agentfootprint 9.83.0 → 9.85.0

package/dist/esm/core/agent/buildToolRegistry.d.ts

@@ -35,6 +35,143 @@
  * name once the skill is active, and dispatch looks up by name. We
  * add them to the dispatch map (`registryByName`) so `lookupTool`
  * resolves correctly.
+ *
+ * ── THE CAPABILITY LAW, EPOCH-SCOPED ──────────────────────────────────
+ *
+ * An EPOCH is one composed request plus the dispatch of the tool calls
+ * that request comes back with. For one epoch E:
+ *
+ *   every offered capability resolves to a dispatchable implementation
+ *   with stable identity. Attention may alter the offer. Omission from
+ *   the offer must NOT be presented as proof of permanent capability loss.
+ *
+ * Clause one is what the two maps returned from here are FOR, and it is
+ * scoped to THE TOOLS THIS FILE ROUTES. `augmentedRegistry` (plus the
+ * per-iteration narrowing the tools slot applies downstream) is this file's
+ * CONTRIBUTION to the offer; `registryByName` is DISPATCH. It is not the
+ * whole offer: the wire list is assembled one layer out, as
+ * `[static, provider, skill, step]` merged first-occurrence-wins
+ * (`buildToolsSlot`), and PROVIDER schemas are a source these maps never
+ * contain. Within the scoped set, a name in the offer that is missing from
+ * dispatch is an `Unknown tool` the model was invited to call — which is why
+ * the autoActivate invariant above exists, and why the name-uniqueness throws
+ * below are throws: an identity that is not stable is one the model cannot
+ * address. Where a provider schema reaches the wire ahead of a skill tool of
+ * the same name, the identity half is the SHADOW SEAM illustrated below.
+ *
+ * `with stable identity` is kept rather than dropped, and the reason is the
+ * event. A law reading only "every offered name resolves to something" would
+ * be true everywhere and would leave `agentfootprint.tools.shadowed` reporting
+ * a deviation from nothing — the framework spends an event on that seam
+ * precisely because reading one contract and calling another implementation is
+ * a violation of an expectation worth naming. Scoping a true clause and
+ * walking its exceptions keeps the expectation stated; weakening the clause to
+ * name resolution would delete it.
+ *
+ * Clause two is the whole point of the narrowing dials — `autoActivate`,
+ * `skillGraph({ scopeTools })`, `.toolsFromActiveSkill()`, a parked map,
+ * an open step tenure. Every one of them subtracts from the OFFER.
+ *
+ * Clause three is a rule about SENTENCES, and nothing in this file can
+ * enforce it; the surfaces that write them are inventoried by
+ * `test/modelFacingSurfaces.test.ts` and judged by
+ * `test/helpers/modelFacingClaims.ts`. It is stated HERE because this is
+ * where a reader learns what an offer is, and therefore where the wrong
+ * inference is cheapest to draw: a tool absent from this iteration's list
+ * is a tool the attention policy did not put there, never a capability
+ * that has been taken away.
+ *
+ * ── WHAT THE LAW DELIBERATELY DOES NOT SAY ────────────────────────────
+ *
+ * Three drafts of it read "position governs the offer, never dispatch".
+ * That generalisation is FALSE across the framework, and it is false in a
+ * direction that matters: it would license telling a model that anything
+ * it once saw is still callable. It holds for the tools THIS file routes —
+ * a scoped skill tool leaves `augmentedRegistry` and stays in
+ * `registryByName`, which is exactly the invariant above. It does not hold
+ * where the implementation never lived in these maps, or where the SCHEMA
+ * the model read never did.
+ *
+ * ── WHERE IT DOES NOT HOLD IS NOT WRITTEN DOWN HERE ───────────────────
+ *
+ * It used to be: a list, in this comment, that called itself complete. It was
+ * wrong three times in three rounds — round 1 missed provider tools vanishing
+ * cross-epoch, round 2 the same-epoch provider/skill shadow, round 3 an
+ * INACTIVE skill shadowing silently and a provider able to claim `skip_step`.
+ * Each round stated the list more precisely and each round an independent
+ * check found one more. A hand-maintained enumeration that claims completeness
+ * is the exact defect this library exists to fix, one level up, so this one is
+ * no longer maintained by hand:
+ *
+ *   THE ENUMERATION IS `test/core/agent/toolDivergenceWalk.test.ts`.
+ *
+ * It walks the configuration space — every source that can put a name on the
+ * wire or answer to one, crossed with the narrowings that change resolution —
+ * drives a REAL run per configuration, and records per epoch what name was
+ * offered, whose contract was on the wire, whose implementation answered, and
+ * whether `agentfootprint.tools.shadowed` fired and what it claimed. Its
+ * committed baseline is the list this comment used to be, kept by observation
+ * instead of by memory: a divergence missing from it fails, and one that stops
+ * appearing fails too. Read it for the SET, and for the reason each member is
+ * tolerated.
+ *
+ * What follows is ILLUSTRATION — the seams a reader of THIS file meets first,
+ * so the two maps below make sense. It is not a boundary, and nothing here
+ * should be read as "and no others":
+ *
+ *   • PROVIDER-DELIVERED tools (`ToolProvider`). Dispatch resolves those
+ *     from `providerToolCache.current`, which the Tools slot OVERWRITES
+ *     with this iteration's `provider.list(ctx)` (buildToolsSlot.ts). So
+ *     `skillScopedTools(id, …)`, which answers `[]` whenever
+ *     `ctx.activeSkillId` is not its skill — and that field reports only a
+ *     `read_skill` activation — drops the tool out of the offer and out of
+ *     dispatch on the SAME epoch.
+ *     Same-epoch offer implies same-epoch dispatch; the cross-epoch half is
+ *     simply not true there.
+ *   • `read_skill` RECOVERY is cursor-gated, so it is not the escape hatch
+ *     that would make the cross-epoch claim harmless anyway.
+ *     `makeReachableSkills` filters the cursor out of its own successor set,
+ *     and under `.tree()` the reachable set is `() => []` outright
+ *     (skillGraph.ts) — a tree routes by predicate and has no cursor to move.
+ *   • The SHADOW SEAM — a SAME-EPOCH divergence, and the one the framework
+ *     TRIES to emit an event for — `claim-swallowed` fires it outside the
+ *     shadow seam too, so the event is a signal, never a boundary. A `ToolProvider` and an ACTIVE skill can declare the
+ *     same tool name, and the two lose in opposite directions, each by a rule
+ *     rather than a race: the wire merge puts provider schemas
+ *     ahead of skill injections first-occurrence-wins, so the model reads the
+ *     PROVIDER's description and `inputSchema`; `lookupTool` checks
+ *     `registryByName` first, where every skill tool lives and no provider
+ *     tool does, so the SKILL's `execute` runs. Clause one's dispatchability
+ *     survives — the name resolves, there is no `Unknown tool` — but stable
+ *     identity does not: the contract offered and the implementation that
+ *     answered are different tools, inside ONE epoch. Nothing throws, because
+ *     nothing here can see it coming: the provider's list is resolved per
+ *     iteration (`list(ctx)`) and the skill has to be active, so there is no
+ *     build-time moment at which the pair is knowable. The pair this file CAN
+ *     see — a static `.tool()` against a skill tool — is refused below, which
+ *     is the better answer whenever the answer is available that early.
+ *     Reported rather than refused: `agentfootprint.tools.shadowed` every
+ *     iteration plus one dev-mode line (`reportShadowedTools`,
+ *     buildToolsSlot.ts). Pinned by `test/toolShadowing.test.ts` and, as a
+ *     counterexample to this law, by epoch-laws 1(g).
+ *     What the event covers is NARROWER than the seam, which is the reason
+ *     this bullet is illustration and the walk is the enumeration: the walk
+ *     records the same divergence with an INACTIVE skill winning dispatch and
+ *     no event at all, a provider claiming `skip_step` and the framework's own
+ *     tool answering, and a configuration where the event fires and names the
+ *     wrong schema source. Their reasons are in the baseline.
+ *
+ * MCP does not add a seam of its OWN, and it is worth saying so because it
+ * looks like it does: `mcpServe` builds `listing` and `byName` ONCE at
+ * construction from the same array, and every server instance installs
+ * those same two captures, so the offer and the dispatch map there cannot
+ * diverge at all. What it does add is a mount: an MCP source reaches an agent
+ * as `staticTools(await client.tools())` — a `ToolProvider` — so it inherits
+ * every provider seam above unchanged. The walk drives both and gets the same
+ * rows for each, which is the only way that claim is worth making.
+ *
+ * Pinned by `test/core/agent/epoch-laws.test.ts` (the law) and
+ * `test/core/agent/toolDivergenceWalk.test.ts` (the set).
  */
 import type { Injection } from '../../lib/injection-engine/types.js';
 import type { LLMToolSchema } from '../../adapters/types.js';

