@vincemakes/kiso-runtime 0.13.0 → 0.15.0

package/dist/agent.d.ts

@@ -39,6 +39,10 @@ export interface AgentDefinition {
     readonly provider?: "anthropic" | "openai-compat";
     readonly apiKey?: string;
     readonly baseUrl?: string;
+    /** PH-1c.1: opt-in Anthropic prompt caching (cache_control
+     *  breakpoints) — OFF by default; the openai-compat path ignores it
+     *  (that dialect's caching is server-automatic). Type-only additive. */
+    readonly promptCaching?: boolean;
     readonly maxTurns?: number;
     readonly maxTokens?: number;
     readonly temperature?: number;
@@ -90,4 +94,5 @@ export declare function createAgent(definition: AgentDefinition): AgentRuntime;
 export declare function buildAdapter(provider: "anthropic" | "openai-compat", opts?: {
     readonly apiKey?: string;
     readonly baseUrl?: string;
+    readonly promptCaching?: boolean;
 }): Promise<Adapter>;

package/dist/agent.js

@@ -132,6 +132,7 @@ async function resolveAdapter(definition) {
             return createAnthropicProvider({
                 ...(definition.apiKey !== undefined ? { apiKey: definition.apiKey } : {}),
                 ...(definition.baseUrl !== undefined ? { baseUrl: definition.baseUrl } : {}),
+                ...(definition.promptCaching !== undefined ? { promptCaching: definition.promptCaching } : {}),
             });
         }
         case "openai-compat": {

package/dist/compose.js

@@ -201,8 +201,13 @@ export function composeApprovalChain(extensions) {
                 try {
                     v = await Promise.resolve(policy.decide(payload, ctx));
                 }
-                catch {
+                catch (err) {
                     v = { action: "ask" }; // a throwing policy counts as ask — it speaks, never silently
+                    // PH-1a (finding PH-F17): the degradation itself must speak
+                    // too — a permanently-throwing policy used to manifest only
+                    // as "why is it asking me about everything?". One stderr
+                    // line, naming the extension; the verdict is unchanged.
+                    console.error(`[kiso] approval policy from extension "${extension}" threw (${err instanceof Error ? err.message : String(err)}) — degraded to ask`);
                 }
                 if (v.action === "abstain")
                     continue; // no opinion — not a verdict

package/dist/index.d.ts

@@ -31,6 +31,8 @@ export { disposeExtensions, loadExtensions, loadProjectExtensions } from "./exte
 export type { KisoExtension } from "./extensions.js";
 export { executionForCallId, executionLedger } from "./ledger.js";
 export type { ExecutionRecord, ExecutionStatus } from "./ledger.js";
+export { assessTasks } from "./task-assessment.js";
+export type { EvidenceVerdict, TaskAssessment, TaskClaim } from "./task-assessment.js";
 export { kisoHome, projectArtifacts, recordTrust, trustFor } from "./trust.js";
 export type { ProjectArtifact, ProjectArtifacts, TrustDecision, TrustRecord } from "./trust.js";
 export { canonicalizeUsage } from "./usage/canonical.js";

package/dist/index.js

@@ -31,6 +31,9 @@ export { SessionStore, StaleWriterError, StoreCorruptionError } from "./store.js
 export { disposeExtensions, loadExtensions, loadProjectExtensions } from "./extensions.js";
 // ledger
 export { executionForCallId, executionLedger } from "./ledger.js";
+// task assessment (TV-1A) — the pure projection separating the model's
+// CLAIM from VERIFIED under Verified ⟹ evidenceSeq > lastMutationSeq
+export { assessTasks } from "./task-assessment.js";
 // trust
 export { kisoHome, projectArtifacts, recordTrust, trustFor } from "./trust.js";
 // usage — the canonical accounting schema (E2/1.3.0, R4b-1 ruling:

package/dist/internal.d.ts

@@ -23,3 +23,5 @@ export * from "./lock-adapter.js";
 export * from "./ledger.js";
 export * from "./extensions.js";
 export * from "./trust.js";
+export * from "./provider/metadata.js";
+export { canonicalizeUsageForModel } from "./usage/canonical.js";

package/dist/internal.js

@@ -23,3 +23,10 @@ export * from "./lock-adapter.js";
 export * from "./ledger.js";
 export * from "./extensions.js";
 export * from "./trust.js";
+// PH-1c: the model metadata registry (capabilities + dated pricing) —
+// first-party consumers (the CLI window derivation) read it here; the
+// curated root surface does not move.
+export * from "./provider/metadata.js";
+// PH-1c: the model-keyed cost derivation rides the same door (the root
+// surface keeps only the frozen canonicalizeUsage).
+export { canonicalizeUsageForModel } from "./usage/canonical.js";

