@vincemakes/kiso-runtime 0.43.0 → 0.45.0

package/dist/context-anchor.d.ts

@@ -15,7 +15,7 @@
  * differently), or one of the STALE_AFTER events after it, each of which
  * changes what the next request carries.
  */
-import { type Event, type Usage } from "@vincemakes/kiso-core";
+import type { Event, Usage } from "@vincemakes/kiso-core";
 /**
  * `usageTotal` turns one usage event into the tokens that request put in
  * the context: its canonical prompt (fresh + cache read + cache write — the

package/dist/context-anchor.js

@@ -1,21 +1,4 @@
-/**
- * 0.40.0 (the owner's session) — what the context holds, anchored on the
- * last BILLED request.
- *
- * The estimate alone read a Chinese-heavy context as ~470k while the
- * provider billed 732,448 input tokens on a 1M window: the ctx row said
- * "~53% left" and the microcompact trigger (window/2) never fired. The
- * provider's own count of the last request is the truth; only what the log
- * appended after it is estimated.
- *
- * The anchor is refused — the caller falls back to the estimate — when no
- * bill describes the context any more: no usage yet, a usage the provider
- * did not report (`known: false`), a usage at or before `floorSeq` (the
- * session switched models since, and a different tokenizer counts
- * differently), or one of the STALE_AFTER events after it, each of which
- * changes what the next request carries.
- */
-import { estimateTokens } from "@vincemakes/kiso-core";
+import { estimateTokens } from "./estimate-tokens.js";
 const STALE_AFTER = new Set([
     "compacted",
     "microcompacted",

package/dist/estimate-tokens.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The token estimator: runtime context-accounting policy.
+ *
+ * A stable, monotone chars/4 proxy for the size of a message list. The
+ * runtime's context policy, request budget, summary layer, context anchor
+ * and request trace read it; the kernel never did.
+ *
+ * ADR-0043 Amendment 13: moved here unchanged from the core package
+ * (`kernel/compaction.ts`). Since ADR-0044 moved compaction into the
+ * microcompact boundary, that file held only this estimator, and nothing
+ * in core called it — so it left the counted kernel instead of the cap
+ * moving.
+ */
+import type { Message } from "@vincemakes/kiso-core";
+/**
+ * Rough token estimate (chars/4 + structural overhead). Calibration-free on
+ * purpose: context economy only needs a stable MONOTONE proxy, not an exact
+ * count — the threshold absorbs the error (the predecessor's ADR-0007). The proxy's
+ * three-word contract, and the pins that hold it, are
+ * packages/core/tests/sc1b-estimator.test.ts (it stays with the
+ * kernel-loop cases it also pins).
+ */
+export declare function estimateTokens(messages: readonly Message[]): number;

package/dist/estimate-tokens.js

@@ -0,0 +1,85 @@
+/**
+ * The token estimator: runtime context-accounting policy.
+ *
+ * A stable, monotone chars/4 proxy for the size of a message list. The
+ * runtime's context policy, request budget, summary layer, context anchor
+ * and request trace read it; the kernel never did.
+ *
+ * ADR-0043 Amendment 13: moved here unchanged from the core package
+ * (`kernel/compaction.ts`). Since ADR-0044 moved compaction into the
+ * microcompact boundary, that file held only this estimator, and nothing
+ * in core called it — so it left the counted kernel instead of the cap
+ * moving.
+ */
+/**
+ * What a non-text block (an image) contributes. There is no character count
+ * to proxy, and this module refuses to guess a provider's image
+ * tokenization; the figure exists so a block is never worth ZERO, which is
+ * what MONOTONE requires. Deliberately small: under-stating an image is a
+ * threshold that fires slightly late, over-stating it is one that fires on
+ * a conversation that was never large.
+ */
+const NON_TEXT_BLOCK_TOKENS = 8;
+/**
+ * chars/4 over a `string | ContentBlock[]` content field.
+ *
+ * SC-1b ①: the array arm must be summed BLOCK BY BLOCK. Reading `.length`
+ * off it yields the block COUNT — a five-block 50 KB message scored ~2
+ * tokens, and the live microcompact threshold believed it.
+ */
+function contentTokens(content) {
+    if (typeof content === "string")
+        return textTokens(content);
+    let tokens = 0;
+    for (const block of content) {
+        tokens += block.type === "text" ? textTokens(block.text) : NON_TEXT_BLOCK_TOKENS;
+    }
+    return tokens;
+}
+/**
+ * 0.40.0 (the owner's session): chars/4, except that a CJK character counts
+ * as one token — which is about what a tokenizer spends on one. Plain
+ * chars/4 read a Chinese-heavy 730k context as ~470k, so the thresholds
+ * never fired and the ctx row lied. Text without CJK scores exactly what
+ * it scored before. A counting loop, not a regex match: the text can be
+ * megabytes, and a match array would hold one entry per character.
+ */
+function textTokens(text) {
+    let cjk = 0;
+    for (let i = 0; i < text.length; i++) {
+        const c = text.charCodeAt(i);
+        // kana, CJK ext A, unified ideographs, Hangul syllables,
+        // compatibility ideographs, full-width forms
+        if ((c >= 0x3040 && c <= 0x30ff) || (c >= 0x3400 && c <= 0x4dbf) || (c >= 0x4e00 && c <= 0x9fff) || (c >= 0xac00 && c <= 0xd7af) || (c >= 0xf900 && c <= 0xfaff) || (c >= 0xff00 && c <= 0xffef))
+            cjk++;
+    }
+    return cjk + Math.ceil((text.length - cjk) / 4);
+}
+/**
+ * Rough token estimate (chars/4 + structural overhead). Calibration-free on
+ * purpose: context economy only needs a stable MONOTONE proxy, not an exact
+ * count — the threshold absorbs the error (the predecessor's ADR-0007). The proxy's
+ * three-word contract, and the pins that hold it, are
+ * packages/core/tests/sc1b-estimator.test.ts (it stays with the
+ * kernel-loop cases it also pins).
+ */
+export function estimateTokens(messages) {
+    let total = 0;
+    for (const msg of messages) {
+        if (msg.role === "user") {
+            total += contentTokens(msg.content);
+        }
+        else if (msg.role === "assistant") {
+            for (const block of msg.blocks) {
+                total +=
+                    block.type === "text"
+                        ? textTokens(block.text)
+                        : textTokens(JSON.stringify(block.input)) + 20;
+            }
+        }
+        else {
+            total += contentTokens(msg.content) + 10;
+        }
+    }
+    return total;
+}

