@tangle-network/agent-runtime 0.92.1 → 0.93.1

package/README.md

@@ -69,22 +69,32 @@ const result = await supervise(
 ### Improve an agent
 
 `improve` optimizes one part of an agent and **only ships a change if it beats the current agent on tasks it never practiced on**.
-It accepts prompt, skill document, tool, MCP, hook, subagent, workflow, rollout-policy, whole-profile, and code surfaces through one call.
-Prompt and skill-document optimization have built-in generators; structured surfaces take an explicit generator, and code runs from isolated incumbent and candidate checkouts.
+It accepts prompt, skill document, curated memory, tool, MCP, hook, subagent, workflow, rollout-policy, whole-profile, and code surfaces through one call.
+Prompt, skill-document, memory, and rollout-policy optimization have built-in generators; structured surfaces take an explicit generator, and code runs from isolated incumbent and candidate checkouts.
 
 ```ts
 import { improve } from '@tangle-network/agent-runtime'
 
 const { profile, shipped, lift } = await improve(baseProfile, findings, {
-  surface: 'prompt',        // or skills/tools/mcp/hooks/subagents/workflow/agent-profile/code
+  surface: 'prompt',        // or skills/memory/tools/mcp/hooks/subagents/workflow/agent-profile/rollout-policy/code
   gate: 'holdout',          // certified on a held-back exam, never the practice set
   scenarios, judge, agent,  // how to measure a candidate
 })
 ```
 
+Curated memory is an external lesson document, not a knowledge store. Supply its current text and persist only the promoted winner:
+
+```ts
+await improve(baseProfile, findings, {
+  surface: 'memory',
+  memory: { document: currentLessons, writeBack: saveLessons },
+  scenarios, judge, agent,
+})
+```
+
 ### Improve a knowledge base
 
-`runKnowledgeImprovementJob` is the runtime-owned front door for KB, wiki, memory-backed, and RAG improvement jobs. It creates a candidate copy, runs supervised agents against it, checks readiness through `@tangle-network/agent-knowledge`, measures spend and timing, and promotes only when the candidate passes.
+`runKnowledgeImprovementJob` is the runtime-owned front door for KB, wiki, memory-backed, and RAG improvement jobs. It creates a candidate copy, runs supervised agents against it, checks readiness through `@tangle-network/agent-knowledge`, measures spend and timing, and promotes only when the candidate passes. Use `improve(..., { surface: 'memory' })` for the agent's curated lesson document; use this job for source, retrieval, and knowledge-store changes.
 
 ```ts
 import { runKnowledgeImprovementJob } from '@tangle-network/agent-runtime/knowledge'

package/dist/candidate-execution/index.d.ts

@@ -1,8 +1,52 @@
-import { $ as PreparedAgentCandidateExecution, i as AgentCandidateExecutionClaim, k as AgentCandidateExecutionClaimStore, j as AgentCandidateExecutionClaimResult, h as AgentCandidateExecutionAttemptRef, g as AgentCandidateExecutionAttemptRecord, o as AgentCandidateExecutionLease, q as AgentCandidateExecutionPhaseResult, u as AgentCandidateExecutionTerminalResult, s as AgentCandidateExecutionStageResult, n as AgentCandidateExecutionFinishResult, r as AgentCandidateExecutionRecoveryEvidence, L as AgentCandidateOutputArtifactPort, M as AgentCandidateOutputPurpose, K as AgentCandidateModelPort, Q as AgentCandidateProtectedModelReservation, N as AgentCandidateProtectedModelActivation, R as AgentCandidateProtectedModelSettlement, y as AgentCandidateExecutorPort, a as AgentCandidateExecutionPorts, V as AgentCandidateVerificationPorts, a4 as VerifiedAgentCandidate } from '../prepare-Z08a4heC.js';
