@vincemakes/kiso-core 0.11.0 → 0.13.0

package/dist/governance/delivery.d.ts

@@ -8,10 +8,21 @@
  * the same events the loop yielded, so the verdict is replayable and the
  * model's narration never participates in its own grading.
  *
- * Producers are declared on tools (`delivers`, tools/tool.ts); the verdict
- * counts producer calls that completed (non-error results), against a
- * delivery claim in the text. The canonical lie — "generated-document" with zero
- * producer calls and a clean completed terminal — fails here.
+ * Producers are named by the CALLER, in `DeliveryConfig.producers` — the
+ * hand-maintained set is the ONLY source of delivery truth. SC-1b removed
+ * `Tool.delivers`, the flag this note used to describe as the eventual
+ * replacement: it was declared on the contract and read by nothing, here
+ * or anywhere. Should a tool's own declaration ever supersede the caller's
+ * set, it enters as a new field with a wiring and a gate, never as a
+ * standing promise the code has not kept.
+ *
+ * The verdict counts producer calls that COMPLETED (non-error results).
+ * `claimedInText` is computed and REPORTED but does not enter `passed` —
+ * a caller that wants "claimed but not delivered" to fail combines the two
+ * itself (the evals fixture does). With `required: false`, text claiming
+ * delivery over zero producer calls passes here. The canonical lie —
+ * "generated-document" with zero producer calls and a clean completed
+ * terminal — is caught by that combination.
  *
  * In M3.5 the emission side (artifact URLs extracted from results) joins;
  * today a completed producer IS the emission.

package/dist/governance/delivery.js

@@ -8,10 +8,21 @@
  * the same events the loop yielded, so the verdict is replayable and the
  * model's narration never participates in its own grading.
  *
- * Producers are declared on tools (`delivers`, tools/tool.ts); the verdict
- * counts producer calls that completed (non-error results), against a
- * delivery claim in the text. The canonical lie — "generated-document" with zero
- * producer calls and a clean completed terminal — fails here.
+ * Producers are named by the CALLER, in `DeliveryConfig.producers` — the
+ * hand-maintained set is the ONLY source of delivery truth. SC-1b removed
+ * `Tool.delivers`, the flag this note used to describe as the eventual
+ * replacement: it was declared on the contract and read by nothing, here
+ * or anywhere. Should a tool's own declaration ever supersede the caller's
+ * set, it enters as a new field with a wiring and a gate, never as a
+ * standing promise the code has not kept.
+ *
+ * The verdict counts producer calls that COMPLETED (non-error results).
+ * `claimedInText` is computed and REPORTED but does not enter `passed` —
+ * a caller that wants "claimed but not delivered" to fail combines the two
+ * itself (the evals fixture does). With `required: false`, text claiming
+ * delivery over zero producer calls passes here. The canonical lie —
+ * "generated-document" with zero producer calls and a clean completed
+ * terminal — is caught by that combination.
  *
  * In M3.5 the emission side (artifact URLs extracted from results) joins;
  * today a completed producer IS the emission.

package/dist/index.d.ts

@@ -9,4 +9,3 @@ export * from "./kernel/permission.js";
 export * from "./kernel/loop.js";
 export * from "./kernel/compaction.js";
 export * from "./kernel/project.js";
-export * from "./governance/delivery.js";

package/dist/index.js

@@ -9,4 +9,3 @@ export * from "./kernel/permission.js";
 export * from "./kernel/loop.js";
 export * from "./kernel/compaction.js";
 export * from "./kernel/project.js";
-export * from "./governance/delivery.js";

package/dist/kernel/compaction.d.ts

@@ -21,6 +21,8 @@ import type { Message } from "../protocol/messages.js";
 /**
  * Rough token estimate (chars/4 + structural overhead). Calibration-free on
  * purpose: context economy only needs a stable MONOTONE proxy, not an exact
- * count — the threshold absorbs the error (mauri ADR-0007).
+ * count — the threshold absorbs the error (mauri ADR-0007). The proxy's
+ * three-word contract, and the pins that hold it, are
+ * packages/core/tests/sc1b-estimator.test.ts.
  */
 export declare function estimateTokens(messages: readonly Message[]): number;

package/dist/kernel/compaction.js

@@ -17,16 +17,43 @@
  * The model-generated half of context economy (the /compact summary layer)
  * lives in kernel/summarize.ts.
  */
+/**
+ * What a non-text block (an image) contributes. There is no character count
+ * to proxy, and this module refuses to guess a provider's image
+ * tokenization; the figure exists so a block is never worth ZERO, which is
+ * what MONOTONE requires. Deliberately small: under-stating an image is a
+ * threshold that fires slightly late, over-stating it is one that fires on
+ * a conversation that was never large.
+ */
+const NON_TEXT_BLOCK_TOKENS = 8;
+/**
+ * chars/4 over a `string | ContentBlock[]` content field.
+ *
+ * SC-1b ①: the array arm must be summed BLOCK BY BLOCK. Reading `.length`
+ * off it yields the block COUNT — a five-block 50 KB message scored ~2
+ * tokens, and the live microcompact threshold believed it.
+ */
+function contentTokens(content) {
+    if (typeof content === "string")
+        return Math.ceil(content.length / 4);
+    let tokens = 0;
+    for (const block of content) {
+        tokens += block.type === "text" ? Math.ceil(block.text.length / 4) : NON_TEXT_BLOCK_TOKENS;
+    }
+    return tokens;
+}
 /**
  * Rough token estimate (chars/4 + structural overhead). Calibration-free on
  * purpose: context economy only needs a stable MONOTONE proxy, not an exact
- * count — the threshold absorbs the error (mauri ADR-0007).
+ * count — the threshold absorbs the error (mauri ADR-0007). The proxy's
+ * three-word contract, and the pins that hold it, are
+ * packages/core/tests/sc1b-estimator.test.ts.
  */
 export function estimateTokens(messages) {
     let total = 0;
     for (const msg of messages) {
         if (msg.role === "user") {
-            total += Math.ceil(msg.content.length / 4);
+            total += contentTokens(msg.content);
         }
         else if (msg.role === "assistant") {
             for (const block of msg.blocks) {
@@ -37,7 +64,7 @@ export function estimateTokens(messages) {
             }
         }
         else {
-            total += Math.ceil(msg.content.length / 4) + 10;
+            total += contentTokens(msg.content) + 10;
         }
     }
     return total;

package/dist/kernel/event-log.d.ts

@@ -37,7 +37,12 @@ export declare class EventLog {
      */
     append(ev: EventInput): Event;
     get all(): readonly Event[];
-    /** Incremental view for consumers that already saw `seq` and before. */
+    /**
+     * Incremental view for consumers that already saw `seq` and before —
+     * STRICTLY after, so a poll loop delivers each event exactly once. A
+     * consumer that has seen nothing passes -1. (SC-1b ④: this filtered
+     * `>= seq` and re-served the seam event on every poll.)
+     */
     since(seq: number): readonly Event[];
     get lastSeq(): number;
 }

