@vincemakes/kiso-core 0.1.24 → 0.1.26

package/dist/kernel/loop.d.ts

@@ -15,10 +15,15 @@
  *
  * Per iteration:
  *   assemble (onUserMessage / onPreLlm)
- *     → adapter.stream(): events yielded straight through, tool calls collected
- *     → execute: validation → permission (onPreTool) → handler → rewrite
- *       (onPostTool), concurrency-safe calls batched parallel, the rest serial
- *     → tool_result events appended
+ *     → adapter.stream(): events yielded straight through; every validated
+ *       and policy-allowed tool call LAUNCHES its execution immediately
+ *       (流中执行) — the executions run concurrently under a window of 4
+ *       (0.1.26, ADR-0024 Amd), their events queued and drained between
+ *       stream events (completion order; the projection re-orders the
+ *       results by call order — 字节纪律)
+ *     → the turn settles: the launched executions finish (receipts land
+ *       before any terminal), the ask-gated successors follow the human's
+ *       verdict (保守序)
  *   no tool calls / maxTurns / abort / max_tokens → terminal event, return
  *
  * Retry lives HERE and only here (ADR-0005): a retryable StructuredError

package/dist/kernel/loop.js

@@ -15,10 +15,15 @@
  *
  * Per iteration:
  *   assemble (onUserMessage / onPreLlm)
- *     → adapter.stream(): events yielded straight through, tool calls collected
- *     → execute: validation → permission (onPreTool) → handler → rewrite
- *       (onPostTool), concurrency-safe calls batched parallel, the rest serial
- *     → tool_result events appended
+ *     → adapter.stream(): events yielded straight through; every validated
+ *       and policy-allowed tool call LAUNCHES its execution immediately
+ *       (流中执行) — the executions run concurrently under a window of 4
+ *       (0.1.26, ADR-0024 Amd), their events queued and drained between
+ *       stream events (completion order; the projection re-orders the
+ *       results by call order — 字节纪律)
+ *     → the turn settles: the launched executions finish (receipts land
+ *       before any terminal), the ask-gated successors follow the human's
+ *       verdict (保守序)
  *   no tool calls / maxTurns / abort / max_tokens → terminal event, return
  *
  * Retry lives HERE and only here (ADR-0005): a retryable StructuredError
@@ -114,6 +119,169 @@ export async function* loop(config) {
         yield await terminal({ kind: "completed" });
         return;
     }
+    // 0.1.26 (ADR-0024 Amd — the trigger condition is met: a real workload
+    // showed the sequential ledger is the bottleneck): the windowed parallel
+    // batching returns, this time with the ledger events emitted per call in
+    // deterministic order. The model stream and the tool executions run
+    // CONCURRENTLY (流中执行): a tool_call_end validated and allowed by the
+    // policy chain launches its execution immediately; the events land
+    // through a queue the stream loop drains on every stream event — their
+    // seq order is the COMPLETION order (started/receipt/result land when
+    // each execution finishes; seq stays monotonic by construction). The
+    // byte discipline is preserved by the projection, which re-orders the
+    // turn's results by CALL order (project.ts flushResults) — the
+    // completion order only affects the landing moment, never the derived
+    // messages. The window caps concurrent executions; the ask gate holds
+    // an ask AND the calls after it until the human decides (保守序 — the
+    // context may have changed when the human approves); the STARTED event
+    // is acked by the drain so the handler never runs before its receipt is
+    // persisted (write-ahead preserved). A voided turn (forged event,
+    // post-stop violation, a non-compatible stop reason) fires the violated
+    // signal: started executions finish and their receipts land (已开跑照落
+    // receipt), not-started ones bail without a started event (abort 语义 —
+    // clean, never uncertain).
+    const WINDOW_SIZE = 4;
+    // The execution event queue. The drain (below) appends + yields each
+    // queued event; the ack of the STARTED event gates the handler (the
+    // write-ahead: the receipt is persisted before the side effect).
+    const execQueue = [];
+    const pushExec = (ev, ack) => {
+        execQueue.push({ ev, ack: ack ?? (() => { }) });
+    };
+    const drainExec = async function* () {
+        while (execQueue.length > 0) {
+            const { ev, ack } = execQueue.shift();
+            // The STARTED event's executionId is allocated HERE, atomically
+            // with the append: `ex-<seq>` — the id equals the event's seq, so
+            // the SAME logical execution derives the SAME id on a replay or a
+            // resume (the execution-identity contract). Under the parallel
+            // execution a pre-append prediction raced; the drain is the only
+            // place the next seq is known without a gap. The ack carries the
+            // id back to the launch (the receipts reference it).
+            const full = ev.type === "tool_execution_started"
+                ? log.append({ ...ev, executionId: `ex-${log.lastSeq + 1}` })
+                : log.append(ev);
+            if (hooks.onEvent)
+                await hooks.onEvent(full, {}).catch(() => { });
+            yield full;
+            ack(full.type === "tool_execution_started" ? full.executionId : undefined);
+        }
+    };
+    // The window: at most WINDOW_SIZE executions run concurrently.
+    let freeSlots = WINDOW_SIZE;
+    const windowWaiters = [];
+    const acquireWindow = () => {
+        if (freeSlots > 0) {
+            freeSlots -= 1;
+            return Promise.resolve();
+        }
+        return new Promise((res) => {
+            windowWaiters.push(res);
+        });
+    };
+    const releaseWindow = () => {
+        const w = windowWaiters.shift();
+        if (w !== undefined)
+            w();
+        else
+            freeSlots += 1;
+    };
+    // The turn's launches: one async task per tool_call_end, in call order.
+    const launches = [];
+    let execActive = 0;
+    // A launch failure (a throwing onPostTool, a real error) fails the RUN —
+    // the launch records it and the loop re-throws it after the settle
+    // (same propagation the sequential execute had).
+    let launchError = null;
+    let violated = false;
+    // The violated signal: rejects when the turn is voided — the paused
+    // ask-branches bail (abort 语义 for not-started executions). Typed
+    // `never` so the ask race resolves to the human decision alone.
