@unoverse-platform/studio 0.1.91 → 0.1.93

package/vendor/base/src/lint/nodes/node.mjs

@@ -22,7 +22,7 @@ export function lintNode(dir, pkg) {
   const label = rel(dir);
 
   if (!existsSync(nodePath))
-    return report("error", label, `has no node.yaml. It is the one REQUIRED file in a node folder (DECLARATIVE_NODES.md §5)`);
+    return report("error", label, `has no node.yaml. It is the one REQUIRED file in a node folder (https://docs.unoverse.ai/nodes/manifest-nodes)`);
 
   const node = readYaml(nodePath);
   if (!node) return;
@@ -39,13 +39,13 @@ export function lintNode(dir, pkg) {
 
     const ways = [hasFolder ? `${s}/` : null, onDisk ? `${s}.yaml` : null, inline ? "node.yaml" : null].filter(Boolean);
     if (ways.length > 1) {
-      report("error", rel(hasFolder ? folder : file), `"${s}" is defined in ${ways.join(" and ")}. Pick one; this is never a merge (DECLARATIVE_NODES.md §5)`);
+      report("error", rel(hasFolder ? folder : file), `"${s}" is defined in ${ways.join(" and ")}. Pick one; this is never a merge (https://docs.unoverse.ai/nodes/manifest-nodes)`);
       continue;
     }
 
     // `api` is always the folder form, so every node reads the same way.
     if (s === "api" && (onDisk || inline)) {
-      report("error", onDisk ? rel(file) : rel(nodePath), `api must be a FOLDER: api/run.yaml, api/events.yaml, and one file per further part (api/service.yaml, api/toolExchange.yaml, api/narrate.yaml). Every node has the same shape (DECLARATIVE_NODES.md §5)`);
+      report("error", onDisk ? rel(file) : rel(nodePath), `api must be a FOLDER: api/run.yaml, api/events.yaml, and one file per further part (api/service.yaml, api/toolExchange.yaml, api/narrate.yaml). Every node has the same shape (https://docs.unoverse.ai/nodes/manifest-nodes)`);
       continue;
     }
 
@@ -54,7 +54,7 @@ export function lintNode(dir, pkg) {
       // every rule below reads the same shape whichever layout the author chose.
       const files = readdirSync(folder).filter((f) => /\.ya?ml$/.test(f)).sort();
       if (!files.length) {
-        report("error", rel(folder), `is an empty ${s}/ folder. Delete it, or add one file per top-level key (DECLARATIVE_NODES.md §5)`);
+        report("error", rel(folder), `is an empty ${s}/ folder. Delete it, or add one file per top-level key (https://docs.unoverse.ai/nodes/manifest-nodes)`);
         continue;
       }
       const doc = {};
@@ -64,7 +64,7 @@ export function lintNode(dir, pkg) {
         if (part === undefined || part === null) continue;
         // The filename IS the key, so a file that repeats it nests the block twice.
         if (typeof part === "object" && !Array.isArray(part) && Object.keys(part).length === 1 && key in part)
-          report("error", rel(join(folder, f)), `starts with "${key}:" again. The FILENAME is the key, so this file holds the CONTENTS of ${key} (DECLARATIVE_NODES.md §5)`);
+          report("error", rel(join(folder, f)), `starts with "${key}:" again. The FILENAME is the key, so this file holds the CONTENTS of ${key} (https://docs.unoverse.ai/nodes/manifest-nodes)`);
         doc[key] = part;
       }
       parts[s] = { doc, file: rel(folder) };
@@ -142,7 +142,7 @@ export function lintNode(dir, pkg) {
 
   // The service channel must match what the node advertises. A method with no
   // connector is undiscoverable; a connector method with no implementation is a lie
-  // that only surfaces when a consumer calls it (08-mcp-services.md).
+  // that only surfaces when a consumer calls it (https://docs.unoverse.ai/nodes/mcp-services).
   if (api?.service || (iface.serviceConnectors ?? []).some((s) => s.isService === true)) {
     const advertised = new Set(
       (iface.serviceConnectors ?? []).filter((s) => s.isService === true).flatMap((s) => s.methods ?? []),
@@ -179,12 +179,12 @@ export function lintNode(dir, pkg) {
       report(
         "error",
         F.node,
-        `offers service methods and declares no outputs, so it is a pure service node and needs "template: service". Without it the canvas draws connector dots that can never carry anything (DECLARATIVE_NODES.md §5)`,
+        `offers service methods and declares no outputs, so it is a pure service node and needs "template: service". Without it the canvas draws connector dots that can never carry anything (https://docs.unoverse.ai/nodes/manifest-nodes)`,
       );
 
