@vincemakes/kiso-runtime 0.1.32 → 0.1.34

package/dist/compose.d.ts

@@ -3,7 +3,7 @@
  * from session.ts: the extension system-prompt appends, the extension
  * hook composition (the existing come first), and the loop's microcompact config lookup.
  */
-import type { HookHost, KisoExtension, ToolRegistry } from "@vincemakes/kiso-core";
+import type { ApprovalChain, HookHost, KisoExtension, ToolRegistry } from "@vincemakes/kiso-core";
 import type { SessionConfig } from "./session.js";
 /** The table, or "" when the registry is empty (no vocabulary, no tools). */
 export declare function composeToolTable(registry: ToolRegistry): string;
@@ -32,3 +32,23 @@ export declare function microcompactFor(config: SessionConfig): {
     readonly thresholdTokens: number;
     readonly keepResults?: number;
 } | undefined;
+/**
+ * E1 (W21/R3 — moved out of the kernel by the 2026-08-09 corrective
+ * action; the composition is extension wiring, the same category as
+ * composeHooks): compose the extensions' approval policies into ONE
+ * chain — the kernel's gate. deny > allow > ask: any deny wins (the
+ * FIRST denial's reason), then ANY allow (a LATER allow beats an
+ * EARLIER ask: the allow-only dont-ask-again extension must override a
+ * mode tier's ask — the old ask-wins chain left it structurally dead),
+ * and an ask falls into the kernel's human flow (its speaker = the
+ * first non-abstain — the panel's why-asked line). Only an ask-free
+ * chain auto-approves: decidedBy = the deciding extension (the FIRST
+ * allow — the symmetry of the first denial; an every-speaker-allows
+ * chain records the first speaker). An all-abstain chain (ADR-0042)
+ * ASKS — no opinion is never a silent allow; absent a channel the
+ * kernel's honest denial. A policy that throws counts as ask — it
+ * speaks, never silently. No policies → undefined (no chain: the
+ * kernel's plain flow — the all-abstain ask exists only where a chain
+ * does).
+ */
+export declare function composeApprovalChain(extensions: readonly KisoExtension[]): ApprovalChain | undefined;