package/dist/kernel/event-log.js

@@ -41,9 +41,14 @@ export class EventLog {
     get all() {
         return this.#events;
     }
-    /** Incremental view for consumers that already saw `seq` and before. */
+    /**
+     * Incremental view for consumers that already saw `seq` and before —
+     * STRICTLY after, so a poll loop delivers each event exactly once. A
+     * consumer that has seen nothing passes -1. (SC-1b ④: this filtered
+     * `>= seq` and re-served the seam event on every poll.)
+     */
     since(seq) {
-        return this.#events.filter((e) => e.seq >= seq);
+        return this.#events.filter((e) => e.seq > seq);
     }
     get lastSeq() {
         return this.#next - 1;

package/dist/kernel/loop.d.ts

@@ -2,8 +2,8 @@
  * L2 — the ReAct loop. The kernel's only loop; everything else is harness.
  *
  * An async generator that yields every event as it happens (never buffers a
- * turn into a list — the agno failure), and converges on exactly one
- * `terminal` event per run (ADR-0004).
+ * turn into a list — the reference implementation's failure), and converges
+ * on exactly one `terminal` event per run (ADR-0004).
  *
  * SINGLE TRUTH (Phase B): the loop holds ONE EventLog. Messages are never
  * stored alongside it — every adapter call derives them via
@@ -100,13 +100,23 @@ export interface LoopConfig {
      */
     readonly approvalVerdict?: (decisionId: string) => boolean | undefined;
     /**
-     * C group: the channel that resolves a failed NON-idempotent execution.
-     * The loop persists `uncertain_pending`, yields it, and AWAITS the
-     * human verdict — no next model turn, no sibling tool, no auto-retry.
-     * Absent, the failure is recorded `abandoned` (never retried).
+     * DEAD — accepted by the type, never read by this loop.
+     *
+     * It was the C group channel for the failed-receipt pause: the loop
+     * persisted `uncertain_pending` and awaited a human verdict. ADR-0038
+     * removed that pause (a complete receipt IS the outcome), and with it
+     * every read of this field — a failure is now simply recorded failed and
+     * the siblings run on. The runtime still passes both callbacks
+     * (runtime/run.ts), so supplying them is harmless and changes nothing.
+     *
+     * The crash window — started, no receipt — is the ONLY uncertainty left,
+     * and the runtime's recovery driver owns it (RESOLVE_UNCERTAIN in
+     * runtime/recovery-plan.ts), not the loop. Both fields are kept because
+     * the surface is frozen (ADR-0051); do not read them as live wiring.
      */
     readonly resolveUncertainty?: (executionId: string) => Promise<"rerun" | "abandoned">;
-    /** round 4 (adversarial): the uncertainty twin of `approvalVerdict`. */
+    /** DEAD, as above — the uncertainty twin of `approvalVerdict`
+     *  (round 4, adversarial). Never read by the loop since ADR-0038. */
     readonly uncertaintyVerdict?: (executionId: string) => "rerun" | "abandoned" | undefined;
     /**
      * E1: the COMPOSED approval chain — the runtime composes the