+    let violatedReject = () => { };
+    const violatedP = new Promise((_, reject) => {
+        violatedReject = () => reject();
+    });
+    // The turn's ask-branches race it; a turn with NO ask leaves the
+    // rejection un-consumed — the no-op keeps it from surfacing as an
+    // unhandled rejection while the race consumers still receive it.
+    void violatedP.catch(() => { });
+    // The ask gate: an ask's human resolution blocks the calls after it.
+    // The DECIDE chain serializes the decisions in CALL order, so the gate
+    // an ask installs is structurally in place before the successors decide.
+    let askGate = Promise.resolve();
+    let askRelease = null;
+    // The decision chain: each launch's decide is chained onto the previous
+    // one's — the decides run in CALL order and the chain resolves to the
+    // call's verdict.
+    let decideChain = Promise.resolve({ action: "allow" });
+    // The decisionId allocator: monotonic per log (seeded past the existing
+    // log), unique under the parallel decides — the ids are correlation
+    // keys (the executionId comes from the drain, seq-stable).
+    let idSeq = log.all.length + 1;
+    const nextDecisionId = () => `d-${idSeq++}`;
+    const launch = (call) => {
+        execActive += 1;
+        launches.push((async () => {
+            try {
+                await acquireWindow();
+                decideChain = decideChain.then(async () => {
+                    const v = await decideCall(call, registry, hooks, { signal: signal ?? NEVER_ABORT, ...(config.sessionId !== undefined ? { sessionId: config.sessionId } : {}) }, log, config.resolveApproval, config.approvalVerdict, signal, config.approvalPolicies, nextDecisionId, pushExec);
+                    if (v.action === "ask") {
+                        askGate = new Promise((res) => {
+                            askRelease = res;
+                        });
+                    }
+                    return v;
+                });
+                const verdict = await decideChain;
+                if (violated)
+                    return; // the turn was voided before this call started
+                if (verdict.action === "deny") {
+                    pushExec(verdict.result);
+                    return;
+                }
+                if (verdict.action === "ask") {
+                    // The human pause — abortable by a user abort OR a turn
+                    // void (the violated promise). The gate opens when the
+                    // human decides, whatever the outcome (conservative
+                    // ordering: the successors then proceed with their own
+                    // verdicts).
+                    const decision = await Promise.race([
+                        humanPause(call, verdict.decisionId, hooks, log, config.resolveApproval, config.approvalVerdict, signal, pushExec),
+                        violatedP,
+                    ]);
+                    askRelease?.();
+                    askRelease = null;
+                    if (violated)
+                        return;
+                    if (decision.action !== "allow") {
+                        // the reason rides the denial — the human's words,
+                        // or the honest "no approval flow configured".
+                        pushExec(resultEvent(call, denialResult(decision.reason ?? "denied")));
+                        return;
+                    }
+                }
+                // 保守序: the calls AFTER an ask wait for its human
+                // resolution (the askGate is the ask's pause promise —
+                // resolved by default, released by the ask branch above).
+                // The context may have changed when the human approves.
+                await askGate;
+                await runLedgered(call, registry, hooks, { signal: signal ?? NEVER_ABORT, ...(config.sessionId !== undefined ? { sessionId: config.sessionId } : {}) }, signal, pushExec);
+            }
+            catch (err) {
+                // The abort sentinel (a user cancel during the decide or
+                // the pause) is swallowed — the loop's aborted() check
+                // ends the run honestly; anything else is recorded and
+                // re-thrown after the settle (the consumer sees it).
+                if (err !== ABORTED)
+                    launchError ??= err;
+            }
+            finally {
+                releaseWindow();
+                execActive -= 1;
+            }
+        })());
+    };
     let turns = 0;
     while (true) {
         if (aborted()) {
@@ -176,12 +344,19 @@ export async function* loop(config) {
                 });
                 for await (const ev of stream) {
                     streamed = true;
+                    // 0.1.26: the launched executions' events land first —
+                    // the completion order; the projection re-orders the
+                    // results by call order (字节纪律).
+                    for await (const q of drainExec())
+                        yield q;
                     // 五: the trust gate — a kernel-owned event from the
                     // adapter is a forgery: it is never appended (never
                     // persisted), and the turn ends with a unique
                     // invalid_request terminal below.
                     if (!isAdapterEvent(ev)) {
                         forgedEvent = true;
+                        violated = true;
+                        violatedReject();
                         break;
                     }
                     // 五: a delta/tool call/usage arriving AFTER the provider's
@@ -190,6 +365,8 @@ export async function* loop(config) {
                     // pending tools must NOT execute).
                     if (sawStop && ev.type !== "stop") {
                         postStopViolation = true;
+                        violated = true;
+                        violatedReject();
                         break;
                     }
                     if (ev.type === "stop") {
@@ -197,8 +374,13 @@ export async function* loop(config) {
                         lastStop = ev.reason;
                         stopCount += 1;
                     }
-                    if (ev.type === "tool_call_end")
+                    if (ev.type === "tool_call_end") {
                         pending.push(ev);
+                        // 流中执行: the call launches immediately — the decide
+                        // and the ledgered run proceed in parallel with the
+                        // model stream.
+                        launch(ev);
+                    }
                     const full = log.append(ev);
                     if (hooks.onEvent)
                         await hooks.onEvent(full, {}).catch(() => { });
@@ -226,141 +408,123 @@ export async function* loop(config) {
                 return;
             }
         }
-        // ── 五: a forged kernel-owned event is a protocol error ──────────────
+        // ── The voided-terminal computation (五 / C 组) ────────────────────
+        // A forged kernel-owned event, a post-stop event, or a
+        // non-compatible stop reason voids the turn: the launched
+        // executions still finish and their receipts land (已开跑照落
+        // receipt — the side effects happened), the not-started bail
+        // (abort 语义), then the terminal.