-export { c as AgentCandidateArtifactPort, d as AgentCandidateBenchmarkGraderIdentity, e as AgentCandidateBenchmarkGraderPort, f as AgentCandidateContainerPort, l as AgentCandidateExecutionCleanupHandles, m as AgentCandidateExecutionFailureClass, p as AgentCandidateExecutionPhase, t as AgentCandidateExecutionTerminalRecord, v as AgentCandidateExecutionUsage, w as AgentCandidateExecutorFinalCapture, x as AgentCandidateExecutorMemoryCapture, z as AgentCandidateExecutorProfileFile, B as AgentCandidateExecutorRequest, C as AgentCandidateExecutorStopRequest, D as AgentCandidateExecutorTaskOutcomeCapture, F as AgentCandidateExecutorWorkspaceFile, G as AgentCandidateExecutorWorkspaceInput, H as AgentCandidateMemoryPort, I as AgentCandidateMemoryResetResult, J as AgentCandidateModelLimits, O as AgentCandidateProtectedModelCall, S as AgentCandidateProtectedRunCapture, T as AgentCandidateRepositoryPort, U as AgentCandidateRetryRejection, b as AgentCandidateRunFinalization, A as AgentCandidateTaskExecution, W as AgentCandidateWorkspacePort, X as CANDIDATE_TRACE_ENV, Y as CANDIDATE_TRACE_TAGS, Z as CanonicalCandidateDocument, E as ExecutePreparedAgentCandidateOptions, _ as InMemoryAgentCandidateExecutionClaimStore, P as PrepareAgentCandidateExecutionOptions, a0 as PreparedAgentCandidateInstruction, a1 as PreparedAgentCandidateLaunch, a2 as PreparedAgentCandidateTrace, a3 as ResolvedAgentCandidateContainer, a5 as VerifiedAgentCandidateTaskOutcome, a6 as executePreparedAgentCandidate, a7 as prepareAgentCandidateExecution } from '../prepare-Z08a4heC.js';
-import { Sha256Digest, AgentCandidateArtifactRef } from '@tangle-network/agent-interface';
+import { CodeSurface } from '@tangle-network/agent-eval/campaign';
+import { AgentCandidateCodeDisabled, AgentCandidateCodeNoOp, AgentCandidateGitHubRepository, AgentProfile, AgentProfileDiff, AgentCandidateProfile, AgentCandidateExecution, AgentCandidateKnowledge, AgentCandidateMemoryPolicy, AgentCandidateLineage, Sha256Digest, AgentCandidateArtifactRef } from '@tangle-network/agent-interface';
+import { a9 as sealAgentCandidateBundle, a0 as PreparedAgentCandidateExecution, j as AgentCandidateExecutionClaim, l as AgentCandidateExecutionClaimStore, k as AgentCandidateExecutionClaimResult, i as AgentCandidateExecutionAttemptRef, h as AgentCandidateExecutionAttemptRecord, p as AgentCandidateExecutionLease, r as AgentCandidateExecutionPhaseResult, v as AgentCandidateExecutionTerminalResult, t as AgentCandidateExecutionStageResult, o as AgentCandidateExecutionFinishResult, s as AgentCandidateExecutionRecoveryEvidence, M as AgentCandidateOutputArtifactPort, N as AgentCandidateOutputPurpose, L as AgentCandidateModelPort, R as AgentCandidateProtectedModelReservation, O as AgentCandidateProtectedModelActivation, S as AgentCandidateProtectedModelSettlement, z as AgentCandidateExecutorPort, a as AgentCandidateExecutionPorts, W as AgentCandidateVerificationPorts, a5 as VerifiedAgentCandidate } from '../prepare-DiVGKcwS.js';
+export { d as AgentCandidateArtifactPort, e as AgentCandidateBenchmarkGraderIdentity, f as AgentCandidateBenchmarkGraderPort, c as AgentCandidateBundleInput, g as AgentCandidateContainerPort, m as AgentCandidateExecutionCleanupHandles, n as AgentCandidateExecutionFailureClass, q as AgentCandidateExecutionPhase, u as AgentCandidateExecutionTerminalRecord, w as AgentCandidateExecutionUsage, x as AgentCandidateExecutorFinalCapture, y as AgentCandidateExecutorMemoryCapture, B as AgentCandidateExecutorProfileFile, C as AgentCandidateExecutorRequest, D as AgentCandidateExecutorStopRequest, F as AgentCandidateExecutorTaskOutcomeCapture, G as AgentCandidateExecutorWorkspaceFile, H as AgentCandidateExecutorWorkspaceInput, I as AgentCandidateMemoryPort, J as AgentCandidateMemoryResetResult, K as AgentCandidateModelLimits, Q as AgentCandidateProtectedModelCall, T as AgentCandidateProtectedRunCapture, U as AgentCandidateRepositoryPort, V as AgentCandidateRetryRejection, b as AgentCandidateRunFinalization, A as AgentCandidateTaskExecution, X as AgentCandidateWorkspacePort, Y as CANDIDATE_TRACE_ENV, Z as CANDIDATE_TRACE_TAGS, _ as CanonicalCandidateDocument, E as ExecutePreparedAgentCandidateOptions, $ as InMemoryAgentCandidateExecutionClaimStore, P as PrepareAgentCandidateExecutionOptions, a1 as PreparedAgentCandidateInstruction, a2 as PreparedAgentCandidateLaunch, a3 as PreparedAgentCandidateTrace, a4 as ResolvedAgentCandidateContainer, a6 as VerifiedAgentCandidateTaskOutcome, a7 as executePreparedAgentCandidate, a8 as prepareAgentCandidateExecution } from '../prepare-DiVGKcwS.js';
