@yanlinglabs/winter-agent-runtime 0.0.27

package/dist/production-wiring.d.ts

@@ -0,0 +1,340 @@
+import type { InitPluginInfo, RuntimeConfig, Settings } from "@yanlinglabs/winter-agent-sdk";
+import { type SourcedRuleEntry } from "./permissions/ruleset.js";
+import type { RuleSource } from "@yanlinglabs/winter-agent-sdk";
+import type { DetailedResolvedSettings } from "./settings/resolve.js";
+import type { DefaultChildEngineFactoryOptions } from "./subagents/register-default-factory.js";
+import { FilesystemCommandResolver } from "./commands/resolver.js";
+import type { SourcedHookEntry } from "./hooks/registry.js";
+import type { McpServerSource } from "./mcp/lifecycle.js";
+import type { SkillListing, SystemPromptAssembler } from "./context/seam.js";
+import type { CompactionController } from "./compaction/seam.js";
+import type { StructuredOutputSeam } from "./structured/seam.js";
+import type { FileCheckpointSink } from "./checkpoint/seam.js";
+import { type SessionProviderOptions, type SessionProviderWiring } from "./provider/session-provider.js";
+import type { ProviderStateRecordInput } from "./store/provider-state.js";
+import type { ClassifierInterface } from "./permissions/auto/engine.js";
+import { type SlotProviderResolution } from "./provider/slots.js";
+import type { ActiveSlotSet, ModelFamilyListing } from "@yanlinglabs/winter-agent-sdk";
+import { type WinterCatalog } from "@yanlinglabs/winter-provider-catalog";
+import type { AttachmentProducer, EngineOptions, ModelDescription, PricedUsage, ProviderUsage, ResolveModelSwitch, UsageRowFacts } from "./engine.js";
+/**
+ * RIDER 24: the assembler's `deps.settings` MUST be the post-`OVERLAY_NEVER_KEYS` EFFECTIVE getter.
+ *
+ * `resolveSettings`' `effective` already applies the filter (`withoutOverlayNeverKeys`, applied to
+ * the project tier only). A caller reaching for `perSource[i].values` or a raw file would let a
+ * repo-committed project `settings.json` set `autoMemoryDirectory` -- pointing this session's memory
+ * at a directory the repository chose, which is precisely the self-grant P5-A closes elsewhere.
+ *
+ * Asserted rather than merely documented: nothing about the two shapes differs structurally, so a
+ * future edit swapping one for the other would type-check and pass every test. This throws at
+ * session construction, which is loud and early, rather than degrading a live session.
+ *
+ * WHOLE-BRANCH MINOR m7 -- WHY THIS COMPARES AGAINST `perSource`, NOT AGAINST `resolved.effective`.
+ * It used to do the latter, and the production call site passes `resolved.effective`: `f(x, y)`
+ * comparing `x` to `y.effective` where `x === y.effective` is an identity check, so the guard could
+ * not fire in production no matter what went wrong. Its two fixtures tested the function; nothing
+ * tested the wiring.
+ *
+ * Against the PROJECT TIER'S RAW VALUES the same call becomes a real question: "does the view I am
+ * about to hand the assembler still carry the value the repository asked for?" `resolved.effective`
+ * answers no (the filter ran) and answers YES the moment `withoutOverlayNeverKeys` regresses or a
+ * caller substitutes a per-source view -- which is the property rider 24 wanted asserted all along.
+ *
+ * The one legitimate way a view may carry the project's value is if another tier independently set
+ * the SAME value, so that is the single exemption. Comparing values rather than presence is still
+ * load-bearing for the opposite case: when project and a higher tier both set the key with
+ * DIFFERENT values, a raw project view has the same presence as `effective` and would sail through
+ * any `key in settings` test.
+ */
+export declare function assertEffectiveSettings(settings: Settings | undefined, resolved: DetailedResolvedSettings): void;
+/**
+ * Phase 5 fix wave, C1: everything the engine needs from a settings file's `permissions` block.
+ *
+ * A SEED, not a policy: the engine folds `entries`/`directories` into its own initial rule set after
+ * the managed baseline and before the `sdk` entries, and the per-entry trust filter downstream is
+ * what makes a project-tier `allow` inert without host-declared trust.