package/dist/kernel/loop.js

@@ -2,8 +2,8 @@
  * L2 — the ReAct loop. The kernel's only loop; everything else is harness.
  *
  * An async generator that yields every event as it happens (never buffers a
- * turn into a list — the agno failure), and converges on exactly one
- * `terminal` event per run (ADR-0004).
+ * turn into a list — the reference implementation's failure), and converges
+ * on exactly one `terminal` event per run (ADR-0004).
  *
  * SINGLE TRUTH (Phase B): the loop holds ONE EventLog. Messages are never
  * stored alongside it — every adapter call derives them via
@@ -205,11 +205,33 @@ export async function* loop(config) {
     // rejection un-consumed — the no-op keeps it from surfacing as an
     // unhandled rejection while the race consumers still receive it.
     void violatedP.catch(() => { });
+    // ── EC-1 ① — the DURABLE TURN COMMIT gate ──────────────────────────────
+    // Invariant 3 (COMMIT GATING): a commit-required handler never starts
+    // before this turn's stop is DURABLE. The gate RESOLVES exactly once per
+    // turn — at the commit, or at the void — and the waiter then reads
+    // `committed`. It deliberately does not reuse `violatedP`: that one
+    // REJECTS, and a rejection awaited here would be caught by the launch's
+    // catch and recorded as a launchError, failing the whole run for what is
+    // an ordinary void. A gate that resolves keeps the void path quiet.
+    // Both are reset per turn (below): turn N+1's calls wait for turn N+1's
+    // commit. Safe because the settle drains every launch before the turn
+    // advances, so no launch ever waits on a stale gate.
+    let committed = false;
+    let settleTurn = () => { };
+    let turnSettled = new Promise((res) => {
+        settleTurn = res;
+    });
     // The ask gate: an ask's human resolution blocks the calls after it.
     // The DECIDE chain serializes the decisions in CALL order, so the gate
     // an ask installs is structurally in place before the successors decide.
+    // EC-1 ③: it must be installed THERE and not at the ask itself, even
+    // though the ask now happens later (post-commit): the gate is what a
+    // precommit-eligible sibling consults to know an ask was accepted ahead
+    // of it, and that has to be knowable BEFORE the commit. Each call
+    // captures the gate ahead of it and its own release (below) — one shared
+    // `askRelease` used to mean the first ask's resolution opened the SECOND
+    // ask's gate.
     let askGate = Promise.resolve();
-    let askRelease = null;
     // The decision chain: each launch's decide is chained onto the previous
     // one's — the decides run in CALL order and the chain resolves to the
     // call's verdict.
@@ -219,16 +241,57 @@ export async function* loop(config) {
     // keys (the executionId comes from the drain, seq-stable).
     let idSeq = log.all.length + 1;
     const nextDecisionId = () => `d-${idSeq++}`;
+    // ── EC-1 ② / ③ — the FIFO EXCLUSIVE BARRIER ────────────────────────────
+    // Absence is the conservative truth: a tool that declares nothing is
+    // EXCLUSIVE, and the kernel serializes it. `concurrency: "shared"` is the
+    // only way to overlap, and it is a per-TOOL certificate the kernel
+    // enforces — never a per-call claim it could not police.
+    //
+    // The fence is installed at ACCEPTANCE (in `launch`, i.e. CALL order),
+    // not when a handler starts: that is what makes it FIFO. A later sibling
+    // — including a precommit-safe read — never overtakes an exclusive
+    // invocation accepted before it, so a read can never observe a
+    // half-written file. A read after a write therefore loses its latency
+    // win; safe overtaking and snapshot semantics stay future work.
+    let fence = Promise.resolve();
+    const sharedRunning = [];
+    /** Reserve this call's place in the FIFO: what it must await before
+     *  running, and the release to call once its handler is done. */
+    const reserve = (tool) => {
+        const shared = tool?.effects?.concurrency === "shared";
+        let release;
+        const done = new Promise((res) => {
+            release = res;
+        });
+        // An exclusive invocation waits for the fence AND every shared call
+        // already accepted ahead of it — while it runs, it runs alone.
+        const wait = shared ? fence : Promise.all([fence, ...sharedRunning]).then(() => undefined);
+        if (shared)
+            sharedRunning.push(done);
+        else {
+            fence = done;
+            sharedRunning.length = 0;
+        }
+        return { wait, release };
+    };
     const launch = (call) => {
         execActive += 1;
+        const tool = registry.get(call.name);
+        const slot = reserve(tool);
+        // EC-1 ③ — this call's place in the ASK order, filled in by the
+        // decide chain (call order). `ahead` is the gate of an ask ACCEPTED
+        // BEFORE this call; `release` opens this call's own gate for its
+        // successors and stays a no-op unless this call asks. Per-call, so
+        // two asks in one turn queue honestly instead of sharing one release.
+        const askOrder = { ahead: Promise.resolve(), release: () => { } };
         launches.push((async () => {
             try {
-                await acquireWindow();
                 decideChain = decideChain.then(async () => {
                     const v = await decideCall(call, registry, hooks, { signal: signal ?? NEVER_ABORT, ...(config.sessionId !== undefined ? { sessionId: config.sessionId } : {}) }, log, config.resolveApproval, config.approvalVerdict, signal, config.approvalPolicy, nextDecisionId, pushExec);
+                    askOrder.ahead = askGate;
                     if (v.action === "ask") {
                         askGate = new Promise((res) => {
-                            askRelease = res;
+                            askOrder.release = res;
                         });
                     }
                     return v;
@@ -240,33 +303,94 @@ export async function* loop(config) {
                     pushExec(verdict.result);
                     return;
                 }
+                // the conservative order: the calls AFTER an ask wait for its
+                // human resolution. The context may have changed when the
+                // human approves — which is why even a precommit-safe read
+                // accepted after an ask waits here rather than racing ahead.
+                await askOrder.ahead;
+                if (violated)
+                    return;
                 if (verdict.action === "ask") {
-                    // The human pause — abortable by a user abort OR a turn
-                    // void (the violated promise). The gate opens when the
-                    // human decides, whatever the outcome (conservative
-                    // ordering: the successors then proceed with their own
-                    // verdicts).
-                    const decision = await Promise.race([
-                        humanPause(call, verdict.decisionId, hooks, log, config.resolveApproval, config.approvalVerdict, signal, pushExec, verdict.speaker),
-                        violatedP,
-                    ]);
-                    askRelease?.();
-                    askRelease = null;
-                    if (violated)
-                        return;
-                    if (decision.action !== "allow") {
-                        // the reason rides the denial — the human's words,
-                        // or the honest "no approval flow configured".
-                        pushExec(resultEvent(call, denialResult(decision.reason ?? "denied")));
-                        return;
+                    try {
+                        // EC-1 ③ — THE POST-COMMIT ASK. A human must never
+                        // be asked to approve a call whose turn then proves
+                        // invalid, so the pause waits for this turn's OWN
+                        // commit exactly like a handler does. On an
+                        // uncommitted turn the call bails here having asked
+                        // NOTHING and started nothing. (Before EC-1 the
+                        // question was put to a person mid-stream, and a
+                        // provider that violated the protocol after its stop
+                        // made that person's "yes" authorize a turn the
+                        // kernel then voided.)
+                        await turnSettled;
+                        if (!committed)
+                            return;
+                        // The human pause — abortable by a user abort OR a
+                        // turn void (the violated promise). Post-commit a
+                        // void can no longer reach this branch; the race
+                        // stays as the cheap structural guarantee that it
+                        // never could.
+                        const decision = await Promise.race([
+                            humanPause(call, verdict.decisionId, hooks, log, config.resolveApproval, config.approvalVerdict, signal, pushExec, verdict.speaker),
+                            violatedP,
+                        ]);
+                        if (violated)
+                            return;
+                        if (decision.action !== "allow") {
+                            // the reason rides the denial — the human's words,
+                            // or the honest "no approval flow configured".
+                            pushExec(resultEvent(call, denialResult(decision.reason ?? "denied")));
+                            return;
+                        }
                     }
+                    finally {
+                        // The gate opens the moment the human's part is over
+                        // — whatever the outcome, and on every bail path:
+                        // successors wait for the VERDICT, never for this
+                        // call's handler, and a turn that voids before the
+                        // ask must not strand them.
+                        askOrder.release();
+                    }
+                }
+                else if (tool?.effects?.precommitSafe !== true) {
+                    // EC-1 ① (invariant 3, COMMIT GATING): the handler waits
+                    // for this turn's OWN commit. An uncommitted turn never
+                    // reaches a handler — the call bails here having emitted
+                    // NO started event, so it is clean, never uncertain
+                    // (abort semantics). This is the whole of "an invalid
+                    // turn never starts a commit-required tool handler".
+                    //
+                    // EC-1 ③(b) — THE PRECOMMIT LAUNCH RULE is the `else`
+                    // this branch is guarded by: a call skips the commit
+                    // gate iff its tool declares `precommitSafe` AND its
+                    // authorization is ALREADY satisfied — an `allow`
+                    // verdict, no human in the loop. Both halves are
+                    // necessary: the certificate says the EXECUTION is
+                    // harmless (read-only, free, local, universally), never
+                    // that the authorization is unnecessary. Such a call may
+                    // run on a turn that later voids; invariant 7 owns that
+                    // outcome — the receipt is an honest fact and the turn
+                    // stays uncommitted.
+                    await turnSettled;
+                    if (!committed)
+                        return;
+                }
+                // EC-1 ③ (invariants 5 + 6): wait behind the FIFO barrier,
+                // and only THEN take a window slot. Waiting — for the
+                // commit, for a human, or for the barrier — consumes no
+                // slot: the window is an EXECUTION window, not a
+                // pending-invocation window, so four held writes can never
+                // starve a runnable sibling.
+                await slot.wait;
+                if (violated)
+                    return;
+                await acquireWindow();
+                try {
+                    await runLedgered(call, registry, hooks, { signal: signal ?? NEVER_ABORT, ...(config.sessionId !== undefined ? { sessionId: config.sessionId } : {}) }, signal, pushExec);
+                }
+                finally {
+                    releaseWindow();
                 }
-                // the conservative order: the calls AFTER an ask wait for its human
-                // resolution (the askGate is the ask's pause promise —
-                // resolved by default, released by the ask branch above).
-                // The context may have changed when the human approves.
-                await askGate;
-                await runLedgered(call, registry, hooks, { signal: signal ?? NEVER_ABORT, ...(config.sessionId !== undefined ? { sessionId: config.sessionId } : {}) }, signal, pushExec);
             }
             catch (err) {
                 // The abort sentinel (a user cancel during the decide or
@@ -277,7 +401,12 @@ export async function* loop(config) {
                     launchError ??= err;
             }
             finally {
-                releaseWindow();
+                // The barrier and the ask gate are released on EVERY exit —
+                // a denial, an uncommitted turn, an abort — or the siblings
+                // queued behind this call would wait forever. (Releasing an