+        let voided = null;
         if (forgedEvent) {
-            yield await terminal({
+            voided = {
                 kind: "error",
                 error: { code: "invalid_request", retryable: false, message: "provider emitted a kernel-owned event" },
-            });
-            return;
+            };
         }
-        // ── 五: events after the stop are a protocol error ───────────────────
-        if (postStopViolation) {
-            yield await terminal({
+        else if (postStopViolation) {
+            voided = {
                 kind: "error",
                 error: { code: "invalid_request", retryable: false, message: "provider emitted events after its stop event" },
-            });
-            return;
+            };
         }
-        // ── Terminal check: no tool call this turn → done, honestly ────────
-        if (pending.length === 0) {
+        else if (pending.length === 0) {
             // Area 6: protocol anomalies are STRUCTURED ERRORS, never a
             // default `completed` — a stream with no stop, a duplicate stop,
             // or a tool_use that never produced a complete call.
             if (stopCount === 0) {
-                yield await terminal({
+                voided = {
                     kind: "error",
                     error: { code: "invalid_request", retryable: false, message: "provider stream ended without a stop event" },
-                });
-                return;
+                };
             }
-            if (stopCount > 1) {
-                yield await terminal({
+            else if (stopCount > 1) {
+                voided = {
                     kind: "error",
                     error: { code: "invalid_request", retryable: false, message: `provider emitted ${stopCount} stop events in one turn` },
-                });
+                };
+            }
+            else {
+                yield await terminal(terminalForStop(lastStop));
                 return;
             }
-            yield await terminal(terminalForStop(lastStop));
-            return;
         }
-        // ── Abort check before side effects: a stop landing during the
-        //    model turn must never let the pending tools run ────────────────
-        if (aborted()) {
+        // ── Abort check: an abort now abandons the launched executions
+        //    (started without receipt → uncertain), exactly as before ──────
+        if (voided === null && aborted()) {
             yield await terminal({ kind: "aborted", by: "user" });
             return;
         }
-        // ── C 组: the turn is verified BEFORE any tool runs ────────────────
-        // A tool may only execute when the provider turn is well-formed:
-        // exactly one stop, whose reason is compatible with complete calls.
-        // Missing/duplicate stops, max_tokens, refusal, content_filter,
-        // pause_turn, context_window, abort, and the contradictory
-        // end_turn-with-pending-calls all terminate WITHOUT executing.
-        if (pending.length > 0) {
+        // ── C 组: the turn is verified. 0.1.26 (流中执行): the calls were
+        // ALREADY launched at tool_call_end, so a non-compatible stop reason
+        // VOIDS the turn instead of preventing the execution.
+        if (voided === null && pending.length > 0) {
             if (stopCount === 0) {
-                yield await terminal({
+                voided = {
                     kind: "error",
                     error: { code: "invalid_request", retryable: false, message: "provider stream ended without a stop event" },
-                });
-                return;
+                };
             }
-            if (stopCount > 1) {
-                yield await terminal({
+            else if (stopCount > 1) {
+                voided = {
                     kind: "error",
                     error: { code: "invalid_request", retryable: false, message: `provider emitted ${stopCount} stop events in one turn` },
-                });
-                return;
-            }
-            switch (lastStop) {
-                case "tool_use":
-                case "function_call":
-                    break; // compatible with complete calls — execute
-                case "max_tokens":
-                    yield await terminal({ kind: "max_tokens" });
-                    return;
-                case "abort":
-                    yield await terminal({ kind: "aborted", by: "user" });
-                    return;
-                case "error":
-                    yield await terminal({
-                        kind: "error",
-                        error: { code: "unknown", retryable: false, message: "provider stopped with an error" },
-                    });
-                    return;
-                case "refusal":
-                case "pause_turn":
-                case "content_filter":
-                case "context_window":
-                case "end_turn":
-                case "stop_sequence":
-                default:
-                    yield await terminal({
-                        kind: "error",
-                        error: {
-                            code: "invalid_request",
-                            retryable: false,
-                            message: `provider stopped with '${String(lastStop)}' but left ${pending.length} tool call(s) unexecuted`,
-                        },
-                    });
-                    return;
-            }
-        }
-        // ── Execute: sequential, ledgered, pause-capable (Phase D) ──────────
-        // Sequential on purpose: the ledger (started → succeeded/failed) and
-        // the approval pause need deterministic, write-ahead ordering; the
-        // windowed parallel batching (ADR-0015) returns as an optimization
-        // once the ledger contract is stable.
-        for (const call of pending) {
-            // Area 4: an abort after the first tool must never start a
-            // sibling tool — each pending call checks the signal first.
-            if (aborted()) {
-                yield await terminal({ kind: "aborted", by: "user" });
-                return;
-            }
-            try {
-                for await (const ev of executeOne(call, registry, hooks, { signal: signal ?? NEVER_ABORT, ...(config.sessionId !== undefined ? { sessionId: config.sessionId } : {}) }, log, config.resolveApproval, config.approvalVerdict, signal, config.approvalPolicies)) {
-                    if (hooks.onEvent)
-                        await hooks.onEvent(ev, {}).catch(() => { });
-                    yield ev;
-                }
+                };
             }
-            catch (err) {
-                // An abort during the approval pause propagates here as the
-                // sentinel — end the run honestly; the request stays durable.
-                if (err === ABORTED || aborted()) {
-                    yield await terminal({ kind: "aborted", by: "user" });
-                    return;
+            else {
+                switch (lastStop) {
+                    case "tool_use":
+                    case "function_call":
+                        break; // compatible with complete calls — the executions proceed
+                    case "max_tokens":
+                        voided = { kind: "max_tokens" };
+                        break;
+                    case "abort":
+                        voided = { kind: "aborted", by: "user" };
+                        break;
+                    case "error":
+                        voided = {
+                            kind: "error",
+                            error: { code: "unknown", retryable: false, message: "provider stopped with an error" },
+                        };
+                        break;
+                    default:
+                        voided = {
+                            kind: "error",
+                            error: {
+                                code: "invalid_request",
+                                retryable: false,
+                                message: `provider stopped with '${String(lastStop)}' with ${pending.length} tool call(s) launched`,
+                            },
+                        };
+                        break;
                 }
-                throw err;
             }
-            // 裁决 #12 (ADR-0038): the failed-receipt uncertain PAUSE is
-            // REMOVED — with a complete receipt (succeeded or failed) the
-            // outcome is KNOWN, and uncertainty belongs to the crash window
-            // alone (started, no receipt; surfaced through the ledger's
-            // uncertainExecutions and resolved offline). A retry is a NEW
-            // call — it passes the approval chain again, which is the correct
-            // guard for partial side effects; the honest note on
-            // non-idempotent failures rides the result (修正一).
