@vincemakes/kiso-core 0.26.2 → 0.27.0

package/dist/index.d.ts

@@ -4,7 +4,6 @@ export * from "./tools/registry.js";
 export * from "./errors.js";
 export * from "./kernel/event-log.js";
 export * from "./kernel/hooks.js";
-export * from "./kernel/mode.js";
 export * from "./kernel/permission.js";
 export * from "./kernel/loop.js";
 export * from "./kernel/compaction.js";

package/dist/index.js

@@ -4,7 +4,6 @@ export * from "./tools/registry.js";
 export * from "./errors.js";
 export * from "./kernel/event-log.js";
 export * from "./kernel/hooks.js";
-export * from "./kernel/mode.js";
 export * from "./kernel/permission.js";
 export * from "./kernel/loop.js";
 export * from "./kernel/compaction.js";

package/dist/kernel/hooks.d.ts

@@ -13,7 +13,7 @@
  * compile-time fact instead of a written rule).
  */
 import type { Event } from "../protocol/events.js";
-import type { Message, UserMessage } from "../protocol/messages.js";
+import type { UserMessage } from "../protocol/messages.js";
 import type { ToolResult } from "../tools/tool.js";
 import type { PermissionDecision } from "./permission.js";
 export interface HookContext {
@@ -39,14 +39,6 @@ export interface HookHost {
     onPreTool?(call: ToolCallPayload, ctx: HookContext): Promise<PermissionDecision>;
     /** Execute: rewrite the result a tool returns. */
     onPostTool?(call: ToolCallPayload, result: ToolResult, ctx: HookContext): Promise<ToolResult>;
-    /**
-     * DEPRECATED (ADR-0044): the classic auto-compaction path is retired —
-     * the loop never fires these (the microcompact boundary replaced it).
-     * Kept so the extension contract type-checks; inert. Removed at 1.0.
-     */
-    onPreCompact?(messages: readonly Message[], ctx: HookContext): Promise<void>;
-    /** DEPRECATED (ADR-0044): see onPreCompact — never invoked. */
-    onPostCompact?(messages: readonly Message[], ctx: HookContext): Promise<void>;
     /** Lifecycle: the loop paused (human decision pending). */
     onPause?(reason: string, ctx: HookContext): Promise<void>;
     /** Lifecycle: the loop is about to stop. */

package/dist/kernel/loop.d.ts

@@ -40,7 +40,6 @@ import type { EventInput } from "./event-log.js";
 import type { AssistantBlock, AssistantMessage, Message, ToolResultMessage } from "../protocol/messages.js";
 import { ToolRegistry } from "../tools/registry.js";
 import type { HookHost } from "./hooks.js";
-import type { ModeProfile } from "./mode.js";
 import { type PermissionDecision } from "./permission.js";
 export interface LoopConfig {
     readonly adapter: Adapter;
@@ -48,9 +47,6 @@ export interface LoopConfig {
     readonly systemPrompt?: string;
     readonly registry: ToolRegistry;
     readonly hooks?: HookHost;
-    readonly modes?: readonly ModeProfile[];
-    /** Active mode name; applies visibleToolNames structurally. */
-    readonly mode?: string;
     readonly maxTurns?: number;
     readonly maxRetries?: number;
     /**
@@ -73,16 +69,6 @@ export interface LoopConfig {
     readonly messages?: readonly Message[];
     /** The run's event log. Pass the session's log to make this run durable. */
     readonly log?: EventLog;
-    /**
-     * DEPRECATED (ADR-0044): the classic auto-compaction path is retired —
-     * the loop no longer produces `compacted` events; the microcompact
-     * boundary (below) absorbed the responsibility. Kept so old configs
-     * type-check; IGNORED. Old sessions' `compacted` events still replay
-     * verbatim (the projection). Removed at 1.0.
-     */
-    readonly compaction?: {
-        readonly thresholdTokens: number;
-    };
     /**
      * C area: MICROCOMPACT — when the projected context exceeds the threshold,
      * append ONE durable `microcompacted` boundary (clearing compactable tool
@@ -112,25 +98,6 @@ export interface LoopConfig {
      * human's decision outranks the abort.
      */
     readonly approvalVerdict?: (decisionId: string) => boolean | undefined;
-    /**
-     * DEAD — accepted by the type, never read by this loop.
-     *
-     * It was the C group channel for the failed-receipt pause: the loop
-     * persisted `uncertain_pending` and awaited a human verdict. ADR-0038
-     * removed that pause (a complete receipt IS the outcome), and with it
-     * every read of this field — a failure is now simply recorded failed and
-     * the siblings run on. The runtime still passes both callbacks
-     * (runtime/run.ts), so supplying them is harmless and changes nothing.
-     *
-     * The crash window — started, no receipt — is the ONLY uncertainty left,
-     * and the runtime's recovery driver owns it (RESOLVE_UNCERTAIN in
-     * runtime/recovery-plan.ts), not the loop. Both fields are kept because
-     * the surface is frozen (ADR-0051); do not read them as live wiring.
-     */
-    readonly resolveUncertainty?: (executionId: string) => Promise<"rerun" | "abandoned">;
-    /** DEAD, as above — the uncertainty twin of `approvalVerdict`
-     *  (round 4, adversarial). Never read by the loop since ADR-0038. */
-    readonly uncertaintyVerdict?: (executionId: string) => "rerun" | "abandoned" | undefined;
     /**
      * E1: the COMPOSED approval chain — the runtime composes the
      * extensions' policies (deny > allow > ask, the R3 ruling) into ONE

