@vincemakes/kiso-core 0.12.0 → 0.14.0

package/dist/index.d.ts

@@ -9,4 +9,3 @@ export * from "./kernel/permission.js";
 export * from "./kernel/loop.js";
 export * from "./kernel/compaction.js";
 export * from "./kernel/project.js";
-export * from "./governance/delivery.js";

package/dist/index.js

@@ -9,4 +9,3 @@ export * from "./kernel/permission.js";
 export * from "./kernel/loop.js";
 export * from "./kernel/compaction.js";
 export * from "./kernel/project.js";
-export * from "./governance/delivery.js";

package/dist/kernel/loop.js

@@ -205,11 +205,33 @@ export async function* loop(config) {
     // rejection un-consumed — the no-op keeps it from surfacing as an
     // unhandled rejection while the race consumers still receive it.
     void violatedP.catch(() => { });
+    // ── EC-1 ① — the DURABLE TURN COMMIT gate ──────────────────────────────
+    // Invariant 3 (COMMIT GATING): a commit-required handler never starts
+    // before this turn's stop is DURABLE. The gate RESOLVES exactly once per
+    // turn — at the commit, or at the void — and the waiter then reads
+    // `committed`. It deliberately does not reuse `violatedP`: that one
+    // REJECTS, and a rejection awaited here would be caught by the launch's
+    // catch and recorded as a launchError, failing the whole run for what is
+    // an ordinary void. A gate that resolves keeps the void path quiet.
+    // Both are reset per turn (below): turn N+1's calls wait for turn N+1's
+    // commit. Safe because the settle drains every launch before the turn
+    // advances, so no launch ever waits on a stale gate.
+    let committed = false;
+    let settleTurn = () => { };
+    let turnSettled = new Promise((res) => {
+        settleTurn = res;
+    });
     // The ask gate: an ask's human resolution blocks the calls after it.
     // The DECIDE chain serializes the decisions in CALL order, so the gate
     // an ask installs is structurally in place before the successors decide.
+    // EC-1 ③: it must be installed THERE and not at the ask itself, even
+    // though the ask now happens later (post-commit): the gate is what a
+    // precommit-eligible sibling consults to know an ask was accepted ahead
+    // of it, and that has to be knowable BEFORE the commit. Each call
+    // captures the gate ahead of it and its own release (below) — one shared
+    // `askRelease` used to mean the first ask's resolution opened the SECOND
+    // ask's gate.
     let askGate = Promise.resolve();
-    let askRelease = null;
     // The decision chain: each launch's decide is chained onto the previous
     // one's — the decides run in CALL order and the chain resolves to the
     // call's verdict.
@@ -219,16 +241,57 @@ export async function* loop(config) {
     // keys (the executionId comes from the drain, seq-stable).
     let idSeq = log.all.length + 1;
     const nextDecisionId = () => `d-${idSeq++}`;
+    // ── EC-1 ② / ③ — the FIFO EXCLUSIVE BARRIER ────────────────────────────
+    // Absence is the conservative truth: a tool that declares nothing is
+    // EXCLUSIVE, and the kernel serializes it. `concurrency: "shared"` is the
+    // only way to overlap, and it is a per-TOOL certificate the kernel
+    // enforces — never a per-call claim it could not police.
+    //
+    // The fence is installed at ACCEPTANCE (in `launch`, i.e. CALL order),
+    // not when a handler starts: that is what makes it FIFO. A later sibling
+    // — including a precommit-safe read — never overtakes an exclusive
+    // invocation accepted before it, so a read can never observe a
+    // half-written file. A read after a write therefore loses its latency
+    // win; safe overtaking and snapshot semantics stay future work.
+    let fence = Promise.resolve();
+    const sharedRunning = [];
+    /** Reserve this call's place in the FIFO: what it must await before
+     *  running, and the release to call once its handler is done. */
+    const reserve = (tool) => {
+        const shared = tool?.effects?.concurrency === "shared";
+        let release;
+        const done = new Promise((res) => {
+            release = res;
+        });
+        // An exclusive invocation waits for the fence AND every shared call
+        // already accepted ahead of it — while it runs, it runs alone.
