@visual-z/xeno 0.4.0 → 0.6.0

package/src/runtime/extensions.ts

@@ -43,6 +43,7 @@ export interface ExtensionTool {
   exposure?: "direct" | "deferred";
   promptSnippet?: string; promptGuidelines?: string[]; executionMode?: "parallel" | "sequential";
   prepareArguments?(input: unknown): unknown;
+  validateInput?(input: unknown): void;
   execute(id: string, args: Record<string, unknown>, signal: AbortSignal | undefined,
     onUpdate: (result: ExtensionToolResult) => void, ctx: ExtensionContext): Promise<ExtensionToolResult>;
   renderCall?(args: unknown, theme: ExtensionTheme, context: ExtensionToolRenderContext): ExtensionComponent;
@@ -102,6 +103,14 @@ interface ExtensionRegistryOptions {
 
 /** Registrations are staged before activation, and disposed as one generation on reload. */
 export class ExtensionRegistry {
+  /** Harness-owned tools keep capability metadata; arbitrary extensions cannot claim it. */
+  readonly builtinTools = new Map<string, ToolDefinition>();
+  private readonly ownedDisposers: (() => Promise<void>)[] = [];
+  installBuiltin(tool: ToolDefinition): void {
+    if (this.tools.has(tool.name) || this.builtinTools.has(tool.name)) throw Error(`duplicate harness tool ${tool.name}`);
+    this.builtinTools.set(tool.name, tool);
+  }
+  own(dispose: () => Promise<void>): void { this.ownedDisposers.push(dispose); }
   readonly commands = new Map<string, ExtensionCommand>();
   readonly tools = new Map<string, ExtensionTool>();
   readonly shortcuts = new Map<string, { description?: string; handler(ctx: ExtensionContext): void | Promise<void> }>();
@@ -160,6 +169,7 @@ export class ExtensionRegistry {
         this.insert(this.commands, name, command, source);
       },
       registerTool: tool => {
+        if (this.builtinTools.has(tool.name)) throw Error(`${tool.name} is owned by the harness`);
         if (!/^[a-zA-Z0-9_-]+$/.test(tool.name) || typeof tool.execute !== "function") throw new Error("Invalid tool definition");
         if (["note", "history", "branch", "resolve", DISCOVERY_TOOL_NAME].includes(tool.name)) throw new Error(`${tool.name} owns the append-only harness and cannot be replaced`);
         if (tool.exposure !== undefined && tool.exposure !== "direct" && tool.exposure !== "deferred") throw new Error("Unknown tool exposure");
@@ -287,6 +297,7 @@ export class ExtensionRegistry {
       access: "write", execution: "exclusive", branch: "none",
       ...(this.integrationTools.has(name) ? { integrationHealth: () => this.integrationTools.get(name)!.observe() } : {}),
       ...(tool.prepareArguments ? { prepareArguments: tool.prepareArguments } : {}),
+      ...(tool.validateInput ? { validateInput: tool.validateInput } : {}),
       run: async (ctx: ToolContext, raw: Record<string, unknown>) => {
         const context = { ...this.active().context(), signal: ctx.signal, tools: this.active().getTools(),
           executeTool: async (target: string, input: unknown) => {
@@ -313,6 +324,7 @@ export class ExtensionRegistry {
       },
     }]));
     if ([...this.tools.values()].some(tool => tool.exposure === "deferred")) definitions.set(DISCOVERY_TOOL_NAME, DISCOVERY_TOOL);
+    for (const [name, tool] of this.builtinTools) definitions.set(name, tool);
     return definitions;
   }
   toolHooks(): NonNullable<ToolContext["extensionHooks"]> {
@@ -328,6 +340,7 @@ export class ExtensionRegistry {
   }
   async dispose(): Promise<void> {
     if (this.disposed) return;
+    for (const dispose of this.ownedDisposers.splice(0)) await dispose();
     await Promise.all([...this.integrations.values()].map(owner => owner.dispose()));
     for (const detach of this.detachListeners) try { detach(); } catch (error) { this.report(String(error)); }
     this.detachListeners.clear(); this.toolUpdateListeners.clear();
@@ -337,16 +350,21 @@ export class ExtensionRegistry {
   }
   /** Q.13: a new generation must not overlap an unresolved callback from its predecessor. */
   async releaseIntegrations(): Promise<boolean> {
+    if ([...this.integrations.values()].some(owner => !owner.canReleaseForReload())) return false;
     const released = await Promise.all([...this.integrations.values()].map(owner => owner.releaseForReload()));
     return released.every(Boolean);
   }
+  restoreIntegrations(): boolean {
+    const restored = [...this.integrations.values()].map(owner => owner.resumeAfterReload());
+    return restored.every(Boolean);
+  }
 }
 
