@vincemakes/kiso-runtime 0.14.0 → 0.15.1

package/dist/agent.d.ts

@@ -39,6 +39,10 @@ export interface AgentDefinition {
     readonly provider?: "anthropic" | "openai-compat";
     readonly apiKey?: string;
     readonly baseUrl?: string;
+    /** PH-1c.1: opt-in Anthropic prompt caching (cache_control
+     *  breakpoints) — OFF by default; the openai-compat path ignores it
+     *  (that dialect's caching is server-automatic). Type-only additive. */
+    readonly promptCaching?: boolean;
     readonly maxTurns?: number;
     readonly maxTokens?: number;
     readonly temperature?: number;
@@ -90,4 +94,5 @@ export declare function createAgent(definition: AgentDefinition): AgentRuntime;
 export declare function buildAdapter(provider: "anthropic" | "openai-compat", opts?: {
     readonly apiKey?: string;
     readonly baseUrl?: string;
+    readonly promptCaching?: boolean;
 }): Promise<Adapter>;

package/dist/agent.js

@@ -132,6 +132,7 @@ async function resolveAdapter(definition) {
             return createAnthropicProvider({
                 ...(definition.apiKey !== undefined ? { apiKey: definition.apiKey } : {}),
                 ...(definition.baseUrl !== undefined ? { baseUrl: definition.baseUrl } : {}),
+                ...(definition.promptCaching !== undefined ? { promptCaching: definition.promptCaching } : {}),
             });
         }
         case "openai-compat": {

package/dist/compose.js

@@ -201,8 +201,13 @@ export function composeApprovalChain(extensions) {
                 try {
                     v = await Promise.resolve(policy.decide(payload, ctx));
                 }
-                catch {
+                catch (err) {
                     v = { action: "ask" }; // a throwing policy counts as ask — it speaks, never silently
+                    // PH-1a (finding PH-F17): the degradation itself must speak
+                    // too — a permanently-throwing policy used to manifest only
+                    // as "why is it asking me about everything?". One stderr
+                    // line, naming the extension; the verdict is unchanged.
+                    console.error(`[kiso] approval policy from extension "${extension}" threw (${err instanceof Error ? err.message : String(err)}) — degraded to ask`);
                 }
                 if (v.action === "abstain")
                     continue; // no opinion — not a verdict

package/dist/internal.d.ts

@@ -23,3 +23,5 @@ export * from "./lock-adapter.js";
 export * from "./ledger.js";
 export * from "./extensions.js";
 export * from "./trust.js";
+export * from "./provider/metadata.js";
+export { canonicalizeUsageForModel } from "./usage/canonical.js";

package/dist/internal.js

@@ -23,3 +23,10 @@ export * from "./lock-adapter.js";
 export * from "./ledger.js";
 export * from "./extensions.js";
 export * from "./trust.js";
+// PH-1c: the model metadata registry (capabilities + dated pricing) —
+// first-party consumers (the CLI window derivation) read it here; the
+// curated root surface does not move.
+export * from "./provider/metadata.js";
+// PH-1c: the model-keyed cost derivation rides the same door (the root
+// surface keeps only the frozen canonicalizeUsage).
+export { canonicalizeUsageForModel } from "./usage/canonical.js";

package/dist/provider/metadata.d.ts

@@ -0,0 +1,56 @@
+/**
+ * PH-1c — the model metadata table (findings PH-F14/PH-F15/PH-F16).
+ *
+ * Capabilities and pricing keyed by MODEL (+ optional endpoint), never
+ * by route: `anthropic`/`openai-compat` are protocol conventions — the
+ * same route serves models whose windows and rates have nothing in
+ * common, which is how the old route-keyed table priced an Anthropic
+ * run at DeepSeek's rates. The registry's one discipline: **unknown is
+ * null, everywhere** — an absent entry, an absent field, an unverified
+ * price all surface as null and no layer downstream may guess.
+ *
+ * Pricing is SEPARATE from capabilities (the review boundary): a price
+ * is a dated claim about someone else's billing page, so every entry
+ * carries `asOf` (the freeze date) and `source` (the page). A model we
+ * can name but not price stays `pricing: null` — the honest stamp the
+ * E2 nullable convention already defined.
+ *
+ * Lives under runtime/internal — the curated root surface (44 names)
+ * does not move; core is untouched.
+ */
+export interface ModelCapabilities {
+    /** tokens of context the model accepts; null = unknown. */
+    readonly contextWindow: number | null;
+    readonly maxOutputTokens: number | null;
+    /** "automatic" — the provider caches without request markup (DeepSeek,
+     *  OpenAI); "explicit" — the request must place cache_control
+     *  breakpoints (Anthropic); "none" — no caching; null = unknown. */
+    readonly promptCaching: "none" | "automatic" | "explicit" | null;
+    /** the model emits a reasoning stream (thinking); null = unknown. */
+    readonly reasoning: boolean | null;
+}
+export interface ModelPricing {
+    readonly inputPerM: number;
+    readonly outputPerM: number;
+    readonly cacheReadPerM: number;
+    readonly cacheWritePerM: number;
+    /** the date the rates were read — a price is a dated claim. */
+    readonly asOf: string;
+    /** the billing page the rates came from. */
+    readonly source: string;
+}
+export interface ModelMetadataEntry {
+    /** EXACT model id — v1 does no pattern matching. */
+    readonly model: string;
+    /** origin qualifier (e.g. "https://api.deepseek.com"): when present,
+     *  the entry matches only requests aimed at that endpoint. */
+    readonly endpoint?: string;
+    readonly capabilities: ModelCapabilities;
+    readonly pricing: ModelPricing | null;
+}
+/**
+ * Look a model up. `endpoint` narrows: an entry WITH an endpoint only
+ * matches when the caller's endpoint origin equals it; an entry without
+ * one matches any endpoint. Unknown model → null, never a default.
+ */
+export declare function lookupModelMetadata(model: string, endpoint?: string): ModelMetadataEntry | null;