package/dist/provider/metadata.d.ts

@@ -0,0 +1,56 @@
+/**
+ * PH-1c — the model metadata table (findings PH-F14/PH-F15/PH-F16).
+ *
+ * Capabilities and pricing keyed by MODEL (+ optional endpoint), never
+ * by route: `anthropic`/`openai-compat` are protocol conventions — the
+ * same route serves models whose windows and rates have nothing in
+ * common, which is how the old route-keyed table priced an Anthropic
+ * run at DeepSeek's rates. The registry's one discipline: **unknown is
+ * null, everywhere** — an absent entry, an absent field, an unverified
+ * price all surface as null and no layer downstream may guess.
+ *
+ * Pricing is SEPARATE from capabilities (the review boundary): a price
+ * is a dated claim about someone else's billing page, so every entry
+ * carries `asOf` (the freeze date) and `source` (the page). A model we
+ * can name but not price stays `pricing: null` — the honest stamp the
+ * E2 nullable convention already defined.
+ *
+ * Lives under runtime/internal — the curated root surface (44 names)
+ * does not move; core is untouched.
+ */
+export interface ModelCapabilities {
+    /** tokens of context the model accepts; null = unknown. */
+    readonly contextWindow: number | null;
+    readonly maxOutputTokens: number | null;
+    /** "automatic" — the provider caches without request markup (DeepSeek,
+     *  OpenAI); "explicit" — the request must place cache_control
+     *  breakpoints (Anthropic); "none" — no caching; null = unknown. */
+    readonly promptCaching: "none" | "automatic" | "explicit" | null;
+    /** the model emits a reasoning stream (thinking); null = unknown. */
+    readonly reasoning: boolean | null;
+}
+export interface ModelPricing {
+    readonly inputPerM: number;
+    readonly outputPerM: number;
+    readonly cacheReadPerM: number;
+    readonly cacheWritePerM: number;
+    /** the date the rates were read — a price is a dated claim. */
+    readonly asOf: string;
+    /** the billing page the rates came from. */
+    readonly source: string;
+}
+export interface ModelMetadataEntry {
+    /** EXACT model id — v1 does no pattern matching. */
+    readonly model: string;
+    /** origin qualifier (e.g. "https://api.deepseek.com"): when present,
+     *  the entry matches only requests aimed at that endpoint. */
+    readonly endpoint?: string;
+    readonly capabilities: ModelCapabilities;
+    readonly pricing: ModelPricing | null;
+}
+/**
+ * Look a model up. `endpoint` narrows: an entry WITH an endpoint only
+ * matches when the caller's endpoint origin equals it; an entry without
+ * one matches any endpoint. Unknown model → null, never a default.
+ */
+export declare function lookupModelMetadata(model: string, endpoint?: string): ModelMetadataEntry | null;

package/dist/provider/metadata.js

@@ -0,0 +1,82 @@
+/**
+ * PH-1c — the model metadata table (findings PH-F14/PH-F15/PH-F16).
+ *
+ * Capabilities and pricing keyed by MODEL (+ optional endpoint), never
+ * by route: `anthropic`/`openai-compat` are protocol conventions — the
+ * same route serves models whose windows and rates have nothing in
+ * common, which is how the old route-keyed table priced an Anthropic
+ * run at DeepSeek's rates. The registry's one discipline: **unknown is
+ * null, everywhere** — an absent entry, an absent field, an unverified
+ * price all surface as null and no layer downstream may guess.
+ *
+ * Pricing is SEPARATE from capabilities (the review boundary): a price
+ * is a dated claim about someone else's billing page, so every entry
+ * carries `asOf` (the freeze date) and `source` (the page). A model we
+ * can name but not price stays `pricing: null` — the honest stamp the
+ * E2 nullable convention already defined.
+ *
+ * Lives under runtime/internal — the curated root surface (44 names)
+ * does not move; core is untouched.
+ */
+const DEEPSEEK_PRICING = {
+    // The E2-frozen rates (pricing table v1, freeze date 2026-08-13),
+    // re-homed here with their provenance made explicit. The caveat
+    // carries forward verbatim: an approximation, not a bill.
+    inputPerM: 0.27,
+    outputPerM: 1.1,
+    cacheReadPerM: 0.027,
+    cacheWritePerM: 0,
+    asOf: "2026-08-13",
+    source: "https://api-docs.deepseek.com/quick_start/pricing",
+};
+/** The v1 table. Nulls outnumber numbers ON PURPOSE: only values with a
+ *  named source enter; everything else waits for one. */
+const ENTRIES = [
+    {
+        model: "deepseek-chat",
+        endpoint: "https://api.deepseek.com",
+        capabilities: { contextWindow: null, maxOutputTokens: null, promptCaching: "automatic", reasoning: false },
+        pricing: DEEPSEEK_PRICING,
+    },
+    {
+        model: "deepseek-reasoner",
+        endpoint: "https://api.deepseek.com",
+        capabilities: { contextWindow: null, maxOutputTokens: null, promptCaching: "automatic", reasoning: true },
+        pricing: DEEPSEEK_PRICING,
+    },
+    {
+        model: "claude-sonnet-5",
+        capabilities: { contextWindow: 200_000, maxOutputTokens: null, promptCaching: "explicit", reasoning: true },
+        // Priced only when the rates are read from the live billing page
+        // and dated — never copied from memory (the review's boundary ②).
+        pricing: null,
+    },
+    {
+        model: "gpt-4o",
+        capabilities: { contextWindow: 128_000, maxOutputTokens: null, promptCaching: "automatic", reasoning: false },
+        pricing: null,
+    },
+];
+/**
+ * Look a model up. `endpoint` narrows: an entry WITH an endpoint only
+ * matches when the caller's endpoint origin equals it; an entry without
+ * one matches any endpoint. Unknown model → null, never a default.
+ */
+export function lookupModelMetadata(model, endpoint) {
+    for (const entry of ENTRIES) {
+        if (entry.model !== model)
+            continue;
+        if (entry.endpoint !== undefined && endpoint !== undefined && entry.endpoint !== originOf(endpoint))
+            continue;
+        return entry;
+    }
+    return null;
+}
+function originOf(endpoint) {
+    try {
+        return new URL(endpoint).origin;
+    }
+    catch {
+        return endpoint;
+    }
+}

package/dist/run.d.ts

@@ -13,7 +13,7 @@ import { type AgentSession, type SessionConfig } from "./session.js";
 export declare class Run implements AsyncIterable<Event> {
     #private;
     runId: string;
-    constructor(store: SessionStore, adapter: Adapter, config: SessionConfig, session: AgentSession, input: string | undefined, externalSignal: AbortSignalLike | undefined, resume: boolean);
+    constructor(store: SessionStore, adapter: Adapter, config: SessionConfig, session: AgentSession, input: string | undefined, externalSignal: AbortSignalLike | undefined, resume: boolean, source?: import("@vincemakes/kiso-core").MessageSource);
     /** Cancel the run: propagates to the adapter (SDK) and future executions. */
     abort(): void;
     [Symbol.asyncIterator](): AsyncIterator<Event>;

