@xemahq/kernel-contracts 0.3.6 → 0.3.7

package/dist/agent-composition/lib/composition-workspace.d.ts

@@ -1,5 +1,5 @@
 import type { WorkingFileBinding, WorkspaceEnvVar, WorkspacePersistenceSpec } from '../../agent-workspace';
-import type { AgentRunRole, OutputSurfaceKind } from '../../workflow';
+import type { AgentRunRole, CompiledManifestCredential, CompiledManifestPermissions, OutputSurfaceKind } from '../../workflow';
 export type { WorkingFileBinding, WorkspaceEnvVar, WorkspacePersistenceSpec, } from '../../agent-workspace';
 export declare enum CompositionOutputSurfaceMode {
     Single = "single",
@@ -31,5 +31,7 @@ export interface CompositionWorkspace {
     readonly outputSurface?: CompositionOutputSurface;
     readonly mountLayout?: CompositionMountLayout;
     readonly workingFiles?: readonly WorkingFileBinding[];
+    readonly credentials?: readonly CompiledManifestCredential[];
+    readonly permissions?: CompiledManifestPermissions;
 }
 //# sourceMappingURL=composition-workspace.d.ts.map

package/dist/agent-composition/lib/composition-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"composition-workspace.d.ts","sourceRoot":"","sources":["../../../src/agent-composition/lib/composition-workspace.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EACV,kBAAkB,EAClB,eAAe,EACf,wBAAwB,EACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,YAAY,EACZ,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,kBAAkB,EAClB,eAAe,EACf,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAQ/B,oBAAY,4BAA4B;IACtC,MAAM,WAAW;IACjB,KAAK,UAAU;CAChB;AAsBD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAE5B,QAAQ,CAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC;IAM7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAMvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAcD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AA6BD,MAAM,WAAW,sBAAsB;IAOrC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEnD,QAAQ,CAAC,cAAc,EAAE,yBAAyB,CAAC;IAOnD,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAOjE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAQD,MAAM,WAAW,oBAAoB;IAKnC,QAAQ,CAAC,WAAW,CAAC,EAAE,wBAAwB,CAAC;IAOhD,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAK1C,QAAQ,CAAC,aAAa,CAAC,EAAE,wBAAwB,CAAC;IAQlD,QAAQ,CAAC,WAAW,CAAC,EAAE,sBAAsB,CAAC;IAgB9C,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACvD"}
+{"version":3,"file":"composition-workspace.d.ts","sourceRoot":"","sources":["../../../src/agent-composition/lib/composition-workspace.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EACV,kBAAkB,EAClB,eAAe,EACf,wBAAwB,EACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,YAAY,EACZ,0BAA0B,EAC1B,2BAA2B,EAC3B,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,kBAAkB,EAClB,eAAe,EACf,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAQ/B,oBAAY,4BAA4B;IACtC,MAAM,WAAW;IACjB,KAAK,UAAU;CAChB;AAsBD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAE5B,QAAQ,CAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC;IAM7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAMvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAcD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AA6BD,MAAM,WAAW,sBAAsB;IAOrC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEnD,QAAQ,CAAC,cAAc,EAAE,yBAAyB,CAAC;IAOnD,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAOjE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAQD,MAAM,WAAW,oBAAoB;IAKnC,QAAQ,CAAC,WAAW,CAAC,EAAE,wBAAwB,CAAC;IAOhD,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAK1C,QAAQ,CAAC,aAAa,CAAC,EAAE,wBAAwB,CAAC;IAQlD,QAAQ,CAAC,WAAW,CAAC,EAAE,sBAAsB,CAAC;IAgB9C,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAWtD,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAW7D,QAAQ,CAAC,WAAW,CAAC,EAAE,2BAA2B,CAAC;CACpD"}

package/dist/agent-composition/lib/composition-workspace.js.map

@@ -1 +1 @@
-{"version":3,"file":"composition-workspace.js","sourceRoot":"","sources":["../../../src/agent-composition/lib/composition-workspace.ts"],"names":[],"mappings":";;;AA2CA,IAAY,4BAGX;AAHD,WAAY,4BAA4B;IACtC,iDAAiB,CAAA;IACjB,+CAAe,CAAA;AACjB,CAAC,EAHW,4BAA4B,4CAA5B,4BAA4B,QAGvC"}
+{"version":3,"file":"composition-workspace.js","sourceRoot":"","sources":["../../../src/agent-composition/lib/composition-workspace.ts"],"names":[],"mappings":";;;AA6CA,IAAY,4BAGX;AAHD,WAAY,4BAA4B;IACtC,iDAAiB,CAAA;IACjB,+CAAe,CAAA;AACjB,CAAC,EAHW,4BAA4B,4CAA5B,4BAA4B,QAGvC"}