 function extensionSchema(parameters: unknown): ToolDefinition["input_schema"] {
   if (typeof parameters !== "object" || parameters === null) throw new Error("Tool parameters must be an object schema");
   const schema = parameters as Record<string, unknown>;
-  if (schema["type"] !== "object" || typeof schema["properties"] !== "object" || schema["properties"] === null) throw new Error("Tool parameters need object properties");
+  if (schema["type"] !== "object" || schema["properties"] !== undefined && (typeof schema["properties"] !== "object" || schema["properties"] === null || Array.isArray(schema["properties"]))) throw new Error("Tool parameters need an object schema");
   const required = schema["required"] ?? [];
   if (!Array.isArray(required) || required.some(value => typeof value !== "string")) throw new Error("Tool required fields must be names");
-  return { ...schema, type: "object", properties: schema["properties"] as Record<string, unknown>, required: required as string[] };
+  return { ...schema, type: "object", properties: (schema["properties"] ?? {}) as Record<string, unknown>, required: required as string[] };
 }

package/src/runtime/formatter-tool.ts

@@ -0,0 +1,38 @@
+/** Trusted formatter configuration controls commands; model arguments supply only paths. */
+import { planFormatters, runConfiguredFormatters, validateFormatters, type FormatterConfig } from "./formatter.ts";
+import { presentObservation, type ToolDefinition } from "./tools.ts";
+import { failureDiagnostic, failureFromError, NOT_STARTED, UNKNOWN_EFFECT } from "../core/tool-failure.ts";
+import { readEditableFile } from "../store/file-checkpoints.ts";
+
+export function createFormatterTool(configs: readonly FormatterConfig[]): ToolDefinition {
+  const frozen = validateFormatters(configs);
+  return {
+    name: "format", access: "shell", execution: "exclusive", branch: "write",
+    description: "Run explicitly configured trusted formatters for these existing workspace files. Every formatter command goes through the session's normal command admission, logs and checkpoints; no executable is auto-discovered or installed. Returns real command outcomes and resulting file digests. Formatting can change content; read the current file before deriving further edits.",
+    input_schema: { type: "object", required: ["paths"], properties: { paths: { type: "array", minItems: 1, maxItems: 100, items: { type: "string" } } } },
+    run: async (ctx, input) => {
+      if (!ctx.invokeHost) return { ok: false, content: "Formatter requires the session command lifecycle.", diagnostic: failureDiagnostic("environment_missing", "Formatter requires the session command lifecycle.", NOT_STARTED) };
+      let executing = false;
+      try {
+        const paths = input["paths"] as string[], plans = await planFormatters(ctx.root, paths, frozen);
+        if (!plans.length) return { ok: false, content: "No configured formatter matches these file extensions.", diagnostic: failureDiagnostic("environment_missing", "No configured formatter matches these file extensions.", NOT_STARTED) };
+        executing = true;
+        const results = await runConfiguredFormatters(plans, ctx.invokeHost, ctx.signal);
+        if (!results.length) return { ok: false, content: "Formatter cancelled before execution.", diagnostic: failureDiagnostic("cancelled", "Formatter cancelled before execution.", NOT_STARTED) };
+        const files = [];
+        for (const path of [...new Set(results.map(result => result.plan.path))]) {
+          const observed = await readEditableFile(ctx.root, path);
+          files.push({ path, sha256: observed.version?.sha256 ?? null });
+        }
+        const receipts = results.map(({ plan, result }) => `${plan.formatter} ${plan.path}: ${result.ok ? "completed" : "failed"}\n${result.content}`).join("\n\n");
+        const last = results.at(-1)!.result;
+        return { ...await presentObservation(ctx, receipts + "\n\nCurrent file versions:\n" + files.map(file => `${file.path}: ${file.sha256 ?? "absent"}`).join("\n")),
+          ok: results.length === plans.length && results.every(result => result.result.ok), data: { files, commands: results.length },
+          ...(last.outcome === undefined ? {} : { outcome: last.outcome }), ...(last.diagnostic === undefined ? {} : { diagnostic: last.diagnostic }) };
+      } catch (error) {
+        const diagnostic = failureFromError(error, executing ? UNKNOWN_EFFECT : NOT_STARTED);
+        return { ok: false, content: diagnostic.message, diagnostic };
+      }
+    },
+  };
+}