 import { TraceStore } from '@tangle-network/agent-eval';
 
+/** A complete profile that can be frozen without losing behavior. */
+type AgentCandidateProfileSource = {
+    kind: 'profile';
+    profile: AgentProfile;
+} | {
+    kind: 'profile-diffs';
+    base: AgentProfile;
+    /** Applied in order. Each exact diff is content-addressed into lineage. */
+    diffs: readonly AgentProfileDiff[];
+} | {
+    kind: 'candidate-profile';
+    /** Already converted to the closed, secret-free candidate profile contract. */
+    profile: AgentCandidateProfile;
+};
+/** The only accepted path from an agent-eval code candidate to executable bytes. */
+interface AgentCandidateCodeSurfaceSource {
+    kind: 'code-surface';
+    surface: CodeSurface;
+    repository: AgentCandidateGitHubRepository;
+    /** Optional parent directory used to resolve a relative `surface.worktreeRef`. */
+    worktreeDir?: string;
+}
+/** Explicit control/no-op code or one finalized CodeSurface whose bytes must still verify. */
+type AgentCandidateCodeSource = AgentCandidateCodeDisabled | AgentCandidateCodeNoOp | AgentCandidateCodeSurfaceSource;
+/** Complete measured surfaces and execution policy compiled into one candidate bundle. */
+interface BuildAgentCandidateBundleInput {
+    profile: AgentCandidateProfileSource;
+    code: AgentCandidateCodeSource;
+    execution: AgentCandidateExecution;
+    knowledge?: AgentCandidateKnowledge;
+    memory: AgentCandidateMemoryPolicy;
+    /** `profileDiffIds` is derived from `profile`; callers cannot contradict it. */
+    lineage: Omit<AgentCandidateLineage, 'profileDiffIds'>;
+}
+/**
+ * Compile one measured profile/code candidate into the immutable execution
+ * contract. Code bytes are re-read and verified by agent-eval before they are
+ * embedded. The returned bundle is schema-validated, canonically digested, and
+ * deeply immutable; call `verifyAgentCandidateBundle` at the execution boundary
+ * to re-read external knowledge, memory, repository, and workspace artifacts.
+ */
+declare function buildAgentCandidateBundle(input: BuildAgentCandidateBundleInput): ReturnType<typeof sealAgentCandidateBundle>;
+
 /** Extract the complete durable claim from a prepared execution. */
 declare function candidateExecutionClaim(prepared: PreparedAgentCandidateExecution): AgentCandidateExecutionClaim;
 
@@ -101,4 +145,4 @@ declare function recoverExpiredAgentCandidateExecution(options: RecoverExpiredAg
 /** Verifies every digest, resource, workspace, and Git object in a candidate bundle. */
 declare function verifyAgentCandidateBundle(input: unknown, ports: AgentCandidateVerificationPorts): Promise<VerifiedAgentCandidate>;
 
-export { AgentCandidateExecutionAttemptRecord, AgentCandidateExecutionAttemptRef, AgentCandidateExecutionClaim, AgentCandidateExecutionClaimResult, AgentCandidateExecutionClaimStore, AgentCandidateExecutionFinishResult, AgentCandidateExecutionLease, AgentCandidateExecutionPhaseResult, AgentCandidateExecutionPorts, AgentCandidateExecutionRecoveryEvidence, AgentCandidateExecutionStageResult, AgentCandidateExecutionTerminalResult, AgentCandidateExecutorPort, type AgentCandidateModelGrantActivateInput, type AgentCandidateModelGrantClient, type AgentCandidateModelGrantReservation, type AgentCandidateModelGrantReserveInput, type AgentCandidateModelGrantSettleInput, AgentCandidateModelPort, AgentCandidateOutputArtifactPort, AgentCandidateOutputPurpose, AgentCandidateProtectedModelActivation, AgentCandidateProtectedModelReservation, AgentCandidateProtectedModelSettlement, AgentCandidateVerificationPorts, type CreateProtectedAgentCandidateModelPortOptions, type DisposePreparedAgentCandidateOptions, FileAgentCandidateExecutionClaimStore, type FileAgentCandidateExecutionClaimStoreOptions, PreparedAgentCandidateExecution, type RecoverExpiredAgentCandidateOptions, VerifiedAgentCandidate, candidateExecutionClaim, createProtectedAgentCandidateModelPort, disposePreparedAgentCandidateExecution, persistCandidateOutputArtifact, recoverExpiredAgentCandidateExecution, verifyAgentCandidateBundle };