package/dist/run.js

@@ -23,12 +23,17 @@ export class Run {
     #session;
     #input;
     #resume;
+    #source;
     #abort = new AbortController();
     #externalSignal;
     #decisionIds = [];
     #uncertaintyIds = [];
     #started = false;
-    constructor(store, adapter, config, session, input, externalSignal, resume) {
+    constructor(store, adapter, config, session, input, externalSignal, resume, 
+    // TV-1B: durable PROVENANCE for the input (e.g. the verification
+    // seed's source:"system") — who produced the line, never a
+    // provider-role escalation. Absent = plain user input.
+    source) {
         this.#store = store;
         this.#adapter = adapter;
         this.#config = config;
@@ -36,6 +41,7 @@ export class Run {
         this.#input = input;
         this.#externalSignal = externalSignal;
         this.#resume = resume;
+        this.#source = source;
         this.runId = crypto.randomUUID();
     }
     /** Cancel the run: propagates to the adapter (SDK) and future executions. */
@@ -244,7 +250,7 @@ export class Run {
             //    session. The prompt is also the first event the consumer
             //    sees, so what was asked and what happened live in the same
             //    stream.
-            const inputEvent = log.append({ type: "user_input", content: this.#input });
+            const inputEvent = log.append({ type: "user_input", content: this.#input, ...(this.#source !== undefined ? { source: this.#source } : {}) });
             await this.#session.persist(this.runId, inputEvent);
             yield inputEvent;
             // 2. The loop projects from the session log — multi-turn context
@@ -430,8 +436,12 @@ export class Run {
                 verdict = chainVerdict;
             }
         }
-        catch {
+        catch (err) {
             verdict = { action: "ask" };
+            // PH-1a (finding PH-F17): same speaking degradation as the chain's
+            // per-policy catch — the recovery path has no extension name, so
+            // the chain is named as a whole.
+            console.error(`[kiso] approval chain threw during recovery (${err instanceof Error ? err.message : String(err)}) — degraded to ask`);
         }
         if (verdict === undefined && hooks?.onPreTool !== undefined) {
             const decision = await abortable(Promise.resolve(hooks.onPreTool(payload, { sessionId: this.#session.id })), signal);
@@ -714,8 +724,8 @@ export class Run {
         }
         // ruling #12 correction one: the honest note rides the recovered failure too —
         // the receipt and the repaired tool_result reproduce the live path
-        // losslessly.
-        if (result.isError && tool?.idempotent !== true) {
+        // losslessly. WR-1-F1: precondition refusals excluded — nothing ran.
+        if (result.isError && result.errorKind !== "precondition" && tool?.idempotent !== true) {
             result = {
                 ...result,
                 content: `${result.content}\n[non-idempotent tool failed — its side effects may have partially applied; verify before retrying]`,

package/dist/session.d.ts

@@ -28,6 +28,7 @@
  * same package, same exports (index.ts re-exports all four).
  */
 import { EventLog, type AbortSignalLike, type Adapter, type Event, type KisoExtension, type Message, type PermissionDecision, type Tool } from "@vincemakes/kiso-core";
+import { type TaskAssessment } from "./task-assessment.js";
 import { type SessionStore } from "./store.js";
 import { Run } from "./run.js";
 /** TUI2-R3v2 ③ — one off-trajectory model request (session.sideQuery).
@@ -113,9 +114,25 @@ export declare class AgentSession {
      * turns (dispatch's /model), never mid-run.
      */
     setAdapter(adapter: Adapter): void;
+    /**
+     * PH-1a (finding PH-F8, P0): the ATOMIC model switch — adapter, model
+     * id, and provider route replace together, effective at the next run.
+     * setAdapter alone is for a same-binding adapter swap (the faux
+     * re-arm); a switch that changes WHAT model answers must come through
+     * here, or the UI claims one model while requests carry another.
+     * Omitting `provider` clears the route — an unknown binding is
+     * canonicalized under the honest "adapter" route (null-priced), never
+     * the stale one. (The context window joins the binding when per-model
+     * metadata exists — the PH-1c registry.)
+     */
+    setModelBinding(binding: {
+        readonly adapter: Adapter;
+        readonly model: string;
+        readonly provider?: "anthropic" | "openai-compat";
+    }): void;
     /** E2: the adapter identity ("anthropic" | "openai-compat") — the route
      *  key the canonical consumer (CLI usage, the trace block) keys on. The
-     *  per-run tracer reads the SAME #config.provider; one source, one
+     *  per-run tracer reads the SAME live binding; one source, one
      *  route — the CLI and the trace can never disagree. */
     get provider(): "anthropic" | "openai-compat" | undefined;
     /**
@@ -158,6 +175,7 @@ export declare class AgentSession {
     /** Run one user turn. Iterate to consume; `run.abort()` cancels. */
     run(input: string, options?: {
         signal?: AbortSignalLike;
+        source?: import("@vincemakes/kiso-core").MessageSource;
     }): Run;
     /**
      * Continue the interrupted run (Area 2): apply durable decisions,
@@ -220,6 +238,20 @@ export declare class AgentSession {
     approve(decisionId: string, allow: boolean, reason?: string): Promise<void>;
     /** Executions that started but never reported a result (crash window). */
     uncertainExecutions(): import("./ledger.js").ExecutionRecord[];
+    /**
+     * TV-1A — assess the task claims and their evidence freshness over THIS
+     * session's durable log. The non-mutating set comes from the live tools'
+     * own `effects.precommitSafe` certificates (one direction of truth,
+     * never a second declaration) — the read-only+free+local contract, the
+     * only certificate that proves the world untouched. `concurrency:
+     * "shared"` is a SCHEDULING promise and never feeds this set (TV-1C —
+     * slow_touch is shared and writes). The evidence policy defaults to
+     * {"shell"} — the convention the task extension's own "make the LAST
+     * item a verification step" guidance produces.
+     */
+    assessTasks(opts?: {
+        readonly evidenceTools?: ReadonlySet<string>;
+    }): TaskAssessment;
     /**
      * The human's verdict on an interrupted execution, keyed by EXECUTION ID
      * (B group): "rerun" (the human says the side effect did NOT happen — the