package/src/runtime/formatter.ts

@@ -0,0 +1,50 @@
+/** Explicit trusted formatters use the original command broker, never hidden subprocesses. */
+import { extname, resolve } from "node:path";
+import { readEditableFile } from "../store/file-checkpoints.ts";
+import type { NativeCommandInput, ToolResult } from "./tools.ts";
+export interface FormatterConfig { name: string; extensions: readonly string[]; command: readonly string[]; disabled?: boolean }
+export interface FormatterPlan { formatter: string; path: string; input: NativeCommandInput }
+
+export function validateFormatters(value: unknown): FormatterConfig[] {
+  if (!Array.isArray(value)) throw new Error("formatters must be an array of trusted command definitions");
+  const names = new Set<string>();
+  return value.map((entry: unknown) => {
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) throw new Error("formatter must be an object");
+    const config = entry as Record<string, unknown>, name = config["name"], extensions = config["extensions"], command = config["command"], disabled = config["disabled"];
+    if (Object.keys(config).some(key => !["name", "extensions", "command", "disabled"].includes(key))) throw new Error("unknown formatter configuration field");
+    if (typeof name !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(name) || names.has(name)) throw new Error("formatter names must be unique stable identifiers");
+    if (!Array.isArray(extensions) || !extensions.length || !extensions.every(extension => typeof extension === "string" && (extension === "*" || /^\.[A-Za-z0-9]+$/.test(extension)))) throw new Error("formatter extensions must contain dotted extensions or *");
+    if (!Array.isArray(command) || !command.length || !command.every(argument => typeof argument === "string" && !argument.includes("\0")) || !command[0]?.trim() || !command.some(argument => argument.includes("$FILE"))) throw new Error("formatter command must be literal argv containing $FILE");
+    if (disabled !== undefined && typeof disabled !== "boolean") throw new Error("formatter disabled must be boolean");
+    names.add(name);
+    return { name, extensions: extensions as string[], command: command as string[], ...(disabled === undefined ? {} : { disabled }) };
+  });
+}
+
+/** Absolute filename substitution prevents option and shell parsing of model paths. */
+export async function planFormatters(root: string, paths: readonly string[], configs: readonly FormatterConfig[]): Promise<FormatterPlan[]> {
+  const definitions = validateFormatters(configs), plans: FormatterPlan[] = [];
+  const known = new Set<string>();
+  for (const path of paths) {
+    const absolute = resolve(root, path);
+    if (known.has(absolute)) continue;
+    known.add(absolute);
+    const source = await readEditableFile(root, path);
+    if (source.version === null) throw new Error(`formatter target is missing: ${path}`);
+    for (const config of definitions) if (!config.disabled && (config.extensions.includes("*") || config.extensions.includes(extname(absolute))))
+      plans.push({ formatter: config.name, path, input: { argv: config.command.map(argument => argument.replaceAll("$FILE", absolute)), cwd: root } });
+  }
+  return plans;
+}
+
+/** Every command returns its real receipt; stop after failure or cancellation. */
+export async function runConfiguredFormatters(plans: readonly FormatterPlan[], invokeHost: (input: NativeCommandInput, signal?: AbortSignal) => Promise<ToolResult>, signal?: AbortSignal): Promise<{ plan: FormatterPlan; result: ToolResult }[]> {
+  const results: { plan: FormatterPlan; result: ToolResult }[] = [];
+  for (const plan of plans) {
+    if (signal?.aborted) break;
+    const result = await invokeHost(plan.input, signal);
+    results.push({ plan, result });
+    if (!result.ok || result.outcome?.status === "stopped") break;
+  }
+  return results;
+}