+        }
+        // ── The turn settles: a void fires the violated signal — the
+        //    not-started executions bail (abort 语义 — no started, no
+        //    receipt, never uncertain); the started ones finish and their
+        //    receipts land BEFORE the terminal or the next turn (已开跑照落
+        //    receipt). The drain yields every queued event; the STARTED
+        //    ack resolves as the consumer persists (write-ahead), so the
+        //    launches advance DURING the drain — a 10ms settle poll covers
+        //    the in-between gaps (mid-handler launches, the ask pause:
+        //    never a busy spin, never a deadlock on a pending ack).
+        if (voided !== null) {
+            violated = true;
+            violatedReject();
+        }
+        while (execActive > 0) {
+            for await (const q of drainExec())
+                yield q;
+            await sleep(10);
+        }
+        for await (const q of drainExec())
+            yield q;
+        if (launchError !== null)
+            throw launchError;
+        if (voided !== null) {
+            yield await terminal(voided);
+            return;
         }
         // ── Advance history: the log grew; re-derive for the next turn ─────
         messages = derive();
@@ -413,28 +577,10 @@ function terminalForStop(reason) {
             };
     }
 }
-// ── Execution ──────────────────────────────────────────────────────────
-/**
- * Execute one tool call as a ledgered sequence of events:
- *
- *   [guards] → permission (allow / deny / DEFER→pause+resume)
- *   → tool_execution_started (durable BEFORE the side effect)
- *   → handler → tool_execution_succeeded|failed
- *   → tool_result (the model's view)
- *
- * Exactly-once (Phase D): before anything runs, the guard asks the ledger
- * whether this tool+input reached a terminal state before. A confirmed
- * success is replayed, an interrupted (uncertain) or abandoned attempt
- * blocks with a precondition result — the handler never auto-runs a
- * possibly-executed side effect.
- */
-async function* executeOne(call, registry, hooks, ctx, log, resolveApproval, resolveApprovalVerdict, signal, approvalPolicies) {
-    const payload = {
-        callId: call.callId,
-        name: call.name,
-        input: call.input ?? {},
-    };
-    const emitResult = (result, executionId) => log.append({
+/** The tool_result event for a call — the shared shape (executionId rides
+ *  it as the durable correlation, 五). */
+function resultEvent(call, result, executionId) {
+    return {
         type: "tool_result",
         callId: call.callId,
         content: result.content,
@@ -447,34 +593,35 @@ async function* executeOne(call, registry, hooks, ctx, log, resolveApproval, res
         // billing receipts, trace anchors) — never dropped at the loop.
         ...(result.tags !== undefined ? { tags: result.tags } : {}),
         ...(executionId !== undefined ? { executionId } : {}),
-    });
+    };
+}
+/**
+ * 0.1.26: the front of ONE call's execution — unknown tool / unparseable
+ * args / schema validation, the durable-policy check, the E1 extension
+ * policy chain, and onPreTool → a verdict. The policy allow/deny facts are
+ * pushed (durable, decidedBy = the speaking extension — never a human
+ * pause). An ask verdict carries the decisionId for the human pause; the
+ * caller runs it (conservative ordering: the calls after an ask wait for
+ * its resolution).
+ */
+async function decideCall(call, registry, hooks, ctx, log, resolveApproval, resolveApprovalVerdict, signal, approvalPolicies, nextDecisionId, push) {
+    const payload = {
+        callId: call.callId,
+        name: call.name,
+        input: call.input ?? {},
+    };
     // Unknown tool or unparseable args — refuse before anything runs.
     const tool = registry.get(call.name);
     if (!tool) {
-        yield emitResult({
-            content: `Unknown tool: ${call.name}`,
-            isError: true,
-            errorKind: "invalid_input",
-        });
-        return;
+        return { action: "deny", result: resultEvent(call, { content: `Unknown tool: ${call.name}`, isError: true, errorKind: "invalid_input" }) };
     }
     if (call.input === null) {
-        yield emitResult({
-            content: "Arguments failed to parse as JSON",
-            isError: true,
-            errorKind: "invalid_input",
-        });
-        return;
+        return { action: "deny", result: resultEvent(call, { content: "Arguments failed to parse as JSON", isError: true, errorKind: "invalid_input" }) };
     }
     // Phase B: real JSON Schema validation — the handler never sees garbage.
     const schemaError = validateArgs(tool.parameters, call.input);
     if (schemaError !== null) {
-        yield emitResult({
-            content: `Arguments failed schema validation:${schemaError}`,
-            isError: true,
-            errorKind: "invalid_input",
-        });
-        return;
+        return { action: "deny", result: resultEvent(call, { content: `Arguments failed schema validation:${schemaError}`, isError: true, errorKind: "invalid_input" }) };
     }
     // Area 3: NO (name, input) dedup — a new logical call with identical
     // parameters is a new execution and runs normally. Exactly-once is
@@ -485,70 +632,6 @@ async function* executeOne(call, registry, hooks, ctx, log, resolveApproval, res
     // all. Checked again here, after any permission path.
     if (signal?.aborted)
         throw ABORTED;
-    /**
-     * The human approval pause (Phase D / 裁决 A): register the resolver
-     * BEFORE announcing the request (a consumer that answers the moment it
-     * sees the event must find the resolver already waiting — no deadlock
-     * between yield and await), persist the request, yield it, await the
-     * human's decision — abortable (an abort during the wait ends the run;
-     * a verdict given in the same instant is still recorded exactly once) —
-     * then persist and yield the decision. Returns the human's verdict.
-     */
-    async function* awaitHumanApproval(decisionId) {
-        const pendingDecision = resolveApproval !== undefined
-            ? resolveApproval(decisionId)
-            : Promise.resolve({ action: "deny", reason: "no approval channel configured" });
-        const requested = log.append({
-            type: "permission_requested",
-            decisionId,
-            callId: call.callId,
-            name: call.name,
-            input: payload.input,
-        });
-        if (hooks.onPause)
-            await hooks.onPause("awaiting approval", {}).catch(() => { });
-        yield requested;
-        // Area 4: the pause is abortable — a cancel during the human's wait
-        // ends the run now; the request stays durable and pending.