package/dist/session.js

@@ -29,9 +29,14 @@
  */
 import { EventLog, projectMessages, } from "@vincemakes/kiso-core";
 import { executionLedger } from "./ledger.js";
+import { assessTasks } from "./task-assessment.js";
+/** TV-1A — the session-level evidence policy: the PURE projection defaults
+ *  to ∅ (never inventing evidence); the session names the one built-in
+ *  verification surface. Override per call for custom evidence tools. */
+const DEFAULT_EVIDENCE_TOOLS = new Set(["shell"]);
 import { denialResult } from "@vincemakes/kiso-core";
 import { DROP_PLACEHOLDER, estimateSummarySavings, KEEP_RECENT_ROUNDS, KEEP_TOKENS_DEFAULT, lastSummaryPoint, MAX_SUMMARY_FAILURES, policyTriggerFromWindow, serializeCovered, SUMMARY_MAX_OUTPUT, summarizeConversation, summaryBoundarySeq, } from "./summarize.js";
-import { canonicalizeUsage } from "./usage/canonical.js";
+import { canonicalizeUsageForModel } from "./usage/canonical.js";
 import { appendFileSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { estimateTokens } from "@vincemakes/kiso-core";
@@ -67,9 +72,18 @@ export class AgentSession {
     log;
     #store;
     // NOT readonly since 0.1.23: /model replaces it between runs (the
-    // constructor and setAdapter are the only writers).
+    // constructor, setAdapter, and setModelBinding are the only writers).
     #adapter;
     #config;
+    // PH-1a (finding PH-F8, P0): the LIVE model binding. #config froze the
+    // startup model/provider, so a /model switch replaced the adapter while
+    // every later run kept sending the OLD model id and canonicalizing
+    // usage under the OLD route. These two travel WITH the adapter now —
+    // setModelBinding writes all three in one call; runs read them through
+    // #effectiveConfig at run construction (next-turn semantics, same as
+    // setAdapter always had).
+    #model;
+    #provider;
     #pendingResolvers = new Map();
     #uncertaintyResolvers = new Map();
     #answered = new Set();
@@ -121,6 +135,16 @@ export class AgentSession {
         }
         const composedHooks = composeHooks(config.hooks, config.extensions ?? []);
         this.#config = composedHooks === undefined ? config : { ...config, hooks: composedHooks };
+        this.#model = config.model;
+        this.#provider = config.provider;
+    }
+    /** The config a NEW run/resume/summary sees: the frozen startup config
+     *  with the LIVE binding fields (model, provider) substituted. Built
+     *  fresh per call so an in-flight run keeps the config it started with
+     *  — the same boundary setAdapter has always drawn. */
+    #effectiveConfig() {
+        const { provider: _startup, ...rest } = this.#config;
+        return { ...rest, model: this.#model, ...(this.#provider !== undefined ? { provider: this.#provider } : {}) };
     }
     /** Write-ahead through the store; a rejected write POISONS the session
      *  (round 1/round 4): the in-memory log no longer matches the disk — whatever
@@ -165,12 +189,28 @@ export class AgentSession {
     setAdapter(adapter) {
         this.#adapter = adapter;
     }
+    /**
+     * PH-1a (finding PH-F8, P0): the ATOMIC model switch — adapter, model
+     * id, and provider route replace together, effective at the next run.
+     * setAdapter alone is for a same-binding adapter swap (the faux
+     * re-arm); a switch that changes WHAT model answers must come through
+     * here, or the UI claims one model while requests carry another.
+     * Omitting `provider` clears the route — an unknown binding is
+     * canonicalized under the honest "adapter" route (null-priced), never
+     * the stale one. (The context window joins the binding when per-model
+     * metadata exists — the PH-1c registry.)
+     */
+    setModelBinding(binding) {
+        this.#adapter = binding.adapter;
+        this.#model = binding.model;
+        this.#provider = binding.provider;
+    }
     /** E2: the adapter identity ("anthropic" | "openai-compat") — the route
      *  key the canonical consumer (CLI usage, the trace block) keys on. The
-     *  per-run tracer reads the SAME #config.provider; one source, one
+     *  per-run tracer reads the SAME live binding; one source, one
      *  route — the CLI and the trace can never disagree. */
     get provider() {
-        return this.#config.provider;
+        return this.#provider;
     }
     /**
      * TUI2-R3v2 ③ — ONE model request that belongs to no run (the
@@ -217,8 +257,8 @@ export class AgentSession {
             root: this.#store.root,
             sessionId: this.id,
             runId,
-            provider: this.#config.provider ?? "adapter",
-            model: this.#config.model,
+            provider: this.#provider ?? "adapter",
+            model: this.#model,
             adapterVersion: runtimeVersion(),
             purpose: options.purpose,
             // the manifest's seqRange pointers derive from the log, and a side
@@ -234,7 +274,7 @@ export class AgentSession {
         let text = "";
         try {
             for await (const ev of guarded.stream({
-                model: this.#config.model,
+                model: this.#model,
                 messages: [{ role: "user", content: options.prompt }],
                 systemPrompt: options.systemPrompt,
                 ...(options.maxTokens !== undefined ? { maxTokens: options.maxTokens } : {}),
@@ -252,7 +292,7 @@ export class AgentSession {
     /** Run one user turn. Iterate to consume; `run.abort()` cancels. */
     run(input, options) {
         this.ensureHealthy();
-        return new Run(this.#store, this.#adapter, this.#config, this, input, options?.signal, false);
+        return new Run(this.#store, this.#adapter, this.#effectiveConfig(), this, input, options?.signal, false, options?.source);
     }
     /**
      * Continue the interrupted run (Area 2): apply durable decisions,
@@ -262,7 +302,7 @@ export class AgentSession {
      */
     resume() {
         this.ensureHealthy();
-        return new Run(this.#store, this.#adapter, this.#config, this, undefined, undefined, true);
+        return new Run(this.#store, this.#adapter, this.#effectiveConfig(), this, undefined, undefined, true);
     }
     /**
      * /compact (ADR-0044): compress the older conversation with a model
@@ -317,7 +357,7 @@ export class AgentSession {
         else {
             const call = await summarizeConversation({
                 adapter: this.#adapter,
-                model: this.#config.model,
+                model: this.#model,
                 // E6 (a): ONE serialized user message — the DSML bug's
                 // raw-message array is structurally dead on this path.
                 messages: [{ role: "user", content: serializedInput }],
@@ -351,7 +391,7 @@ export class AgentSession {
         // a degraded ledger costs one stderr line, never the summary.
         if (usage !== null) {
             try {
-                const canonical = canonicalizeUsage(this.#config.provider ?? "adapter", usage);
+                const canonical = canonicalizeUsageForModel(this.#model, undefined, this.#provider ?? "adapter", usage);
                 const line = JSON.stringify({ kind: "summary", canonical }) + "\n";
                 mkdirSync(join(this.#store.root, "traces"), { recursive: true });
                 appendFileSync(join(this.#store.root, "traces", `${this.id}.jsonl`), line);
@@ -528,6 +568,28 @@ export class AgentSession {
     uncertainExecutions() {
         return [...executionLedger(this.log.all).values()].filter((r) => r.status === "uncertain");
     }
+    /**
+     * TV-1A — assess the task claims and their evidence freshness over THIS
+     * session's durable log. The non-mutating set comes from the live tools'
+     * own `effects.precommitSafe` certificates (one direction of truth,
+     * never a second declaration) — the read-only+free+local contract, the
+     * only certificate that proves the world untouched. `concurrency:
+     * "shared"` is a SCHEDULING promise and never feeds this set (TV-1C —
+     * slow_touch is shared and writes). The evidence policy defaults to
+     * {"shell"} — the convention the task extension's own "make the LAST
+     * item a verification step" guidance produces.
+     */
+    assessTasks(opts) {
+        const nonMutatingTools = new Set();
+        for (const tool of this.#config.registry.list()) {
+            if (tool.effects?.precommitSafe === true)
+                nonMutatingTools.add(tool.name);
+        }
+        return assessTasks(this.log.all, {
+            nonMutatingTools,
+            evidenceTools: opts?.evidenceTools ?? DEFAULT_EVIDENCE_TOOLS,
+        });
+    }
     /**
      * The human's verdict on an interrupted execution, keyed by EXECUTION ID
      * (B group): "rerun" (the human says the side effect did NOT happen — the