     // The mirror of it: advertising the discovery method as a tool.
     if (advertised.has(DISCOVERY_METHOD))
-      report("error", F.iface ?? F.node, `a serviceConnector lists "${DISCOVERY_METHOD}" in methods. It is tool DISCOVERY, called by convention, and listing it advertises it to the model as a tool (08-mcp-services.md)`);
+      report("error", F.iface ?? F.node, `a serviceConnector lists "${DISCOVERY_METHOD}" in methods. It is tool DISCOVERY, called by convention, and listing it advertises it to the model as a tool (https://docs.unoverse.ai/nodes/mcp-services)`);
     for (const method of advertised)
       if (!api?.service?.[method])
         report("error", F.iface ?? F.node, `advertises method "${method}" but api/service.yaml has no implementation. A consumer calling it gets an error`);
@@ -224,14 +224,14 @@ export function lintNode(dir, pkg) {
         : api.toolExchange
           ? `it declares a toolExchange, which is a multi-turn loop`
           : `an input declares a SPAWN signal`;
-      report("error", F.node, `kind is "${node.kind}" but this node is a ${derived}: ${why} (DECLARATIVE_NODES.md §5)`);
+      report("error", F.node, `kind is "${node.kind}" but this node is a ${derived}: ${why} (https://docs.unoverse.ai/nodes/manifest-nodes)`);
     }
     derivedKinds.set(label, derived);
 
     // The events table is compulsory for a node the graph can trigger: it is the only
     // way anything leaves the node, so without it the node is a call into the void.
     if (!(api.events ?? []).length)
-      report("error", F.api, `has run calls but no api/events.yaml. The events table is compulsory, it is the only way anything leaves a node (DECLARATIVE_NODES.md §5)`);
+      report("error", F.api, `has run calls but no api/events.yaml. The events table is compulsory, it is the only way anything leaves a node (https://docs.unoverse.ai/nodes/manifest-nodes)`);
   } else if (existsSync(join(dir, "src")) === false && !parts.api && !isAnnotation) {
     // An ANNOTATION node is exempt, because "does nothing" is the whole specification. `Note`
     // has no inputs, no outputs and no api: it is a markdown sticky on the canvas. Warning about
@@ -253,7 +253,7 @@ export function lintNode(dir, pkg) {
   for (const [i, r] of rows.entries()) {
     const from = r.from ?? "response";
     if (!SOURCES.includes(from))
-      report("error", F.api, `events[${i}] has from: "${from}". Must be one of ${SOURCES.join(", ")} (DECLARATIVE_NODES.md §5)`);
+      report("error", F.api, `events[${i}] has from: "${from}". Must be one of ${SOURCES.join(", ")} (https://docs.unoverse.ai/nodes/manifest-nodes)`);
     /**
      * A `send` ROW ADDRESSES A NODE, NOT A CONNECTOR, so the coverage and order rules below do
      * not apply to it: there is no dot for it to cover and none to be out of order with. What it
@@ -310,7 +310,7 @@ export function lintNode(dir, pkg) {
       report(
         "error",
         F.api,
-        `events rows are ordered ${rowOrder.join(", ")} but the output connectors are ${want.join(", ")}. Keep the table in connector order so the node reads top to bottom (DECLARATIVE_NODES.md §5)`,
+        `events rows are ordered ${rowOrder.join(", ")} but the output connectors are ${want.join(", ")}. Keep the table in connector order so the node reads top to bottom (https://docs.unoverse.ai/nodes/manifest-nodes)`,
       );
   }
 
@@ -323,12 +323,12 @@ export function lintNode(dir, pkg) {
   // Retired keys. Left in place they would silently do nothing, which is worse than a
   // hard error, so each one names its replacement.
   if (api?.response !== undefined)
-    report("error", F.api, `api.response is retired: transport/terminator/error moved INTO the call (request), and what leaves the node is the events table (DECLARATIVE_NODES.md §5)`);
+    report("error", F.api, `api.response is retired: transport/terminator/error moved INTO the call (request), and what leaves the node is the events table (https://docs.unoverse.ai/nodes/manifest-nodes)`);
   if (api?.narrate?.output !== undefined)
-    report("error", F.api, `narrate.output is retired. The narrator's line lands via an \`events\` row with from: narrator (DECLARATIVE_NODES.md §5)`);
+    report("error", F.api, `narrate.output is retired. The narrator's line lands via an \`events\` row with from: narrator (https://docs.unoverse.ai/nodes/manifest-nodes)`);
   for (const [name, m] of Object.entries(api?.service ?? {}))
     if (m.response !== undefined)
-      report("error", F.api, `service.${name}.response is retired: transport/error moved into the call, and the value it hands back is service.${name}.returns (DECLARATIVE_NODES.md §5)`);
+      report("error", F.api, `service.${name}.response is retired: transport/error moved into the call, and the value it hands back is service.${name}.returns (https://docs.unoverse.ai/nodes/manifest-nodes)`);
 