+                // already-open gate is a no-op: a promise resolves once.)
+                askOrder.release();
+                slot.release();
                 execActive -= 1;
             }
         })());
@@ -325,6 +454,25 @@ export async function* loop(config) {
         // user_input, …) from the stream is a FORGERY and must never reach
         // the log.
         let forgedEvent = false;
+        // EC-1 ①: a SECOND stop voids the turn — and unlike the pre-EC-1 path
+        // (which appended both, leaving two stops in the log forever), NEITHER
+        // stop is persisted now. A deliberate improvement of that class.
+        let duplicateStop = false;
+        // EC-1 ①: the turn's stop, HELD in memory until the stream proves
+        // clean. It is neither appended NOR yielded here — yield order must
+        // equal append order (persistence-ownership.test.ts), so the hold
+        // covers both, and the commit below performs both together.
+        let heldStop = null;
+        // EC-1 ⑤ (the live void): the last durable event BEFORE this turn's
+        // model output — the previous turn's stop, the user input, or a
+        // microcompact boundary. Everything after it is this turn's draft,
+        // which is exactly the range a void must abandon.
+        const turnStart = log.lastSeq;
+        // EC-1 ①: this turn's commit gate — reset BEFORE any call can launch.
+        committed = false;
+        turnSettled = new Promise((res) => {
+            settleTurn = res;
+        });
         while (true) {
             // Area 4: the backoff is abortable — a cancel landing during a
             // retry wait ends the run now, not after the backoff.
@@ -370,9 +518,24 @@ export async function* loop(config) {
                         break;
                     }
                     if (ev.type === "stop") {
+                        // EC-1 ① — DURABLE TURN COMMIT. The stop is HELD, not
+                        // persisted: before EC-1 it was appended the instant it
+                        // arrived, so a stop could be durable while the stream
+                        // was still running — and the recovery keyed "this turn
+                        // committed" on exactly that durable stop. The two
+                        // truths are now one: a durable compatible stop means
+                        // THIS producer observed clean stream exhaustion.
+                        if (sawStop) {
+                            duplicateStop = true;
+                            violated = true;
+                            violatedReject();
+                            break;
+                        }
                         sawStop = true;
                         lastStop = ev.reason;
                         stopCount += 1;
+                        heldStop = ev;
+                        continue;
                     }
                     // R-E 0.1.43: the append precedes the launch — the call's
                     // framework seq is assigned here; invocationSeq must never
@@ -430,78 +593,98 @@ export async function* loop(config) {
                 error: { code: "invalid_request", retryable: false, message: "provider emitted events after its stop event" },
             };
         }
-        else if (pending.length === 0) {
-            // Area 6: protocol anomalies are STRUCTURED ERRORS, never a
-            // default `completed` — a stream with no stop, a duplicate stop,
-            // or a tool_use that never produced a complete call.
-            if (stopCount === 0) {
-                voided = {
-                    kind: "error",
-                    error: { code: "invalid_request", retryable: false, message: "provider stream ended without a stop event" },
-                };
-            }
-            else if (stopCount > 1) {
-                voided = {
-                    kind: "error",
-                    error: { code: "invalid_request", retryable: false, message: `provider emitted ${stopCount} stop events in one turn` },
-                };
-            }
-            else {
-                yield await terminal(terminalForStop(lastStop));
-                return;
+        else if (duplicateStop) {
+            // EC-1 ①: a second stop. The pre-EC-1 path appended BOTH and voided
+            // afterwards, so a duplicate-stop turn left two stops in the log
+            // forever; now neither is durable — the turn simply never commits.
+            voided = {
+                kind: "error",
+                error: { code: "invalid_request", retryable: false, message: `provider emitted ${stopCount + 1} stop events in one turn` },
+            };
+        }
+        else if (stopCount === 0) {
+            // Area 6: protocol anomalies are STRUCTURED ERRORS, never a default
+            // `completed`. EC-1 ①: ONE arm now, not two — the pre-EC-1 code
+            // duplicated this verdict across the pending/no-pending split, where
+            // it never differed.
+            voided = {
+                kind: "error",
+                error: { code: "invalid_request", retryable: false, message: "provider stream ended without a stop event" },
+            };
+        }
+        else if (pending.length > 0) {
+            // C group: STRUCTURAL COMPATIBILITY — a stop reason that cannot
+            // carry tool calls voids the turn. EC-1 ①: this is now the second
+            // half of the commit condition and runs BEFORE the commit, so an
+            // incompatible turn never persists its stop; combined with the
+            // commit gate its calls never became effects either (pre-EC-1 they
+            // had already launched, and the void could only let their receipts
+            // land after the fact).
+            switch (lastStop) {
+                case "tool_use":
+                case "function_call":
+                    break; // compatible with complete calls — the executions proceed
+                case "max_tokens":
+                    voided = { kind: "max_tokens" };
+                    break;
+                case "abort":
+                    voided = { kind: "aborted", by: "user" };
+                    break;
+                case "error":
+                    voided = {
+                        kind: "error",
+                        error: { code: "unknown", retryable: false, message: "provider stopped with an error" },
+                    };
+                    break;
+                default:
+                    voided = {
+                        kind: "error",
+                        error: {
+                            code: "invalid_request",
+                            retryable: false,
+                            message: `provider stopped with '${String(lastStop)}' with ${pending.length} tool call(s) launched`,
+                        },
+                    };
+                    break;
             }
         }
-        // ── Abort check: an abort now abandons the launched executions
-        //    (started without receipt → uncertain), exactly as before ──────
-        if (voided === null && aborted()) {
+        // ── EC-1 ① — TURN COMMIT ──────────────────────────────────────────
+        // The held stop is persisted HERE and only here: iterator done (the
+        // stream loop broke cleanly) AND structurally compatible (above). The
+        // append and the yield happen together, in the loop's ordinary order,
+        // so the durable log gains no event and loses none — only the MOMENT
+        // moves, and the projection is byte-identical. What it buys:
+        //
+        //   a durable compatible stop ⇔ this producer observed clean stream
+        //   exhaustion.
+        //
+        // The gate is released either way: a committed turn frees its
+        // handlers, a voided turn frees them to bail with no started event.
+        // An abort with calls in flight abandons the turn BEFORE it commits:
+        // the aborted turn leaves NO durable stop, so its calls stay an
+        // UNCOMMITTED DRAFT the resume voids (⑤) rather than a committed batch
+        // no one will ever execute — which would strand the model's tool_use
+        // blocks with no results (the EC1-F1 dangling-pair class). A turn with
+        // NO calls has nothing to abandon and still ends on its own stop
+        // reason, the pre-EC-1 order.
+        if (voided === null && pending.length > 0 && aborted()) {
+            settleTurn();
             yield await terminal({ kind: "aborted", by: "user" });
             return;
         }
-        // ── C group: the turn is verified. 0.1.26 (streaming execution): the calls were
-        // ALREADY launched at tool_call_end, so a non-compatible stop reason
-        // VOIDS the turn instead of preventing the execution.
-        if (voided === null && pending.length > 0) {
-            if (stopCount === 0) {
-                voided = {
-                    kind: "error",
-                    error: { code: "invalid_request", retryable: false, message: "provider stream ended without a stop event" },
-                };
-            }
-            else if (stopCount > 1) {
-                voided = {
-                    kind: "error",
-                    error: { code: "invalid_request", retryable: false, message: `provider emitted ${stopCount} stop events in one turn` },
-                };
-            }
-            else {
-                switch (lastStop) {
-                    case "tool_use":
-                    case "function_call":
-                        break; // compatible with complete calls — the executions proceed
-                    case "max_tokens":
-                        voided = { kind: "max_tokens" };
-                        break;
-                    case "abort":
-                        voided = { kind: "aborted", by: "user" };
-                        break;
-                    case "error":
-                        voided = {
-                            kind: "error",
-                            error: { code: "unknown", retryable: false, message: "provider stopped with an error" },
-                        };
-                        break;
-                    default:
-                        voided = {
-                            kind: "error",
-                            error: {
-                                code: "invalid_request",
-                                retryable: false,
-                                message: `provider stopped with '${String(lastStop)}' with ${pending.length} tool call(s) launched`,
-                            },
-                        };
-                        break;
-                }
-            }
+        if (voided === null && heldStop !== null) {
+            const full = log.append(heldStop);
+            if (hooks.onEvent)
+                await hooks.onEvent(full, {}).catch(() => { });
+            committed = true;
+            yield full;
+        }
+        settleTurn();
+        // A turn with no tool calls ends on its OWN stop reason (Phase B,
+        // Area 6) — never a blanket `completed`. Reached only once committed.
+        if (voided === null && pending.length === 0) {
+            yield await terminal(terminalForStop(lastStop));
+            return;
         }
         // ── The turn settles: a void fires the violated signal — the
         //    not-started executions bail (abort semantics — no started, no
@@ -526,6 +709,33 @@ export async function* loop(config) {
         if (launchError !== null)
             throw launchError;
         if (voided !== null) {
+            // EC-1 ⑤ — THE LIVE VOID. ① means a voided turn's commit-required
+            // call never ran, so nothing answers the `tool_use` its
+            // tool_call_end already persisted. The run ends here on its error
+            // terminal, and the recovery driver will never see it: its first
+            // rule is "the open run reached its terminal". So the NEXT turn of
+            // the same session would send the model an assistant tool_use with
+            // no result — the provider-400 class, live rather than after a
+            // crash. Pre-EC-1 the streaming launch had already answered the
+            // pair; closing the destructive hole opened this one.
+            //
+            // The fix is the instrument the resume already uses, produced here
+            // instead: the loop is a SECOND PRODUCER of `model_output_abandoned`
+            // (an existing variant — no new protocol surface, the frozen event
+            // contract holds). It voids the whole draft range, exactly as
+            // ABANDON_DRAFT does, and only when a call is still pure intent —
+            // a call with a durable started is a FACT, and the same rule as
+            // recovery-plan.ts's `unexecuted`. Idempotent by construction: the
+            // marker becomes the last boundary, so no later resume derives a
+            // second draft over the same range.
+            if (log.all.some((e) => e.type === "tool_call_end" &&
+                e.seq > turnStart &&
+                !log.all.some((x) => x.type === "tool_execution_started" && x.callId === e.callId))) {
+                const marker = log.append({ type: "model_output_abandoned", voidFromSeq: turnStart, reason: "the turn was voided before it committed" });
+                if (hooks.onEvent)
+                    await hooks.onEvent(marker, {}).catch(() => { });
+                yield marker;
+            }
             yield await terminal(voided);
             return;
         }