package/dist/compose.js

@@ -5,7 +5,8 @@
  */
 /**
  * 0.1.40 (R-C item 1) — the tool substitution table: the fixed vocabulary
- * (the CC content in kiso's voice, each line bound to the tool that makes
+ * (the reference implementation's content in kiso's voice, each line bound
+ * to the tool that makes
  * it true) filtered to the ACTIVE tool set + each active tool's ONE-line
  * snippet + its guideline bullets. The full descriptions NEVER enter the
  * system prompt — the provider transmits them in the JSON schema anyway
@@ -28,6 +29,9 @@ export function composeToolTable(registry) {
         ...TOOL_RULES.filter((r) => active.has(r.tool)).map((r) => `- ${r.line}`),
         // the parallel directive: the window applies to every active turn.
         "- batch independent tool calls into one reply — they run in parallel",
+        // D1: a tool result is evidence, not an answer — the turn ends with
+        // the findings that make the evidence useful to the human.
+        "- end your turn with your findings — never end on a bare tool result",
         ...tools.flatMap((t) => (t.promptSnippet === undefined ? [] : [`- ${t.promptSnippet}`])),
     ];
     const guidelines = tools.flatMap((t) => (t.promptGuidelines ?? []).map((g) => `- ${t.name}: ${g}`));
@@ -147,3 +151,81 @@ export function microcompactFor(config) {
     }
     return undefined;
 }
+/**
+ * E1 (W21/R3 — moved out of the kernel by the 2026-08-09 corrective
+ * action; the composition is extension wiring, the same category as
+ * composeHooks): compose the extensions' approval policies into ONE
+ * chain — the kernel's gate. deny > allow > ask: any deny wins (the
+ * FIRST denial's reason), then ANY allow (a LATER allow beats an
+ * EARLIER ask: the allow-only dont-ask-again extension must override a
+ * mode tier's ask — the old ask-wins chain left it structurally dead),
+ * and an ask falls into the kernel's human flow (its speaker = the
+ * first non-abstain — the panel's why-asked line). Only an ask-free
+ * chain auto-approves: decidedBy = the deciding extension (the FIRST
+ * allow — the symmetry of the first denial; an every-speaker-allows
+ * chain records the first speaker). An all-abstain chain (ADR-0042)
+ * ASKS — no opinion is never a silent allow; absent a channel the
+ * kernel's honest denial. A policy that throws counts as ask — it
+ * speaks, never silently. No policies → undefined (no chain: the
+ * kernel's plain flow — the all-abstain ask exists only where a chain
+ * does).
+ */
+export function composeApprovalChain(extensions) {
+    const policies = extensions.flatMap((e) => (e.approvals ?? []).map((policy) => ({ extension: e.name, policy })));
+    if (policies.length === 0)
+        return undefined;
+    return {
+        async decide(payload, ctx) {
+            let chainVerdict;
+            let deniedReason;
+            let deniedBy;
+            let allowedBy; // the FIRST allowing extension (the composition's decider for an allow)
+            let firstSpeaker; // the first non-abstain verdict's extension
+            let anySpoke = false;
+            for (const { extension, policy } of policies) {
+                let v;
+                try {
+                    v = await Promise.resolve(policy.decide(payload, ctx));
+                }
+                catch {
+                    v = { action: "ask" }; // a throwing policy counts as ask — it speaks, never silently
+                }
+                if (v.action === "abstain")
+                    continue; // no opinion — not a verdict
+                anySpoke = true;
+                firstSpeaker ??= extension;
+                if (v.action === "deny") {
+                    deniedBy ??= extension;
+                    deniedReason ??= v.reason; // the FIRST denial's reason
+                }
+                else if (v.action === "allow") {
+                    // deny > allow > ask — the allow overrides any EARLIER
+                    // ask in the chain (the allow-only dont-ask-again
+                    // extension after a mode tier that asked). The first
+                    // allow is the deciding one — the symmetry of deniedBy.
+                    allowedBy ??= extension;
+                    chainVerdict = { action: "allow" };
+                }
+                else if (chainVerdict === undefined) {
+                    chainVerdict = { action: "ask" }; // recorded — a later allow overrides it
+                }
+            }
+            if (deniedBy !== undefined) {
+                return { action: "deny", reason: deniedReason ?? "denied", decidedBy: deniedBy };
+            }
+            if (allowedBy !== undefined) {
+                return { action: "allow", decidedBy: allowedBy }; // an allow beat any earlier ask
+            }
+            if (chainVerdict === undefined && anySpoke) {
+                return { action: "allow", decidedBy: firstSpeaker }; // every speaker allows
+            }
+            if (chainVerdict === undefined) {
+                // an all-abstain (ADR-0042): NO policy speaks — the call falls
+                // to the ask flow, never to a silent auto-approve. The human
+                // decides; absent a channel, the kernel's honest denial.
+                return { action: "ask" };
+            }
+            return { action: "ask", ...(firstSpeaker !== undefined ? { speaker: firstSpeaker } : {}) };
+        },
+    };
+}