package/dist/task-assessment.d.ts

@@ -0,0 +1,93 @@
+/**
+ * TV-1A — TaskAssessment as a PURE PROJECTION + Evidence Freshness.
+ *
+ * The task checklist the model maintains through task_set is a SELF-REPORT:
+ * an item is "done" because the model said so. This projection mechanically
+ * separates that CLAIM from VERIFIED, under one frozen sentence:
+ *
+ *   Verified ⟹ evidenceSeq > lastRelevantMutationSeq.
+ *
+ * No new event kind, no core diff — the projection reads the existing
+ * durable vocabulary (`deriveRecoveryPlan` is the shape precedent). The
+ * classifiers are maximally conservative; the exemptions are exactly
+ * three (TV-1C — no wider taxonomy exists or is wanted):
+ *
+ * - MUTATION marker: `tool_execution_started` (intent-to-effect) of any
+ *   name NOT in `nonMutatingTools`. Started — not the receipt — so failed
+ *   and crash-window executions invalidate too, and pre-EC-1 overlap eras
+ *   are covered by the same rule. Absence of a certificate is a mutation.
+ *   The exemption set is fed by `effects.precommitSafe` — the frozen
+ *   read-only+free+local contract, the only certificate that PROVES the
+ *   world untouched. `concurrency: "shared"` proves overlap-safety and
+ *   nothing else (the TV-1C finding: slow_touch is shared AND writes) —
+ *   it never feeds this set.
+ *   ONE proven exception (TV-1B, grounded in WR-1A): an execution whose
+ *   terminal receipt is failed(errorKind:"precondition") never counts —
+ *   that kind's frozen contract is "work refused BEFORE it starts".
+ * - EVIDENCE: only receipts (`tool_execution_succeeded`) of names in
+ *   `evidenceTools`. Default ∅ — the projection never invents evidence.
+ *   What TV-1A's verdict asserts is POSITIONAL: the arc's last
+ *   intent-to-effect was a successful evidence-class run — an "evidence",
+ *   never a "proof" (semantic knowledge is the TV-1B driver's).
+ * - task_set itself never invalidates: recording the claim after the check
+ *   is the natural arc (tests → mark done), and the claim-recording act
+ *   mutates nothing the evidence observed.
+ * - VOIDED RANGES (TV-1C): a `model_output_abandoned` marker voids
+ *   (voidFromSeq, seq] — the durable vocabulary's own "never happened",
+ *   the same ranges the kernel projection skips. Every consumer here
+ *   skips them uniformly: a voided echo is not a claim, a voided receipt
+ *   is not evidence, a voided start is not a mutation. task_set waits
+ *   for turn commit today (TT-1), so the scheduler already keeps claims
+ *   out of voided turns — the projection encodes the admissibility rule
+ *   itself instead of relying on that forever.
+ *
+ * `verified` means FRESH EVIDENCE UNDER THE CONFIGURED POLICY — never
+ * "objectively proven correct". Goal Truth is external (PE-1's
+ * evaluator); this projection only ever ranks the model's own claim
+ * against the trajectory's own receipts.
+ */
+import type { Event } from "@vincemakes/kiso-core";
+/** One item of the model's plan, exactly as last claimed. */
+export interface TaskClaim {
+    readonly text: string;
+    readonly status: "pending" | "active" | "done";
+}
+/** The freshness verdict. `stale` and `unreadable` NAME their cause. */
+export type EvidenceVerdict = {
+    readonly kind: "verified";
+    readonly evidenceSeq: number;
+} | {
+    readonly kind: "stale";
+    readonly evidenceSeq: number;
+    readonly invalidatedBySeq: number;
+} | {
+    readonly kind: "none";
+} | {
+    readonly kind: "unreadable";
+    readonly atSeq: number;
+    readonly reason: string;
+};
+export interface TaskAssessment {
+    /** The LAST successful task_set echo, parsed — the model's claims. */
+    readonly claims: readonly TaskClaim[];
+    /** True only for a non-empty plan whose every item is claimed done. */
+    readonly allClaimedDone: boolean;
+    readonly lastTaskSetSeq: number | null;
+    /** Seq of the last mutation-class `tool_execution_started`, if any. */
+    readonly lastMutationSeq: number | null;
+    readonly evidence: EvidenceVerdict;
+}
+/**
+ * Assess the task claims and their evidence freshness over a durable
+ * trajectory. Pure: same events, same options, same assessment.
+ */
+export declare function assessTasks(events: readonly Event[], opts?: {
+    /** Names whose executions PROVABLY never mutate the observable
+     *  world (from `effects.precommitSafe` certificates — read-only +
+     *  free + local). `concurrency: "shared"` is NOT such a proof
+     *  (TV-1C). Default ∅ — everything mutates. */
+    readonly nonMutatingTools?: ReadonlySet<string>;
+    /** Names whose successful receipts count as evidence. Default ∅ —
+     *  nothing does. */
+    readonly evidenceTools?: ReadonlySet<string>;
+}): TaskAssessment;

