@xemahq/kernel-contracts 0.3.6 → 0.4.0

package/dist/agent-composition/lib/composition-workspace.d.ts

@@ -1,5 +1,5 @@
 import type { WorkingFileBinding, WorkspaceEnvVar, WorkspacePersistenceSpec } from '../../agent-workspace';
-import type { AgentRunRole, OutputSurfaceKind } from '../../workflow';
+import type { AgentRunRole, CompiledManifestCredential, CompiledManifestPermissions, OutputSurfaceKind } from '../../workflow';
 export type { WorkingFileBinding, WorkspaceEnvVar, WorkspacePersistenceSpec, } from '../../agent-workspace';
 export declare enum CompositionOutputSurfaceMode {
     Single = "single",
@@ -15,7 +15,7 @@ export interface CompositionOutputSurface {
     readonly defaultDocument?: string;
 }
 export interface CompositionAgentRunConfig {
-    readonly phase: string;
+    readonly stage: string;
     readonly role: AgentRunRole;
     readonly deliverableSpecRef?: string;
 }
@@ -31,5 +31,7 @@ export interface CompositionWorkspace {
     readonly outputSurface?: CompositionOutputSurface;
     readonly mountLayout?: CompositionMountLayout;
     readonly workingFiles?: readonly WorkingFileBinding[];
+    readonly credentials?: readonly CompiledManifestCredential[];
+    readonly permissions?: CompiledManifestPermissions;
 }
 //# sourceMappingURL=composition-workspace.d.ts.map

package/dist/agent-composition/lib/composition-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"composition-workspace.d.ts","sourceRoot":"","sources":["../../../src/agent-composition/lib/composition-workspace.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EACV,kBAAkB,EAClB,eAAe,EACf,wBAAwB,EACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,YAAY,EACZ,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,kBAAkB,EAClB,eAAe,EACf,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAQ/B,oBAAY,4BAA4B;IACtC,MAAM,WAAW;IACjB,KAAK,UAAU;CAChB;AAsBD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAE5B,QAAQ,CAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC;IAM7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAMvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAcD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AA6BD,MAAM,WAAW,sBAAsB;IAOrC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEnD,QAAQ,CAAC,cAAc,EAAE,yBAAyB,CAAC;IAOnD,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAOjE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAQD,MAAM,WAAW,oBAAoB;IAKnC,QAAQ,CAAC,WAAW,CAAC,EAAE,wBAAwB,CAAC;IAOhD,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAK1C,QAAQ,CAAC,aAAa,CAAC,EAAE,wBAAwB,CAAC;IAQlD,QAAQ,CAAC,WAAW,CAAC,EAAE,sBAAsB,CAAC;IAgB9C,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACvD"}
+{"version":3,"file":"composition-workspace.d.ts","sourceRoot":"","sources":["../../../src/agent-composition/lib/composition-workspace.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EACV,kBAAkB,EAClB,eAAe,EACf,wBAAwB,EACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,YAAY,EACZ,0BAA0B,EAC1B,2BAA2B,EAC3B,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,kBAAkB,EAClB,eAAe,EACf,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAQ/B,oBAAY,4BAA4B;IACtC,MAAM,WAAW;IACjB,KAAK,UAAU;CAChB;AAsBD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAE5B,QAAQ,CAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC;IAM7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAMvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAcD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AA6BD,MAAM,WAAW,sBAAsB;IAOrC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEnD,QAAQ,CAAC,cAAc,EAAE,yBAAyB,CAAC;IAOnD,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAOjE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAQD,MAAM,WAAW,oBAAoB;IAKnC,QAAQ,CAAC,WAAW,CAAC,EAAE,wBAAwB,CAAC;IAOhD,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAK1C,QAAQ,CAAC,aAAa,CAAC,EAAE,wBAAwB,CAAC;IAQlD,QAAQ,CAAC,WAAW,CAAC,EAAE,sBAAsB,CAAC;IAgB9C,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAWtD,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAW7D,QAAQ,CAAC,WAAW,CAAC,EAAE,2BAA2B,CAAC;CACpD"}