package/dist/esm/core/agent/buildToolRegistry.js

@@ -35,6 +35,143 @@
  * name once the skill is active, and dispatch looks up by name. We
  * add them to the dispatch map (`registryByName`) so `lookupTool`
  * resolves correctly.
+ *
+ * ── THE CAPABILITY LAW, EPOCH-SCOPED ──────────────────────────────────
+ *
+ * An EPOCH is one composed request plus the dispatch of the tool calls
+ * that request comes back with. For one epoch E:
+ *
+ *   every offered capability resolves to a dispatchable implementation
+ *   with stable identity. Attention may alter the offer. Omission from
+ *   the offer must NOT be presented as proof of permanent capability loss.
+ *
+ * Clause one is what the two maps returned from here are FOR, and it is
+ * scoped to THE TOOLS THIS FILE ROUTES. `augmentedRegistry` (plus the
+ * per-iteration narrowing the tools slot applies downstream) is this file's
+ * CONTRIBUTION to the offer; `registryByName` is DISPATCH. It is not the
+ * whole offer: the wire list is assembled one layer out, as
+ * `[static, provider, skill, step]` merged first-occurrence-wins
+ * (`buildToolsSlot`), and PROVIDER schemas are a source these maps never
+ * contain. Within the scoped set, a name in the offer that is missing from
+ * dispatch is an `Unknown tool` the model was invited to call — which is why
+ * the autoActivate invariant above exists, and why the name-uniqueness throws
+ * below are throws: an identity that is not stable is one the model cannot
+ * address. Where a provider schema reaches the wire ahead of a skill tool of
+ * the same name, the identity half is the SHADOW SEAM illustrated below.
+ *
+ * `with stable identity` is kept rather than dropped, and the reason is the
+ * event. A law reading only "every offered name resolves to something" would
+ * be true everywhere and would leave `agentfootprint.tools.shadowed` reporting
+ * a deviation from nothing — the framework spends an event on that seam
+ * precisely because reading one contract and calling another implementation is
+ * a violation of an expectation worth naming. Scoping a true clause and
+ * walking its exceptions keeps the expectation stated; weakening the clause to
+ * name resolution would delete it.
+ *
+ * Clause two is the whole point of the narrowing dials — `autoActivate`,
+ * `skillGraph({ scopeTools })`, `.toolsFromActiveSkill()`, a parked map,
+ * an open step tenure. Every one of them subtracts from the OFFER.
+ *
+ * Clause three is a rule about SENTENCES, and nothing in this file can
+ * enforce it; the surfaces that write them are inventoried by
+ * `test/modelFacingSurfaces.test.ts` and judged by
+ * `test/helpers/modelFacingClaims.ts`. It is stated HERE because this is
+ * where a reader learns what an offer is, and therefore where the wrong
+ * inference is cheapest to draw: a tool absent from this iteration's list
+ * is a tool the attention policy did not put there, never a capability
+ * that has been taken away.
+ *
+ * ── WHAT THE LAW DELIBERATELY DOES NOT SAY ────────────────────────────
+ *
+ * Three drafts of it read "position governs the offer, never dispatch".
+ * That generalisation is FALSE across the framework, and it is false in a
+ * direction that matters: it would license telling a model that anything
+ * it once saw is still callable. It holds for the tools THIS file routes —
+ * a scoped skill tool leaves `augmentedRegistry` and stays in
+ * `registryByName`, which is exactly the invariant above. It does not hold
+ * where the implementation never lived in these maps, or where the SCHEMA
+ * the model read never did.
+ *
+ * ── WHERE IT DOES NOT HOLD IS NOT WRITTEN DOWN HERE ───────────────────
+ *
+ * It used to be: a list, in this comment, that called itself complete. It was
+ * wrong three times in three rounds — round 1 missed provider tools vanishing
+ * cross-epoch, round 2 the same-epoch provider/skill shadow, round 3 an
+ * INACTIVE skill shadowing silently and a provider able to claim `skip_step`.
+ * Each round stated the list more precisely and each round an independent
+ * check found one more. A hand-maintained enumeration that claims completeness
+ * is the exact defect this library exists to fix, one level up, so this one is
+ * no longer maintained by hand:
+ *
+ *   THE ENUMERATION IS `test/core/agent/toolDivergenceWalk.test.ts`.
+ *
+ * It walks the configuration space — every source that can put a name on the
+ * wire or answer to one, crossed with the narrowings that change resolution —
+ * drives a REAL run per configuration, and records per epoch what name was