package/dist/agent-workspace/awp-spec.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://xema.dev/schemas/awp-spec.v1.json",
-  "emittedAt": "2026-06-12T12:44:29.614Z",
+  "emittedAt": "2026-06-12T14:43:51.031Z",
   "spec": {
     "id": "awp/v1",
     "version": "1.2.0",

package/dist/workflow/lib/errors.d.ts

@@ -11,6 +11,7 @@ export declare enum WorkflowErrorCode {
     DSL_UNKNOWN_DELIVERABLE_FIELD = "DSL_UNKNOWN_DELIVERABLE_FIELD",
     DSL_VERSION_NOT_RESOLVABLE = "DSL_VERSION_NOT_RESOLVABLE",
     DSL_PERMISSION_ESCALATION = "DSL_PERMISSION_ESCALATION",
+    DSL_VARS_BRIEFCASE_COLLISION = "DSL_VARS_BRIEFCASE_COLLISION",
     DSL_MATRIX_KEY_NOT_DECLARED = "DSL_MATRIX_KEY_NOT_DECLARED",
     DSL_INVALID_MATRIX_OUTPUT_ACCESS = "DSL_INVALID_MATRIX_OUTPUT_ACCESS",
     DSL_FIELD_NOT_TYPED = "DSL_FIELD_NOT_TYPED",

package/dist/workflow/lib/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/workflow/lib/errors.ts"],"names":[],"mappings":"AAUA,oBAAY,iBAAiB;IAE3B,kBAAkB,uBAAuB;IACzC,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IACjD,kBAAkB,uBAAuB;IACzC,+BAA+B,oCAAoC;IACnE,kBAAkB,uBAAuB;IACzC,6BAA6B,kCAAkC;IAO/D,iBAAiB,sBAAsB;IAMvC,4BAA4B,iCAAiC;IAS7D,6BAA6B,kCAAkC;IAC/D,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IAOvD,2BAA2B,gCAAgC;IAS3D,gCAAgC,qCAAqC;IAWrE,mBAAmB,wBAAwB;IAM3C,uBAAuB,4BAA4B;IAGnD,gBAAgB,qBAAqB;IAOrC,2BAA2B,gCAAgC;IAG3D,qBAAqB,0BAA0B;IAC/C,yBAAyB,8BAA8B;IACvD,wBAAwB,6BAA6B;IACrD,4BAA4B,iCAAiC;IAC7D,+BAA+B,oCAAoC;IAMnE,4BAA4B,iCAAiC;IAM7D,uCAAuC,4CAA4C;IACnF,2BAA2B,gCAAgC;IAC3D,4BAA4B,iCAAiC;IAU7D,uBAAuB,4BAA4B;IASnD,6BAA6B,kCAAkC;IAS/D,0BAA0B,+BAA+B;IASzD,yBAAyB,8BAA8B;CACxD;AAGD,eAAO,MAAM,kCAAkC,EAAE,SAAS,iBAAiB,EAuBjE,CAAC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/workflow/lib/errors.ts"],"names":[],"mappings":"AAUA,oBAAY,iBAAiB;IAE3B,kBAAkB,uBAAuB;IACzC,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IACjD,kBAAkB,uBAAuB;IACzC,+BAA+B,oCAAoC;IACnE,kBAAkB,uBAAuB;IACzC,6BAA6B,kCAAkC;IAO/D,iBAAiB,sBAAsB;IAMvC,4BAA4B,iCAAiC;IAS7D,6BAA6B,kCAAkC;IAC/D,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IAcvD,4BAA4B,iCAAiC;IAO7D,2BAA2B,gCAAgC;IAS3D,gCAAgC,qCAAqC;IAWrE,mBAAmB,wBAAwB;IAM3C,uBAAuB,4BAA4B;IAGnD,gBAAgB,qBAAqB;IAOrC,2BAA2B,gCAAgC;IAG3D,qBAAqB,0BAA0B;IAC/C,yBAAyB,8BAA8B;IACvD,wBAAwB,6BAA6B;IACrD,4BAA4B,iCAAiC;IAC7D,+BAA+B,oCAAoC;IAMnE,4BAA4B,iCAAiC;IAM7D,uCAAuC,4CAA4C;IACnF,2BAA2B,gCAAgC;IAC3D,4BAA4B,iCAAiC;IAU7D,uBAAuB,4BAA4B;IASnD,6BAA6B,kCAAkC;IAS/D,0BAA0B,+BAA+B;IASzD,yBAAyB,8BAA8B;CACxD;AAGD,eAAO,MAAM,kCAAkC,EAAE,SAAS,iBAAiB,EAwBjE,CAAC"}