+        const wait = shared ? fence : Promise.all([fence, ...sharedRunning]).then(() => undefined);
+        if (shared)
+            sharedRunning.push(done);
+        else {
+            fence = done;
+            sharedRunning.length = 0;
+        }
+        return { wait, release };
+    };
     const launch = (call) => {
         execActive += 1;
+        const tool = registry.get(call.name);
+        const slot = reserve(tool);
+        // EC-1 ③ — this call's place in the ASK order, filled in by the
+        // decide chain (call order). `ahead` is the gate of an ask ACCEPTED
+        // BEFORE this call; `release` opens this call's own gate for its
+        // successors and stays a no-op unless this call asks. Per-call, so
+        // two asks in one turn queue honestly instead of sharing one release.
+        const askOrder = { ahead: Promise.resolve(), release: () => { } };
         launches.push((async () => {
             try {
-                await acquireWindow();
                 decideChain = decideChain.then(async () => {
                     const v = await decideCall(call, registry, hooks, { signal: signal ?? NEVER_ABORT, ...(config.sessionId !== undefined ? { sessionId: config.sessionId } : {}) }, log, config.resolveApproval, config.approvalVerdict, signal, config.approvalPolicy, nextDecisionId, pushExec);
+                    askOrder.ahead = askGate;
                     if (v.action === "ask") {
                         askGate = new Promise((res) => {
-                            askRelease = res;
+                            askOrder.release = res;
                         });
                     }
                     return v;
@@ -240,33 +303,94 @@ export async function* loop(config) {
                     pushExec(verdict.result);
                     return;
                 }
+                // the conservative order: the calls AFTER an ask wait for its
+                // human resolution. The context may have changed when the
+                // human approves — which is why even a precommit-safe read
+                // accepted after an ask waits here rather than racing ahead.
+                await askOrder.ahead;
+                if (violated)
+                    return;
                 if (verdict.action === "ask") {
-                    // The human pause — abortable by a user abort OR a turn
-                    // void (the violated promise). The gate opens when the
-                    // human decides, whatever the outcome (conservative
-                    // ordering: the successors then proceed with their own
-                    // verdicts).
-                    const decision = await Promise.race([
-                        humanPause(call, verdict.decisionId, hooks, log, config.resolveApproval, config.approvalVerdict, signal, pushExec, verdict.speaker),
-                        violatedP,
-                    ]);
-                    askRelease?.();
-                    askRelease = null;
-                    if (violated)
-                        return;
-                    if (decision.action !== "allow") {
-                        // the reason rides the denial — the human's words,
-                        // or the honest "no approval flow configured".
-                        pushExec(resultEvent(call, denialResult(decision.reason ?? "denied")));
-                        return;
+                    try {
+                        // EC-1 ③ — THE POST-COMMIT ASK. A human must never
+                        // be asked to approve a call whose turn then proves
+                        // invalid, so the pause waits for this turn's OWN
+                        // commit exactly like a handler does. On an
+                        // uncommitted turn the call bails here having asked
+                        // NOTHING and started nothing. (Before EC-1 the
+                        // question was put to a person mid-stream, and a
+                        // provider that violated the protocol after its stop
+                        // made that person's "yes" authorize a turn the
+                        // kernel then voided.)
+                        await turnSettled;
+                        if (!committed)
+                            return;
+                        // The human pause — abortable by a user abort OR a
+                        // turn void (the violated promise). Post-commit a
+                        // void can no longer reach this branch; the race
+                        // stays as the cheap structural guarantee that it
+                        // never could.
+                        const decision = await Promise.race([
+                            humanPause(call, verdict.decisionId, hooks, log, config.resolveApproval, config.approvalVerdict, signal, pushExec, verdict.speaker),
+                            violatedP,
+                        ]);
+                        if (violated)
+                            return;
+                        if (decision.action !== "allow") {
+                            // the reason rides the denial — the human's words,
+                            // or the honest "no approval flow configured".