   // ── chained calls ──
   //
@@ -340,7 +340,7 @@ export function lintNode(dir, pkg) {
     for (const [i, s] of list.entries()) {
       const isLast = i === list.length - 1;
       if (!s?.name) {
-        report("error", F.api, `${at}[${i}] has no name. A call is reached as calls.<name>, so an unnamed one cannot be read by a later call, an events row, or returns (DECLARATIVE_NODES.md §5)`);
+        report("error", F.api, `${at}[${i}] has no name. A call is reached as calls.<name>, so an unnamed one cannot be read by a later call, an events row, or returns (https://docs.unoverse.ai/nodes/manifest-nodes)`);
       } else {
         if (names.includes(s.name))
           report("error", F.api, `${at} declares two calls named "${s.name}". The second silently overwrites the first in calls.<name>`);
@@ -354,7 +354,7 @@ export function lintNode(dir, pkg) {
       // left on the old spelling would send NO credential at all and fail as a vendor 401,
       // which reads as a bad key rather than a manifest that was never migrated.
       if (s?.auth !== undefined)
-        report("error", F.api, `${at}[${i}] (${s.name ?? "unnamed"}) uses "auth", which is retired on a call. Rename it to "credential" — that is how this node proves itself to the VENDOR. node.yaml's "auth" is the other direction: who may run this node (DECLARATIVE_NODES.md §9.13)`);
+        report("error", F.api, `${at}[${i}] (${s.name ?? "unnamed"}) uses "auth", which is retired on a call. Rename it to "credential" — that is how this node proves itself to the VENDOR. node.yaml's "auth" is the other direction: who may run this node (https://docs.unoverse.ai/nodes/who-can-run-it)`);
 
       // Only the LAST step may stream, and only on the workflow channel: its reply is the
       // node's answer. An earlier step exists so a later one can READ it, and there is
@@ -418,8 +418,8 @@ export function lintNode(dir, pkg) {
           "error",
           F.api,
           isLast
-            ? `${at}[${i}] (${s.name ?? "unnamed"}) has transport "${s.transport}". A provided method hands back ONE value, so it has no connector to stream onto (DECLARATIVE_NODES.md §5)`
-            : `${at}[${i}] (${s.name ?? "unnamed"}) has transport "${s.transport}" but is not the last step. Only the last may stream (DECLARATIVE_NODES.md §5)`,
+            ? `${at}[${i}] (${s.name ?? "unnamed"}) has transport "${s.transport}". A provided method hands back ONE value, so it has no connector to stream onto (https://docs.unoverse.ai/nodes/manifest-nodes)`
+            : `${at}[${i}] (${s.name ?? "unnamed"}) has transport "${s.transport}" but is not the last step. Only the last may stream (https://docs.unoverse.ai/nodes/manifest-nodes)`,
         );
       // Only when it tests an earlier REPLY. A first call may perfectly well be gated on
       // config or on the caller's params, and Salesforce's is. What is meaningless is
@@ -451,7 +451,7 @@ export function lintNode(dir, pkg) {
     if (at === "narrate.request")
       for (const k of ["name", "when"])
         if (call[k] !== undefined)
-          report("error", F.api, `${at} sets "${k}", which belongs to a call in a list and is ignored here (DECLARATIVE_NODES.md §5)`);
+          report("error", F.api, `${at} sets "${k}", which belongs to a call in a list and is ignored here (https://docs.unoverse.ai/nodes/manifest-nodes)`);
 
   // RETIRED SHAPES. Each would silently do nothing rather than fail: the executor reads
   // `run` and `service`, finds no calls at all, and the node dies on its first run with a
@@ -459,18 +459,18 @@ export function lintNode(dir, pkg) {
   // because these are what every older example and every half-remembered habit produces.
   for (const [old, now] of [["request", "api/run.yaml, a LIST"], ["steps", "api/run.yaml"], ["provides", "api/service.yaml"]])
     if (api?.[old] !== undefined)
-      report("error", F.api, `api/${old}.yaml is retired. This is ${now}. A node's calls are ALWAYS a list, each entry starting "- name: <what it fetches>" (DECLARATIVE_NODES.md §5)`);
+      report("error", F.api, `api/${old}.yaml is retired. This is ${now}. A node's calls are ALWAYS a list, each entry starting "- name: <what it fetches>" (https://docs.unoverse.ai/nodes/manifest-nodes)`);
 
   for (const [name, m] of Object.entries(api?.service ?? {}))
     for (const old of ["request", "steps"])
       if (m[old] !== undefined)
-        report("error", F.api, `service.${name} declares "${old}". A method's calls are ALWAYS a list named "calls", even when there is one (DECLARATIVE_NODES.md §5)`);
+        report("error", F.api, `service.${name} declares "${old}". A method's calls are ALWAYS a list named "calls", even when there is one (https://docs.unoverse.ai/nodes/manifest-nodes)`);
 
   // Credentials must resolve to a declared type, or the run fails at execute time.
   for (const c of iface.credentials ?? []) {
     const name = c.name;
     if (!pkg.credentials.has(name))
-      report("error", F.iface ?? F.node, `needs credential "${name}" but no credentials/${name}.yaml exists in this package. A package DECLARES the credentials it needs (04-credentials.md)`);
+      report("error", F.iface ?? F.node, `needs credential "${name}" but no credentials/${name}.yaml exists in this package. A package DECLARES the credentials it needs (https://docs.unoverse.ai/nodes/credentials)`);
   }
 