package/dist/agent-composition/lib/composition-workspace.js.map

@@ -1 +1 @@
-{"version":3,"file":"composition-workspace.js","sourceRoot":"","sources":["../../../src/agent-composition/lib/composition-workspace.ts"],"names":[],"mappings":";;;AA2CA,IAAY,4BAGX;AAHD,WAAY,4BAA4B;IACtC,iDAAiB,CAAA;IACjB,+CAAe,CAAA;AACjB,CAAC,EAHW,4BAA4B,4CAA5B,4BAA4B,QAGvC"}
+{"version":3,"file":"composition-workspace.js","sourceRoot":"","sources":["../../../src/agent-composition/lib/composition-workspace.ts"],"names":[],"mappings":";;;AA6CA,IAAY,4BAGX;AAHD,WAAY,4BAA4B;IACtC,iDAAiB,CAAA;IACjB,+CAAe,CAAA;AACjB,CAAC,EAHW,4BAA4B,4CAA5B,4BAA4B,QAGvC"}

package/dist/agent-composition/lib/model-resolution-matrix.d.ts

@@ -3,14 +3,14 @@ export declare enum ResolutionDimension {
     Agent = "agent",
     Skill = "skill",
     Project = "project",
-    Group = "group",
+    Stage = "stage",
     Purpose = "purpose"
 }
 export interface ModelMatrixSelector {
     readonly agent?: string;
     readonly skill?: string;
     readonly project?: string;
-    readonly group?: string;
+    readonly stage?: string;
     readonly purpose?: string;
     readonly extra?: Readonly<Record<string, string>>;
 }
@@ -24,7 +24,7 @@ export interface ModelResolutionContext {
     readonly agentSlug: string;
     readonly projectId?: string;
     readonly skillSlug?: string;
-    readonly groupKey?: string;
+    readonly stageKey?: string;
     readonly purpose?: string;
     readonly extra?: Readonly<Record<string, string>>;
 }

package/dist/agent-composition/lib/model-resolution-matrix.js

@@ -6,7 +6,7 @@ var ResolutionDimension;
     ResolutionDimension["Agent"] = "agent";
     ResolutionDimension["Skill"] = "skill";
     ResolutionDimension["Project"] = "project";
-    ResolutionDimension["Group"] = "group";
+    ResolutionDimension["Stage"] = "stage";
     ResolutionDimension["Purpose"] = "purpose";
 })(ResolutionDimension || (exports.ResolutionDimension = ResolutionDimension = {}));
 //# sourceMappingURL=model-resolution-matrix.js.map

package/dist/agent-workspace/awp-spec.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://xema.dev/schemas/awp-spec.v1.json",
-  "emittedAt": "2026-06-12T12:44:29.614Z",
+  "emittedAt": "2026-06-13T09:08:25.716Z",
   "spec": {
     "id": "awp/v1",
     "version": "1.2.0",

package/dist/agent-workspace/lib/context-json.d.ts

@@ -8,7 +8,7 @@ export interface ContextInvocation {
     readonly surface: InvocationSurface;
     readonly attempt: number;
     readonly runId: string | null;
-    readonly groupKey: string | null;
+    readonly stageKey: string | null;
     readonly sessionId: string | null;
 }
 export interface ContextAuthority {

package/dist/llm-gateway/lib/caller.d.ts

@@ -9,6 +9,6 @@ export interface LlmCaller {
     id: string;
     orgId: string;
     projectId?: string;
-    groupKey?: string;
+    stageKey?: string;
 }
 //# sourceMappingURL=caller.d.ts.map

package/dist/workflow/lib/compiled-workspace-manifest.d.ts

@@ -28,7 +28,7 @@ export interface CompiledWorkspaceManifest {
 }
 export interface CompiledManifestAgent {
     readonly slug: string;
-    readonly groupKey: string;
+    readonly stageKey: string;
     readonly role: AgentRunRole;
     readonly deliverableSpecRef?: string;
     readonly defaultModel?: ModelRef;

package/dist/workflow/lib/errors.d.ts

@@ -11,6 +11,7 @@ export declare enum WorkflowErrorCode {
     DSL_UNKNOWN_DELIVERABLE_FIELD = "DSL_UNKNOWN_DELIVERABLE_FIELD",
     DSL_VERSION_NOT_RESOLVABLE = "DSL_VERSION_NOT_RESOLVABLE",
     DSL_PERMISSION_ESCALATION = "DSL_PERMISSION_ESCALATION",
+    DSL_VARS_BRIEFCASE_COLLISION = "DSL_VARS_BRIEFCASE_COLLISION",
     DSL_MATRIX_KEY_NOT_DECLARED = "DSL_MATRIX_KEY_NOT_DECLARED",
     DSL_INVALID_MATRIX_OUTPUT_ACCESS = "DSL_INVALID_MATRIX_OUTPUT_ACCESS",
     DSL_FIELD_NOT_TYPED = "DSL_FIELD_NOT_TYPED",

