@vincemakes/kiso-core 0.10.0 → 0.12.0

package/dist/governance/delivery.d.ts

@@ -8,10 +8,21 @@
  * the same events the loop yielded, so the verdict is replayable and the
  * model's narration never participates in its own grading.
  *
- * Producers are declared on tools (`delivers`, tools/tool.ts); the verdict
- * counts producer calls that completed (non-error results), against a
- * delivery claim in the text. The canonical lie — "generated-document" with zero
- * producer calls and a clean completed terminal — fails here.
+ * Producers are named by the CALLER, in `DeliveryConfig.producers` — the
+ * hand-maintained set is the ONLY source of delivery truth. SC-1b removed
+ * `Tool.delivers`, the flag this note used to describe as the eventual
+ * replacement: it was declared on the contract and read by nothing, here
+ * or anywhere. Should a tool's own declaration ever supersede the caller's
+ * set, it enters as a new field with a wiring and a gate, never as a
+ * standing promise the code has not kept.
+ *
+ * The verdict counts producer calls that COMPLETED (non-error results).
+ * `claimedInText` is computed and REPORTED but does not enter `passed` —
+ * a caller that wants "claimed but not delivered" to fail combines the two
+ * itself (the evals fixture does). With `required: false`, text claiming
+ * delivery over zero producer calls passes here. The canonical lie —
+ * "generated-document" with zero producer calls and a clean completed
+ * terminal — is caught by that combination.
  *
  * In M3.5 the emission side (artifact URLs extracted from results) joins;
  * today a completed producer IS the emission.

package/dist/governance/delivery.js

@@ -8,10 +8,21 @@
  * the same events the loop yielded, so the verdict is replayable and the
  * model's narration never participates in its own grading.
  *
- * Producers are declared on tools (`delivers`, tools/tool.ts); the verdict
- * counts producer calls that completed (non-error results), against a
- * delivery claim in the text. The canonical lie — "generated-document" with zero
- * producer calls and a clean completed terminal — fails here.
+ * Producers are named by the CALLER, in `DeliveryConfig.producers` — the
+ * hand-maintained set is the ONLY source of delivery truth. SC-1b removed
+ * `Tool.delivers`, the flag this note used to describe as the eventual
+ * replacement: it was declared on the contract and read by nothing, here
+ * or anywhere. Should a tool's own declaration ever supersede the caller's
+ * set, it enters as a new field with a wiring and a gate, never as a
+ * standing promise the code has not kept.
+ *
+ * The verdict counts producer calls that COMPLETED (non-error results).
+ * `claimedInText` is computed and REPORTED but does not enter `passed` —
+ * a caller that wants "claimed but not delivered" to fail combines the two
+ * itself (the evals fixture does). With `required: false`, text claiming
+ * delivery over zero producer calls passes here. The canonical lie —
+ * "generated-document" with zero producer calls and a clean completed
+ * terminal — is caught by that combination.
  *
  * In M3.5 the emission side (artifact URLs extracted from results) joins;
  * today a completed producer IS the emission.

package/dist/kernel/compaction.d.ts

@@ -21,6 +21,8 @@ import type { Message } from "../protocol/messages.js";
 /**
  * Rough token estimate (chars/4 + structural overhead). Calibration-free on
  * purpose: context economy only needs a stable MONOTONE proxy, not an exact
- * count — the threshold absorbs the error (mauri ADR-0007).
+ * count — the threshold absorbs the error (mauri ADR-0007). The proxy's
+ * three-word contract, and the pins that hold it, are
+ * packages/core/tests/sc1b-estimator.test.ts.
  */
 export declare function estimateTokens(messages: readonly Message[]): number;