-        let finalDecision;
-        try {
-            finalDecision = await raceAbort(pendingDecision, signal);
-        }
-        catch (err) {
-            if (err === ABORTED) {
-                // 第四轮(对抗): the human may have answered in the same instant
-                // the abort landed — a CONSUMED verdict must be recorded
-                // (exactly once), never lost; the abort then ends the run with
-                // its honest aborted terminal.
-                const verdict = resolveApprovalVerdict?.(decisionId);
-                if (verdict !== undefined) {
-                    yield log.append({
-                        type: "permission_decided",
-                        decisionId,
-                        callId: call.callId,
-                        decision: verdict ? "approved" : "denied",
-                        ...(verdict ? {} : { reason: "denied by user" }),
-                    });
-                }
-            }
-            throw err;
-        }
-        // The approval channel (session.approve) persists the decision
-        // write-ahead BEFORE waking the resolver (Area 2): if it already
-        // landed in the log, this is the same decision, not a duplicate.
-        const decided = log.all.find((e) => e.type === "permission_decided" && e.decisionId === decisionId) ??
-            log.append({
-                type: "permission_decided",
-                decisionId,
-                callId: call.callId, // binds the decision to the invocation (B 组)
-                decision: finalDecision.action === "allow" ? "approved" : "denied",
-                ...(finalDecision.action === "deny" && finalDecision.reason !== undefined
-                    ? { reason: finalDecision.reason }
-                    : {}),
-            });
-        yield decided;
-        return finalDecision;
-    }
     // ── E1: the extension policy chain, decided BEFORE the human flow ─────
     // A durable POLICY decision for THIS call takes effect on resume — the
     // chain never re-runs when its verdict is already in the log (同构
@@ -600,16 +683,16 @@ async function* executeOne(call, registry, hooks, ctx, log, resolveApproval, res
         else if (chainVerdict === undefined) {
             // 全员 abstain (ADR-0042): NO policy speaks — the call falls to
             // the ask flow below, never to a silent auto-approve. The human
-            // decides; absent a channel, awaitHumanApproval's honest denial.
+            // decides; absent a channel, humanPause's honest denial.
             chainVerdict = { action: "ask" };
         }
         if (chainVerdict.action !== "ask") {
             // allow/deny are PERSISTED FACTS (decidedBy = a SPEAKING
             // extension — never the chain head on behalf of a non-speaker)
             // — never a human pause.
-            yield log.append({
+            push({
                 type: "permission_decided",
-                decisionId: `d-${log.lastSeq + 1}`,
+                decisionId: nextDecisionId(),
                 callId: call.callId,
                 decision: chainVerdict.action === "allow" ? "approved" : "denied",
                 ...(chainVerdict.action === "deny" ? { reason: chainVerdict.reason } : {}),
@@ -618,12 +701,10 @@ async function* executeOne(call, registry, hooks, ctx, log, resolveApproval, res
         }
     }
     if (chainVerdict?.action === "deny") {
-        yield emitResult(denialResult(chainVerdict.reason));
-        return;
+        return { action: "deny", result: resultEvent(call, denialResult(chainVerdict.reason)) };
     }
     if (durable !== undefined && durable.decision === "denied") {
-        yield emitResult(denialResult(durable.reason ?? "denied"));
-        return;
+        return { action: "deny", result: resultEvent(call, denialResult(durable.reason ?? "denied")) };
     }
     if (chainVerdict?.action === "ask") {
         // 裁决 A (E1 ask 语义修正): an ask means "a HUMAN must decide" — it
@@ -633,15 +714,9 @@ async function* executeOne(call, registry, hooks, ctx, log, resolveApproval, res
         // channel configured → an honest denial (judged by resolveApproval,
         // not by the hook's presence).
         if (resolveApproval === undefined) {
-            yield emitResult(denialResult("a policy asked for a human decision, but no approval flow is configured"));
-            return;
-        }
-        const decisionId = `d-${log.lastSeq + 1}`;
-        const finalDecision = yield* awaitHumanApproval(decisionId);
-        if (finalDecision.action !== "allow") {
-            yield emitResult(denialResult(finalDecision.reason ?? "denied"));
-            return;
+            return { action: "deny", result: resultEvent(call, denialResult("a policy asked for a human decision, but no approval flow is configured")) };
         }
+        return { action: "ask", decisionId: nextDecisionId() };
     }
     // Permission negotiation — defer is a REAL pause (Phase D). C 组: the
     // hook itself is cancelable (a slow policy query must not outlive an
@@ -654,37 +729,105 @@ async function* executeOne(call, registry, hooks, ctx, log, resolveApproval, res
         if (signal?.aborted)
             throw ABORTED;
         if (decision.action === "defer") {
-            const decisionId = `d-${log.lastSeq + 1}`;
-            const finalDecision = yield* awaitHumanApproval(decisionId);
-            if (finalDecision.action !== "allow") {
-                yield emitResult(denialResult(finalDecision.reason ?? "denied"));
-                return;
-            }
+            return { action: "ask", decisionId: nextDecisionId() };
         }
-        else if (decision.action !== "allow") {
-            yield emitResult(denialResult(decision.reason ?? "denied"));
-            return;
+        if (decision.action !== "allow") {
+            return { action: "deny", result: resultEvent(call, denialResult(decision.reason ?? "denied")) };
         }
     }
-    // The ledgered execution. The started event is durable BEFORE the side
-    // effect; a crash between it and the result leaves "uncertain". The
-    // executionId is the persistent identity of THIS logical execution
-    // (Area 3): generated from the log's next seq, so it is unique per log
-    // and survives restarts.
-    const executionId = `ex-${log.lastSeq + 1}`;
+    return { action: "allow" };
+}
+/**
+ * The human approval pause (Phase D / 裁决 A): register the resolver
+ * BEFORE announcing the request (a consumer that answers the moment it
+ * sees the event must find the resolver already waiting — no deadlock
+ * between push and await), persist the request (via push), await the
+ * human's decision — abortable (an abort during the wait ends the run; a
+ * verdict given in the same instant is still recorded exactly once) —
+ * then persist the decision. Returns "approved" | "denied".