+ * offered, whose contract was on the wire, whose implementation answered, and
+ * whether `agentfootprint.tools.shadowed` fired and what it claimed. Its
+ * committed baseline is the list this comment used to be, kept by observation
+ * instead of by memory: a divergence missing from it fails, and one that stops
+ * appearing fails too. Read it for the SET, and for the reason each member is
+ * tolerated.
+ *
+ * What follows is ILLUSTRATION — the seams a reader of THIS file meets first,
+ * so the two maps below make sense. It is not a boundary, and nothing here
+ * should be read as "and no others":
+ *
+ *   • PROVIDER-DELIVERED tools (`ToolProvider`). Dispatch resolves those
+ *     from `providerToolCache.current`, which the Tools slot OVERWRITES
+ *     with this iteration's `provider.list(ctx)` (buildToolsSlot.ts). So
+ *     `skillScopedTools(id, …)`, which answers `[]` whenever
+ *     `ctx.activeSkillId` is not its skill — and that field reports only a
+ *     `read_skill` activation — drops the tool out of the offer and out of
+ *     dispatch on the SAME epoch.
+ *     Same-epoch offer implies same-epoch dispatch; the cross-epoch half is
+ *     simply not true there.
+ *   • `read_skill` RECOVERY is cursor-gated, so it is not the escape hatch
+ *     that would make the cross-epoch claim harmless anyway.
+ *     `makeReachableSkills` filters the cursor out of its own successor set,
+ *     and under `.tree()` the reachable set is `() => []` outright
+ *     (skillGraph.ts) — a tree routes by predicate and has no cursor to move.
+ *   • The SHADOW SEAM — a SAME-EPOCH divergence, and the one the framework
+ *     TRIES to emit an event for — `claim-swallowed` fires it outside the
+ *     shadow seam too, so the event is a signal, never a boundary. A `ToolProvider` and an ACTIVE skill can declare the
+ *     same tool name, and the two lose in opposite directions, each by a rule
+ *     rather than a race: the wire merge puts provider schemas
+ *     ahead of skill injections first-occurrence-wins, so the model reads the
+ *     PROVIDER's description and `inputSchema`; `lookupTool` checks
+ *     `registryByName` first, where every skill tool lives and no provider
+ *     tool does, so the SKILL's `execute` runs. Clause one's dispatchability
+ *     survives — the name resolves, there is no `Unknown tool` — but stable
+ *     identity does not: the contract offered and the implementation that
+ *     answered are different tools, inside ONE epoch. Nothing throws, because
+ *     nothing here can see it coming: the provider's list is resolved per
+ *     iteration (`list(ctx)`) and the skill has to be active, so there is no
+ *     build-time moment at which the pair is knowable. The pair this file CAN
+ *     see — a static `.tool()` against a skill tool — is refused below, which
+ *     is the better answer whenever the answer is available that early.
+ *     Reported rather than refused: `agentfootprint.tools.shadowed` every
+ *     iteration plus one dev-mode line (`reportShadowedTools`,
+ *     buildToolsSlot.ts). Pinned by `test/toolShadowing.test.ts` and, as a
+ *     counterexample to this law, by epoch-laws 1(g).
+ *     What the event covers is NARROWER than the seam, which is the reason
+ *     this bullet is illustration and the walk is the enumeration: the walk
+ *     records the same divergence with an INACTIVE skill winning dispatch and
+ *     no event at all, a provider claiming `skip_step` and the framework's own
+ *     tool answering, and a configuration where the event fires and names the
+ *     wrong schema source. Their reasons are in the baseline.
+ *
+ * MCP does not add a seam of its OWN, and it is worth saying so because it
+ * looks like it does: `mcpServe` builds `listing` and `byName` ONCE at
+ * construction from the same array, and every server instance installs
+ * those same two captures, so the offer and the dispatch map there cannot
+ * diverge at all. What it does add is a mount: an MCP source reaches an agent
+ * as `staticTools(await client.tools())` — a `ToolProvider` — so it inherits
+ * every provider seam above unchanged. The walk drives both and gets the same
+ * rows for each, which is the only way that claim is worth making.
+ *
+ * Pinned by `test/core/agent/epoch-laws.test.ts` (the law) and
+ * `test/core/agent/toolDivergenceWalk.test.ts` (the set).
  */
 import { buildReadSkillTool, buildSkipStepTool } from '../../lib/injection-engine/skillTools.js';
 import { stepsOf, SKIP_STEP_TOOL_NAME } from '../../lib/injection-engine/skillSteps.js';