package/dist/index.d.ts

@@ -24,15 +24,14 @@ export { AgentSession, AgentSession as Session } from "./session.js";
 export type { SideQueryOptions } from "./session.js";
 export { PoisonedSessionError, ResumeBlockedError } from "./session.js";
 export type { ApprovalRequest, CompactInfo, ContextPolicy, SessionConfig, SummarizeResult } from "./session.js";
-export { Run } from "./run.js";
+export { Run, RunClosedError } from "./run.js";
 export { SessionStore, StaleWriterError, StoreCorruptionError } from "./store.js";
 export type { Event, SessionMeta, StoreRecord } from "./store.js";
 export { disposeExtensions, loadExtensions, loadProjectExtensions } from "./extensions.js";
 export type { KisoExtension } from "./extensions.js";
 export { executionForCallId, executionLedger } from "./ledger.js";
 export type { ExecutionRecord, ExecutionStatus } from "./ledger.js";
-export { assessTasks } from "./task-assessment.js";
-export type { EvidenceVerdict, TaskAssessment, TaskClaim } from "./task-assessment.js";
 export { kisoHome, projectArtifacts, recordTrust, trustFor } from "./trust.js";
 export type { ProjectArtifact, ProjectArtifacts, TrustDecision, TrustRecord } from "./trust.js";
 export { canonicalizeUsage } from "./usage/canonical.js";
+export { estimateTokens } from "./estimate-tokens.js";

package/dist/index.js

@@ -24,16 +24,13 @@ export { AgentRuntime, AgentRuntime as Agent, createAgent } from "./agent.js";
 export { AgentSession, AgentSession as Session } from "./session.js";
 export { PoisonedSessionError, ResumeBlockedError } from "./session.js";
 // run
-export { Run } from "./run.js";
+export { Run, RunClosedError } from "./run.js";
 // store
 export { SessionStore, StaleWriterError, StoreCorruptionError } from "./store.js";
 // extensions
 export { disposeExtensions, loadExtensions, loadProjectExtensions } from "./extensions.js";
 // ledger
 export { executionForCallId, executionLedger } from "./ledger.js";
-// task assessment (TV-1A) — the pure projection separating the model's
-// CLAIM from VERIFIED under Verified ⟹ evidenceSeq > lastMutationSeq
-export { assessTasks } from "./task-assessment.js";
 // trust
 export { kisoHome, projectArtifacts, recordTrust, trustFor } from "./trust.js";
 // usage — the canonical accounting schema (E2/1.3.0, R4b-1 ruling:
@@ -45,3 +42,7 @@ export { kisoHome, projectArtifacts, recordTrust, trustFor } from "./trust.js";
 // provider observation; canonicalizeUsage derives at the accounting
 // boundary (R4 Case B — the frozen usage union does not move).
 export { canonicalizeUsage } from "./usage/canonical.js";
+// ADR-0043 Amendment 13: the token estimator is runtime context-accounting
+// policy, not a kernel primitive — it moved here unchanged from the core
+// package, which never called it.
+export { estimateTokens } from "./estimate-tokens.js";

package/dist/request-budget.js

@@ -17,7 +17,7 @@
  * This is a display and design entry. The auto-compact policy keeps its
  * own number (`estimateCtxRatio` in the CLI) — moving it is A1b's.
  */
-import { estimateTokens } from "@vincemakes/kiso-core";
+import { estimateTokens } from "./estimate-tokens.js";
 const chars = (s) => Math.ceil(s.length / 4);
 export function requestBudget(parts, window) {
     const system = parts.systemPrompt === undefined ? 0 : chars(parts.systemPrompt);

