@vincemakes/kiso-runtime 0.42.3 → 0.44.0

package/dist/index.d.ts

@@ -31,8 +31,6 @@ export { disposeExtensions, loadExtensions, loadProjectExtensions } from "./exte
 export type { KisoExtension } from "./extensions.js";
 export { executionForCallId, executionLedger } from "./ledger.js";
 export type { ExecutionRecord, ExecutionStatus } from "./ledger.js";
-export { assessTasks } from "./task-assessment.js";
-export type { EvidenceVerdict, TaskAssessment, TaskClaim } from "./task-assessment.js";
 export { kisoHome, projectArtifacts, recordTrust, trustFor } from "./trust.js";
 export type { ProjectArtifact, ProjectArtifacts, TrustDecision, TrustRecord } from "./trust.js";
 export { canonicalizeUsage } from "./usage/canonical.js";

package/dist/index.js

@@ -31,9 +31,6 @@ export { SessionStore, StaleWriterError, StoreCorruptionError } from "./store.js
 export { disposeExtensions, loadExtensions, loadProjectExtensions } from "./extensions.js";
 // ledger
 export { executionForCallId, executionLedger } from "./ledger.js";
-// task assessment (TV-1A) — the pure projection separating the model's
-// CLAIM from VERIFIED under Verified ⟹ evidenceSeq > lastMutationSeq
-export { assessTasks } from "./task-assessment.js";
 // trust
 export { kisoHome, projectArtifacts, recordTrust, trustFor } from "./trust.js";
 // usage — the canonical accounting schema (E2/1.3.0, R4b-1 ruling:

package/dist/recovery-plan.js

@@ -147,16 +147,25 @@ export function deriveRecoveryPlan(events, scope) {
     //    undecided → the pipeline must decide; decided-approved without an
     //    execution → execute the persisted call; decided-denied without a
     //    model-facing result → repair it from the denial.
-    const hasRequest = (callId, after) => events.some((e) => e.type === "permission_requested" && e.callId === callId && e.seq > after);
-    const hasExecution = (callId, after) => events.some((e) => e.type === "tool_execution_started" && e.callId === callId && e.seq > after);
-    const hasResult = (callId, after) => events.some((e) => e.type === "tool_result" && e.callId === callId && e.seq > after);
+    // 0430-F1: an event binds to an invocation by its OWN invocationSeq
+    // when both carry one (0.1.43+) — callId is a correlation key the model
+    // may re-use; an old log's event without one binds by callId after the
+    // call, as before.
+    const bound = (e, callId, after, invocationSeq) => e.invocationSeq !== undefined && invocationSeq !== undefined ? e.invocationSeq === invocationSeq : e.callId === callId && e.seq > after;
+    const hasRequest = (callId, after, invocationSeq) => events.some((e) => e.type === "permission_requested" && bound(e, callId, after, invocationSeq));
+    const hasExecution = (callId, after, invocationSeq) => events.some((e) => e.type === "tool_execution_started" && bound(e, callId, after, invocationSeq));
+    const hasResult = (callId, after, invocationSeq) => events.some((e) => e.type === "tool_result" && bound(e, callId, after, invocationSeq));
     const decidedForCall = (callId, after) => {
         for (const e of events) {
             if (e.type !== "permission_decided")
                 continue;
             // a durable POLICY verdict binds the call (E1); a human verdict
-            // binds its request, never the call (the requests pass owns it)
-            if (e.decidedBy !== undefined && e.callId === callId && e.seq > after)
+            // binds its request, never the call (the requests pass owns it).
+            // 0430-F1: a decision that names its invocation binds EXACTLY that
+            // one (callId repeats); only an old log's decision binds by callId.
+            if (e.decidedBy === undefined)
+                continue;
+            if (e.invocationSeq !== undefined ? e.invocationSeq === after : e.callId === callId && e.seq > after)
                 return e;
         }
         return undefined;
@@ -179,18 +188,24 @@ export function deriveRecoveryPlan(events, scope) {
         // a stored request owns the invocation (the requests pass below) —
         // "only a durable permission_decided authorizes an effect"; Gap A
         // must never re-decide over a stored request.
-        if (hasRequest(call.callId, call.seq))
+        if (hasRequest(call.callId, call.seq, call.seq))
             continue;
-        if (hasResult(call.callId, call.seq))
+        if (hasResult(call.callId, call.seq, call.seq))
             continue; // closed — nothing to fill
         const decided = decidedForCall(call.callId, call.seq);
+        // 0430-F1: a started execution proves the invocation crossed the
+        // permission gate on the fresh path (which records no decision for
+        // a default or hook allow) — it is never re-decided; step 6 owns its
+        // receipt.
+        if (decided === undefined && hasExecution(call.callId, call.seq, call.seq))
+            continue;
         if (decided === undefined)
             return { kind: "DECIDE_PERMISSION", invocationSeq: call.seq };
         if (decided.decision === "approved") {
-            if (!hasExecution(call.callId, call.seq))
+            if (!hasExecution(call.callId, call.seq, call.seq))
                 return { kind: "EXECUTE", invocationSeq: call.seq };
         }
-        else if (!hasResult(call.callId, call.seq)) {
+        else if (!hasResult(call.callId, call.seq, call.seq)) {
             return { kind: "REPAIR_RESULT", invocationSeq: call.seq };
         }
     }
@@ -213,10 +228,10 @@ export function deriveRecoveryPlan(events, scope) {
             return { kind: "WAIT_PERMISSION", invocationSeq: invocationSeq ?? pending.seq };
         }
         if (decided.decision === "approved") {
-            if (!hasExecution(pending.callId, pending.seq))
+            if (!hasExecution(pending.callId, pending.seq, invocationSeq))
                 return { kind: "EXECUTE", invocationSeq: invocationSeq ?? pending.seq };
         }
-        else if (!hasResult(pending.callId, pending.seq)) {
+        else if (!hasResult(pending.callId, pending.seq, invocationSeq)) {
             return { kind: "REPAIR_RESULT", invocationSeq: invocationSeq ?? pending.seq };
         }
     }
@@ -226,7 +241,7 @@ export function deriveRecoveryPlan(events, scope) {
     for (const ev of scope) {
         if (ev.type !== "tool_execution_succeeded" && ev.type !== "tool_execution_failed")
             continue;
-        if (!hasResult(ev.callId, ev.seq) && !events.some((e) => e.type === "tool_result" && e.executionId === ev.executionId)) {
+        if (!hasResult(ev.callId, ev.seq, ev.invocationSeq) && !events.some((e) => e.type === "tool_result" && e.executionId === ev.executionId)) {
             return { kind: "REPAIR_RESULT", executionId: ev.executionId };
         }
     }