package/dist/workflow/lib/errors.js

@@ -15,6 +15,7 @@ var WorkflowErrorCode;
     WorkflowErrorCode["DSL_UNKNOWN_DELIVERABLE_FIELD"] = "DSL_UNKNOWN_DELIVERABLE_FIELD";
     WorkflowErrorCode["DSL_VERSION_NOT_RESOLVABLE"] = "DSL_VERSION_NOT_RESOLVABLE";
     WorkflowErrorCode["DSL_PERMISSION_ESCALATION"] = "DSL_PERMISSION_ESCALATION";
+    WorkflowErrorCode["DSL_VARS_BRIEFCASE_COLLISION"] = "DSL_VARS_BRIEFCASE_COLLISION";
     WorkflowErrorCode["DSL_MATRIX_KEY_NOT_DECLARED"] = "DSL_MATRIX_KEY_NOT_DECLARED";
     WorkflowErrorCode["DSL_INVALID_MATRIX_OUTPUT_ACCESS"] = "DSL_INVALID_MATRIX_OUTPUT_ACCESS";
     WorkflowErrorCode["DSL_FIELD_NOT_TYPED"] = "DSL_FIELD_NOT_TYPED";
@@ -48,6 +49,7 @@ exports.NON_RETRYABLE_WORKFLOW_ERROR_CODES = [
     WorkflowErrorCode.DSL_UNKNOWN_DELIVERABLE_FIELD,
     WorkflowErrorCode.DSL_VERSION_NOT_RESOLVABLE,
     WorkflowErrorCode.DSL_PERMISSION_ESCALATION,
+    WorkflowErrorCode.DSL_VARS_BRIEFCASE_COLLISION,
     WorkflowErrorCode.DSL_MATRIX_KEY_NOT_DECLARED,
     WorkflowErrorCode.DSL_INVALID_MATRIX_OUTPUT_ACCESS,
     WorkflowErrorCode.DSL_FIELD_NOT_TYPED,