package/dist/kernel/mode.d.ts

@@ -6,21 +6,19 @@
  * - `visibleToolNames` — physical removal: the registry is subset() to these
  *   tools BEFORE the adapter is called. The model cannot call what it cannot
  *   see; no system-prompt overlay can make that guarantee.
- * - `systemOverlay` — appended to the system prompt by the harness (the
- *   kernel does not compose prompts); kept here because it is part of the
- *   mode's contract.
- * - `permissionDefault` — the decision onPreTool falls back to when no hook
- *   or store decides.
- * - `compactionKeepExtra` / `stopPredicate` — reserved (ADR-0011); read by
- *   the harness when the semantics land.
+ *
+ * That is the whole profile. SC-1b: `systemOverlay`, `permissionDefault`,
+ * `compactionKeepExtra`, and `stopPredicate` were REMOVED at 0.12.0 by the
+ * SC-1 memo's adjudication — all four were declared here and read by
+ * nothing, in the kernel or above it. Two of them ("reserved, read by the
+ * harness when the semantics land") had been waiting since mauri ADR-0011
+ * for semantics that never landed. A field that describes an intention
+ * rather than a behavior is a promise the type system makes on the
+ * kernel's behalf and the kernel does not keep; the honest profile is the
+ * one member that is actually applied.
  */
-import type { PermissionDecision } from "./permission.js";
 export interface ModeProfile {
     readonly name: string;
-    readonly systemOverlay?: string;
     readonly visibleToolNames?: readonly string[];
-    readonly permissionDefault?: PermissionDecision;
-    readonly compactionKeepExtra?: readonly string[];
-    readonly stopPredicate?: string;
 }
 export declare function resolveModeProfile(modes: readonly ModeProfile[] | undefined, name: string | undefined): ModeProfile | undefined;

package/dist/kernel/mode.js

@@ -6,13 +6,16 @@
  * - `visibleToolNames` — physical removal: the registry is subset() to these
  *   tools BEFORE the adapter is called. The model cannot call what it cannot
  *   see; no system-prompt overlay can make that guarantee.
- * - `systemOverlay` — appended to the system prompt by the harness (the
- *   kernel does not compose prompts); kept here because it is part of the
- *   mode's contract.
- * - `permissionDefault` — the decision onPreTool falls back to when no hook
- *   or store decides.
- * - `compactionKeepExtra` / `stopPredicate` — reserved (ADR-0011); read by
- *   the harness when the semantics land.
+ *
+ * That is the whole profile. SC-1b: `systemOverlay`, `permissionDefault`,
+ * `compactionKeepExtra`, and `stopPredicate` were REMOVED at 0.12.0 by the
+ * SC-1 memo's adjudication — all four were declared here and read by
+ * nothing, in the kernel or above it. Two of them ("reserved, read by the
+ * harness when the semantics land") had been waiting since mauri ADR-0011
+ * for semantics that never landed. A field that describes an intention
+ * rather than a behavior is a promise the type system makes on the
+ * kernel's behalf and the kernel does not keep; the honest profile is the
+ * one member that is actually applied.
  */
 export function resolveModeProfile(modes, name) {
     if (!name || !modes)