package/dist/esm/core/agent/buildToolRegistry.js.map

@@ -1 +1 @@
-{"version":3,"file":"buildToolRegistry.js","sourceRoot":"","sources":["../../../../src/core/agent/buildToolRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AACjG,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAGxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAqC,MAAM,aAAa,CAAC;AA4BvF;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAsC,EACtC,UAAgC,EAChC,UAAoC,EAAE;IAEtC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;IAE9D,qEAAqE;IACrE,oEAAoE;IACpE,kDAAkD;IAClD,6DAA6D;IAC7D,uBAAuB;IACvB,MAAM,gBAAgB,GAAwB,EAAE,CAAC;IACjD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAgB,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,QAAiD,CAAC;QACrE,MAAM,cAAc,GAAG,IAAI,EAAE,YAAY,KAAK,cAAc,CAAC;QAC7D,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAC9B,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,KAAM,IAAwB,EAAE,CAAC;oBAC3C,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,kDAAkD;wBACzE,2EAA2E;wBAC3E,uDAAuD,CAC1D,CAAC;gBACJ,CAAC;gBACD,SAAS,CAAC,wCAAwC;YACpD,CAAC;YACD,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAuB,CAAC,CAAC;YACpD,oEAAoE;YACpE,mEAAmE;YACnE,oEAAoE;YACpE,EAAE;YACF,oEAAoE;YACpE,iEAAiE;YACjE,sDAAsD;YACtD,qEAAqE;YACrE,sEAAsE;YACtE,2DAA2D;YAC3D,IAAI,cAAc;gBAAE,SAAS;YAC7B,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,8EAA8E;IAC9E,MAAM,gBAAgB,GACpB,MAAM,CAAC,MAAM,GAAG,CAAC;QACf,CAAC,CAAC,oEAAoE;YACpE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAE,EAAE,CAAC;QAC7D,CAAC,CAAC,EAAE,CAAC;IAET,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,oEAAoE;IACpE,uEAAuE;IACvE,sEAAsE;IACtE,iEAAiE;IACjE,MAAM,cAAc,GAAiC,EAAE,CAAC;IACxD,IAAI,OAAO,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG;YACd,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9B,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtC,GAAG,gBAAgB,CAAC,IAAI,EAAE;SAC3B,CAAC;QACF,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,qBAAqB,iBAAiB,0CAA0C;gBAC9E,gFAAgF;gBAChF,kFAAkF;gBAClF,oDAAoD,CACvD,CAAC;QACJ,CAAC;QACA,cAAsC,CAAC,IAAI,CAAC;YAC3C,IAAI,EAAE,iBAAiB;YACvB,IAAI,EAAE,gBAAgB,EAAE;SACzB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,iBAAiB,GAAiC;QACtD,GAAG,QAAQ;QACX,GAAG,gBAAgB;QACnB,GAAG,cAAc;QACjB,GAAG,gBAAgB;KACpB,CAAC;IAEF,8DAA8D;IAC9D,kEAAkE;IAClE,sEAAsE;IACtE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,+EAA+E;QAC/E,8EAA8E;QAC9E,gFAAgF;QAChF,2EAA2E;QAC3E,uEAAuE;QACvE,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,CAAC,IAAI,+BAA+B;gBACtE,wEAAwE;gBACxE,oEAAoE;gBACpE,gCAAgC,CACnC,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAU,CAAC,CACxD,CAAC;IACF,mEAAmE;IACnE,iEAAiE;IACjE,mEAAmE;IACnE,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;QACtD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,sEAAsE;IACtE,EAAE;IACF,qEAAqE;IACrE,0EAA0E;IAC1E,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC1F,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,cAAc,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,qBAAqB,mBAAmB,wCAAwC;gBAC9E,kFAAkF;gBAClF,mFAAmF;gBACnF,mBAAmB,CACtB,CAAC;QACJ,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhE,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"buildToolRegistry.js","sourceRoot":"","sources":["../../../../src/core/agent/buildToolRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8KG;AAEH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AACjG,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAGxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAqC,MAAM,aAAa,CAAC;AA4BvF;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAsC,EACtC,UAAgC,EAChC,UAAoC,EAAE;IAEtC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;IAE9D,qEAAqE;IACrE,oEAAoE;IACpE,kDAAkD;IAClD,6DAA6D;IAC7D,uBAAuB;IACvB,MAAM,gBAAgB,GAAwB,EAAE,CAAC;IACjD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAgB,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,QAAiD,CAAC;QACrE,MAAM,cAAc,GAAG,IAAI,EAAE,YAAY,KAAK,cAAc,CAAC;QAC7D,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAC9B,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,KAAM,IAAwB,EAAE,CAAC;oBAC3C,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,kDAAkD;wBACzE,2EAA2E;wBAC3E,uDAAuD,CAC1D,CAAC;gBACJ,CAAC;gBACD,SAAS,CAAC,wCAAwC;YACpD,CAAC;YACD,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAuB,CAAC,CAAC;YACpD,oEAAoE;YACpE,mEAAmE;YACnE,oEAAoE;YACpE,EAAE;YACF,oEAAoE;YACpE,iEAAiE;YACjE,sDAAsD;YACtD,qEAAqE;YACrE,sEAAsE;YACtE,2DAA2D;YAC3D,IAAI,cAAc;gBAAE,SAAS;YAC7B,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,8EAA8E;IAC9E,MAAM,gBAAgB,GACpB,MAAM,CAAC,MAAM,GAAG,CAAC;QACf,CAAC,CAAC,oEAAoE;YACpE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAE,EAAE,CAAC;QAC7D,CAAC,CAAC,EAAE,CAAC;IAET,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,oEAAoE;IACpE,uEAAuE;IACvE,sEAAsE;IACtE,iEAAiE;IACjE,MAAM,cAAc,GAAiC,EAAE,CAAC;IACxD,IAAI,OAAO,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG;YACd,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9B,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtC,GAAG,gBAAgB,CAAC,IAAI,EAAE;SAC3B,CAAC;QACF,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,qBAAqB,iBAAiB,0CAA0C;gBAC9E,gFAAgF;gBAChF,kFAAkF;gBAClF,oDAAoD,CACvD,CAAC;QACJ,CAAC;QACA,cAAsC,CAAC,IAAI,CAAC;YAC3C,IAAI,EAAE,iBAAiB;YACvB,IAAI,EAAE,gBAAgB,EAAE;SACzB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,iBAAiB,GAAiC;QACtD,GAAG,QAAQ;QACX,GAAG,gBAAgB;QACnB,GAAG,cAAc;QACjB,GAAG,gBAAgB;KACpB,CAAC;IAEF,8DAA8D;IAC9D,kEAAkE;IAClE,sEAAsE;IACtE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,+EAA+E;QAC/E,8EAA8E;QAC9E,gFAAgF;QAChF,2EAA2E;QAC3E,uEAAuE;QACvE,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,CAAC,IAAI,+BAA+B;gBACtE,wEAAwE;gBACxE,oEAAoE;gBACpE,gCAAgC,CACnC,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAU,CAAC,CACxD,CAAC;IACF,mEAAmE;IACnE,iEAAiE;IACjE,mEAAmE;IACnE,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;QACtD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,sEAAsE;IACtE,EAAE;IACF,qEAAqE;IACrE,0EAA0E;IAC1E,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC1F,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,cAAc,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,qBAAqB,mBAAmB,wCAAwC;gBAC9E,kFAAkF;gBAClF,mFAAmF;gBACnF,mBAAmB,CACtB,CAAC;QACJ,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhE,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;AAC5D,CAAC"}

