoint, Yi as providerAttemptEvidence, Yn as prepareJsonlAppend, Z as scopeRetainedOwnerTurnEnded, Zi as runtimeOwnedDriveHarnessProviderEvidence, _ as isDriverSpec, an as isLiveNodeStatus, b as assertRecursiveReservationPolicy, c as runTree, ca as detachedSnapshot, cn as bridgeModelRouteRefusal, cr as meterUsageEvent, dr as spendFromUsageTotals, ea as runtimeOwnedExecutorProviderEvidence, ei as generateSpanId, f as runDriverWithRetry, fr as bridgeRuntimeAttachmentsKey, g as driverExecutorFactory, gt as CONTINUATIONS_DIR, h as driverChild, i as bestDelivered, ii as toOtelAttributes, it as providerVisibleProfile, ji as promptModelProfileMaterialization, jr as readHarnessTranscript, k as restoreScopeOwnerAcceptedExecution, ki as profileMaterializationAxes$1, kt as bindReusableExecutorExecutionId, lr as newUsageTotals, mr as errMessage, mt as gateOnDeliverable, n as createRootHandle, na as runtimeOwnedScopeOwnerRuntime, nt as coordinationMcpAlias, or as assertValidBudget, p as summarizeDriverAttempts, pr as bridgeStopSignalKey, q as scopeRetainedOwnerPriorSpend, r as createSupervisor, rr as executorFailure, rt as coordinationProfileToolPrefix, s as runFinalizer, sn as bridgeAdmissionRefusal, ta as runtimeOwnedPendingExecutorMaterialization, tr as parseWorkerToolTraceArtifact, u as HarnessTurnFailedError, vt as CheckUnavailableError, w as meterRuntimeOwnedAccounting, wi as assertProfileMaterialization, wn as routerBrain, wr as RunCancellationReason, x as beginScopeOwnerAttempt, xt as bestComposite, yt as admitContinuationPolicy, z as bindScopeRetainedOwnerProvider, zi as worktreeCliProfileMaterialization, zt as createRouterTranscript } from "./supervisor-dlufUXys.js";
+import { $i as runtimeOwnedExecutorMaterialization, $t as PEER_MAIL_WIRE_KEY, A as scopeOwnerExecutorNodeContext, Ai as promptControlProfileMaterialization, An as resolveAgentEnvironmentProvider, Ar as persistHarnessTranscript, At as captureReusableExecutorConfig, B as consumeScopeRetainedOwnerResult, C as deriveNodeExecutionIdentity, Ct as createContinuationKeeper, D as recordScopeOwnerMaterialization, Di as defineProfileMaterializationContract, Dr as runAbortable, E as recordScopeOwnerDriverAttempt, Ei as controlProfileMaterialization, Er as linkAbort, F as seatExecutionProfile, Fi as renderUnsupported, Fn as retainedExecutorSeamKey, Ft as snapshotExecutorConfig, G as scopeRetainedOwnerContext, Gi as inheritRuntimeOwnedExecutorAttestation, H as prepareScopeRetainedOwnerSeatSwitch, Hi as authoredAgentIdentity, I as abandonScopeRetainedOwnerInvocation, J as scopeRetainedOwnerResourceReader, Jn as isNoEntError, Jt as createActivityLog, K as scopeRetainedOwnerJournalRoot, L as beginScopeRetainedOwnerDrive, Li as unsupportedProfileDimensions, M as SeatChain, N as SeatChainExhaustedError, Nt as createExecutor, O as recordScopeOwnerPause, Oi as fullProfileMaterialization, P as authoredSeatStages, Pn as registerRetainedExecutorPreparation, Pr as contentAddress, Qi as runtimeOwnedExecutorExecutionBinding, Qr as createOtelExporter, R as bindScopeRetainedOwnerEnvironmentId, St as checkVerdictOf, T as meterRuntimeOwnedProviderAttempt, U as prepareScopeRetainedOwnerTask, V as noteScopeRetainedOwnerCoordination, Vi as attestRuntimeOwnedScopeOwner, Vt as WORKER_TRACE_PROPAGATION, W as reconcileScopeRetainedOwnerEnvironment, X as scopeRetainedOwnerResult, Xi as recordRuntimeOwnedDriveHarnessProviderEvidence, Xn as readCommittedJsonLines, Xt as createInbox, Y as scopeRetainedOwnerRestorePoint, Yi as providerAttemptEvidence, Yn as prepareJsonlAppend, Z as scopeRetainedOwnerTurnEnded, Zi as