+ */
+export interface SettingsRuleSeed {
+    /** Tagged with the tier that asserted them, which is what the P5-A gate reads. */
+    entries: SourcedRuleEntry[];
+    /** `permissions.additionalDirectories`, tagged the same way (`effectiveDirectories` gates project-tier grants). */
+    directories: Array<{
+        path: string;
+        source: RuleSource;
+    }>;
+    /**
+     * The surviving `permissions.defaultMode`, AFTER the pinned `filterEscalatingDefaultMode` -- so a
+     * repo-committed `bypassPermissions` never reaches the engine. A DEFAULT: an explicit
+     * `config.permissionMode` still wins, because a file cannot override what the host asked for.
+     */
+    defaultMode?: string;
+    /** WS-07 §6.4's veto, from ANY tier. `engine.ts` read `config.permissions` only. */
+    disableBypassPermissionsMode?: boolean;
+    /** Non-fatal problems, surfaced through `ProductionWiring.warnings`. */
+    warnings: string[];
+}
+/**
+ * One `SourcedRuleEntry` per (tier, behavior, rule string), in the pinned precedence order.
+ *
+ * ORDER IS `perSource`'s OWN (highest-precedence first), and it matters: `resolveRules` and
+ * `findMatchingRuleEntry` both return the FIRST match within a behavior, so a managed deny must be
+ * reached before a user one. `perSource` is already ordered that way.
+ *
+ * A MALFORMED RULE IS REPORTED, NEVER THROWN. `sourceRule` validates at add time and raises
+ * `PermissionRuleValidationError`; that is the right behaviour for an `Options` field the host
+ * controls (fail loud at startup) and the wrong one for a FILE a repository may have written --
+ * a single bad string in a checked-in project `settings.json` must not make the session unstartable.
+ * The bad entry is dropped and named in `warnings`; every other rule in the same file still binds.
+ */
+export declare function buildSettingsRuleSeed(resolved: DetailedResolvedSettings, opts?: {
+    allowDangerouslySkipPermissions?: boolean;
+    disableBypassPermissionsMode?: boolean;
+    cwd?: string;
+    home?: string;
+}): SettingsRuleSeed;
+export interface ProductionWiringOptions {
+    /** The session's EFFECTIVE config (post-`resolveEngineSession`), never the raw pre-resolution one. */
+    config: RuntimeConfig;
+    /** The environment governing `WINTER_HOME` and every env-derived read below. Explicit at both entrypoints. */
+    env: Record<string, string | undefined>;
+    /**
+     * The resolved `~/.winter` root -- `config.winterHome ?? resolveWinterHome(env)`. Passed rather
+     * than re-derived so this module and `resolveEngineSession` can never disagree about where a
+     * session lives (Lane S's judgment call 10: the two conventions in this codebase are not
+     * interchangeable, and picking the wrong one silently empties the user tier).
+     */
+    winterHome?: string;
+    /**
+     * The session's durable transcript sink (`resolveEngineSession`'s own `store`), so the two P5
+     * dialect entries have somewhere to land: Lane S's `invoked_skills` attachment and Lane K's
+     * `file-history-*` records. Omitted for a non-persistent session, in which case both are simply
+     * never written -- exactly as a session with no store has no durable anything.
+     */
+    persistence?: {
+        /** Review r1, M-1: the renderer's sticky decoration decisions, kept as layer-2 sidecar records. */
+        recordProviderState?(record: ProviderStateRecordInput): void | Promise<void>;
+        recordInvokedSkills?(attachment: {
+            type: string;
+            skills: unknown[];
+        }): void | Promise<void>;
+        recordFileHistory?(record: {
+            kind: "snapshot" | "delta";
+            userMessageUuid: string;
+            path: string;
+            pathHash: string;
+            tool: string;
+            at: string;
+            version: number;
+            absent?: boolean;
+            parentRealPath?: string;
+            anchorPath?: string;
+            anchorRealPath?: string;
+        }): void | Promise<void>;
+    };
+    /**
+     * Phase 6 Task 10: what the session's PROVIDER is built from.
+     *
+     * Every field is an injection point a TEST uses and production leaves alone: the catalog (a fixture
+     * owns its own rows), the credential store (an in-memory one, never the Keychain), the reserved
+     * `winter-test/<name>` namespace's scripted double, and the resumed continuation chain. Production
+     * passes only `testProviders` (the harness alias R6-13 keeps) and the OS home.
+     *
+     * OMITTING THE WHOLE OBJECT still runs selection: there is no "skip the provider" mode, because a
+     * mode that skipped it is exactly how a leg ends up with a different provider policy from the other
+     * two.