+                            pushExec(resultEvent(call, denialResult(decision.reason ?? "denied")));
+                            return;
+                        }
                     }
+                    finally {
+                        // The gate opens the moment the human's part is over
+                        // — whatever the outcome, and on every bail path:
+                        // successors wait for the VERDICT, never for this
+                        // call's handler, and a turn that voids before the
+                        // ask must not strand them.
+                        askOrder.release();
+                    }
+                }
+                else if (tool?.effects?.precommitSafe !== true) {
+                    // EC-1 ① (invariant 3, COMMIT GATING): the handler waits
+                    // for this turn's OWN commit. An uncommitted turn never
+                    // reaches a handler — the call bails here having emitted
+                    // NO started event, so it is clean, never uncertain
+                    // (abort semantics). This is the whole of "an invalid
+                    // turn never starts a commit-required tool handler".
+                    //
+                    // EC-1 ③(b) — THE PRECOMMIT LAUNCH RULE is the `else`
+                    // this branch is guarded by: a call skips the commit
+                    // gate iff its tool declares `precommitSafe` AND its
+                    // authorization is ALREADY satisfied — an `allow`
+                    // verdict, no human in the loop. Both halves are
+                    // necessary: the certificate says the EXECUTION is
+                    // harmless (read-only, free, local, universally), never
+                    // that the authorization is unnecessary. Such a call may
+                    // run on a turn that later voids; invariant 7 owns that
+                    // outcome — the receipt is an honest fact and the turn
+                    // stays uncommitted.
+                    await turnSettled;
+                    if (!committed)
+                        return;
+                }
+                // EC-1 ③ (invariants 5 + 6): wait behind the FIFO barrier,
+                // and only THEN take a window slot. Waiting — for the
+                // commit, for a human, or for the barrier — consumes no
+                // slot: the window is an EXECUTION window, not a
+                // pending-invocation window, so four held writes can never
+                // starve a runnable sibling.
+                await slot.wait;
+                if (violated)
+                    return;
+                await acquireWindow();
+                try {
+                    await runLedgered(call, registry, hooks, { signal: signal ?? NEVER_ABORT, ...(config.sessionId !== undefined ? { sessionId: config.sessionId } : {}) }, signal, pushExec);
+                }
+                finally {
+                    releaseWindow();
                 }
-                // the conservative order: the calls AFTER an ask wait for its human
-                // resolution (the askGate is the ask's pause promise —
-                // resolved by default, released by the ask branch above).
-                // The context may have changed when the human approves.
-                await askGate;
-                await runLedgered(call, registry, hooks, { signal: signal ?? NEVER_ABORT, ...(config.sessionId !== undefined ? { sessionId: config.sessionId } : {}) }, signal, pushExec);
             }
             catch (err) {
                 // The abort sentinel (a user cancel during the decide or
@@ -277,7 +401,12 @@ export async function* loop(config) {
                     launchError ??= err;
             }
             finally {
-                releaseWindow();
+                // The barrier and the ask gate are released on EVERY exit —
+                // a denial, an uncommitted turn, an abort — or the siblings
+                // queued behind this call would wait forever. (Releasing an
+                // already-open gate is a no-op: a promise resolves once.)
+                askOrder.release();
+                slot.release();
                 execActive -= 1;
             }
         })());
@@ -325,6 +454,25 @@ export async function* loop(config) {
         // user_input, …) from the stream is a FORGERY and must never reach
         // the log.
         let forgedEvent = false;
+        // EC-1 ①: a SECOND stop voids the turn — and unlike the pre-EC-1 path
+        // (which appended both, leaving two stops in the log forever), NEITHER
+        // stop is persisted now. A deliberate improvement of that class.
+        let duplicateStop = false;
+        // EC-1 ①: the turn's stop, HELD in memory until the stream proves
+        // clean. It is neither appended NOR yielded here — yield order must
+        // equal append order (persistence-ownership.test.ts), so the hold
+        // covers both, and the commit below performs both together.