package/dist/esm/core/agent/evidence/frames.d.ts

@@ -22,15 +22,20 @@
  * from the exempt corpus. The frames are stable exported constants for this
  * reason as much as for the tests that match on them.
  */
-/** Opening of the evidence correction's authored frame. Stable — tests, docs
- *  and readers match on it. */
-export declare const EVIDENCE_CHECK_FRAME_PREFIX = "[evidence check";
+export { EVIDENCE_CHECK_FRAME_PREFIX } from '../../../lib/saidByPerson.js';
 /**
- * True when this message content is a correction the library wrote.
+ * True when this message content is a CORRECTION the library wrote.
  *
  * Both in-loop corrections are listed: the schema re-ask quotes a validator's
  * message about the model's own output, and the evidence recheck quotes the
  * model's own values. Neither is a person supplying data, and treating either
  * as one would exempt the very text it was written to challenge.
+ *
+ * DELIBERATELY NARROWER than `isSaidByPerson` (9.84.0), which excludes all
+ * four authored frames. This one is the exempt corpus's rule, and the exempt
+ * corpus is about who SUPPLIED a value, not who typed the message: widening it
+ * to the drop notice and the compaction frame would change which values the
+ * evidence gate exempts, which is a decision about the gate and not about
+ * authorship. Read `LIBRARY_AUTHORED_PREFIXES` if you want the whole list.
  */
 export declare function isLibraryAuthoredTurn(content: string): boolean;

