@vincemakes/kiso-core 0.1.31 → 0.1.33

package/dist/kernel/loop.d.ts

@@ -34,7 +34,7 @@
  */
 import { type Adapter, type AbortSignalLike } from "../protocol/adapter.js";
 import type { Event, StructuredError } from "../protocol/events.js";
-import type { ApprovalPolicy } from "../protocol/extension.js";
+import type { ApprovalChain } from "../protocol/extension.js";
 import { EventLog } from "./event-log.js";
 import type { EventInput } from "./event-log.js";
 import type { AssistantBlock, AssistantMessage, Message, ToolResultMessage } from "../protocol/messages.js";
@@ -109,18 +109,17 @@ export interface LoopConfig {
     /** round 4 (adversarial): the uncertainty twin of `approvalVerdict`. */
     readonly uncertaintyVerdict?: (executionId: string) => "rerun" | "abandoned" | undefined;
     /**
-     * E1: extension approval policies, tagged by their owning extension —
-     * decided BEFORE the human flow. Any deny wins (the FIRST denial's
-     * reason); else any ask falls into the existing flow; all allow
-     * auto-approves. A policy that throws counts as ask. Allow/deny are
-     * recorded durably with decidedBy = the extension's name, never pausing
-     * for a human; a durable decision already recorded (resume) takes
-     * effect and the chain never re-runs.
+     * E1: the COMPOSED approval chain — the runtime composes the
+     * extensions' policies (deny > allow > ask, the R3 ruling) into ONE
+     * decide; the kernel's gate calls it BEFORE the human flow. Allow/deny
+     * are recorded durably with decidedBy = the deciding extension, never
+     * pausing for a human; an ask falls into the human flow (its speaker
+     * names the first non-abstain — the panel's why-asked line). A
+     * throwing chain counts as ask. Absent, no chain runs. A durable
+     * decision already recorded (resume) takes effect and the chain never
+     * re-runs.
      */
-    readonly approvalPolicies?: readonly {
-        readonly extension: string;
-        readonly policy: ApprovalPolicy;
-    }[];
+    readonly approvalPolicy?: ApprovalChain;
     /** P3: the session's id — carried to tools via ToolContext.sessionId. */
     readonly sessionId?: string;
 }