+        let heldStop = null;
+        // EC-1 ⑤ (the live void): the last durable event BEFORE this turn's
+        // model output — the previous turn's stop, the user input, or a
+        // microcompact boundary. Everything after it is this turn's draft,
+        // which is exactly the range a void must abandon.
+        const turnStart = log.lastSeq;
+        // EC-1 ①: this turn's commit gate — reset BEFORE any call can launch.
+        committed = false;
+        turnSettled = new Promise((res) => {
+            settleTurn = res;
+        });
         while (true) {
             // Area 4: the backoff is abortable — a cancel landing during a
             // retry wait ends the run now, not after the backoff.
@@ -370,9 +518,24 @@ export async function* loop(config) {
                         break;
                     }
                     if (ev.type === "stop") {
+                        // EC-1 ① — DURABLE TURN COMMIT. The stop is HELD, not
+                        // persisted: before EC-1 it was appended the instant it
+                        // arrived, so a stop could be durable while the stream
+                        // was still running — and the recovery keyed "this turn
+                        // committed" on exactly that durable stop. The two
+                        // truths are now one: a durable compatible stop means
+                        // THIS producer observed clean stream exhaustion.
+                        if (sawStop) {
+                            duplicateStop = true;
+                            violated = true;
+                            violatedReject();
+                            break;
+                        }
                         sawStop = true;
                         lastStop = ev.reason;
                         stopCount += 1;
+                        heldStop = ev;
+                        continue;
                     }
                     // R-E 0.1.43: the append precedes the launch — the call's
                     // framework seq is assigned here; invocationSeq must never
@@ -430,78 +593,98 @@ export async function* loop(config) {
                 error: { code: "invalid_request", retryable: false, message: "provider emitted events after its stop event" },
             };
         }
-        else if (pending.length === 0) {
-            // Area 6: protocol anomalies are STRUCTURED ERRORS, never a
-            // default `completed` — a stream with no stop, a duplicate stop,
-            // or a tool_use that never produced a complete call.
-            if (stopCount === 0) {
-                voided = {
-                    kind: "error",
-                    error: { code: "invalid_request", retryable: false, message: "provider stream ended without a stop event" },
-                };
-            }
-            else if (stopCount > 1) {
-                voided = {
-                    kind: "error",
-                    error: { code: "invalid_request", retryable: false, message: `provider emitted ${stopCount} stop events in one turn` },
-                };
-            }
-            else {
-                yield await terminal(terminalForStop(lastStop));
-                return;
+        else if (duplicateStop) {
+            // EC-1 ①: a second stop. The pre-EC-1 path appended BOTH and voided
+            // afterwards, so a duplicate-stop turn left two stops in the log
+            // forever; now neither is durable — the turn simply never commits.
+            voided = {
+                kind: "error",
+                error: { code: "invalid_request", retryable: false, message: `provider emitted ${stopCount + 1} stop events in one turn` },
+            };
+        }
+        else if (stopCount === 0) {
+            // Area 6: protocol anomalies are STRUCTURED ERRORS, never a default
+            // `completed`. EC-1 ①: ONE arm now, not two — the pre-EC-1 code
+            // duplicated this verdict across the pending/no-pending split, where
+            // it never differed.
+            voided = {
+                kind: "error",
+                error: { code: "invalid_request", retryable: false, message: "provider stream ended without a stop event" },
+            };
+        }
+        else if (pending.length > 0) {
+            // C group: STRUCTURAL COMPATIBILITY — a stop reason that cannot
+            // carry tool calls voids the turn. EC-1 ①: this is now the second
+            // half of the commit condition and runs BEFORE the commit, so an
+            // incompatible turn never persists its stop; combined with the
+            // commit gate its calls never became effects either (pre-EC-1 they
+            // had already launched, and the void could only let their receipts
+            // land after the fact).
