@xemahq/kernel-contracts 0.3.4 → 0.3.6

package/dist/agent-composition/index.d.ts

@@ -3,5 +3,6 @@ export * from './lib/composition';
 export * from './lib/composition-limits-schema';
 export * from './lib/composition-workspace';
 export * from './lib/intrinsic-floor';
+export * from './lib/invocation-overlay';
 export * from './lib/model-resolution-matrix';
 //# sourceMappingURL=index.d.ts.map

package/dist/agent-composition/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agent-composition/index.ts"],"names":[],"mappings":"AAWA,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,+BAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agent-composition/index.ts"],"names":[],"mappings":"AAWA,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC"}

package/dist/agent-composition/index.js

@@ -19,5 +19,6 @@ __exportStar(require("./lib/composition"), exports);
 __exportStar(require("./lib/composition-limits-schema"), exports);
 __exportStar(require("./lib/composition-workspace"), exports);
 __exportStar(require("./lib/intrinsic-floor"), exports);
+__exportStar(require("./lib/invocation-overlay"), exports);
 __exportStar(require("./lib/model-resolution-matrix"), exports);
 //# sourceMappingURL=index.js.map

package/dist/agent-composition/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agent-composition/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAWA,yDAAuC;AACvC,oDAAkC;AAClC,kEAAgD;AAChD,8DAA4C;AAC5C,wDAAsC;AACtC,gEAA8C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agent-composition/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAWA,yDAAuC;AACvC,oDAAkC;AAClC,kEAAgD;AAChD,8DAA4C;AAC5C,wDAAsC;AACtC,2DAAyC;AACzC,gEAA8C"}

package/dist/agent-composition/lib/composition.d.ts

@@ -1,5 +1,5 @@
 import type { ToolSelectionEntry } from '../../mcp-tool';
-import type { ModelRef } from '../../workflow';
+import type { NodeOverlayFragment } from '../../workflow';
 import type { SkillRef } from '../../skill';
 import type { CapabilityLayer } from './capability-layer';
 import type { CompositionWorkspace } from './composition-workspace';
@@ -25,13 +25,11 @@ export interface CompositionLimits {
     readonly maxSpawns: number;
     readonly tokenBudget?: number | undefined;
 }
-export interface CompositionNode {
+export interface CompositionNode extends NodeOverlayFragment {
     readonly agent: AgentRef;
     readonly alias?: string;
     readonly skills: readonly SkillRef[];
     readonly tools: readonly ToolSelectionEntry[];
-    readonly modelOverride?: ModelRef;
-    readonly instructions?: string;
     readonly children: readonly CompositionNode[];
     readonly limits?: CompositionLimits;
 }
@@ -46,13 +44,11 @@ export interface Composition {
     readonly capability?: CapabilityLayer;
     readonly workspace?: CompositionWorkspace;
 }
-export interface ResolvedCompositionNode {
+export interface ResolvedCompositionNode extends NodeOverlayFragment {
     readonly agent: Required<AgentRef>;
     readonly alias?: string;
     readonly skills: readonly SkillRef[];
     readonly tools: readonly ToolSelectionEntry[];
-    readonly modelOverride?: ModelRef;
-    readonly instructions?: string;
     readonly children: readonly ResolvedCompositionNode[];
     readonly limits?: CompositionLimits;
 }

package/dist/agent-composition/lib/composition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"composition.d.ts","sourceRoot":"","sources":["../../../src/agent-composition/lib/composition.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAKpE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAOD,oBAAY,gBAAgB;IAC1B,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAQD,oBAAY,oBAAoB;IAC9B,KAAK,UAAU;IACf,SAAS,cAAc;IACvB,QAAQ,aAAa;CACtB;AAwBD,MAAM,WAAW,iBAAiB;IAEhC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAQ3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AASD,MAAM,WAAW,eAAe;IAE9B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAEzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAErC,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAK9C,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC;IAalC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;IAQ9C,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACrC;AAKD,MAAM,WAAW,WAAW;IAE1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IAEzC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAE/B,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC;IAStC,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAC3C;AAWD,MAAM,WAAW,uBAAuB;IAEtC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAErC,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAE9C,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC;IAOlC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,QAAQ,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAQtD,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACrC;AAMD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IAEjC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IAEvC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IAOrC,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAC3C"}
+{"version":3,"file":"composition.d.ts","sourceRoot":"","sources":["../../../src/agent-composition/lib/composition.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAKpE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAOD,oBAAY,gBAAgB;IAC1B,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAQD,oBAAY,oBAAoB;IAC9B,KAAK,UAAU;IACf,SAAS,cAAc;IACvB,QAAQ,aAAa;CACtB;AAwBD,MAAM,WAAW,iBAAiB;IAEhC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAQ3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AASD,MAAM,WAAW,eAAgB,SAAQ,mBAAmB;IAE1D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAEzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAErC,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAM9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;IAQ9C,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACrC;AAKD,MAAM,WAAW,WAAW;IAE1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IAEzC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAE/B,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC;IAStC,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAC3C;AAWD,MAAM,WAAW,uBAAwB,SAAQ,mBAAmB;IAElE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAErC,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAM9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAQtD,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACrC;AAMD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IAEjC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IAEvC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IAOrC,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAC3C"}

package/dist/agent-composition/lib/invocation-overlay.d.ts

@@ -0,0 +1,17 @@
+import type { ToolSelectionEntry } from '../../mcp-tool';
+import type { SkillRef } from '../../skill';
+import type { NodeOverlayFragment } from '../../workflow';
+export interface InvocationToolOverlay {
+    readonly add?: readonly ToolSelectionEntry[];
+    readonly remove?: readonly string[];
+}
+export interface InvocationSkillOverlay {
+    readonly add?: readonly SkillRef[];
+}
+export interface InvocationOverlay extends NodeOverlayFragment {
+    readonly tools?: InvocationToolOverlay;
+    readonly skills?: InvocationSkillOverlay;
+}
+export type AgentStepWithOverlay = InvocationOverlay;
+export type SessionInvocationOverlay = InvocationOverlay;
+//# sourceMappingURL=invocation-overlay.d.ts.map

package/dist/agent-composition/lib/invocation-overlay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invocation-overlay.d.ts","sourceRoot":"","sources":["../../../src/agent-composition/lib/invocation-overlay.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAQ1D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAE7C,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAQD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;CACpC;AAOD,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC;CAC1C;AAQD,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAOrD,MAAM,MAAM,wBAAwB,GAAG,iBAAiB,CAAC"}

package/dist/agent-composition/lib/invocation-overlay.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=invocation-overlay.js.map

package/dist/agent-composition/lib/invocation-overlay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invocation-overlay.js","sourceRoot":"","sources":["../../../src/agent-composition/lib/invocation-overlay.ts"],"names":[],"mappings":""}

package/dist/agent-permission/index.d.ts

@@ -0,0 +1,2 @@
+export * from './lib/permission-map';
+//# sourceMappingURL=index.d.ts.map

package/dist/agent-permission/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agent-permission/index.ts"],"names":[],"mappings":"AAWA,cAAc,sBAAsB,CAAC"}

package/dist/agent-permission/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/permission-map"), exports);
+//# sourceMappingURL=index.js.map

package/dist/agent-permission/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agent-permission/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAWA,uDAAqC"}

package/dist/agent-permission/lib/permission-map.d.ts

@@ -0,0 +1,6 @@
+export declare const KNOWN_PERMISSION_KEYS: readonly ["read", "edit", "glob", "grep", "list", "bash", "task", "external_directory", "lsp", "skill", "todowrite", "question", "webfetch", "websearch", "doom_loop"];
+export type PermissionKey = (typeof KNOWN_PERMISSION_KEYS)[number];
+export type PermissionAction = 'allow' | 'ask' | 'deny';
+export type PermissionRule = PermissionAction | Readonly<Record<string, PermissionAction>>;
+export type PermissionMap = Readonly<Record<string, PermissionRule>>;
+//# sourceMappingURL=permission-map.d.ts.map

package/dist/agent-permission/lib/permission-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-map.d.ts","sourceRoot":"","sources":["../../../src/agent-permission/lib/permission-map.ts"],"names":[],"mappings":"AA8CA,eAAO,MAAM,qBAAqB,wKAGxB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AASxD,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAQ3F,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC"}

package/dist/agent-permission/lib/permission-map.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KNOWN_PERMISSION_KEYS = void 0;
+const KNOWN_RULE_PERMISSION_KEYS = [
+    'read',
+    'edit',
+    'glob',
+    'grep',
+    'list',
+    'bash',
+    'task',
+    'external_directory',
+    'lsp',
+    'skill',
+];
+const KNOWN_ACTION_PERMISSION_KEYS = [
+    'todowrite',
+    'question',
+    'webfetch',
+    'websearch',
+    'doom_loop',
+];
+exports.KNOWN_PERMISSION_KEYS = [
+    ...KNOWN_RULE_PERMISSION_KEYS,
+    ...KNOWN_ACTION_PERMISSION_KEYS,
+];
+//# sourceMappingURL=permission-map.js.map