package/dist/kernel/loop.js

@@ -38,7 +38,6 @@ import { EventLog } from "./event-log.js";
 import { ToolRegistry } from "../tools/registry.js";
 import { validateArgs } from "../tools/validate.js";
 import { NoOpHooks } from "./hooks.js";
-import { resolveModeProfile } from "./mode.js";
 import { denialResult } from "./permission.js";
 import { messagesToEvents, MICROCOMPACTABLE, DO_NOT_COMPACT, projectMessages } from "./project.js";
 /**
@@ -72,17 +71,13 @@ export async function* loop(config) {
     const maxTurns = config.maxTurns ?? DEFAULT_MAX_TURNS;
     const maxRetries = config.maxRetries ?? DEFAULT_MAX_RETRIES;
     const signal = config.signal;
-    const mode = resolveModeProfile(config.modes, config.mode);
-    const registry = mode?.visibleToolNames !== undefined
-        ? config.registry.subset(mode.visibleToolNames)
-        : config.registry;
     // CX-1 F7b (audit F7): ONE tool table per request — captured at
     // assembly, dispatched from until the next assembly. The definition
     // the model saw, the schema the arguments are validated against, the
     // execute that runs and the effects the scheduler reads are the same
     // captured values; a live source that changes mid-request reaches the
     // NEXT request.
-    let table = registry.snapshot();
+    let table = config.registry.snapshot();
     // Seed: a fresh log encodes the seed history as events so the projection
     // (and any later replay) contains it. A non-empty log (session resume)
     // is never re-seeded — the log already holds everything.
@@ -559,7 +554,7 @@ export async function* loop(config) {
                     messages,
                     ...(config.reasoning !== undefined ? { reasoning: config.reasoning } : {}),
                     ...(config.systemPrompt !== undefined ? { systemPrompt: config.systemPrompt } : {}),
-                    tools: (table = registry.snapshot()).specs,
+                    tools: (table = config.registry.snapshot()).specs,
                     ...(config.maxTokens !== undefined ? { maxTokens: config.maxTokens } : {}),
                     ...(config.temperature !== undefined ? { temperature: config.temperature } : {}),
                     ...(signal !== undefined ? { signal } : {}),
@@ -641,15 +636,13 @@ export async function* loop(config) {
                     return;
                 }
                 let structured = toStructuredError(err);
-                // CX-1 F8 (ruled: the kernel owns retries): the wait is
-                // max(attempts × 250 ms, the provider's Retry-After), abortable.
-                // A wait above the cap is never shortened — the run stops with
-                // an explicit error instead of retrying early.
-                const retryWait = () => {
-                    const ms = Math.max((attempts + 1) * 250, structured.retryAfterMs ?? 0);
-                    return ms > RETRY_AFTER_MAX_MS ? null : ms;
-                };
-                if (structured.retryable && attempts < maxRetries && retryWait() === null) {
+                // CX-1 F8 (ruled: the kernel owns retries): the n-th retry waits
+                // max(n × 250 ms, the provider's Retry-After), abortable — computed
+                // BEFORE `attempts` advances (the 2026-09-07 review's P3: computed
+                // after it, the first wait was 500 ms). A wait above the cap is
+                // never shortened — the run stops with an explicit error instead.
+                const retryWait = () => Math.max((attempts + 1) * 250, structured.retryAfterMs ?? 0);
+                if (structured.retryable && attempts < maxRetries && retryWait() > RETRY_AFTER_MAX_MS) {
                     structured = {
                         ...structured,
                         retryable: false,
@@ -660,8 +653,8 @@ export async function* loop(config) {
                 // content — duplicates are worse than failures. Nothing streamed
                 // yet: the cheap in-place retry (no draft exists to void).
                 if (structured.retryable && !streamed && attempts < maxRetries) {
+                    await sleep(retryWait(), signal); // abortable backoff, Retry-After honored
                     attempts += 1;
-                    await sleep(retryWait() ?? attempts * 250, signal); // abortable backoff, Retry-After honored
                     continue;