runtimeOwnedDriveHarnessProviderEvidence, _ as isDriverSpec, an as isLiveNodeStatus, b as assertRecursiveReservationPolicy, c as runTree, ca as detachedSnapshot, cn as bridgeModelRouteRefusal, cr as meterUsageEvent, dr as spendFromUsageTotals, ea as runtimeOwnedExecutorProviderEvidence, ei as generateSpanId, f as runDriverWithRetry, fr as bridgeRuntimeAttachmentsKey, g as driverExecutorFactory, gt as CONTINUATIONS_DIR, h as driverChild, i as bestDelivered, ii as toOtelAttributes, it as providerVisibleProfile, ji as promptModelProfileMaterialization, jr as readHarnessTranscript, k as restoreScopeOwnerAcceptedExecution, ki as profileMaterializationAxes$1, kt as bindReusableExecutorExecutionId, lr as newUsageTotals, mr as errMessage, mt as gateOnDeliverable, n as createRootHandle, na as runtimeOwnedScopeOwnerRuntime, nn as isPeerMailEnvelope, nt as coordinationMcpAlias, or as assertValidBudget, p as summarizeDriverAttempts, pr as bridgeStopSignalKey, q as scopeRetainedOwnerPriorSpend, r as createSupervisor, rr as executorFailure, rt as coordinationProfileToolPrefix, s as runFinalizer, sn as bridgeAdmissionRefusal, ta as runtimeOwnedPendingExecutorMaterialization, tr as parseWorkerToolTraceArtifact, u as HarnessTurnFailedError, vt as CheckUnavailableError, w as meterRuntimeOwnedAccounting, wi as assertProfileMaterialization, wn as routerBrain, wr as RunCancellationReason, x as beginScopeOwnerAttempt, xt as bestComposite, yt as admitContinuationPolicy, z as bindScopeRetainedOwnerProvider, zi as worktreeCliProfileMaterialization, zt as createRouterTranscript } from "./supervisor-CSKkm-e1.js";
 import { f as RuntimeRunStateError, i as ConfigError, m as ValidationError } from "./errors-DodWX-cb.js";
 import { Dt as teardownSurfaces, Et as teardownExecutor, V as addSpend, Z as isAsyncIterable$1, ct as withTimeout, dt as addResourceSpend, lt as zeroSpend, mt as withBudgetResources, pt as resourceTelemetry, q as errorMessage, rt as sleep, st as unmeteredSpend, yt as DEFAULT_SUCCESSFUL_SHUTDOWN_MS } from "./workspace-streams-DFAhW7hF.js";
 import { _ as agentHarness, a as concreteProfileModel, c as profileModelExecutionSettings, n as assertModelAllowed, o as enforceTokenLimits, r as assertProfileModelsAllowed, s as profileBridgeWireModel, t as assertExecutableAgentProfile, v as harnessRunsAgent } from "./model-policy-CNe257pB.js";
 import { n as assertNoSymlinkDescendant } from "./durable-file-DWQA4ooo.js";
 import { t as composeRuntimeHooks } from "./runtime-hooks-tXpAarhW.js";
-import { C as createFileRunContext, F as createCoordinationToolsForManager, N as coordinationVerbNames, O as applyRunCancellation, T as withRunContext, c as refreshedWake, g as progressStop, h as plateau, k as watchRunCancellation, l as resolveWakePolicy, n as createSteerAcknowledger, o as composeWakeInput, p as createProgressTracker, r as driverAgent, s as deadlineWarningAt, t as createCancelAcknowledger, w as createInMemoryRunContext } from "./coordination-driver-xq1y2G6E.js";
+import { C as createFileRunContext, F as createCoordinationToolsForManager, N as coordinationVerbNames, O as applyRunCancellation, T as withRunContext, c as refreshedWake, g as progressStop, h as plateau, k as watchRunCancellation, l as resolveWakePolicy, n as createSteerAcknowledger, o as composeWakeInput, p as createProgressTracker, r as driverAgent, s as deadlineWarningAt, t as createCancelAcknowledger, w as createInMemoryRunContext } from "./coordination-driver-COSL19sL.js";
 import { r as createStdioToolServer, t as PROTOCOL_VERSION } from "./tool-server-Dqer2M4_.js";