   // configSchema internal consistency.
@@ -495,7 +495,7 @@ export function lintNode(dir, pkg) {
         report(
           "error",
           F.config,
-          `config.yaml declares "${field}", which is platform chrome: compose injects the run-authorization controls into every node's settings form, and a manifest must not carry its own copy (15-who-can-run-it.md). Delete the field and its ui:order entry`,
+          `config.yaml declares "${field}", which is platform chrome: compose injects the run-authorization controls into every node's settings form, and a manifest must not carry its own copy (https://docs.unoverse.ai/nodes/who-can-run-it). Delete the field and its ui:order entry`,
         );
     }
     for (const r of config.configSchema.required ?? [])
@@ -514,7 +514,7 @@ export function lintNode(dir, pkg) {
         if (!names.includes(dep)) report("error", F.config, `${n}: ui:dependencies names "${dep}", which is not a sibling property`);
       // A template field on an object/array takes a `return` expression, not handlebars.
       if (f["ui:field"] === "template" && (f.type === "object" || f.type === "array") && typeof f.default === "string" && f.default.trim() && !f.default.startsWith("return "))
-        report("warn", F.config, `${n}: is an object template, so its value is a "return ..." expression, not handlebars (06-config-schema.md)`);
+        report("warn", F.config, `${n}: is an object template, so its value is a "return ..." expression, not handlebars (https://docs.unoverse.ai/nodes/config-schema)`);
       // A NUMBER OR A BOOLEAN IS NEVER A TEMPLATE FIELD, and this is an error rather than a
       // warning because it takes the browser down. `ui:field: template` draws the CodeMirror
       // editor, whose document is TEXT; handed the number 10 or the boolean true it builds a
@@ -529,7 +529,7 @@ export function lintNode(dir, pkg) {
         report(
           "error",
           F.config,
-          `${n}: is a ${f.type}, so it cannot carry "ui:field: template" — that draws a text editor, which a non-string value crashes. Drop the marker; a route can still wire the field, since the engine templates any string config value (06-config-schema.md)`,
+          `${n}: is a ${f.type}, so it cannot carry "ui:field: template" — that draws a text editor, which a non-string value crashes. Drop the marker; a route can still wire the field, since the engine templates any string config value (https://docs.unoverse.ai/nodes/config-schema)`,
         );
     }
 
@@ -578,7 +578,7 @@ export function lintNode(dir, pkg) {
   if (!test?.testData && !api) {
     // nothing to run, so nothing to fixture
   } else if (!test?.testData) {
-    report("error", F.node, `has no testData. Every node needs sample data so it can be loaded and run (DECLARATIVE_NODES.md §6)`);
+    report("error", F.node, `has no testData. Every node needs sample data so it can be loaded and run (https://docs.unoverse.ai/nodes/testing-nodes)`);
   } else {
     if (config?.configSchema) {
       /**
@@ -619,7 +619,7 @@ export function lintNode(dir, pkg) {
       report("error", F.test, `this node has only service methods, so testData needs a "call" block naming one. Otherwise nothing can run it`);
   }
 
-  // WHO MAY RUN THIS NODE (DECLARATIVE_NODES.md §9.13).
+  // WHO MAY RUN THIS NODE (https://docs.unoverse.ai/nodes/who-can-run-it).
   //
   // COMPULSORY, and that is the entire point of the block. Before 2026-07-28 authorization was
   // an OPTIONAL `requires: { role }`, so a node that said nothing was indistinguishable from a
@@ -627,17 +627,17 @@ export function lintNode(dir, pkg) {
   // answer to "who may run this", so each node now states its stance out loud and a reviewer
   // reads a decision rather than an absence.
   if (node.requires !== undefined)
-    report("error", F.node, `"requires" is retired on a node. Authorization is now "auth: { required, role }" — and unlike requires it is compulsory, so a node cannot stay silent about who may run it (DECLARATIVE_NODES.md §9.13)`);
+    report("error", F.node, `"requires" is retired on a node. Authorization is now "auth: { required, role }" — and unlike requires it is compulsory, so a node cannot stay silent about who may run it (https://docs.unoverse.ai/nodes/who-can-run-it)`);
 
   const auth = node.auth;
   if (auth === undefined) {
-    report("error", F.node, `node.yaml has no "auth" block. Every node states who may run it: "auth: { required: false }" adds no requirement of its own (the trigger still owns the door), "required: true" demands a signed-in caller, and "role: noun:verb" demands a specific claim (DECLARATIVE_NODES.md §9.13)`);
+    report("error", F.node, `node.yaml has no "auth" block. Every node states who may run it: "auth: { required: false }" adds no requirement of its own (the trigger still owns the door), "required: true" demands a signed-in caller, and "role: noun:verb" demands a specific claim (https://docs.unoverse.ai/nodes/who-can-run-it)`);
   } else if (typeof auth.required !== "boolean") {
-    report("error", F.node, `auth.required must be true or false, written out. Leaving it off would put the node back to being silent about authorization, which is what this block exists to stop (DECLARATIVE_NODES.md §9.13)`);
+    report("error", F.node, `auth.required must be true or false, written out. Leaving it off would put the node back to being silent about authorization, which is what this block exists to stop (https://docs.unoverse.ai/nodes/who-can-run-it)`);
   } else if (auth.role !== undefined && auth.required === false) {
     // A role lives on a token, so demanding one while waiving the token is unsatisfiable. It
     // would read as "protected" on the acceptance screen and admit everyone at run time.
-    report("error", F.node, `auth declares role "${auth.role}" with required: false. A role lives on a token, so this can never be satisfied — a node asking for a role is asking for a signed-in caller (DECLARATIVE_NODES.md §9.13)`);
+    report("error", F.node, `auth declares role "${auth.role}" with required: false. A role lives on a token, so this can never be satisfied — a node asking for a role is asking for a signed-in caller (https://docs.unoverse.ai/nodes/who-can-run-it)`);
   }
 