package/dist/workflow/lib/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/workflow/lib/errors.ts"],"names":[],"mappings":";;;AAUA,IAAY,iBAsIX;AAtID,WAAY,iBAAiB;IAE3B,8DAAyC,CAAA;IACzC,kEAA6C,CAAA;IAC7C,sEAAiD,CAAA;IACjD,8DAAyC,CAAA;IACzC,wFAAmE,CAAA;IACnE,8DAAyC,CAAA;IACzC,oFAA+D,CAAA;IAO/D,4DAAuC,CAAA;IAMvC,kFAA6D,CAAA;IAS7D,oFAA+D,CAAA;IAC/D,8EAAyD,CAAA;IACzD,4EAAuD,CAAA;IAOvD,gFAA2D,CAAA;IAS3D,0FAAqE,CAAA;IAWrE,gEAA2C,CAAA;IAM3C,wEAAmD,CAAA;IAGnD,0DAAqC,CAAA;IAOrC,gFAA2D,CAAA;IAG3D,oEAA+C,CAAA;IAC/C,4EAAuD,CAAA;IACvD,0EAAqD,CAAA;IACrD,kFAA6D,CAAA;IAC7D,wFAAmE,CAAA;IAMnE,kFAA6D,CAAA;IAM7D,wGAAmF,CAAA;IACnF,gFAA2D,CAAA;IAC3D,kFAA6D,CAAA;IAU7D,wEAAmD,CAAA;IASnD,oFAA+D,CAAA;IAS/D,8EAAyD,CAAA;IASzD,4EAAuD,CAAA;AACzD,CAAC,EAtIW,iBAAiB,iCAAjB,iBAAiB,QAsI5B;AAGY,QAAA,kCAAkC,GAAiC;IAC9E,iBAAiB,CAAC,kBAAkB;IACpC,iBAAiB,CAAC,oBAAoB;IACtC,iBAAiB,CAAC,sBAAsB;IACxC,iBAAiB,CAAC,kBAAkB;IACpC,iBAAiB,CAAC,+BAA+B;IACjD,iBAAiB,CAAC,kBAAkB;IACpC,iBAAiB,CAAC,6BAA6B;IAC/C,iBAAiB,CAAC,iBAAiB;IACnC,iBAAiB,CAAC,4BAA4B;IAC9C,iBAAiB,CAAC,6BAA6B;IAC/C,iBAAiB,CAAC,0BAA0B;IAC5C,iBAAiB,CAAC,yBAAyB;IAC3C,iBAAiB,CAAC,2BAA2B;IAC7C,iBAAiB,CAAC,gCAAgC;IAClD,iBAAiB,CAAC,mBAAmB;IACrC,iBAAiB,CAAC,uBAAuB;IACzC,iBAAiB,CAAC,yBAAyB;IAC3C,iBAAiB,CAAC,wBAAwB;IAC1C,iBAAiB,CAAC,+BAA+B;IACjD,iBAAiB,CAAC,4BAA4B;IAC9C,iBAAiB,CAAC,uCAAuC;IACzD,iBAAiB,CAAC,6BAA6B;CACvC,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/workflow/lib/errors.ts"],"names":[],"mappings":";;;AAUA,IAAY,iBAoJX;AApJD,WAAY,iBAAiB;IAE3B,8DAAyC,CAAA;IACzC,kEAA6C,CAAA;IAC7C,sEAAiD,CAAA;IACjD,8DAAyC,CAAA;IACzC,wFAAmE,CAAA;IACnE,8DAAyC,CAAA;IACzC,oFAA+D,CAAA;IAO/D,4DAAuC,CAAA;IAMvC,kFAA6D,CAAA;IAS7D,oFAA+D,CAAA;IAC/D,8EAAyD,CAAA;IACzD,4EAAuD,CAAA;IAcvD,kFAA6D,CAAA;IAO7D,gFAA2D,CAAA;IAS3D,0FAAqE,CAAA;IAWrE,gEAA2C,CAAA;IAM3C,wEAAmD,CAAA;IAGnD,0DAAqC,CAAA;IAOrC,gFAA2D,CAAA;IAG3D,oEAA+C,CAAA;IAC/C,4EAAuD,CAAA;IACvD,0EAAqD,CAAA;IACrD,kFAA6D,CAAA;IAC7D,wFAAmE,CAAA;IAMnE,kFAA6D,CAAA;IAM7D,wGAAmF,CAAA;IACnF,gFAA2D,CAAA;IAC3D,kFAA6D,CAAA;IAU7D,wEAAmD,CAAA;IASnD,oFAA+D,CAAA;IAS/D,8EAAyD,CAAA;IASzD,4EAAuD,CAAA;AACzD,CAAC,EApJW,iBAAiB,iCAAjB,iBAAiB,QAoJ5B;AAGY,QAAA,kCAAkC,GAAiC;IAC9E,iBAAiB,CAAC,kBAAkB;IACpC,iBAAiB,CAAC,oBAAoB;IACtC,iBAAiB,CAAC,sBAAsB;IACxC,iBAAiB,CAAC,kBAAkB;IACpC,iBAAiB,CAAC,+BAA+B;IACjD,iBAAiB,CAAC,kBAAkB;IACpC,iBAAiB,CAAC,6BAA6B;IAC/C,iBAAiB,CAAC,iBAAiB;IACnC,iBAAiB,CAAC,4BAA4B;IAC9C,iBAAiB,CAAC,6BAA6B;IAC/C,iBAAiB,CAAC,0BAA0B;IAC5C,iBAAiB,CAAC,yBAAyB;IAC3C,iBAAiB,CAAC,4BAA4B;IAC9C,iBAAiB,CAAC,2BAA2B;IAC7C,iBAAiB,CAAC,gCAAgC;IAClD,iBAAiB,CAAC,mBAAmB;IACrC,iBAAiB,CAAC,uBAAuB;IACzC,iBAAiB,CAAC,yBAAyB;IAC3C,iBAAiB,CAAC,wBAAwB;IAC1C,iBAAiB,CAAC,+BAA+B;IACjD,iBAAiB,CAAC,4BAA4B;IAC9C,iBAAiB,CAAC,uCAAuC;IACzD,iBAAiB,CAAC,6BAA6B;CACvC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/kernel-contracts",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the 32 kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework/runtime deps.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/src/agent-composition/lib/composition-workspace.ts