package/src/runtime/foundation.ts

@@ -0,0 +1,78 @@
+/** Foundations use the existing catalog, broker, permission and checkpoint owners. */
+import { parsePermissionRule, type PermissionRule } from "../core/permissions.ts";
+import { parsePatch, patchPaths } from "../core/patch.ts";
+import { parseWebSearchConfig } from "../core/web-content.ts";
+import { lastTurnChanges } from "../core/review.ts";
+import { discoverTargetInstructions, renderTargetInstructions } from "../store/context-files.ts";
+import { createPatchTool } from "./patch-tool.ts";
+import { createDiffTool } from "./review-tool.ts";
+import { createQuestionTool, type QuestionSlot } from "./question-tool.ts";
+import { createWebFetchTool, createWebSearchTool } from "./web-tools.ts";
+import { LspManager, parseLspConfig } from "./lsp-client.ts";
+import { validateFormatters } from "./formatter.ts";
+import { createFormatterTool } from "./formatter-tool.ts";
+import { permissionResourceAction } from "./permission-resources.ts";
+import type { ToolContext, ToolDefinition, ToolResult } from "./tools.ts";
+import { McpManager } from "./mcp-client.ts";
+import { parseMcpServers } from "../core/mcp-config.ts";
+import type { ExtensionRegistry } from "./extensions.ts";
+import { join } from "node:path";
+import { getBlob } from "../store/blobs.ts";
+
+export class FoundationRuntime {
+  readonly questionSlot: QuestionSlot;
+  readonly mcp: McpManager;
+  readonly tools: ToolDefinition[];
+  readonly permissions: PermissionRule[];
+  private readonly lsp: LspManager;
+  constructor(workspace: string, config: Record<string, unknown>, offline: boolean, configDirectory: string, questionSlot: QuestionSlot = {}) {
+    this.questionSlot = questionSlot;
+    const servers = Object.fromEntries(Object.entries(parseMcpServers(config["mcp"])).map(([name, server]) => [name, offline && server.transport === "http" ? { ...server, enabled: false } : server]));
+    this.mcp = new McpManager(servers, { cwd: workspace, credentialsDirectory: join(configDirectory, "mcp-credentials") });
+    if (config["permissions"] !== undefined && !Array.isArray(config["permissions"])) throw Error("permissions must be an array");
+    this.permissions = Array.isArray(config["permissions"]) ? config["permissions"].map(parsePermissionRule) : [];
+    const lsp = parseLspConfig(config["lsp"]); this.lsp = new LspManager(workspace, lsp);
+    const formatters = config["formatters"] === undefined ? [] : validateFormatters(config["formatters"]);
+    const search = parseWebSearchConfig(config["webSearch"]);
+    const network = [createWebFetchTool(), createWebSearchTool(search)];
+    if (offline) for (const tool of network) tool.run = async () => ({ ok: false, content: "Network tools are unavailable in offline mode." });
+    this.tools = [createQuestionTool(this.questionSlot), createPatchTool(), createDiffTool({ lastTurn: async ctx => {
+      if (!ctx.historyEvents || !ctx.checkpointBlobs) throw Error("original checkpoint history is unavailable");
+      return { blobs: ctx.checkpointBlobs, ...lastTurnChanges(await ctx.historyEvents()) };
+    }, canRead: async (ctx, path) => await permissionResourceAction(ctx.root, path, ctx.rules ?? [], ctx.sessionRules ?? [], "diff") === "allow" }), ...network, ...(lsp.length ? [this.lsp.tool()] : [])];
+    this.tools.push({ ...createFormatterTool(formatters), branch: "none" });
+  }
+  async register(registry: ExtensionRegistry): Promise<void> {
+    for (const tool of this.tools) registry.installBuiltin(tool);
+    const discovered = await this.mcp.discover();
+    for (const integration of discovered.integrations) registry.api("xeno-mcp").registerIntegration(integration);
+  }
+  async instructions(ctx: ToolContext, name: string, input: unknown, noContextFiles: boolean): Promise<ToolResult | null> {
+    if (noContextFiles || !["read", "write", "edit", "apply_patch", "query", "format", "lsp"].includes(name) || !input || typeof input !== "object") return null;
+    const args = input as Record<string, unknown>;
+    const paths = name === "apply_patch" ? patchPaths(parsePatch(String(args["patchText"]))) : typeof args["path"] === "string" ? [args["path"]] : Array.isArray(args["paths"]) ? args["paths"].filter((path): path is string => typeof path === "string") : [];
+    if (!paths.length) return null;
+    const known = new Set<string>();
+    for (const event of await ctx.historyEvents?.() ?? []) {
+      if (event.t !== "tool_result") continue;
+      let data: unknown = event.data;
+      if (event.data_ref && ctx.outputStore) {
+        const saved = await getBlob(ctx.outputStore, event.data_ref.sha256);
+        if (saved) data = JSON.parse(saved) as unknown;
+      }
+      if (!data || typeof data !== "object" || Array.isArray(data)) continue;
+      const receipt = data as Record<string, unknown>;
+      if (receipt["kind"] !== "scoped_instructions") continue;
+      const keys = receipt["keys"]; if (Array.isArray(keys)) for (const key of keys) if (typeof key === "string") known.add(key);
+    }
+    const found = await discoverTargetInstructions({ workspace: ctx.root, paths, known,
+      canRead: async path => await permissionResourceAction(ctx.root, path, ctx.rules ?? [], ctx.sessionRules ?? []) === "allow" });
+    if (found.notices.some(notice => notice.kind === "skipped" && notice.reason === "instruction read permission is unavailable")) return { ok: false, content: "Scoped instructions require read permission before this operation." };
+    const files = found.files.filter(file => !ctx.frozenSystem?.().includes(file.content));
+    if (!files.length) return null;
+    for (const file of files) if (await permissionResourceAction(ctx.root, file.path, ctx.rules ?? [], ctx.sessionRules ?? []) !== "allow") return { ok: false, content: "Scoped instructions require read permission before this operation." };
+    return { ok: false, content: "Scoped instructions were discovered. Read and follow them before deciding whether to retry the original operation. No original operation was executed.\n\n" + renderTargetInstructions(files),
+      data: { kind: "scoped_instructions", keys: files.map(file => file.key), files: files.map(file => ({ path: file.path, scope: file.scope, key: file.key, content: file.content, truncated: file.truncated })) } };
+  }
+  async dispose(): Promise<void> { await Promise.all([this.lsp.dispose(), this.mcp.dispose()]); }
+}