+     */
+    provider?: Omit<SessionProviderOptions, "config" | "env">;
+}
+export interface ProductionWiring {
+    /** Spread into `runEngine({...})`. Every field is one of `EngineOptions`' own P5 seams or init inputs. */
+    engineOptions: {
+        winterHome: string;
+        settingsRules: SettingsRuleSeed;
+        providerIdentity?: {
+            providerId: string;
+            modelKey: string;
+            family: string;
+            continuationDomain?: string;
+            adapterId?: string;
+            adapterVersion?: string;
+            catalogVersion?: string;
+            authRefKind?: string;
+        };
+        apiKeySource: string;
+        providerSupportsToolSearch?: boolean;
+        classifier?: ClassifierInterface;
+        /** P6 fix wave (Ruling E-2): the switch seam, from the session's own wiring. */
+        resolveModelSwitch?: ResolveModelSwitch;
+        /** P6 fix wave (Ruling E-3): `fallbackModel`'s candidates as catalog keys, present only when configured. */
+        fallbackModels?: string[];
+        /** P6 fix wave (Ruling E-4): R6-H's price of one generation, from the session's own wiring. */
+        priceUsage?: (modelKey: string, usage: ProviderUsage) => PricedUsage | undefined;
+        /** Dist-session fixes (C1): the catalog facts for an UNPRICED generation's `modelUsage` row. */
+        usageRowFacts?: (modelKey: string) => UsageRowFacts | undefined;
+        /** P6 fix wave (Ruling E-5): the classifier model's key, for the session pin -- present exactly when `classifier` is. */
+        classifierIdentity?: {
+            modelKey: string;
+        };
+        /** R6-I: the `list_models` control handler's source. */
+        supportedModels: () => unknown[];
+        /** The Winter-only `account_info` control handler's source. */
+        accountInfo: () => unknown;
+        /** WS-13c §3: the active slot set for a given model key -- the Agent tool's `model` enum and description lines. */
+        activeSlotSet?: (currentModelKey: string | undefined) => ActiveSlotSet;
+        /** WS-13c §4: slot name -> provider + catalog key, for a child spawn and for `set_model`. */
+        resolveSlot?: (requested: string, currentModelKey: string | undefined) => SlotProviderResolution;
+        /** WS-13c §5: bumps when the resolved settings view changes, so a `modelSlots` edit re-renders with no restart. */
+        settingsVersion?: () => number;
+        /**
+         * WS-13c §7: the `list_model_families` control handler's source.
+         *
+         * The parameter is Lane A's; the spine's `EngineOptions.listModelFamilies` is `() => …`, which
+         * this is assignable to. See the producer for the one-line spine fix that makes the engine
+         * actually pass the live key.
+         */
+        listModelFamilies?: (currentModelKey?: string) => ModelFamilyListing;
+        systemPromptAssembler: SystemPromptAssembler;
+        commandResolver: FilesystemCommandResolver;
+        compactionController: CompactionController;
+        structuredOutput: StructuredOutputSeam;
+        fileCheckpointSink?: FileCheckpointSink;
+        extraHookEntries: readonly SourcedHookEntry[];
+        /**
+         * WS-21 §6.3 item 2 (fix round 1, Critical 1): the conditional-rule on-touch attachment
+         * producer (`context/rules.ts`'s `conditionalRuleAttachmentProducer`), when this session has
+         * any conditional rules to announce. `EngineOptions.attachmentProducers` has no other producer
+         * in production today, so this is always either absent or a one-element array -- declared as
+         * the full array type anyway, matching `EngineOptions`'s own shape, so a second producer some
+         * later lane adds is a one-line change here, not a second field.
+         */
+        attachmentProducers?: readonly AttachmentProducer[];
+        /**
+         * WS-21 §6.3 item 1 (fix round 2): the enabled plugins that ship a `workflows/` directory,
+         * threaded to `EngineOptions.pluginWorkflows` -> `RegistryToolExecutorDeps.pluginWorkflows`
+         * (registry.ts) so the Workflow tool's `<plugin>:<name>` resolution can find them.
+         */
+        pluginWorkflows?: readonly {
+            name: string;
+            workflowsPath?: string;
+            workflowsPaths?: readonly string[];
+        }[];
+        extraMcpServerSources: readonly McpServerSource[];
+        initSlashCommands: readonly string[];
+        initSkills: readonly string[];
+        initPlugins: readonly InitPluginInfo[];
+        initOutputStyle: string;
+        skillListing: SkillListing;
+        /** SDK 0.0.16: the catalog's model display names for the `# Environment` model line. */
+        describeModel: NonNullable<EngineOptions["describeModel"]>;
+        /**
+         * The web tools' two wiring-level seams, DECLARED here rather than riding the spread undeclared:
+         * a spread of a property the destination type has not declared is not an excess-property error,
+         * so an undeclared one type-checks whether or not anything downstream reads it.