package/dist/run.js

@@ -3,7 +3,7 @@
  * persistence, the loop drive, the durable recovery state machine), moved
  * verbatim from session.ts.
  */
-import { denialResult, loop } from "@vincemakes/kiso-core";
+import { denialResult, loop, validateArgs } from "@vincemakes/kiso-core";
 import { ABORTED, MergedSignal, abortable, openRunId } from "./recovery.js";
 import { resolveReasoning } from "./provider/metadata.js";
 import { deriveRecoveryPlan, invocationSeqOf } from "./recovery-plan.js";
@@ -37,8 +37,8 @@ export class Run {
     #decisionIds = [];
     #started = false;
     constructor(store, adapter, config, session, input, externalSignal, resume, 
-    // TV-1B: durable PROVENANCE for the input (e.g. the verification
-    // seed's source:"system") — who produced the line, never a
+    // TV-1B: durable PROVENANCE for the input (e.g. source:"system"
+    // for a line the product wrote) — who produced the line, never a
     // provider-role escalation. Absent = plain user input.
     source, 
     // 0.40.0: how a person composed the turn (a skill + the typed line) —
@@ -494,7 +494,21 @@ export class Run {
             throw new Error(`the recovery plan derived a call outside the scope (seq ${invocationSeq})`);
         // The chain's PolicyCall carries name+input only — callId is the
         // framework's, the hook's is the provider-facing ToolCallPayload.
-        const payload = { callId: call.callId, name: call.name, input: call.input ?? {} };
+        // 0430-F1: the fresh path's preflight, in the same order and with the
+        // same words — a call the kernel refuses before any policy (unknown
+        // tool, unparsable arguments, a schema failure) is refused here the
+        // same way: one invalid_input result, no decision, no execution.
+        const tool = this.#config.registry.get(call.name);
+        const schemaError = tool !== undefined && call.input !== null ? validateArgs(tool.parameters, call.input) : null;
+        const refusal = tool === undefined ? `Unknown tool: ${call.name}` : call.input === null ? "Arguments failed to parse as JSON" : schemaError !== null ? `Arguments failed schema validation:${schemaError}` : undefined;
+        if (refusal !== undefined) {
+            yield log.append({ type: "tool_result", callId: call.callId, invocationSeq: call.seq, content: refusal, isError: true, errorKind: "invalid_input" });
+            return;
+        }
+        // #20: the same lexical evidence the fresh path hands onPreTool — THIS
+        // invocation's deltas, anchored by its seq; never given to the chain.
+        const rawInput = rawInputOf(log.all, call.callId, call.seq);
+        const payload = { callId: call.callId, name: call.name, input: call.input ?? {}, ...(rawInput !== undefined ? { rawInput } : {}) };
         const policyCall = { name: payload.name, input: payload.input };
         let verdict;
         try {
@@ -525,13 +539,26 @@ export class Run {
         }
         if (verdict === undefined)
             verdict = { action: "allow" }; // no policies — the kernel's default allow
-        // The recovery's own decision is a POLICY verdict (the plan's E1
-        // rule: only a decidedBy-carrying decision binds the call — a human
-        // verdict binds its request, never the call). The driver's write
-        // must satisfy its own plan: no decidedBy → the re-derive would
-        // derive DECIDE_PERMISSION again forever (the plan cannot tell the
-        // driver's write from a human's). Stamped "mode:default" when the
-        // verdict carries none — the gates' seeded convention.
+        // 0430-F1: a verdict WITHOUT a speaker — the default allow, an
+        // onPreTool allow or deny — is not a durable fact on the fresh path
+        // and is not one here: allow goes straight to the execution (the
+        // plan no longer re-decides a started invocation), deny straight to
+        // the denial result. Only a speaking chain's verdict is recorded,
+        // exactly as the fresh path records it. (Before: a fabricated
+        // "mode:default" decision, written so the plan could make progress.)
+        if (!("decidedBy" in verdict)) {
+            if (verdict.action === "allow") {
+                yield* this.#executeInvocation(call.seq, scope, log, signal);
+                return;
+            }
+            if (verdict.action === "deny") {
+                yield* this.#denialResult(call.callId, ("reason" in verdict && verdict.reason !== undefined ? verdict.reason : undefined) ?? "denied", call.seq);
+                return;
+            }
+        }
+        // A speaking chain's decision binds the call (the plan's E1 rule: a
+        // decidedBy-carrying decision binds the call — a human verdict binds
+        // its request, never the call).
         const decisionId = `d-${log.all.length + 1}`;
         if (verdict.action === "allow") {
             yield log.append({
@@ -655,6 +682,9 @@ export class Run {
             ? {
                 type: "tool_result",