package/dist/provider/metadata.js

@@ -0,0 +1,82 @@
+/**
+ * PH-1c — the model metadata table (findings PH-F14/PH-F15/PH-F16).
+ *
+ * Capabilities and pricing keyed by MODEL (+ optional endpoint), never
+ * by route: `anthropic`/`openai-compat` are protocol conventions — the
+ * same route serves models whose windows and rates have nothing in
+ * common, which is how the old route-keyed table priced an Anthropic
+ * run at DeepSeek's rates. The registry's one discipline: **unknown is
+ * null, everywhere** — an absent entry, an absent field, an unverified
+ * price all surface as null and no layer downstream may guess.
+ *
+ * Pricing is SEPARATE from capabilities (the review boundary): a price
+ * is a dated claim about someone else's billing page, so every entry
+ * carries `asOf` (the freeze date) and `source` (the page). A model we
+ * can name but not price stays `pricing: null` — the honest stamp the
+ * E2 nullable convention already defined.
+ *
+ * Lives under runtime/internal — the curated root surface (44 names)
+ * does not move; core is untouched.
+ */
+const DEEPSEEK_PRICING = {
+    // The E2-frozen rates (pricing table v1, freeze date 2026-08-13),
+    // re-homed here with their provenance made explicit. The caveat
+    // carries forward verbatim: an approximation, not a bill.
+    inputPerM: 0.27,
+    outputPerM: 1.1,
+    cacheReadPerM: 0.027,
+    cacheWritePerM: 0,
+    asOf: "2026-08-13",
+    source: "https://api-docs.deepseek.com/quick_start/pricing",
+};
+/** The v1 table. Nulls outnumber numbers ON PURPOSE: only values with a
+ *  named source enter; everything else waits for one. */
+const ENTRIES = [
+    {
+        model: "deepseek-chat",
+        endpoint: "https://api.deepseek.com",
+        capabilities: { contextWindow: null, maxOutputTokens: null, promptCaching: "automatic", reasoning: false },
+        pricing: DEEPSEEK_PRICING,
+    },
+    {
+        model: "deepseek-reasoner",
+        endpoint: "https://api.deepseek.com",
+        capabilities: { contextWindow: null, maxOutputTokens: null, promptCaching: "automatic", reasoning: true },
+        pricing: DEEPSEEK_PRICING,
+    },
+    {
+        model: "claude-sonnet-5",
+        capabilities: { contextWindow: 200_000, maxOutputTokens: null, promptCaching: "explicit", reasoning: true },
+        // Priced only when the rates are read from the live billing page
+        // and dated — never copied from memory (the review's boundary ②).
+        pricing: null,
+    },
+    {
+        model: "gpt-4o",
+        capabilities: { contextWindow: 128_000, maxOutputTokens: null, promptCaching: "automatic", reasoning: false },
+        pricing: null,
+    },
+];
+/**
+ * Look a model up. `endpoint` narrows: an entry WITH an endpoint only
+ * matches when the caller's endpoint origin equals it; an entry without
+ * one matches any endpoint. Unknown model → null, never a default.
+ */
+export function lookupModelMetadata(model, endpoint) {
+    for (const entry of ENTRIES) {
+        if (entry.model !== model)
+            continue;
+        if (entry.endpoint !== undefined && endpoint !== undefined && entry.endpoint !== originOf(endpoint))
+            continue;
+        return entry;
+    }
+    return null;
+}
+function originOf(endpoint) {
+    try {
+        return new URL(endpoint).origin;
+    }
+    catch {
+        return endpoint;
+    }
+}

package/dist/run.js

@@ -436,8 +436,12 @@ export class Run {
                 verdict = chainVerdict;
             }
         }
-        catch {
+        catch (err) {
             verdict = { action: "ask" };
+            // PH-1a (finding PH-F17): same speaking degradation as the chain's
+            // per-policy catch — the recovery path has no extension name, so
+            // the chain is named as a whole.
+            console.error(`[kiso] approval chain threw during recovery (${err instanceof Error ? err.message : String(err)}) — degraded to ask`);
         }
         if (verdict === undefined && hooks?.onPreTool !== undefined) {
             const decision = await abortable(Promise.resolve(hooks.onPreTool(payload, { sessionId: this.#session.id })), signal);