+         * `resolveAuxiliaryModel` is withheld on the arms with no catalog identity, like `resolveReviewer`;
+         * `resolveToolSecret` is present on every arm (it needs a credential store, not a model).
+         */
+        resolveAuxiliaryModel?: NonNullable<EngineOptions["resolveAuxiliaryModel"]>;
+        resolveToolSecret: NonNullable<EngineOptions["resolveToolSecret"]>;
+    };
+    /**
+     * Mirrors handed to `registerDefaultChildEngineFactory`, so a CHILD engine gets the same context
+     * surface its parent does -- see that function's own fields for the two gaps this closes.
+     */
+    /**
+     * Mirrors handed to `registerDefaultChildEngineFactory`, so a CHILD engine gets the same context
+     * surface its parent does.
+     *
+     * TYPED AS A `Pick` OF THE FACTORY'S OWN OPTIONS (rn-1, residual round 2), which is a tripwire and
+     * not tidiness. This was an independent object literal spread into the factory, and a spread of a
+     * property the destination has not declared is NOT an excess-property error -- so `skillListing`
+     * was declared here, type-checked, arrived on `opts`, and was dropped one line before `deps`,
+     * inert in production for a whole round while a review recorded it as landed. Against a `Pick`,
+     * a field the factory has not declared is a compile error AT THE PRODUCER, where the mistake is
+     * made, instead of a silent drop at the consumer, where nobody is looking.
+     *
+     * Adding a mirror is therefore now a two-file edit by construction: declare it on
+     * `DefaultChildEngineFactoryOptions` first, then produce it here.
+     */
+    childFactoryOptions: Required<Pick<DefaultChildEngineFactoryOptions, "systemPromptAssembler" | "skillRuntime" | "skillListing" | "settingsRules" | "structuredOutput" | "extraHookEntries" | "compactionControllerFactory" | "resolveChildProvider" | "describeModel" | "priceUsage" | "usageRowFacts" | "resolveToolSecret">> & Pick<DefaultChildEngineFactoryOptions, "resolveAuxiliaryModel">;
+    /**
+     * Phase 6 Task 10: the session's provider, and everything resolved with it.
+     *
+     * `provider` is spread into `runEngine` by both entrypoints; the rest is what the control handlers
+     * (`supportedModels`/`accountInfo`) and the report read. See `session-provider.ts`.
+     */
+    providerWiring: SessionProviderWiring;
+    /**
+     * WS-21 §3.4.4 step 4 / §6.3 item 6: every settings tier's `env` block, claude's per-tier filters
+     * applied (`settings/env-filter.ts`), merged HIGHEST-PRECEDENCE-WINS. APPLIED by this function
+     * (fix round 1, item 5): `Object.assign(env, settingsEnv)` after every settings read, which reaches a
+     * tool spawn's process env the way claude's own `Object.assign(process.env, filtered)` does -- in
+     * production `env` IS `process.env`, and each test passes its own isolated object. Also exposed here
+     * so a caller (and this file's tests) can see exactly which variables were applied.
+     */
+    settingsEnv: Record<string, string>;
+    /**
+     * WS-21 §6.3 item 5 (fix round 1): the SAME live getter `systemPromptAssembler`/`providerEnabled`/
+     * `advisorModelSetting` read internally (`settingsGetter`, defined once at the top of this
+     * function), surfaced so a caller -- and this file's own tests -- can observe the settings view
+     * this wiring actually resolved, host-managed filtering (`applyHostManagedSettingsFilter`)
+     * included, without a second, divergent resolution. `Settings.apiKeyHelper` has no production
+     * reader anywhere in `packages/runtime/src` today (grepped as part of this fix round), so this is
+     * also the only way to prove that filter's wiring end to end until a consumer exists.
+     */
+    settings: () => Settings | undefined;
+    /**
+     * The config the ENGINE should run, which differs from the input config in the provider-derived
+     * defaults only (`contextWindowTokens` from the descriptor when the host stated none).
+     *
+     * RETURNED rather than mutated: `ProductionWiringOptions.config` is what every other consumer in
+     * this function reads, and a builder that silently rewrote its own input would make the ordering
+     * between the two invisible at the call site -- the same argument `withAutoSkillPermissions`'
+     * header already makes.