package/src/runtime/integrations.ts

@@ -55,7 +55,7 @@ export class LazyIntegration {
   private busy = false;
   private phase: "idle" | "connect" | "call" | "repair" = "idle";
   private disposed = false;
-  private readonly lifetime = new AbortController();
+  private lifetime = new AbortController();
   private readonly pending = new Set<Promise<unknown>>();
   private readonly closed = new WeakSet<IntegrationConnection>();
   private cleanup: "none" | "pending" | "complete" | "failed" = "none";
@@ -199,7 +199,7 @@ export class LazyIntegration {
     // No promise can kill trusted in-process code. Pending ownership remains visible until it settles.
   }
   async releaseForReload(): Promise<boolean> {
-    if (this.busy || this.pending.size || this.cleanup === "failed") return false;
+    if (!this.canReleaseForReload()) return false;
     this.disposed = true; this.lifetime.abort();
     const closing = this.retire(this.handle);
     let timer: ReturnType<typeof setTimeout> | undefined;
@@ -207,4 +207,10 @@ export class LazyIntegration {
     clearTimeout(timer);
     return this.pending.size === 0 && this.observe().cleanup !== "failed";
   }
+  canReleaseForReload(): boolean { return !this.busy && this.pending.size === 0 && this.cleanup !== "failed"; }
+  /** Re-enable explicit future invocations after an abandoned staged reload. No operation is replayed. */
+  resumeAfterReload(): boolean {
+    if (!this.canReleaseForReload()) return false;
+    this.disposed = false; this.lifetime = new AbortController(); return true;
+  }
 }