 import { k as writeRunCancellation, o as readRunCancelRequest, s as readRunCancellation } from "./run-layout-DSCWdbX2.js";
 import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, canonicalCandidateJson, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
@@ -648,6 +648,7 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 		...opts.analysts ? { analysts: opts.analysts } : {},
 		...opts.analyzeOnSettle ? { analyzeOnSettle: opts.analyzeOnSettle } : {},
 		...opts.sourceEvidenceRefs ? { sourceEvidenceRefs: opts.sourceEvidenceRefs } : {},
+		...opts.peerAudit ? { peerAudit: opts.peerAudit } : {},
 		...opts.watchWorkers ? { watchWorkers: opts.watchWorkers } : {},
 		...opts.stallAfterMs !== void 0 ? { stallAfterMs: opts.stallAfterMs } : {},
 		...opts.continuityByProfile ? { continuityByProfile: opts.continuityByProfile } : {},
@@ -1952,6 +1953,7 @@ function buildSupervisorAgent(profile, deps, testBrain) {
 			...deps.analysts ? { analysts: deps.analysts } : {},
 			...deps.analyzeOnSettle ? { analyzeOnSettle: deps.analyzeOnSettle } : {},
 			...deps.sourceEvidenceRefs ? { sourceEvidenceRefs: deps.sourceEvidenceRefs } : {},
+			...deps.peerAudit ? { peerAudit: deps.peerAudit } : {},
 			...deps.escalateQuestion ? { escalateQuestion: deps.escalateQuestion } : {},
 			...deps.watchWorkers ? { watchWorkers: deps.watchWorkers } : {},
 			...deps.stallAfterMs !== void 0 ? { stallAfterMs: deps.stallAfterMs } : {},
@@ -2026,6 +2028,7 @@ function buildSupervisorAgent(profile, deps, testBrain) {
 			const context = nodeContextSeed ? supervisorNodeContext(nodeContextSeed, stableProfile, task, scope) : void 0;
 			const priorCoordination = deps.loadPriorCoordination ? await deps.loadPriorCoordination() : deps.priorCoordination;
 			const slot = createVerbSlot();
+			const peerInbox = createInbox();
 			const nodeTools = resolveTools && context ? await bindSupervisorTools(resolveTools, context, scope.signal, slot) : void 0;
 			const nodeObserver = bindSupervisorNodeObserver(context, observeNodeEvent, deps.onEvent);
 			const stopController = new AbortController();
@@ -2068,6 +2071,7 @@ function buildSupervisorAgent(profile, deps, testBrain) {
 				...deps.analysts ? { analysts: deps.analysts } : {},
 				...deps.analyzeOnSettle ? { analyzeOnSettle: deps.analyzeOnSettle } : {},
 				...deps.sourceEvidenceRefs ? { sourceEvidenceRefs: deps.sourceEvidenceRefs } : {},
+				...deps.peerAudit ? { peerAudit: deps.peerAudit } : {},
 				...deps.escalateQuestion ? { escalateQuestion: deps.escalateQuestion } : {},
 				...deps.watchWorkers ? { watchWorkers: deps.watchWorkers } : {},
 				...deps.stallAfterMs !== void 0 ? { stallAfterMs: deps.stallAfterMs } : {},
@@ -2100,6 +2104,8 @@ function buildSupervisorAgent(profile, deps, testBrain) {
 			liveCoordinator = mcp;
 			managerInbox = (message) => {
 				if (deliver !== void 0 && harnessInvocationActive && (deliverReady === void 0 || deliverReady()) && deliver(message)) return true;
+				const envelope = message !== null && typeof message === "object" ? message[PEER_MAIL_WIRE_KEY] : void 0;
+				if (deps.peerMailUrl && isPeerMailEnvelope(envelope)) return peerInbox.deliver({ [PEER_MAIL_WIRE_KEY]: envelope });
 				return controls.receiveLeadMessage(message);
 			};
 			const coordinationTools = slot.descriptors();
@@ -2291,6 +2297,9 @@ function buildSupervisorAgent(profile, deps, testBrain) {
 								state: controls.reentryState(),
 								attempt
 							});
+							const peerMessages = peerInbox.drain();
+							const peerText = peerMessages.length === 0 ? void 0 : peerInbox.fold(peerMessages);