                 }
                 // F4 — ABANDON HYGIENE, every streamed exit: settle, drain,
@@ -675,8 +668,8 @@ export async function* loop(config) {
                 // F4 — the mid-stream retry: same classification, same per-turn
                 // budget (ADR-0005 Amendment 1: frame state, per-process).
                 if (structured.retryable && attempts < maxRetries && !unsafeStartedInDraft()) {
+                    await sleep(retryWait(), signal); // the same abortable backoff, Retry-After honored
                     attempts += 1;
-                    await sleep(retryWait() ?? attempts * 250, signal); // the same abortable backoff, Retry-After honored
                     // Fresh per-attempt state — the marker is the boundary now.
                     pending.length = 0;
                     lastStop = undefined;
@@ -984,14 +977,18 @@ async function decideCall(call, registry, hooks, ctx, log, resolveApproval, reso
     // its verdict. A throwing chain counts as ask. Allow/deny are recorded
     // durably with decidedBy = the deciding extension, never pausing for a
     // human.
-    // CX-1 F1 (audit F1): a durable decision is consumable ONCE — by the
-    // invocation it was recorded for, or by that invocation's RE-ISSUE on
-    // resume (same callId, same tool, identical input, and the original
-    // never produced a result). A provider callId alone is correlation,
-    // never identity: the old lookup found the current call itself
-    // (already appended), compared its input to its own, and took the
-    // FIRST decision with that callId in the whole log — so a reused
-    // callId inherited an old allow for a new call.
+    // CX-1 F1 (audit F1): a durable decision binds to EXACTLY the
+    // invocation it was recorded for — `invocationSeq === call.seq`. A
+    // provider callId alone is correlation, never identity: the old lookup
+    // took the FIRST decision with that callId in the whole log, so a
+    // reused callId inherited an old allow for a new call. The 0.26.1
+    // "re-issue" exception (same callId, same input, no result yet) is
+    // RETRACTED (the 2026-09-07 review's P1): it let a same-turn duplicate
+    // and a voided draft's retry inherit a verdict, and nothing needed it —
+    // a committed turn's pending call is executed by the recovery driver
+    // under its ORIGINAL seq, and a re-streamed call after a void is a new
+    // invocation the chain decides again (a policy is a function; running
+    // it twice costs nothing and gives a stateful one its say).
     //
     // The decision's invocationSeq names the original call (every
     // producer stamps it, round 5). A legacy decision (no invocationSeq,
@@ -1012,28 +1009,6 @@ async function decideCall(call, registry, hooks, ctx, log, resolveApproval, reso
         }
         return undefined;
     };
-    /** The re-issue rule: a resume re-issues the pending call under the SAME
-     *  provider id — same callId, same tool, identical input — and the
-     *  original never completed: no result and no other call under that id
-     *  stands between the original and this call. A different callId with
-     *  the same arguments is a new invocation (the /mode-switch shape: a
-     *  write denied under plan is asked afresh under default). */
-    const reissues = (origSeq) => {
-        const orig = all.find((e) => e.seq === origSeq);
-        if (orig === undefined || orig.type !== "tool_call_end")
-            return false;
-        if (orig.callId !== call.callId || orig.name !== call.name)
-            return false;
-        if (JSON.stringify(orig.input) !== JSON.stringify(call.input))
-            return false;
-        for (const e of all) {
-            if (e.seq <= origSeq || e.seq >= call.seq)
-                continue;
-            if ((e.type === "tool_result" || e.type === "tool_call_end") && e.callId === orig.callId)
-                return false;
-        }
-        return true;
-    };
     let durable;
     let legacyAmbiguous = false;
     for (const e of all) {
@@ -1046,7 +1021,7 @@ async function decideCall(call, registry, hooks, ctx, log, resolveApproval, reso
             legacyAmbiguous = true;
             continue;
         }
-        if (origSeq === call.seq || reissues(origSeq))
+        if (origSeq === call.seq)
             durable = e;
     }
     let chainVerdict;