+export { type AgentCandidateCodeSource, type AgentCandidateCodeSurfaceSource, AgentCandidateExecutionAttemptRecord, AgentCandidateExecutionAttemptRef, AgentCandidateExecutionClaim, AgentCandidateExecutionClaimResult, AgentCandidateExecutionClaimStore, AgentCandidateExecutionFinishResult, AgentCandidateExecutionLease, AgentCandidateExecutionPhaseResult, AgentCandidateExecutionPorts, AgentCandidateExecutionRecoveryEvidence, AgentCandidateExecutionStageResult, AgentCandidateExecutionTerminalResult, AgentCandidateExecutorPort, type AgentCandidateModelGrantActivateInput, type AgentCandidateModelGrantClient, type AgentCandidateModelGrantReservation, type AgentCandidateModelGrantReserveInput, type AgentCandidateModelGrantSettleInput, AgentCandidateModelPort, AgentCandidateOutputArtifactPort, AgentCandidateOutputPurpose, type AgentCandidateProfileSource, AgentCandidateProtectedModelActivation, AgentCandidateProtectedModelReservation, AgentCandidateProtectedModelSettlement, AgentCandidateVerificationPorts, type BuildAgentCandidateBundleInput, type CreateProtectedAgentCandidateModelPortOptions, type DisposePreparedAgentCandidateOptions, FileAgentCandidateExecutionClaimStore, type FileAgentCandidateExecutionClaimStoreOptions, PreparedAgentCandidateExecution, type RecoverExpiredAgentCandidateOptions, VerifiedAgentCandidate, buildAgentCandidateBundle, candidateExecutionClaim, createProtectedAgentCandidateModelPort, disposePreparedAgentCandidateExecution, persistCandidateOutputArtifact, recoverExpiredAgentCandidateExecution, sealAgentCandidateBundle, verifyAgentCandidateBundle };

package/dist/candidate-execution/index.js

@@ -1,9 +1,10 @@
 import {
   FileAgentCandidateExecutionClaimStore,
+  buildAgentCandidateBundle,
   createProtectedAgentCandidateModelPort,
   disposePreparedAgentCandidateExecution,
   recoverExpiredAgentCandidateExecution
-} from "../chunk-PH65PR4F.js";
+} from "../chunk-XDSWWUKE.js";
 import {
   CANDIDATE_TRACE_ENV,
   CANDIDATE_TRACE_TAGS,
@@ -12,8 +13,9 @@ import {
   executePreparedAgentCandidate,
   persistCandidateOutputArtifact,
   prepareAgentCandidateExecution,
+  sealAgentCandidateBundle,
   verifyAgentCandidateBundle
-} from "../chunk-A62TP7SK.js";
+} from "../chunk-OX3QRJOA.js";
 import "../chunk-3D2RHC4K.js";
 import "../chunk-3MDZX7YU.js";
 import "../chunk-DGUM43GV.js";
@@ -22,6 +24,7 @@ export {
   CANDIDATE_TRACE_TAGS,
   FileAgentCandidateExecutionClaimStore,
   InMemoryAgentCandidateExecutionClaimStore,
+  buildAgentCandidateBundle,
   candidateExecutionClaim,
   createProtectedAgentCandidateModelPort,
   disposePreparedAgentCandidateExecution,
@@ -29,6 +32,7 @@ export {
   persistCandidateOutputArtifact,
   prepareAgentCandidateExecution,
   recoverExpiredAgentCandidateExecution,
+  sealAgentCandidateBundle,
   verifyAgentCandidateBundle
 };
 //# sourceMappingURL=index.js.map

package/dist/{chunk-A62TP7SK.js → chunk-OX3QRJOA.js}

@@ -2,39 +2,8 @@ import {
   contentAddress
 } from "./chunk-3D2RHC4K.js";
 
-// src/candidate-execution/types.ts
-var verifiedCandidateBrand = /* @__PURE__ */ Symbol("verifiedAgentCandidate");
-var preparedCandidateBrand = /* @__PURE__ */ Symbol("preparedAgentCandidate");
-var verifiedTaskOutcomeBrand = /* @__PURE__ */ Symbol("verifiedTaskOutcome");
-var CANDIDATE_TRACE_TAGS = {
-  executionId: "tangle.candidate.execution_id",
-  bundleDigest: "tangle.candidate.bundle_digest",
-  executionPlanDigest: "tangle.candidate.execution_plan_digest",