package/dist/agent-permission/lib/permission-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-map.js","sourceRoot":"","sources":["../../../src/agent-permission/lib/permission-map.ts"],"names":[],"mappings":";;;AAqBA,MAAM,0BAA0B,GAAG;IACjC,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,oBAAoB;IACpB,KAAK;IACL,OAAO;CACC,CAAC;AAMX,MAAM,4BAA4B,GAAG;IACnC,WAAW;IACX,UAAU;IACV,UAAU;IACV,WAAW;IACX,WAAW;CACH,CAAC;AAEE,QAAA,qBAAqB,GAAG;IACnC,GAAG,0BAA0B;IAC7B,GAAG,4BAA4B;CACvB,CAAC"}

package/dist/agent-workspace/awp-spec.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://xema.dev/schemas/awp-spec.v1.json",
-  "emittedAt": "2026-06-12T00:05:53.686Z",
+  "emittedAt": "2026-06-12T12:44:29.614Z",
   "spec": {
     "id": "awp/v1",
     "version": "1.2.0",

package/dist/agent-workspace/lib/agent-tool-defaults.d.ts

@@ -1,8 +1,5 @@
-export declare const KNOWN_PERMISSION_KEYS: readonly ["read", "edit", "glob", "grep", "list", "bash", "task", "external_directory", "lsp", "skill", "todowrite", "question", "webfetch", "websearch", "doom_loop"];
-export type PermissionKey = (typeof KNOWN_PERMISSION_KEYS)[number];
-export type PermissionAction = 'allow' | 'ask' | 'deny';
-export type PermissionRule = PermissionAction | Readonly<Record<string, PermissionAction>>;
-export type PermissionMap = Readonly<Record<string, PermissionRule>>;
+import type { PermissionAction, PermissionKey, PermissionMap, PermissionRule } from '../../agent-permission';
+export { KNOWN_PERMISSION_KEYS, type PermissionAction, type PermissionKey, type PermissionMap, type PermissionRule, } from '../../agent-permission';
 export declare const SYSTEM_REQUIRED_PERMISSIONS: Readonly<Partial<Record<PermissionKey, PermissionAction>>>;
 export declare const SYSTEM_DEFAULT_PERMISSIONS: Readonly<Partial<Record<PermissionKey, PermissionAction>>>;
 export declare const SYSTEM_OPT_IN_PERMISSIONS: Readonly<Partial<Record<PermissionKey, PermissionAction>>>;

package/dist/agent-workspace/lib/agent-tool-defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-tool-defaults.d.ts","sourceRoot":"","sources":["../../../src/agent-workspace/lib/agent-tool-defaults.ts"],"names":[],"mappings":"AA8DA,eAAO,MAAM,qBAAqB,wKAGxB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AASxD,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAQ3F,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;AAOrE,eAAO,MAAM,2BAA2B,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAMlG,CAAC;AAOF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAKjG,CAAC;AAUF,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAOhG,CAAC;AAMF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;CACrC;AAQD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;CAC/D;AAmBD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,0BAA0B,GAAG,SAAS,GAC/C,wBAAwB,CAiB1B;AAiCD,wBAAgB,iCAAiC,CAC/C,WAAW,EAAE,0BAA0B,GAAG,SAAS,GAClD,IAAI,CAsBN;AAED,qBAAa,+BAAgC,SAAQ,KAAK;IAGtD,QAAQ,CAAC,yBAAyB,EAAE,aAAa,CAAC,aAAa,CAAC;gBADhE,OAAO,EAAE,MAAM,EACN,yBAAyB,EAAE,aAAa,CAAC,aAAa,CAAC;CAKnE"}
+{"version":3,"file":"agent-tool-defaults.d.ts","sourceRoot":"","sources":["../../../src/agent-workspace/lib/agent-tool-defaults.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EACV,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,cAAc,EACf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,wBAAwB,CAAC;AAOhC,eAAO,MAAM,2BAA2B,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAMlG,CAAC;AAOF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAKjG,CAAC;AAUF,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAOhG,CAAC;AAMF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;CACrC;AAQD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;CAC/D;AAmBD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,0BAA0B,GAAG,SAAS,GAC/C,wBAAwB,CAiB1B;AAiCD,wBAAgB,iCAAiC,CAC/C,WAAW,EAAE,0BAA0B,GAAG,SAAS,GAClD,IAAI,CAsBN;AAED,qBAAa,+BAAgC,SAAQ,KAAK;IAGtD,QAAQ,CAAC,yBAAyB,EAAE,aAAa,CAAC,aAAa,CAAC;gBADhE,OAAO,EAAE,MAAM,EACN,yBAAyB,EAAE,aAAa,CAAC,aAAa,CAAC;CAKnE"}

package/dist/agent-workspace/lib/agent-tool-defaults.js

@@ -3,29 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AgentPermissionsValidationError = exports.SYSTEM_OPT_IN_PERMISSIONS = exports.SYSTEM_DEFAULT_PERMISSIONS = exports.SYSTEM_REQUIRED_PERMISSIONS = exports.KNOWN_PERMISSION_KEYS = void 0;
 exports.resolveAgentPermissions = resolveAgentPermissions;
 exports.assertNoRequiredPermissionsDenied = assertNoRequiredPermissionsDenied;
-const KNOWN_RULE_PERMISSION_KEYS = [
-    'read',
-    'edit',
-    'glob',
-    'grep',
-    'list',
-    'bash',
-    'task',
-    'external_directory',
-    'lsp',
-    'skill',
-];
-const KNOWN_ACTION_PERMISSION_KEYS = [
-    'todowrite',
-    'question',
-    'webfetch',
-    'websearch',
-    'doom_loop',
-];
-exports.KNOWN_PERMISSION_KEYS = [
-    ...KNOWN_RULE_PERMISSION_KEYS,
-    ...KNOWN_ACTION_PERMISSION_KEYS,
-];
+const agent_permission_1 = require("../../agent-permission");
+var agent_permission_2 = require("../../agent-permission");
+Object.defineProperty(exports, "KNOWN_PERMISSION_KEYS", { enumerable: true, get: function () { return agent_permission_2.KNOWN_PERMISSION_KEYS; } });
 exports.SYSTEM_REQUIRED_PERMISSIONS = {
     read: 'allow',
     list: 'allow',
@@ -49,7 +29,7 @@ exports.SYSTEM_OPT_IN_PERMISSIONS = {
 };
 function resolveAgentPermissions(manifest) {
     const out = {};
-    for (const key of exports.KNOWN_PERMISSION_KEYS) {
+    for (const key of agent_permission_1.KNOWN_PERMISSION_KEYS) {
         out[key] = resolveClosedSetPermission(key, manifest?.permission?.[key]);
     }
     if (manifest?.permission) {
@@ -57,7 +37,7 @@ function resolveAgentPermissions(manifest) {
             if (key in exports.SYSTEM_REQUIRED_PERMISSIONS) {
                 continue;
             }
-            if (exports.KNOWN_PERMISSION_KEYS.includes(key)) {
+            if (agent_permission_1.KNOWN_PERMISSION_KEYS.includes(key)) {
                 continue;
             }
             out[key] = value;