package/dist/run.d.ts

@@ -7,8 +7,19 @@ import { type AbortSignalLike, type Adapter, type ContentBlock, type Event } fro
 import type { SessionStore } from "./store.js";
 import { type AgentSession, type SessionConfig } from "./session.js";
 /**
- * A single turn. Async-iterable, so `for await (const ev of session.run(x))`
- * is the natural shape; the handle also carries the runId and the abort.
+ * ADR-0057: `run.steer()` after the run decided to end — its ingress is
+ * sealed. The host starts a new run with the input instead.
+ */
+export declare class RunClosedError extends Error {
+    readonly runId: string;
+    constructor(runId: string);
+}
+/**
+ * A single foreground execution, from its input to one terminal (ADR-0057:
+ * it may admit further input at Safe Admission boundaries).
+ * Async-iterable, so `for await (const ev of session.run(x))` is the
+ * natural shape; the handle also carries the runId, the abort and the
+ * steer.
  */
 export declare class Run implements AsyncIterable<Event> {
     #private;
@@ -16,5 +27,16 @@ export declare class Run implements AsyncIterable<Event> {
     constructor(store: SessionStore, adapter: Adapter, config: SessionConfig, session: AgentSession, input: string | readonly ContentBlock[] | undefined, externalSignal: AbortSignalLike | undefined, resume: boolean, source?: import("@vincemakes/kiso-core").MessageSource, via?: import("@vincemakes/kiso-core").UserInputVia);
     /** Cancel the run: propagates to the adapter (SDK) and future executions. */
     abort(): void;
+    /**
+     * ADR-0057 — hand this run a person's input. It is admitted at the next
+     * Safe Admission boundary (every started effect settled, no approval
+     * open) as a user_input the model sees on its next request. Throws
+     * {@link RunClosedError} once the run has decided to end.
+     */
+    steer(content: string | readonly ContentBlock[]): void;
+    /** ADR-0057 — take back the input that has not been admitted yet. */
+    retract(): readonly (string | readonly ContentBlock[])[];
+    /** ADR-0057 — input that arrived but was not admitted when the run ended. */
+    unadmitted(): readonly (string | readonly ContentBlock[])[];
     [Symbol.asyncIterator](): AsyncIterator<Event>;
 }