+     */
+    config: RuntimeConfig;
+    /**
+     * Non-fatal problems worth telling a host about: a malformed project `mcp.json`, a plugin that
+     * would not load, a `skills` option naming something unknown. NEVER thrown -- Lane S's
+     * `validateSkillsOption` returns a result precisely so the decision is the caller's, and a broken
+     * plugin must not take a session down (`loadPlugins` returns rejections for the same reason).
+     */
+    warnings: readonly string[];
+    /** Withdraws every session-keyed registration. Called on teardown; `main.ts` may skip it (the process exits). */
+    dispose(): void;
+}
+/**
+ * The display name the `# Environment` model line uses for `model`, read from the catalog UNDER THE
+ * SESSION'S OWN PROVIDER (dist-session fixes E4).
+ *
+ * A host commonly spawns with the provider-local id plus `Options.provider` (the Winter daemon does),
+ * and one bare id is served by many providers -- `deepseek-v4-flash` by eleven, each with its own row
+ * (deepseek's and deepseek-anthropic's own rows are now `deepseek-flash`, keeping `deepseek-v4-flash`
+ * only as an alias). A first-match search over the whole catalog named the model by whichever
+ * provider sorted first.
+ *
+ *   - with `providerId`: that provider's rows only, in TWO PASSES like the adapters' descriptor index --
+ *     key or upstream id first, alias only after -- so an alias can never shadow a real id, and
+ *     novita's provider-local `deepseek/deepseek-v4-pro` names novita's row, not deepseek's KEY;
+ *   - without one (a session with no provider identity at all): the string is read as a catalog KEY
+ *     when it is one (a key names its provider), and a bare id or alias only when exactly ONE row in
+ *     the whole catalog answers to it. Ambiguous -> nothing, and the line keeps the bare id.
+ */
+export declare function describeCatalogModel(catalog: WinterCatalog, model: string, providerId?: string): ModelDescription | undefined;
+/**
+ * Build every P5 seam for one session.
+ *
+ * STARTUP ORDER IS LOAD-BEARING and follows Lane S's recipe exactly -- each step's input is the
+ * previous step's output: settings -> plugins -> skill index -> skills-option validation -> command
+ * resolver. Reordering it silently produces an index with no plugin skills, or a resolver whose
+ * `/name` set disagrees with the model's own listing.
+ */
+export declare function buildProductionWiring(opts: ProductionWiringOptions): Promise<ProductionWiring>;
+/**
+ * The automatic `Skill(...)` allow entries for a session, folded into `allowedTools` by BOTH
+ * entrypoints before `runEngine` seeds its rule set.
+ *
+ * Separate from `buildProductionWiring` because it must be applied to the CONFIG, and the config is
+ * what that function takes as input -- returning a mutated config from a builder whose job is to
+ * produce seams would make the ordering between the two invisible at the call site.
+ */
+export declare function withAutoSkillPermissions(config: RuntimeConfig): RuntimeConfig;

package/dist/protocol/channel.d.ts

@@ -0,0 +1,22 @@
+import type { WinterFrame } from "@yanlinglabs/winter-agent-sdk";
+export interface FrameSink {
+    write(f: WinterFrame): void;
+    end(): void;
+}
+export type FrameSource = AsyncIterable<WinterFrame>;
+export interface Duplex {
+    input: FrameSource;
+    output: FrameSink;
+}
+export declare class Queue<T> implements AsyncIterable<T> {
+    private buf;
+    private resolvers;
+    private ended;
+    write(v: T): void;
+    end(): void;
+    [Symbol.asyncIterator](): AsyncGenerator<Awaited<T>, void, unknown>;
+}
+export declare function createInMemoryChannel(): {
+    host: Duplex;
+    runtime: Duplex;
+};

package/dist/provider/advisor-route.d.ts

@@ -0,0 +1,47 @@
+import type { WinterCatalog } from "@yanlinglabs/winter-provider-catalog";
+import type { SlotProviderResolution } from "./slots.js";
+export interface AdvisorRouteInput {
+    catalog: WinterCatalog;
+    /** The session's LIVE effective model key (the engine's, not the wiring's start snapshot). Undefined for a session with no resolvable model. */
+    sessionModelKey: string | undefined;
+    /** `Options.advisor.model` / `RuntimeConfig.advisor.model`. */
+    optionModel?: string;
+    /** `settings.advisor.model`, read through the LIVE settings getter (hot, D30). */
+    settingModel?: string;
+    /** WS-13c §4, one argument: the slot layer already knows the session's model key. */
+    resolveSlot: (requested: string) => SlotProviderResolution;
+}
+export type AdvisorRoute = {
+    ok: true;
+    modelKey: string;
+    providerId: string;
+    source: "option" | "setting" | "family-default" | "own-model";
+} | {
+    ok: false;
+    reason: string;
+};
+/** The precedence step that named a candidate, and what it named. `undefined` = nothing states one. */
+interface AdvisorCandidate {
+    requested: string;
+    source: "option" | "setting" | "family-default" | "own-model";
+    /** How the refusal describes where this value came from, so the user knows WHICH knob to fix. */
+    origin: string;
+}
+/**
+ * The ONE candidate this session's advisor uses, per D30's precedence.
