@vincemakes/kiso-core 0.26.2 → 0.26.3

package/dist/kernel/loop.js

@@ -641,15 +641,13 @@ export async function* loop(config) {
                     return;
                 }
                 let structured = toStructuredError(err);
-                // CX-1 F8 (ruled: the kernel owns retries): the wait is
-                // max(attempts × 250 ms, the provider's Retry-After), abortable.
-                // A wait above the cap is never shortened — the run stops with
-                // an explicit error instead of retrying early.
-                const retryWait = () => {
-                    const ms = Math.max((attempts + 1) * 250, structured.retryAfterMs ?? 0);
-                    return ms > RETRY_AFTER_MAX_MS ? null : ms;
-                };
-                if (structured.retryable && attempts < maxRetries && retryWait() === null) {
+                // CX-1 F8 (ruled: the kernel owns retries): the n-th retry waits
+                // max(n × 250 ms, the provider's Retry-After), abortable — computed
+                // BEFORE `attempts` advances (the 2026-09-07 review's P3: computed
+                // after it, the first wait was 500 ms). A wait above the cap is
+                // never shortened — the run stops with an explicit error instead.
+                const retryWait = () => Math.max((attempts + 1) * 250, structured.retryAfterMs ?? 0);
+                if (structured.retryable && attempts < maxRetries && retryWait() > RETRY_AFTER_MAX_MS) {
                     structured = {
                         ...structured,
                         retryable: false,
@@ -660,8 +658,8 @@ export async function* loop(config) {
                 // content — duplicates are worse than failures. Nothing streamed
                 // yet: the cheap in-place retry (no draft exists to void).
                 if (structured.retryable && !streamed && attempts < maxRetries) {
+                    await sleep(retryWait(), signal); // abortable backoff, Retry-After honored
                     attempts += 1;
-                    await sleep(retryWait() ?? attempts * 250, signal); // abortable backoff, Retry-After honored
                     continue;
                 }
                 // F4 — ABANDON HYGIENE, every streamed exit: settle, drain,
@@ -675,8 +673,8 @@ export async function* loop(config) {
                 // F4 — the mid-stream retry: same classification, same per-turn
                 // budget (ADR-0005 Amendment 1: frame state, per-process).
                 if (structured.retryable && attempts < maxRetries && !unsafeStartedInDraft()) {
+                    await sleep(retryWait(), signal); // the same abortable backoff, Retry-After honored
                     attempts += 1;
-                    await sleep(retryWait() ?? attempts * 250, signal); // the same abortable backoff, Retry-After honored
                     // Fresh per-attempt state — the marker is the boundary now.
                     pending.length = 0;
                     lastStop = undefined;
@@ -984,14 +982,18 @@ async function decideCall(call, registry, hooks, ctx, log, resolveApproval, reso
     // its verdict. A throwing chain counts as ask. Allow/deny are recorded
     // durably with decidedBy = the deciding extension, never pausing for a
     // human.
-    // CX-1 F1 (audit F1): a durable decision is consumable ONCE — by the
-    // invocation it was recorded for, or by that invocation's RE-ISSUE on
-    // resume (same callId, same tool, identical input, and the original
-    // never produced a result). A provider callId alone is correlation,
-    // never identity: the old lookup found the current call itself
-    // (already appended), compared its input to its own, and took the
-    // FIRST decision with that callId in the whole log — so a reused
-    // callId inherited an old allow for a new call.
+    // CX-1 F1 (audit F1): a durable decision binds to EXACTLY the
+    // invocation it was recorded for — `invocationSeq === call.seq`. A
+    // provider callId alone is correlation, never identity: the old lookup
+    // took the FIRST decision with that callId in the whole log, so a
+    // reused callId inherited an old allow for a new call. The 0.26.1
+    // "re-issue" exception (same callId, same input, no result yet) is
+    // RETRACTED (the 2026-09-07 review's P1): it let a same-turn duplicate
+    // and a voided draft's retry inherit a verdict, and nothing needed it —
+    // a committed turn's pending call is executed by the recovery driver
+    // under its ORIGINAL seq, and a re-streamed call after a void is a new
+    // invocation the chain decides again (a policy is a function; running
+    // it twice costs nothing and gives a stateful one its say).
     //
     // The decision's invocationSeq names the original call (every
     // producer stamps it, round 5). A legacy decision (no invocationSeq,
@@ -1012,28 +1014,6 @@ async function decideCall(call, registry, hooks, ctx, log, resolveApproval, reso
         }
         return undefined;
     };
-    /** The re-issue rule: a resume re-issues the pending call under the SAME
-     *  provider id — same callId, same tool, identical input — and the
-     *  original never completed: no result and no other call under that id
-     *  stands between the original and this call. A different callId with
-     *  the same arguments is a new invocation (the /mode-switch shape: a
-     *  write denied under plan is asked afresh under default). */
-    const reissues = (origSeq) => {
-        const orig = all.find((e) => e.seq === origSeq);
-        if (orig === undefined || orig.type !== "tool_call_end")
-            return false;
-        if (orig.callId !== call.callId || orig.name !== call.name)
-            return false;
-        if (JSON.stringify(orig.input) !== JSON.stringify(call.input))
-            return false;
-        for (const e of all) {
-            if (e.seq <= origSeq || e.seq >= call.seq)
-                continue;
-            if ((e.type === "tool_result" || e.type === "tool_call_end") && e.callId === orig.callId)
-                return false;
-        }
-        return true;
-    };
     let durable;
     let legacyAmbiguous = false;
     for (const e of all) {
@@ -1046,7 +1026,7 @@ async function decideCall(call, registry, hooks, ctx, log, resolveApproval, reso
             legacyAmbiguous = true;
             continue;
         }
-        if (origSeq === call.seq || reissues(origSeq))
+        if (origSeq === call.seq)
             durable = e;
     }
     let chainVerdict;