package/dist/workflow/lib/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/workflow/lib/errors.ts"],"names":[],"mappings":"AAUA,oBAAY,iBAAiB;IAE3B,kBAAkB,uBAAuB;IACzC,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IACjD,kBAAkB,uBAAuB;IACzC,+BAA+B,oCAAoC;IACnE,kBAAkB,uBAAuB;IACzC,6BAA6B,kCAAkC;IAO/D,iBAAiB,sBAAsB;IAMvC,4BAA4B,iCAAiC;IAS7D,6BAA6B,kCAAkC;IAC/D,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IAOvD,2BAA2B,gCAAgC;IAS3D,gCAAgC,qCAAqC;IAWrE,mBAAmB,wBAAwB;IAM3C,uBAAuB,4BAA4B;IAGnD,gBAAgB,qBAAqB;IAOrC,2BAA2B,gCAAgC;IAG3D,qBAAqB,0BAA0B;IAC/C,yBAAyB,8BAA8B;IACvD,wBAAwB,6BAA6B;IACrD,4BAA4B,iCAAiC;IAC7D,+BAA+B,oCAAoC;IAMnE,4BAA4B,iCAAiC;IAM7D,uCAAuC,4CAA4C;IACnF,2BAA2B,gCAAgC;IAC3D,4BAA4B,iCAAiC;IAU7D,uBAAuB,4BAA4B;IASnD,6BAA6B,kCAAkC;IAS/D,0BAA0B,+BAA+B;IASzD,yBAAyB,8BAA8B;CACxD;AAGD,eAAO,MAAM,kCAAkC,EAAE,SAAS,iBAAiB,EAuBjE,CAAC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/workflow/lib/errors.ts"],"names":[],"mappings":"AAUA,oBAAY,iBAAiB;IAE3B,kBAAkB,uBAAuB;IACzC,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IACjD,kBAAkB,uBAAuB;IACzC,+BAA+B,oCAAoC;IACnE,kBAAkB,uBAAuB;IACzC,6BAA6B,kCAAkC;IAO/D,iBAAiB,sBAAsB;IAMvC,4BAA4B,iCAAiC;IAS7D,6BAA6B,kCAAkC;IAC/D,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IAcvD,4BAA4B,iCAAiC;IAO7D,2BAA2B,gCAAgC;IAS3D,gCAAgC,qCAAqC;IAWrE,mBAAmB,wBAAwB;IAM3C,uBAAuB,4BAA4B;IAGnD,gBAAgB,qBAAqB;IAOrC,2BAA2B,gCAAgC;IAG3D,qBAAqB,0BAA0B;IAC/C,yBAAyB,8BAA8B;IACvD,wBAAwB,6BAA6B;IACrD,4BAA4B,iCAAiC;IAC7D,+BAA+B,oCAAoC;IAMnE,4BAA4B,iCAAiC;IAM7D,uCAAuC,4CAA4C;IACnF,2BAA2B,gCAAgC;IAC3D,4BAA4B,iCAAiC;IAU7D,uBAAuB,4BAA4B;IASnD,6BAA6B,kCAAkC;IAS/D,0BAA0B,+BAA+B;IASzD,yBAAyB,8BAA8B;CACxD;AAGD,eAAO,MAAM,kCAAkC,EAAE,SAAS,iBAAiB,EAwBjE,CAAC"}