package/dist/run.js

@@ -15,8 +15,23 @@ import { RequestTracer, traceGuard } from "./trace/guard.js";
 import { runtimeVersion } from "./trace/writer.js";
 import { ResumeBlockedError } from "./session.js";
 /**
- * A single turn. Async-iterable, so `for await (const ev of session.run(x))`
- * is the natural shape; the handle also carries the runId and the abort.
+ * ADR-0057: `run.steer()` after the run decided to end — its ingress is
+ * sealed. The host starts a new run with the input instead.
+ */
+export class RunClosedError extends Error {
+    runId;
+    constructor(runId) {
+        super(`run ${runId} has ended — start a new run with this input`);
+        this.name = "RunClosedError";
+        this.runId = runId;
+    }
+}
+/**
+ * A single foreground execution, from its input to one terminal (ADR-0057:
+ * it may admit further input at Safe Admission boundaries).
+ * Async-iterable, so `for await (const ev of session.run(x))` is the
+ * natural shape; the handle also carries the runId, the abort and the
+ * steer.
  */
 export class Run {
     runId;
@@ -36,9 +51,15 @@ export class Run {
     #externalSignal;
     #decisionIds = [];
     #started = false;
+    // ADR-0057 — the ephemeral ingress: a person's input in arrival order,
+    // held in memory until an admission site takes it. The log owns what was
+    // admitted; nothing here is durable (a crash before admission loses it).
+    #pending = [];
+    #unadmitted = [];
+    #sealed = false;
     constructor(store, adapter, config, session, input, externalSignal, resume, 
-    // TV-1B: durable PROVENANCE for the input (e.g. the verification
-    // seed's source:"system") — who produced the line, never a
+    // TV-1B: durable PROVENANCE for the input (e.g. source:"system"
+    // for a line the product wrote) — who produced the line, never a
     // provider-role escalation. Absent = plain user input.
     source, 
     // 0.40.0: how a person composed the turn (a skill + the typed line) —
@@ -59,6 +80,41 @@ export class Run {
     abort() {
         this.#abort.abort();
     }
+    /**
+     * ADR-0057 — hand this run a person's input. It is admitted at the next
+     * Safe Admission boundary (every started effect settled, no approval
+     * open) as a user_input the model sees on its next request. Throws
+     * {@link RunClosedError} once the run has decided to end.
+     */
+    steer(content) {
+        if (this.#sealed)
+            throw new RunClosedError(this.runId);
+        this.#pending.push(content);
+    }
+    /** ADR-0057 — take back the input that has not been admitted yet. */
+    retract() {
+        return this.#pending.splice(0);
+    }
+    /** ADR-0057 — input that arrived but was not admitted when the run ended. */
+    unadmitted() {
+        return [...this.#unadmitted];
+    }
+    /** The kernel's `admit`: what is pending becomes ONE human input — a
+     *  single line as itself, several as text blocks in arrival order. */
+    async #admit(mode) {
+        if (mode !== "seal" && this.#pending.length > 0) {
+            const lines = this.#pending.splice(0);
+            const content = lines.length === 1 ? lines[0] : lines.flatMap((l) => (typeof l === "string" ? [{ type: "text", text: l }] : l));
+            return [{ kind: "human", content, source: "user" }];
+        }
+        if (mode !== "take")
+            this.#seal();
+        return [];
+    }
+    #seal() {
+        this.#sealed = true;
+        this.#unadmitted.push(...this.#pending.splice(0));
+    }
     async *[Symbol.asyncIterator]() {
         if (this.#started)
             throw new Error("a run may only be consumed once");
@@ -204,6 +260,9 @@ export class Run {
                 // the human gave in the same instant as the abort is
                 // recorded, exactly once.
                 approvalVerdict: (decisionId) => this.#session.approvalVerdict(decisionId),
+                // ADR-0057: the ingress — the kernel admits at its three sites
+                // and seals at every terminal.
+                admit: (mode) => this.#admit(mode),
             });
             const self = this;
             const runLoop = async function* () {
@@ -328,6 +387,9 @@ export class Run {
                 yield ev;
         }
         finally {
+            // ADR-0057: however the run ended — terminal, throw or abandoned —
+            // its ingress is closed; pending input is handed back.
+            this.#seal();
             // round 5(P1-5): flush verdicts the consumer submitted before the
             // generator was abandoned — an approve()/resolveUncertain() whose
             // durable event the loop never got to persist must STILL land on
@@ -505,7 +567,10 @@ export class Run {
             yield log.append({ type: "tool_result", callId: call.callId, invocationSeq: call.seq, content: refusal, isError: true, errorKind: "invalid_input" });
             return;
         }
-        const payload = { callId: call.callId, name: call.name, input: call.input ?? {} };
+        // #20: the same lexical evidence the fresh path hands onPreTool — THIS
+        // invocation's deltas, anchored by its seq; never given to the chain.
+        const rawInput = rawInputOf(log.all, call.callId, call.seq);
+        const payload = { callId: call.callId, name: call.name, input: call.input ?? {}, ...(rawInput !== undefined ? { rawInput } : {}) };
         const policyCall = { name: payload.name, input: payload.input };
         let verdict;
         try {
@@ -825,7 +890,7 @@ export class Run {
                 };
             }
             if (this.#config.hooks?.onPostTool) {
-                result = await this.#config.hooks.onPostTool({ callId, name, input }, result, { sessionId: this.#session.id });
+                result = await this.#config.hooks.onPostTool({ callId, name, input, ...(rawInput !== undefined ? { rawInput } : {}) }, result, { sessionId: this.#session.id });
             }
         }
         // ruling #12 correction one: the honest note rides the recovered failure too —

package/dist/session.d.ts

@@ -29,7 +29,6 @@
  */
 import { EventLog, type AbortSignalLike, type Adapter, type Event, type KisoExtension, type Message, type PermissionDecision, type Tool, type ToolSpec, type EventInput } from "@vincemakes/kiso-core";
 import { type OverflowMeasure } from "./overflow-belt.js";
-import { type TaskAssessment } from "./task-assessment.js";
 import { type ContinuationScope } from "@vincemakes/kiso-core";
 import { type ReasoningSetting } from "./provider/metadata.js";
 import { type SessionStore, type StoreRecord } from "./store.js";
@@ -375,20 +374,6 @@ export declare class AgentSession {
     approve(decisionId: string, allow: boolean, reason?: string): Promise<void>;
     /** Executions that started but never reported a result (crash window). */
     uncertainExecutions(): import("./ledger.js").ExecutionRecord[];
-    /**
-     * TV-1A — assess the task claims and their evidence freshness over THIS
-     * session's durable log. The non-mutating set comes from the live tools'
-     * own `effects.precommitSafe` certificates (one direction of truth,
-     * never a second declaration) — the read-only+free+local contract, the
-     * only certificate that proves the world untouched. `concurrency:
-     * "shared"` is a SCHEDULING promise and never feeds this set (TV-1C —
-     * slow_touch is shared and writes). The evidence policy defaults to
-     * {"shell"} — the convention the task extension's own "make the LAST
-     * item a verification step" guidance produces.
-     */
-    assessTasks(opts?: {
-        readonly evidenceTools?: ReadonlySet<string>;
-    }): TaskAssessment;
     /**
      * The human's verdict on an interrupted execution, keyed by EXECUTION ID
      * (B group): "rerun" (the human says the side effect did NOT happen — the