-  materializationReceiptDigest: "tangle.candidate.materialization_receipt_digest"
-};
-var CANDIDATE_TRACE_ENV = {
-  executionId: "TANGLE_CANDIDATE_EXECUTION_ID",
-  bundleDigest: "TANGLE_CANDIDATE_BUNDLE_DIGEST",
-  executionPlanDigest: "TANGLE_CANDIDATE_EXECUTION_PLAN_DIGEST",
-  materializationReceiptDigest: "TANGLE_CANDIDATE_MATERIALIZATION_RECEIPT_DIGEST",
-  traceRunId: "TANGLE_TRACE_RUN_ID"
-};
-
-// src/candidate-execution/claim.ts
-import { createHash as createHash2, randomBytes, timingSafeEqual } from "crypto";
-import { readFile } from "fs/promises";
-import {
-  agentCandidateResolvedModelSchema
-} from "@tangle-network/agent-interface";
-
-// src/candidate-execution/claim-file-formats.ts
-var CLAIM_FORMAT_VERSION = 7;
-var PENDING_FORMAT_VERSION = 1;
-var TERMINAL_FORMAT_VERSION = 3;
-var PHASE_FORMAT_VERSION = 1;
-
-// src/candidate-execution/claim-terminal.ts
-import { agentCandidateArtifactRefSchema } from "@tangle-network/agent-interface";
+// src/candidate-execution/bundle.ts
+import { agentCandidateBundleSchema } from "@tangle-network/agent-interface";
 
 // src/candidate-execution/digest.ts
 import { createHash } from "crypto";
@@ -92,6 +61,51 @@ function deepFreezeCandidate(value, seen = /* @__PURE__ */ new Set()) {
   return Object.freeze(value);
 }
 
+// src/candidate-execution/bundle.ts
+function sealAgentCandidateBundle(input) {
+  const digest = canonicalCandidateDigest(input);
+  const parsed = agentCandidateBundleSchema.parse({ ...input, digest });
+  const parsedDigest = canonicalCandidateDigest(omitTopLevelDigest(parsed));
+  if (parsedDigest !== digest) {
+    throw new Error("candidate bundle changed while validating its canonical wire shape");
+  }
+  return immutableCandidateValue(parsed);
+}
+
+// src/candidate-execution/types.ts
+var verifiedCandidateBrand = /* @__PURE__ */ Symbol("verifiedAgentCandidate");
+var preparedCandidateBrand = /* @__PURE__ */ Symbol("preparedAgentCandidate");
+var verifiedTaskOutcomeBrand = /* @__PURE__ */ Symbol("verifiedTaskOutcome");
+var CANDIDATE_TRACE_TAGS = {
+  executionId: "tangle.candidate.execution_id",
+  bundleDigest: "tangle.candidate.bundle_digest",
+  executionPlanDigest: "tangle.candidate.execution_plan_digest",
+  materializationReceiptDigest: "tangle.candidate.materialization_receipt_digest"
+};
+var CANDIDATE_TRACE_ENV = {
+  executionId: "TANGLE_CANDIDATE_EXECUTION_ID",
+  bundleDigest: "TANGLE_CANDIDATE_BUNDLE_DIGEST",
+  executionPlanDigest: "TANGLE_CANDIDATE_EXECUTION_PLAN_DIGEST",
+  materializationReceiptDigest: "TANGLE_CANDIDATE_MATERIALIZATION_RECEIPT_DIGEST",
+  traceRunId: "TANGLE_TRACE_RUN_ID"
+};
+
+// src/candidate-execution/claim.ts
+import { createHash as createHash2, randomBytes, timingSafeEqual } from "crypto";
+import { readFile } from "fs/promises";
+import {
+  agentCandidateResolvedModelSchema
+} from "@tangle-network/agent-interface";
+
+// src/candidate-execution/claim-file-formats.ts
+var CLAIM_FORMAT_VERSION = 7;
+var PENDING_FORMAT_VERSION = 1;
+var TERMINAL_FORMAT_VERSION = 3;
+var PHASE_FORMAT_VERSION = 1;
+
+// src/candidate-execution/claim-terminal.ts
+import { agentCandidateArtifactRefSchema } from "@tangle-network/agent-interface";
+
 // src/candidate-execution/exact-object.ts
 function assertExactObjectKeys(value, required, label, optional = []) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
@@ -3898,10 +3912,10 @@ var CandidateExecutionDeadlineError = class extends Error {
 };
 
 // src/candidate-execution/verify.ts
-import { agentCandidateBundleSchema } from "@tangle-network/agent-interface";
+import { agentCandidateBundleSchema as agentCandidateBundleSchema2 } from "@tangle-network/agent-interface";
 var verifiedCandidateState = /* @__PURE__ */ new WeakMap();
 async function verifyAgentCandidateBundle(input, ports) {
-  const parsed = agentCandidateBundleSchema.parse(input);
+  const parsed = agentCandidateBundleSchema2.parse(input);