package/dist/tools/registry.d.ts

@@ -40,9 +40,11 @@ export declare class ToolRegistry {
      *  snapshot at request assembly and dispatches from it: the definition
      *  sent to the model, the schema validated against, the `execute` that
      *  runs and the `effects` the scheduler reads are the SAME captured
-     *  values (a shallow copy of each Tool — extensions replace their Tool
-     *  objects rather than mutating them, and the copy makes that a
-     *  contract). Two sources publishing one name is an error the moment
+     *  values: the declaration data (schema, effects) is COPIED into the
+     *  table, the handler stays by reference — an in-place edit to the
+     *  source after the snapshot cannot reach a request already under way
+     *  (the 2026-09-07 review's P2: a shallow copy shared the nested
+     *  objects). Two sources publishing one name is an error the moment
      *  it is observed, naming both owners — never a traversal-order pick;
      *  the one exception is the SAME Tool object reached twice (the 0.1.27
      *  dedup), which is one tool. */

package/dist/tools/registry.js

@@ -40,9 +40,11 @@ export class ToolRegistry {
      *  snapshot at request assembly and dispatches from it: the definition
      *  sent to the model, the schema validated against, the `execute` that
      *  runs and the `effects` the scheduler reads are the SAME captured
-     *  values (a shallow copy of each Tool — extensions replace their Tool
-     *  objects rather than mutating them, and the copy makes that a
-     *  contract). Two sources publishing one name is an error the moment
+     *  values: the declaration data (schema, effects) is COPIED into the
+     *  table, the handler stays by reference — an in-place edit to the
+     *  source after the snapshot cannot reach a request already under way
+     *  (the 2026-09-07 review's P2: a shallow copy shared the nested
+     *  objects). Two sources publishing one name is an error the moment
      *  it is observed, naming both owners — never a traversal-order pick;
      *  the one exception is the SAME Tool object reached twice (the 0.1.27
      *  dedup), which is one tool. */
@@ -55,7 +57,8 @@ export class ToolRegistry {
                     return; // the same object reached twice — one tool
                 throw new Error(`tool table: '${t.name}' is published by two sources (${prior.owner}, ${owner})`);
             }
-            captured.set(t.name, { tool: Object.freeze({ ...t }), original: t, owner });
+            const copy = { ...t, parameters: structuredClone(t.parameters), ...(t.effects === undefined ? {} : { effects: Object.freeze(structuredClone(t.effects)) }) };
+            captured.set(t.name, { tool: Object.freeze(copy), original: t, owner });
         };
         for (const t of this.#tools.values())
             take(t, "registered");

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vincemakes/kiso-core",
-	"version": "0.26.2",
+	"version": "0.26.3",
 	"description": "kiso (foundation) core — protocol, event log, loop, hooks, modes, permissions, compaction, delivery truth. The 2,000-line kernel at the bottom of the kiso framework.",
 	"type": "module",
 	"license": "MIT",
@@ -33,7 +33,7 @@
 		"openai"
 	],
 	"devDependencies": {
-		"@vincemakes/kiso-evals": "0.26.2",
+		"@vincemakes/kiso-evals": "0.26.3",
 		"@types/node": "^26.1.2",
 		"typescript": "^5.7.2",
 		"vitest": "^3.0.0"