                 callId: ev.callId,
+                // 0430-F1: the receipt's invocation identity rides the fill, as
+                // a fresh result carries call.seq — bound exactly ever after.
+                ...(ev.invocationSeq !== undefined ? { invocationSeq: ev.invocationSeq } : {}),
                 content: ev.result.content,
                 isError: false,
                 // round 8: the repaired result reproduces the normal path
@@ -665,6 +695,7 @@ export class Run {
             : {
                 type: "tool_result",
                 callId: ev.callId,
+                ...(ev.invocationSeq !== undefined ? { invocationSeq: ev.invocationSeq } : {}),
                 content: ev.error,
                 isError: true,
                 ...(ev.errorKind !== undefined ? { errorKind: ev.errorKind } : {}),
@@ -687,7 +718,10 @@ export class Run {
         const decided = log.all.find((e) => e.type === "permission_decided" &&
             (request !== undefined
                 ? e.decisionId === request.decisionId
-                : call !== undefined && e.callId === call.callId && e.seq > call.seq && e.decidedBy !== undefined));
+                : call !== undefined &&
+                    e.decidedBy !== undefined &&
+                    // 0430-F1: exact invocation first; an old log's decision by callId
+                    (e.invocationSeq !== undefined ? e.invocationSeq === call.seq : e.callId === call.callId && e.seq > call.seq)));
         if (decided === undefined || (request?.callId ?? call?.callId) === undefined) {
             throw new Error(`the recovery plan derived a denial without its decision (seq ${invocationSeq})`);
         }
@@ -755,6 +789,12 @@ export class Run {
         const log = this.#session.log;
         const tool = this.#config.registry.get(name);
         const executionId = `ex-${log.lastSeq + 1}`;
+        // 0.43.0 (#13, 0420-F1): ToolContext is a function of the durable
+        // invocation and execution, never of fresh vs recovery — the same
+        // sessionId, callId, executionId and lexical arguments the fresh path
+        // hands the handler, the last derived from THIS invocation's deltas.
+        const rawInput = rawInputOf(log.all, callId, invocationSeq);
+        const ctx = { signal, sessionId: this.#session.id, callId, executionId, ...(rawInput !== undefined ? { rawInput } : {}) };
         // An abort that landed while the decision was being applied must
         // not start the side effect (finding 3).
         if (signal.aborted)
@@ -777,7 +817,7 @@ export class Run {
                     result = { content: "aborted before execution", isError: true, errorKind: "fatal" };
                 }
                 else {
-                    result = await tool.execute(input, { signal });
+                    result = await tool.execute(input, ctx);
                 }
             }
             catch (err) {
@@ -788,7 +828,7 @@ export class Run {
                 };
             }
             if (this.#config.hooks?.onPostTool) {
-                result = await this.#config.hooks.onPostTool({ callId, name, input }, result, { sessionId: this.#session.id });
+                result = await this.#config.hooks.onPostTool({ callId, name, input, ...(rawInput !== undefined ? { rawInput } : {}) }, result, { sessionId: this.#session.id });
             }
         }
         // ruling #12 correction one: the honest note rides the recovered failure too —
@@ -850,6 +890,7 @@ export class Run {
             content: denial.content,
             isError: true,
             errorKind: denial.errorKind,
+            tags: denial.tags, // 0430-F1: the fresh path's denial carries them
         });
     }
 }
@@ -861,3 +902,27 @@ function resolveReasoningOrThrow(model, setting, endpoint) {
         throw new Error(`the session's recorded reasoning setting cannot run here: ${r.reason}`);
     return Object.keys(r.wire).length > 0 ? { reasoning: r.wire } : {};
 }
+/** 0.43.0 (#13): the invocation's lexical arguments from the durable
+ *  log — the tool_call_input_delta events between ITS tool_call_start
+ *  and ITS tool_call_end (anchored by invocationSeq, never "the latest
+ *  same callId"), the window the kernel buffered on the fresh path.
+ *  Undefined when no delta was streamed, or when the invocation's seq is
+ *  unknown. */
+function rawInputOf(events, callId, invocationSeq) {
+    if (invocationSeq === undefined)
+        return undefined;
+    const end = events.findIndex((e) => e.seq === invocationSeq);
+    if (end < 0)
+        return undefined;
+    let text;
+    for (let i = end - 1; i >= 0; i -= 1) {
+        const e = events[i];
+        if (e.type === "tool_call_start" && e.callId === callId)
+            break;
+        if (e.type === "stop" || e.type === "user_input" || e.type === "terminal" || e.type === "assistant_start")
+            break;
+        if (e.type === "tool_call_input_delta" && e.callId === callId)
+            text = e.inputJsonDelta + (text ?? "");
+    }
+    return text;
+}