package/dist/task-assessment.js

@@ -0,0 +1,165 @@
+/**
+ * TV-1A — TaskAssessment as a PURE PROJECTION + Evidence Freshness.
+ *
+ * The task checklist the model maintains through task_set is a SELF-REPORT:
+ * an item is "done" because the model said so. This projection mechanically
+ * separates that CLAIM from VERIFIED, under one frozen sentence:
+ *
+ *   Verified ⟹ evidenceSeq > lastRelevantMutationSeq.
+ *
+ * No new event kind, no core diff — the projection reads the existing
+ * durable vocabulary (`deriveRecoveryPlan` is the shape precedent). The
+ * classifiers are maximally conservative; the exemptions are exactly
+ * three (TV-1C — no wider taxonomy exists or is wanted):
+ *
+ * - MUTATION marker: `tool_execution_started` (intent-to-effect) of any
+ *   name NOT in `nonMutatingTools`. Started — not the receipt — so failed
+ *   and crash-window executions invalidate too, and pre-EC-1 overlap eras
+ *   are covered by the same rule. Absence of a certificate is a mutation.
+ *   The exemption set is fed by `effects.precommitSafe` — the frozen
+ *   read-only+free+local contract, the only certificate that PROVES the
+ *   world untouched. `concurrency: "shared"` proves overlap-safety and
+ *   nothing else (the TV-1C finding: slow_touch is shared AND writes) —
+ *   it never feeds this set.
+ *   ONE proven exception (TV-1B, grounded in WR-1A): an execution whose
+ *   terminal receipt is failed(errorKind:"precondition") never counts —
+ *   that kind's frozen contract is "work refused BEFORE it starts".
+ * - EVIDENCE: only receipts (`tool_execution_succeeded`) of names in
+ *   `evidenceTools`. Default ∅ — the projection never invents evidence.
+ *   What TV-1A's verdict asserts is POSITIONAL: the arc's last
+ *   intent-to-effect was a successful evidence-class run — an "evidence",
+ *   never a "proof" (semantic knowledge is the TV-1B driver's).
+ * - task_set itself never invalidates: recording the claim after the check
+ *   is the natural arc (tests → mark done), and the claim-recording act
+ *   mutates nothing the evidence observed.
+ * - VOIDED RANGES (TV-1C): a `model_output_abandoned` marker voids
+ *   (voidFromSeq, seq] — the durable vocabulary's own "never happened",
+ *   the same ranges the kernel projection skips. Every consumer here
+ *   skips them uniformly: a voided echo is not a claim, a voided receipt
+ *   is not evidence, a voided start is not a mutation. task_set waits
+ *   for turn commit today (TT-1), so the scheduler already keeps claims
+ *   out of voided turns — the projection encodes the admissibility rule
+ *   itself instead of relying on that forever.
+ *
+ * `verified` means FRESH EVIDENCE UNDER THE CONFIGURED POLICY — never
+ * "objectively proven correct". Goal Truth is external (PE-1's
+ * evaluator); this projection only ever ranks the model's own claim
+ * against the trajectory's own receipts.
+ */
+const TASK_TOOL = "task_set";
+const STATUSES = new Set(["pending", "active", "done"]);
+const COUNT_LINE = /^\[task\] (\d+) items? — (\d+) pending, (\d+) active, (\d+) done$/;
+const ITEM_LINE = /^\[(\w+)\] (.*)$/;
+/** Parse the canonical task_set echo (the frozen content contract the
+ *  checklist cell also reads). Returns the claims, or the reason it
+ *  cannot — never a guess. */
+function parseEcho(content) {
+    const lines = content.split("\n");
+    const head = COUNT_LINE.exec(lines[0] ?? "");
+    if (head === null)
+        return { reason: "line 1 is not the [task] count line" };
+    const total = Number(head[1]);
+    const declared = { pending: Number(head[2]), active: Number(head[3]), done: Number(head[4]) };
+    const claims = [];
+    for (let i = 1; i < lines.length; i += 1) {
+        const m = ITEM_LINE.exec(lines[i]);
+        if (m === null || !STATUSES.has(m[1]))
+            return { reason: `line ${i + 1} is not a [pending|active|done] item line` };
+        claims.push({ text: m[2], status: m[1] });
+    }
+    const counts = { pending: 0, active: 0, done: 0 };
+    for (const c of claims)
+        counts[c.status] += 1;
+    if (claims.length !== total || counts.pending !== declared.pending || counts.active !== declared.active || counts.done !== declared.done) {
+        return { reason: "the count line disagrees with the item lines" };
+    }
+    return { claims };
+}
+/**
+ * Assess the task claims and their evidence freshness over a durable
+ * trajectory. Pure: same events, same options, same assessment.
+ */
+export function assessTasks(events, opts) {
+    const nonMutating = opts?.nonMutatingTools ?? new Set();
+    const evidenceNames = opts?.evidenceTools ?? new Set();
+    // TV-1C: PASS 0 — the voided ranges. (voidFromSeq, seq] of every
+    // `model_output_abandoned` marker is "never happened" for this whole
+    // projection, exactly as the kernel's own context projection treats
+    // it. Markers are rare; a linear range check is honest and enough.
+    const voidRanges = [];
+    for (const ev of events) {
+        if (ev.type === "model_output_abandoned")
+            voidRanges.push({ from: ev.voidFromSeq, to: ev.seq });
+    }
+    const voided = (seq) => voidRanges.some((r) => seq > r.from && seq <= r.to);
+    // TV-1B: PASS 1 — executions whose terminal receipt is a
+    // PRECONDITION failure are PROVEN no-mutation (WR-1A froze that
+    // contract: work refused before it starts). Everything else stays
+    // conservative: no receipt (crash window), fatal/transient/
+    // invalid_input, success, and legacy receipts with no errorKind.
+    // Two passes, no temporal rollback state — same events, same verdict.
+    const provenNoMutation = new Set();
+    for (const ev of events) {
+        if (voided(ev.seq))
+            continue;
+        if (ev.type === "tool_execution_failed" && ev.errorKind === "precondition") {
+            provenNoMutation.add(ev.executionId);
+        }
+    }
+    const nameByExecution = new Map();
+    let claims = [];
+    let lastTaskSetSeq = null;
+    let unreadable = null;
+    let lastMutationSeq = null;
+    let lastEvidenceSeq = null;
+    let staleBySeq = null;
+    for (const ev of events) {
+        if (voided(ev.seq))
+            continue;
+        if (ev.type === "tool_execution_started") {
+            nameByExecution.set(ev.executionId, ev.name);
+            if (ev.name !== TASK_TOOL && !nonMutating.has(ev.name) && !provenNoMutation.has(ev.executionId)) {
+                lastMutationSeq = ev.seq;
+                if (lastEvidenceSeq !== null && staleBySeq === null)
+                    staleBySeq = ev.seq;
+            }
+        }
+        else if (ev.type === "tool_execution_succeeded") {
+            const name = nameByExecution.get(ev.executionId);
+            if (name === TASK_TOOL) {
+                const parsed = parseEcho(ev.result.content);
+                if ("reason" in parsed) {
+                    unreadable = { atSeq: ev.seq, reason: parsed.reason };
+                    claims = [];
+                    lastTaskSetSeq = ev.seq;
+                }
+                else {
+                    unreadable = null;
+                    claims = parsed.claims;
+                    lastTaskSetSeq = ev.seq;
+                }
+            }
+            else if (name !== undefined && evidenceNames.has(name)) {
+                // a fresh evidence receipt supersedes both the older evidence
+                // AND any staleness its own start incurred.
+                lastEvidenceSeq = ev.seq;
+                staleBySeq = null;
+            }
+        }
+    }
+    const allClaimedDone = claims.length > 0 && claims.every((c) => c.status === "done");
+    let evidence;
+    if (unreadable !== null) {
+        evidence = { kind: "unreadable", atSeq: unreadable.atSeq, reason: unreadable.reason };
+    }
+    else if (lastEvidenceSeq === null) {
+        evidence = { kind: "none" };
+    }
+    else if (staleBySeq !== null) {
+        evidence = { kind: "stale", evidenceSeq: lastEvidenceSeq, invalidatedBySeq: staleBySeq };
+    }
+    else {
+        evidence = { kind: "verified", evidenceSeq: lastEvidenceSeq };
+    }
+    return { claims, allClaimedDone, lastTaskSetSeq, lastMutationSeq, evidence };
+}