package/dist/agent-workspace/lib/agent-tool-defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-tool-defaults.js","sourceRoot":"","sources":["../../../src/agent-workspace/lib/agent-tool-defaults.ts"],"names":[],"mappings":";;;AAqKA,0DAmBC;AAiCD,8EAwBC;AA5MD,MAAM,0BAA0B,GAAG;IACjC,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,oBAAoB;IACpB,KAAK;IACL,OAAO;CACC,CAAC;AAMX,MAAM,4BAA4B,GAAG;IACnC,WAAW;IACX,UAAU;IACV,UAAU;IACV,WAAW;IACX,WAAW;CACH,CAAC;AAEE,QAAA,qBAAqB,GAAG;IACnC,GAAG,0BAA0B;IAC7B,GAAG,4BAA4B;CACvB,CAAC;AA4BE,QAAA,2BAA2B,GAA+D;IACrG,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,SAAS,EAAE,OAAO;CACnB,CAAC;AAOW,QAAA,0BAA0B,GAA+D;IACpG,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,OAAO;CACf,CAAC;AAUW,QAAA,yBAAyB,GAA+D;IACnG,QAAQ,EAAE,MAAM;IAChB,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,MAAM;IACjB,kBAAkB,EAAE,MAAM;IAC1B,GAAG,EAAE,MAAM;CACZ,CAAC;AAqCF,SAAgB,uBAAuB,CACrC,QAAgD;IAEhD,MAAM,GAAG,GAAmC,EAAE,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,6BAAqB,EAAE,CAAC;QACxC,GAAG,CAAC,GAAG,CAAC,GAAG,0BAA0B,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,CAAC;IAKD,IAAI,QAAQ,EAAE,UAAU,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/D,IAAI,GAAG,IAAI,mCAA2B,EAAE,CAAC;gBAAA,SAAS;YAAA,CAAC;YACnD,IAAK,6BAA2C,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAA,SAAS;YAAA,CAAC;YAC3E,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AAC7B,CAAC;AAOD,SAAS,0BAA0B,CACjC,GAAkB,EAClB,YAAwC;IAExC,IAAI,GAAG,IAAI,mCAA2B,EAAE,CAAC;QACvC,OAAO,mCAA2B,CAAC,GAAG,CAAE,CAAC;IAC3C,CAAC;IACD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,GAAG,IAAI,kCAA0B,EAAE,CAAC;QACtC,OAAO,kCAA0B,CAAC,GAAG,CAAE,CAAC;IAC1C,CAAC;IACD,OAAO,iCAAyB,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC;AAClD,CAAC;AAYD,SAAgB,iCAAiC,CAC/C,WAAmD;IAEnD,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC;QAAA,OAAO;IAAA,CAAC;IACvC,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,mCAA2B,CAAoB,EAAE,CAAC;QAC9E,MAAM,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,+BAA+B,CACvC,wDAAwD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,EACvG,MAAM,CACP,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAa,+BAAgC,SAAQ,KAAK;IAG7C;IAFX,YACE,OAAe,EACN,yBAAuD;QAEhE,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,8BAAyB,GAAzB,yBAAyB,CAA8B;QAGhE,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF;AARD,0EAQC"}
+{"version":3,"file":"agent-tool-defaults.js","sourceRoot":"","sources":["../../../src/agent-workspace/lib/agent-tool-defaults.ts"],"names":[],"mappings":";;;AAiIA,0DAmBC;AAiCD,8EAwBC;AAzKD,6DAA+D;AAQ/D,2DAMgC;AAL9B,yHAAA,qBAAqB,OAAA;AAYV,QAAA,2BAA2B,GAA+D;IACrG,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,SAAS,EAAE,OAAO;CACnB,CAAC;AAOW,QAAA,0BAA0B,GAA+D;IACpG,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,OAAO;CACf,CAAC;AAUW,QAAA,yBAAyB,GAA+D;IACnG,QAAQ,EAAE,MAAM;IAChB,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,MAAM;IACjB,kBAAkB,EAAE,MAAM;IAC1B,GAAG,EAAE,MAAM;CACZ,CAAC;AAqCF,SAAgB,uBAAuB,CACrC,QAAgD;IAEhD,MAAM,GAAG,GAAmC,EAAE,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,wCAAqB,EAAE,CAAC;QACxC,GAAG,CAAC,GAAG,CAAC,GAAG,0BAA0B,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,CAAC;IAKD,IAAI,QAAQ,EAAE,UAAU,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/D,IAAI,GAAG,IAAI,mCAA2B,EAAE,CAAC;gBAAA,SAAS;YAAA,CAAC;YACnD,IAAK,wCAA2C,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAA,SAAS;YAAA,CAAC;YAC3E,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AAC7B,CAAC;AAOD,SAAS,0BAA0B,CACjC,GAAkB,EAClB,YAAwC;IAExC,IAAI,GAAG,IAAI,mCAA2B,EAAE,CAAC;QACvC,OAAO,mCAA2B,CAAC,GAAG,CAAE,CAAC;IAC3C,CAAC;IACD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,GAAG,IAAI,kCAA0B,EAAE,CAAC;QACtC,OAAO,kCAA0B,CAAC,GAAG,CAAE,CAAC;IAC1C,CAAC;IACD,OAAO,iCAAyB,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC;AAClD,CAAC;AAYD,SAAgB,iCAAiC,CAC/C,WAAmD;IAEnD,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC;QAAA,OAAO;IAAA,CAAC;IACvC,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,mCAA2B,CAAoB,EAAE,CAAC;QAC9E,MAAM,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,+BAA+B,CACvC,wDAAwD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,EACvG,MAAM,CACP,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAa,+BAAgC,SAAQ,KAAK;IAG7C;IAFX,YACE,OAAe,EACN,yBAAuD;QAEhE,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,8BAAyB,GAAzB,yBAAyB,CAA8B;QAGhE,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF;AARD,0EAQC"}

package/dist/reference-resolution/index.d.ts

@@ -0,0 +1,2 @@
+export * from './lib/reference-resolution';
+//# sourceMappingURL=index.d.ts.map

package/dist/reference-resolution/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/reference-resolution/index.ts"],"names":[],"mappings":"AASA,cAAc,4BAA4B,CAAC"}

package/dist/reference-resolution/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/reference-resolution"), exports);
+//# sourceMappingURL=index.js.map

package/dist/reference-resolution/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/reference-resolution/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AASA,6DAA2C"}

package/dist/reference-resolution/lib/reference-resolution.d.ts

@@ -0,0 +1,40 @@
+export declare enum MissingReferencePolicy {
+    Required = "required",
+    Optional = "optional"
+}
+export declare enum ReferenceResolutionState {
+    Present = "present",
+    DeclaredButUnavailable = "declared-but-unavailable",
+    OptionalSkipped = "optional-skipped",
+    Denied = "denied"
+}
+export declare enum ReferenceKind {
+    Agent = "agent",
+    Skill = "skill",
+    Tool = "tool",
+    Capability = "capability",
+    Action = "action",
+    Workflow = "workflow"
+}
+export declare enum ReferenceVerification {
+    Verified = "verified",
+    RegistryOnly = "registry-only",
+    GatewayOnly = "gateway-only",
+    Unavailable = "unavailable"
+}
+export interface ReferenceOwner {
+    readonly biomeId?: string;
+    readonly biomeVersion?: string;
+}
+export interface ResolvedReferenceDecision {
+    readonly kind: ReferenceKind;
+    readonly ref: string;
+    readonly version?: string;
+    readonly policy: MissingReferencePolicy;
+    readonly state: ReferenceResolutionState;
+    readonly verification?: ReferenceVerification;
+    readonly owner?: ReferenceOwner;
+    readonly reason: string;
+}
+export declare function isFatalReferenceDecision(decision: ResolvedReferenceDecision): boolean;
+//# sourceMappingURL=reference-resolution.d.ts.map

package/dist/reference-resolution/lib/reference-resolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reference-resolution.d.ts","sourceRoot":"","sources":["../../../src/reference-resolution/lib/reference-resolution.ts"],"names":[],"mappings":"AAmCA,oBAAY,sBAAsB;IAKhC,QAAQ,aAAa;IAMrB,QAAQ,aAAa;CACtB;AAMD,oBAAY,wBAAwB;IAElC,OAAO,YAAY;IAOnB,sBAAsB,6BAA6B;IAMnD,eAAe,qBAAqB;IAMpC,MAAM,WAAW;CAClB;AAOD,oBAAY,aAAa;IAEvB,KAAK,UAAU;IAEf,KAAK,UAAU;IAEf,IAAI,SAAS;IAEb,UAAU,eAAe;IAEzB,MAAM,WAAW;IAEjB,QAAQ,aAAa;CACtB;AASD,oBAAY,qBAAqB;IAE/B,QAAQ,aAAa;IAErB,YAAY,kBAAkB;IAE9B,WAAW,iBAAiB;IAE5B,WAAW,gBAAgB;CAC5B;AAWD,MAAM,WAAW,cAAc;IAE7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAQD,MAAM,WAAW,yBAAyB;IAExC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAE7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IAExC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;IAEzC,QAAQ,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC;IAE9C,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;IAEhC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAUD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,yBAAyB,GAClC,OAAO,CAQT"}

package/dist/reference-resolution/lib/reference-resolution.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReferenceVerification = exports.ReferenceKind = exports.ReferenceResolutionState = exports.MissingReferencePolicy = void 0;
+exports.isFatalReferenceDecision = isFatalReferenceDecision;
+var MissingReferencePolicy;
+(function (MissingReferencePolicy) {
+    MissingReferencePolicy["Required"] = "required";
+    MissingReferencePolicy["Optional"] = "optional";
+})(MissingReferencePolicy || (exports.MissingReferencePolicy = MissingReferencePolicy = {}));
+var ReferenceResolutionState;
+(function (ReferenceResolutionState) {
+    ReferenceResolutionState["Present"] = "present";
+    ReferenceResolutionState["DeclaredButUnavailable"] = "declared-but-unavailable";
+    ReferenceResolutionState["OptionalSkipped"] = "optional-skipped";
+    ReferenceResolutionState["Denied"] = "denied";
+})(ReferenceResolutionState || (exports.ReferenceResolutionState = ReferenceResolutionState = {}));
+var ReferenceKind;
+(function (ReferenceKind) {
+    ReferenceKind["Agent"] = "agent";
+    ReferenceKind["Skill"] = "skill";
+    ReferenceKind["Tool"] = "tool";
+    ReferenceKind["Capability"] = "capability";
+    ReferenceKind["Action"] = "action";
+    ReferenceKind["Workflow"] = "workflow";
+})(ReferenceKind || (exports.ReferenceKind = ReferenceKind = {}));
+var ReferenceVerification;
+(function (ReferenceVerification) {
+    ReferenceVerification["Verified"] = "verified";
+    ReferenceVerification["RegistryOnly"] = "registry-only";
+    ReferenceVerification["GatewayOnly"] = "gateway-only";
+    ReferenceVerification["Unavailable"] = "unavailable";
+})(ReferenceVerification || (exports.ReferenceVerification = ReferenceVerification = {}));
+function isFatalReferenceDecision(decision) {
+    if (decision.state === ReferenceResolutionState.Denied) {
+        return true;
+    }
+    if (decision.state === ReferenceResolutionState.DeclaredButUnavailable) {
+        return decision.policy !== MissingReferencePolicy.Optional;
+    }
+    return false;
+}
+//# sourceMappingURL=reference-resolution.js.map