package/dist/kernel/compaction.js

@@ -17,16 +17,43 @@
  * The model-generated half of context economy (the /compact summary layer)
  * lives in kernel/summarize.ts.
  */
+/**
+ * What a non-text block (an image) contributes. There is no character count
+ * to proxy, and this module refuses to guess a provider's image
+ * tokenization; the figure exists so a block is never worth ZERO, which is
+ * what MONOTONE requires. Deliberately small: under-stating an image is a
+ * threshold that fires slightly late, over-stating it is one that fires on
+ * a conversation that was never large.
+ */
+const NON_TEXT_BLOCK_TOKENS = 8;
+/**
+ * chars/4 over a `string | ContentBlock[]` content field.
+ *
+ * SC-1b ①: the array arm must be summed BLOCK BY BLOCK. Reading `.length`
+ * off it yields the block COUNT — a five-block 50 KB message scored ~2
+ * tokens, and the live microcompact threshold believed it.
+ */
+function contentTokens(content) {
+    if (typeof content === "string")
+        return Math.ceil(content.length / 4);
+    let tokens = 0;
+    for (const block of content) {
+        tokens += block.type === "text" ? Math.ceil(block.text.length / 4) : NON_TEXT_BLOCK_TOKENS;
+    }
+    return tokens;
+}
 /**
  * Rough token estimate (chars/4 + structural overhead). Calibration-free on
  * purpose: context economy only needs a stable MONOTONE proxy, not an exact
- * count — the threshold absorbs the error (mauri ADR-0007).
+ * count — the threshold absorbs the error (mauri ADR-0007). The proxy's
+ * three-word contract, and the pins that hold it, are
+ * packages/core/tests/sc1b-estimator.test.ts.
  */
 export function estimateTokens(messages) {
     let total = 0;
     for (const msg of messages) {
         if (msg.role === "user") {
-            total += Math.ceil(msg.content.length / 4);
+            total += contentTokens(msg.content);
         }
         else if (msg.role === "assistant") {
             for (const block of msg.blocks) {
@@ -37,7 +64,7 @@ export function estimateTokens(messages) {
             }
         }
         else {
-            total += Math.ceil(msg.content.length / 4) + 10;
+            total += contentTokens(msg.content) + 10;
         }
     }
     return total;

package/dist/kernel/event-log.d.ts

@@ -37,7 +37,12 @@ export declare class EventLog {
      */
     append(ev: EventInput): Event;
     get all(): readonly Event[];
-    /** Incremental view for consumers that already saw `seq` and before. */
+    /**
+     * Incremental view for consumers that already saw `seq` and before —
+     * STRICTLY after, so a poll loop delivers each event exactly once. A
+     * consumer that has seen nothing passes -1. (SC-1b ④: this filtered
+     * `>= seq` and re-served the seam event on every poll.)
+     */
     since(seq: number): readonly Event[];
     get lastSeq(): number;
 }

package/dist/kernel/event-log.js

@@ -41,9 +41,14 @@ export class EventLog {
     get all() {
         return this.#events;
     }
-    /** Incremental view for consumers that already saw `seq` and before. */
+    /**
+     * Incremental view for consumers that already saw `seq` and before —
+     * STRICTLY after, so a poll loop delivers each event exactly once. A
+     * consumer that has seen nothing passes -1. (SC-1b ④: this filtered
+     * `>= seq` and re-served the seam event on every poll.)
+     */
     since(seq) {
-        return this.#events.filter((e) => e.seq >= seq);
+        return this.#events.filter((e) => e.seq > seq);
     }
     get lastSeq() {
         return this.#next - 1;