package/dist/esm/core/agent/evidence/frames.js

@@ -22,17 +22,25 @@
  * from the exempt corpus. The frames are stable exported constants for this
  * reason as much as for the tests that match on them.
  */
-import { SCHEMA_CHECK_FRAME_PREFIX } from '../outputEnforcement.js';
-/** Opening of the evidence correction's authored frame. Stable — tests, docs
- *  and readers match on it. */
-export const EVIDENCE_CHECK_FRAME_PREFIX = '[evidence check';
+import { EVIDENCE_CHECK_FRAME_PREFIX, SCHEMA_CHECK_FRAME_PREFIX, } from '../../../lib/saidByPerson.js';
+// Both markers live in the authorship registry (9.84.0) — the one list of
+// openings this library puts on a user-role message it wrote. The sentences
+// that carry them are still `gate.ts`'s and `outputEnforcement.ts`'s.
+export { EVIDENCE_CHECK_FRAME_PREFIX } from '../../../lib/saidByPerson.js';
 /**
- * True when this message content is a correction the library wrote.
+ * True when this message content is a CORRECTION the library wrote.
  *
  * Both in-loop corrections are listed: the schema re-ask quotes a validator's
  * message about the model's own output, and the evidence recheck quotes the
  * model's own values. Neither is a person supplying data, and treating either
  * as one would exempt the very text it was written to challenge.
+ *
+ * DELIBERATELY NARROWER than `isSaidByPerson` (9.84.0), which excludes all
+ * four authored frames. This one is the exempt corpus's rule, and the exempt
+ * corpus is about who SUPPLIED a value, not who typed the message: widening it
+ * to the drop notice and the compaction frame would change which values the
+ * evidence gate exempts, which is a decision about the gate and not about
+ * authorship. Read `LIBRARY_AUTHORED_PREFIXES` if you want the whole list.
  */
 export function isLibraryAuthoredTurn(content) {
     return (content.startsWith(EVIDENCE_CHECK_FRAME_PREFIX) || content.startsWith(SCHEMA_CHECK_FRAME_PREFIX));

package/dist/esm/core/agent/evidence/frames.js.map

@@ -1 +1 @@
-{"version":3,"file":"frames.js","sourceRoot":"","sources":["../../../../../src/core/agent/evidence/frames.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE;+BAC+B;AAC/B,MAAM,CAAC,MAAM,2BAA2B,GAAG,iBAAiB,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,OAAO,CACL,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CACjG,CAAC;AACJ,CAAC"}
+{"version":3,"file":"frames.js","sourceRoot":"","sources":["../../../../../src/core/agent/evidence/frames.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AAEtC,0EAA0E;AAC1E,4EAA4E;AAC5E,sEAAsE;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,OAAO,CACL,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CACjG,CAAC;AACJ,CAAC"}

package/dist/esm/core/agent/outputEnforcement.d.ts

@@ -105,8 +105,7 @@ export interface OutputFailure {
  * the two paths report a failure the same way.
  */
 export declare function describeFailure(err: unknown): OutputFailure;
-/** Opening of the authored frame. Stable — tests and readers match on it. */
-export declare const SCHEMA_CHECK_FRAME_PREFIX = "[schema check";
+export { SCHEMA_CHECK_FRAME_PREFIX } from '../../lib/saidByPerson.js';
 /**
  * The two messages a failed attempt adds to the conversation: the answer
  * that failed, and the correction.

package/dist/esm/core/agent/outputEnforcement.js

@@ -35,6 +35,7 @@
  */
 import { fnv1a } from '../slots/helpers.js';
 import { applyOutputSchema } from '../outputSchema.js';
+import { SCHEMA_CHECK_FRAME_PREFIX } from '../../lib/saidByPerson.js';
 /**
  * Append one row to the run's output-attempt ledger.
  *
@@ -65,8 +66,9 @@ export function describeFailure(err) {
     };
 }
 // ─── The corrective turn ─────────────────────────────────────────────
-/** Opening of the authored frame. Stable — tests and readers match on it. */
-export const SCHEMA_CHECK_FRAME_PREFIX = '[schema check';
+// The marker lives in the authorship registry both this file and a rule author
+// can import (9.84.0) — see `lib/saidByPerson.ts`. The frame below is ours.
+export { SCHEMA_CHECK_FRAME_PREFIX } from '../../lib/saidByPerson.js';
 /**
  * The two messages a failed attempt adds to the conversation: the answer
  * that failed, and the correction.