package/dist/reference-resolution/lib/reference-resolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reference-resolution.js","sourceRoot":"","sources":["../../../src/reference-resolution/lib/reference-resolution.ts"],"names":[],"mappings":";;;AAoKA,4DAUC;AA3ID,IAAY,sBAYX;AAZD,WAAY,sBAAsB;IAKhC,+CAAqB,CAAA;IAMrB,+CAAqB,CAAA;AACvB,CAAC,EAZW,sBAAsB,sCAAtB,sBAAsB,QAYjC;AAMD,IAAY,wBAsBX;AAtBD,WAAY,wBAAwB;IAElC,+CAAmB,CAAA;IAOnB,+EAAmD,CAAA;IAMnD,gEAAoC,CAAA;IAMpC,6CAAiB,CAAA;AACnB,CAAC,EAtBW,wBAAwB,wCAAxB,wBAAwB,QAsBnC;AAOD,IAAY,aAaX;AAbD,WAAY,aAAa;IAEvB,gCAAe,CAAA;IAEf,gCAAe,CAAA;IAEf,8BAAa,CAAA;IAEb,0CAAyB,CAAA;IAEzB,kCAAiB,CAAA;IAEjB,sCAAqB,CAAA;AACvB,CAAC,EAbW,aAAa,6BAAb,aAAa,QAaxB;AASD,IAAY,qBASX;AATD,WAAY,qBAAqB;IAE/B,8CAAqB,CAAA;IAErB,uDAA8B,CAAA;IAE9B,qDAA4B,CAAA;IAE5B,oDAA2B,CAAA;AAC7B,CAAC,EATW,qBAAqB,qCAArB,qBAAqB,QAShC;AAmDD,SAAgB,wBAAwB,CACtC,QAAmC;IAEnC,IAAI,QAAQ,CAAC,KAAK,KAAK,wBAAwB,CAAC,MAAM,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,KAAK,wBAAwB,CAAC,sBAAsB,EAAE,CAAC;QACvE,OAAO,QAAQ,CAAC,MAAM,KAAK,sBAAsB,CAAC,QAAQ,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/workflow/lib/compiled-workspace-manifest.d.ts

@@ -1,3 +1,4 @@
+import type { PermissionMap } from '../../agent-permission';
 import type { ToolSelectionEntry } from '../../mcp-tool';
 import type { AgentRunRole } from './agent-role';
 import type { CompiledWorkingFile } from './compiled-working-file';
@@ -32,6 +33,7 @@ export interface CompiledManifestAgent {
     readonly deliverableSpecRef?: string;
     readonly defaultModel?: ModelRef;
     readonly instructions?: string;
+    readonly permission?: PermissionMap;
     readonly subAgents: readonly SubAgentBinding[];
 }
 export interface CompiledManifestDisplay {

package/dist/workflow/lib/compiled-workspace-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compiled-workspace-manifest.d.ts","sourceRoot":"","sources":["../../../src/workflow/lib/compiled-workspace-manifest.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAInE,YAAY,EACV,mBAAmB,EACnB,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,UAAU,EACX,MAAM,4BAA4B,CAAC;AAEpC,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,SAAS,eAAe,EAAE,CAAC;IACnD,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAC1D,QAAQ,CAAC,MAAM,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAKrD,QAAQ,CAAC,aAAa,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACtD,QAAQ,CAAC,WAAW,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAC5D,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAC;IAClD,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAC;IAClD,QAAQ,CAAC,aAAa,EAAE,6BAA6B,CAAC;IACtD,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAChD,QAAQ,CAAC,GAAG,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAQ3E,QAAQ,CAAC,YAAY,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAMtD,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAM1B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC;IASjC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,CAAC;KACtC,CAAC;CACH;AAQD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,4BAA4B,EAAE,2BAA2B,CAAC;IACzF,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,4BAA4B,EAAE,8BAA8B,CAAC;CAChG;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAMlC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAC,CAAC;CAC/E;AAED,MAAM,MAAM,iCAAiC,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEnE,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAO3B,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC;IAMjD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAMvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,YAAY,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAOD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;CACzC;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACzD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAClD,CAAC"}
+{"version":3,"file":"compiled-workspace-manifest.d.ts","sourceRoot":"","sources":["../../../src/workflow/lib/compiled-workspace-manifest.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAInE,YAAY,EACV,mBAAmB,EACnB,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,UAAU,EACX,MAAM,4BAA4B,CAAC;AAEpC,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,SAAS,eAAe,EAAE,CAAC;IACnD,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAC1D,QAAQ,CAAC,MAAM,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAKrD,QAAQ,CAAC,aAAa,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACtD,QAAQ,CAAC,WAAW,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAC5D,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAC;IAClD,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAC;IAClD,QAAQ,CAAC,aAAa,EAAE,6BAA6B,CAAC;IACtD,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAChD,QAAQ,CAAC,GAAG,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAQ3E,QAAQ,CAAC,YAAY,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAMtD,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAM1B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC;IASjC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAU/B,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,CAAC;KACtC,CAAC;CACH;AAQD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,4BAA4B,EAAE,2BAA2B,CAAC;IACzF,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,4BAA4B,EAAE,8BAA8B,CAAC;CAChG;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAMlC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAC,CAAC;CAC/E;AAED,MAAM,MAAM,iCAAiC,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEnE,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAO3B,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC;IAMjD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAMvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,YAAY,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAOD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;CACzC;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACzD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAClD,CAAC"}

package/dist/workflow/lib/model-ref.d.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import type { PermissionMap } from '../../agent-permission';
 export declare enum ModelClass {
     CODING = "coding",
     REVIEW = "review",
@@ -18,24 +19,35 @@ export declare enum ModelRefKind {
     CONCRETE = "concrete",
     STRATEGY = "strategy"
 }
-export interface ConcreteModelRef {
+export interface ModelOptions {
+    readonly temperature?: number;
+    readonly topP?: number;
+    readonly maxTokens?: number;
+    readonly stop?: readonly string[];
+    readonly presencePenalty?: number;
+    readonly frequencyPenalty?: number;
+    readonly reasoningEffort?: string;
+    readonly thinkingBudget?: number;
+}
+export interface ConcreteModelRef extends ModelOptions {
     readonly kind: ModelRefKind.CONCRETE;
     readonly modelId: string;
     readonly providerSlug?: string;
-    readonly temperature?: number;
 }
-export interface StrategyModelRef {
+export interface StrategyModelRef extends ModelOptions {
     readonly kind: ModelRefKind.STRATEGY;
     readonly modelClass: ModelClass;
-    readonly temperature?: number;
 }
 export type ModelRef = ConcreteModelRef | StrategyModelRef;
 export declare function isConcreteModelRef(ref: ModelRef): ref is ConcreteModelRef;
 export declare function isStrategyModelRef(ref: ModelRef): ref is StrategyModelRef;
-export interface SubAgentBinding {
-    readonly slug: string;
-    readonly alias?: string;
+export interface NodeOverlayFragment {
     readonly modelOverride?: ModelRef;
     readonly instructions?: string;
+    readonly permission?: PermissionMap;
+}
+export interface SubAgentBinding extends NodeOverlayFragment {
+    readonly slug: string;
+    readonly alias?: string;
 }
 //# sourceMappingURL=model-ref.d.ts.map