   const withoutDigest = omitTopLevelDigest(parsed);
   const actualDigest = canonicalCandidateDigest(withoutDigest);
   if (actualDigest !== parsed.digest) {
@@ -4014,6 +4028,255 @@ import {
   applyAgentCandidateWorkspacePlan,
   materializeCandidateProfile
 } from "@tangle-network/agent-profile-materialize";
+
+// src/candidate-execution/profile.ts
+import { agentCandidateProfileSchema, agentProfileSchema } from "@tangle-network/agent-interface";
+var CANDIDATE_PROFILE_DIRECT_FIELDS = [
+  "name",
+  "description",
+  "version",
+  "tags",
+  "prompt",
+  "harness",
+  "permissions",
+  "tools",
+  "confidential"
+];
+function freezeGenericAgentCandidateProfile(input) {
+  const profile = parseExactAgentProfile(input, "profile");
+  if (profile.connections !== void 0) unsupportedProfileField("connections");
+  if (profile.metadata !== void 0) unsupportedProfileField("metadata");
+  if (profile.extensions !== void 0) unsupportedProfileField("extensions");
+  if (profile.model?.metadata !== void 0) unsupportedProfileField("model.metadata");
+  const candidate = {};
+  copyDirectProfileFields(candidate, profile);
+  if (profile.model) {
+    const { metadata: _metadata, ...model } = profile.model;
+    candidate.model = model;
+  }
+  if (profile.mcp) candidate.mcp = freezeMcpServers(profile.mcp);
+  if (profile.subagents) {
+    candidate.subagents = Object.fromEntries(
+      Object.entries(profile.subagents).map(([name, subagent]) => {
+        if (subagent.metadata !== void 0) unsupportedProfileField(`subagents.${name}.metadata`);
+        const { metadata: _metadata, ...value } = subagent;
+        return [name, value];
+      })
+    );
+  }
+  if (profile.resources) candidate.resources = freezeResources(profile.resources);
+  if (profile.hooks && Object.values(profile.hooks).some((commands) => commands.length > 0)) {
+    throw new Error(
+      "generic AgentProfile hooks cannot be safely tokenized; use a candidate-profile source with executable/args"
+    );
+  }
+  if (profile.hooks) candidate.hooks = profile.hooks;
+  if (profile.modes) {
+    candidate.modes = Object.fromEntries(
+      Object.entries(profile.modes).map(([name, mode]) => {
+        if (mode.metadata !== void 0) unsupportedProfileField(`modes.${name}.metadata`);
+        const { metadata: _metadata, ...value } = mode;
+        return [name, value];
+      })
+    );
+  }
+  const parsed = parseExactCandidateProfile(candidate);
+  assertCandidateProfileBinding(profile, parsed);
+  return parsed;
+}
+function assertCandidateProfileBinding(measuredInput, bundled) {
+  const measured = parseExactAgentProfile(measuredInput, "proposal candidate profile");
+  if (measured.connections || measured.metadata || measured.extensions) {
+    throw new Error("proposal candidate profile contains fields unsupported by sealed candidates");
+  }
+  const normalized = candidateProfileAsAgentProfile(bundled);
+  if (canonicalCandidateDigest(measured) !== canonicalCandidateDigest(normalized)) {
+    throw new Error("proposal candidateProfile does not match candidateBundle.profile");
+  }
+}
+function parseExactAgentProfile(input, label) {
+  const parsed = agentProfileSchema.parse(input);
+  assertCanonicalParse(input, parsed, label);
+  return parsed;
+}
+function parseExactCandidateProfile(input) {
+  const parsed = agentCandidateProfileSchema.parse(input);
+  assertCanonicalParse(input, parsed, "candidate profile");
+  return parsed;
+}
+function assertCandidateProfileExecutionSupport(profile) {
+  const fields = ["tools", "permissions", "modes", "confidential"];
+  const unsupported = fields.filter((field) => hasEntries(profile[field]));
+  if (unsupported.length > 0) {
+    throw new Error(
+      `candidate execution cannot prove in-session effects for non-empty AgentProfile fields: ${unsupported.join(", ")}`
+    );
+  }
+}
+function candidateProfileAsAgentProfile(candidate) {
+  const output = {};