package/dist/workflow/lib/errors.js

@@ -15,6 +15,7 @@ var WorkflowErrorCode;
     WorkflowErrorCode["DSL_UNKNOWN_DELIVERABLE_FIELD"] = "DSL_UNKNOWN_DELIVERABLE_FIELD";
     WorkflowErrorCode["DSL_VERSION_NOT_RESOLVABLE"] = "DSL_VERSION_NOT_RESOLVABLE";
     WorkflowErrorCode["DSL_PERMISSION_ESCALATION"] = "DSL_PERMISSION_ESCALATION";
+    WorkflowErrorCode["DSL_VARS_BRIEFCASE_COLLISION"] = "DSL_VARS_BRIEFCASE_COLLISION";
     WorkflowErrorCode["DSL_MATRIX_KEY_NOT_DECLARED"] = "DSL_MATRIX_KEY_NOT_DECLARED";
     WorkflowErrorCode["DSL_INVALID_MATRIX_OUTPUT_ACCESS"] = "DSL_INVALID_MATRIX_OUTPUT_ACCESS";
     WorkflowErrorCode["DSL_FIELD_NOT_TYPED"] = "DSL_FIELD_NOT_TYPED";
@@ -48,6 +49,7 @@ exports.NON_RETRYABLE_WORKFLOW_ERROR_CODES = [
     WorkflowErrorCode.DSL_UNKNOWN_DELIVERABLE_FIELD,
     WorkflowErrorCode.DSL_VERSION_NOT_RESOLVABLE,
     WorkflowErrorCode.DSL_PERMISSION_ESCALATION,
+    WorkflowErrorCode.DSL_VARS_BRIEFCASE_COLLISION,
     WorkflowErrorCode.DSL_MATRIX_KEY_NOT_DECLARED,
     WorkflowErrorCode.DSL_INVALID_MATRIX_OUTPUT_ACCESS,
     WorkflowErrorCode.DSL_FIELD_NOT_TYPED,