package/dist/kernel/loop.d.ts

@@ -2,8 +2,8 @@
  * L2 — the ReAct loop. The kernel's only loop; everything else is harness.
  *
  * An async generator that yields every event as it happens (never buffers a
- * turn into a list — the agno failure), and converges on exactly one
- * `terminal` event per run (ADR-0004).
+ * turn into a list — the reference implementation's failure), and converges
+ * on exactly one `terminal` event per run (ADR-0004).
  *
  * SINGLE TRUTH (Phase B): the loop holds ONE EventLog. Messages are never
  * stored alongside it — every adapter call derives them via
@@ -100,13 +100,23 @@ export interface LoopConfig {
      */
     readonly approvalVerdict?: (decisionId: string) => boolean | undefined;
     /**
-     * C group: the channel that resolves a failed NON-idempotent execution.
-     * The loop persists `uncertain_pending`, yields it, and AWAITS the
-     * human verdict — no next model turn, no sibling tool, no auto-retry.
-     * Absent, the failure is recorded `abandoned` (never retried).
+     * DEAD — accepted by the type, never read by this loop.
+     *
+     * It was the C group channel for the failed-receipt pause: the loop
+     * persisted `uncertain_pending` and awaited a human verdict. ADR-0038
+     * removed that pause (a complete receipt IS the outcome), and with it
+     * every read of this field — a failure is now simply recorded failed and
+     * the siblings run on. The runtime still passes both callbacks
+     * (runtime/run.ts), so supplying them is harmless and changes nothing.
+     *
+     * The crash window — started, no receipt — is the ONLY uncertainty left,
+     * and the runtime's recovery driver owns it (RESOLVE_UNCERTAIN in
+     * runtime/recovery-plan.ts), not the loop. Both fields are kept because
+     * the surface is frozen (ADR-0051); do not read them as live wiring.
      */
     readonly resolveUncertainty?: (executionId: string) => Promise<"rerun" | "abandoned">;
-    /** round 4 (adversarial): the uncertainty twin of `approvalVerdict`. */
+    /** DEAD, as above — the uncertainty twin of `approvalVerdict`
+     *  (round 4, adversarial). Never read by the loop since ADR-0038. */
     readonly uncertaintyVerdict?: (executionId: string) => "rerun" | "abandoned" | undefined;
     /**
      * E1: the COMPOSED approval chain — the runtime composes the

package/dist/kernel/loop.js

@@ -2,8 +2,8 @@
  * L2 — the ReAct loop. The kernel's only loop; everything else is harness.
  *
  * An async generator that yields every event as it happens (never buffers a
- * turn into a list — the agno failure), and converges on exactly one
- * `terminal` event per run (ADR-0004).
+ * turn into a list — the reference implementation's failure), and converges
+ * on exactly one `terminal` event per run (ADR-0004).
  *
  * SINGLE TRUTH (Phase B): the loop holds ONE EventLog. Messages are never
  * stored alongside it — every adapter call derives them via

package/dist/kernel/mode.d.ts

@@ -6,21 +6,19 @@
  * - `visibleToolNames` — physical removal: the registry is subset() to these
  *   tools BEFORE the adapter is called. The model cannot call what it cannot
  *   see; no system-prompt overlay can make that guarantee.
- * - `systemOverlay` — appended to the system prompt by the harness (the
- *   kernel does not compose prompts); kept here because it is part of the
- *   mode's contract.
- * - `permissionDefault` — the decision onPreTool falls back to when no hook
- *   or store decides.
- * - `compactionKeepExtra` / `stopPredicate` — reserved (ADR-0011); read by
- *   the harness when the semantics land.
+ *
+ * That is the whole profile. SC-1b: `systemOverlay`, `permissionDefault`,
+ * `compactionKeepExtra`, and `stopPredicate` were REMOVED at 0.12.0 by the
+ * SC-1 memo's adjudication — all four were declared here and read by
+ * nothing, in the kernel or above it. Two of them ("reserved, read by the
+ * harness when the semantics land") had been waiting since mauri ADR-0011
+ * for semantics that never landed. A field that describes an intention
+ * rather than a behavior is a promise the type system makes on the
+ * kernel's behalf and the kernel does not keep; the honest profile is the
+ * one member that is actually applied.
  */
-import type { PermissionDecision } from "./permission.js";
 export interface ModeProfile {
     readonly name: string;
-    readonly systemOverlay?: string;
     readonly visibleToolNames?: readonly string[];
-    readonly permissionDefault?: PermissionDecision;
-    readonly compactionKeepExtra?: readonly string[];
-    readonly stopPredicate?: string;
 }
 export declare function resolveModeProfile(modes: readonly ModeProfile[] | undefined, name: string | undefined): ModeProfile | undefined;