package/dist/run.js

@@ -5,7 +5,7 @@
  */
 import { denialResult, loop } from "@vincemakes/kiso-core";
 import { ABORTED, MergedSignal, abortable, openRunId } from "./recovery.js";
-import { composeSystemPrompt, composeToolTable, microcompactFor } from "./compose.js";
+import { composeApprovalChain, composeSystemPrompt, composeToolTable, microcompactFor } from "./compose.js";
 import { truncationGuard } from "./truncation-guard.js";
 import { ResumeBlockedError } from "./session.js";
 /**
@@ -70,6 +70,7 @@ export class Run {
             // append in LOAD order — deterministic (same extensions → same
             // prompt); no appends → byte-identical to the extension-less run.
             const systemPrompt = composeSystemPrompt(basePrompt, this.#config.extensions ?? []);
+            const approvalChain = composeApprovalChain(this.#config.extensions ?? []);
             const loopConfig = () => ({
                 // 0.1.40 (R-C item 3): the truncation guard gates the model
                 // stream — a truncated turn's tool batch never executes.
@@ -85,7 +86,9 @@ export class Run {
                 ...(this.#config.compaction !== undefined ? { compaction: this.#config.compaction } : {}),
                 ...(microcompact !== undefined ? { microcompact } : {}),
                 ...(this.#config.maxRetries !== undefined ? { maxRetries: this.#config.maxRetries } : {}),
-                approvalPolicies: (this.#config.extensions ?? []).flatMap((e) => (e.approvals ?? []).map((policy) => ({ extension: e.name, policy }))),
+                // E1: the composed approval chain — the extensions'
+                // policies composed into ONE gate (deny > allow > ask).
+                ...(approvalChain !== undefined ? { approvalPolicy: approvalChain } : {}),
                 log,
                 signal,
                 resolveApproval: (decisionId) => new Promise((resolve) => {

package/dist/session.d.ts

@@ -139,8 +139,11 @@ export declare class AgentSession {
      * next resume applies it without re-asking. The crash window between a
      * resolve and the run's write is benign: nothing has executed yet, so a
      * lost decision only re-presents the request.
+     * W21: an optional reason rides a DENIAL (the panel's feedback — the
+     * tool_result carries `[Permission denied] <the words>`); allow reasons
+     * are never persisted (the words ride the next user turn instead).
      */
-    approve(decisionId: string, allow: boolean): Promise<void>;
+    approve(decisionId: string, allow: boolean, reason?: string): Promise<void>;
     /** Executions that started but never reported a result (crash window). */
     uncertainExecutions(): import("@vincemakes/kiso-core").ExecutionRecord[];
     /**

package/dist/session.js

@@ -270,8 +270,11 @@ export class AgentSession {
      * next resume applies it without re-asking. The crash window between a
      * resolve and the run's write is benign: nothing has executed yet, so a
      * lost decision only re-presents the request.
+     * W21: an optional reason rides a DENIAL (the panel's feedback — the
+     * tool_result carries `[Permission denied] <the words>`); allow reasons
+     * are never persisted (the words ride the next user turn instead).
      */
-    async approve(decisionId, allow) {
+    async approve(decisionId, allow, reason) {
         // round 4: a poisoned session may not mutate the log — checked before
         // anything is recorded.
         this.ensureHealthy();
@@ -306,7 +309,10 @@ export class AgentSession {
             // cannot issue while awaiting approve().)
             this.#pendingDurableApprovals.set(decisionId, allow);
             this.#pendingResolvers.delete(decisionId);
-            resolver(allow ? { action: "allow" } : { action: "deny", reason: "denied by user" });
+            // W21: the panel's feedback rides the denial — the tool_result
+            // carries `[Permission denied] <the words>` (the rejection
+            // asymmetry: words keep the run alive).
+            resolver(allow ? { action: "allow" } : { action: "deny", reason: reason ?? "denied by user" });
             return;
         }
         const runId = request?.runId ?? "approval";
@@ -315,7 +321,7 @@ export class AgentSession {
             decisionId,
             ...(request !== undefined ? { callId: request.event.callId } : {}),
             decision: allow ? "approved" : "denied",
-            ...(allow ? {} : { reason: "denied by user" }),
+            ...(allow ? {} : { reason: reason ?? "denied by user" }),
         });
         await this.persist(runId, decided);
     }