package/src/runtime/loop.ts

@@ -187,6 +187,12 @@ export const DEFAULT_BRANCH_LIMITS: BranchLimits = {
 };
 
 export interface SessionConfig {
+  /** Runtime-only output contract, explicitly selected by the current caller. */
+  validateOutput?: (text: string) => { ok: boolean; error?: string };
+  /** Persist a selector, never persisted profile code or authorization (D6/D13). */
+  agentProfile?: { name: string; workflowExplicit: boolean };
+  /** An explicit mode command's capability default, independent of role authority. */
+  workflowToolProfile?: "foundation";
   /** P.3: legacy full snapshots are an explicit compatibility mode, never the CLI default. */
   workspaceTracking?: "journal" | "legacy";
   shellCheckpoints?: boolean;
@@ -330,7 +336,7 @@ export type RewindResult =
   | { ok: false; error: string };
 
 /** O.5: child execution returns facts; only the parent coordinator accepts them. */
-type DeferredToolResult = ToolResult & { accept?: () => Promise<LoopEvent[]>; annotation?: LogEvent };
+type DeferredToolResult = ToolResult & { accept?: () => Promise<LoopEvent[]>; annotation?: LogEvent; finalText?: string };
 type ToolCall = Extract<AssistantBlock, { type: "tool_use" }>;
 type SessionBrokerReceipt = BrokerReceipt<DeferredToolResult> & { events: LoopEvent[] };
 type PreparedBrokerCall = { run(emit?: (event: LoopEvent) => void): Promise<SessionBrokerReceipt> };
@@ -384,6 +390,13 @@ export class Session {
     // Branch capability sets are owned by branchTools; a parent's optional catalog is not a grant.
     if ((config.branchDepth ?? 0) > 0) delete this.config.tools.deferredTools;
     this.config.tools.outputStore ??= join(config.logDir, "artifacts");
+    this.config.tools.historyEvents = async () => {
+      const history = await readNodeHistory(this.config.logDir, this.state.node, undefined, "context");
+      if (!history.ok) throw Error(history.error);
+      return history.nodes.flatMap(node => node.node === this.state.node ? structuredClone(this.state.events) : node.events);
+    };
+    if (config.blobDir) this.config.tools.checkpointBlobs = config.blobDir;
+    this.config.tools.frozenSystem = () => this.config.frozen.system;
     // R4 / D8: full ancestry, not the bounded model view or a second mutable ledger.
     // Each child Session installs its own callback even when contexts are copied.
     this.config.tools.observedFileVersion = async absolute => {
@@ -492,7 +505,16 @@ export class Session {
         if (plan.cursor.context_ref) {
           const saved = await getBlob(join(dir, "artifacts"), plan.cursor.context_ref);
           if (saved === null) throw new Error("missing frozen session context");
-          const context = JSON.parse(saved) as { skills?: Skill[]; acceptanceContract?: AcceptanceContract; strictVerification?: boolean; workingSet?: boolean; workingSetVersion?: 1 | 2; guidanceVersion?: 1; projectionVersion?: number; frozen: FrozenPrefix; boundary?: Partial<BoundaryConfig>; contextPolicy?: unknown; stallLimit?: number; outputRecoveryLimit?: number; guidance?: boolean; gates: Record<string, string>; snapshotIgnore?: readonly string[]; workspaceTracking?: "journal" | "legacy"; shellCheckpoints?: boolean; workNamespace?: string; maxParallelTools?: number };
+          const context = JSON.parse(saved) as { agentProfile?: { name: string; workflowExplicit: boolean }; workflowMode?: "build" | "plan"; skills?: Skill[]; acceptanceContract?: AcceptanceContract; strictVerification?: boolean; workingSet?: boolean; workingSetVersion?: 1 | 2; guidanceVersion?: 1; projectionVersion?: number; frozen: FrozenPrefix; boundary?: Partial<BoundaryConfig>; contextPolicy?: unknown; stallLimit?: number; outputRecoveryLimit?: number; guidance?: boolean; gates: Record<string, string>; snapshotIgnore?: readonly string[]; workspaceTracking?: "journal" | "legacy"; shellCheckpoints?: boolean; workNamespace?: string; maxParallelTools?: number };
+          if (context.agentProfile !== undefined) {
+            if (!context.agentProfile || typeof context.agentProfile.name !== "string" || !/^[a-z][a-z0-9_-]{0,63}$/.test(context.agentProfile.name) || typeof context.agentProfile.workflowExplicit !== "boolean") throw Error("unsupported saved agent profile selector");
+            this.config.agentProfile = { ...context.agentProfile };
+          }
+          if (context.workflowMode !== undefined) { if (!["build", "plan"].includes(context.workflowMode)) throw Error("unsupported saved workflow mode"); this.config.tools.workflowMode = context.workflowMode; }
+          if ("workflowToolProfile" in context && context.workflowToolProfile !== undefined) {
+            if (context.workflowToolProfile !== "foundation") throw Error("unsupported saved workflow tool profile");
+            this.config.workflowToolProfile = "foundation";
+          }
           if (context.projectionVersion !== undefined && context.projectionVersion !== PROJECTION_VERSION) throw new Error("unsupported saved projection version");
           this.config.workingSet = context.workingSet === true;
           if (context.workingSetVersion !== undefined && ![1, 2].includes(context.workingSetVersion)) throw new Error("unsupported saved working-set version");
@@ -760,12 +782,18 @@ export class Session {
   }
 