package/dist/trace/guard.js

@@ -25,7 +25,7 @@ import { randomUUID } from "node:crypto";
 import { buildContextManifest, segmentHashes } from "./manifest.js";
 import { cacheableHashes } from "./analyze.js";
 import { hashContext, hashSystemPrompt, hashToolSpecs, stablePrefixFingerprint } from "./hash.js";
-import { PRICING_TABLE_V1, canonicalizeUsage } from "../usage/canonical.js";
+import { PRICING_TABLE_V1, canonicalizeUsageForModel } from "../usage/canonical.js";
 import { buildRentLedger } from "./rent.js";
 import { TRACE_SCHEMA_VERSION } from "./record.js";
 import { TraceWriter } from "./writer.js";
@@ -201,11 +201,14 @@ export class RequestTracer {
             record.cacheWrite = p.cacheWrite ?? null;
             record.output = p.outputTokens ?? 0;
         }
-        // E2 — the canonical block formalizes the same raw (the route-keyed
-        // mapping; the validator pins block == quartet, so the two can never
-        // drift apart). Unknown usage canonicalizes to the "0 = unknown"
-        // convention, consistent with the quartet above.
-        record.canonical = canonicalizeUsage(this.#provider, {
+        // E2 — the canonical block formalizes the same raw (the validator
+        // pins block == quartet, so the two can never drift apart). Unknown
+        // usage canonicalizes to the "0 = unknown" convention, consistent
+        // with the quartet above. PH-1c: the PRICE keys on the record's own
+        // MODEL via the metadata registry (route-keyed pricing priced an
+        // Anthropic run at DeepSeek's rates); the convention still keys on
+        // the route. An unpriced model costs null — never a fallback rate.
+        record.canonical = canonicalizeUsageForModel(record.model, undefined, this.#provider, {
             inputTokens: p.inputTokens,
             outputTokens: p.outputTokens,
             cacheRead: p.cacheRead,