package/dist/kernel/mode.js

@@ -6,13 +6,16 @@
  * - `visibleToolNames` — physical removal: the registry is subset() to these
  *   tools BEFORE the adapter is called. The model cannot call what it cannot
  *   see; no system-prompt overlay can make that guarantee.
- * - `systemOverlay` — appended to the system prompt by the harness (the
- *   kernel does not compose prompts); kept here because it is part of the
- *   mode's contract.
- * - `permissionDefault` — the decision onPreTool falls back to when no hook
- *   or store decides.
- * - `compactionKeepExtra` / `stopPredicate` — reserved (ADR-0011); read by
- *   the harness when the semantics land.
+ *
+ * That is the whole profile. SC-1b: `systemOverlay`, `permissionDefault`,
+ * `compactionKeepExtra`, and `stopPredicate` were REMOVED at 0.12.0 by the
+ * SC-1 memo's adjudication — all four were declared here and read by
+ * nothing, in the kernel or above it. Two of them ("reserved, read by the
+ * harness when the semantics land") had been waiting since mauri ADR-0011
+ * for semantics that never landed. A field that describes an intention
+ * rather than a behavior is a promise the type system makes on the
+ * kernel's behalf and the kernel does not keep; the honest profile is the
+ * one member that is actually applied.
  */
 export function resolveModeProfile(modes, name) {
     if (!name || !modes)

package/dist/kernel/permission.d.ts

@@ -5,9 +5,18 @@
  * allow one call, deny with a reason fed back to the model, or defer to a
  * human. The kernel's contract is only the decision shape; where decisions
  * are stored (accept-for-session) is harness territory (PermissionStore,
- * M2). M1 treats `defer` as a deny with reason "awaiting user" — the model
- * sees the refusal and can adjust; the human-in-the-loop wiring arrives
- * with the harness.
+ * M2).
+ *
+ * `defer` IS A REAL PAUSE. The M1 note that once lived here — "defer is a
+ * deny with reason 'awaiting user'; the human-in-the-loop wiring arrives
+ * with the harness" — described the behavior ADR-0024 decision #3 replaced,
+ * and that ADR's own Context names this note as the thing it fixed (a
+ * denial "fakes the pause": the model sees a refusal and adjusts while no
+ * human ever decided). Shipped now: the loop persists `permission_requested`
+ * and AWAITS the approval channel in the same run frame, the human's
+ * verdict is persisted as `permission_decided`, and the pause survives a
+ * crash (kernel/loop.ts). With no approval channel configured the deferral
+ * degrades to an HONEST denial that says so.
  */
 export type PermissionDecision = {
     readonly action: "allow";

package/dist/kernel/permission.js

@@ -5,9 +5,18 @@
  * allow one call, deny with a reason fed back to the model, or defer to a
  * human. The kernel's contract is only the decision shape; where decisions
  * are stored (accept-for-session) is harness territory (PermissionStore,
- * M2). M1 treats `defer` as a deny with reason "awaiting user" — the model
- * sees the refusal and can adjust; the human-in-the-loop wiring arrives
- * with the harness.
+ * M2).
+ *
+ * `defer` IS A REAL PAUSE. The M1 note that once lived here — "defer is a
+ * deny with reason 'awaiting user'; the human-in-the-loop wiring arrives
+ * with the harness" — described the behavior ADR-0024 decision #3 replaced,
+ * and that ADR's own Context names this note as the thing it fixed (a
+ * denial "fakes the pause": the model sees a refusal and adjusts while no
+ * human ever decided). Shipped now: the loop persists `permission_requested`
+ * and AWAITS the approval channel in the same run frame, the human's
+ * verdict is persisted as `permission_decided`, and the pause survives a
+ * crash (kernel/loop.ts). With no approval channel configured the deferral
+ * degrades to an HONEST denial that says so.
  */
 /** The denial a tool result carries when a call was refused pre-flight. */
 export function denialResult(reason) {