   // whenToUse decides whether the node SURFACES to the building agent at all.
@@ -646,15 +646,15 @@ export function lintNode(dir, pkg) {
     // Absorbed from scripts/check-node-meta.mjs (2026-07-29, previously an orphan
     // nothing invoked): a node without whenToUse is invisible to catalog ranking
     // and marketplace search — a silent discovery failure, so it fails the lint.
-    report("error", F.node, `whenToUse is missing. The ranker embeds it for catalog/semantic search; without it this node cannot be discovered by capability (14-node-discoverability.md)`);
+    report("error", F.node, `whenToUse is missing. The ranker embeds it for catalog/semantic search; without it this node cannot be discovered by capability (https://docs.unoverse.ai/nodes/node-discoverability)`);
   }
   if (w) {
     if (/^use this (node|when)/i.test(w))
-      report("warn", F.node, `whenToUse opens by restating itself. Lead with the OUTCOME in task vocabulary (14-node-discoverability.md)`);
+      report("warn", F.node, `whenToUse opens by restating itself. Lead with the OUTCOME in task vocabulary (https://docs.unoverse.ai/nodes/node-discoverability)`);
     if (/^(hybrid|attach|this is an?|a powerful)/i.test(w))
-      report("warn", F.node, `whenToUse opens with plumbing or marketing. Outcome first, mechanism last; it sinks the ranking (14-node-discoverability.md)`);
+      report("warn", F.node, `whenToUse opens with plumbing or marketing. Outcome first, mechanism last; it sinks the ranking (https://docs.unoverse.ai/nodes/node-discoverability)`);
     if (node.description && w.toLowerCase() === node.description.toLowerCase())
-      report("error", F.node, `whenToUse merely repeats description. It carries zero selection signal (14-node-discoverability.md)`);
+      report("error", F.node, `whenToUse merely repeats description. It carries zero selection signal (https://docs.unoverse.ai/nodes/node-discoverability)`);
   }
 
   // ALLOWED_HOSTS. A manifest cannot execute, but it can say "send this credential to
@@ -733,7 +733,7 @@ export function lintNode(dir, pkg) {
   // Renamed with the call key it mirrors, so the package's promise and the call's spelling
   // stay the same word. Left as `auth` it would list schemes for a key no call has.
   if (pkg.requires?.auth !== undefined)
-    report("error", rel(pkg.file), `package.yaml uses requires.auth, which is retired. Rename it to requires.credential to match the call key (DECLARATIVE_NODES.md §9.13)`);
+    report("error", rel(pkg.file), `package.yaml uses requires.auth, which is retired. Rename it to requires.credential to match the call key (https://docs.unoverse.ai/nodes/who-can-run-it)`);
 
   if (pkg.requires && api)
     for (const { at, call } of calls) {

package/vendor/base/src/lint/nodes/package.mjs

@@ -46,7 +46,7 @@ export function lintPackage(dir) {
           report(
             "error",
             rel(join(credDir, f)),
-            `credential "${doc.name}" is also declared in ${prior.file} with different fields (${prior.fields} vs ${fields}). They share one entry in context.credentials and must agree (04-credentials.md)`,
+            `credential "${doc.name}" is also declared in ${prior.file} with different fields (${prior.fields} vs ${fields}). They share one entry in context.credentials and must agree (https://docs.unoverse.ai/nodes/credentials)`,
           );
         else if (!prior) allCredentials.set(doc.name, { file: rel(join(credDir, f)), fields });
       }
@@ -67,7 +67,7 @@ export function lintPackage(dir) {
       report(
         "error",
         rel(entry),
-        `still calls api.registerCredential() while this package also declares credentials/ manifests. Registration is first-wins and silent, so one of them is dropped at random. Move the declaration, do not copy it (04-credentials.md)`,
+        `still calls api.registerCredential() while this package also declares credentials/ manifests. Registration is first-wins and silent, so one of them is dropped at random. Move the declaration, do not copy it (https://docs.unoverse.ai/nodes/credentials)`,
       );
   }
 

package/vendor/base/src/manifests/executor/context.ts

@@ -40,6 +40,9 @@ export function contextFor(node: ComposedNode, inputs: any, config: any, executi
     credentials: executionContext?.credentials ?? {},
     signal: inputs ?? {},
     services: executionContext?.services ?? {},
+    // The caller's disconnect. A tool loop stops between turns when it fires, so a run
+    // the engine reaped cannot keep spending model calls (observed live 2026-09-05).
+    abort: executionContext?.abortSignal,
     // Picked field by field, never spread: a future field on auth.user must be an explicit
     // decision to expose, not something a manifest silently inherits.
     user: { email: user.email, id: user.id ?? user.sub, name: user.name },

package/vendor/base/src/manifests/runtime/channels/service.ts

@@ -11,7 +11,7 @@ import type { RunContext } from "../context.js";
 import { evaluate } from "../templating.js";
 import { runCalls } from "../http/request.js";
 import type { StateStore } from "../state.js";
-import { rowComponentsFromResults, renderRowComponents } from "../../../agent-mcp/rowComponents.js";
+import { rowComponentsFromResults, renderRowComponents, screenLine } from "../../../agent-mcp/rowComponents.js";
 import { withHelpers } from "../helpers.js";
 