package/dist/esm/core/agent/outputEnforcement.js.map

@@ -1 +1 @@
-{"version":3,"file":"outputEnforcement.js","sourceRoot":"","sources":["../../../../src/core/agent/outputEnforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAA2B,MAAM,oBAAoB,CAAC;AAoDhF;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAwB,EAAE,GAAkB;IAC9E,MAAM,IAAI,GAAI,KAAK,CAAC,cAAuD,IAAI,EAAE,CAAC;IAClF,2EAA2E;IAC3E,+DAA+D;IAC/D,KAAK,CAAC,cAAc,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAcD;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,MAAM,CAAC,GAAG,GAOT,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,GACR,UAAU,EAAE,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,OAAO;QACL,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,iBAAiB;QACpC,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,IAAI,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC;QACrD,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AAEzD;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAoB,EACpB,OAAsB,EACtB,KAAmE;IAEnE,MAAM,KAAK,GACT,GAAG,yBAAyB,wDAAwD;QACpF,yBAAyB,KAAK,CAAC,OAAO,OAAO,KAAK,CAAC,aAAa,sBAAsB;QACtF,uFAAuF;QACvF,wFAAwF;QACxF,mEAAmE,CAAC;IACtE,OAAO;QACL,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE;QAC5C,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,OAAO,OAAO,CAAC,KAAK,EAAE,EAAE;KAC1D,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB,CAAC,GAA2B;IAC9D,OAAO,CACL,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAC9F,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC;AAED,wEAAwE;AAExE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAEtD,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAC7B,UAA6C,EAC7C,WAAoB;IAEpB,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACT,oFAAoF;YACpF,iBAAiB;YACjB,CAAC,WAAW,CAAC,CAAC,CAAC,sBAAsB,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,UAAU;KACxB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAqB;IACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC;IAC3E,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAmC,EACnC,QAA4C;IAE5C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,KAAK,GAAG,MAA0C,CAAC;IACzD,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;QACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClF,OAAO,QAA6C,CAAC;QACvD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,sEAAsE;QACtE,+DAA+D;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAkCD;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,MAAmC;IAEnC,IAAI,CAAC;QACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC"}
+{"version":3,"file":"outputEnforcement.js","sourceRoot":"","sources":["../../../../src/core/agent/outputEnforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAA2B,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAoDtE;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAwB,EAAE,GAAkB;IAC9E,MAAM,IAAI,GAAI,KAAK,CAAC,cAAuD,IAAI,EAAE,CAAC;IAClF,2EAA2E;IAC3E,+DAA+D;IAC/D,KAAK,CAAC,cAAc,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAcD;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,MAAM,CAAC,GAAG,GAOT,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,GACR,UAAU,EAAE,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,OAAO;QACL,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,iBAAiB;QACpC,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,IAAI,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC;QACrD,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE,+EAA+E;AAC/E,4EAA4E;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAoB,EACpB,OAAsB,EACtB,KAAmE;IAEnE,MAAM,KAAK,GACT,GAAG,yBAAyB,wDAAwD;QACpF,yBAAyB,KAAK,CAAC,OAAO,OAAO,KAAK,CAAC,aAAa,sBAAsB;QACtF,uFAAuF;QACvF,wFAAwF;QACxF,mEAAmE,CAAC;IACtE,OAAO;QACL,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE;QAC5C,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,OAAO,OAAO,CAAC,KAAK,EAAE,EAAE;KAC1D,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB,CAAC,GAA2B;IAC9D,OAAO,CACL,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAC9F,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC;AAED,wEAAwE;AAExE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAEtD,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAC7B,UAA6C,EAC7C,WAAoB;IAEpB,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACT,oFAAoF;YACpF,iBAAiB;YACjB,CAAC,WAAW,CAAC,CAAC,CAAC,sBAAsB,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,UAAU;KACxB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAqB;IACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC;IAC3E,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAmC,EACnC,QAA4C;IAE5C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,KAAK,GAAG,MAA0C,CAAC;IACzD,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;QACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClF,OAAO,QAA6C,CAAC;QACvD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,sEAAsE;QACtE,+DAA+D;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAkCD;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,MAAmC;IAEnC,IAAI,CAAC;QACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC"}