package/dist/session.d.ts

@@ -29,7 +29,6 @@
  */
 import { EventLog, type AbortSignalLike, type Adapter, type Event, type KisoExtension, type Message, type PermissionDecision, type Tool, type ToolSpec, type EventInput } from "@vincemakes/kiso-core";
 import { type OverflowMeasure } from "./overflow-belt.js";
-import { type TaskAssessment } from "./task-assessment.js";
 import { type ContinuationScope } from "@vincemakes/kiso-core";
 import { type ReasoningSetting } from "./provider/metadata.js";
 import { type SessionStore, type StoreRecord } from "./store.js";
@@ -375,20 +374,6 @@ export declare class AgentSession {
     approve(decisionId: string, allow: boolean, reason?: string): Promise<void>;
     /** Executions that started but never reported a result (crash window). */
     uncertainExecutions(): import("./ledger.js").ExecutionRecord[];
-    /**
-     * TV-1A — assess the task claims and their evidence freshness over THIS
-     * session's durable log. The non-mutating set comes from the live tools'
-     * own `effects.precommitSafe` certificates (one direction of truth,
-     * never a second declaration) — the read-only+free+local contract, the
-     * only certificate that proves the world untouched. `concurrency:
-     * "shared"` is a SCHEDULING promise and never feeds this set (TV-1C —
-     * slow_touch is shared and writes). The evidence policy defaults to
-     * {"shell"} — the convention the task extension's own "make the LAST
-     * item a verification step" guidance produces.
-     */
-    assessTasks(opts?: {
-        readonly evidenceTools?: ReadonlySet<string>;
-    }): TaskAssessment;
     /**
      * The human's verdict on an interrupted execution, keyed by EXECUTION ID
      * (B group): "rerun" (the human says the side effect did NOT happen — the