package/dist/kernel/permission.d.ts

@@ -5,9 +5,18 @@
  * allow one call, deny with a reason fed back to the model, or defer to a
  * human. The kernel's contract is only the decision shape; where decisions
  * are stored (accept-for-session) is harness territory (PermissionStore,
- * M2). M1 treats `defer` as a deny with reason "awaiting user" — the model
- * sees the refusal and can adjust; the human-in-the-loop wiring arrives
- * with the harness.
+ * M2).
+ *
+ * `defer` IS A REAL PAUSE. The M1 note that once lived here — "defer is a
+ * deny with reason 'awaiting user'; the human-in-the-loop wiring arrives
+ * with the harness" — described the behavior ADR-0024 decision #3 replaced,
+ * and that ADR's own Context names this note as the thing it fixed (a
+ * denial "fakes the pause": the model sees a refusal and adjusts while no
+ * human ever decided). Shipped now: the loop persists `permission_requested`
+ * and AWAITS the approval channel in the same run frame, the human's
+ * verdict is persisted as `permission_decided`, and the pause survives a
+ * crash (kernel/loop.ts). With no approval channel configured the deferral
+ * degrades to an HONEST denial that says so.
  */
 export type PermissionDecision = {
     readonly action: "allow";

package/dist/kernel/permission.js

@@ -5,9 +5,18 @@
  * allow one call, deny with a reason fed back to the model, or defer to a
  * human. The kernel's contract is only the decision shape; where decisions
  * are stored (accept-for-session) is harness territory (PermissionStore,
- * M2). M1 treats `defer` as a deny with reason "awaiting user" — the model
- * sees the refusal and can adjust; the human-in-the-loop wiring arrives
- * with the harness.
+ * M2).
+ *
+ * `defer` IS A REAL PAUSE. The M1 note that once lived here — "defer is a
+ * deny with reason 'awaiting user'; the human-in-the-loop wiring arrives
+ * with the harness" — described the behavior ADR-0024 decision #3 replaced,
+ * and that ADR's own Context names this note as the thing it fixed (a
+ * denial "fakes the pause": the model sees a refusal and adjusts while no
+ * human ever decided). Shipped now: the loop persists `permission_requested`
+ * and AWAITS the approval channel in the same run frame, the human's
+ * verdict is persisted as `permission_decided`, and the pause survives a
+ * crash (kernel/loop.ts). With no approval channel configured the deferral
+ * degrades to an HONEST denial that says so.
  */
 /** The denial a tool result carries when a call was refused pre-flight. */
 export function denialResult(reason) {

package/dist/kernel/project.d.ts

@@ -19,8 +19,10 @@
  * re-runs the compaction algorithm (a future version could differ, A group/D
  * group); `microcompacted` boundaries re-derive the cleared view from the
  * stream itself (deterministic and idempotent); `summarized` (ADR-0044)
- * replaces its covered range with one assistant summary message. All
- * three are persisted facts — the replay equals the live run. See ADR-0002.
+ * replaces its covered range with one USER message carrying the summary
+ * behind SUMMARY_FRAMING (E6's boundary honesty — see that constant
+ * below; it is deliberately NOT an assistant message). All three are
+ * persisted facts — the replay equals the live run. See ADR-0002.
  */
 import type { Event } from "../protocol/events.js";
 import type { EventInput } from "./event-log.js";

package/dist/kernel/project.js

@@ -19,8 +19,10 @@
  * re-runs the compaction algorithm (a future version could differ, A group/D
  * group); `microcompacted` boundaries re-derive the cleared view from the
  * stream itself (deterministic and idempotent); `summarized` (ADR-0044)
- * replaces its covered range with one assistant summary message. All
- * three are persisted facts — the replay equals the live run. See ADR-0002.
+ * replaces its covered range with one USER message carrying the summary
+ * behind SUMMARY_FRAMING (E6's boundary honesty — see that constant
+ * below; it is deliberately NOT an assistant message). All three are
+ * persisted facts — the replay equals the live run. See ADR-0002.
  */
 /**
  * C area: tools whose output is eligible for microcompact clearing — reads,
@@ -516,9 +518,13 @@ export function projectMessages(events) {
                 // its own range; the case documents the intent (and no flush:
                 // it must never split a message).
                 break;
-            case "microcompacted":
-                // handled above (the replacement pass) — no open message.
-                break;
+            // EC-1 (ruled in at the checkpoint): a SECOND `case
+            // "microcompacted"` sat here and was unreachable — the earlier
+            // case at the top of this switch owns the label, and in a
+            // JavaScript switch the first matching case wins. It never ran,
+            // it emitted a build warning ("this case clause will never be
+            // evaluated"), and it cost two lines of the kernel's budget.
+            // Removed; the microcompact replacement pass above is unchanged.
         }
     }
     flushAssistant();

package/dist/protocol/adapter.d.ts

@@ -8,9 +8,9 @@
  * events carry `seq`). The three properties that let a ReAct loop stream
  * without buffering and without losing its place.
  *
- * WHY not a `Promise<Event[]>`: a buffered adapter is what made agno's
- * streaming a second-class feature bolted onto a batch loop. The contract
- * shape IS the architecture — see ADR-0001.
+ * WHY not a `Promise<Event[]>`: a buffered adapter is what made the
+ * reference implementation's streaming a second-class feature bolted onto
+ * a batch loop. The contract shape IS the architecture — see ADR-0001.
  *
  * Adapters translate provider wire events INTO `Event`. They never see tool
  * handlers (only `ToolSpec` projections) — the kernel is the only thing that

package/dist/protocol/adapter.js

@@ -8,9 +8,9 @@
  * events carry `seq`). The three properties that let a ReAct loop stream
  * without buffering and without losing its place.
  *
- * WHY not a `Promise<Event[]>`: a buffered adapter is what made agno's
- * streaming a second-class feature bolted onto a batch loop. The contract
- * shape IS the architecture — see ADR-0001.
+ * WHY not a `Promise<Event[]>`: a buffered adapter is what made the
+ * reference implementation's streaming a second-class feature bolted onto
+ * a batch loop. The contract shape IS the architecture — see ADR-0001.
  *
  * Adapters translate provider wire events INTO `Event`. They never see tool
  * handlers (only `ToolSpec` projections) — the kernel is the only thing that