+ *
+ * Exported for the tests that pin the precedence independently of whether a candidate happens to
+ * RESOLVE — the two questions are separate, and conflating them is how a "default" test can pass
+ * while precedence is broken.
+ */
+export declare function selectAdvisorCandidate(input: Pick<AdvisorRouteInput, "catalog" | "sessionModelKey" | "optionModel" | "settingModel">): AdvisorCandidate | undefined;
+/**
+ * WS-06 §4 / D30: the reviewer this session's advisor consults, or a typed reason it has none.
+ *
+ * NEVER A SUBSTITUTION. Three shapes of "no": nothing states a candidate at all; the stated
+ * candidate does not resolve (the slot layer's own `slot-unservable`/`ambiguous-slot-name`/
+ * `unknown-slot` message rides through verbatim, because it already names every row that WOULD have
+ * served it and why each did not); or the resolved row is a Claude row Winter cannot authenticate.
+ */
+export declare function resolveAdvisorRoute(input: AdvisorRouteInput): AdvisorRoute;
+export {};

package/dist/provider/bridge.d.ts

@@ -0,0 +1,124 @@
+import type { ProviderAdapter, ProviderContext, ProviderEvent, ResolvedModel } from "@yanlinglabs/winter-provider-runtime";
+import { ProviderTurnError, type MessageOrigin, type Provider, type ProviderMessage, type ProviderRequest, type ProviderStreamSink, type ProviderTurn } from "../engine.js";
+import type { ContinuationChain } from "../store/provider-state.js";
+export { ProviderTurnError, isProviderTurnError } from "../engine.js";
+/**
+ * R6-3 / Lane C: renders the engine's history into what THIS target may actually be sent.
+ *
+ * Lane C implements the real one (per-message cross-family decoration, `classifySwitch`'s loss
+ * matrix at the engine's switch point). T3 ships the IDENTITY renderer below, which is deliberately the most conservative
+ * thing that is still correct.
+ */
+export interface HistoryRenderer {
+    render(messages: ProviderMessage[], chain: ContinuationChain, target: {
+        family: string;
+        continuationDomain?: string;
+        readableState: "none" | "summary" | "full-exposed";
+        providerId?: string;
+        modelKey?: string;
+        readsImages?: boolean;
+    }): ProviderMessage[];
+}
+/**
+ * The T3 renderer: NO decoration, and native state replayed ONLY inside the same continuation domain.
+ *
+ * Both halves are refusals rather than features, and that is the point. Decoration is Lane C's --
+ * inventing a cross-family note here would put Winter-authored text into a model's context that no
+ * ruling has approved. Replaying native state ACROSS a domain boundary is worse than not replaying
+ * it: opaque items are meaningful only to the provider that minted them, so a cross-domain replay is
+ * at best rejected and at worst silently misinterpreted. When the domains disagree the annotation is
+ * dropped and the message rides as plain content -- which is exactly R6-7's "degrade to
+ * summary-level", applied at the point of use.
+ *
+ * A message WITH an `origin` is passed through untouched apart from the nativeState domain check
+ * above: absence of a domain match is not this renderer's job to carry across (that is Lane C's).
+ *
+ * A message with NO `origin` at all (every pre-P6 history, and every message the host supplied) --
+ * micro-round Minor 2, mirroring `provider-runtime`'s own renderer fix: FAIL CLOSED, LAYERED ON TOP
+ * of the nativeState domain check above rather than replacing it (a live, same-turn message can
+ * carry a stamped `nativeState.continuationDomain` with no `.origin` of its own -- `stampNativeState`
+ * stamps the former directly, per this file's own header; the two are independent facts, and the
+ * domain check must still run for a message that only has the first). Unknown provenance is this
+ * renderer's worst-informed case too, and "decoration is Lane C's" was never a reason to also skip
+ * STRIPPING what `stripOpaque` already knows how to strip -- the in-dialect `thinking`/
+ * `redacted_thinking` blocks that ride in the CONTENT (the exact gap this function's own header used
+ * to name and accept: "which the identity renderer could not do anything about"). Delegates to
+ * `stripOpaque` itself (exported for exactly this) rather than reimplementing the two-carrier rule a
+ * second time and risking the two copies drifting apart on what counts as opaque. Object identity is
+ * preserved when there is truly nothing to strip.