package/dist/kernel/loop.js

@@ -225,7 +225,7 @@ export async function* loop(config) {
             try {
                 await acquireWindow();
                 decideChain = decideChain.then(async () => {
-                    const v = await decideCall(call, registry, hooks, { signal: signal ?? NEVER_ABORT, ...(config.sessionId !== undefined ? { sessionId: config.sessionId } : {}) }, log, config.resolveApproval, config.approvalVerdict, signal, config.approvalPolicies, nextDecisionId, pushExec);
+                    const v = await decideCall(call, registry, hooks, { signal: signal ?? NEVER_ABORT, ...(config.sessionId !== undefined ? { sessionId: config.sessionId } : {}) }, log, config.resolveApproval, config.approvalVerdict, signal, config.approvalPolicy, nextDecisionId, pushExec);
                     if (v.action === "ask") {
                         askGate = new Promise((res) => {
                             askRelease = res;
@@ -247,7 +247,7 @@ export async function* loop(config) {
                     // ordering: the successors then proceed with their own
                     // verdicts).
                     const decision = await Promise.race([
-                        humanPause(call, verdict.decisionId, hooks, log, config.resolveApproval, config.approvalVerdict, signal, pushExec),
+                        humanPause(call, verdict.decisionId, hooks, log, config.resolveApproval, config.approvalVerdict, signal, pushExec, verdict.speaker),
                         violatedP,
                     ]);
                     askRelease?.();
@@ -604,7 +604,7 @@ function resultEvent(call, result, executionId) {
  * caller runs it (conservative ordering: the calls after an ask wait for
  * its resolution).
  */
-async function decideCall(call, registry, hooks, ctx, log, resolveApproval, resolveApprovalVerdict, signal, approvalPolicies, nextDecisionId, push) {
+async function decideCall(call, registry, hooks, ctx, log, resolveApproval, resolveApprovalVerdict, signal, approvalPolicy, nextDecisionId, push) {
     const payload = {
         callId: call.callId,
         name: call.name,
@@ -632,59 +632,30 @@ async function decideCall(call, registry, hooks, ctx, log, resolveApproval, reso
     // all. Checked again here, after any permission path.
     if (signal?.aborted)
         throw ABORTED;
-    // ── E1: the extension policy chain, decided BEFORE the human flow ─────
+    // ── E1: the composed approval chain, decided BEFORE the human flow ────
     // A durable POLICY decision for THIS call takes effect on resume — the
     // chain never re-runs when its verdict is already in the log (isomorphic
     // alreadyReplaced: the persisted fact speaks for the call). The match is
     // the same logical call: same callId, decidedBy set (a policy verdict,
     // never a human's), and input identical to the original tool_call_end —
     // a re-issued call with different arguments is a NEW call and re-decided.
-    // Composition: deny > ask > allow — any deny wins (the FIRST denial's
-    // reason), else any ask falls into the existing human flow below, and
-    // only an ALL-allow chain auto-approves: recorded durably with decidedBy
-    // = the extension's name, never a human-visible pause. A policy that
-    // throws counts as ask.
+    // The chain itself is COMPOSED by the runtime (composeApprovalChain —
+    // the R3 ruling: deny > allow > ask, any deny wins, a LATER allow beats
+    // an EARLIER ask, an all-abstain asks per ADR-0042); the kernel consumes
+    // its verdict. A throwing chain counts as ask. Allow/deny are recorded
+    // durably with decidedBy = the deciding extension, never pausing for a
+    // human.
     const originalCall = [...log.all].reverse().find((e) => e.type === "tool_call_end" && e.callId === call.callId);
     const durable = originalCall !== undefined && JSON.stringify(originalCall.input) === JSON.stringify(call.input)
         ? log.all.find((e) => e.type === "permission_decided" && e.decidedBy !== undefined && e.callId === call.callId)
         : undefined;
     let chainVerdict;
-    let deniedReason;
-    let deniedBy;
-    let firstSpeaker; // the first non-abstain verdict's extension
-    let anySpoke = false;
-    if (durable === undefined && approvalPolicies !== undefined && approvalPolicies.length > 0) {
-        for (const { extension, policy } of approvalPolicies) {
-            let v;
-            try {
-                v = await raceAbort(Promise.resolve(policy.decide(payload, ctx)), signal);
-            }
-            catch {
-                v = { action: "ask" }; // a throwing policy counts as ask — it speaks, never silently
-            }
-            if (v.action === "abstain")