package/dist/tools/registry.d.ts

@@ -7,11 +7,6 @@
  * implementation's hand-maintained agent-tool sets and its six copies of the
  * default tool list — see ADR-0001).
  *
- * `subset()` is the structural tool filter: a mode or a subagent gets a
- * registry whose tool table PHYSICALLY lacks the tools it must not see. The
- * model cannot call a tool that is not in its registry — no prompt can
- * achieve that guarantee.
- *
  * `registerLive()` adds a LIVE tool source — a function returning an
  * extension's CURRENT tools array. Any extension whose tool table settles
  * after load is such a source (the runtime registers every extension's
@@ -40,9 +35,11 @@ export declare class ToolRegistry {
      *  snapshot at request assembly and dispatches from it: the definition
      *  sent to the model, the schema validated against, the `execute` that
      *  runs and the `effects` the scheduler reads are the SAME captured
-     *  values (a shallow copy of each Tool — extensions replace their Tool
-     *  objects rather than mutating them, and the copy makes that a
-     *  contract). Two sources publishing one name is an error the moment
+     *  values: the declaration data (schema, effects) is COPIED into the
+     *  table, the handler stays by reference — an in-place edit to the
+     *  source after the snapshot cannot reach a request already under way
+     *  (the 2026-09-07 review's P2: a shallow copy shared the nested
+     *  objects). Two sources publishing one name is an error the moment
      *  it is observed, naming both owners — never a traversal-order pick;
      *  the one exception is the SAME Tool object reached twice (the 0.1.27
      *  dedup), which is one tool. */
@@ -50,9 +47,6 @@ export declare class ToolRegistry {
     get(name: string): Tool<any> | undefined;
     list(): readonly Tool[];
     has(name: string): boolean;
-    /** A registry restricted to the named tools. Unknown names are dropped
-     *  loudly (the kernel never silently shrinks a tool set). */
-    subset(names: readonly string[]): ToolRegistry;
     /** The minimal projection an adapter may see (never the handlers). */
     toSpecs(): readonly ToolSpec[];
 }

package/dist/tools/registry.js

@@ -7,11 +7,6 @@
  * implementation's hand-maintained agent-tool sets and its six copies of the
  * default tool list — see ADR-0001).
  *
- * `subset()` is the structural tool filter: a mode or a subagent gets a
- * registry whose tool table PHYSICALLY lacks the tools it must not see. The
- * model cannot call a tool that is not in its registry — no prompt can
- * achieve that guarantee.
- *
  * `registerLive()` adds a LIVE tool source — a function returning an
  * extension's CURRENT tools array. Any extension whose tool table settles
  * after load is such a source (the runtime registers every extension's
@@ -40,9 +35,11 @@ export class ToolRegistry {
      *  snapshot at request assembly and dispatches from it: the definition
      *  sent to the model, the schema validated against, the `execute` that
      *  runs and the `effects` the scheduler reads are the SAME captured
-     *  values (a shallow copy of each Tool — extensions replace their Tool
-     *  objects rather than mutating them, and the copy makes that a
-     *  contract). Two sources publishing one name is an error the moment
+     *  values: the declaration data (schema, effects) is COPIED into the
+     *  table, the handler stays by reference — an in-place edit to the
+     *  source after the snapshot cannot reach a request already under way
+     *  (the 2026-09-07 review's P2: a shallow copy shared the nested
+     *  objects). Two sources publishing one name is an error the moment
      *  it is observed, naming both owners — never a traversal-order pick;
      *  the one exception is the SAME Tool object reached twice (the 0.1.27
      *  dedup), which is one tool. */
@@ -55,7 +52,8 @@ export class ToolRegistry {
                     return; // the same object reached twice — one tool
                 throw new Error(`tool table: '${t.name}' is published by two sources (${prior.owner}, ${owner})`);
             }
-            captured.set(t.name, { tool: Object.freeze({ ...t }), original: t, owner });
+            const copy = { ...t, parameters: structuredClone(t.parameters), ...(t.effects === undefined ? {} : { effects: Object.freeze(structuredClone(t.effects)) }) };
+            captured.set(t.name, { tool: Object.freeze(copy), original: t, owner });
         };
         for (const t of this.#tools.values())
             take(t, "registered");
@@ -105,19 +103,6 @@ export class ToolRegistry {
             return true;
         return this.#live.some(({ source }) => source().some((x) => x.name === name));
     }
-    /** A registry restricted to the named tools. Unknown names are dropped
-     *  loudly (the kernel never silently shrinks a tool set). */
-    subset(names) {
-        const out = new ToolRegistry();
-        for (const name of names) {
-            const tool = this.get(name);
-            if (tool === undefined) {
-                throw new Error(`subset(): unknown tool '${name}'`);
-            }
-            out.register(tool);
-        }
-        return out;
-    }
     /** The minimal projection an adapter may see (never the handlers). */
     toSpecs() {
         return this.list().map((t) => ({