+							const withPeerMail = (input) => peerText === void 0 ? input : `${typeof input === "string" ? input : JSON.stringify(input) ?? String(input)}\n\n${peerText}`;
 							harnessInvocationActive = true;
 							let completed = false;
 							try {
@@ -2300,10 +2309,10 @@ function buildSupervisorAgent(profile, deps, testBrain) {
 									...registeredProfile === stableProfile ? {} : { registeredProfile },
 									...profilePrompt !== void 0 ? { systemPrompt: profilePrompt } : {},
 									...session === void 0 ? {} : { session },
-									task: compose === void 0 ? task : compose(UNPROVEN_CONTINUITY),
+									task: withPeerMail(compose === void 0 ? task : compose(UNPROVEN_CONTINUITY)),
 									...compose === void 0 ? {} : { reentry: {
 										reason: reentry,
-										compose,
+										compose: (continuity) => withPeerMail(compose(continuity)),
 										...refresh === void 0 ? {} : { refresh },
 										onContinuity: (continuity) => {
 											if (continuity.environment === "replaced") environmentReplacements += 1;
@@ -2313,6 +2322,7 @@ function buildSupervisorAgent(profile, deps, testBrain) {
 									scope,
 									coordinationMcpUrl: mcp.url,
 									coordinationMcpHeaders: mcp.headers,
+									...deps.peerMailUrl ? { peerMailUrl: deps.peerMailUrl } : {},
 									stopSignal: stopController.signal,
 									coordinationTools
 								});
@@ -2346,6 +2356,7 @@ function buildSupervisorAgent(profile, deps, testBrain) {
 										attempt: nextAttempt,
 										signal: AbortSignal.any([scope.signal, stopController.signal]),
 										heartbeatMs: wakePolicy.heartbeatMs,
+										...deps.peerMailUrl ? { alsoWakeOn: peerInbox.pending() > 0 ? Promise.resolve() : peerInbox.nextDelivery() } : {},
 										debounceMs: wakePolicy.debounceMs,
 										...warnAt === void 0 ? {} : { deadlineAt: warnAt }
 									});
@@ -3270,7 +3281,7 @@ function driveHarnessFromBackend(backend, executionId, now = Date.now, maxTurns,
 	let seatChain;
 	let activeSeat;
 	let switchedProviderCheckpointAt;
-	const drive = async ({ profile, authoredProfile, registeredProfile, task, scope, coordinationMcpUrl, coordinationMcpHeaders, stopSignal, coordinationTools, reentry, session }) => {
+	const drive = async ({ profile, authoredProfile, registeredProfile, task, scope, coordinationMcpUrl, coordinationMcpHeaders, peerMailUrl, stopSignal, coordinationTools, reentry, session }) => {
 		const priorCommittedArtifact = managerArtifact;
 		managerArtifact = void 0;
 		switchedProviderCheckpointAt = void 0;
@@ -3392,6 +3403,7 @@ function driveHarnessFromBackend(backend, executionId, now = Date.now, maxTurns,
 		};
 		const turnStop = turnCap > 0 ? new AbortController() : void 0;
 		const effectiveStopSignal = turnStop === void 0 ? stopSignal : stopSignal === void 0 ? turnStop.signal : AbortSignal.any([stopSignal, turnStop.signal]);
+		const peerMailAttachment = peerMailRuntimeAttachment(authoredProfile, boundBackend, { peerMailUrl });
 		const attachment = {
 			transport: "http",
 			url: coordinationMcpUrl,
@@ -3408,6 +3420,7 @@ function driveHarnessFromBackend(backend, executionId, now = Date.now, maxTurns,
 			if (!authorization?.startsWith("Bearer ")) throw new ValidationError("driveHarnessFromBackend: provider coordination requires a bearer credential");
 			if (Object.hasOwn(boundBackend.defaults?.env ?? {}, credentialName)) throw new ValidationError("driveHarnessFromBackend: provider defaults contain the reserved coordination credential name");
 			if (Object.hasOwn(boundBackend.defaults?.runtimeAttachments?.mcp ?? {}, "agent-runtime-coordination")) throw new ValidationError("driveHarnessFromBackend: provider defaults contain the reserved coordination attachment alias");