 /**
@@ -103,13 +103,26 @@ async function serviceMethod(
       if (!session?.userId) {
         console.log(`[manifests] ${node.type}: ${found.length} row component(s) not rendered — no live session on this run`);
       }
-      renderRowComponents(found, sessionCtx, log);
+      const outcomes = renderRowComponents(found, sessionCtx, log);
+      /**
+       * THE SEARCH MIRRORS TOO (MCP_APP_PROTOCOL §0.1, ruled 2026-09-05). When the delivery
+       * holds a component that takes input (a shell), the model must answer the SCREEN,
+       * not the rows: it wait for the delivery's verdict — instant here, the ladder at the
+       * door leaves one candidate and the rules brain answers at once — and the result
+       * carries a `screen` line saying what is on screen and what was not shown.
+       * Card-only deliveries stay fire-and-forget, as fast as ever.
+       */
+      if (found.some((i) => i.shell)) {
+        const screen = screenLine(await outcomes);
+        const result = await evaluate(spec.returns, { response: last, calls: results, params, config: ctx.config, user: ctx.user });
+        return screen && result && typeof result === "object" && !Array.isArray(result) ? { ...(result as Record<string, unknown>), screen } : result;
+      }
     } else {
       const n = Array.isArray(rows) ? rows.length : 0;
       console.log(`[manifests] ${node.type}: no row components in ${n} row(s)`);
       // The empty delivery is announced (§12e mechanical spent rule): this search
       // ran and surfaced nothing, and the standing set's fate hangs on that fact.
-      renderRowComponents(found, sessionCtx, log);
+      void renderRowComponents(found, sessionCtx, log);
     }
   }
 

package/vendor/base/src/manifests/runtime/context.ts

@@ -29,6 +29,12 @@ export interface RunContext {
    * phrase for two different things.
    */
   calls: Record<string, any>;
+  /**
+   * The CALLER'S DISCONNECT, when the node runs over a stream. Set from the request's
+   * own signal; a turn loop checks it between turns and stops. Absent for a node that
+   * runs in-process, which cannot be hung up on.
+   */
+  abort?: AbortSignal;
   /**
    * The SIGNED-IN person, and nothing that authenticates as them.
    *

package/vendor/base/src/manifests/runtime/tools/toolloop.ts

@@ -223,6 +223,14 @@ export async function runToolLoop(
   const usage = makeUsageCollector(node, ctx);
 
   for (turn = 1; turn <= maxTurns; turn++) {
+    // THE CALLER HUNG UP. The engine reaps a run by aborting the node's request; a loop
+    // that did not look was observed spending a dozen model turns against a run that no
+    // longer existed (2026-09-05). Checked between turns: a turn in flight completes,
+    // the next never starts.
+    if (ctx.abort?.aborted) {
+      console.warn(`[manifests] ${node.type}: run aborted by the caller after ${turn - 1} turn(s) — stopping`);
+      break;
+    }
     const scoped: RunContext = {
       ...ctx,
       services: { ...ctx.services, [connector]: { tools: live } },

package/vendor/base/src/manifests/source.ts

@@ -134,6 +134,17 @@ export function diskSource(home: string): ManifestSource {
   return {
     name: "disk",
     async listPackages(): Promise<RawPackage[]> {
+      return readDiskPackages(home);
+    },
+  };
+}
+
+/**
+ * The same read, synchronous. Disk settles at once; the source above is async only
+ * because the row source beside it must be. The publish collector (items/collect.ts) is
+ * synchronous end to end, so it reads here rather than growing a promise it cannot await.
+ */
+export function readDiskPackages(home: string): RawPackage[] {
       if (!fs.existsSync(home)) return [];
       const packages: RawPackage[] = [];
 
@@ -182,6 +193,4 @@ export function diskSource(home: string): ManifestSource {
         if (pkg.nodes.length || Object.keys(pkg.credentials).length) packages.push(pkg);
       }
       return packages;
-    },
-  };
 }

package/vendor/base/src/platform/executionContext.ts

@@ -44,6 +44,9 @@ export function buildExecutionContext(nodeType: string, inputs: any, config: any
         },
     publishingContext,
     activeLoop: context.activeLoop,
+    // The caller's disconnect, when the node runs over a stream (routeExecuteStream). A
+    // turn loop checks it between turns so a reaped run stops spending model calls.
+    abortSignal: context.abortSignal,
     logger: console,
     auth: context.auth,
   };