package/dist/usage/canonical.d.ts

@@ -111,6 +111,21 @@ export declare function priceFor(route: string, u: {
  *  builtin v1 table so the export's default behavior is the pinned one
  *  and a future injection never widens this frozen signature. */
 export declare function canonicalizeUsage(route: string, raw: RawUsage, table?: PricingTable): CanonicalUsage;
+/**
+ * PH-1c — the MODEL-KEYED cost path (findings PH-F14/PH-F16). The
+ * convention still keys on the ROUTE (a protocol property: fresh vs
+ * total input); the PRICE keys on the model+endpoint metadata entry —
+ * the route-keyed table is how an Anthropic run got priced at
+ * DeepSeek's rates. No metadata entry, or an entry with `pricing:
+ * null`, costs null — the honest stamp, never a fallback rate.
+ *
+ * A NEW function beside canonicalizeUsage, not a widened signature —
+ * the E2 ruling froze that one ("a future injection never widens this
+ * frozen signature"), and this is the future it reserved room for.
+ * Metadata-priced records stamp pricingTableId "metadata" (version 1);
+ * the (id, version) tuple ritual carries forward unchanged.
+ */
+export declare function canonicalizeUsageForModel(model: string, endpoint: string | undefined, route: string, raw: RawUsage): CanonicalUsage;
 /** The canonical schema's invariants, machine-checked: closed key set;
  *  non-negative numbers; cacheWrite/reasoning null-or-number; the pinned
  *  sentence — cacheRead can never exceed total (= input + cacheRead +

package/dist/usage/canonical.js

@@ -27,6 +27,7 @@
  * accounting boundary (R4 Case B, pure derivation; the union does not
  * move). Raw is provider observation; canonical is the accounting truth.
  */
+import { lookupModelMetadata } from "../provider/metadata.js";
 /** The route → input-convention table (R2a). `input` semantics differ
  *  between the two routes; the convention is a property of the ROUTE, not
  *  the provider. Unknown routes fall back to "total" — exactly the
@@ -61,15 +62,14 @@ export function pricingTableFor(version) {
     return table;
 }
 export function priceFor(route, u, table) {
-    // The R5b-④c semantics: a REAL route (an INPUT_CONVENTIONS key — the
-    // routes the table is expected to price) missing from the table is a
-    // HOLE → null, the explicit-absent stamp. The builtin table never
-    // backfills an injected table's hole. Unknown routes keep the legacy
-    // within-table mirror fallback (the total-convention entry, matching
-    // the convention fallback above — one table, one fallback, no drift);
-    // a table without even the mirror entry yields null, never a crash.
-    const entry = table.entries[route] ??
-        (route in INPUT_CONVENTIONS ? undefined : table.entries["openai-compat"]);
+    // PH-1a (supersedes R5b-④c's mirror fallback): a route missing from
+    // the table is a HOLE → null, the explicit-absent stamp — REAL routes
+    // and unknown routes alike. The retired mirror fallback priced the
+    // "adapter" route (a directly-injected adapter, finding PH-F7) at the
+    // openai-compat entry: a fabricated cost on exactly the runs whose
+    // rates are unknown. null is the honest answer; the builtin table
+    // never backfills an injected table's hole either.
+    const entry = table.entries[route];
     if (entry === undefined)
         return null;
     return ((u.input * entry.inputPerM +
@@ -107,6 +107,37 @@ export function canonicalizeUsage(route, raw, table = PRICING_TABLE_V1) {
         pricingTableVersion: table.version,
     };
 }
+/**
+ * PH-1c — the MODEL-KEYED cost path (findings PH-F14/PH-F16). The
+ * convention still keys on the ROUTE (a protocol property: fresh vs
+ * total input); the PRICE keys on the model+endpoint metadata entry —
+ * the route-keyed table is how an Anthropic run got priced at
+ * DeepSeek's rates. No metadata entry, or an entry with `pricing:
+ * null`, costs null — the honest stamp, never a fallback rate.
+ *
+ * A NEW function beside canonicalizeUsage, not a widened signature —
+ * the E2 ruling froze that one ("a future injection never widens this
+ * frozen signature"), and this is the future it reserved room for.
+ * Metadata-priced records stamp pricingTableId "metadata" (version 1);
+ * the (id, version) tuple ritual carries forward unchanged.
+ */
+export function canonicalizeUsageForModel(model, endpoint, route, raw) {
+    const base = canonicalizeUsage(route, raw, EMPTY_TABLE); // convention math only — EMPTY_TABLE prices nothing
+    const entry = lookupModelMetadata(model, endpoint);
+    const pricing = entry?.pricing ?? null;
+    if (pricing === null) {
+        return { ...base, costUsd: null, pricingTableId: "metadata", pricingTableVersion: 1 };
+    }
+    const costUsd = (base.input * pricing.inputPerM +
+        base.output * pricing.outputPerM +
+        base.cacheRead * pricing.cacheReadPerM +
+        (base.cacheWrite ?? 0) * pricing.cacheWritePerM) /
+        1e6;
+    return { ...base, costUsd, pricingTableId: "metadata", pricingTableVersion: 1 };
+}
+/** No entries at all — canonicalizeUsageForModel's convention-only pass
+ *  through canonicalizeUsage; every price it could produce is null. */
+const EMPTY_TABLE = { id: "metadata", version: 1, entries: {} };
 // ── The validator ──────────────────────────────────────────────────────────
 // Strict by design: closed keys (a misspelled field can never enter a
 // ledger), non-negative numbers, the pinned sentence machine-checked, and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincemakes/kiso-runtime",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "kiso runtime — durable multi-turn agent sessions: AgentDefinition, AgentRuntime, AgentSession, Run, append-only JSONL store.",
   "type": "module",
   "license": "MIT",
@@ -25,11 +25,11 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@vincemakes/kiso-core": "0.13.0"
+    "@vincemakes/kiso-core": "0.15.0"
   },
   "peerDependencies": {
-    "@vincemakes/kiso-provider-anthropic": "0.13.0",
-    "@vincemakes/kiso-provider-openai": "0.13.0"
+    "@vincemakes/kiso-provider-anthropic": "0.15.0",
+    "@vincemakes/kiso-provider-openai": "0.15.0"
   },
   "peerDependenciesMeta": {
     "@vincemakes/kiso-provider-anthropic": {
@@ -40,7 +40,7 @@
     }
   },
   "devDependencies": {
-    "@vincemakes/kiso-evals": "0.13.0",
+    "@vincemakes/kiso-evals": "0.15.0",
     "@types/node": "^26.1.2",
     "typescript": "^5.7.2",
     "vitest": "^3.0.0"