package/dist/workflow/lib/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/workflow/lib/errors.ts"],"names":[],"mappings":";;;AAUA,IAAY,iBAsIX;AAtID,WAAY,iBAAiB;IAE3B,8DAAyC,CAAA;IACzC,kEAA6C,CAAA;IAC7C,sEAAiD,CAAA;IACjD,8DAAyC,CAAA;IACzC,wFAAmE,CAAA;IACnE,8DAAyC,CAAA;IACzC,oFAA+D,CAAA;IAO/D,4DAAuC,CAAA;IAMvC,kFAA6D,CAAA;IAS7D,oFAA+D,CAAA;IAC/D,8EAAyD,CAAA;IACzD,4EAAuD,CAAA;IAOvD,gFAA2D,CAAA;IAS3D,0FAAqE,CAAA;IAWrE,gEAA2C,CAAA;IAM3C,wEAAmD,CAAA;IAGnD,0DAAqC,CAAA;IAOrC,gFAA2D,CAAA;IAG3D,oEAA+C,CAAA;IAC/C,4EAAuD,CAAA;IACvD,0EAAqD,CAAA;IACrD,kFAA6D,CAAA;IAC7D,wFAAmE,CAAA;IAMnE,kFAA6D,CAAA;IAM7D,wGAAmF,CAAA;IACnF,gFAA2D,CAAA;IAC3D,kFAA6D,CAAA;IAU7D,wEAAmD,CAAA;IASnD,oFAA+D,CAAA;IAS/D,8EAAyD,CAAA;IASzD,4EAAuD,CAAA;AACzD,CAAC,EAtIW,iBAAiB,iCAAjB,iBAAiB,QAsI5B;AAGY,QAAA,kCAAkC,GAAiC;IAC9E,iBAAiB,CAAC,kBAAkB;IACpC,iBAAiB,CAAC,oBAAoB;IACtC,iBAAiB,CAAC,sBAAsB;IACxC,iBAAiB,CAAC,kBAAkB;IACpC,iBAAiB,CAAC,+BAA+B;IACjD,iBAAiB,CAAC,kBAAkB;IACpC,iBAAiB,CAAC,6BAA6B;IAC/C,iBAAiB,CAAC,iBAAiB;IACnC,iBAAiB,CAAC,4BAA4B;IAC9C,iBAAiB,CAAC,6BAA6B;IAC/C,iBAAiB,CAAC,0BAA0B;IAC5C,iBAAiB,CAAC,yBAAyB;IAC3C,iBAAiB,CAAC,2BAA2B;IAC7C,iBAAiB,CAAC,gCAAgC;IAClD,iBAAiB,CAAC,mBAAmB;IACrC,iBAAiB,CAAC,uBAAuB;IACzC,iBAAiB,CAAC,yBAAyB;IAC3C,iBAAiB,CAAC,wBAAwB;IAC1C,iBAAiB,CAAC,+BAA+B;IACjD,iBAAiB,CAAC,4BAA4B;IAC9C,iBAAiB,CAAC,uCAAuC;IACzD,iBAAiB,CAAC,6BAA6B;CACvC,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/workflow/lib/errors.ts"],"names":[],"mappings":";;;AAUA,IAAY,iBAoJX;AApJD,WAAY,iBAAiB;IAE3B,8DAAyC,CAAA;IACzC,kEAA6C,CAAA;IAC7C,sEAAiD,CAAA;IACjD,8DAAyC,CAAA;IACzC,wFAAmE,CAAA;IACnE,8DAAyC,CAAA;IACzC,oFAA+D,CAAA;IAO/D,4DAAuC,CAAA;IAMvC,kFAA6D,CAAA;IAS7D,oFAA+D,CAAA;IAC/D,8EAAyD,CAAA;IACzD,4EAAuD,CAAA;IAcvD,kFAA6D,CAAA;IAO7D,gFAA2D,CAAA;IAS3D,0FAAqE,CAAA;IAWrE,gEAA2C,CAAA;IAM3C,wEAAmD,CAAA;IAGnD,0DAAqC,CAAA;IAOrC,gFAA2D,CAAA;IAG3D,oEAA+C,CAAA;IAC/C,4EAAuD,CAAA;IACvD,0EAAqD,CAAA;IACrD,kFAA6D,CAAA;IAC7D,wFAAmE,CAAA;IAMnE,kFAA6D,CAAA;IAM7D,wGAAmF,CAAA;IACnF,gFAA2D,CAAA;IAC3D,kFAA6D,CAAA;IAU7D,wEAAmD,CAAA;IASnD,oFAA+D,CAAA;IAS/D,8EAAyD,CAAA;IASzD,4EAAuD,CAAA;AACzD,CAAC,EApJW,iBAAiB,iCAAjB,iBAAiB,QAoJ5B;AAGY,QAAA,kCAAkC,GAAiC;IAC9E,iBAAiB,CAAC,kBAAkB;IACpC,iBAAiB,CAAC,oBAAoB;IACtC,iBAAiB,CAAC,sBAAsB;IACxC,iBAAiB,CAAC,kBAAkB;IACpC,iBAAiB,CAAC,+BAA+B;IACjD,iBAAiB,CAAC,kBAAkB;IACpC,iBAAiB,CAAC,6BAA6B;IAC/C,iBAAiB,CAAC,iBAAiB;IACnC,iBAAiB,CAAC,4BAA4B;IAC9C,iBAAiB,CAAC,6BAA6B;IAC/C,iBAAiB,CAAC,0BAA0B;IAC5C,iBAAiB,CAAC,yBAAyB;IAC3C,iBAAiB,CAAC,4BAA4B;IAC9C,iBAAiB,CAAC,2BAA2B;IAC7C,iBAAiB,CAAC,gCAAgC;IAClD,iBAAiB,CAAC,mBAAmB;IACrC,iBAAiB,CAAC,uBAAuB;IACzC,iBAAiB,CAAC,yBAAyB;IAC3C,iBAAiB,CAAC,wBAAwB;IAC1C,iBAAiB,CAAC,+BAA+B;IACjD,iBAAiB,CAAC,4BAA4B;IAC9C,iBAAiB,CAAC,uCAAuC;IACzD,iBAAiB,CAAC,6BAA6B;CACvC,CAAC"}

package/dist/workflow/lib/mount-plan.d.ts

@@ -53,7 +53,7 @@ export type MountSource = {
     readonly kind: 'agent-definition';
     readonly orgId: string;
     readonly agentSlug: string;
-    readonly groupKey: string;
+    readonly stageKey: string;
     readonly agentMode: 'primary' | 'subagent';
 } | {
     readonly kind: 'skill-bundle';
@@ -63,7 +63,7 @@ export type MountSource = {
     readonly orgId: string;
     readonly sectionKey: string;
     readonly agentSlug?: string;
-    readonly groupKey?: string;
+    readonly stageKey?: string;
 } | ({
     readonly kind: 'rendered-agents-md';
 } & RenderedAgentRunContextParams) | ({
@@ -75,7 +75,7 @@ export interface RenderedAgentRunContextParams {
     readonly orgId: string;
     readonly projectId: string;
     readonly agentSlug: string;
-    readonly groupKey: string;
+    readonly stageKey: string;
     readonly role: AgentRunRole;
     readonly sessionId?: string;
     readonly runId?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/kernel-contracts",
-  "version": "0.3.6",
+  "version": "0.4.0",
   "description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the 32 kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework/runtime deps.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/src/agent-composition/lib/composition-workspace.ts