package/dist/workflow/lib/model-ref.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model-ref.d.ts","sourceRoot":"","sources":["../../../src/workflow/lib/model-ref.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,oBAAY,UAAU;IACpB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED,eAAO,MAAM,kBAAkB,EAAE,SAAS,UAAU,EAMnD,CAAC;AAOF,eAAO,MAAM,gBAAgB;;;;;;EAE5B,CAAC;AAEF,oBAAY,YAAY;IACtB,QAAQ,aAAa;IACrB,QAAQ,aAAa;CACtB;AAOD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAOD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,QAAQ,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;AAE3D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,QAAQ,GAAG,GAAG,IAAI,gBAAgB,CAEzE;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,QAAQ,GAAG,GAAG,IAAI,gBAAgB,CAEzE;AAYD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC;IAQlC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC"}
+{"version":3,"file":"model-ref.d.ts","sourceRoot":"","sources":["../../../src/workflow/lib/model-ref.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAkB5D,oBAAY,UAAU;IACpB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED,eAAO,MAAM,kBAAkB,EAAE,SAAS,UAAU,EAMnD,CAAC;AAOF,eAAO,MAAM,gBAAgB;;;;;;EAE5B,CAAC;AAEF,oBAAY,YAAY;IACtB,QAAQ,aAAa;IACrB,QAAQ,aAAa;CACtB;AAkBD,MAAM,WAAW,YAAY;IAE3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAElC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAElC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAMnC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAElC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAUD,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAQD,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC;AAED,MAAM,MAAM,QAAQ,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;AAE3D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,QAAQ,GAAG,GAAG,IAAI,gBAAgB,CAEzE;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,QAAQ,GAAG,GAAG,IAAI,gBAAgB,CAEzE;AA0BD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;CACrC;AAYD,MAAM,WAAW,eAAgB,SAAQ,mBAAmB;IAC1D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB"}

package/dist/workflow/lib/model-ref.js.map

@@ -1 +1 @@
-{"version":3,"file":"model-ref.js","sourceRoot":"","sources":["../../../src/workflow/lib/model-ref.ts"],"names":[],"mappings":";;;AA+FA,gDAEC;AAED,gDAEC;AA/ED,6BAAwB;AAkBxB,IAAY,UAMX;AAND,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,+BAAiB,CAAA;IACjB,mCAAqB,CAAA;IACrB,mCAAqB,CAAA;IACrB,iCAAmB,CAAA;AACrB,CAAC,EANW,UAAU,0BAAV,UAAU,QAMrB;AAEY,QAAA,kBAAkB,GAA0B;IACvD,UAAU,CAAC,MAAM;IACjB,UAAU,CAAC,MAAM;IACjB,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,OAAO;CACnB,CAAC;AAOW,QAAA,gBAAgB,GAAG,OAAC,CAAC,IAAI,CACpC,0BAA4D,CAC7D,CAAC;AAEF,IAAY,YAGX;AAHD,WAAY,YAAY;IACtB,qCAAqB,CAAA;IACrB,qCAAqB,CAAA;AACvB,CAAC,EAHW,YAAY,4BAAZ,YAAY,QAGvB;AA2BD,SAAgB,kBAAkB,CAAC,GAAa;IAC9C,OAAO,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,QAAQ,CAAC;AAC5C,CAAC;AAED,SAAgB,kBAAkB,CAAC,GAAa;IAC9C,OAAO,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,QAAQ,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"model-ref.js","sourceRoot":"","sources":["../../../src/workflow/lib/model-ref.ts"],"names":[],"mappings":";;;AA0IA,gDAEC;AAED,gDAEC;AA1HD,6BAAwB;AAoBxB,IAAY,UAMX;AAND,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,+BAAiB,CAAA;IACjB,mCAAqB,CAAA;IACrB,mCAAqB,CAAA;IACrB,iCAAmB,CAAA;AACrB,CAAC,EANW,UAAU,0BAAV,UAAU,QAMrB;AAEY,QAAA,kBAAkB,GAA0B;IACvD,UAAU,CAAC,MAAM;IACjB,UAAU,CAAC,MAAM;IACjB,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,OAAO;CACnB,CAAC;AAOW,QAAA,gBAAgB,GAAG,OAAC,CAAC,IAAI,CACpC,0BAA4D,CAC7D,CAAC;AAEF,IAAY,YAGX;AAHD,WAAY,YAAY;IACtB,qCAAqB,CAAA;IACrB,qCAAqB,CAAA;AACvB,CAAC,EAHW,YAAY,4BAAZ,YAAY,QAGvB;AAoED,SAAgB,kBAAkB,CAAC,GAAa;IAC9C,OAAO,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,QAAQ,CAAC;AAC5C,CAAC;AAED,SAAgB,kBAAkB,CAAC,GAAa;IAC9C,OAAO,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,QAAQ,CAAC;AAC5C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/kernel-contracts",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the 32 kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework/runtime deps.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/src/agent-composition/index.ts

@@ -14,4 +14,5 @@ export * from './lib/composition';
 export * from './lib/composition-limits-schema';
 export * from './lib/composition-workspace';
 export * from './lib/intrinsic-floor';
+export * from './lib/invocation-overlay';
 export * from './lib/model-resolution-matrix';

package/src/agent-composition/lib/composition.ts

@@ -14,7 +14,7 @@
 // ═══════════════════════════════════════════════════════════════════════════
 
 import type { ToolSelectionEntry } from '../../mcp-tool';
-import type { ModelRef } from '../../workflow';
+import type { NodeOverlayFragment } from '../../workflow';
 import type { SkillRef } from '../../skill';
 import type { CapabilityLayer } from './capability-layer';
 import type { CompositionWorkspace } from './composition-workspace';
@@ -99,7 +99,7 @@ export interface CompositionLimits {
  * `skills` / `tools` / `modelOverride` attach AT this node — they extend or
  * override what the referenced agent definition declares intrinsically.
  */
-export interface CompositionNode {
+export interface CompositionNode extends NodeOverlayFragment {
   /** The agent definition this node runs. */
   readonly agent: AgentRef;
   /** Optional alias when the same agent appears more than once in the tree. */
@@ -108,24 +108,10 @@ export interface CompositionNode {
   readonly skills: readonly SkillRef[];
   /** Tools attached at this node. */
   readonly tools: readonly ToolSelectionEntry[];
-  /**
-   * Optional concrete model override for this node. When omitted the
-   * Model Resolution Matrix decides at the invocation boundary.
-   */
-  readonly modelOverride?: ModelRef;
-  /**
-   * Node-level instructions — a prompt fragment layered ONTO the referenced
-   * agent definition's intrinsic system prompt. This is the "instructions"
-   * lever that lets a handful of base agents (generic/coder/explorer/planner)
-   * be specialized per node without authoring a new agent definition.
-   *
-   * Composite ordering (resolver-enforced): `agentDefinition.systemPrompt`
-   * THEN these `instructions`. The platform `system-overlay.md` (AWP base +
-   * deliverable contract + authority) is injected LATER by the runtime — it
-   * is NOT part of this field. Absent/blank = the base prompt passes through
-   * unchanged (never an empty append).
-   */
-  readonly instructions?: string;
+  // modelOverride / instructions / permission — the INVOCATION-overlay trio —
+  // are inherited from NodeOverlayFragment (single declaration site). They
+  // OVERRIDE the model, APPEND to the base prompt, and RESTRICT-merge the
+  // permission for this node only.
   /** Sub-agents — themselves fully-armed composition nodes (recursive). */
   readonly children: readonly CompositionNode[];
   /**
@@ -173,7 +159,7 @@ export interface Composition {
  * Distinct from `CompositionNode` (the AUTHORED form): a resolved node
  * has its agent reference fully version-pinned, never `latest`.
  */
-export interface ResolvedCompositionNode {
+export interface ResolvedCompositionNode extends NodeOverlayFragment {
   /** Fully version-pinned agent reference. */
   readonly agent: Required<AgentRef>;
   readonly alias?: string;
@@ -181,15 +167,10 @@ export interface ResolvedCompositionNode {
   readonly skills: readonly SkillRef[];
   /** Tool references attached at this node. */
   readonly tools: readonly ToolSelectionEntry[];
-  /** Concrete model override, when the node pinned one. */
-  readonly modelOverride?: ModelRef;
-  /**
-   * Resolved node-level instructions, copied verbatim from the source
-   * `CompositionNode.instructions`. The composer/runtime layers this onto
-   * the referenced agent definition's `systemPrompt` (base prompt first,
-   * then instructions). Absent = no node-level override.
-   */
-  readonly instructions?: string;
+  // modelOverride / instructions / permission — inherited verbatim from the
+  // source node via NodeOverlayFragment (single declaration site). The
+  // composer layers instructions onto the base systemPrompt and deep-merges
+  // permission over the agent's authored permission before the system tiers.
   /** Resolved sub-agent nodes (recursive). */
   readonly children: readonly ResolvedCompositionNode[];
   /**