package/dist/protocol/events.d.ts

@@ -220,10 +220,17 @@ export interface ToolExecutionSucceeded {
     readonly tags?: readonly string[];
 }
 /**
- * The side effect ran and FAILED. `safeToRetry` is the tool's own proof
- * (declared idempotent): only then is a failure a clean "failed"; a
- * non-idempotent failure may have produced a side effect and is UNCERTAIN
- * until a human decides (Area 3).
+ * The side effect ran and FAILED. A complete receipt IS the outcome, so this
+ * execution is "failed" — NEVER "uncertain", whatever `safeToRetry` says
+ * (ADR-0038 superseding ADR-0025 decision #3: uncertainty belongs to the
+ * crash window alone — started, no receipt). The run does not pause here;
+ * siblings continue and the model retries with the error in hand, and that
+ * retry is a NEW call that re-passes the approval chain.
+ *
+ * `safeToRetry` is the tool's own `idempotent: true` declaration, carried
+ * for HISTORY: since ADR-0038 it no longer feeds the ledger's status
+ * derivation (runtime/ledger.ts). Its one live consequence is the honest
+ * note appended to a non-idempotent failure's result (ADR-0038 Amendment 1).
  */
 export interface ToolExecutionFailed {
     readonly seq: number;
@@ -294,11 +301,20 @@ export interface PermissionExpired {
     readonly reason: string;
 }
 /**
- * A non-idempotent execution FAILED and the run PAUSES until a human
- * decides (C group): no next model turn, no sibling tool, no auto-retry. The
- * verdict is recorded by the session (resolveUncertain) and the ledger
- * transitions uncertain → rerun/abandoned; the event itself is the durable
- * pause marker.
+ * HISTORICAL — the current kernel NEVER emits this event.
+ *
+ * It marked the C group's failed-receipt pause: a non-idempotent execution
+ * that FAILED paused the run until a human ruled. ADR-0038 removed that
+ * pause (a complete receipt IS the outcome), so nothing appends this any
+ * more — pinned by `packages/core/tests/execution-gate.test.ts` and
+ * `packages/runtime/tests/execution.test.ts`, which assert its ABSENCE.
+ *
+ * The variant stays because the durable contract is frozen (ADR-0051) and
+ * old logs replay theirs verbatim (ADR-0038, Consequences): the projection
+ * renders nothing for it, and the ledger reports those receipted executions
+ * as "failed". The crash window — started, no receipt — is now the only
+ * source of uncertainty, and it is resolved through
+ * `uncertainExecutions()` / `resolveUncertain()`, not through this event.
  */
 export interface UncertainPending {
     readonly seq: number;
@@ -342,9 +358,11 @@ export interface MicroCompactEvent {
  * range. `coversToSeq` is the seq of the LAST covered event; the covered
  * range runs from just past the previous `summarized` event's coversToSeq
  * (or the trajectory's start for the first) up to coversToSeq. The
- * projection replaces exactly those events with ONE assistant summary
- * message (`summary`); every `summarized` event always renders its own
- * message. Byte-stable: a summarized event is a persisted fact, so the
+ * projection replaces exactly those events with ONE USER message carrying
+ * the summary behind a fixed framing line (E6's boundary honesty: the
+ * model reads compressed history as CONTEXT, never as a reply it produced
+ * — see SUMMARY_FRAMING in kernel/project.ts). It is not an assistant
+ * message; every `summarized` event always renders its own message. Byte-stable: a summarized event is a persisted fact, so the
  * same events derive the same messages on every replay.
  *
  * The summary is generated OFF-LOOP through the session's own adapter —

package/dist/protocol/extension.d.ts

@@ -83,7 +83,7 @@ export interface KisoExtension {
      * E2: EXTEND the system prompt — append-only, never replace (a replace
      * is a footgun; appends guarantee "adding an extension never removes
      * existing guidance" — the monotonicity family of the approval chain's
-     * deny>ask>allow and the veto short-circuit). The session's own
+     * deny > allow > ask and the veto short-circuit). The session's own
      * systemPrompt comes first, then each extension's append in load order,
      * \n\n-joined.
      */

package/dist/protocol/messages.d.ts

@@ -10,7 +10,12 @@
  * carries images. Forcing every caller into the array shape to serve the
  * 5% that need vision is a tax paid on every line of product code.
  *
- * See ADR-0003 (sum type) and ADR-0008 (tool contract).
+ * See ADR-0003 (sum type). The tool contract's record is mauri ADR-0008 —
+ * the PREDECESSOR series, cited the same way in kernel/hooks.ts and
+ * kernel/mode.ts: kiso's own numbers 0006-0019 were NEVER assigned
+ * (docs/adrs/README.md), so an unprefixed "ADR-0008" sends a reader to a
+ * record that does not exist in this repo. The live tool contract is
+ * tools/tool.ts itself.
  *
  * This module is types-only: it compiles to nothing.
  */
@@ -107,8 +112,12 @@ export type Message = UserMessage | AssistantMessage | ToolResultMessage;
 /**
  * What the adapter advertises to the model.
  *
- * Deliberately minimal: the full tool (handler, repair, concurrency, dedup)
- * is L3-internal and an adapter must never see it. An adapter that can reach
+ * Deliberately minimal: the full tool (the handler above all, plus the
+ * declarations the kernel keeps to itself) is L3-internal and an adapter
+ * must never see it. NB the historical list here named a `repair` member
+ * and a `dedup` member — neither exists on `Tool`: the (name, input) dedup
+ * guard was removed by ADR-0025, and repair means RECEIPT repair, which is
+ * the runtime's, not a tool's. An adapter that can reach
  * the handler will eventually call it, and then the kernel is no longer the
  * only thing that runs tools.
  */

package/dist/protocol/messages.js

@@ -10,7 +10,12 @@
  * carries images. Forcing every caller into the array shape to serve the
  * 5% that need vision is a tax paid on every line of product code.
  *
- * See ADR-0003 (sum type) and ADR-0008 (tool contract).
+ * See ADR-0003 (sum type). The tool contract's record is mauri ADR-0008 —
+ * the PREDECESSOR series, cited the same way in kernel/hooks.ts and
+ * kernel/mode.ts: kiso's own numbers 0006-0019 were NEVER assigned
+ * (docs/adrs/README.md), so an unprefixed "ADR-0008" sends a reader to a
+ * record that does not exist in this repo. The live tool contract is
+ * tools/tool.ts itself.
  *
  * This module is types-only: it compiles to nothing.
  */