package/dist/session.d.ts

@@ -114,9 +114,25 @@ export declare class AgentSession {
      * turns (dispatch's /model), never mid-run.
      */
     setAdapter(adapter: Adapter): void;
+    /**
+     * PH-1a (finding PH-F8, P0): the ATOMIC model switch — adapter, model
+     * id, and provider route replace together, effective at the next run.
+     * setAdapter alone is for a same-binding adapter swap (the faux
+     * re-arm); a switch that changes WHAT model answers must come through
+     * here, or the UI claims one model while requests carry another.
+     * Omitting `provider` clears the route — an unknown binding is
+     * canonicalized under the honest "adapter" route (null-priced), never
+     * the stale one. (The context window joins the binding when per-model
+     * metadata exists — the PH-1c registry.)
+     */
+    setModelBinding(binding: {
+        readonly adapter: Adapter;
+        readonly model: string;
+        readonly provider?: "anthropic" | "openai-compat";
+    }): void;
     /** E2: the adapter identity ("anthropic" | "openai-compat") — the route
      *  key the canonical consumer (CLI usage, the trace block) keys on. The
-     *  per-run tracer reads the SAME #config.provider; one source, one
+     *  per-run tracer reads the SAME live binding; one source, one
      *  route — the CLI and the trace can never disagree. */
     get provider(): "anthropic" | "openai-compat" | undefined;
     /**
@@ -185,6 +201,7 @@ export declare class AgentSession {
         signal?: AbortSignalLike;
         onStart?: (info: CompactInfo) => void;
         drop?: boolean;
+        focus?: string;
     }): Promise<SummarizeResult | null>;
     /**
      * E6 — the run-start context policy (candidate A + the crux drop arm).
@@ -224,9 +241,12 @@ export declare class AgentSession {
     uncertainExecutions(): import("./ledger.js").ExecutionRecord[];
     /**
      * TV-1A — assess the task claims and their evidence freshness over THIS
-     * session's durable log. The shared-tool set comes from the live tools'
-     * own `effects.concurrency: "shared"` certificates (one direction of
-     * truth, never a second declaration); the evidence policy defaults to
+     * session's durable log. The non-mutating set comes from the live tools'
+     * own `effects.precommitSafe` certificates (one direction of truth,
+     * never a second declaration) — the read-only+free+local contract, the
+     * only certificate that proves the world untouched. `concurrency:
+     * "shared"` is a SCHEDULING promise and never feeds this set (TV-1C —
+     * slow_touch is shared and writes). The evidence policy defaults to
      * {"shell"} — the convention the task extension's own "make the LAST
      * item a verification step" guidance produces.
      */