package/dist/session.js

@@ -31,11 +31,6 @@ import { EventLog, projectMessages, SUMMARY_FRAMING, } from "@vincemakes/kiso-co
 import { executionLedger } from "./ledger.js";
 import { overflowBelt } from "./overflow-belt.js";
 import { windowLearner } from "./window-learner.js";
-import { assessTasks } from "./task-assessment.js";
-/** TV-1A — the session-level evidence policy: the PURE projection defaults
- *  to ∅ (never inventing evidence); the session names the one built-in
- *  verification surface. Override per call for custom evidence tools. */
-const DEFAULT_EVIDENCE_TOOLS = new Set(["shell"]);
 import { denialResult } from "@vincemakes/kiso-core";
 import { buildProfile, readProfile, writeProfile, writeSummary } from "./profile.js";
 import { summarizeEvents } from "./session-summary.js";
@@ -1064,28 +1059,6 @@ export class AgentSession {
     uncertainExecutions() {
         return [...executionLedger(this.log.all).values()].filter((r) => r.status === "uncertain");
     }
-    /**
-     * TV-1A — assess the task claims and their evidence freshness over THIS
-     * session's durable log. The non-mutating set comes from the live tools'
-     * own `effects.precommitSafe` certificates (one direction of truth,
-     * never a second declaration) — the read-only+free+local contract, the
-     * only certificate that proves the world untouched. `concurrency:
-     * "shared"` is a SCHEDULING promise and never feeds this set (TV-1C —
-     * slow_touch is shared and writes). The evidence policy defaults to
-     * {"shell"} — the convention the task extension's own "make the LAST
-     * item a verification step" guidance produces.
-     */
-    assessTasks(opts) {
-        const nonMutatingTools = new Set();
-        for (const tool of this.#config.registry.list()) {
-            if (tool.effects?.precommitSafe === true)
-                nonMutatingTools.add(tool.name);
-        }
-        return assessTasks(this.log.all, {
-            nonMutatingTools,
-            evidenceTools: opts?.evidenceTools ?? DEFAULT_EVIDENCE_TOOLS,
-        });
-    }
     /**
      * The human's verdict on an interrupted execution, keyed by EXECUTION ID
      * (B group): "rerun" (the human says the side effect did NOT happen — the

package/dist/summarize.d.ts

@@ -270,8 +270,9 @@ export declare function estimateEventTokens(ev: Event): number;
  * rounds exist (nothing worth covering yet).
  *
  * ⑥ (task round): a tool result tagged do-not-compact is DURABLE work
- * memory (the task_set echo) — the summary must never cover its round,
- * or the model loses the current list. When the base boundary would
+ * memory (a tool declares it so; the retired task extension's list was
+ * the first) — the summary must never cover its round, or the model
+ * loses it. When the base boundary would
  * cover such a result, the boundary pulls back to just before the round
  * containing the LATEST one (still a turn boundary). A protected round
  * as the FIRST uncovered round leaves nothing before it to cover →

package/dist/summarize.js

@@ -501,8 +501,9 @@ export function estimateEventTokens(ev) {
  * rounds exist (nothing worth covering yet).
  *
  * ⑥ (task round): a tool result tagged do-not-compact is DURABLE work
- * memory (the task_set echo) — the summary must never cover its round,
- * or the model loses the current list. When the base boundary would
+ * memory (a tool declares it so; the retired task extension's list was
+ * the first) — the summary must never cover its round, or the model
+ * loses it. When the base boundary would
  * cover such a result, the boundary pulls back to just before the round
  * containing the LATEST one (still a turn boundary). A protected round
  * as the FIRST uncovered round leaves nothing before it to cover →

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vincemakes/kiso-runtime",
-	"version": "0.42.3",
+	"version": "0.44.0",
 	"description": "kiso runtime \u2014 durable multi-turn agent sessions: AgentDefinition, AgentRuntime, AgentSession, Run, append-only JSONL store.",
 	"type": "module",
 	"license": "MIT",
@@ -25,12 +25,12 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@vincemakes/kiso-core": "0.42.3"
+		"@vincemakes/kiso-core": "0.44.0"
 	},
 	"peerDependencies": {
-		"@vincemakes/kiso-provider-anthropic": "0.42.3",
-		"@vincemakes/kiso-provider-openai": "0.42.3",
-		"@vincemakes/kiso-provider-openai-responses": "0.42.3"
+		"@vincemakes/kiso-provider-anthropic": "0.44.0",
+		"@vincemakes/kiso-provider-openai": "0.44.0",
+		"@vincemakes/kiso-provider-openai-responses": "0.44.0"
 	},
 	"peerDependenciesMeta": {
 		"@vincemakes/kiso-provider-anthropic": {
@@ -44,7 +44,7 @@
 		}
 	},
 	"devDependencies": {
-		"@vincemakes/kiso-evals": "0.42.3",
+		"@vincemakes/kiso-evals": "0.44.0",
 		"@types/node": "^26.1.2",
 		"typescript": "^5.7.2",
 		"vitest": "^3.0.0"