+ */
+export declare function createIdentityHistoryRenderer(): HistoryRenderer;
+/** What `adapterAsProvider` needs beyond the adapter and its context. */
+export interface AdapterProviderOptions {
+    renderer?: HistoryRenderer;
+    /** Overrides the adapter on `resolved`. The one caller is a test that wants a scripted adapter against a real `ResolvedModel`. */
+    adapter?: ProviderAdapter;
+    /**
+     * Phase 6 Task 10 (Lane C wiring item 2): THE RESUMED CONTINUATION CHAIN.
+     *
+     * A GETTER, because the chain is re-attached asynchronously at the start of a run
+     * (`attachContinuationChain`) — long after this provider is constructed — so a captured value would
+     * always be the empty map this option replaces.
+     *
+     * What it buys: `createHistoryRenderer` reads a message's `origin` off the message itself when the
+     * engine already annotated it, and otherwise off `chain.get(message.uuid)`. The second path is the
+     * one that matters for a RESUMED history whose `summary` records (R6-8's foreign reasoning, which
+     * may never enter the transcript) live only in the sidecar: without the chain those messages render
+     * with no decoration at all, which looks exactly like a session that had nothing to say.
+     *
+     * Absent -> an empty chain, which is what T3 shipped and what a non-persistent session genuinely has.
+     */
+    chain?: () => ContinuationChain;
+}
+/**
+ * A `Provider` that is known to produce only the two PRODUCTION turn kinds.
+ *
+ * Narrower than `Provider` on purpose: no adapter stream can express `rpc_probe`, so a caller reading
+ * `turn.nativeState`/`turn.thinking` off one of these needs no cast -- and a cast is exactly what
+ * would also silence a real mistake.
+ */
+export interface AdapterProvider extends Provider {
+    generate(input: ProviderRequest): Promise<FoldedProviderTurn>;
+}
+/**
+ * Wraps a resolved adapter as the engine's `Provider`.
+ *
+ * The whole conversion in one place: render the history, build a `TurnRequest`, consume
+ * `streamTurn`, fold, STAMP the resolved identity onto any native state, and normalize any failure
+ * into a `ProviderTurnError`.
+ */
+export declare function adapterAsProvider(resolved: ResolvedModel, ctx: ProviderContext, opts?: AdapterProviderOptions): AdapterProvider;
+/**
+ * What a fold can produce: the two PRODUCTION turn kinds and nothing else.
+ *
+ * `rpc_probe` is a P1-only test affordance the engine performs on a provider's behalf; no adapter
+ * stream can express it, so narrowing the return type here is not a convenience -- it is what lets a
+ * caller read `turn.thinking`/`turn.nativeState` without a cast that would also silence a real
+ * mistake.
+ */
+export type FoldedProviderTurn = Exclude<ProviderTurn, {
+    kind: "rpc_probe";
+}>;
+/**
+ * The fold itself, exported so a lane can test its own adapter's stream against the REAL consumer
+ * rather than a re-implementation of it.
+ */
+export declare function foldProviderStream(stream: AsyncIterable<ProviderEvent>, sink?: ProviderStreamSink): Promise<FoldedProviderTurn>;
+/**
+ * Anything thrown -> a `ProviderTurnError`.
+ *
+ * The ORIGINAL is never re-thrown, and never attached as `cause`. An arbitrary throw from an adapter
+ * can carry a request object, a response body, or a header map -- any of which may hold credential
+ * material or opaque provider state, and all of which would then ride the error into a frame and a
+ * log. Only a BOUNDED message survives (Global Constraints: credential material is redacted
+ * everywhere, including thrown error messages).
+ */
+export declare function toProviderTurnError(err: unknown, committed?: boolean): ProviderTurnError;
+/**
+ * Stamps the RESOLVED identity's family and continuation domain onto a folded turn's native state.
+ *
+ * The fold has no access to either -- it consumes an adapter's event stream, not its resolution -- so
+ * this is the one place the two meet. A turn with no native state is returned untouched: stamping
+ * never fabricates state that an adapter did not produce.