+ */
+async function humanPause(call, decisionId, hooks, log, resolveApproval, resolveApprovalVerdict, signal, push) {
+    const pendingDecision = resolveApproval !== undefined
+        ? resolveApproval(decisionId)
+        : Promise.resolve({ action: "deny", reason: "no approval channel configured" });
+    push({
+        type: "permission_requested",
+        decisionId,
+        callId: call.callId,
+        name: call.name,
+        input: call.input ?? {},
+    });
+    if (hooks.onPause)
+        await hooks.onPause("awaiting approval", {}).catch(() => { });
+    // Area 4: the pause is abortable — a cancel during the human's wait
+    // ends the run now; the request stays durable and pending.
+    let finalDecision;
+    try {
+        finalDecision = await raceAbort(pendingDecision, signal);
+    }
+    catch (err) {
+        if (err === ABORTED) {
+            // 第四轮(对抗): the human may have answered in the same instant
+            // the abort landed — a CONSUMED verdict must be recorded
+            // (exactly once), never lost; the abort then ends the run with
+            // its honest aborted terminal.
+            const verdict = resolveApprovalVerdict?.(decisionId);
+            if (verdict !== undefined) {
+                push({
+                    type: "permission_decided",
+                    decisionId,
+                    callId: call.callId,
+                    decision: verdict ? "approved" : "denied",
+                    ...(verdict ? {} : { reason: "denied by user" }),
+                });
+            }
+        }
+        throw err;
+    }
+    // The approval channel (session.approve) persists the decision
+    // write-ahead BEFORE waking the resolver (Area 2): if it already
+    // landed in the log, this is the same decision, not a duplicate.
+    if (log.all.find((e) => e.type === "permission_decided" && e.decisionId === decisionId) === undefined) {
+        push({
+            type: "permission_decided",
+            decisionId,
+            callId: call.callId, // binds the decision to the invocation (B 组)
+            decision: finalDecision.action === "allow" ? "approved" : "denied",
+            ...(finalDecision.action === "deny" && finalDecision.reason !== undefined
+                ? { reason: finalDecision.reason }
+                : {}),
+        });
+    }
+    return finalDecision;
+}
+/**
+ * 0.1.26: the ledgered execution of an ALLOWED call — started (durable
+ * BEFORE the side effect, write-ahead acked by the drain), handler,
+ * receipt, result. The executionId comes from the loop's monotonic
+ * allocator (under concurrency the old `lastSeq + 1` prediction raced).
+ */
+async function runLedgered(call, registry, hooks, ctx, signal, push) {
+    const tool = registry.get(call.name); // validated + decided by decideCall
     // C 组: the signal is re-checked immediately before the started event —
     // an abort that landed in any permission path must not let the side
     // effect begin.
     if (signal?.aborted)
         throw ABORTED;
-    const started = log.append({
-        type: "tool_execution_started",
-        executionId,
-        callId: call.callId,
-        name: call.name,
-        input: call.input,
+    // The started event is durable BEFORE the side effect; a crash between
+    // it and the result leaves "uncertain". The ack resolves when the
+    // drain yields the event and the consumer persisted it — the handler
+    // never runs before its receipt is on disk (write-ahead preserved
+    // under the parallel execution). The executionId is allocated BY THE
+    // DRAIN (ex-<seq> — atomic with the append, stable across replays) and
+    // carried back through the ack.
+    const executionId = await new Promise((res) => {
+        push({
+            type: "tool_execution_started",
+            callId: call.callId,
+            name: call.name,
+            input: call.input, // non-null: decideCall denied a null input before this ran
+        }, (id) => res(id ?? ""));
     });
-    yield started;
     let result;
     try {
         // C 组: re-checked again right before the handler — the handler also
@@ -702,7 +845,7 @@ async function* executeOne(call, registry, hooks, ctx, log, resolveApproval, res
         };
     }
     if (hooks.onPostTool) {
-        result = await hooks.onPostTool(payload, result, ctx);
+        result = await hooks.onPostTool({ callId: call.callId, name: call.name, input: call.input ?? {} }, result, ctx);
     }
     // 裁决 #12 修正一: a non-idempotent failure's side effects may have
     // partially applied — an honest note rides the RESULT (and the failed
@@ -722,7 +865,7 @@ async function* executeOne(call, registry, hooks, ctx, log, resolveApproval, res
         // effect and is uncertain until a human decides.
         // 八: the tags ride on the RECEIPT too — a crash-window repair of the
         // tool_result reproduces the normal path losslessly.
-        yield log.append({
+        push({
             type: "tool_execution_failed",
             executionId,
             callId: call.callId,
@@ -736,7 +879,7 @@ async function* executeOne(call, registry, hooks, ctx, log, resolveApproval, res
         });
     }
     else {
-        yield log.append({
+        push({
             type: "tool_execution_succeeded",
             executionId,
             callId: call.callId,
@@ -744,7 +887,7 @@ async function* executeOne(call, registry, hooks, ctx, log, resolveApproval, res
             ...(result.tags !== undefined ? { tags: result.tags } : {}),
         });
     }
-    yield emitResult(result, executionId);
+    push(resultEvent(call, result, executionId));
 }
 /** Thrown when an abort lands while the loop awaits a human decision. */
 const ABORTED = Symbol("kiso-aborted-during-approval");

package/dist/kernel/project.js

@@ -139,6 +139,27 @@ export function projectMessages(events) {
     const isCovered = (seq) => summaryRanges.some((r) => seq > r.from && seq <= r.to);
     // Summaries render in range order as the pass crosses their boundaries.
     let renderedSummaries = 0;
+    // 0.1.26 (ADR-0024 Amd, parallel execution): the tool results of ONE turn
+    // are buffered and emitted in CALL order at the turn boundary. The
+    // physical seq order is the COMPLETION order (started/receipt/result land
+    // when each execution finishes — parallel), which must never enter the
+    // projection: the same logical turn projects byte-identically whatever
+    // the completion interleaving (字节纪律 — 以 call 序为准,完成序只影响
+    // 落盘时刻). `callOrder` is rebuilt per turn from the tool_call_end
+    // events (their seq order IS the call order — the stream order).