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vincemakes/kiso-core",
-	"version": "0.26.2",
+	"version": "0.27.0",
 	"description": "kiso (foundation) core — protocol, event log, loop, hooks, modes, permissions, compaction, delivery truth. The 2,000-line kernel at the bottom of the kiso framework.",
 	"type": "module",
 	"license": "MIT",
@@ -33,7 +33,7 @@
 		"openai"
 	],
 	"devDependencies": {
-		"@vincemakes/kiso-evals": "0.26.2",
+		"@vincemakes/kiso-evals": "0.27.0",
 		"@types/node": "^26.1.2",
 		"typescript": "^5.7.2",
 		"vitest": "^3.0.0"

package/dist/kernel/mode.d.ts

@@ -1,24 +0,0 @@
-/**
- * L2 — ModeProfile: a mode is a cross-layer behavior switch (mauri ADR-0011),
- * not a kernel feature. The kernel knows ONE mode at a time and applies it
- * structurally:
- *
- * - `visibleToolNames` — physical removal: the registry is subset() to these
- *   tools BEFORE the adapter is called. The model cannot call what it cannot
- *   see; no system-prompt overlay can make that guarantee.
- *
- * That is the whole profile. SC-1b: `systemOverlay`, `permissionDefault`,
- * `compactionKeepExtra`, and `stopPredicate` were REMOVED at 0.12.0 by the
- * SC-1 memo's adjudication — all four were declared here and read by
- * nothing, in the kernel or above it. Two of them ("reserved, read by the
- * harness when the semantics land") had been waiting since mauri ADR-0011
- * for semantics that never landed. A field that describes an intention
- * rather than a behavior is a promise the type system makes on the
- * kernel's behalf and the kernel does not keep; the honest profile is the
- * one member that is actually applied.
- */
-export interface ModeProfile {
-    readonly name: string;
-    readonly visibleToolNames?: readonly string[];
-}
-export declare function resolveModeProfile(modes: readonly ModeProfile[] | undefined, name: string | undefined): ModeProfile | undefined;

package/dist/kernel/mode.js

@@ -1,24 +0,0 @@
-/**
- * L2 — ModeProfile: a mode is a cross-layer behavior switch (mauri ADR-0011),
- * not a kernel feature. The kernel knows ONE mode at a time and applies it
- * structurally:
- *
- * - `visibleToolNames` — physical removal: the registry is subset() to these
- *   tools BEFORE the adapter is called. The model cannot call what it cannot
- *   see; no system-prompt overlay can make that guarantee.
- *
- * That is the whole profile. SC-1b: `systemOverlay`, `permissionDefault`,
- * `compactionKeepExtra`, and `stopPredicate` were REMOVED at 0.12.0 by the
- * SC-1 memo's adjudication — all four were declared here and read by
- * nothing, in the kernel or above it. Two of them ("reserved, read by the
- * harness when the semantics land") had been waiting since mauri ADR-0011
- * for semantics that never landed. A field that describes an intention
- * rather than a behavior is a promise the type system makes on the
- * kernel's behalf and the kernel does not keep; the honest profile is the
- * one member that is actually applied.
- */
-export function resolveModeProfile(modes, name) {
-    if (!name || !modes)
-        return undefined;
-    return modes.find((m) => m.name === name);
-}