package/src/agent-composition/lib/invocation-overlay.ts

@@ -0,0 +1,75 @@
+// ═══════════════════════════════════════════════════════════════════════════
+// ── Invocation Overlay ──
+//
+// The INVOCATION-axis overlay: per-call shaping of a resolved agent that is
+// NEVER persisted into identity. ONE shared shape for both call sites —
+// a workflow step's `with:` block AND a session/thread override — so the
+// platform has a single overlay contract, not two divergent ones.
+//
+// Semantics (add-or-restrict ONLY — an overlay can extend context and NARROW
+// capability, but NEVER widen beyond the agent's own + org/project policy):
+//   - modelOverride : OVERRIDE   (inherited from NodeOverlayFragment)
+//   - instructions  : APPEND     (inherited; appended AFTER the resolved
+//                                 agent prompt — same field, same append
+//                                 semantics as a node; NO separate
+//                                 `instructionsAppend` name — one concept)
+//   - permission    : RESTRICT   (inherited; deep-merge, may only narrow)
+//   - tools         : ADD/REMOVE (still policy-checked at resolve time)
+//   - skills        : ADD-only   (identity skills are the floor)
+//
+// Agent SELECTION (which agent runs) is deliberately NOT part of this overlay:
+// in a workflow that is `agentSlug`/`agentRef`, and `compositionRef` selects a
+// workspace SOURCE, not the agent (see plan audit A5). The overlay only SHAPES
+// the already-selected agent.
+// ═══════════════════════════════════════════════════════════════════════════
+
+import type { ToolSelectionEntry } from '../../mcp-tool';
+import type { SkillRef } from '../../skill';
+import type { NodeOverlayFragment } from '../../workflow';
+
+/**
+ * Tools requested for this invocation. `add` requests extra tools, `remove`
+ * drops tools by ref. Both are still validated against the agent's resolved
+ * permission AND the step/session policy at resolve time — a request can
+ * never force-enable a tool the agent is not allowed to use (fail-fast).
+ */
+export interface InvocationToolOverlay {
+  readonly add?: readonly ToolSelectionEntry[];
+  /** Tool refs to drop for this invocation. */
+  readonly remove?: readonly string[];
+}
+
+/**
+ * Skills requested for this invocation. ADD-only: the resolved agent's own
+ * skills are the floor and cannot be removed by an overlay (they are
+ * governed, registered identity). Removal/disable is a separate, later
+ * governed capability — not part of the per-call overlay.
+ */
+export interface InvocationSkillOverlay {
+  readonly add?: readonly SkillRef[];
+}
+
+/**
+ * The canonical per-call overlay. Extends {@link NodeOverlayFragment}
+ * (model / instructions / permission) with tools + skills. Both the
+ * workflow-step overlay and the session overlay ARE this shape.
+ */
+export interface InvocationOverlay extends NodeOverlayFragment {
+  readonly tools?: InvocationToolOverlay;
+  readonly skills?: InvocationSkillOverlay;
+}
+
+/**
+ * A workflow step's typed `with:` overlay. Structurally an
+ * {@link InvocationOverlay}; named for the call site. The agent action
+ * manifest validates it via its `spec.inputs` JSON Schema (the existing
+ * fail-fast validation lane — NOT a new validation system).
+ */
+export type AgentStepWithOverlay = InvocationOverlay;
+
+/**
+ * A session/thread invocation overlay — the SAME shape as the workflow
+ * step overlay so sessions and workflows shape an agent identically
+ * (no second, looser session override surface).
+ */
+export type SessionInvocationOverlay = InvocationOverlay;

package/src/agent-permission/index.ts

@@ -0,0 +1,12 @@
+// ═══════════════════════════════════════════════════════════════════════════
+// ── Agent Permission Contracts — Barrel Export ──
+//
+// Kernel (Layer-0) leaf: the pure permission TYPES (PermissionMap,
+// PermissionRule, PermissionAction, PermissionKey, KNOWN_PERMISSION_KEYS).
+// Zero deps. Imported by `workflow`, `agent-workspace`, and any consumer
+// that needs the permission shape — breaks the prior workflow↔agent-workspace
+// cycle. The resolve LOGIC + system tiers live in
+// `agent-workspace/lib/agent-tool-defaults.ts`.
+// ═══════════════════════════════════════════════════════════════════════════
+
+export * from './lib/permission-map';

package/src/agent-permission/lib/permission-map.ts

@@ -0,0 +1,71 @@
+// ═══════════════════════════════════════════════════════════════════════════
+// ── Agent Permission types — single source of truth (Layer-0 leaf) ──
+//
+// The PURE permission TYPES, extracted to their own dependency-free subpath
+// so BOTH `workflow` (model-ref / compiled-workspace-manifest) and
+// `agent-workspace` (the resolve logic) can import them WITHOUT creating a
+// `workflow ↔ agent-workspace` import cycle. The merge logic + system tiers
+// (`resolveAgentPermissions`, `SYSTEM_*_PERMISSIONS`,
+// `assertNoRequiredPermissionsDenied`) stay in
+// `agent-workspace/lib/agent-tool-defaults.ts` and import these types.
+//
+// Mirrors OpenCode's unified `permission` surface (`packages/opencode/src/
+// config/permission.ts`).
+// ═══════════════════════════════════════════════════════════════════════════
+
+/**
+ * Permission keys that take a `Rule` shape — either a scalar action or
+ * a per-target map (e.g. `bash: { '*': 'allow', 'rm -rf *': 'deny' }`,
+ * `task: { 'html-builder': 'allow' }`, `external_directory: { '/**':
+ * 'allow' }`). Mirrors OpenCode's `permission.ts` `InputObject`.
+ */
+const KNOWN_RULE_PERMISSION_KEYS = [
+  'read',
+  'edit',
+  'glob',
+  'grep',
+  'list',
+  'bash',
+  'task',
+  'external_directory',
+  'lsp',
+  'skill',
+] as const;
+
+/**
+ * Permission keys that take a scalar `Action` only (no per-target map).
+ * Mirrors OpenCode's `permission.ts` `InputObject`.
+ */
+const KNOWN_ACTION_PERMISSION_KEYS = [
+  'todowrite',
+  'question',
+  'webfetch',
+  'websearch',
+  'doom_loop',
+] as const;
+
+export const KNOWN_PERMISSION_KEYS = [
+  ...KNOWN_RULE_PERMISSION_KEYS,
+  ...KNOWN_ACTION_PERMISSION_KEYS,
+] as const;
+
+export type PermissionKey = (typeof KNOWN_PERMISSION_KEYS)[number];
+
+export type PermissionAction = 'allow' | 'ask' | 'deny';
+
+/**
+ * A permission entry is either a scalar action or a per-target map. The
+ * map form is supported only for the keys in `KNOWN_RULE_PERMISSION_KEYS`
+ * — the action-only keys reject map shapes at the OpenCode schema layer.
+ * Catch-all entries (MCP tool names, biome-emitted globs) live alongside
+ * the closed set; their shape is validated by OpenCode at config load.
+ */
+export type PermissionRule = PermissionAction | Readonly<Record<string, PermissionAction>>;
+
+/**
+ * Full permission map. Closed-set keys carry typed rules; the index
+ * signature accommodates MCP tool names and biome-emitted glob patterns
+ * (e.g. `xema_*`, `emit*`) that OpenCode resolves via its catch-all
+ * `Schema.Record(Schema.String, Rule)` in `permission.ts`.
+ */
+export type PermissionMap = Readonly<Record<string, PermissionRule>>;

package/src/agent-workspace/lib/agent-tool-defaults.ts

@@ -29,62 +29,26 @@
 // pipelines, and authoring previews all merge through this function.
 // ═══════════════════════════════════════════════════════════════════════════
 
-/**
- * Permission keys that take a `Rule` shape — either a scalar action or
- * a per-target map (e.g. `bash: { '*': 'allow', 'rm -rf *': 'deny' }`,
- * `task: { 'html-builder': 'allow' }`, `external_directory: { '/**':
- * 'allow' }`). Mirrors OpenCode's `permission.ts` `InputObject`.
- */
-const KNOWN_RULE_PERMISSION_KEYS = [
-  'read',
-  'edit',
-  'glob',
-  'grep',
-  'list',
-  'bash',
-  'task',
-  'external_directory',
-  'lsp',
-  'skill',
-] as const;
-
-/**
- * Permission keys that take a scalar `Action` only (no per-target map).
- * Mirrors OpenCode's `permission.ts` `InputObject`.
- */
-const KNOWN_ACTION_PERMISSION_KEYS = [
-  'todowrite',
-  'question',
-  'webfetch',
-  'websearch',
-  'doom_loop',
-] as const;
-
-export const KNOWN_PERMISSION_KEYS = [
-  ...KNOWN_RULE_PERMISSION_KEYS,
-  ...KNOWN_ACTION_PERMISSION_KEYS,
-] as const;
-
-export type PermissionKey = (typeof KNOWN_PERMISSION_KEYS)[number];
-
-export type PermissionAction = 'allow' | 'ask' | 'deny';
-
-/**
- * A permission entry is either a scalar action or a per-target map. The
- * map form is supported only for the keys in `KNOWN_RULE_PERMISSION_KEYS`
- * — the action-only keys reject map shapes at the OpenCode schema layer.
- * Catch-all entries (MCP tool names, biome-emitted globs) live alongside
- * the closed set; their shape is validated by OpenCode at config load.
- */
-export type PermissionRule = PermissionAction | Readonly<Record<string, PermissionAction>>;
-
-/**
- * Full permission map. Closed-set keys carry typed rules; the index
- * signature accommodates MCP tool names and biome-emitted glob patterns
- * (e.g. `xema_*`, `emit*`) that OpenCode resolves via its catch-all
- * `Schema.Record(Schema.String, Rule)` in `permission.ts`.
- */
-export type PermissionMap = Readonly<Record<string, PermissionRule>>;
+// The pure permission TYPES now live in the dependency-free `agent-permission`
+// leaf subpath (breaking the prior workflow↔agent-workspace cycle). Import the
+// value (`KNOWN_PERMISSION_KEYS`) for the resolve logic below + the types, and
+// re-export all of them so the `agent-workspace` barrel surface stays stable
+// for every existing consumer.
+import { KNOWN_PERMISSION_KEYS } from '../../agent-permission';
+import type {
+  PermissionAction,
+  PermissionKey,
+  PermissionMap,
+  PermissionRule,
+} from '../../agent-permission';
+
+export {
+  KNOWN_PERMISSION_KEYS,
+  type PermissionAction,
+  type PermissionKey,
+  type PermissionMap,
+  type PermissionRule,
+} from '../../agent-permission';
 