+			if (peerMailUrl && Object.hasOwn(boundBackend.defaults?.runtimeAttachments?.mcp ?? {}, peerMailMcpAlias)) throw new ValidationError("driveHarnessFromBackend: provider defaults contain the reserved peer-mail attachment alias");
 			if (!await providerAcceptsCoordinationAttachments(boundBackend)) throw new ValidationError("driveHarnessFromBackend: provider does not advertise create.runtimeAttachments.mcp; no environment was created");
 			factory = createExecutor({
 				...boundBackend,
@@ -3420,6 +3433,10 @@ function driveHarnessFromBackend(backend, executionId, now = Date.now, maxTurns,
 					},
 					runtimeAttachments: { mcp: {
 						...boundBackend.defaults?.runtimeAttachments?.mcp ?? {},
+						...peerMailUrl ? { [peerMailMcpAlias]: {
+							transport: "http",
+							url: peerMailUrl
+						} } : {},
 						[coordinationMcpAlias]: {
 							transport: "http",
 							url: coordinationMcpUrl,
@@ -3443,7 +3460,10 @@ function driveHarnessFromBackend(backend, executionId, now = Date.now, maxTurns,
 					onResult: async (result) => commitOwnerResult(result)
 				} } : {},
 				...effectiveStopSignal === void 0 ? {} : { [bridgeStopSignalKey]: effectiveStopSignal },
-				[bridgeRuntimeAttachmentsKey]: { [coordinationMcpAlias]: attachment }
+				[bridgeRuntimeAttachmentsKey]: {
+					...peerMailAttachment ?? {},
+					[coordinationMcpAlias]: attachment
+				}
 			}
 		});
 		keepTranscript(lastExecutor?.harnessTranscript?.());
@@ -3876,6 +3896,11 @@ async function verifyProfilePromotions(table) {
 	const { verifySealedExperiment } = await import("@tangle-network/agent-eval/experiment");
 	for (const [name, entry] of promoted) if (!await verifySealedExperiment(entry.promotion.experiment)) throw new ValidationError(`supervise: opts.registry.profiles ${JSON.stringify(name)} cites a sealed play whose digest does not match its spec`);
 }
+/** Capabilities a data-only consumer may require before building an opted-in run. */
+const superviseFleetCapabilities = Object.freeze({
+	peerAudit: true,
+	traceTools: true
+});
 const superviseOptionKeySet = /* @__PURE__ */ new Set([
 	"allowedModels",
 	"analysts",
@@ -3915,6 +3940,8 @@ const superviseOptionKeySet = /* @__PURE__ */ new Set([
 	"onProgressStop",
 	"otel",
 	"peerMail",
+	"peerAudit",
+	"traceTools",
 	"perWorker",
 	"reservationPolicy",
 	"deadlineCheckIn",
@@ -4398,8 +4425,36 @@ function superviseInternal(profile, task, opts, testBrain) {
 		if (options.backend?.backend !== "provider" || options.makeWorkerAgent || options.makeLeafAgent) throw new ValidationError("supervise: SQL runContext requires backend-derived retained provider workers");
 	}
 	assertValidBudget(options.budget, "supervise budget");
-	const composeSpawnProfile = profileGuidanceComposer(options.profileGuidance);
-	const registeredProfile = superviseRootProfile(profile, options.profileGuidance);
+	const guidanceComposer = profileGuidanceComposer(options.profileGuidance);
+	const applyTraceTools = (profile) => {
+		if (options.traceTools !== false || profile.tools === void 0) return profile;
+		const tools = Object.fromEntries(Object.entries(profile.tools).filter(([name]) => name !== `${coordinationProfileToolPrefix}observe_agent` && name !== `${coordinationProfileToolPrefix}read_journal`));
+		return agentProfileSchema.parse({
+			...profile,
+			tools
+		});
+	};
+	const composeSpawnProfile = options.traceTools === false ? (profile) => applyTraceTools(guidanceComposer?.(profile) ?? profile) : guidanceComposer;