package/dist/kernel/project.d.ts

@@ -19,8 +19,10 @@
  * re-runs the compaction algorithm (a future version could differ, A group/D
  * group); `microcompacted` boundaries re-derive the cleared view from the
  * stream itself (deterministic and idempotent); `summarized` (ADR-0044)
- * replaces its covered range with one assistant summary message. All
- * three are persisted facts — the replay equals the live run. See ADR-0002.
+ * replaces its covered range with one USER message carrying the summary
+ * behind SUMMARY_FRAMING (E6's boundary honesty — see that constant
+ * below; it is deliberately NOT an assistant message). All three are
+ * persisted facts — the replay equals the live run. See ADR-0002.
  */
 import type { Event } from "../protocol/events.js";
 import type { EventInput } from "./event-log.js";

package/dist/kernel/project.js

@@ -19,8 +19,10 @@
  * re-runs the compaction algorithm (a future version could differ, A group/D
  * group); `microcompacted` boundaries re-derive the cleared view from the
  * stream itself (deterministic and idempotent); `summarized` (ADR-0044)
- * replaces its covered range with one assistant summary message. All
- * three are persisted facts — the replay equals the live run. See ADR-0002.
+ * replaces its covered range with one USER message carrying the summary
+ * behind SUMMARY_FRAMING (E6's boundary honesty — see that constant
+ * below; it is deliberately NOT an assistant message). All three are
+ * persisted facts — the replay equals the live run. See ADR-0002.
  */
 /**
  * C area: tools whose output is eligible for microcompact clearing — reads,

package/dist/protocol/adapter.d.ts

@@ -8,9 +8,9 @@
  * events carry `seq`). The three properties that let a ReAct loop stream
  * without buffering and without losing its place.
  *
- * WHY not a `Promise<Event[]>`: a buffered adapter is what made agno's
- * streaming a second-class feature bolted onto a batch loop. The contract
- * shape IS the architecture — see ADR-0001.
+ * WHY not a `Promise<Event[]>`: a buffered adapter is what made the
+ * reference implementation's streaming a second-class feature bolted onto
+ * a batch loop. The contract shape IS the architecture — see ADR-0001.
  *
  * Adapters translate provider wire events INTO `Event`. They never see tool
  * handlers (only `ToolSpec` projections) — the kernel is the only thing that

package/dist/protocol/adapter.js

@@ -8,9 +8,9 @@
  * events carry `seq`). The three properties that let a ReAct loop stream
  * without buffering and without losing its place.
  *
- * WHY not a `Promise<Event[]>`: a buffered adapter is what made agno's
- * streaming a second-class feature bolted onto a batch loop. The contract
- * shape IS the architecture — see ADR-0001.
+ * WHY not a `Promise<Event[]>`: a buffered adapter is what made the
+ * reference implementation's streaming a second-class feature bolted onto
+ * a batch loop. The contract shape IS the architecture — see ADR-0001.
  *
  * Adapters translate provider wire events INTO `Event`. They never see tool
  * handlers (only `ToolSpec` projections) — the kernel is the only thing that