@@ -26,6 +26,8 @@ import type {
 } from '../../agent-workspace';
 import type {
   AgentRunRole,
+  CompiledManifestCredential,
+  CompiledManifestPermissions,
   OutputSurfaceKind,
 } from '../../workflow';
 
@@ -91,17 +93,17 @@ export interface CompositionOutputSurface {
 /**
  * The agent run-config the composer needs that is NOT carried by the
  * `CompositionNode` tree. The node tree pins WHICH agent runs; these
- * three fields pin the run FRAMING (phase + role + deliverable
+ * three fields pin the run FRAMING (stage + role + deliverable
  * contract) the renderer + system-overlay are driven by.
  *
- * `role` is the canonical {@link AgentRunRole}. `phase` /
+ * `role` is the canonical {@link AgentRunRole}. `stage` /
  * `deliverableSpecRef` are carried verbatim from the source manifest's
  * `spec.agent` block — they MAY still hold a `${input.x}` token, which
  * the workspace pipeline resolves against the run's bind inputs (the
  * same fail-fast interpolation grammar `env` values use).
  */
 export interface CompositionAgentRunConfig {
-  readonly phase: string;
+  readonly stage: string;
   readonly role: AgentRunRole;
   readonly deliverableSpecRef?: string;
 }
@@ -141,7 +143,7 @@ export interface CompositionMountLayout {
    * slots are NEVER present — the composer auto-emits them.
    */
   readonly mounts: Readonly<Record<string, unknown>>;
-  /** Agent run-config (phase + role + deliverable contract). */
+  /** Agent run-config (stage + role + deliverable contract). */
   readonly agentRunConfig: CompositionAgentRunConfig;
   /**
    * Raw `spec.seedFiles` array — manifest DSL `ManifestSeedFile`
@@ -207,4 +209,26 @@ export interface CompositionWorkspace {
    * engine idle.
    */
   readonly workingFiles?: readonly WorkingFileBinding[];
+  /**
+   * Authored external-credential requirements — the manifest's
+   * `spec.credentials` block, carried verbatim from the compiled
+   * manifest. The composition boot-seeder projects it from the source
+   * workspace manifest; the `agent-session-runtime` composer surfaces it
+   * onto the reconstructed manifest `spec` so the environment resolver
+   * (and resume drift detection) see the authored credential set.
+   * Optional + additive — compositions needing no credentials omit it.
+   * Was silently DROPPED at seed before (BUG-1).
+   */
+  readonly credentials?: readonly CompiledManifestCredential[];
+  /**
+   * Authored tool allow/deny permission sets — the manifest's
+   * `spec.permissions` block, carried verbatim from the compiled
+   * manifest. Same seed → compose → resolve path as {@link credentials};
+   * consumed by the environment resolver + resume drift detection.
+   * Optional + additive. Distinct from the per-node
+   * {@link CompositionNode.permission} overlay — this is the workspace
+   * toolset policy, not the agent's permission map. Was silently DROPPED
+   * at seed before (BUG-1).
+   */
+  readonly permissions?: CompiledManifestPermissions;
 }

package/src/agent-composition/lib/model-resolution-matrix.ts

@@ -18,20 +18,20 @@
 import type { ModelRef } from '../../workflow';
 
 /**
- * Open registry of matrix dimensions. v1 ships agent/skill/project/group;
+ * Open registry of matrix dimensions. v1 ships agent/skill/project/stage;
  * v1.1 adds `purpose` for non-agent invocations (memory summarization,
  * embedding, reorganization). New dimensions are added here + carried in
  * `ModelMatrixSelector.extra` (untyped) or as a typed first-class field.
  *
- * The `group` dimension is the kernel-neutral name for a sub-app's
- * structural grouping tag on a job (e.g. the software-dev biome maps
- * its `phaseKey:` YAML field onto this dimension at compile time).
+ * The `stage` dimension is the kernel-neutral name for a sub-app's
+ * structural workflow-stage tag on a job (e.g. the software-dev biome maps
+ * its `stageKey:` YAML field onto this dimension at compile time).
  */
 export enum ResolutionDimension {
   Agent = 'agent',
   Skill = 'skill',
   Project = 'project',
-  Group = 'group',
+  Stage = 'stage',
   Purpose = 'purpose',
 }
 