+    let resultBuf = [];
+    const callOrder = new Map();
+    let callOrderNext = 0;
+    const flushResults = () => {
+        if (resultBuf.length === 0)
+            return;
+        resultBuf.sort((a, b) => (callOrder.get(a.callId) ?? 0) - (callOrder.get(b.callId) ?? 0));
+        for (const r of resultBuf)
+            out.push(r.message);
+        resultBuf = [];
+        callOrder.clear();
+        callOrderNext = 0;
+    };
     let explicitAssistant = false;
     for (const ev of events) {
         // ADR-0044: covered events are replaced by their summary — seed
@@ -154,6 +175,7 @@ export function projectMessages(events) {
             ev.seq !== undefined &&
             ev.seq > summaryRanges[renderedSummaries].to) {
             flushAssistant();
+            flushResults(); // the results follow the assistant in reading order
             out.push({
                 role: "assistant",
                 blocks: [{ type: "text", text: summaryRanges[renderedSummaries].summary }],
@@ -162,6 +184,10 @@ export function projectMessages(events) {
         }
         switch (ev.type) {
             case "user_input": {
+                // 0.1.26: the previous turn closes here — the assistant
+                // first, then its results in call order (the turn boundary).
+                flushAssistant();
+                flushResults();
                 // 六: the final replacement renders HERE, at the input's own
                 // position — the original is skipped, the replacement event
                 // itself produces nothing (a later replacement for the same
@@ -194,6 +220,7 @@ export function projectMessages(events) {
                 // D 组: an explicit message boundary — close any open message
                 // and begin a new one (adjacent assistants stay separate).
                 flushAssistant();
+                flushResults();
                 explicitAssistant = true;
                 if (ev.source !== undefined)
                     assistantSource = ev.source;
@@ -214,6 +241,8 @@ export function projectMessages(events) {
                 explicitAssistant = false;
                 break;
             case "text_start":
+                // An INTERNAL block boundary (a multi-block assistant
+                // message) — never a turn boundary; no flush.
                 pushText(); // an explicit boundary: a new block begins
                 if (ev.source !== undefined)
                     assistantSource = ev.source;
@@ -222,6 +251,20 @@ export function projectMessages(events) {
                 pushText(); // an explicit boundary: the block closes
                 break;
             case "text_delta":
+                // 0.1.26: a text delta with BUFFERED RESULTS opens the NEXT
+                // turn's stream — the previous turn closes HERE: its
+                // assistant first (already closed at the stop, usually),
+                // then its buffered results in call order (the turn
+                // boundary; the API requires each tool_calls message to be
+                // followed by its tool messages — a real DeepSeek 400
+                // without the boundary). The guard keys on the RESULT
+                // buffer: a mid-message delta (the current turn's text, the
+                // multi-block assistant) has nothing buffered and must not
+                // flush — the empty flush would clear the source and split
+                // the message.
+                if (resultBuf.length > 0)
+                    flushAssistant();
+                flushResults();
                 text = (text ?? "") + ev.text;
                 break;
             case "tool_call_start":
@@ -231,7 +274,15 @@ export function projectMessages(events) {
             case "tool_call_input_delta":
                 break; // the parsed input arrives at tool_call_end
             case "tool_call_end":
+                // 0.1.26: a tool_call_end with BUFFERED RESULTS opens the
+                // NEXT turn's stream (the model called again) — the
+                // previous turn closes first; a same-turn call has nothing
+                // buffered.
+                if (resultBuf.length > 0)
+                    flushAssistant();
+                flushResults();
                 pushText();
+                callOrder.set(ev.callId, callOrderNext++);
                 blocks.push({
                     type: "tool_use",
                     callId: ev.callId,
@@ -240,7 +291,11 @@ export function projectMessages(events) {
                 });
                 break;
             case "tool_result": {
-                flushAssistant();
+                // 0.1.26: NO flushAssistant — the streaming execution lands
+                // results BETWEEN the turn's tool_call_ends; closing the
+                // assistant here splits the turn's tool_calls message (the
+                // API 400). The assistant stays open and closes at the turn
+                // boundary with ALL its tool_use blocks.
                 const message = {
                     role: "tool",
                     callId: ev.callId,
@@ -258,10 +313,14 @@ export function projectMessages(events) {
                 if ("seq" in ev && typeof ev.seq === "number") {
                     Object.defineProperty(message, "eventSeq", { value: ev.seq, enumerable: false, configurable: true });
                 }
-                out.push(message);
+                // 0.1.26: BUFFERED — the results flush in call order at the
+                // turn boundary (flushResults), not in completion order.
+                resultBuf.push({ callId: ev.callId, message });
                 break;
             }
             case "microcompacted": {
+                flushAssistant();
+                flushResults(); // the results must be in `out` before the replacement pass
                 flushAssistant();
                 // C 区: replace every eligible OLD tool result with the fixed
                 // placeholder. Eligibility: the result's own event seq <= the
@@ -283,6 +342,8 @@ export function projectMessages(events) {
                 break;
             }
             case "compacted": {
+                flushAssistant();
+                flushResults(); // the results must be in `out` before the replacement pass
                 flushAssistant();
                 // Apply the EXACT persisted replacements — never re-run the
                 // compaction algorithm (a future version could differ). 五:
@@ -310,8 +371,12 @@ export function projectMessages(events) {
             case "thinking":
                 // 自举 P1: accumulate the turn's reasoning — the flush (an
                 // empty one at the turn's start) keeps the pending text, and
-                // the assistant message that follows carries it.
-                flushAssistant();
+                // the assistant message that follows carries it. 0.1.26: the
+                // assistant flush is guarded on the buffered results (a
+                // mid-turn reasoning must not split the current message).
+                if (resultBuf.length > 0)
+                    flushAssistant();
+                flushResults();
                 pendingReasoning = (pendingReasoning ?? "") + ev.text;
                 break;
             case "summarized":
@@ -320,9 +385,23 @@ export function projectMessages(events) {
                 // covered range's position.
                 break;
             case "usage":
+                // 0.1.26: NO flush — the non-rendered events interleave with
+                // the streaming execution (a tool's started/receipt, an
+                // ask's request land BETWEEN the turn's tool_call_ends).