+            switch (lastStop) {
+                case "tool_use":
+                case "function_call":
+                    break; // compatible with complete calls — the executions proceed
+                case "max_tokens":
+                    voided = { kind: "max_tokens" };
+                    break;
+                case "abort":
+                    voided = { kind: "aborted", by: "user" };
+                    break;
+                case "error":
+                    voided = {
+                        kind: "error",
+                        error: { code: "unknown", retryable: false, message: "provider stopped with an error" },
+                    };
+                    break;
+                default:
+                    voided = {
+                        kind: "error",
+                        error: {
+                            code: "invalid_request",
+                            retryable: false,
+                            message: `provider stopped with '${String(lastStop)}' with ${pending.length} tool call(s) launched`,
+                        },
+                    };
+                    break;
             }
         }
-        // ── Abort check: an abort now abandons the launched executions
-        //    (started without receipt → uncertain), exactly as before ──────
-        if (voided === null && aborted()) {
+        // ── EC-1 ① — TURN COMMIT ──────────────────────────────────────────
+        // The held stop is persisted HERE and only here: iterator done (the
+        // stream loop broke cleanly) AND structurally compatible (above). The
+        // append and the yield happen together, in the loop's ordinary order,
+        // so the durable log gains no event and loses none — only the MOMENT
+        // moves, and the projection is byte-identical. What it buys:
+        //
+        //   a durable compatible stop ⇔ this producer observed clean stream
+        //   exhaustion.
+        //
+        // The gate is released either way: a committed turn frees its
+        // handlers, a voided turn frees them to bail with no started event.
+        // An abort with calls in flight abandons the turn BEFORE it commits:
+        // the aborted turn leaves NO durable stop, so its calls stay an
+        // UNCOMMITTED DRAFT the resume voids (⑤) rather than a committed batch
+        // no one will ever execute — which would strand the model's tool_use
+        // blocks with no results (the EC1-F1 dangling-pair class). A turn with
+        // NO calls has nothing to abandon and still ends on its own stop
+        // reason, the pre-EC-1 order.
+        if (voided === null && pending.length > 0 && aborted()) {
+            settleTurn();
             yield await terminal({ kind: "aborted", by: "user" });
             return;
         }
-        // ── C group: the turn is verified. 0.1.26 (streaming execution): the calls were
-        // ALREADY launched at tool_call_end, so a non-compatible stop reason
-        // VOIDS the turn instead of preventing the execution.
-        if (voided === null && pending.length > 0) {
-            if (stopCount === 0) {
-                voided = {
-                    kind: "error",
-                    error: { code: "invalid_request", retryable: false, message: "provider stream ended without a stop event" },
-                };
-            }
-            else if (stopCount > 1) {
-                voided = {
-                    kind: "error",
-                    error: { code: "invalid_request", retryable: false, message: `provider emitted ${stopCount} stop events in one turn` },
-                };
-            }
-            else {
-                switch (lastStop) {
-                    case "tool_use":
-                    case "function_call":
-                        break; // compatible with complete calls — the executions proceed
-                    case "max_tokens":
-                        voided = { kind: "max_tokens" };
-                        break;
-                    case "abort":
-                        voided = { kind: "aborted", by: "user" };
-                        break;
-                    case "error":
-                        voided = {
-                            kind: "error",
-                            error: { code: "unknown", retryable: false, message: "provider stopped with an error" },
-                        };
-                        break;
-                    default:
-                        voided = {
-                            kind: "error",
-                            error: {
-                                code: "invalid_request",
-                                retryable: false,
-                                message: `provider stopped with '${String(lastStop)}' with ${pending.length} tool call(s) launched`,
-                            },
-                        };
-                        break;
-                }
-            }
+        if (voided === null && heldStop !== null) {
+            const full = log.append(heldStop);
+            if (hooks.onEvent)
+                await hooks.onEvent(full, {}).catch(() => { });
+            committed = true;
+            yield full;
+        }
+        settleTurn();
+        // A turn with no tool calls ends on its OWN stop reason (Phase B,
+        // Area 6) — never a blanket `completed`. Reached only once committed.