+  copyDirectProfileFields(output, candidate);
+  if (candidate.model) output.model = { ...candidate.model };
+  if (candidate.mcp) {
+    output.mcp = Object.fromEntries(
+      Object.entries(candidate.mcp).map(([name, server]) => [
+        name,
+        {
+          ...server,
+          ...server.args ? { args: server.args.map(publicValue) } : {},
+          ...server.env ? { env: mapPublicValues(server.env) } : {}
+        }
+      ])
+    );
+  }
+  if (candidate.subagents) output.subagents = cloneRecord(candidate.subagents);
+  if (candidate.modes) output.modes = cloneRecord(candidate.modes);
+  if (candidate.hooks) {
+    output.hooks = Object.fromEntries(
+      Object.entries(candidate.hooks).map(([event, hooks]) => [
+        event,
+        hooks.map(({ executable, args, env, ...hook }) => ({
+          ...hook,
+          command: [executable, ...(args ?? []).map(publicValue)].map(shellQuote).join(" "),
+          ...env ? { env: mapPublicValues(env) } : {}
+        }))
+      ])
+    );
+  }
+  if (candidate.resources) {
+    if (candidate.resources.failOnError !== true) {
+      throw new Error("proposal candidate profile contains fields unsupported by sealed candidates");
+    }
+    output.resources = {
+      failOnError: true,
+      ...candidate.resources.files ? {
+        files: candidate.resources.files.map((file) => ({
+          ...file,
+          resource: publicResource(file.resource)
+        }))
+      } : {},
+      ...candidate.resources.tools ? { tools: candidate.resources.tools.map(publicResource) } : {},
+      ...candidate.resources.skills ? { skills: candidate.resources.skills.map(publicResource) } : {},
+      ...candidate.resources.agents ? { agents: candidate.resources.agents.map(publicResource) } : {},
+      ...candidate.resources.commands ? { commands: candidate.resources.commands.map(publicResource) } : {},
+      ...candidate.resources.instructions !== void 0 ? {
+        instructions: typeof candidate.resources.instructions === "string" ? candidate.resources.instructions : publicResource(candidate.resources.instructions)
+      } : {}
+    };
+  }
+  return output;
+}
+function freezeMcpServers(servers) {
+  return Object.fromEntries(
+    Object.entries(servers).map(([name, server]) => {
+      if (server.transport !== void 0 && server.transport !== "stdio") {
+        unsupportedProfileField(`mcp.${name}.transport=${server.transport}`);
+      }
+      if (server.url !== void 0) unsupportedProfileField(`mcp.${name}.url`);
+      if (server.headers !== void 0) unsupportedProfileField(`mcp.${name}.headers`);
+      if (server.metadata !== void 0) unsupportedProfileField(`mcp.${name}.metadata`);
+      return [
+        name,
+        {
+          ...server.transport ? { transport: server.transport } : {},
+          ...server.command ? { command: server.command } : {},
+          ...server.args ? { args: server.args.map(candidatePublicValue) } : {},
+          ...server.env ? { env: mapCandidatePublicValues(server.env) } : {},
+          ...server.cwd ? { cwd: server.cwd } : {},
+          ...server.enabled === void 0 ? {} : { enabled: server.enabled }
+        }
+      ];
+    })
+  );
+}
+function freezeResources(resources) {
+  if (resources.failOnError !== true) {
+    throw new Error("candidate profile resources require failOnError: true");
+  }
+  return {
+    failOnError: true,
+    ...resources.files ? {
+      files: resources.files.map((file) => ({
+        ...file,
+        resource: freezeResource(file.resource)
+      }))
+    } : {},
+    ...resources.tools ? { tools: resources.tools.map(freezeResource) } : {},
+    ...resources.skills ? { skills: resources.skills.map(freezeResource) } : {},
+    ...resources.agents ? { agents: resources.agents.map(freezeResource) } : {},
+    ...resources.commands ? { commands: resources.commands.map(freezeResource) } : {},
+    ...resources.instructions === void 0 ? {} : {