package/dist/session.js

@@ -36,7 +36,7 @@ import { assessTasks } from "./task-assessment.js";
 const DEFAULT_EVIDENCE_TOOLS = new Set(["shell"]);
 import { denialResult } from "@vincemakes/kiso-core";
 import { DROP_PLACEHOLDER, estimateSummarySavings, KEEP_RECENT_ROUNDS, KEEP_TOKENS_DEFAULT, lastSummaryPoint, MAX_SUMMARY_FAILURES, policyTriggerFromWindow, serializeCovered, SUMMARY_MAX_OUTPUT, summarizeConversation, summaryBoundarySeq, } from "./summarize.js";
-import { canonicalizeUsage } from "./usage/canonical.js";
+import { canonicalizeUsageForModel } from "./usage/canonical.js";
 import { appendFileSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { estimateTokens } from "@vincemakes/kiso-core";
@@ -72,9 +72,18 @@ export class AgentSession {
     log;
     #store;
     // NOT readonly since 0.1.23: /model replaces it between runs (the
-    // constructor and setAdapter are the only writers).
+    // constructor, setAdapter, and setModelBinding are the only writers).
     #adapter;
     #config;
+    // PH-1a (finding PH-F8, P0): the LIVE model binding. #config froze the
+    // startup model/provider, so a /model switch replaced the adapter while
+    // every later run kept sending the OLD model id and canonicalizing
+    // usage under the OLD route. These two travel WITH the adapter now —
+    // setModelBinding writes all three in one call; runs read them through
+    // #effectiveConfig at run construction (next-turn semantics, same as
+    // setAdapter always had).
+    #model;
+    #provider;
     #pendingResolvers = new Map();
     #uncertaintyResolvers = new Map();
     #answered = new Set();
@@ -126,6 +135,16 @@ export class AgentSession {
         }
         const composedHooks = composeHooks(config.hooks, config.extensions ?? []);
         this.#config = composedHooks === undefined ? config : { ...config, hooks: composedHooks };
+        this.#model = config.model;
+        this.#provider = config.provider;
+    }
+    /** The config a NEW run/resume/summary sees: the frozen startup config
+     *  with the LIVE binding fields (model, provider) substituted. Built
+     *  fresh per call so an in-flight run keeps the config it started with
+     *  — the same boundary setAdapter has always drawn. */
+    #effectiveConfig() {
+        const { provider: _startup, ...rest } = this.#config;
+        return { ...rest, model: this.#model, ...(this.#provider !== undefined ? { provider: this.#provider } : {}) };
     }
     /** Write-ahead through the store; a rejected write POISONS the session
      *  (round 1/round 4): the in-memory log no longer matches the disk — whatever
@@ -170,12 +189,28 @@ export class AgentSession {
     setAdapter(adapter) {
         this.#adapter = adapter;
     }
+    /**
+     * PH-1a (finding PH-F8, P0): the ATOMIC model switch — adapter, model
+     * id, and provider route replace together, effective at the next run.
+     * setAdapter alone is for a same-binding adapter swap (the faux
+     * re-arm); a switch that changes WHAT model answers must come through
+     * here, or the UI claims one model while requests carry another.
+     * Omitting `provider` clears the route — an unknown binding is
+     * canonicalized under the honest "adapter" route (null-priced), never
+     * the stale one. (The context window joins the binding when per-model
+     * metadata exists — the PH-1c registry.)
+     */
+    setModelBinding(binding) {
+        this.#adapter = binding.adapter;
+        this.#model = binding.model;
+        this.#provider = binding.provider;
+    }
     /** E2: the adapter identity ("anthropic" | "openai-compat") — the route
      *  key the canonical consumer (CLI usage, the trace block) keys on. The
-     *  per-run tracer reads the SAME #config.provider; one source, one
+     *  per-run tracer reads the SAME live binding; one source, one
      *  route — the CLI and the trace can never disagree. */
     get provider() {
-        return this.#config.provider;
+        return this.#provider;
     }
     /**
      * TUI2-R3v2 ③ — ONE model request that belongs to no run (the
@@ -222,8 +257,8 @@ export class AgentSession {
             root: this.#store.root,
             sessionId: this.id,
             runId,
-            provider: this.#config.provider ?? "adapter",
-            model: this.#config.model,
+            provider: this.#provider ?? "adapter",
+            model: this.#model,
             adapterVersion: runtimeVersion(),
             purpose: options.purpose,
             // the manifest's seqRange pointers derive from the log, and a side
@@ -239,7 +274,7 @@ export class AgentSession {
         let text = "";
         try {
             for await (const ev of guarded.stream({
-                model: this.#config.model,
+                model: this.#model,
                 messages: [{ role: "user", content: options.prompt }],
                 systemPrompt: options.systemPrompt,
                 ...(options.maxTokens !== undefined ? { maxTokens: options.maxTokens } : {}),
@@ -257,7 +292,7 @@ export class AgentSession {
     /** Run one user turn. Iterate to consume; `run.abort()` cancels. */
     run(input, options) {
         this.ensureHealthy();
-        return new Run(this.#store, this.#adapter, this.#config, this, input, options?.signal, false, options?.source);
+        return new Run(this.#store, this.#adapter, this.#effectiveConfig(), this, input, options?.signal, false, options?.source);
     }
     /**
      * Continue the interrupted run (Area 2): apply durable decisions,
@@ -267,7 +302,7 @@ export class AgentSession {
      */
     resume() {
         this.ensureHealthy();
-        return new Run(this.#store, this.#adapter, this.#config, this, undefined, undefined, true);
+        return new Run(this.#store, this.#adapter, this.#effectiveConfig(), this, undefined, undefined, true);
     }
     /**
      * /compact (ADR-0044): compress the older conversation with a model
@@ -280,7 +315,11 @@ export class AgentSession {
      * worth covering yet). Crash semantics: a crash BEFORE the persist is
      * "nothing happened"; after it, a resume projects the compressed view.
      */
-    async summarize(options = {}) {
+    async summarize(
+    // R3a: `focus` — an optional steer for the summary call ("keep the
+    // auth details"). Rides the serialized input as ONE instruction
+    // line; absent = byte-identical to the pre-round call.
+    options = {}) {
         this.ensureHealthy();
         const keepRounds = options.keepRounds ?? KEEP_RECENT_ROUNDS;
         // W18: the signal is observed at EVERY phase boundary — the cancel
@@ -301,7 +340,8 @@ export class AgentSession {
         // messages still feed the pre-call token estimate and the savings
         // figure (estimate-only, never the model input).
         const covered = projectMessages(events.filter((e) => e.seq > prevPoint && e.seq <= boundary && e.type !== "summarized"));
-        const serializedInput = serializeCovered({ events, prevPoint, boundary });
+        const serialized0 = serializeCovered({ events, prevPoint, boundary });
+        const serializedInput = options.focus === undefined ? serialized0 : `Focus the summary on: ${options.focus}\n\n${serialized0}`;
         // W18: the indicator's pre-call data — rounds + the token estimate
         // are knowable BEFORE the adapter call; the summary itself is ONE
         // call with no fraction (kiso never invents a percentage here).
@@ -322,7 +362,7 @@ export class AgentSession {
         else {
             const call = await summarizeConversation({
                 adapter: this.#adapter,
-                model: this.#config.model,
+                model: this.#model,
                 // E6 (a): ONE serialized user message — the DSML bug's
                 // raw-message array is structurally dead on this path.
                 messages: [{ role: "user", content: serializedInput }],
@@ -356,7 +396,7 @@ export class AgentSession {
         // a degraded ledger costs one stderr line, never the summary.
         if (usage !== null) {
             try {
-                const canonical = canonicalizeUsage(this.#config.provider ?? "adapter", usage);
+                const canonical = canonicalizeUsageForModel(this.#model, undefined, this.#provider ?? "adapter", usage);
                 const line = JSON.stringify({ kind: "summary", canonical }) + "\n";
                 mkdirSync(join(this.#store.root, "traces"), { recursive: true });
                 appendFileSync(join(this.#store.root, "traces", `${this.id}.jsonl`), line);
@@ -535,20 +575,23 @@ export class AgentSession {
     }
     /**
      * TV-1A — assess the task claims and their evidence freshness over THIS
-     * session's durable log. The shared-tool set comes from the live tools'
-     * own `effects.concurrency: "shared"` certificates (one direction of
-     * truth, never a second declaration); the evidence policy defaults to
+     * session's durable log. The non-mutating set comes from the live tools'
+     * own `effects.precommitSafe` certificates (one direction of truth,
+     * never a second declaration) — the read-only+free+local contract, the
+     * only certificate that proves the world untouched. `concurrency:
+     * "shared"` is a SCHEDULING promise and never feeds this set (TV-1C —
+     * slow_touch is shared and writes). The evidence policy defaults to
      * {"shell"} — the convention the task extension's own "make the LAST
      * item a verification step" guidance produces.
      */
     assessTasks(opts) {
-        const sharedTools = new Set();
+        const nonMutatingTools = new Set();
         for (const tool of this.#config.registry.list()) {
-            if (tool.effects?.concurrency === "shared")
-                sharedTools.add(tool.name);
+            if (tool.effects?.precommitSafe === true)
+                nonMutatingTools.add(tool.name);
         }
         return assessTasks(this.log.all, {
-            sharedTools,
+            nonMutatingTools,
             evidenceTools: opts?.evidenceTools ?? DEFAULT_EVIDENCE_TOOLS,
         });
     }