+	const auditPeers = /* @__PURE__ */ new Map();
+	const peerAuditFor = (parent) => options.peerAudit ? {
+		register: (nodeId, tools) => {
+			auditPeers.set(nodeId, {
+				parent,
+				tools
+			});
+		},
+		read: async (peerId, name, args) => {
+			const peer = auditPeers.get(peerId);
+			if (peer?.parent !== parent) return { error: "unknown-peer" };
+			const rootRead = name === "observe_agent" && args.tree !== true && args.outRef === void 0 && (args.workerId === void 0 || args.workerId === peerId);
+			const tool = (rootRead ? auditPeers.get(parent)?.tools : peer.tools)?.find((tool) => tool.name === name);
+			return tool ? tool.handler(rootRead ? {
+				...args,
+				workerId: peerId
+			} : args) : { error: "peer-tool-unavailable" };
+		}
+	} : void 0;
+	const registeredProfile = applyTraceTools(superviseRootProfile(profile, options.profileGuidance));
 	if (options.segment !== void 0) admitSegment(options.segment);
 	const canonicalProfile = options.segment === void 0 ? registeredProfile : withRootSegment(registeredProfile, options.segment);
 	assertExecutableAgentProfile(canonicalProfile, "supervise root");
@@ -4554,7 +4609,7 @@ function superviseInternal(profile, task, opts, testBrain) {
 		const withRetry = (make) => withWorkerSpawnRetry(make, options.workerRetry, { ...options.onWorkerRetry ? { onRetry: options.onWorkerRetry } : {} });
 		const makeLeaf = withRetry(options.makeLeafAgent ?? workerFromBackend(options.backend, deliverable));
 		const securityPolicy = options.profileSecurity ?? DEFAULT_AUTHORED_PROFILE_SECURITY_POLICY;
-		const makeRecursiveWorkerFor = (parent, parentIdentity, depth, parentOwnerId, analystLineage = false) => {
+		const makeRecursiveWorkerFor = (parent, parentIdentity, depth, parentOwnerId, analystLineage = false, peerRootOwnerId) => {
 			const makeRecursiveWorker = (authoredProfile, spawnContext, recovering = false) => {
 				if (!spawnContext) throw new ValidationError("supervise: backend-derived workers require spawn context");
 				const input = freezeDetachedProfile(authoredProfile);
@@ -4577,7 +4632,7 @@ function superviseInternal(profile, task, opts, testBrain) {
 					...spawnContext.execution ? { execution: spawnContext.execution } : {}
 				});
 				if (typeof decision !== "object" || decision === null || Array.isArray(decision)) throw new ValidationError("supervise: authorizeSpawn must return an AuthorizedSpawn");
-				const authorized = freezeDetachedProfile(decision.profile);
+				const authorized = freezeDetachedProfile(applyTraceTools(decision.profile));
 				const childExecution = canonicalExecution(authorized, spawnContext.task, decision.execution, `supervise spawn ${JSON.stringify(spawnContext.label)}`);
 				const authorizedContext = Object.freeze({
 					...spawnContext,
@@ -4623,12 +4678,16 @@ function superviseInternal(profile, task, opts, testBrain) {
 				if (isExternalSupervisor(authorized) && !nestedDriveHarness) throw new ValidationError(`supervise: authored external supervisor profile.harness=${JSON.stringify(authorized.harness)} requires a local bridge, a provider with authenticated coordination.publicUrl and runtime MCP attachments, or an explicit driveHarness with reachable coordination transport`);
 				assertProfileContract(authorized, isExternalSupervisor(authorized) ? driverMaterialization : promptModelProfileMaterialization, `supervise driver ${JSON.stringify(spawnContext.label)}`, true);
 				if (managerBackend) assertBridgeProfileMaterializes(profileWithoutDeclaredRuntimeCoordinationTools(authorized), managerBackend, `supervise driver ${JSON.stringify(spawnContext.label)}`);