package/dist/summarize.d.ts

@@ -58,6 +58,16 @@ export declare function lastSummaryPoint(events: readonly Event[]): number;
  * containing the LATEST one (still a turn boundary). A protected round
  * as the FIRST uncovered round leaves nothing before it to cover →
  * undefined (an honest "nothing to compact").
+ *
+ * P1 (0.1.42): the SAME pullback family now enforces the pairing
+ * invariant — a boundary NEVER splits a tool_call/tool_result pair. A
+ * mid-execution input leaves a covered call with a kept result, and the
+ * projection renders an orphaned tool message (a real provider 400 — the
+ * fresh2 family). The straddle pullback ITERATES to stability — every
+ * straddled pair in the shrinking range pulls the boundary before its
+ * round — while the protected pullback applies ONCE on the base range
+ * (the operative list is the LATEST echo — the old ⑥ semantics:
+ * superseded echoes stay coverable).
  */
 export declare function summaryBoundarySeq(events: readonly Event[], keepRounds?: number): number | undefined;
 /**

package/dist/summarize.js

@@ -92,6 +92,16 @@ export function lastSummaryPoint(events) {
  * containing the LATEST one (still a turn boundary). A protected round
  * as the FIRST uncovered round leaves nothing before it to cover →
  * undefined (an honest "nothing to compact").
+ *
+ * P1 (0.1.42): the SAME pullback family now enforces the pairing
+ * invariant — a boundary NEVER splits a tool_call/tool_result pair. A
+ * mid-execution input leaves a covered call with a kept result, and the
+ * projection renders an orphaned tool message (a real provider 400 — the
+ * fresh2 family). The straddle pullback ITERATES to stability — every
+ * straddled pair in the shrinking range pulls the boundary before its
+ * round — while the protected pullback applies ONCE on the base range
+ * (the operative list is the LATEST echo — the old ⑥ semantics:
+ * superseded echoes stay coverable).
  */
 export function summaryBoundarySeq(events, keepRounds = KEEP_RECENT_ROUNDS) {
     const prevPoint = lastSummaryPoint(events);
@@ -102,16 +112,27 @@ export function summaryBoundarySeq(events, keepRounds = KEEP_RECENT_ROUNDS) {
     }
     if (uncoveredInputs.length <= keepRounds)
         return undefined;
-    const base = uncoveredInputs[uncoveredInputs.length - keepRounds] - 1;
-    const protectedRound = latestProtectedBoundary(events, prevPoint, base);
-    if (protectedRound !== undefined) {
-        if (protectedRound <= prevPoint)
+    const firstUncovered = uncoveredInputs[0];
+    let boundary = uncoveredInputs[uncoveredInputs.length - keepRounds] - 1;
+    // The protected pullback applies ONCE on the base range (⑥); the
+    // straddle pullback recomputes against the SHRINKING range below it.
+    const protectedBoundary = latestProtectedBoundary(events, prevPoint, boundary);
+    for (;;) {
+        const straddleBoundary = latestStraddleBoundary(events, prevPoint, boundary);
+        let pull = straddleBoundary;
+        if (protectedBoundary !== undefined) {
+            pull = pull === undefined ? protectedBoundary : Math.min(pull, protectedBoundary);
+        }
+        if (pull === undefined)
+            return boundary;
+        // Nothing before the first uncovered round (or before the previous
+        // summary point) is coverable — the honest "nothing to compact".
+        if (pull < firstUncovered || pull <= prevPoint)
             return undefined;
-        return protectedRound;
+        if (pull >= boundary)
+            return boundary; // stable — the pull never advances
+        boundary = pull;
     }
-    // The input at m - keepRounds opens the FIRST KEPT round; everything
-    // before it (m - keepRounds ≥ 1 covered rounds) is summarizable.
-    return base;
 }
 /**
  * ⑥: the boundary just before the round holding the LATEST do-not-compact
@@ -145,6 +166,37 @@ function latestProtectedBoundary(events, prevPoint, base) {
         return undefined;
     return inputSeq - 1;
 }
+/**
+ * P1 (0.1.42): the boundary just before the round holding the LATEST
+ * tool_call_end in (prevPoint, cut] whose tool_result landed on the KEPT
+ * side of the cut — covering the call alone would project an orphaned
+ * tool message (the pairing invariant; the fresh2 400 family). Returns
+ * the pair's round-opening input minus one — still a turn boundary —
+ * or prevPoint when the round opened at or before the previous summary
+ * point (the caller's `pull <= prevPoint` guard turns that into the
+ * honest nothing-to-compact: the range holds no whole pair to keep, so
+ * the compact is refused) — or undefined when the range holds no
+ * straddled pair.
+ */
+function latestStraddleBoundary(events, prevPoint, cut) {
+    let straddledCall = -1;
+    for (const ev of events) {
+        if (ev.type !== "tool_call_end" || ev.seq <= prevPoint || ev.seq > cut)
+            continue;
+        const keptResult = events.some((e) => e.type === "tool_result" && e.callId === ev.callId && e.seq > cut);
+        if (keptResult)
+            straddledCall = ev.seq;
+    }
+    if (straddledCall < 0)
+        return undefined;
+    // The pair's round opening: the last user_input before the call.
+    let inputSeq = -1;
+    for (const ev of events) {
+        if (ev.type === "user_input" && ev.seq > prevPoint && ev.seq < straddledCall)
+            inputSeq = ev.seq;
+    }
+    return inputSeq < 0 ? prevPoint : inputSeq - 1;
+}
 /**
  * The NoticeCell's number: estimated tokens of the covered content minus
  * the summary's own — the same chars/4 proxy as estimateTokens (a stable