package/dist/session.js

@@ -31,11 +31,6 @@ import { EventLog, projectMessages, SUMMARY_FRAMING, } from "@vincemakes/kiso-co
 import { executionLedger } from "./ledger.js";
 import { overflowBelt } from "./overflow-belt.js";
 import { windowLearner } from "./window-learner.js";
-import { assessTasks } from "./task-assessment.js";
-/** TV-1A — the session-level evidence policy: the PURE projection defaults
- *  to ∅ (never inventing evidence); the session names the one built-in
- *  verification surface. Override per call for custom evidence tools. */
-const DEFAULT_EVIDENCE_TOOLS = new Set(["shell"]);
 import { denialResult } from "@vincemakes/kiso-core";
 import { buildProfile, readProfile, writeProfile, writeSummary } from "./profile.js";
 import { summarizeEvents } from "./session-summary.js";
@@ -45,7 +40,7 @@ import { canonicalizeUsageForModel } from "./usage/canonical.js";
 import { contextAnchor } from "./context-anchor.js";
 import { appendFileSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
-import { estimateTokens } from "@vincemakes/kiso-core";
+import { estimateTokens } from "./estimate-tokens.js";
 import { StaleWriterError } from "./store.js";
 import { composeHooks, composeSystemPrompt, microcompactFor, runBasePrompt } from "./compose.js";
 import { checkpointBoundarySeq } from "./checkpoint.js";
@@ -1064,28 +1059,6 @@ export class AgentSession {
     uncertainExecutions() {
         return [...executionLedger(this.log.all).values()].filter((r) => r.status === "uncertain");
     }
-    /**
-     * TV-1A — assess the task claims and their evidence freshness over THIS
-     * session's durable log. The non-mutating set comes from the live tools'
-     * own `effects.precommitSafe` certificates (one direction of truth,
-     * never a second declaration) — the read-only+free+local contract, the
-     * only certificate that proves the world untouched. `concurrency:
-     * "shared"` is a SCHEDULING promise and never feeds this set (TV-1C —
-     * slow_touch is shared and writes). The evidence policy defaults to
-     * {"shell"} — the convention the task extension's own "make the LAST
-     * item a verification step" guidance produces.
-     */
-    assessTasks(opts) {
-        const nonMutatingTools = new Set();
-        for (const tool of this.#config.registry.list()) {
-            if (tool.effects?.precommitSafe === true)
-                nonMutatingTools.add(tool.name);
-        }
-        return assessTasks(this.log.all, {
-            nonMutatingTools,
-            evidenceTools: opts?.evidenceTools ?? DEFAULT_EVIDENCE_TOOLS,
-        });
-    }
     /**
      * The human's verdict on an interrupted execution, keyed by EXECUTION ID
      * (B group): "rerun" (the human says the side effect did NOT happen — the

package/dist/summarize.d.ts

@@ -270,8 +270,9 @@ export declare function estimateEventTokens(ev: Event): number;
  * rounds exist (nothing worth covering yet).
  *
  * ⑥ (task round): a tool result tagged do-not-compact is DURABLE work
- * memory (the task_set echo) — the summary must never cover its round,
- * or the model loses the current list. When the base boundary would
+ * memory (a tool declares it so; the retired task extension's list was
+ * the first) — the summary must never cover its round, or the model
+ * loses it. When the base boundary would
  * cover such a result, the boundary pulls back to just before the round
  * containing the LATEST one (still a turn boundary). A protected round
  * as the FIRST uncovered round leaves nothing before it to cover →

package/dist/summarize.js

@@ -13,7 +13,8 @@
  * unchanged ("nothing happened"). Only the generated `summarized` event
  * lands on disk; the original events stay there forever.
  */
-import { estimateTokens, DO_NOT_COMPACT, DEFAULT_MAX_RETRIES, RETRY_AFTER_MAX_MS, retryDelayMs } from "@vincemakes/kiso-core";
+import { DO_NOT_COMPACT, DEFAULT_MAX_RETRIES, RETRY_AFTER_MAX_MS, retryDelayMs } from "@vincemakes/kiso-core";
+import { estimateTokens } from "./estimate-tokens.js";
 /** K (ADR-0044): the recent ROUNDS kept intact by /compact — a constant,
  *  not a knob. The covered range ends just before the K-th most recent
  *  round, so the model still reasons over the recent conversation. */
@@ -501,8 +502,9 @@ export function estimateEventTokens(ev) {
  * rounds exist (nothing worth covering yet).
  *
  * ⑥ (task round): a tool result tagged do-not-compact is DURABLE work
- * memory (the task_set echo) — the summary must never cover its round,
- * or the model loses the current list. When the base boundary would
+ * memory (a tool declares it so; the retired task extension's list was
+ * the first) — the summary must never cover its round, or the model
+ * loses it. When the base boundary would
  * cover such a result, the boundary pulls back to just before the round
  * containing the LATEST one (still a turn boundary). A protected round
  * as the FIRST uncovered round leaves nothing before it to cover →

package/dist/trace/manifest.js

@@ -20,7 +20,7 @@
  * surprise), every turn range degrades to null — honest thin pointers
  * rather than wrong ones.
  */
-import { estimateTokens } from "@vincemakes/kiso-core";
+import { estimateTokens } from "../estimate-tokens.js";
 import { canonicalJson, hashSystemPrompt, hashToolSpecs, sha256Hex } from "./hash.js";
 /** The log's visible user boundaries, in log order: every user_input
  *  whose replacement (if any) is not a veto. */