@@ -26,6 +26,8 @@ import type {
 } from '../../agent-workspace';
 import type {
   AgentRunRole,
+  CompiledManifestCredential,
+  CompiledManifestPermissions,
   OutputSurfaceKind,
 } from '../../workflow';
 
@@ -207,4 +209,26 @@ export interface CompositionWorkspace {
    * engine idle.
    */
   readonly workingFiles?: readonly WorkingFileBinding[];
+  /**
+   * Authored external-credential requirements — the manifest's
+   * `spec.credentials` block, carried verbatim from the compiled
+   * manifest. The composition boot-seeder projects it from the source
+   * workspace manifest; the `agent-session-runtime` composer surfaces it
+   * onto the reconstructed manifest `spec` so the environment resolver
+   * (and resume drift detection) see the authored credential set.
+   * Optional + additive — compositions needing no credentials omit it.
+   * Was silently DROPPED at seed before (BUG-1).
+   */
+  readonly credentials?: readonly CompiledManifestCredential[];
+  /**
+   * Authored tool allow/deny permission sets — the manifest's
+   * `spec.permissions` block, carried verbatim from the compiled
+   * manifest. Same seed → compose → resolve path as {@link credentials};
+   * consumed by the environment resolver + resume drift detection.
+   * Optional + additive. Distinct from the per-node
+   * {@link CompositionNode.permission} overlay — this is the workspace
+   * toolset policy, not the agent's permission map. Was silently DROPPED
+   * at seed before (BUG-1).
+   */
+  readonly permissions?: CompiledManifestPermissions;
 }

package/src/workflow/lib/errors.ts

@@ -41,6 +41,20 @@ export enum WorkflowErrorCode {
   DSL_UNKNOWN_DELIVERABLE_FIELD = 'DSL_UNKNOWN_DELIVERABLE_FIELD',
   DSL_VERSION_NOT_RESOLVABLE = 'DSL_VERSION_NOT_RESOLVABLE',
   DSL_PERMISSION_ESCALATION = 'DSL_PERMISSION_ESCALATION',
+  /**
+   * A run was dispatched whose Briefcase declares a `vars` key that
+   * collides with a top-level workflow `vars:` key. The two namespaces
+   * are distinct by design — workflow `vars:` is author-owned config
+   * surfaced in the `${{ vars.X }}` expression namespace, while
+   * Briefcase `vars` are run-scoped facts read imperatively by
+   * activities (`getVar` / `requireVar`). A key present in BOTH is an
+   * ambiguity: the expression namespace would resolve the workflow
+   * value while an activity accessor would resolve the briefcase value,
+   * silently disagreeing under the same name. The compiler fails fast at
+   * the single folding point (`compileWorkflow`) so the dispatcher must
+   * rename one side instead of getting last-wins behavior at runtime.
+   */
+  DSL_VARS_BRIEFCASE_COLLISION = 'DSL_VARS_BRIEFCASE_COLLISION',
   /**
    * A consumer expression dereferences `needs.<X>.outputs.byKey[…]` but
    * `<X>` is either not a matrix job, or is matrix without `keyBy:`
@@ -158,6 +172,7 @@ export const NON_RETRYABLE_WORKFLOW_ERROR_CODES: readonly WorkflowErrorCode[] =
   WorkflowErrorCode.DSL_UNKNOWN_DELIVERABLE_FIELD,
   WorkflowErrorCode.DSL_VERSION_NOT_RESOLVABLE,
   WorkflowErrorCode.DSL_PERMISSION_ESCALATION,
+  WorkflowErrorCode.DSL_VARS_BRIEFCASE_COLLISION,
   WorkflowErrorCode.DSL_MATRIX_KEY_NOT_DECLARED,
   WorkflowErrorCode.DSL_INVALID_MATRIX_OUTPUT_ACCESS,
   WorkflowErrorCode.DSL_FIELD_NOT_TYPED,