   /** D6: changing the frozen prefix is an explicit checkpoint, never in-place prompt surgery. */
-  async reloadResources(frozen: FrozenPrefix, skills = this.config.skills): Promise<boolean> {
-    if (JSON.stringify(frozen) === JSON.stringify(this.config.frozen) && JSON.stringify(skills) === JSON.stringify(this.config.skills)) return false;
+  assertResourceIdle(): void {
     if (this.running || this.isHalfRound()) throw new Error("cannot reload resources while a turn is active or a tool call is unpaired");
+  }
+
+  async reloadResources(frozen: FrozenPrefix, skills = this.config.skills, nextProvider?: Provider, forceCheckpoint = false): Promise<boolean> {
+    if (!nextProvider && !forceCheckpoint && JSON.stringify(frozen) === JSON.stringify(this.config.frozen) && JSON.stringify(skills) === JSON.stringify(this.config.skills)) return false;
+    this.assertResourceIdle();
     const contextRef = await this.persistContext(frozen, skills);
-    await this.performCut("model_checkpoint", this.provider.config.spec.id, undefined,
-      this.provider.config.spec.provider, this.provider.config.effort, contextRef);
+    const provider = nextProvider ?? this.provider;
+    await this.performCut("model_checkpoint", provider.config.spec.id, undefined,
+      provider.config.spec.provider, provider.config.effort, contextRef);
+    this.provider = provider;
     this.config.frozen = frozen;
     if (skills !== undefined) this.config.skills = skills;
     this.installSkillResources();
@@ -850,6 +878,9 @@ export class Session {
       ...(this.config.workingSet && this.config.workingSetVersion === 2 ? { workingSetVersion: 2 } : {}),
       ...(this.config.guidanceVersion === 1 ? { guidanceVersion: 1 } : {}),
       frozen, gates: this.config.tools.gates,
+      ...(this.config.tools.workflowMode ? { workflowMode: this.config.tools.workflowMode } : {}),
+      ...(this.config.agentProfile ? { agentProfile: this.config.agentProfile } : {}),
+      ...(this.config.workflowToolProfile ? { workflowToolProfile: this.config.workflowToolProfile } : {}),
       workNamespace: this.config.workNamespace ?? "main",
       maxParallelTools: this.config.maxParallelTools ?? 3,
       ...(this.config.boundary ? { boundary: this.config.boundary } : {}),
@@ -953,13 +984,31 @@ export class Session {
         await result.accept?.();
         await this.record({ t: "extension", id: this.clock.nextId(), at: this.clock.now(), customType: "skill_result", content: result.content,
           display: true, inContext: true });
+        // Evidence stays in the receipt; structured output validates the child's
+        // actual final message, never the human-readable receipt wrapper (D11).
+        const finalText = this.config.validateOutput ? result.finalText ?? "" : result.content;
+        let outcome = result.outcome ?? executionOutcome("execution_error"), reason = "isolated skill finished";
+        if (outcome.status === "completed") {
+          const error = await this.validateFinalOutput(finalText);
+          if (error !== undefined) { outcome = executionOutcome("execution_error"); reason = error; }
+        }
+        await this.record({ t: "outcome", id: this.clock.nextId(), at: this.clock.now(), reason, outcome });
         await this.saveCursor();
-        yield { kind: "assistant_text", text: result.content };
-        yield { kind: "done", outcome: result.outcome ?? executionOutcome("execution_error"), reason: "isolated skill finished" };
+        yield { kind: "assistant_text", text: finalText };
+        yield { kind: "done", outcome, reason };
       } finally { owned.finish(); }
     } finally { this.config.tools = savedTools; this.restoreDeclaredTools(); }
   }
 