-                continue; // no opinion — not a verdict
-            anySpoke = true;
-            firstSpeaker ??= extension;
-            if (v.action === "deny") {
-                deniedBy ??= extension;
-                deniedReason ??= v.reason; // the FIRST denial's reason
-            }
-            else if (v.action === "ask") {
-                chainVerdict = { action: "ask" };
-            }
-        }
-        if (deniedBy !== undefined) {
-            chainVerdict = { action: "deny", reason: deniedReason ?? "denied" };
-        }
-        else if (chainVerdict === undefined && anySpoke) {
-            chainVerdict = { action: "allow" }; // every speaker allows
+    if (durable === undefined && approvalPolicy !== undefined) {
+        try {
+            chainVerdict = await raceAbort(Promise.resolve(approvalPolicy.decide(payload, ctx)), signal);
         }
-        else if (chainVerdict === undefined) {
-            // an all-abstain (ADR-0042): NO policy speaks — the call falls to
-            // the ask flow below, never to a silent auto-approve. The human
-            // decides; absent a channel, humanPause's honest denial.
-            chainVerdict = { action: "ask" };
+        catch {
+            chainVerdict = { action: "ask" }; // a throwing chain counts as ask — it speaks, never silently
         }
         if (chainVerdict.action !== "ask") {
             // allow/deny are PERSISTED FACTS (decidedBy = a SPEAKING
@@ -695,13 +666,15 @@ async function decideCall(call, registry, hooks, ctx, log, resolveApproval, reso
                 decisionId: nextDecisionId(),
                 callId: call.callId,
                 decision: chainVerdict.action === "allow" ? "approved" : "denied",
-                ...(chainVerdict.action === "deny" ? { reason: chainVerdict.reason } : {}),
-                decidedBy: deniedBy ?? firstSpeaker,
+                ...(chainVerdict.action === "deny" && chainVerdict.reason !== undefined
+                    ? { reason: chainVerdict.reason }
+                    : {}),
+                decidedBy: chainVerdict.decidedBy,
             });
         }
     }
     if (chainVerdict?.action === "deny") {
-        return { action: "deny", result: resultEvent(call, denialResult(chainVerdict.reason)) };
+        return { action: "deny", result: resultEvent(call, denialResult(chainVerdict.reason ?? "denied")) };
     }
     if (durable !== undefined && durable.decision === "denied") {
         return { action: "deny", result: resultEvent(call, denialResult(durable.reason ?? "denied")) };
@@ -716,7 +689,13 @@ async function decideCall(call, registry, hooks, ctx, log, resolveApproval, reso
         if (resolveApproval === undefined) {
             return { action: "deny", result: resultEvent(call, denialResult("a policy asked for a human decision, but no approval flow is configured")) };
         }
-        return { action: "ask", decisionId: nextDecisionId() };
+        // W21: the speaker rides the ask verdict — the panel's why-asked
+        // line names the extension that asked (the composed chain's first
+        // non-abstain; exactOptionalPropertyTypes: omitted, never
+        // `undefined`).
+        return chainVerdict.speaker === undefined
+            ? { action: "ask", decisionId: nextDecisionId() }
+            : { action: "ask", decisionId: nextDecisionId(), speaker: chainVerdict.speaker };
     }
     // Permission negotiation — defer is a REAL pause (Phase D). C group: the
     // hook itself is cancelable (a slow policy query must not outlive an
@@ -746,7 +725,7 @@ async function decideCall(call, registry, hooks, ctx, log, resolveApproval, reso
  * verdict given in the same instant is still recorded exactly once) —
  * then persist the decision. Returns "approved" | "denied".
  */
-async function humanPause(call, decisionId, hooks, log, resolveApproval, resolveApprovalVerdict, signal, push) {
+async function humanPause(call, decisionId, hooks, log, resolveApproval, resolveApprovalVerdict, signal, push, speaker) {
     const pendingDecision = resolveApproval !== undefined
         ? resolveApproval(decisionId)
         : Promise.resolve({ action: "deny", reason: "no approval channel configured" });
@@ -756,6 +735,9 @@ async function humanPause(call, decisionId, hooks, log, resolveApproval, resolve
         callId: call.callId,
         name: call.name,
         input: call.input ?? {},
+        // W21: the ask verdict's speaker — the panel's why-asked line (a
+        // static-hook ask has none).
+        ...(speaker !== undefined ? { speaker } : {}),
     });
     if (hooks.onPause)
         await hooks.onPause("awaiting approval", {}).catch(() => { });