package/dist/protocol/events.d.ts

@@ -220,10 +220,17 @@ export interface ToolExecutionSucceeded {
     readonly tags?: readonly string[];
 }
 /**
- * The side effect ran and FAILED. `safeToRetry` is the tool's own proof
- * (declared idempotent): only then is a failure a clean "failed"; a
- * non-idempotent failure may have produced a side effect and is UNCERTAIN
- * until a human decides (Area 3).
+ * The side effect ran and FAILED. A complete receipt IS the outcome, so this
+ * execution is "failed" — NEVER "uncertain", whatever `safeToRetry` says
+ * (ADR-0038 superseding ADR-0025 decision #3: uncertainty belongs to the
+ * crash window alone — started, no receipt). The run does not pause here;
+ * siblings continue and the model retries with the error in hand, and that
+ * retry is a NEW call that re-passes the approval chain.
+ *
+ * `safeToRetry` is the tool's own `idempotent: true` declaration, carried
+ * for HISTORY: since ADR-0038 it no longer feeds the ledger's status
+ * derivation (runtime/ledger.ts). Its one live consequence is the honest
+ * note appended to a non-idempotent failure's result (ADR-0038 Amendment 1).
  */
 export interface ToolExecutionFailed {
     readonly seq: number;
@@ -294,11 +301,20 @@ export interface PermissionExpired {
     readonly reason: string;
 }
 /**
- * A non-idempotent execution FAILED and the run PAUSES until a human
- * decides (C group): no next model turn, no sibling tool, no auto-retry. The
- * verdict is recorded by the session (resolveUncertain) and the ledger
- * transitions uncertain → rerun/abandoned; the event itself is the durable
- * pause marker.
+ * HISTORICAL — the current kernel NEVER emits this event.
+ *
+ * It marked the C group's failed-receipt pause: a non-idempotent execution
+ * that FAILED paused the run until a human ruled. ADR-0038 removed that
+ * pause (a complete receipt IS the outcome), so nothing appends this any
+ * more — pinned by `packages/core/tests/execution-gate.test.ts` and
+ * `packages/runtime/tests/execution.test.ts`, which assert its ABSENCE.
+ *
+ * The variant stays because the durable contract is frozen (ADR-0051) and
+ * old logs replay theirs verbatim (ADR-0038, Consequences): the projection
+ * renders nothing for it, and the ledger reports those receipted executions
+ * as "failed". The crash window — started, no receipt — is now the only
+ * source of uncertainty, and it is resolved through
+ * `uncertainExecutions()` / `resolveUncertain()`, not through this event.
  */
 export interface UncertainPending {
     readonly seq: number;
@@ -342,9 +358,11 @@ export interface MicroCompactEvent {
  * range. `coversToSeq` is the seq of the LAST covered event; the covered
  * range runs from just past the previous `summarized` event's coversToSeq
  * (or the trajectory's start for the first) up to coversToSeq. The
- * projection replaces exactly those events with ONE assistant summary
- * message (`summary`); every `summarized` event always renders its own
- * message. Byte-stable: a summarized event is a persisted fact, so the
+ * projection replaces exactly those events with ONE USER message carrying
+ * the summary behind a fixed framing line (E6's boundary honesty: the
+ * model reads compressed history as CONTEXT, never as a reply it produced
+ * — see SUMMARY_FRAMING in kernel/project.ts). It is not an assistant
+ * message; every `summarized` event always renders its own message. Byte-stable: a summarized event is a persisted fact, so the
  * same events derive the same messages on every replay.
  *
  * The summary is generated OFF-LOOP through the session's own adapter —

package/dist/protocol/extension.d.ts

@@ -83,7 +83,7 @@ export interface KisoExtension {
      * E2: EXTEND the system prompt — append-only, never replace (a replace
      * is a footgun; appends guarantee "adding an extension never removes
      * existing guidance" — the monotonicity family of the approval chain's
-     * deny>ask>allow and the veto short-circuit). The session's own
+     * deny > allow > ask and the veto short-circuit). The session's own
      * systemPrompt comes first, then each extension's append in load order,
      * \n\n-joined.
      */