package/dist/task-assessment.d.ts

@@ -1,93 +0,0 @@
-/**
- * TV-1A — TaskAssessment as a PURE PROJECTION + Evidence Freshness.
- *
- * The task checklist the model maintains through task_set is a SELF-REPORT:
- * an item is "done" because the model said so. This projection mechanically
- * separates that CLAIM from VERIFIED, under one frozen sentence:
- *
- *   Verified ⟹ evidenceSeq > lastRelevantMutationSeq.
- *
- * No new event kind, no core diff — the projection reads the existing
- * durable vocabulary (`deriveRecoveryPlan` is the shape precedent). The
- * classifiers are maximally conservative; the exemptions are exactly
- * three (TV-1C — no wider taxonomy exists or is wanted):
- *
- * - MUTATION marker: `tool_execution_started` (intent-to-effect) of any
- *   name NOT in `nonMutatingTools`. Started — not the receipt — so failed
- *   and crash-window executions invalidate too, and pre-EC-1 overlap eras
- *   are covered by the same rule. Absence of a certificate is a mutation.
- *   The exemption set is fed by `effects.precommitSafe` — the frozen
- *   read-only+free+local contract, the only certificate that PROVES the
- *   world untouched. `concurrency: "shared"` proves overlap-safety and
- *   nothing else (the TV-1C finding: slow_touch is shared AND writes) —
- *   it never feeds this set.
- *   ONE proven exception (TV-1B, grounded in WR-1A): an execution whose
- *   terminal receipt is failed(errorKind:"precondition") never counts —
- *   that kind's frozen contract is "work refused BEFORE it starts".
- * - EVIDENCE: only receipts (`tool_execution_succeeded`) of names in
- *   `evidenceTools`. Default ∅ — the projection never invents evidence.
- *   What TV-1A's verdict asserts is POSITIONAL: the arc's last
- *   intent-to-effect was a successful evidence-class run — an "evidence",
- *   never a "proof" (semantic knowledge is the TV-1B driver's).
- * - task_set itself never invalidates: recording the claim after the check
- *   is the natural arc (tests → mark done), and the claim-recording act
- *   mutates nothing the evidence observed.
- * - VOIDED RANGES (TV-1C): a `model_output_abandoned` marker voids
- *   (voidFromSeq, seq] — the durable vocabulary's own "never happened",
- *   the same ranges the kernel projection skips. Every consumer here
- *   skips them uniformly: a voided echo is not a claim, a voided receipt
- *   is not evidence, a voided start is not a mutation. task_set waits
- *   for turn commit today (TT-1), so the scheduler already keeps claims
- *   out of voided turns — the projection encodes the admissibility rule
- *   itself instead of relying on that forever.
- *
- * `verified` means FRESH EVIDENCE UNDER THE CONFIGURED POLICY — never
- * "objectively proven correct". Goal Truth is external (PE-1's
- * evaluator); this projection only ever ranks the model's own claim
- * against the trajectory's own receipts.
- */
-import type { Event } from "@vincemakes/kiso-core";
-/** One item of the model's plan, exactly as last claimed. */
-export interface TaskClaim {
-    readonly text: string;
-    readonly status: "pending" | "active" | "done";
-}
-/** The freshness verdict. `stale` and `unreadable` NAME their cause. */
-export type EvidenceVerdict = {
-    readonly kind: "verified";
-    readonly evidenceSeq: number;
-} | {
-    readonly kind: "stale";
-    readonly evidenceSeq: number;
-    readonly invalidatedBySeq: number;
-} | {
-    readonly kind: "none";
-} | {
-    readonly kind: "unreadable";
-    readonly atSeq: number;
-    readonly reason: string;
-};
-export interface TaskAssessment {
-    /** The LAST successful task_set echo, parsed — the model's claims. */
-    readonly claims: readonly TaskClaim[];
-    /** True only for a non-empty plan whose every item is claimed done. */
-    readonly allClaimedDone: boolean;
-    readonly lastTaskSetSeq: number | null;
-    /** Seq of the last mutation-class `tool_execution_started`, if any. */
-    readonly lastMutationSeq: number | null;
-    readonly evidence: EvidenceVerdict;
-}
-/**
- * Assess the task claims and their evidence freshness over a durable
- * trajectory. Pure: same events, same options, same assessment.
- */
-export declare function assessTasks(events: readonly Event[], opts?: {
-    /** Names whose executions PROVABLY never mutate the observable
-     *  world (from `effects.precommitSafe` certificates — read-only +
-     *  free + local). `concurrency: "shared"` is NOT such a proof
-     *  (TV-1C). Default ∅ — everything mutates. */
-    readonly nonMutatingTools?: ReadonlySet<string>;
-    /** Names whose successful receipts count as evidence. Default ∅ —
-     *  nothing does. */
-    readonly evidenceTools?: ReadonlySet<string>;
-}): TaskAssessment;