package/dist/kernel/project.js

@@ -85,6 +85,7 @@ export function projectMessages(events) {
             assistantSource = undefined;
             return;
         }
+        const callIds = blocks.filter((b) => b.type === "tool_use").map((b) => b.callId);
         const reasoning = pendingReasoning;
         pendingReasoning = null;
         out.push({
@@ -95,6 +96,15 @@ export function projectMessages(events) {
         });
         blocks = [];
         assistantSource = undefined;
+        // P1: the closed assistant's calls whose results are NOT already
+        // buffered are pending — their results land later (post-stop late
+        // results, the straddle's shape). The mid-execution inputs hold
+        // until those results flush.
+        // the guard keeps a still-pending pair holding when a call-less
+        // assistant closes mid-hold (the empty set would release the input)
+        const buffered = new Set(resultBuf.map((r) => r.callId));
+        if (callIds.length > 0)
+            pendingCalls = new Set(callIds.filter((c) => !buffered.has(c)));
     };
     // C group/round 6: vetoed/rewritten user inputs. Collect the replacement map
     // first — the FINAL replacement for each input wins (later replacements
@@ -150,15 +160,32 @@ export function projectMessages(events) {
     let resultBuf = [];
     const callOrder = new Map();
     let callOrderNext = 0;
-    const flushResults = () => {
-        if (resultBuf.length === 0)
-            return;
-        resultBuf.sort((a, b) => (callOrder.get(a.callId) ?? 0) - (callOrder.get(b.callId) ?? 0));
-        for (const r of resultBuf)
-            out.push(r.message);
-        resultBuf = [];
-        callOrder.clear();
-        callOrderNext = 0;
+    // P1 (0.1.42): the mid-execution input deferral. A user input arriving
+    // while the last closed assistant's tool_calls are UNANSWERED (the
+    // result lands later in the log — the boundary straddle's durable
+    // shape) must never separate the call from its result: the request
+    // [assistant, user, tool] is a real provider 400. Such inputs are
+    // HELD and released right after the results flush — the mid-execution
+    // input takes effect when the turn's execution completes.
+    let pendingCalls = new Set();
+    let heldUsers = [];
+    const flushResults = (force = false) => {
+        if (resultBuf.length > 0) {
+            resultBuf.sort((a, b) => (callOrder.get(a.callId) ?? 0) - (callOrder.get(b.callId) ?? 0));
+            for (const r of resultBuf)
+                out.push(r.message);
+            resultBuf = [];
+            callOrder.clear();
+            callOrderNext = 0;
+        }
+        // The held inputs release ONLY when the pair resolved (or the
+        // projection ends — force): a still-pending pair must keep holding,
+        // or the next user_input's leading flush would dump the inputs
+        // between the call and its late result (the 400 again).
+        if (force || pendingCalls.size === 0) {
+            out.push(...heldUsers);
+            heldUsers = [];
+        }
     };
     let explicitAssistant = false;
     for (const ev of events) {
@@ -186,30 +213,41 @@ export function projectMessages(events) {
             case "user_input": {
                 // 0.1.26: the previous turn closes here — the assistant
                 // first, then its results in call order (the turn boundary).
-                flushAssistant();
-                flushResults();
                 // round 6: the final replacement renders HERE, at the input's own
                 // position — the original is skipped, the replacement event
                 // itself produces nothing (a later replacement for the same
-                // input never becomes a second message).
+                // input never becomes a second message); a null content is a
+                // true veto (nothing renders at that position).
+                flushAssistant();
+                flushResults();
+                let content = ev.content;
+                let source = ev.source;
+                let veto = false;
                 if ("seq" in ev && typeof ev.seq === "number" && replaced.has(ev.seq)) {
                     const replacement = replaced.get(ev.seq);
-                    flushAssistant();
-                    if (replacement.content !== null) {
-                        out.push({
-                            role: "user",
-                            content: replacement.content,
-                            ...(replacement.source !== undefined ? { source: replacement.source } : {}),
-                        });
+                    if (replacement.content === null) {
+                        veto = true;
+                    }
+                    else {
+                        content = replacement.content;
+                        source = replacement.source ?? ev.source;
                     }
-                    break;
                 }
-                flushAssistant();
-                out.push({
+                if (veto)
+                    break;
+                const message = {
                     role: "user",
-                    content: ev.content,
-                    ...(ev.source !== undefined ? { source: ev.source } : {}),
-                });
+                    content,
+                    ...(source !== undefined ? { source } : {}),
+                };
+                // P1: the mid-execution deferral — an input arriving while
+                // the turn's calls are unanswered is HELD and released right
+                // after the results flush (the pairing invariant: the
+                // results must follow their calls before any user message).