+                // Flushing here SPLIT the turn's assistant message — the
+                // API requires each tool_calls message to be followed by
+                // ITS tool messages, and a second assistant message (with
+                // the later calls) between the first's calls and results
+                // is a real 400. The assistant closes at the stop and the
+                // turn boundaries.
+                break;
             case "stop":
+                // The turn boundary: the assistant closes at the provider's
+                // stop; the results are buffered and flush at the next
+                // turn's first event.
+                flushAssistant();
+                break;
             case "terminal":
-            case "microcompacted":
             case "tool_execution_started":
             case "tool_execution_succeeded":
             case "tool_execution_failed":
@@ -331,11 +410,14 @@ export function projectMessages(events) {
             case "permission_decided":
             case "permission_expired":
             case "uncertain_pending":
-                flushAssistant();
+                break;
+            case "microcompacted":
+                // handled above (the replacement pass) — no open message.
                 break;
         }
     }
     flushAssistant();
+    flushResults();
     return out;
 }
 /**

package/dist/protocol/extension.d.ts

@@ -67,6 +67,12 @@ export interface KisoExtension {
     readonly systemPrompt?: {
         readonly append: string;
     };
+    /**
+     * 0.1.26 (MCP 懒连接): an optional LIVE flag — the CLI's banner renders
+     * "name (connecting…)" while it is true. Soft surface: absent = no
+     * marker (the default).
+     */
+    readonly connecting?: boolean;
     /**
      * 发现#8 (P1): the extension's shutdown action — the closing of external
      * resources it holds (child processes, connections). The LOADER is

package/dist/tools/registry.d.ts

@@ -11,12 +11,24 @@
  * registry whose tool table PHYSICALLY lacks the tools it must not see. The
  * model cannot call a tool that is not in its registry — no prompt can
  * achieve that guarantee.
+ *
+ * 0.1.26 (MCP 懒连接): `registerLive()` adds a LIVE tool source — a
+ * function returning the extension's current tools array. The array grows
+ * when the extension's background connections settle (the MCP bridge
+ * registers its servers' tools post-connect); the registry consults the
+ * live sources on every lookup. The registered map wins a name collision
+ * (the agent's built-ins are authoritative); the collision check that
+ * would otherwise fire at registration time cannot run against a live,
+ * still-growing source.
  */
 import type { ToolSpec } from "../protocol/messages.js";
 import type { Tool } from "./tool.js";
 export declare class ToolRegistry {
     #private;
     register(tool: Tool<any>): void;
+    /** 0.1.26: a live tool source — consulted on every lookup, never
+     *  snapshotted. The source returns the CURRENT array (it may grow). */
+    registerLive(source: () => readonly Tool[]): void;
     get(name: string): Tool<any> | undefined;
     list(): readonly Tool[];
     has(name: string): boolean;

package/dist/tools/registry.js

@@ -11,30 +11,55 @@
  * registry whose tool table PHYSICALLY lacks the tools it must not see. The
  * model cannot call a tool that is not in its registry — no prompt can
  * achieve that guarantee.
+ *
+ * 0.1.26 (MCP 懒连接): `registerLive()` adds a LIVE tool source — a
+ * function returning the extension's current tools array. The array grows
+ * when the extension's background connections settle (the MCP bridge
+ * registers its servers' tools post-connect); the registry consults the
+ * live sources on every lookup. The registered map wins a name collision
+ * (the agent's built-ins are authoritative); the collision check that
+ * would otherwise fire at registration time cannot run against a live,
+ * still-growing source.
  */
 export class ToolRegistry {
     #tools = new Map();
+    #live = [];
     register(tool) {
         if (this.#tools.has(tool.name)) {
             throw new Error(`Tool already registered: ${tool.name}`);
         }
         this.#tools.set(tool.name, tool);
     }
+    /** 0.1.26: a live tool source — consulted on every lookup, never
+     *  snapshotted. The source returns the CURRENT array (it may grow). */
+    registerLive(source) {
+        this.#live.push(source);
+    }
     get(name) {
-        return this.#tools.get(name);
+        const t = this.#tools.get(name);
+        if (t !== undefined)
+            return t;
+        for (const src of this.#live) {
+            const found = src().find((x) => x.name === name);
+            if (found !== undefined)
+                return found;
+        }
+        return undefined;
     }
     list() {
-        return [...this.#tools.values()];
+        return [...this.#tools.values(), ...this.#live.flatMap((src) => src())];
     }
     has(name) {
-        return this.#tools.has(name);
+        if (this.#tools.has(name))
+            return true;
+        return this.#live.some((src) => src().some((x) => x.name === name));
     }
     /** A registry restricted to the named tools. Unknown names are dropped
      *  loudly (the kernel never silently shrinks a tool set). */
     subset(names) {
         const out = new ToolRegistry();
         for (const name of names) {
-            const tool = this.#tools.get(name);
+            const tool = this.get(name);
             if (tool === undefined) {
                 throw new Error(`subset(): unknown tool '${name}'`);
             }
@@ -44,7 +69,7 @@ export class ToolRegistry {
     }
     /** The minimal projection an adapter may see (never the handlers). */
     toSpecs() {
-        return [...this.#tools.values()].map((t) => ({
+        return this.list().map((t) => ({
             name: t.name,
             description: t.description,
             inputSchema: t.parameters,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincemakes/kiso-core",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "description": "kiso(\u57fa\u790e) core \u2014 protocol, event log, loop, hooks, modes, permissions, compaction, delivery truth. The 2,000-line kernel at the bottom of the kiso framework.",
   "type": "module",
   "license": "MIT",
@@ -33,7 +33,7 @@
     "openai"
   ],
   "devDependencies": {
-    "@vincemakes/kiso-evals": "0.1.24",
+    "@vincemakes/kiso-evals": "0.1.26",
     "@types/node": "^26.1.2",
     "typescript": "^5.7.2",
     "vitest": "^3.0.0"