+ */
+export declare function stampNativeState(turn: FoldedProviderTurn, origin: MessageOrigin): FoldedProviderTurn;

package/dist/provider/classifier/model-classifier.d.ts

@@ -0,0 +1,82 @@
+import type { AutoClassifierConfig, CredentialRef } from "@yanlinglabs/winter-agent-sdk";
+import type { WinterModelDescriptor } from "@yanlinglabs/winter-provider-catalog";
+import type { ClassifierInterface } from "../../permissions/auto/engine.js";
+import type { Provider, ProviderRequest } from "../../engine.js";
+import { type ClassifierPromptResult } from "./prompt.js";
+import { type ClassifierNoVerdictReason } from "./verdict-schema.js";
+/**
+ * A DISCLOSED Winter default (no pinned counterpart — §10 documents no timeout).
+ *
+ * 15 s is chosen against what the failure costs rather than against a model's latency: every
+ * expiry is a fail-closed denial the user then has to resolve by hand, so a value too low turns a
+ * slow provider into a broken session, while a value too high makes a hung classifier feel like a
+ * hung agent. A host that knows its route can pass its own.
+ */
+export declare const DEFAULT_CLASSIFIER_TIMEOUT_MS = 15000;
+export interface ModelClassifierOptions {
+    /** The engine `Provider` seam. A scripted double in a fixture, `adapterAsProvider(...)` in production — this file cannot tell them apart, which is the point. */
+    provider: Provider;
+    /** The classifier's OWN model, pinned per session and independent of the worker model (§10.6-4). */
+    model: string;
+    timeoutMs?: number;
+    /** P2 carry: the app-owned accumulated-context bound. See `prompt.ts`'s `DEFAULT_MAX_CONTEXT_CHARS`. */
+    maxContextChars?: number;
+    /** P7a fix wave (item 5, M-1): the running brand's instructions file, so the classifier prompt labels the operator's own file correctly. */
+    instructionsFile?: string;
+    /**
+     * Test seam: observes what was actually sent and what came back, WITHOUT the classifier logging
+     * anything itself. Nothing in this file writes to a log — a permission review's request contains
+     * the envelope, and the envelope contains file paths and command lines.
+     */
+    onRequest?: (info: {
+        request: ProviderRequest;
+        prompt: ClassifierPromptResult;
+    }) => void;
+}
+/**
+ * `createModelClassifier` — one forced tool call, one verdict, every failure collapsed.
+ */
+export declare function createModelClassifier(opts: ModelClassifierOptions): ClassifierInterface;
+export type ClassifierRoute = 
+/** `config.autoClassifier` named a model. It resolves through the SAME selection path as the session model (§10.6-4: "chosen via WS-13"). */
+{
+    kind: "configured";
+    model: string;
+    authRef?: CredentialRef;
+}
+/** No route configured, and the worker model itself clears the bar in R6-14. */
+ | {
+    kind: "worker-eligible";
+}
+/** Neither. §10.6-4: "otherwise fall back to Manual, never silently weaken." */
+ | {
+    kind: "manual-fallback";
+    reason: string;
+};
+/** The narrow shape this needs from a session config. Structural so `RuntimeConfig` satisfies it and a fixture need not build one. */
+export interface ClassifierRouteConfig {
+    model?: string;
+    autoClassifier?: AutoClassifierConfig;
+}
+/**
+ * R6-14's route rule, and it is a ONE-WAY door: a session either gets a classifier it has real
+ * evidence for, or it gets Manual.
+ *
+ * The worker-eligible bar is `structuredOutput.confidence === "verified"` AND `classifierEligible`.
+ * Both halves are required and neither is a formality:
+ *
+ *   - `structuredOutput` verified means someone OBSERVED this model honour a forced tool schema. On
+ *     today's seed catalog every `structuredOutput` row is `inferred`, so nothing is worker-eligible
+ *     — which is the correct state, not a gap: an inferred capability is a guess, and a guess about
+ *     schema adherence is a guess about whether the security reviewer can be parsed at all.
+ *   - `classifierEligible` is set only after the safety corpus passes LIVE against that model
+ *     (R6-14's own wording, and the descriptor field's own comment). It is the evidence that the
+ *     model answers the security questions correctly, which schema adherence says nothing about.
+ *
+ * TIGHTENED, deliberately, past the ruling's literal wording: `structuredOutput.value === true` is
+ * required as well as its confidence. A `verified` claim that the model does NOT support structured
+ * output is verified evidence AGAINST eligibility, and reading the confidence without the value
+ * would turn it into evidence for. Strictness only; disclosed in the task report.
+ */
+export declare function selectClassifierRoute(config: ClassifierRouteConfig, descriptorOf: (modelKey: string) => WinterModelDescriptor | undefined): ClassifierRoute;
+export type { ClassifierNoVerdictReason };