+                if (pendingCalls.size > 0)
+                    heldUsers.push(message);
+                else
+                    out.push(message);
                 break;
             }
             case "user_input_replaced":
@@ -253,18 +291,16 @@ export function projectMessages(events) {
             case "text_delta":
                 // 0.1.26: a text delta with BUFFERED RESULTS opens the NEXT
                 // turn's stream — the previous turn closes HERE: its
-                // assistant first (already closed at the stop, usually),
-                // then its buffered results in call order (the turn
-                // boundary; the API requires each tool_calls message to be
-                // followed by its tool messages — a real DeepSeek 400
-                // without the boundary). The guard keys on the RESULT
-                // buffer: a mid-message delta (the current turn's text, the
-                // multi-block assistant) has nothing buffered and must not
-                // flush — the empty flush would clear the source and split
-                // the message.
-                if (resultBuf.length > 0)
-                    flushAssistant();
-                flushResults();
+                // assistant (closed at the stop), then its buffered results
+                // in call order (the API requires each tool_calls message
+                // to be followed by its tool messages — a real 400 without
+                // the boundary). P1 (0.1.42): the flush keys on OPEN
+                // assistant content — an open block or text proves the
+                // model is still streaming THIS turn, and a same-turn
+                // buffered result must stay buffered (flushing it here
+                // split the turn's message — the fresh2 400).
+                if (blocks.length === 0 && text === null && resultBuf.length > 0)
+                    flushResults();
                 text = (text ?? "") + ev.text;
                 break;
             case "tool_call_start":
@@ -276,11 +312,14 @@ export function projectMessages(events) {
             case "tool_call_end":
                 // 0.1.26: a tool_call_end with BUFFERED RESULTS opens the
                 // NEXT turn's stream (the model called again) — the
-                // previous turn closes first; a same-turn call has nothing
-                // buffered.
-                if (resultBuf.length > 0)
-                    flushAssistant();
-                flushResults();
+                // previous turn's results close first; a same-turn call
+                // keeps the assistant open. P1 (0.1.42): open assistant
+                // content proves the same-turn call — the buffered results
+                // close at the stop, NEVER here (flushing a same-turn
+                // result at a later call_end split the turn's message —
+                // the fresh2 400).
+                if (blocks.length === 0 && text === null && resultBuf.length > 0)
+                    flushResults();
                 pushText();
                 callOrder.set(ev.callId, callOrderNext++);
                 blocks.push({
@@ -315,6 +354,9 @@ export function projectMessages(events) {
                 }
                 // 0.1.26: BUFFERED — the results flush in call order at the
                 // turn boundary (flushResults), not in completion order.
+                // P1: a pending call's result resolves the pair — the held
+                // mid-execution inputs release with the flush.
+                pendingCalls.delete(ev.callId);
                 resultBuf.push({ callId: ev.callId, message });
                 break;
             }
@@ -374,9 +416,11 @@ export function projectMessages(events) {
                 // the assistant message that follows carries it. 0.1.26: the
                 // assistant flush is guarded on the buffered results (a
                 // mid-turn reasoning must not split the current message).
-                if (resultBuf.length > 0)
-                    flushAssistant();
-                flushResults();
+                // P1 (0.1.42): the flush keys on OPEN assistant content —
+                // a mid-turn reasoning with a same-turn result buffered
+                // must NOT split the message (the fresh2 400 family).
+                if (blocks.length === 0 && text === null && resultBuf.length > 0)
+                    flushResults();
                 pendingReasoning = (pendingReasoning ?? "") + ev.text;
                 break;
             case "summarized":
@@ -397,9 +441,14 @@ export function projectMessages(events) {
                 break;
             case "stop":
                 // The turn boundary: the assistant closes at the provider's
-                // stop; the results are buffered and flush at the next
-                // turn's first event.
+                // stop — and the turn's BUFFERED results close WITH it (P1
+                // 0.1.42). Parallel execution lands same-turn results
+                // mid-stream; flushing them here — the true boundary —
+                // projects [assistant, results…] in reading order, and the
+                // stream-open guards below only ever flush a CLOSED turn's
+                // late (post-stop) results.
                 flushAssistant();
+                flushResults();
                 break;
             case "terminal":
             case "tool_execution_started":
@@ -417,7 +466,7 @@ export function projectMessages(events) {
         }
     }
     flushAssistant();
-    flushResults();
+    flushResults(true); // the log's end is the last resort: held inputs never drop
     return out;
 }
 /**