+      instructions: typeof resources.instructions === "string" ? resources.instructions : freezeResource(resources.instructions)
+    }
+  };
+}
+function freezeResource(resource) {
+  if (resource.kind === "github") {
+    throw new Error(
+      "generic GitHub profile resources do not carry byte identity; use a candidate-profile source with a pinned commit, digest, and byte length"
+    );
+  }
+  const bytes = Buffer.from(resource.content, "utf8");
+  return {
+    ...resource,
+    sha256: embeddedCandidateArtifact(bytes).sha256,
+    byteLength: bytes.byteLength
+  };
+}
+function copyDirectProfileFields(target, source) {
+  for (const key of CANDIDATE_PROFILE_DIRECT_FIELDS) {
+    if (source[key] !== void 0) target[key] = source[key];
+  }
+}
+function assertCanonicalParse(input, parsed, label) {
+  if (!Buffer.from(canonicalCandidateBytes(input)).equals(canonicalCandidateBytes(parsed))) {
+    throw new Error(`${label} contains unsupported or non-canonical fields`);
+  }
+}
+function publicResource(resource) {
+  if (resource.kind === "inline") {
+    return { kind: "inline", name: resource.name, content: resource.content };
+  }
+  return {
+    kind: "github",
+    repository: `${resource.repository.owner}/${resource.repository.repo}`,
+    path: resource.path,
+    ref: resource.commit,
+    ...resource.name ? { name: resource.name } : {}
+  };
+}
+function candidatePublicValue(value) {
+  return { kind: "public", value };
+}
+function mapCandidatePublicValues(values) {
+  return Object.fromEntries(
+    Object.entries(values).map(([name, value]) => [name, candidatePublicValue(value)])
+  );
+}
+function publicValue(value) {
+  return value.value;
+}
+function mapPublicValues(values) {
+  return Object.fromEntries(Object.entries(values).map(([key, value]) => [key, publicValue(value)]));
+}
+function cloneRecord(values) {
+  return Object.fromEntries(
+    Object.entries(values).map(([key, value]) => [key, { ...value }])
+  );
+}
+function hasEntries(value) {
+  return value !== void 0 && value !== null && typeof value === "object" ? Object.keys(value).length > 0 : false;
+}
+function shellQuote(value) {
+  return /^[A-Za-z0-9_./:@%+=,-]+$/.test(value) ? value : `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function unsupportedProfileField(path) {
+  throw new Error(
+    `generic AgentProfile field ${path} is not representable in a sealed candidate profile`
+  );
+}
+
+// src/candidate-execution/prepare.ts
 var MATERIALIZER_HARNESSES = /* @__PURE__ */ new Set([
   "claude-code",
   "claude",
@@ -4035,6 +4298,7 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
   const verifiedState = getVerifiedCandidateState(candidate);
   assertSameVerificationPorts(verifiedState.ports, ports);
   const bundle = candidate.bundle;
+  assertCandidateProfileExecutionSupport(bundle.profile);
   const harness = materializerHarness(bundle.execution.harness);
   assertTaskInput(task, bundle.execution.instructionDelivery);
   const resultTimeoutMs = candidateResultTimeout(options.resultTimeoutMs, task.limits.timeoutMs);
@@ -4740,15 +5004,21 @@ function errorMessage2(error) {
 }
 
 export {
-  CLAIM_FORMAT_VERSION,
-  PENDING_FORMAT_VERSION,
-  TERMINAL_FORMAT_VERSION,
-  PHASE_FORMAT_VERSION,
   canonicalCandidateBytes,
   canonicalCandidateDigest,
   immutableCandidateValue,
   canonicalCandidateDocument,
+  embeddedCandidateArtifact,
   omitTopLevelDigest,
+  sealAgentCandidateBundle,
+  freezeGenericAgentCandidateProfile,
+  assertCandidateProfileBinding,
+  parseExactAgentProfile,
+  parseExactCandidateProfile,
+  CLAIM_FORMAT_VERSION,
+  PENDING_FORMAT_VERSION,
+  TERMINAL_FORMAT_VERSION,
+  PHASE_FORMAT_VERSION,
   assertExactObjectKeys,
   terminalRecord,
   recoveredTerminalRecord,
@@ -4781,4 +5051,4 @@ export {
   verifyAgentCandidateBundle,
   prepareAgentCandidateExecution
 };
-//# sourceMappingURL=chunk-A62TP7SK.js.map
+//# sourceMappingURL=chunk-OX3QRJOA.js.map