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vincemakes/kiso-runtime",
-	"version": "0.43.0",
+	"version": "0.45.0",
 	"description": "kiso runtime \u2014 durable multi-turn agent sessions: AgentDefinition, AgentRuntime, AgentSession, Run, append-only JSONL store.",
 	"type": "module",
 	"license": "MIT",
@@ -25,12 +25,12 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@vincemakes/kiso-core": "0.43.0"
+		"@vincemakes/kiso-core": "0.45.0"
 	},
 	"peerDependencies": {
-		"@vincemakes/kiso-provider-anthropic": "0.43.0",
-		"@vincemakes/kiso-provider-openai": "0.43.0",
-		"@vincemakes/kiso-provider-openai-responses": "0.43.0"
+		"@vincemakes/kiso-provider-anthropic": "0.45.0",
+		"@vincemakes/kiso-provider-openai": "0.45.0",
+		"@vincemakes/kiso-provider-openai-responses": "0.45.0"
 	},
 	"peerDependenciesMeta": {
 		"@vincemakes/kiso-provider-anthropic": {
@@ -44,7 +44,7 @@
 		}
 	},
 	"devDependencies": {
-		"@vincemakes/kiso-evals": "0.43.0",
+		"@vincemakes/kiso-evals": "0.45.0",
 		"@types/node": "^26.1.2",
 		"typescript": "^5.7.2",
 		"vitest": "^3.0.0"

package/dist/task-assessment.d.ts

@@ -1,93 +0,0 @@
-/**
- * TV-1A — TaskAssessment as a PURE PROJECTION + Evidence Freshness.
- *
- * The task checklist the model maintains through task_set is a SELF-REPORT:
- * an item is "done" because the model said so. This projection mechanically
- * separates that CLAIM from VERIFIED, under one frozen sentence:
- *
- *   Verified ⟹ evidenceSeq > lastRelevantMutationSeq.
- *
- * No new event kind, no core diff — the projection reads the existing
- * durable vocabulary (`deriveRecoveryPlan` is the shape precedent). The
- * classifiers are maximally conservative; the exemptions are exactly
- * three (TV-1C — no wider taxonomy exists or is wanted):
- *
- * - MUTATION marker: `tool_execution_started` (intent-to-effect) of any
- *   name NOT in `nonMutatingTools`. Started — not the receipt — so failed
- *   and crash-window executions invalidate too, and pre-EC-1 overlap eras
- *   are covered by the same rule. Absence of a certificate is a mutation.
- *   The exemption set is fed by `effects.precommitSafe` — the frozen
- *   read-only+free+local contract, the only certificate that PROVES the
- *   world untouched. `concurrency: "shared"` proves overlap-safety and
- *   nothing else (the TV-1C finding: slow_touch is shared AND writes) —
- *   it never feeds this set.
- *   ONE proven exception (TV-1B, grounded in WR-1A): an execution whose
- *   terminal receipt is failed(errorKind:"precondition") never counts —
- *   that kind's frozen contract is "work refused BEFORE it starts".
- * - EVIDENCE: only receipts (`tool_execution_succeeded`) of names in
- *   `evidenceTools`. Default ∅ — the projection never invents evidence.
- *   What TV-1A's verdict asserts is POSITIONAL: the arc's last
- *   intent-to-effect was a successful evidence-class run — an "evidence",
- *   never a "proof" (semantic knowledge is the TV-1B driver's).
- * - task_set itself never invalidates: recording the claim after the check
- *   is the natural arc (tests → mark done), and the claim-recording act
- *   mutates nothing the evidence observed.
- * - VOIDED RANGES (TV-1C): a `model_output_abandoned` marker voids
- *   (voidFromSeq, seq] — the durable vocabulary's own "never happened",
- *   the same ranges the kernel projection skips. Every consumer here
- *   skips them uniformly: a voided echo is not a claim, a voided receipt
- *   is not evidence, a voided start is not a mutation. task_set waits
- *   for turn commit today (TT-1), so the scheduler already keeps claims
- *   out of voided turns — the projection encodes the admissibility rule
- *   itself instead of relying on that forever.
- *
- * `verified` means FRESH EVIDENCE UNDER THE CONFIGURED POLICY — never
- * "objectively proven correct". Goal Truth is external (PE-1's
- * evaluator); this projection only ever ranks the model's own claim
- * against the trajectory's own receipts.
- */
-import type { Event } from "@vincemakes/kiso-core";
-/** One item of the model's plan, exactly as last claimed. */
-export interface TaskClaim {
-    readonly text: string;
-    readonly status: "pending" | "active" | "done";
-}
-/** The freshness verdict. `stale` and `unreadable` NAME their cause. */
-export type EvidenceVerdict = {
-    readonly kind: "verified";
-    readonly evidenceSeq: number;
-} | {
-    readonly kind: "stale";
-    readonly evidenceSeq: number;
-    readonly invalidatedBySeq: number;
-} | {
-    readonly kind: "none";
-} | {
-    readonly kind: "unreadable";
-    readonly atSeq: number;
-    readonly reason: string;
-};
-export interface TaskAssessment {
-    /** The LAST successful task_set echo, parsed — the model's claims. */
-    readonly claims: readonly TaskClaim[];
-    /** True only for a non-empty plan whose every item is claimed done. */
-    readonly allClaimedDone: boolean;
-    readonly lastTaskSetSeq: number | null;
-    /** Seq of the last mutation-class `tool_execution_started`, if any. */
-    readonly lastMutationSeq: number | null;
-    readonly evidence: EvidenceVerdict;
-}
-/**
- * Assess the task claims and their evidence freshness over a durable
- * trajectory. Pure: same events, same options, same assessment.
- */
-export declare function assessTasks(events: readonly Event[], opts?: {
-    /** Names whose executions PROVABLY never mutate the observable
-     *  world (from `effects.precommitSafe` certificates — read-only +
-     *  free + local). `concurrency: "shared"` is NOT such a proof
-     *  (TV-1C). Default ∅ — everything mutates. */
-    readonly nonMutatingTools?: ReadonlySet<string>;
-    /** Names whose successful receipts count as evidence. Default ∅ —
-     *  nothing does. */
-    readonly evidenceTools?: ReadonlySet<string>;
-}): TaskAssessment;