package/dist/protocol/events.d.ts

@@ -16,8 +16,8 @@
  * assigned by the kernel's EventLog at append time. Consumers (surfaces,
  * persistence, eval) sync by `seq`; a trajectory is the complete replay of
  * `seq` 0..N. Without `seq`, "what happened" can only be reconstructed by
- * array-shape heuristics — the exact failure Claude Code's transcript sync
- * lives in. See ADR-0002.
+ * array-shape heuristics — the exact failure the reference implementation's
+ * transcript sync lives in. See ADR-0002.
  *
  * This module is almost types-only: the only runtime value it emits is
  * `isKisoEvent`, the type guard the session store validates records with.
@@ -258,6 +258,9 @@ export interface PermissionRequested {
     readonly callId: string;
     readonly name: string;
     readonly input: Readonly<Record<string, unknown>>;
+    /** W21: the first non-abstain extension's name — the panel's why-asked
+     *  line. Absent on static-hook asks and old logs. */
+    readonly speaker?: string;
 }
 /** The durable answer to a PermissionRequested. */
 export interface PermissionDecided {
@@ -400,7 +403,7 @@ export interface StructuredError {
  *
  * Every consumer switches on `kind`; with `exactOptionalPropertyTypes` and
  * `strictNullChecks` on, a terminal that nobody handles is a compile error,
- * not a production mystery. CC's query() returns 11 different reasons that
+ * not a production mystery. The reference implementation's query() returns 11 different reasons that
  * every consumer discards — here the terminal is an event like any other,
  * so it cannot be lost. See ADR-0004.
  *

package/dist/protocol/events.js

@@ -16,8 +16,8 @@
  * assigned by the kernel's EventLog at append time. Consumers (surfaces,
  * persistence, eval) sync by `seq`; a trajectory is the complete replay of
  * `seq` 0..N. Without `seq`, "what happened" can only be reconstructed by
- * array-shape heuristics — the exact failure Claude Code's transcript sync
- * lives in. See ADR-0002.
+ * array-shape heuristics — the exact failure the reference implementation's
+ * transcript sync lives in. See ADR-0002.
  *
  * This module is almost types-only: the only runtime value it emits is
  * `isKisoEvent`, the type guard the session store validates records with.
@@ -205,7 +205,8 @@ const EVENT_VALIDATORS = {
     permission_requested: (v) => typeof v.decisionId === "string" &&
         typeof v.callId === "string" &&
         typeof v.name === "string" &&
-        isPlainObject(v.input),
+        isPlainObject(v.input) &&
+        (v.speaker === undefined || typeof v.speaker === "string"),
     permission_decided: (v) => typeof v.decisionId === "string" &&
         (v.decision === "approved" || v.decision === "denied") &&
         (v.callId === undefined || typeof v.callId === "string") &&

package/dist/protocol/extension.d.ts

@@ -38,6 +38,29 @@ export type PolicyVerdict = {
 export interface ApprovalPolicy {
     readonly decide: (call: PolicyCall, ctx: ToolContext) => PolicyVerdict | Promise<PolicyVerdict>;
 }
+/**
+ * The COMPOSED chain's verdict — what the kernel's gate consumes. The
+ * runtime composes the extensions' policies (deny > allow > ask, the R3
+ * ruling); allow/deny always carry decidedBy — the deciding extension —
+ * and an ask may carry the speaker (the first non-abstain — the panel's
+ * why-asked line). The attribution is durable audit (rides
+ * permission_decided, never a human pause).
+ */
+export type ChainVerdict = {
+    readonly action: "deny";
+    readonly reason?: string;
+    readonly decidedBy: string;
+} | {
+    readonly action: "ask";
+    readonly speaker?: string;
+} | {
+    readonly action: "allow";
+    readonly decidedBy: string;
+};
+/** The approval chain as the kernel sees it — ONE composed policy. */
+export interface ApprovalChain {
+    readonly decide: (call: PolicyCall, ctx: ToolContext) => ChainVerdict | Promise<ChainVerdict>;
+}
 /**
  * A loaded extension. `name` is unique per installation (the loader rejects
  * duplicates loudly); hooks/tools/approvals are all optional.