package/dist/truncation-guard.d.ts

@@ -1,7 +1,8 @@
 /**
  * 0.1.40 (R-C item 3) — the truncation guard: a runtime adapter wrapper.
  *
- * The pi protection: a truncated stream (stopReason max_tokens/length) can
+ * The reference implementation's protection: a truncated stream (stopReason
+ * max_tokens/length) can
  * yield tool args that parse and validate but are silently incomplete —
  * executing them is the destructive-bug class. The provider adapters already
  * see the stop reason; the RUNTIME vetoes execution of the whole batch:

package/dist/truncation-guard.js

@@ -1,7 +1,8 @@
 /**
  * 0.1.40 (R-C item 3) — the truncation guard: a runtime adapter wrapper.
  *
- * The pi protection: a truncated stream (stopReason max_tokens/length) can
+ * The reference implementation's protection: a truncated stream (stopReason
+ * max_tokens/length) can
  * yield tool args that parse and validate but are silently incomplete —
  * executing them is the destructive-bug class. The provider adapters already
  * see the stop reason; the RUNTIME vetoes execution of the whole batch:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincemakes/kiso-runtime",
-  "version": "0.1.32",
+  "version": "0.1.34",
   "description": "kiso runtime — durable multi-turn agent sessions: AgentDefinition, AgentRuntime, AgentSession, Run, append-only JSONL store.",
   "type": "module",
   "license": "MIT",
@@ -21,11 +21,11 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@vincemakes/kiso-core": "0.1.31"
+    "@vincemakes/kiso-core": "0.1.33"
   },
   "peerDependencies": {
-    "@vincemakes/kiso-provider-anthropic": "0.1.32",
-    "@vincemakes/kiso-provider-openai": "0.1.32"
+    "@vincemakes/kiso-provider-anthropic": "0.1.34",
+    "@vincemakes/kiso-provider-openai": "0.1.34"
   },
   "peerDependenciesMeta": {
     "@vincemakes/kiso-provider-anthropic": {
@@ -36,7 +36,7 @@
     }
   },
   "devDependencies": {
-    "@vincemakes/kiso-evals": "0.1.32",
+    "@vincemakes/kiso-evals": "0.1.33",
     "@types/node": "^26.1.2",
     "typescript": "^5.7.2",
     "vitest": "^3.0.0"