@@ -47,11 +47,11 @@ export interface ModelMatrixSelector {
   /** Match when the invocation's project id equals this value. */
   readonly project?: string;
   /**
-   * Match when the invocation's structural group key equals this value.
-   * Kernel-neutral name; the software-dev biome's `phaseKey:` YAML field
+   * Match when the invocation's structural stage key equals this value.
+   * Kernel-neutral name; the software-dev biome's `stageKey:` YAML field
    * is mapped onto this dimension by the DSL compiler.
    */
-  readonly group?: string;
+  readonly stage?: string;
   /**
    * Match when the invocation's non-agent purpose equals this value. Used
    * for system flows that route LLM calls outside the agent/skill model —
@@ -84,7 +84,7 @@ export interface ModelResolutionContext {
   readonly agentSlug: string;
   readonly projectId?: string;
   readonly skillSlug?: string;
-  readonly groupKey?: string;
+  readonly stageKey?: string;
   /**
    * Non-agent invocation purpose (e.g. memory summarization/embedding).
    * Optional — agent and skill invocations leave this undefined.

package/src/agent-workspace/lib/context-json.ts

@@ -29,7 +29,7 @@ export interface ContextInvocation {
   readonly surface: InvocationSurface;
   readonly attempt: number;
   readonly runId: string | null;
-  readonly groupKey: string | null;
+  readonly stageKey: string | null;
   readonly sessionId: string | null;
 }
 

package/src/llm-gateway/lib/caller.ts

@@ -32,9 +32,9 @@ export enum LlmCallerKind {
  * - `kind` + `id` together identify the originating object.
  * - `orgId` is always present (billing/audit anchor).
  * - `projectId` is set when the call is project-scoped (most are).
- * - `groupKey` is set when the caller is tied to a workflow's structural
- *   group bucket. Kernel-neutral name; a sub-app biome (e.g. software-dev)
- *   maps its own `phaseKey` value onto this field at compile time.
+ * - `stageKey` is set when the caller is tied to a workflow's structural
+ *   stage bucket. Kernel-neutral name; a sub-app biome (e.g. software-dev)
+ *   maps its own `stageKey` YAML value onto this field at compile time.
  *
  * Adding new fields is non-breaking; renaming or repurposing existing
  * ones is breaking and requires updates on both gateway and consumers.
@@ -44,5 +44,5 @@ export interface LlmCaller {
   id: string;
   orgId: string;
   projectId?: string;
-  groupKey?: string;
+  stageKey?: string;
 }

package/src/workflow/lib/compiled-run.ts

@@ -19,7 +19,7 @@ import type { WorkflowVariableRequirement } from './variable-requirement';
  *     :ref`, reconstructing the compiled workspace manifest from the
  *     resolved composition's `workspace.mountLayout` block.
  *   • `inline` — short-form `with.mounts` whose agent metadata
- *     (`agentSlug`, `groupKey`, `deliverableSpecRef`, every entry in
+ *     (`agentSlug`, `stageKey`, `deliverableSpecRef`, every entry in
  *     `mounts`) is fully literal at compile time. The compiler runs
  *     `compileManifest()` once and embeds the result so the worker
  *     skips both the DB round-trip and the runtime synthesis step.

package/src/workflow/lib/compiled-workspace-manifest.ts

@@ -66,7 +66,7 @@ export interface CompiledWorkspaceManifest {
 
 export interface CompiledManifestAgent {
   readonly slug: string;
-  readonly groupKey: string;
+  readonly stageKey: string;
   /**
    * Canonical {@link AgentRunRole}. Validated by the DSL's
    * `ManifestAgentBlockSchema` at compile time, so the runtime can