+        if (voided === null && pending.length === 0) {
+            yield await terminal(terminalForStop(lastStop));
+            return;
         }
         // ── The turn settles: a void fires the violated signal — the
         //    not-started executions bail (abort semantics — no started, no
@@ -526,6 +709,33 @@ export async function* loop(config) {
         if (launchError !== null)
             throw launchError;
         if (voided !== null) {
+            // EC-1 ⑤ — THE LIVE VOID. ① means a voided turn's commit-required
+            // call never ran, so nothing answers the `tool_use` its
+            // tool_call_end already persisted. The run ends here on its error
+            // terminal, and the recovery driver will never see it: its first
+            // rule is "the open run reached its terminal". So the NEXT turn of
+            // the same session would send the model an assistant tool_use with
+            // no result — the provider-400 class, live rather than after a
+            // crash. Pre-EC-1 the streaming launch had already answered the
+            // pair; closing the destructive hole opened this one.
+            //
+            // The fix is the instrument the resume already uses, produced here
+            // instead: the loop is a SECOND PRODUCER of `model_output_abandoned`
+            // (an existing variant — no new protocol surface, the frozen event
+            // contract holds). It voids the whole draft range, exactly as
+            // ABANDON_DRAFT does, and only when a call is still pure intent —
+            // a call with a durable started is a FACT, and the same rule as
+            // recovery-plan.ts's `unexecuted`. Idempotent by construction: the
+            // marker becomes the last boundary, so no later resume derives a
+            // second draft over the same range.
+            if (log.all.some((e) => e.type === "tool_call_end" &&
+                e.seq > turnStart &&
+                !log.all.some((x) => x.type === "tool_execution_started" && x.callId === e.callId))) {
+                const marker = log.append({ type: "model_output_abandoned", voidFromSeq: turnStart, reason: "the turn was voided before it committed" });
+                if (hooks.onEvent)
+                    await hooks.onEvent(marker, {}).catch(() => { });
+                yield marker;
+            }
             yield await terminal(voided);
             return;
         }
@@ -826,7 +1036,7 @@ async function runLedgered(call, registry, hooks, ctx, signal, push) {
         // observes ctx.signal, but the gate itself must not invoke it after
         // a cancel.
         result = signal?.aborted
-            ? { content: "aborted before execution", isError: true, errorKind: "fatal" }
+            ? { content: "aborted before execution", isError: true, errorKind: "precondition" }
             : await tool.execute(call.input, ctx);
     }
     catch (err) {
@@ -844,8 +1054,10 @@ async function runLedgered(call, registry, hooks, ctx, signal, push) {
     // receipt below, losslessly — a crash-window repair of the tool_result
     // reproduces the normal path). Idempotent failures carry no note; the
     // MCP bridge maps tools without declaring idempotency, so unknown
-    // idempotency = the note applies (honest).
-    if (result.isError && tool.idempotent !== true) {
+    // idempotency = the note applies (honest). WR-1-F1: a PRECONDITION
+    // refusal is work refused BEFORE it starts — by the kind's own
+    // contract nothing ran, so the note would be a false statement there.
+    if (result.isError && result.errorKind !== "precondition" && tool.idempotent !== true) {
         result = {
             ...result,
             content: `${result.content}\n[non-idempotent tool failed — its side effects may have partially applied; verify before retrying]`,

package/dist/kernel/project.js

@@ -518,9 +518,13 @@ export function projectMessages(events) {
                 // its own range; the case documents the intent (and no flush:
                 // it must never split a message).
                 break;
-            case "microcompacted":
-                // handled above (the replacement pass) — no open message.
-                break;
+            // EC-1 (ruled in at the checkpoint): a SECOND `case
+            // "microcompacted"` sat here and was unreachable — the earlier
+            // case at the top of this switch owns the label, and in a
+            // JavaScript switch the first matching case wins. It never ran,
+            // it emitted a build warning ("this case clause will never be
+            // evaluated"), and it cost two lines of the kernel's budget.
+            // Removed; the microcompact replacement pass above is unchanged.
         }
     }
     flushAssistant();

package/dist/tools/tool.d.ts

@@ -11,8 +11,9 @@
  * Their absence is the honest contract; the concurrency RACE they were
  * mistaken for a defense against is a real open question and moved to EC-1,
  * which owes a mechanism that does not depend on a per-tool opt-in.