package/dist/task-assessment.d.ts

@@ -9,13 +9,18 @@
  *
  * No new event kind, no core diff — the projection reads the existing
  * durable vocabulary (`deriveRecoveryPlan` is the shape precedent). The
- * classifiers are maximally conservative and reuse EC-1's certificate
- * direction verbatim:
+ * classifiers are maximally conservative; the exemptions are exactly
+ * three (TV-1C — no wider taxonomy exists or is wanted):
  *
  * - MUTATION marker: `tool_execution_started` (intent-to-effect) of any
- *   name NOT in `sharedTools`. Started — not the receipt — so failed and
- *   crash-window executions invalidate too, and pre-EC-1 overlap eras are
- *   covered by the same rule. Absence of a certificate is a mutation.
+ *   name NOT in `nonMutatingTools`. Started — not the receipt — so failed
+ *   and crash-window executions invalidate too, and pre-EC-1 overlap eras
+ *   are covered by the same rule. Absence of a certificate is a mutation.
+ *   The exemption set is fed by `effects.precommitSafe` — the frozen
+ *   read-only+free+local contract, the only certificate that PROVES the
+ *   world untouched. `concurrency: "shared"` proves overlap-safety and
+ *   nothing else (the TV-1C finding: slow_touch is shared AND writes) —
+ *   it never feeds this set.
  *   ONE proven exception (TV-1B, grounded in WR-1A): an execution whose
  *   terminal receipt is failed(errorKind:"precondition") never counts —
  *   that kind's frozen contract is "work refused BEFORE it starts".
@@ -27,6 +32,19 @@
  * - task_set itself never invalidates: recording the claim after the check
  *   is the natural arc (tests → mark done), and the claim-recording act
  *   mutates nothing the evidence observed.
+ * - VOIDED RANGES (TV-1C): a `model_output_abandoned` marker voids
+ *   (voidFromSeq, seq] — the durable vocabulary's own "never happened",
+ *   the same ranges the kernel projection skips. Every consumer here
+ *   skips them uniformly: a voided echo is not a claim, a voided receipt
+ *   is not evidence, a voided start is not a mutation. task_set waits
+ *   for turn commit today (TT-1), so the scheduler already keeps claims
+ *   out of voided turns — the projection encodes the admissibility rule
+ *   itself instead of relying on that forever.
+ *
+ * `verified` means FRESH EVIDENCE UNDER THE CONFIGURED POLICY — never
+ * "objectively proven correct". Goal Truth is external (PE-1's
+ * evaluator); this projection only ever ranks the model's own claim
+ * against the trajectory's own receipts.
  */
 import type { Event } from "@vincemakes/kiso-core";
 /** One item of the model's plan, exactly as last claimed. */
@@ -64,9 +82,11 @@ export interface TaskAssessment {
  * trajectory. Pure: same events, same options, same assessment.
  */
 export declare function assessTasks(events: readonly Event[], opts?: {
-    /** Names whose executions never mutate (from `effects.concurrency:
-     *  "shared"` certificates). Default ∅ — everything mutates. */
-    readonly sharedTools?: ReadonlySet<string>;
+    /** Names whose executions PROVABLY never mutate the observable
+     *  world (from `effects.precommitSafe` certificates — read-only +
+     *  free + local). `concurrency: "shared"` is NOT such a proof
+     *  (TV-1C). Default ∅ — everything mutates. */
+    readonly nonMutatingTools?: ReadonlySet<string>;
     /** Names whose successful receipts count as evidence. Default ∅ —
      *  nothing does. */
     readonly evidenceTools?: ReadonlySet<string>;