 /**
  * Permissions every agent gets — manifests cannot deny them. Removing

package/src/reference-resolution/index.ts

@@ -0,0 +1,10 @@
+// ═══════════════════════════════════════════════════════════════════════════
+// ── Reference Resolution Contracts — Barrel Export ──
+//
+// Kernel (Layer-0) leaf: the shared graceful-degradation decision (DBM.1) used
+// by every resolver that walks a definition's declared references. Zero
+// cross-subpath deps so agent-composition / skill / capability / workflow /
+// action resolvers can all import it without a cycle.
+// ═══════════════════════════════════════════════════════════════════════════
+
+export * from './lib/reference-resolution';

package/src/reference-resolution/lib/reference-resolution.ts

@@ -0,0 +1,175 @@
+// ═══════════════════════════════════════════════════════════════════════════
+// ── Reference Resolution — graceful-degradation decision (DBM.1) ──
+//
+// The ONE shared contract every resolver uses when it walks a definition's
+// declared references (an Agent node's `agentRef`, a skill's sub-skill, an
+// action's capability, a workflow's `uses:`) and asks "is this reference
+// available right now, and what do I do if it isn't?".
+//
+// It exists because of DYNAMIC BIOME MODULARITY: a definition authored while
+// biome X was installed keeps referencing X's contributions after X is
+// uninstalled/disabled. Today every resolver hard-fails uniformly
+// (AGENT_NOT_REGISTERED / MOUNT_SOURCE_NOT_FOUND aborts the whole run). The
+// shared policy below lets a reference be declared `optional` so its absence
+// degrades to a typed, observable skip instead of aborting — while the DEFAULT
+// stays fail-fast/fail-closed (no silent fallback).
+//
+// Modeled on `ResolvedModelDecision` (the Model Matrix's traced outcome): a
+// resolver returns one {@link ResolvedReferenceDecision} per reference, carrying
+// the outcome + a human-readable `reason` for the Studio debugger. Distinct
+// from model resolution on purpose — the Model Matrix always has a DEFAULT rule
+// so it can never be "unavailable"; references genuinely can.
+//
+// Pure Layer-0 leaf: zero cross-subpath imports so EVERY resolver
+// (agent-composition / skill / capability / workflow / action) can import it
+// without creating a cycle.
+// ═══════════════════════════════════════════════════════════════════════════
+
+/**
+ * How a resolver must treat a reference whose backing contribution is not
+ * currently available. Closed set; the DEFAULT is {@link Required}.
+ *
+ * This is the per-reference knob that makes biome add/remove non-breaking:
+ * authors mark the references they can live without as {@link Optional}; every
+ * other reference keeps the fail-fast contract.
+ */
+export enum MissingReferencePolicy {
+  /**
+   * Default. An unavailable reference is fatal — the resolver throws and the
+   * whole resolution/run fails fast. Never degrades silently.
+   */
+  Required = 'required',
+  /**
+   * An unavailable reference is skipped with a typed warning
+   * ({@link ReferenceResolutionState.OptionalSkipped}) and resolution
+   * continues without it. The only sanctioned degradation path.
+   */
+  Optional = 'optional',
+}
+
+/**
+ * The four — and only four — outcomes of resolving a single reference.
+ * Closed set; this is the "4-state ResolverDecision" of DBM.1.
+ */
+export enum ReferenceResolutionState {
+  /** Resolved to a live, available contribution. */
+  Present = 'present',
+  /**
+   * The reference is declared on the definition but its backing contribution
+   * is not currently available — typically because the owning biome was
+   * uninstalled or disabled. Fatal under {@link MissingReferencePolicy.Required};
+   * degrades to {@link OptionalSkipped} under {@link MissingReferencePolicy.Optional}.
+   */
+  DeclaredButUnavailable = 'declared-but-unavailable',
+  /**
+   * An {@link MissingReferencePolicy.Optional} reference that was
+   * {@link DeclaredButUnavailable} and was therefore skipped; resolution
+   * continued without it. This is the graceful-degradation terminal state.
+   */
+  OptionalSkipped = 'optional-skipped',
+  /**
+   * The reference resolves to a contribution the caller is NOT permitted to
+   * use (governance / scope / visibility denied it). Always fatal regardless
+   * of policy — fail-closed, never downgraded to a skip.
+   */
+  Denied = 'denied',
+}
+
+/**
+ * The closed set of reference KINDS a definition can declare and a resolver
+ * can resolve. Adding a new resolvable reference type = a one-line enum
+ * extension here.
+ */
+export enum ReferenceKind {
+  /** An Agent node's `agentRef` (a child agent / sub-agent). */
+  Agent = 'agent',
+  /** A skill bundle slug (intrinsic, node-attached, or a sub-skill). */
+  Skill = 'skill',
+  /** An MCP tool selection entry (`<provider>:<tool>@<v>`). */
+  Tool = 'tool',
+  /** A capability ref (`document:pdf-to-markdown@1`) reached via the router. */
+  Capability = 'capability',
+  /** A workflow action ref. */
+  Action = 'action',
+  /** A sub-workflow `uses:` ref. */
+  Workflow = 'workflow',
+}
+
+/**
+ * Declared-vs-enforced verification of a {@link ReferenceResolutionState.Present}
+ * reference — adopted from NemoClaw's verification model. Answers "the registry
+ * SAYS this exists, but is it actually reachable at the gateway/runtime?".
+ * Surfaced for diagnostics; it does NOT change fail-fast semantics (an
+ * unreachable-but-required reference still fails).
+ */
+export enum ReferenceVerification {
+  /** Declared in the registry AND confirmed reachable at the gateway/runtime. */
+  Verified = 'verified',
+  /** Declared in the registry but reachability at runtime is unconfirmed. */
+  RegistryOnly = 'registry-only',
+  /** Reachable at the gateway/runtime but with no registry declaration. */
+  GatewayOnly = 'gateway-only',
+  /** Neither declared nor reachable — pairs with {@link ReferenceResolutionState.DeclaredButUnavailable}. */
+  Unavailable = 'unavailable',
+}
+
+/**
+ * Owner attribution for a reference — which biome contributes it (NemoClaw's
+ * owner-attribution shape). The key signal behind a
+ * {@link ReferenceResolutionState.DeclaredButUnavailable} outcome: it names the
+ * biome whose install/enable would make the reference {@link ReferenceResolutionState.Present}
+ * again, so the UI can say "install biome X to restore `media:transcribe@1`".
+ *
+ * Both fields optional — System/kernel-shipped references have no owning biome.
+ */
+export interface ReferenceOwner {
+  /** The contributing biome's id; absent for System/kernel-shipped references. */
+  readonly biomeId?: string;
+  /** The contributing biome's version at resolution time, when known. */
+  readonly biomeVersion?: string;
+}
+
+/**
+ * The traced outcome of resolving ONE declared reference — the per-reference
+ * sibling of {@link ResolvedModelDecision}. A resolver emits one of these per
+ * reference it walks; the set is the audit trail the Studio debugger renders
+ * and the basis for any fail-fast throw.
+ */
+export interface ResolvedReferenceDecision {
+  /** What kind of reference this is. */
+  readonly kind: ReferenceKind;
+  /** The ref/slug exactly as authored on the definition. */
+  readonly ref: string;
+  /** The pinned version the definition requested, when it pinned one. */
+  readonly version?: string;
+  /** The policy that governed this reference (default {@link MissingReferencePolicy.Required}). */
+  readonly policy: MissingReferencePolicy;
+  /** The resolution outcome. */
+  readonly state: ReferenceResolutionState;
+  /** Declared-vs-enforced verification, when the resolver could determine it. */
+  readonly verification?: ReferenceVerification;
+  /** Which biome contributes the reference, for "install X to restore" UX. */
+  readonly owner?: ReferenceOwner;
+  /** Human-readable reason for the Studio debugger; mirrors `ResolvedModelDecision.reason`. */
+  readonly reason: string;
+}
+
+/**
+ * `true` when the decision must abort resolution fail-fast — every
+ * {@link ReferenceResolutionState.Denied}, plus any
+ * {@link ReferenceResolutionState.DeclaredButUnavailable} that was NOT marked
+ * {@link MissingReferencePolicy.Optional}. The single predicate every resolver
+ * checks so the fail-fast rule is implemented in exactly one place (no
+ * per-resolver re-derivation, no silent divergence).
+ */
+export function isFatalReferenceDecision(
+  decision: ResolvedReferenceDecision,
+): boolean {
+  if (decision.state === ReferenceResolutionState.Denied) {
+    return true;
+  }
+  if (decision.state === ReferenceResolutionState.DeclaredButUnavailable) {
+    return decision.policy !== MissingReferencePolicy.Optional;
+  }
+  return false;
+}