package/dist/protocol/messages.d.ts

@@ -10,7 +10,12 @@
  * carries images. Forcing every caller into the array shape to serve the
  * 5% that need vision is a tax paid on every line of product code.
  *
- * See ADR-0003 (sum type) and ADR-0008 (tool contract).
+ * See ADR-0003 (sum type). The tool contract's record is mauri ADR-0008 —
+ * the PREDECESSOR series, cited the same way in kernel/hooks.ts and
+ * kernel/mode.ts: kiso's own numbers 0006-0019 were NEVER assigned
+ * (docs/adrs/README.md), so an unprefixed "ADR-0008" sends a reader to a
+ * record that does not exist in this repo. The live tool contract is
+ * tools/tool.ts itself.
  *
  * This module is types-only: it compiles to nothing.
  */
@@ -107,8 +112,12 @@ export type Message = UserMessage | AssistantMessage | ToolResultMessage;
 /**
  * What the adapter advertises to the model.
  *
- * Deliberately minimal: the full tool (handler, repair, concurrency, dedup)
- * is L3-internal and an adapter must never see it. An adapter that can reach
+ * Deliberately minimal: the full tool (the handler above all, plus the
+ * declarations the kernel keeps to itself) is L3-internal and an adapter
+ * must never see it. NB the historical list here named a `repair` member
+ * and a `dedup` member — neither exists on `Tool`: the (name, input) dedup
+ * guard was removed by ADR-0025, and repair means RECEIPT repair, which is
+ * the runtime's, not a tool's. An adapter that can reach
  * the handler will eventually call it, and then the kernel is no longer the
  * only thing that runs tools.
  */

package/dist/protocol/messages.js

@@ -10,7 +10,12 @@
  * carries images. Forcing every caller into the array shape to serve the
  * 5% that need vision is a tax paid on every line of product code.
  *
- * See ADR-0003 (sum type) and ADR-0008 (tool contract).
+ * See ADR-0003 (sum type). The tool contract's record is mauri ADR-0008 —
+ * the PREDECESSOR series, cited the same way in kernel/hooks.ts and
+ * kernel/mode.ts: kiso's own numbers 0006-0019 were NEVER assigned
+ * (docs/adrs/README.md), so an unprefixed "ADR-0008" sends a reader to a
+ * record that does not exist in this repo. The live tool contract is
+ * tools/tool.ts itself.
  *
  * This module is types-only: it compiles to nothing.
  */