package/dist/tools/tool.d.ts

@@ -4,9 +4,16 @@
  * A tool is a pure declaration + handler pair. The kernel never branches on
  * a tool's internals: `parameters` is a JSON Schema the kernel validates and
  * projects to the adapter as `ToolSpec` (adapter never sees the handler —
- * see ADR-0001), `concurrencySafe` decides batch scheduling, `delivers`
- * marks a tool as an artifact producer (consumed by harness-side delivery
- * tracking; the kernel only carries the flag).
+ * see ADR-0001).
+ *
+ * SC-1b: `concurrencySafe` and `delivers` were REMOVED at 0.12.0 by the
+ * SC-1 memo's adjudication — both were declared and consulted by nothing.
+ * Their absence is the honest contract; the concurrency RACE they were
+ * mistaken for a defense against is a real open question and moved to EC-1,
+ * which owes a mechanism that does not depend on a per-tool opt-in.
+ * Delivery truth is named by the CALLER (`DeliveryConfig.producers`), which
+ * is where it always actually lived — and since EC-1 that verdict lives in
+ * kiso-evals (governance/delivery.ts there), not in the kernel at all.
  *
  * WHY JSON Schema instead of a runtime library: the kernel has zero runtime
  * dependencies (ADR-0001). Zod / TypeBox / valibot live at the harness layer;
@@ -49,24 +56,62 @@ export interface Tool<I = unknown> {
     /** JSON Schema (draft-07 subset). Validated before execute. */
     readonly parameters: Readonly<Record<string, unknown>>;
     /**
-     * Per-call concurrency predicate — a shape the reference implementation's
-     * static executionMode cannot express: the same tool may be parallel-safe for one
-     * input and must be serial for another (generate_image with
-     * `chain_to_previous`). Absent = safe when true-ish; see ADR-0015.
+     * The tool's own declaration that REPEATING its side effect is safe
+     * (reads, searches, pure computations).
+     *
+     * It is NOT a dedup guard. The kernel runs every logical call, including
+     * one whose (name, input) is identical to an earlier one — ADR-0024
+     * decision #2's (name, input) guard was REMOVED by ADR-0025 decision #1
+     * ("NO (name, input) dedup", kernel/loop.ts). Exactly-once is enforced
+     * by execution IDENTITY instead: a confirmed success is never
+     * re-executed (a lost model-facing result is repaired FROM the durable
+     * receipt), and an execution that STARTED without reporting — the crash
+     * window — waits for a human verdict. A FAILED execution is failed, not
+     * uncertain: a complete receipt IS the outcome (ADR-0038).
+     *
+     * What this flag actually decides, and nothing more:
+     *   - a failure from a tool that did NOT declare it carries the honest
+     *     "side effects may have partially applied; verify before retrying"
+     *     note on the result (ADR-0038 Amendment 1);
+     *   - it rides the durable receipt as `tool_execution_failed.safeToRetry`
+     *     — history only, since ADR-0038 stopped it feeding ledger status.
+     *
+     * Undeclared is the safe side: unknown idempotency means the note
+     * applies. A retry is a NEW call and re-passes the approval chain.
      */
-    readonly concurrencySafe?: (input: I) => boolean;
-    /** Marks this tool as an artifact producer (harness-side delivery truth). */
-    readonly delivers?: {
-        readonly kind: string;
-    };
+    readonly idempotent?: boolean;
     /**
-     * Exactly-once guard escape hatch (Phase D): a tool whose side effects
-     * are safe to repeat (reads, searches, pure computations) declares
-     * `idempotent: true`. Without it, the kernel refuses to run the same
-     * tool+input twice in a session — a confirmed success is replayed, an
-     * interrupted attempt blocks. The default is the safe side.
+     * EC-1 — an OPTIMIZATION CERTIFICATE, never a safety claim.
+     *
+     * Read the type carefully: there is no `"exclusive"`, and there is no
+     * `false`. ABSENCE is the conservative truth — an undeclared tool is
+     * commit-required and exclusive — so the type system cannot express a
+     * claim that something unsafe is safe. Correctness comes from absence;
+     * a declaration only buys performance back. That is the whole reason
+     * this field is shaped so oddly, and it is the lesson SC-1b paid for:
+     * `concurrencySafe` and `delivers` were declarations the kernel never
+     * read, so they were fiction. The kernel ENFORCES both of these, in the
+     * same round that introduces them.
+     *
+     *   precommitSafe — "running this before the turn commits is harmless:
+     *   read-only AND free AND local, for EVERY invocation." Only such a
+     *   call may start before Turn Commit, and only when its authorization
+     *   is already satisfied (auto-allowed). Its execution never makes an
+     *   uncommitted turn valid (invariant 7).
+     *
+     *   concurrency: "shared" — "EVERY invocation may overlap every
+     *   sibling." Without it the kernel serializes the tool behind a FIFO
+     *   exclusive barrier, which is what closes the same-path write race:
+     *   two edit_file calls on one path can no longer interleave.
+     *
+     * Per-call conflict granularity (a resourceKey) stays future and
+     * evidence-gated: this field is per-TOOL on purpose, because a per-call
+     * claim is exactly the kind the type system could not police.
      */
-    readonly idempotent?: boolean;
+    readonly effects?: {
+        readonly precommitSafe?: true;
+        readonly concurrency?: "shared";
+    };
     /** R-C: ONE line for the system prompt — the tool's role, never the
      *  schema (the full description rides the JSON schema the provider
      *  transmits anyway — never pay twice). */

package/dist/tools/tool.js

@@ -4,9 +4,16 @@
  * A tool is a pure declaration + handler pair. The kernel never branches on
  * a tool's internals: `parameters` is a JSON Schema the kernel validates and
  * projects to the adapter as `ToolSpec` (adapter never sees the handler —
- * see ADR-0001), `concurrencySafe` decides batch scheduling, `delivers`
- * marks a tool as an artifact producer (consumed by harness-side delivery
- * tracking; the kernel only carries the flag).
+ * see ADR-0001).
+ *
+ * SC-1b: `concurrencySafe` and `delivers` were REMOVED at 0.12.0 by the
+ * SC-1 memo's adjudication — both were declared and consulted by nothing.
+ * Their absence is the honest contract; the concurrency RACE they were
+ * mistaken for a defense against is a real open question and moved to EC-1,
+ * which owes a mechanism that does not depend on a per-tool opt-in.
+ * Delivery truth is named by the CALLER (`DeliveryConfig.producers`), which
+ * is where it always actually lived — and since EC-1 that verdict lives in
+ * kiso-evals (governance/delivery.ts there), not in the kernel at all.
  *
  * WHY JSON Schema instead of a runtime library: the kernel has zero runtime
  * dependencies (ADR-0001). Zod / TypeBox / valibot live at the harness layer;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincemakes/kiso-core",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "kiso (foundation) core — protocol, event log, loop, hooks, modes, permissions, compaction, delivery truth. The 2,000-line kernel at the bottom of the kiso framework.",
   "type": "module",
   "license": "MIT",
@@ -33,7 +33,7 @@
     "openai"
   ],
   "devDependencies": {
-    "@vincemakes/kiso-evals": "0.11.0",
+    "@vincemakes/kiso-evals": "0.13.0",
     "@types/node": "^26.1.2",
     "typescript": "^5.7.2",
     "vitest": "^3.0.0"