package/dist/task-assessment.js

@@ -9,13 +9,18 @@
  *
  * No new event kind, no core diff — the projection reads the existing
  * durable vocabulary (`deriveRecoveryPlan` is the shape precedent). The
- * classifiers are maximally conservative and reuse EC-1's certificate
- * direction verbatim:
+ * classifiers are maximally conservative; the exemptions are exactly
+ * three (TV-1C — no wider taxonomy exists or is wanted):
  *
  * - MUTATION marker: `tool_execution_started` (intent-to-effect) of any
- *   name NOT in `sharedTools`. Started — not the receipt — so failed and
- *   crash-window executions invalidate too, and pre-EC-1 overlap eras are
- *   covered by the same rule. Absence of a certificate is a mutation.
+ *   name NOT in `nonMutatingTools`. Started — not the receipt — so failed
+ *   and crash-window executions invalidate too, and pre-EC-1 overlap eras
+ *   are covered by the same rule. Absence of a certificate is a mutation.
+ *   The exemption set is fed by `effects.precommitSafe` — the frozen
+ *   read-only+free+local contract, the only certificate that PROVES the
+ *   world untouched. `concurrency: "shared"` proves overlap-safety and
+ *   nothing else (the TV-1C finding: slow_touch is shared AND writes) —
+ *   it never feeds this set.
  *   ONE proven exception (TV-1B, grounded in WR-1A): an execution whose
  *   terminal receipt is failed(errorKind:"precondition") never counts —
  *   that kind's frozen contract is "work refused BEFORE it starts".
@@ -27,6 +32,19 @@
  * - task_set itself never invalidates: recording the claim after the check
  *   is the natural arc (tests → mark done), and the claim-recording act
  *   mutates nothing the evidence observed.
+ * - VOIDED RANGES (TV-1C): a `model_output_abandoned` marker voids
+ *   (voidFromSeq, seq] — the durable vocabulary's own "never happened",
+ *   the same ranges the kernel projection skips. Every consumer here
+ *   skips them uniformly: a voided echo is not a claim, a voided receipt
+ *   is not evidence, a voided start is not a mutation. task_set waits
+ *   for turn commit today (TT-1), so the scheduler already keeps claims
+ *   out of voided turns — the projection encodes the admissibility rule
+ *   itself instead of relying on that forever.
+ *
+ * `verified` means FRESH EVIDENCE UNDER THE CONFIGURED POLICY — never
+ * "objectively proven correct". Goal Truth is external (PE-1's
+ * evaluator); this projection only ever ranks the model's own claim
+ * against the trajectory's own receipts.
  */
 const TASK_TOOL = "task_set";
 const STATUSES = new Set(["pending", "active", "done"]);
@@ -62,8 +80,18 @@ function parseEcho(content) {
  * trajectory. Pure: same events, same options, same assessment.
  */
 export function assessTasks(events, opts) {
-    const shared = opts?.sharedTools ?? new Set();
+    const nonMutating = opts?.nonMutatingTools ?? new Set();
     const evidenceNames = opts?.evidenceTools ?? new Set();
+    // TV-1C: PASS 0 — the voided ranges. (voidFromSeq, seq] of every
+    // `model_output_abandoned` marker is "never happened" for this whole
+    // projection, exactly as the kernel's own context projection treats
+    // it. Markers are rare; a linear range check is honest and enough.
+    const voidRanges = [];
+    for (const ev of events) {
+        if (ev.type === "model_output_abandoned")
+            voidRanges.push({ from: ev.voidFromSeq, to: ev.seq });
+    }
+    const voided = (seq) => voidRanges.some((r) => seq > r.from && seq <= r.to);
     // TV-1B: PASS 1 — executions whose terminal receipt is a
     // PRECONDITION failure are PROVEN no-mutation (WR-1A froze that
     // contract: work refused before it starts). Everything else stays
@@ -72,6 +100,8 @@ export function assessTasks(events, opts) {
     // Two passes, no temporal rollback state — same events, same verdict.
     const provenNoMutation = new Set();
     for (const ev of events) {
+        if (voided(ev.seq))
+            continue;
         if (ev.type === "tool_execution_failed" && ev.errorKind === "precondition") {
             provenNoMutation.add(ev.executionId);
         }
@@ -84,9 +114,11 @@ export function assessTasks(events, opts) {
     let lastEvidenceSeq = null;
     let staleBySeq = null;
     for (const ev of events) {
+        if (voided(ev.seq))
+            continue;
         if (ev.type === "tool_execution_started") {
             nameByExecution.set(ev.executionId, ev.name);
-            if (ev.name !== TASK_TOOL && !shared.has(ev.name) && !provenNoMutation.has(ev.executionId)) {
+            if (ev.name !== TASK_TOOL && !nonMutating.has(ev.name) && !provenNoMutation.has(ev.executionId)) {
                 lastMutationSeq = ev.seq;
                 if (lastEvidenceSeq !== null && staleBySeq === null)
                     staleBySeq = ev.seq;