package/dist/tools/tool.d.ts

@@ -4,9 +4,15 @@
  * A tool is a pure declaration + handler pair. The kernel never branches on
  * a tool's internals: `parameters` is a JSON Schema the kernel validates and
  * projects to the adapter as `ToolSpec` (adapter never sees the handler —
- * see ADR-0001), `concurrencySafe` decides batch scheduling, `delivers`
- * marks a tool as an artifact producer (consumed by harness-side delivery
- * tracking; the kernel only carries the flag).
+ * see ADR-0001).
+ *
+ * SC-1b: `concurrencySafe` and `delivers` were REMOVED at 0.12.0 by the
+ * SC-1 memo's adjudication — both were declared and consulted by nothing.
+ * Their absence is the honest contract; the concurrency RACE they were
+ * mistaken for a defense against is a real open question and moved to EC-1,
+ * which owes a mechanism that does not depend on a per-tool opt-in.
+ * Delivery truth is named by the CALLER (governance/delivery.ts's
+ * `DeliveryConfig.producers`), which is where it always actually lived.
  *
  * WHY JSON Schema instead of a runtime library: the kernel has zero runtime
  * dependencies (ADR-0001). Zod / TypeBox / valibot live at the harness layer;
@@ -49,22 +55,28 @@ export interface Tool<I = unknown> {
     /** JSON Schema (draft-07 subset). Validated before execute. */
     readonly parameters: Readonly<Record<string, unknown>>;
     /**
-     * Per-call concurrency predicate — a shape the reference implementation's
-     * static executionMode cannot express: the same tool may be parallel-safe for one
-     * input and must be serial for another (generate_image with
-     * `chain_to_previous`). Absent = safe when true-ish; see ADR-0015.
-     */
-    readonly concurrencySafe?: (input: I) => boolean;
-    /** Marks this tool as an artifact producer (harness-side delivery truth). */
-    readonly delivers?: {
-        readonly kind: string;
-    };
-    /**
-     * Exactly-once guard escape hatch (Phase D): a tool whose side effects
-     * are safe to repeat (reads, searches, pure computations) declares
-     * `idempotent: true`. Without it, the kernel refuses to run the same
-     * tool+input twice in a session — a confirmed success is replayed, an
-     * interrupted attempt blocks. The default is the safe side.
+     * The tool's own declaration that REPEATING its side effect is safe
+     * (reads, searches, pure computations).
+     *
+     * It is NOT a dedup guard. The kernel runs every logical call, including
+     * one whose (name, input) is identical to an earlier one — ADR-0024
+     * decision #2's (name, input) guard was REMOVED by ADR-0025 decision #1
+     * ("NO (name, input) dedup", kernel/loop.ts). Exactly-once is enforced
+     * by execution IDENTITY instead: a confirmed success is never
+     * re-executed (a lost model-facing result is repaired FROM the durable
+     * receipt), and an execution that STARTED without reporting — the crash
+     * window — waits for a human verdict. A FAILED execution is failed, not
+     * uncertain: a complete receipt IS the outcome (ADR-0038).
+     *
+     * What this flag actually decides, and nothing more:
+     *   - a failure from a tool that did NOT declare it carries the honest
+     *     "side effects may have partially applied; verify before retrying"
+     *     note on the result (ADR-0038 Amendment 1);
+     *   - it rides the durable receipt as `tool_execution_failed.safeToRetry`
+     *     — history only, since ADR-0038 stopped it feeding ledger status.
+     *
+     * Undeclared is the safe side: unknown idempotency means the note
+     * applies. A retry is a NEW call and re-passes the approval chain.
      */
     readonly idempotent?: boolean;
     /** R-C: ONE line for the system prompt — the tool's role, never the

package/dist/tools/tool.js

@@ -4,9 +4,15 @@
  * A tool is a pure declaration + handler pair. The kernel never branches on
  * a tool's internals: `parameters` is a JSON Schema the kernel validates and
  * projects to the adapter as `ToolSpec` (adapter never sees the handler —
- * see ADR-0001), `concurrencySafe` decides batch scheduling, `delivers`
- * marks a tool as an artifact producer (consumed by harness-side delivery
- * tracking; the kernel only carries the flag).
+ * see ADR-0001).
+ *
+ * SC-1b: `concurrencySafe` and `delivers` were REMOVED at 0.12.0 by the
+ * SC-1 memo's adjudication — both were declared and consulted by nothing.
+ * Their absence is the honest contract; the concurrency RACE they were
+ * mistaken for a defense against is a real open question and moved to EC-1,
+ * which owes a mechanism that does not depend on a per-tool opt-in.
+ * Delivery truth is named by the CALLER (governance/delivery.ts's
+ * `DeliveryConfig.producers`), which is where it always actually lived.
  *
  * WHY JSON Schema instead of a runtime library: the kernel has zero runtime
  * dependencies (ADR-0001). Zod / TypeBox / valibot live at the harness layer;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincemakes/kiso-core",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "kiso (foundation) core — protocol, event log, loop, hooks, modes, permissions, compaction, delivery truth. The 2,000-line kernel at the bottom of the kiso framework.",
   "type": "module",
   "license": "MIT",
@@ -33,7 +33,7 @@
     "openai"
   ],
   "devDependencies": {
-    "@vincemakes/kiso-evals": "0.10.0",
+    "@vincemakes/kiso-evals": "0.12.0",
     "@types/node": "^26.1.2",
     "typescript": "^5.7.2",
     "vitest": "^3.0.0"