package/dist/task-assessment.js

@@ -1,165 +0,0 @@
-/**
- * TV-1A — TaskAssessment as a PURE PROJECTION + Evidence Freshness.
- *
- * The task checklist the model maintains through task_set is a SELF-REPORT:
- * an item is "done" because the model said so. This projection mechanically
- * separates that CLAIM from VERIFIED, under one frozen sentence:
- *
- *   Verified ⟹ evidenceSeq > lastRelevantMutationSeq.
- *
- * No new event kind, no core diff — the projection reads the existing
- * durable vocabulary (`deriveRecoveryPlan` is the shape precedent). The
- * classifiers are maximally conservative; the exemptions are exactly
- * three (TV-1C — no wider taxonomy exists or is wanted):
- *
- * - MUTATION marker: `tool_execution_started` (intent-to-effect) of any
- *   name NOT in `nonMutatingTools`. Started — not the receipt — so failed
- *   and crash-window executions invalidate too, and pre-EC-1 overlap eras
- *   are covered by the same rule. Absence of a certificate is a mutation.
- *   The exemption set is fed by `effects.precommitSafe` — the frozen
- *   read-only+free+local contract, the only certificate that PROVES the
- *   world untouched. `concurrency: "shared"` proves overlap-safety and
- *   nothing else (the TV-1C finding: slow_touch is shared AND writes) —
- *   it never feeds this set.
- *   ONE proven exception (TV-1B, grounded in WR-1A): an execution whose
- *   terminal receipt is failed(errorKind:"precondition") never counts —
- *   that kind's frozen contract is "work refused BEFORE it starts".
- * - EVIDENCE: only receipts (`tool_execution_succeeded`) of names in
- *   `evidenceTools`. Default ∅ — the projection never invents evidence.
- *   What TV-1A's verdict asserts is POSITIONAL: the arc's last
- *   intent-to-effect was a successful evidence-class run — an "evidence",
- *   never a "proof" (semantic knowledge is the TV-1B driver's).
- * - task_set itself never invalidates: recording the claim after the check
- *   is the natural arc (tests → mark done), and the claim-recording act
- *   mutates nothing the evidence observed.
- * - VOIDED RANGES (TV-1C): a `model_output_abandoned` marker voids
- *   (voidFromSeq, seq] — the durable vocabulary's own "never happened",
- *   the same ranges the kernel projection skips. Every consumer here
- *   skips them uniformly: a voided echo is not a claim, a voided receipt
- *   is not evidence, a voided start is not a mutation. task_set waits
- *   for turn commit today (TT-1), so the scheduler already keeps claims
- *   out of voided turns — the projection encodes the admissibility rule
- *   itself instead of relying on that forever.
- *
- * `verified` means FRESH EVIDENCE UNDER THE CONFIGURED POLICY — never
- * "objectively proven correct". Goal Truth is external (PE-1's
- * evaluator); this projection only ever ranks the model's own claim
- * against the trajectory's own receipts.
- */
-const TASK_TOOL = "task_set";
-const STATUSES = new Set(["pending", "active", "done"]);
-const COUNT_LINE = /^\[task\] (\d+) items? — (\d+) pending, (\d+) active, (\d+) done$/;
-const ITEM_LINE = /^\[(\w+)\] (.*)$/;
-/** Parse the canonical task_set echo (the frozen content contract the
- *  checklist cell also reads). Returns the claims, or the reason it
- *  cannot — never a guess. */
-function parseEcho(content) {
-    const lines = content.split("\n");
-    const head = COUNT_LINE.exec(lines[0] ?? "");
-    if (head === null)
-        return { reason: "line 1 is not the [task] count line" };
-    const total = Number(head[1]);
-    const declared = { pending: Number(head[2]), active: Number(head[3]), done: Number(head[4]) };
-    const claims = [];
-    for (let i = 1; i < lines.length; i += 1) {
-        const m = ITEM_LINE.exec(lines[i]);
-        if (m === null || !STATUSES.has(m[1]))
-            return { reason: `line ${i + 1} is not a [pending|active|done] item line` };
-        claims.push({ text: m[2], status: m[1] });
-    }
-    const counts = { pending: 0, active: 0, done: 0 };
-    for (const c of claims)
-        counts[c.status] += 1;