package/dist/protocol/messages.d.ts

@@ -45,8 +45,8 @@ export type ContentBlock = TextContentBlock | ImageContentBlock;
  *
  * The model treats this as evidence about intent; a "user" line that the UI
  * recycled from a suggestion chip is NOT user intent, and a model that cannot
- * tell the difference drifts on its own recycled wording (Claude Code
- * #60087). The kernel preserves the label; product code decides how to render
+ * tell the difference drifts on its own recycled wording (the reference
+ * implementation's #60087). The kernel preserves the label; product code decides how to render
  * it. Defaults (when absent): role `user` → "user", role `assistant` →
  * "model", role `tool` → "tool_result".
  */

package/dist/tools/registry.d.ts

@@ -3,9 +3,9 @@
  *
  * One registry per agent. It is the ONLY place the kernel learns which tools
  * exist: nothing is assembled from a list maintained elsewhere, because a
- * second list is a second truth (the failure class behind Claude Code's five
- * hand-maintained agent-tool sets and pi's six copies of the default tool
- * list — see ADR-0001).
+ * second list is a second truth (the failure class behind the reference
+ * implementation's hand-maintained agent-tool sets and its six copies of the
+ * default tool list — see ADR-0001).
  *
  * `subset()` is the structural tool filter: a mode or a subagent gets a
  * registry whose tool table PHYSICALLY lacks the tools it must not see. The

package/dist/tools/registry.js

@@ -3,9 +3,9 @@
  *
  * One registry per agent. It is the ONLY place the kernel learns which tools
  * exist: nothing is assembled from a list maintained elsewhere, because a
- * second list is a second truth (the failure class behind Claude Code's five
- * hand-maintained agent-tool sets and pi's six copies of the default tool
- * list — see ADR-0001).
+ * second list is a second truth (the failure class behind the reference
+ * implementation's hand-maintained agent-tool sets and its six copies of the
+ * default tool list — see ADR-0001).
  *
  * `subset()` is the structural tool filter: a mode or a subagent gets a
  * registry whose tool table PHYSICALLY lacks the tools it must not see. The

package/dist/tools/tool.d.ts

@@ -49,8 +49,8 @@ export interface Tool<I = unknown> {
     /** JSON Schema (draft-07 subset). Validated before execute. */
     readonly parameters: Readonly<Record<string, unknown>>;
     /**
-     * Per-call concurrency predicate — the CC-invented shape that pi's static
-     * executionMode cannot express: the same tool may be parallel-safe for one
+     * Per-call concurrency predicate — a shape the reference implementation's
+     * static executionMode cannot express: the same tool may be parallel-safe for one
      * input and must be serial for another (generate_image with
      * `chain_to_previous`). Absent = safe when true-ish; see ADR-0015.
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincemakes/kiso-core",
-  "version": "0.1.31",
+  "version": "0.1.33",
   "description": "kiso (foundation) core — protocol, event log, loop, hooks, modes, permissions, compaction, delivery truth. The 2,000-line kernel at the bottom of the kiso framework.",
   "type": "module",
   "license": "MIT",
@@ -33,7 +33,7 @@
     "openai"
   ],
   "devDependencies": {
-    "@vincemakes/kiso-evals": "0.1.32",
+    "@vincemakes/kiso-evals": "0.1.33",
     "@types/node": "^26.1.2",
     "typescript": "^5.7.2",
     "vitest": "^3.0.0"