package/dist/task-assessment.js

@@ -1,165 +0,0 @@
-/**
- * TV-1A — TaskAssessment as a PURE PROJECTION + Evidence Freshness.
- *
- * The task checklist the model maintains through task_set is a SELF-REPORT:
- * an item is "done" because the model said so. This projection mechanically
- * separates that CLAIM from VERIFIED, under one frozen sentence:
- *
- *   Verified ⟹ evidenceSeq > lastRelevantMutationSeq.
- *
- * No new event kind, no core diff — the projection reads the existing
- * durable vocabulary (`deriveRecoveryPlan` is the shape precedent). The
- * classifiers are maximally conservative; the exemptions are exactly
- * three (TV-1C — no wider taxonomy exists or is wanted):
- *
- * - MUTATION marker: `tool_execution_started` (intent-to-effect) of any
- *   name NOT in `nonMutatingTools`. Started — not the receipt — so failed
- *   and crash-window executions invalidate too, and pre-EC-1 overlap eras
- *   are covered by the same rule. Absence of a certificate is a mutation.
- *   The exemption set is fed by `effects.precommitSafe` — the frozen
- *   read-only+free+local contract, the only certificate that PROVES the
- *   world untouched. `concurrency: "shared"` proves overlap-safety and
- *   nothing else (the TV-1C finding: slow_touch is shared AND writes) —
- *   it never feeds this set.
- *   ONE proven exception (TV-1B, grounded in WR-1A): an execution whose
- *   terminal receipt is failed(errorKind:"precondition") never counts —
- *   that kind's frozen contract is "work refused BEFORE it starts".
- * - EVIDENCE: only receipts (`tool_execution_succeeded`) of names in
- *   `evidenceTools`. Default ∅ — the projection never invents evidence.
- *   What TV-1A's verdict asserts is POSITIONAL: the arc's last
- *   intent-to-effect was a successful evidence-class run — an "evidence",
- *   never a "proof" (semantic knowledge is the TV-1B driver's).
- * - task_set itself never invalidates: recording the claim after the check
- *   is the natural arc (tests → mark done), and the claim-recording act
- *   mutates nothing the evidence observed.
- * - VOIDED RANGES (TV-1C): a `model_output_abandoned` marker voids
- *   (voidFromSeq, seq] — the durable vocabulary's own "never happened",
- *   the same ranges the kernel projection skips. Every consumer here
- *   skips them uniformly: a voided echo is not a claim, a voided receipt
- *   is not evidence, a voided start is not a mutation. task_set waits
- *   for turn commit today (TT-1), so the scheduler already keeps claims
- *   out of voided turns — the projection encodes the admissibility rule
- *   itself instead of relying on that forever.
- *
- * `verified` means FRESH EVIDENCE UNDER THE CONFIGURED POLICY — never
- * "objectively proven correct". Goal Truth is external (PE-1's
- * evaluator); this projection only ever ranks the model's own claim
- * against the trajectory's own receipts.
- */
-const TASK_TOOL = "task_set";
-const STATUSES = new Set(["pending", "active", "done"]);
-const COUNT_LINE = /^\[task\] (\d+) items? — (\d+) pending, (\d+) active, (\d+) done$/;
-const ITEM_LINE = /^\[(\w+)\] (.*)$/;
-/** Parse the canonical task_set echo (the frozen content contract the
- *  checklist cell also reads). Returns the claims, or the reason it
- *  cannot — never a guess. */
-function parseEcho(content) {
-    const lines = content.split("\n");
-    const head = COUNT_LINE.exec(lines[0] ?? "");
-    if (head === null)
-        return { reason: "line 1 is not the [task] count line" };
-    const total = Number(head[1]);
-    const declared = { pending: Number(head[2]), active: Number(head[3]), done: Number(head[4]) };
-    const claims = [];
-    for (let i = 1; i < lines.length; i += 1) {
-        const m = ITEM_LINE.exec(lines[i]);
-        if (m === null || !STATUSES.has(m[1]))
-            return { reason: `line ${i + 1} is not a [pending|active|done] item line` };
-        claims.push({ text: m[2], status: m[1] });
-    }
-    const counts = { pending: 0, active: 0, done: 0 };
-    for (const c of claims)
-        counts[c.status] += 1;