package/dist/trace/guard.js

@@ -25,7 +25,7 @@ import { randomUUID } from "node:crypto";
 import { buildContextManifest, segmentHashes } from "./manifest.js";
 import { cacheableHashes } from "./analyze.js";
 import { hashContext, hashSystemPrompt, hashToolSpecs, stablePrefixFingerprint } from "./hash.js";
-import { PRICING_TABLE_V1, canonicalizeUsage } from "../usage/canonical.js";
+import { PRICING_TABLE_V1, canonicalizeUsageForModel } from "../usage/canonical.js";
 import { buildRentLedger } from "./rent.js";
 import { TRACE_SCHEMA_VERSION } from "./record.js";
 import { TraceWriter } from "./writer.js";
@@ -201,11 +201,14 @@ export class RequestTracer {
             record.cacheWrite = p.cacheWrite ?? null;
             record.output = p.outputTokens ?? 0;
         }
-        // E2 — the canonical block formalizes the same raw (the route-keyed
-        // mapping; the validator pins block == quartet, so the two can never
-        // drift apart). Unknown usage canonicalizes to the "0 = unknown"
-        // convention, consistent with the quartet above.
-        record.canonical = canonicalizeUsage(this.#provider, {
+        // E2 — the canonical block formalizes the same raw (the validator
+        // pins block == quartet, so the two can never drift apart). Unknown
+        // usage canonicalizes to the "0 = unknown" convention, consistent
+        // with the quartet above. PH-1c: the PRICE keys on the record's own
+        // MODEL via the metadata registry (route-keyed pricing priced an
+        // Anthropic run at DeepSeek's rates); the convention still keys on
+        // the route. An unpriced model costs null — never a fallback rate.
+        record.canonical = canonicalizeUsageForModel(record.model, undefined, this.#provider, {
             inputTokens: p.inputTokens,
             outputTokens: p.outputTokens,
             cacheRead: p.cacheRead,

package/dist/usage/canonical.d.ts

@@ -111,6 +111,21 @@ export declare function priceFor(route: string, u: {
  *  builtin v1 table so the export's default behavior is the pinned one
  *  and a future injection never widens this frozen signature. */
 export declare function canonicalizeUsage(route: string, raw: RawUsage, table?: PricingTable): CanonicalUsage;
+/**
+ * PH-1c — the MODEL-KEYED cost path (findings PH-F14/PH-F16). The
+ * convention still keys on the ROUTE (a protocol property: fresh vs
+ * total input); the PRICE keys on the model+endpoint metadata entry —
+ * the route-keyed table is how an Anthropic run got priced at
+ * DeepSeek's rates. No metadata entry, or an entry with `pricing:
+ * null`, costs null — the honest stamp, never a fallback rate.
+ *
+ * A NEW function beside canonicalizeUsage, not a widened signature —
+ * the E2 ruling froze that one ("a future injection never widens this
+ * frozen signature"), and this is the future it reserved room for.
+ * Metadata-priced records stamp pricingTableId "metadata" (version 1);
+ * the (id, version) tuple ritual carries forward unchanged.
+ */
+export declare function canonicalizeUsageForModel(model: string, endpoint: string | undefined, route: string, raw: RawUsage): CanonicalUsage;
 /** The canonical schema's invariants, machine-checked: closed key set;
  *  non-negative numbers; cacheWrite/reasoning null-or-number; the pinned
  *  sentence — cacheRead can never exceed total (= input + cacheRead +