- * Delivery truth is named by the CALLER (governance/delivery.ts's
- * `DeliveryConfig.producers`), which is where it always actually lived.
+ * Delivery truth is named by the CALLER (`DeliveryConfig.producers`), which
+ * is where it always actually lived — and since EC-1 that verdict lives in
+ * kiso-evals (governance/delivery.ts there), not in the kernel at all.
  *
  * WHY JSON Schema instead of a runtime library: the kernel has zero runtime
  * dependencies (ADR-0001). Zod / TypeBox / valibot live at the harness layer;
@@ -79,6 +80,38 @@ export interface Tool<I = unknown> {
      * applies. A retry is a NEW call and re-passes the approval chain.
      */
     readonly idempotent?: boolean;
+    /**
+     * EC-1 — an OPTIMIZATION CERTIFICATE, never a safety claim.
+     *
+     * Read the type carefully: there is no `"exclusive"`, and there is no
+     * `false`. ABSENCE is the conservative truth — an undeclared tool is
+     * commit-required and exclusive — so the type system cannot express a
+     * claim that something unsafe is safe. Correctness comes from absence;
+     * a declaration only buys performance back. That is the whole reason
+     * this field is shaped so oddly, and it is the lesson SC-1b paid for:
+     * `concurrencySafe` and `delivers` were declarations the kernel never
+     * read, so they were fiction. The kernel ENFORCES both of these, in the
+     * same round that introduces them.
+     *
+     *   precommitSafe — "running this before the turn commits is harmless:
+     *   read-only AND free AND local, for EVERY invocation." Only such a
+     *   call may start before Turn Commit, and only when its authorization
+     *   is already satisfied (auto-allowed). Its execution never makes an
+     *   uncommitted turn valid (invariant 7).
+     *
+     *   concurrency: "shared" — "EVERY invocation may overlap every
+     *   sibling." Without it the kernel serializes the tool behind a FIFO
+     *   exclusive barrier, which is what closes the same-path write race:
+     *   two edit_file calls on one path can no longer interleave.
+     *
+     * Per-call conflict granularity (a resourceKey) stays future and
+     * evidence-gated: this field is per-TOOL on purpose, because a per-call
+     * claim is exactly the kind the type system could not police.
+     */
+    readonly effects?: {
+        readonly precommitSafe?: true;
+        readonly concurrency?: "shared";
+    };
     /** R-C: ONE line for the system prompt — the tool's role, never the
      *  schema (the full description rides the JSON schema the provider
      *  transmits anyway — never pay twice). */

package/dist/tools/tool.js

@@ -11,8 +11,9 @@
  * Their absence is the honest contract; the concurrency RACE they were
  * mistaken for a defense against is a real open question and moved to EC-1,
  * which owes a mechanism that does not depend on a per-tool opt-in.
- * Delivery truth is named by the CALLER (governance/delivery.ts's
- * `DeliveryConfig.producers`), which is where it always actually lived.
+ * Delivery truth is named by the CALLER (`DeliveryConfig.producers`), which
+ * is where it always actually lived — and since EC-1 that verdict lives in
+ * kiso-evals (governance/delivery.ts there), not in the kernel at all.
  *
  * WHY JSON Schema instead of a runtime library: the kernel has zero runtime
  * dependencies (ADR-0001). Zod / TypeBox / valibot live at the harness layer;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincemakes/kiso-core",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "kiso (foundation) core — protocol, event log, loop, hooks, modes, permissions, compaction, delivery truth. The 2,000-line kernel at the bottom of the kiso framework.",
   "type": "module",
   "license": "MIT",
@@ -33,7 +33,7 @@
     "openai"
   ],
   "devDependencies": {
-    "@vincemakes/kiso-evals": "0.12.0",
+    "@vincemakes/kiso-evals": "0.14.0",
     "@types/node": "^26.1.2",
     "typescript": "^5.7.2",
     "vitest": "^3.0.0"