+  /** Every final publication path records the same validator receipt (D11). */
+  private async validateFinalOutput(text: string): Promise<string | undefined> {
+    if (!this.config.validateOutput) return undefined;
+    const validation = this.config.validateOutput(text);
+    await this.appendExtension({ customType: "output_validation", content: validation.ok ? "Final JSON output passed the selected schema." : `Final JSON output failed: ${validation.error ?? "schema mismatch"}`,
+      display: false, inContext: false, data: { valid: validation.ok } });
+    return validation.ok ? undefined : `output schema validation failed: ${validation.error ?? "schema mismatch"}`;
+  }
+
   /** O.8: dispatch and diagnostics share exact source hints, including forks. */
   contextInput(): ProjectInput {
     return { frozen: this.config.frozen, handoff: this.state.handoff, events: this.state.events,
@@ -1427,6 +1476,12 @@ export class Session {
             continue;
           }
           const stopped = yield* this.maybeCut(counter, false);
+          if (!stopped) {
+            const error = await this.validateFinalOutput(result.blocks.filter(block => block.type === "text").map(block => block.text).join("\n"));
+            if (error !== undefined) {
+              yield { kind: "done", reason: error, outcome: executionOutcome("execution_error") }; return;
+            }
+          }
           yield {
             kind: "done",
             reason: stopped ? "stopped: no verifiable progress" : result.stopReason ?? "end_turn",
@@ -2021,14 +2076,15 @@ export class Session {
     this.children.set(node, branch);
     yield { kind: "branch_start", node, reason: purpose, at: Date.now() };
 
-    let text = "";
+    let finalParts: string[] = [];
     let outcome = executionOutcome("unknown");
     try {
       for await (const event of branch.snapshotTurn([], true)) {
         if (event.kind === "snapshot_failed") throw new Error(`cannot establish branch baseline: ${event.reason}`);
       }
       for await (const e of branch.send(prompt, signal)) {
-        if (e.kind === "assistant_text" && e.text) text = e.text;
+        if (e.kind === "turn_start" || e.kind === "discard") finalParts = [];
+        if (e.kind === "assistant_text") finalParts.push(e.text ?? "");
         if (e.kind === "done") outcome = e.outcome ?? executionOutcome("unknown");
       }
     } catch {
@@ -2055,6 +2111,7 @@ export class Session {
       ? `\n\nIts changes are in ${worktree.path} on branch ${worktree.branch}, ` +
         "not in your files. Adopting continues in that checkout without merging it into this one."
       : "";
+    const text = finalParts.join("\n");
     const summary = text.trim() || "(the branch produced no closing message)";
     const receiptHistory = await readNodeHistory(this.config.logDir, tip, undefined, "context");
     if (!receiptHistory.ok) throw new Error(receiptHistory.error);
@@ -2081,6 +2138,7 @@ export class Session {
         (this.adviceNames().includes("resolve") ? `Resolve it with resolve(node: ${node}, ...).` : "Branch-resolution capability unavailable."),
       ok: outcome.status === "completed",
       outcome,
+      finalText: text,
       accept: async () => {
         if ((await this.branchStatuses()).some(item => item.node === node && item.handoff_ref)) return [];
         this.state.usage.push(...branch.state.usage);