-    if (claims.length !== total || counts.pending !== declared.pending || counts.active !== declared.active || counts.done !== declared.done) {
-        return { reason: "the count line disagrees with the item lines" };
-    }
-    return { claims };
-}
-/**
- * Assess the task claims and their evidence freshness over a durable
- * trajectory. Pure: same events, same options, same assessment.
- */
-export function assessTasks(events, opts) {
-    const nonMutating = opts?.nonMutatingTools ?? new Set();
-    const evidenceNames = opts?.evidenceTools ?? new Set();
-    // TV-1C: PASS 0 — the voided ranges. (voidFromSeq, seq] of every
-    // `model_output_abandoned` marker is "never happened" for this whole
-    // projection, exactly as the kernel's own context projection treats
-    // it. Markers are rare; a linear range check is honest and enough.
-    const voidRanges = [];
-    for (const ev of events) {
-        if (ev.type === "model_output_abandoned")
-            voidRanges.push({ from: ev.voidFromSeq, to: ev.seq });
-    }
-    const voided = (seq) => voidRanges.some((r) => seq > r.from && seq <= r.to);
-    // TV-1B: PASS 1 — executions whose terminal receipt is a
-    // PRECONDITION failure are PROVEN no-mutation (WR-1A froze that
-    // contract: work refused before it starts). Everything else stays
-    // conservative: no receipt (crash window), fatal/transient/
-    // invalid_input, success, and legacy receipts with no errorKind.
-    // Two passes, no temporal rollback state — same events, same verdict.
-    const provenNoMutation = new Set();
-    for (const ev of events) {
-        if (voided(ev.seq))
-            continue;
-        if (ev.type === "tool_execution_failed" && ev.errorKind === "precondition") {
-            provenNoMutation.add(ev.executionId);
-        }
-    }
-    const nameByExecution = new Map();
-    let claims = [];
-    let lastTaskSetSeq = null;
-    let unreadable = null;
-    let lastMutationSeq = null;
-    let lastEvidenceSeq = null;
-    let staleBySeq = null;
-    for (const ev of events) {
-        if (voided(ev.seq))
-            continue;
-        if (ev.type === "tool_execution_started") {
-            nameByExecution.set(ev.executionId, ev.name);
-            if (ev.name !== TASK_TOOL && !nonMutating.has(ev.name) && !provenNoMutation.has(ev.executionId)) {
-                lastMutationSeq = ev.seq;
-                if (lastEvidenceSeq !== null && staleBySeq === null)
-                    staleBySeq = ev.seq;
-            }
-        }
-        else if (ev.type === "tool_execution_succeeded") {
-            const name = nameByExecution.get(ev.executionId);
-            if (name === TASK_TOOL) {
-                const parsed = parseEcho(ev.result.content);
-                if ("reason" in parsed) {
-                    unreadable = { atSeq: ev.seq, reason: parsed.reason };
-                    claims = [];
-                    lastTaskSetSeq = ev.seq;
-                }
-                else {
-                    unreadable = null;
-                    claims = parsed.claims;
-                    lastTaskSetSeq = ev.seq;
-                }
-            }
-            else if (name !== undefined && evidenceNames.has(name)) {
-                // a fresh evidence receipt supersedes both the older evidence
-                // AND any staleness its own start incurred.
-                lastEvidenceSeq = ev.seq;
-                staleBySeq = null;
-            }
-        }
-    }
-    const allClaimedDone = claims.length > 0 && claims.every((c) => c.status === "done");
-    let evidence;
-    if (unreadable !== null) {
-        evidence = { kind: "unreadable", atSeq: unreadable.atSeq, reason: unreadable.reason };
-    }
-    else if (lastEvidenceSeq === null) {
-        evidence = { kind: "none" };
-    }
-    else if (staleBySeq !== null) {
-        evidence = { kind: "stale", evidenceSeq: lastEvidenceSeq, invalidatedBySeq: staleBySeq };
-    }
-    else {
-        evidence = { kind: "verified", evidenceSeq: lastEvidenceSeq };
-    }
-    return { claims, allClaimedDone, lastTaskSetSeq, lastMutationSeq, evidence };
-}