-				const childFactory = makeRecursiveWorkerFor(authorized, childExecution.identity, depth + 1, ownerId, analystLineage || spawnContext.analyst !== void 0 || spawnContext.assignmentId.startsWith("analyst:"));
+				const rootPeerOwner = options.peerAudit ? depth === 1 ? ownerId : peerRootOwnerId : void 0;
+				const childFactory = makeRecursiveWorkerFor(authorized, childExecution.identity, depth + 1, ownerId, analystLineage || spawnContext.analyst !== void 0 || spawnContext.assignmentId.startsWith("analyst:"), rootPeerOwner);
 				const nestedPerWorker = defaultPerWorker(spawnContext.budget, ownerShare);
 				const authorizeNestedMessage = authorizeDownFor(authorized, depth + 1);
 				let acceptedSubmission = false;
 				let unassessedOutput = false;
+				const peerAudit = depth === 1 ? peerAuditFor(spawnContext.parentNodeId) : void 0;
 				return driverChild(authorized, supervisorAgent(authorized, {
+					...spawnContext.peerMailUrl ? { peerMailUrl: spawnContext.peerMailUrl } : {},
+					...peerAudit ? { peerAudit } : {},
 					blobs,
 					onUnassessedOutput: () => {
 						unassessedOutput = true;
@@ -4648,7 +4707,8 @@ function superviseInternal(profile, task, opts, testBrain) {
 						ownerId,
 						depth,
 						identity: childExecution.identity,
-						assignmentId: spawnContext.assignmentId
+						assignmentId: spawnContext.assignmentId,
+						...rootPeerOwner ? { peerRootOwnerId: rootPeerOwner } : {}
 					},
 					...options.resolveSupervisorTools ? { resolveSupervisorTools: options.resolveSupervisorTools } : {},
 					...observeNodeEvent ? {
@@ -4739,7 +4799,9 @@ function superviseInternal(profile, task, opts, testBrain) {
 		await verifyProfilePromotions(profileTable);
 		const priorCoordination = log ? await log.load(runId, rootOwnerId) : void 0;
 		const authorizeRootMessage = authorizeDownFor(canonicalProfile, 1);
+		const rootPeerAudit = peerAuditFor("");
 		const agentDeps = {
+			...rootPeerAudit ? { peerAudit: rootPeerAudit } : {},
 			blobs,
 			makeWorkerAgent: workerFactory,
 			...authorizeRootMessage ? { authorizeDownMessage: authorizeRootMessage } : {},
@@ -4936,6 +4998,6 @@ function rootProviderModelEvidenceFromExecution(evidence) {
 	return evidence ?? rootProviderModelEvidence([]);
 }
 //#endregion
-export { readRootStreamReceipt as _, superviseWithTestBrain as a, createSupervisorSpanRecorder as b, resolveWorkerSpawnRetry as c, assertCoordinationBinding as d, resolveSupervisorProfile as f, readRootStream as g, ROOT_STREAM_FILE as h, superviseRootProfile as i, retryPreSpawnRefusals as l, supervisorAgentWithTestBrain as m, profileGuidanceComposer as n, workerFromBackend as o, supervisorAgent as p, supervise as r, isPreSpawnExecutorFailure as s, DEFAULT_AUTHORED_PROFILE_SECURITY_POLICY as t, withWorkerSpawnRetry as u, UNPROVEN_CONTINUITY as v, serveCoordinationMcp as x, composeReentryTask as y };
+export { serveCoordinationMcp as S, readRootStream as _, superviseRootProfile as a, composeReentryTask as b, isPreSpawnExecutorFailure as c, withWorkerSpawnRetry as d, assertCoordinationBinding as f, ROOT_STREAM_FILE as g, supervisorAgentWithTestBrain as h, superviseFleetCapabilities as i, resolveWorkerSpawnRetry as l, supervisorAgent as m, profileGuidanceComposer as n, superviseWithTestBrain as o, resolveSupervisorProfile as p, supervise as r, workerFromBackend as s, DEFAULT_AUTHORED_PROFILE_SECURITY_POLICY as t, retryPreSpawnRefusals as u, readRootStreamReceipt as v, createSupervisorSpanRecorder as x, UNPROVEN_CONTINUITY as y };
 
-//# sourceMappingURL=supervise-DLezpJcp.js.map
+//# sourceMappingURL=supervise-CwWI7kIk.js.map