package/dist/usage/canonical.js

@@ -27,6 +27,7 @@
  * accounting boundary (R4 Case B, pure derivation; the union does not
  * move). Raw is provider observation; canonical is the accounting truth.
  */
+import { lookupModelMetadata } from "../provider/metadata.js";
 /** The route → input-convention table (R2a). `input` semantics differ
  *  between the two routes; the convention is a property of the ROUTE, not
  *  the provider. Unknown routes fall back to "total" — exactly the
@@ -61,15 +62,14 @@ export function pricingTableFor(version) {
     return table;
 }
 export function priceFor(route, u, table) {
-    // The R5b-④c semantics: a REAL route (an INPUT_CONVENTIONS key — the
-    // routes the table is expected to price) missing from the table is a
-    // HOLE → null, the explicit-absent stamp. The builtin table never
-    // backfills an injected table's hole. Unknown routes keep the legacy
-    // within-table mirror fallback (the total-convention entry, matching
-    // the convention fallback above — one table, one fallback, no drift);
-    // a table without even the mirror entry yields null, never a crash.
-    const entry = table.entries[route] ??
-        (route in INPUT_CONVENTIONS ? undefined : table.entries["openai-compat"]);
+    // PH-1a (supersedes R5b-④c's mirror fallback): a route missing from
+    // the table is a HOLE → null, the explicit-absent stamp — REAL routes
+    // and unknown routes alike. The retired mirror fallback priced the
+    // "adapter" route (a directly-injected adapter, finding PH-F7) at the
+    // openai-compat entry: a fabricated cost on exactly the runs whose
+    // rates are unknown. null is the honest answer; the builtin table
+    // never backfills an injected table's hole either.
+    const entry = table.entries[route];
     if (entry === undefined)
         return null;
     return ((u.input * entry.inputPerM +
@@ -107,6 +107,37 @@ export function canonicalizeUsage(route, raw, table = PRICING_TABLE_V1) {
         pricingTableVersion: table.version,
     };
 }
+/**
+ * PH-1c — the MODEL-KEYED cost path (findings PH-F14/PH-F16). The
+ * convention still keys on the ROUTE (a protocol property: fresh vs
+ * total input); the PRICE keys on the model+endpoint metadata entry —
+ * the route-keyed table is how an Anthropic run got priced at
+ * DeepSeek's rates. No metadata entry, or an entry with `pricing:
+ * null`, costs null — the honest stamp, never a fallback rate.
+ *
+ * A NEW function beside canonicalizeUsage, not a widened signature —
+ * the E2 ruling froze that one ("a future injection never widens this
+ * frozen signature"), and this is the future it reserved room for.
+ * Metadata-priced records stamp pricingTableId "metadata" (version 1);
+ * the (id, version) tuple ritual carries forward unchanged.
+ */
+export function canonicalizeUsageForModel(model, endpoint, route, raw) {
+    const base = canonicalizeUsage(route, raw, EMPTY_TABLE); // convention math only — EMPTY_TABLE prices nothing
+    const entry = lookupModelMetadata(model, endpoint);
+    const pricing = entry?.pricing ?? null;
+    if (pricing === null) {
+        return { ...base, costUsd: null, pricingTableId: "metadata", pricingTableVersion: 1 };
+    }
+    const costUsd = (base.input * pricing.inputPerM +
+        base.output * pricing.outputPerM +
+        base.cacheRead * pricing.cacheReadPerM +
+        (base.cacheWrite ?? 0) * pricing.cacheWritePerM) /
+        1e6;
+    return { ...base, costUsd, pricingTableId: "metadata", pricingTableVersion: 1 };
+}
+/** No entries at all — canonicalizeUsageForModel's convention-only pass
+ *  through canonicalizeUsage; every price it could produce is null. */
+const EMPTY_TABLE = { id: "metadata", version: 1, entries: {} };
 // ── The validator ──────────────────────────────────────────────────────────
 // Strict by design: closed keys (a misspelled field can never enter a
 // ledger), non-negative numbers, the pinned sentence machine-checked, and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincemakes/kiso-runtime",
-  "version": "0.14.0",
+  "version": "0.15.1",
   "description": "kiso runtime — durable multi-turn agent sessions: AgentDefinition, AgentRuntime, AgentSession, Run, append-only JSONL store.",
   "type": "module",
   "license": "MIT",
@@ -25,11 +25,11 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@vincemakes/kiso-core": "0.14.0"
+    "@vincemakes/kiso-core": "0.15.1"
   },
   "peerDependencies": {
-    "@vincemakes/kiso-provider-anthropic": "0.14.0",
-    "@vincemakes/kiso-provider-openai": "0.14.0"
+    "@vincemakes/kiso-provider-anthropic": "0.15.1",
+    "@vincemakes/kiso-provider-openai": "0.15.1"
   },
   "peerDependenciesMeta": {
     "@vincemakes/kiso-provider-anthropic": {
@@ -40,7 +40,7 @@
     }
   },
   "devDependencies": {
-    "@vincemakes/kiso-evals": "0.14.0",
+    "@vincemakes/kiso-evals": "0.15.1",
     "@types/node": "^26.1.2",
     "typescript": "^5.7.2",
     "vitest": "^3.0.0"