package/vendor/base/src/workflow/PlatformMemoryCore.ts

@@ -14,6 +14,9 @@
  *   - data.config.enableAgentMemory → getGoalContext, writeNote,
  *       updateGoalState, searchHistory, resumeGoal, archiveGoal  (goal-scoped working memory)
  *
+ * recordAttempt is PLATFORM-ONLY (PLATFORM_MEMORY_METHODS): the judge writes the ledger
+ * through executePlatformMemoryMethod; it is never merged into an agent's schema.
+ *
  * Per-agent (not canvas-wide) so memory never leaks into worker agents UNO
  * builds inside the workflows it creates — those default off. Still a TOGGLE,
  * not a connector: a bare agent with the toggle on still gets its schema with
@@ -57,7 +60,7 @@ export const USER_MEMORY_METHODS: Record<string, any> = {
 export const AGENT_MEMORY_METHODS: Record<string, any> = {
   getGoalContext: {
     description:
-      "Your wake-up briefing: the active goal (description, acceptance criteria), your last saved goal-state (plan, current step, blockers), recent journal notes, durable environment facts, and recent past-goal summaries. Call FIRST when starting or resuming work — it replaces re-reading history. Read-only, cheap.",
+      "Your wake-up briefing: the active goal (description, acceptance criteria), the LEDGER (attempts so far, whether the goal is met, the open criteria the judge failed last time with its reason, any standing directive), your last saved goal-state (plan, current step), recent journal notes, durable environment facts, and recent past-goal summaries. Call FIRST when starting or resuming work — it replaces re-reading history. Read-only, cheap.",
     input: { type: "object", additionalProperties: false, properties: {} },
   },
   writeNote: {
@@ -79,7 +82,7 @@ export const AGENT_MEMORY_METHODS: Record<string, any> = {
   },
   updateGoalState: {
     description:
-      "Overwrite your compact goal-state object — the FIRST thing future-you reads after a reset. Keep it current after each meaningful step: the goal description, the plan (short steps with status), the current step, and blockers. Supplied fields merge over the existing state; it is also snapshotted to durable storage. (The acceptance bar is NOT set here — lockCriteria authors and locks it independently, so you cannot grade your own homework.)",
+      "Overwrite your compact goal-state object — the FIRST thing future-you reads after a reset. Keep it current after each meaningful step: the goal description, the plan (short steps with status), and the current step. Supplied fields merge over the existing state; it is also snapshotted to durable storage. (The acceptance bar is NOT set here, and neither are blockers: the bar is locked independently and what is still open is derived from the judge's last verdict, so you cannot grade your own homework.)",
     input: {
       type: "object",
       additionalProperties: false,
@@ -87,7 +90,6 @@ export const AGENT_MEMORY_METHODS: Record<string, any> = {
         description: { type: "string", description: "The goal in one sentence (sets/updates the goal description)" },
         plan: { type: "array", items: { type: "string" }, description: "Short step list, each prefixed with its status, e.g. '[done] fetch schema'" },
         currentStep: { type: "string", description: "What is being worked on right now" },
-        blockers: { type: "array", items: { type: "string" }, description: "Open blockers; empty array clears them" },
       },
     },
   },
@@ -134,14 +136,18 @@ export const USER_MEMORY_INSTRUCTIONS =
   "User memory is available. A background summary of who this user is (identity + current state) was injected into your context at start — do not re-fetch it. queryMemory(topic) searches deeper when a specific topic needs prior context.";
 
 export const AGENT_MEMORY_INSTRUCTIONS =
-  "You have persistent goal memory that survives restarts and context resets. On wake: getGoalContext before doing work — it shows the active goal AND your recent goals with their progress (done/total). If an earlier goal is unfinished or was closed too soon, resumeGoal reopens it so you continue from where you left off instead of starting over. While working: record decisions, failures, environment facts, and progress with writeNote, and keep updateGoalState accurate after each meaningful step (mark steps '[done] …' as you finish them — don't leave the plan frozen on step 1). On completion: REVIEW first — verify the output meets the locked acceptance criteria, mark the remaining plan steps done and set a closing currentStep via updateGoalState, then archiveGoal with a specific summary. The journal is for future-you — write what re-hydration needs, nothing else.";
+  "You have persistent goal memory that survives restarts and context resets. On wake: getGoalContext before doing work — it shows the active goal, its ledger (attempts, whether it is met, the criteria still open from the judge's last verdict), AND your recent goals with their progress (done/total). If an earlier goal is unfinished or was closed too soon, resumeGoal reopens it so you continue from where you left off instead of starting over. While working: record decisions, failures, environment facts, and progress with writeNote, and keep updateGoalState accurate after each meaningful step (mark steps '[done] …' as you finish them — don't leave the plan frozen on step 1). On completion: REVIEW first — verify the output meets the locked acceptance criteria, mark the remaining plan steps done and set a closing currentStep via updateGoalState, then archiveGoal with a specific summary. The journal is for future-you — write what re-hydration needs, nothing else.";
 