-    if (claims.length !== total || counts.pending !== declared.pending || counts.active !== declared.active || counts.done !== declared.done) {
-        return { reason: "the count line disagrees with the item lines" };
-    }
-    return { claims };
-}
-/**
- * Assess the task claims and their evidence freshness over a durable
- * trajectory. Pure: same events, same options, same assessment.
- */
-export function assessTasks(events, opts) {
-    const nonMutating = opts?.nonMutatingTools ?? new Set();
-    const evidenceNames = opts?.evidenceTools ?? new Set();
-    // TV-1C: PASS 0 — the voided ranges. (voidFromSeq, seq] of every
-    // `model_output_abandoned` marker is "never happened" for this whole
-    // projection, exactly as the kernel's own context projection treats
-    // it. Markers are rare; a linear range check is honest and enough.
-    const voidRanges = [];
-    for (const ev of events) {
-        if (ev.type === "model_output_abandoned")
-            voidRanges.push({ from: ev.voidFromSeq, to: ev.seq });
-    }
-    const voided = (seq) => voidRanges.some((r) => seq > r.from && seq <= r.to);
-    // TV-1B: PASS 1 — executions whose terminal receipt is a
-    // PRECONDITION failure are PROVEN no-mutation (WR-1A froze that
-    // contract: work refused before it starts). Everything else stays
-    // conservative: no receipt (crash window), fatal/transient/
-    // invalid_input, success, and legacy receipts with no errorKind.
-    // Two passes, no temporal rollback state — same events, same verdict.
-    const provenNoMutation = new Set();
-    for (const ev of events) {
-        if (voided(ev.seq))
-            continue;
-        if (ev.type === "tool_execution_failed" && ev.errorKind === "precondition") {
-            provenNoMutation.add(ev.executionId);
-        }
-    }
-    const nameByExecution = new Map();
-    let claims = [];
-    let lastTaskSetSeq = null;
-    let unreadable = null;
-    let lastMutationSeq = null;
-    let lastEvidenceSeq = null;
-    let staleBySeq = null;
-    for (const ev of events) {
-        if (voided(ev.seq))
-            continue;
-        if (ev.type === "tool_execution_started") {
-            nameByExecution.set(ev.executionId, ev.name);
-            if (ev.name !== TASK_TOOL && !nonMutating.has(ev.name) && !provenNoMutation.has(ev.executionId)) {
-                lastMutationSeq = ev.seq;
-                if (lastEvidenceSeq !== null && staleBySeq === null)
-                    staleBySeq = ev.seq;
-            }
-        }
-        else if (ev.type === "tool_execution_succeeded") {
-            const name = nameByExecution.get(ev.executionId);
-            if (name === TASK_TOOL) {
-                const parsed = parseEcho(ev.result.content);
-                if ("reason" in parsed) {
-                    unreadable = { atSeq: ev.seq, reason: parsed.reason };
-                    claims = [];
-                    lastTaskSetSeq = ev.seq;
-                }
-                else {
-                    unreadable = null;
-                    claims = parsed.claims;
-                    lastTaskSetSeq = ev.seq;
-                }
-            }
-            else if (name !== undefined && evidenceNames.has(name)) {
-                // a fresh evidence receipt supersedes both the older evidence
-                // AND any staleness its own start incurred.
-                lastEvidenceSeq = ev.seq;
-                staleBySeq = null;
-            }
-        }
-    }
-    const allClaimedDone = claims.length > 0 && claims.every((c) => c.status === "done");
-    let evidence;
-    if (unreadable !== null) {
-        evidence = { kind: "unreadable", atSeq: unreadable.atSeq, reason: unreadable.reason };
-    }
-    else if (lastEvidenceSeq === null) {
-        evidence = { kind: "none" };
-    }
-    else if (staleBySeq !== null) {
-        evidence = { kind: "stale", evidenceSeq: lastEvidenceSeq, invalidatedBySeq: staleBySeq };
-    }
-    else {
-        evidence = { kind: "verified", evidenceSeq: lastEvidenceSeq };
-    }
-    return { claims, allClaimedDone, lastTaskSetSeq, lastMutationSeq, evidence };
-}