package/src/workflow/lib/compiled-workspace-manifest.ts

@@ -8,6 +8,7 @@
  * → workflow-contracts → workspace-manifest-dsl.
  */
 
+import type { PermissionMap } from '../../agent-permission';
 import type { ToolSelectionEntry } from '../../mcp-tool';
 
 import type { AgentRunRole } from './agent-role';
@@ -83,6 +84,16 @@ export interface CompiledManifestAgent {
    * Absent = the base agent's prompt passes through unchanged.
    */
   readonly instructions?: string;
+  /**
+   * Optional node-level permission override carried through from the
+   * authored manifest's `spec.agent.permission` (WS5 kernel extension).
+   * Deep-merged (per top-level key) over the referenced base agent's
+   * authored permission before the system tiers run — lets a generic base
+   * agent (e.g. `coder`/`planner`) be specialized into a bounded role
+   * (read-only, scoped `task` allowlist) without a new agent definition.
+   * Absent = the base agent's permissions pass through unchanged.
+   */
+  readonly permission?: PermissionMap;
   readonly subAgents: readonly SubAgentBinding[];
 }
 

package/src/workflow/lib/model-ref.ts

@@ -22,6 +22,8 @@
 
 import { z } from 'zod';
 
+import type { PermissionMap } from '../../agent-permission';
+
 /**
  * LLM-routing tier. The SINGLE source of truth for the closed set
  * `utility | planning | creative | coding | review` — every other
@@ -68,27 +70,68 @@ export enum ModelRefKind {
   STRATEGY = 'strategy',
 }
 
+/**
+ * Model generation / sampling options — the closed set of knobs an author
+ * MAY set on a model reference.
+ *
+ * **No platform-side defaults (hard rule).** Every field is optional and
+ * Xema injects NO default for any of them. An unset field is passed through
+ * as ABSENT so the engine/provider applies its own default — never
+ * materialise a value here, in a DTO, a Zod `.default()`, a seeder, or a
+ * `?? <n>` fallback. Forward a field to the provider only when it is
+ * explicitly defined (the `request.x !== undefined` pattern).
+ *
+ * Spread (via `extends`) by both {@link ConcreteModelRef} and
+ * {@link StrategyModelRef} so every override slot in the platform inherits
+ * new options for free — one fragment, no parallel field, no per-slot
+ * restatement (the `ModelRef` / `PermissionMap` reuse pattern).
+ */
+export interface ModelOptions {
+  /** Sampling temperature. Unset = engine default (NOT 0). */
+  readonly temperature?: number;
+  /** Nucleus sampling top-p. Unset = engine default. */
+  readonly topP?: number;
+  /** Max output tokens for the completion. Unset = engine default. */
+  readonly maxTokens?: number;
+  /** Stop sequences. Unset = engine default. */
+  readonly stop?: readonly string[];
+  /** Presence penalty. Unset = engine default. */
+  readonly presencePenalty?: number;
+  /** Frequency penalty. Unset = engine default. */
+  readonly frequencyPenalty?: number;
+  /**
+   * Reasoning effort, provider-specific (e.g. `low`/`medium`/`high`).
+   * Free-form string because the accepted set differs per provider.
+   * Unset = engine default.
+   */
+  readonly reasoningEffort?: string;
+  /** Extended-thinking token budget, provider-specific. Unset = engine default. */
+  readonly thinkingBudget?: number;
+}
+
 /**
  * Pin to a specific (modelId, providerSlug). The provider slug is
  * optional only when the modelId is globally unique across credentialed
  * providers for the org — when ambiguous, the resolver returns 400.
+ *
+ * Carries the optional {@link ModelOptions} sampling knobs (temperature,
+ * topP, maxTokens, …) — all pass-through-only, no platform default.
  */
-export interface ConcreteModelRef {
+export interface ConcreteModelRef extends ModelOptions {
   readonly kind: ModelRefKind.CONCRETE;
   readonly modelId: string;
   readonly providerSlug?: string;
-  readonly temperature?: number;
 }
 
 /**
  * Route through the existing `ModelStrategy` cascade for a given
  * `ModelClass`. The bound model can change without invalidating the
- * reference (lazy resolution).
+ * reference (lazy resolution). Carries the optional {@link ModelOptions}
+ * sampling knobs — all pass-through-only, no platform default.
  */
-export interface StrategyModelRef {
+export interface StrategyModelRef extends ModelOptions {
   readonly kind: ModelRefKind.STRATEGY;
   readonly modelClass: ModelClass;
-  readonly temperature?: number;
 }
 
 export type ModelRef = ConcreteModelRef | StrategyModelRef;
@@ -101,26 +144,47 @@ export function isStrategyModelRef(ref: ModelRef): ref is StrategyModelRef {
   return ref.kind === ModelRefKind.STRATEGY;
 }
 
+/**
+ * The INVOCATION-overlay fragment shared by EVERY "agent node" shape — the
+ * genuinely-identical trio that specializes a referenced agent WITHOUT
+ * authoring a new definition. Single declaration site (the
+ * `ModelRef`/`PermissionMap` reuse pattern): `CompositionNode`,
+ * `SubAgentBinding`, the compiled manifest agent block, and the typed
+ * workflow/session invocation overlays all `extends` this — the trio is
+ * never restated per shape.
+ *
+ * Identity floors always win (add-or-restrict, never widen):
+ *   - `modelOverride` — OVERRIDE: which model + how it samples
+ *     ({@link ModelOptions}). Resolver reads `modelOverride.temperature`
+ *     etc. to stamp sampling; omitted ⇒ the Model Resolution Matrix decides.
+ *   - `instructions`  — ADDITIVE: a prompt fragment layered AFTER the base
+ *     agent's `systemPrompt` (composite order: base prompt THEN this; the
+ *     platform `system-overlay.md` is injected LATER by the runtime).
+ *     Absent/blank ⇒ base prompt passes through unchanged (never an empty
+ *     append).
+ *   - `permission`    — RESTRICT-merge: a partial `PermissionMap`
+ *     deep-merged per top-level key OVER the base agent's authored
+ *     permission, BEFORE the system tiers run (`resolveAgentPermissions`).
+ *     A present key replaces the base's value for that key; absent keys
+ *     fall through. Omitted ⇒ base permissions unchanged. May only narrow.
+ */
+export interface NodeOverlayFragment {
+  readonly modelOverride?: ModelRef;
+  readonly instructions?: string;
+  readonly permission?: PermissionMap;
+}
+
 /**
  * A runtime attachment: "while this session/step runs, mount agent
- * `slug` as a delegate available to the primary, optionally with a
- * model override."
+ * `slug` as a delegate available to the primary, optionally specialized
+ * via the {@link NodeOverlayFragment} trio (model / instructions / permission)."
  *
  * Intrinsic delegates (those declared in the primary's own source
  * manifest under `permission.task.<slug>: allow`) are the floor — they
  * are always mounted and cannot be removed by any binding layer. A
- * binding on an intrinsic slug refines its model only.
+ * binding on an intrinsic slug refines its overlay only.
  */
-export interface SubAgentBinding {
+export interface SubAgentBinding extends NodeOverlayFragment {
   readonly slug: string;
   readonly alias?: string;
-  readonly modelOverride?: ModelRef;
-  /**
-   * Optional node-level instructions carried through from the authored
-   * manifest's `spec.agent.subAgents[].instructions` (WS5 Phase B). A prompt
-   * fragment the runtime layers ONTO the referenced base agent's intrinsic
-   * system prompt — the `base agent slug + instructions` lever. Absent = the
-   * base agent's prompt passes through unchanged.
-   */
-  readonly instructions?: string;
 }