 // A harness BUILDER runs under an external gate (Define→build→Verdict→Deliver). It must NOT
 // close or complete the goal itself — the harness's Deliver node owns archiving, and only when
 // an independent Verdict passed. So the builder gets the read/journal memory tools WITHOUT the
 // goal-lifecycle tools (archiveGoal/resumeGoal), and an instruction that forbids self-completion.
 export const AGENT_MEMORY_INSTRUCTIONS_BUILDER =
-  "You have persistent goal memory that survives restarts and context resets. On wake: getGoalContext BEFORE doing work — it shows the active goal AND any revision feedback (blockers) from a prior attempt. If blockers are present, your last build was REJECTED by the independent harness: address those exact gaps before rebuilding, and do not re-submit the same build. While working: record decisions, failures, environment facts, and progress with writeNote, and keep updateGoalState accurate (plan, currentStep, blockers). You do NOT complete, archive, or close the goal — an external harness independently judges the result and owns completion. Build the best workflow, produce its real output, then stop and report; never declare the goal done yourself.";
+  "You have persistent goal memory that survives restarts and context resets. On wake: getGoalContext BEFORE doing work — it shows the active goal AND its ledger: the criteria the independent judge failed on the last attempt (each with its reason and how many attempts in a row it has failed), plus any standing directive. If open criteria are present, your last build was REJECTED: address those exact gaps before rebuilding, and do not re-submit the same build. While working: record decisions, failures, environment facts, and progress with writeNote, and keep updateGoalState accurate (plan, currentStep). You do NOT complete, archive, or close the goal — an external harness independently judges the result and owns completion. Build the best workflow, produce its real output, then stop and report; never declare the goal done yourself.";
+
+// PLATFORM-ONLY methods: executed by the harness through executePlatformMemoryMethod, never
+// merged into an agent's schema. The judge records verdicts; an agent cannot.
+export const PLATFORM_MEMORY_METHODS = new Set(["recordAttempt"]);
 
 // UnoverseMCP authoring methods. An agent whose toolset contains any of these IS a harness
 // builder — used to strip its goal-completion authority (see mergePlatformMemorySchema).
@@ -276,19 +282,16 @@ function resolveIdentity(params: any, context: any): MemoryCallIdentity | { erro
   if (!userId) return { error: "No user identity in execution context — cannot access memory" };
   if (!workflowId) return { error: "No workflow id in execution context — cannot access memory" };
 
-  // Shared per-workflow agent memory: all agents on a canvas share ONE goal drawer.
-  // The pointer is agent_goal:{user}:{workflowId}:shared — the workflowId is unique
-  // per canvas, so "shared" gives exactly one goal per workflow. The Agent Memory
-  // toggle is the access switch: any agent with memory enabled reads/writes the SAME
-  // goal, so a harness Define node and the worker agent share the goal automatically.
-  // A caller may still pass an explicit `agentId` to target a specific drawer instead
-  // (e.g. isolated builder scratch for a future tournament).
-  const agentId = params?.agentId || "shared";
-  const agentNode =
-    agentId === "shared"
-      ? null
-      : (context?.workflow?.nodes || context?.cachedWorkflow?.nodes || []).find((n: any) => n?.id === agentId);
-  const agentName = agentNode?.data?.label || (agentId === "shared" ? "Canvas" : undefined);
+  // TWO DRAWERS (AGENT_MEMORY.md ruling 2026-09-05, part 2). The GOAL is a property of the
+  // canvas (HARNESS.md §12 ruling 1) — one active goal per workflowId, shared brief for
+  // everyone. SCRATCH is per agent: the calling node on a canvas, or "caller" for an external
+  // builder over the builder MCP (no node). The platform resolves the id from the execution
+  // context; agents never pass identity. A caller may still pass an explicit `agentId` to
+  // address a specific scratch (isolated builder scratch for a future tournament).
+  const nodes: any[] = context?.workflow?.nodes || context?.cachedWorkflow?.workflow?.nodes || context?.cachedWorkflow?.nodes || [];
+  const agentId: string = params?.agentId || context?.callingNodeId || context?.nodeId || "caller";
+  const agentNode = nodes.find((n: any) => n?.id === agentId);
+  const agentName: string | undefined = agentNode?.data?.label || (agentId === "caller" ? "External builder" : undefined);
 
   return {
     userId,
@@ -395,14 +398,22 @@ export async function executePlatformMemoryMethod(method: string, params: any, c
         );
       }
       case "updateGoalState": {
-        // acceptanceCriteria is a first-class column on the goal (the checkAcceptance
-        // judge reads it from goal.acceptanceCriteria), NOT part of the free-form state
-        // blob — pull it out so it routes to its own field, or it never reaches the checker.
-        const { description, acceptanceCriteria, ...stateFields } = params || {};
+        // description, acceptanceCriteria and directive are first-class columns on the goal
+        // (the judge reads criteria from goal.acceptanceCriteria; the directive is the one
+        // platform instruction slot), NOT part of the free-form state blob — pull them out so
+        // they route to their own fields. `directive` is only sent when the caller passed it,
+        // because null means CLEAR.
+        const { description, acceptanceCriteria, directive, ...stateFields } = params || {};
         const state = Object.keys(stateFields).length > 0 ? stateFields : undefined;
+        const body: Record<string, any> = { userId, workflowId, agentId, agentName, description, acceptanceCriteria, state };
+        if (params && Object.prototype.hasOwnProperty.call(params, "directive")) body.directive = directive ?? null;
+        return await memoryServerPost("/agent/state", body, accessToken);
+      }
+      case "recordAttempt": {
+        // The judge's verdict → one ledger row. Platform-only (PLATFORM_MEMORY_METHODS).
         return await memoryServerPost(
-          "/agent/state",
-          { userId, workflowId, agentId, agentName, description, acceptanceCriteria, state },
+          "/agent/attempt",
+          { userId, workflowId, agentId, results: params?.results, deliverables: params?.deliverables || [] },
           accessToken,
         );
       }