package/src/workflow/lib/errors.ts

@@ -41,6 +41,20 @@ export enum WorkflowErrorCode {
   DSL_UNKNOWN_DELIVERABLE_FIELD = 'DSL_UNKNOWN_DELIVERABLE_FIELD',
   DSL_VERSION_NOT_RESOLVABLE = 'DSL_VERSION_NOT_RESOLVABLE',
   DSL_PERMISSION_ESCALATION = 'DSL_PERMISSION_ESCALATION',
+  /**
+   * A run was dispatched whose Briefcase declares a `vars` key that
+   * collides with a top-level workflow `vars:` key. The two namespaces
+   * are distinct by design — workflow `vars:` is author-owned config
+   * surfaced in the `${{ vars.X }}` expression namespace, while
+   * Briefcase `vars` are run-scoped facts read imperatively by
+   * activities (`getVar` / `requireVar`). A key present in BOTH is an
+   * ambiguity: the expression namespace would resolve the workflow
+   * value while an activity accessor would resolve the briefcase value,
+   * silently disagreeing under the same name. The compiler fails fast at
+   * the single folding point (`compileWorkflow`) so the dispatcher must
+   * rename one side instead of getting last-wins behavior at runtime.
+   */
+  DSL_VARS_BRIEFCASE_COLLISION = 'DSL_VARS_BRIEFCASE_COLLISION',
   /**
    * A consumer expression dereferences `needs.<X>.outputs.byKey[…]` but
    * `<X>` is either not a matrix job, or is matrix without `keyBy:`
@@ -158,6 +172,7 @@ export const NON_RETRYABLE_WORKFLOW_ERROR_CODES: readonly WorkflowErrorCode[] =
   WorkflowErrorCode.DSL_UNKNOWN_DELIVERABLE_FIELD,
   WorkflowErrorCode.DSL_VERSION_NOT_RESOLVABLE,
   WorkflowErrorCode.DSL_PERMISSION_ESCALATION,
+  WorkflowErrorCode.DSL_VARS_BRIEFCASE_COLLISION,
   WorkflowErrorCode.DSL_MATRIX_KEY_NOT_DECLARED,
   WorkflowErrorCode.DSL_INVALID_MATRIX_OUTPUT_ACCESS,
   WorkflowErrorCode.DSL_FIELD_NOT_TYPED,

package/src/workflow/lib/mount-plan.ts

@@ -116,7 +116,7 @@ export type MountSource =
       readonly kind: 'agent-definition';
       readonly orgId: string;
       readonly agentSlug: string;
-      readonly groupKey: string;
+      readonly stageKey: string;
       /**
        * Frontmatter `mode` for the rendered .opencode/agents/<slug>.md
        * file. Per OpenCode docs, primary agents and sub-agents share the
@@ -141,7 +141,7 @@ export type MountSource =
       readonly orgId: string;
       readonly sectionKey: string;
       readonly agentSlug?: string;
-      readonly groupKey?: string;
+      readonly stageKey?: string;
     }
   | ({ readonly kind: 'rendered-agents-md' } & RenderedAgentRunContextParams)
   | ({ readonly kind: 'rendered-system-overlay' } & RenderedAgentRunContextParams)
@@ -170,7 +170,7 @@ export interface RenderedAgentRunContextParams {
   readonly orgId: string;
   readonly projectId: string;
   readonly agentSlug: string;
-  readonly groupKey: string;
+  readonly stageKey: string;
   readonly role: AgentRunRole;
   readonly sessionId?: string;
   readonly runId?: string;

package/src/workflow/lib/workflow-stage.ts

@@ -9,7 +9,7 @@
 //
 // A stage is identified by a free-form `stageKey` string. The artifact
 // natural key already `_`-encodes this value (`{kind}:{workflowRunId}:
-// {groupKey|_}:{scope|_}:{slug}`), and the workflow engine sequences jobs
+// {stageKey|_}:{scope|_}:{slug}`), and the workflow engine sequences jobs
 // via explicit `needs:` dependency edges — neither needs a closed enum.
 //
 // Biomes that DO define an ordered stage list (e.g. for a phase rail or a
@@ -33,7 +33,7 @@ export enum WorkflowStageCategory {
 
 /**
  * A single ordered workflow stage. `stageKey` is the value that flows onto
- * a job's `groupKey` and into the artifact natural key — a free-form
+ * a job's `stageKey` and into the artifact natural key — a free-form
  * string the kernel never validates against a closed set.
  */
 export interface WorkflowStage {