package/dist/esm/core/agent/selfCallNotice.d.ts

@@ -0,0 +1,140 @@
+/**
+ * The answer a `read_skill` SELF-CALL gets back (9.84.0).
+ *
+ * A self-call is `read_skill("X")` from a cursor already standing on X. It used
+ * to fall through the skill-graph gate's reachability arm — `makeReachableSkills`
+ * filters the cursor out of its own successor set (a MOVE to where you already
+ * are is not a move) and `openSkillIds()` excludes every graph-wired skill, so
+ * the cursor's own id is in neither half of `hops ∪ open`. The model was told:
+ *
+ *     read_skill("X") is not reachable from here. Reachable skills: …
+ *
+ * while X's body was in its system prompt and X's tools were in that very call's
+ * tool list. Read as a statement about AVAILABILITY — which is how a model reads
+ * "not reachable" — that is a flat contradiction of the request it arrived in,
+ * and the observed behaviour was to stop and answer that it could not help.
+ *
+ * ── THE LAW THIS FILE IS WRITTEN AGAINST ──────────────────────────────────
+ *
+ * A TOOL RESULT IS NOT READ ONCE. It is composed during iteration N, written
+ * into `history`, and then read by the model on call N+1 AND ON EVERY CALL
+ * AFTER IT for the rest of the turn — including the out-of-budget WRAP-UP,
+ * which `callLLM` serves with an EMPTY tool list under a user message saying
+ * "Do not request tools".
+ *
+ * The consequence is the whole design: NO COMPOSE-TIME CHECK CAN MAKE A
+ * FORWARD-LOOKING SENTENCE SAFE. A budget test, a posture test, a cursor test
+ * — each is true at the instant it runs and each is outlived by the sentence
+ * it admitted. Three rounds of this file fixed one clause at a time and each
+ * time a different clause was still false, because every one of them was a
+ * PREDICTION and the fix was always a better prediction.
+ *
+ * So the notice makes no predictions at all. Every clause is a fact about ONE
+ * already-finished event — the call the model made `read_skill` on — and every
+ * clause is anchored to that call by name ("that call"), never by deixis ("the
+ * call you just made", which denotes a different call each time it is re-read).
+ * A past fact about a named call cannot be falsified by anything that happens
+ * afterwards: not by the budget running out, not by a posture refusing a hop,
+ * not by a sibling tool in the same batch moving the cursor.
+ *
+ * ── WHAT WAS DELETED, AND WHY THE NOTICE STILL DOES ITS JOB ───────────────
+ *
+ * Gone: the exhortation ("Go ahead and act on the request"), the move offer
+ * ("read_skill MOVES you somewhere else — from here that would be: beta"), the
+ * open-skill offer ("These activate without moving you: gamma"), and the
+ * budget clause that was added to gate them. Each was false somewhere:
+ *
+ *   • the exhortation, on the wrap-up call, beside "Do not request tools";
+ *   • the move offer, on the wrap-up call (a hop is a tool call), under
+ *     `strictness: 'rails'` (every model hop refused) and under `'guard'` on a
+ *     decisively-routed turn (every hop not on an outstanding menu refused) —
+ *     where the sibling posture arm answers a taken-up offer with "read_skill
+ *     here reaches only the open skills: gamma", contradicting the notice from
+ *     the arm immediately above it, and spending escalation budget to do so;
+ *   • the budget clause, because a budget read at compose time is a claim
+ *     about a call that has not happened.
+ *
+ * The notice's JOB is to stop a model concluding its capability is gone. It
+ * does that by stating what it held, not by promising what it may do: you were
+ * standing in this skill, its instructions were in that call's prompt, its
+ * tools were on that call's wire, and asking took nothing away. A model that
+ * reads those four facts has no ground left for "I cannot help".
+ *
+ * The forward-looking half had a rightful owner all along, and it is not a
+ * tool result: the `read_skill` DESCRIPTION is recomposed on every single call,
+ * so it can safely speak in the present ("You are in 'beta'."), it is filtered
+ * for per-role visibility at source, and it is absent from the wrap-up because
+ * the whole tool list is. One owner for the present tense, one for the past,
+ * and they can no longer disagree — which is the only property that survived
+ * every round of this bug.
+ */
+import type { ActiveInjection } from '../../lib/injection-engine/types.js';
+import type { LLMToolSchema } from '../../adapters/types.js';
+/** What the current skill's tools did on the call the model made `read_skill` on. */
+export interface SelfSkillTools {
+    /** Every tool the skill declares — `[]` for a skill that declares none. */
+    readonly declared: readonly string[];
+    /** Those actually on that call's wire. A subset of `declared`. */
+    readonly served: readonly string[];
+}
+/**
+ * The skill's tools, as of the call the model just made — or `undefined` when
+ * that cannot be established, which is not the same answer and must not be
+ * reported as one.
+ *
+ * `undefined` means the notice says nothing about tools at all. It happens when
+ * the tools slot composed no per-iteration list (`reactMode: 'classic'` caches
+ * the slot, and `callLLM` falls back to its build-time schemas), or when the
+ * cursor's skill is not in the active set. Silence is the only honest output
+ * there: the alternative is a sentence naming tools the model may not have.
+ *
+ * The out-of-budget wrap-up is NOT one of these cases and must not be modelled
+ * as one. Its empty tool list belongs to a LATER call; the wire read here is
+ * always the one the model was really handed on the call being answered, and
+ * the notice speaks of that call and only that call.
+ */
+export declare function selfSkillTools(skillId: string, activeInjections: readonly ActiveInjection[] | undefined, wire: readonly LLMToolSchema[] | undefined): SelfSkillTools | undefined;
+/**
+ * The self-call's tool result.
+ *
+ * NOT a refusal to the MODEL, and deliberately so. The gate's other two arms
+ * refuse because the model asked for something it may not have; a self-call
+ * asks for a body it already holds, and the useful reply is the fact — where
+ * you stood, and what rode that call — not a decline. It is still counted as a
+ * refusal by the ESCALATION BUDGET (`noteSkillRefusal`, beside the emit), and
+ * those two facts do not fight: the budget is not measuring how the sentence
+ * reads, it is measuring a model that keeps asking the graph where it is
+ * instead of working, which is exactly the stuck run the budget escalates.
+ *
+ * It still OVERWRITES the tool's own result the way every other arm does,
+ * because that overwrite is what puts the authoritative sentence in front of
+ * the governance rules, the refusal cap and the after-tool moment, on both
+ * channels, before the model reads anything.
+ *
+ * The one thing not overwritten is a BODY. The live case is `surfaceMode:
+ * 'both'` — `'tool-only'` cannot arise here, because `skillBodyDelivery`
+ * refuses it at BUILD time for anything but an `llm-activated` skill and only a
+ * graph-wired skill can be the cursor. Under `'both'` the body is in the system
+ * prompt AND rides the tool result, and the second copy is the whole point of
+ * the mode: recency-first delivery, the body at the end of the window rather
+ * than only at the top of the prompt. Dropping it here would quietly demote
+ * `'both'` to `'system-prompt'` on the one call that asked to re-read.
+ *
+ * TENSE IS LOAD-BEARING, AND SO IS DEIXIS. Every clause below is past tense
+ * about a single named call, and every reference to that call is "that call" —
+ * bound by the opening clause, which says which call it was. "The call you just
+ * made" was the earlier wording and it is not safe: re-read four calls later it
+ * denotes call four, and the tools it names rode call one.
+ *
+ * There are exactly two present-tense phrases in the output and both are
+ * timeless rather than temporal: "It declares no tools of its own" (a
+ * declaration is fixed when the skill is defined and cannot vary within a run)
+ * and "Its instructions are repeated below" (the body is appended to this very
+ * string, so the sentence is true wherever the string is read).
+ */
+export declare function selfCallNotice(args: {
+    readonly skillId: string;
+    /** `undefined` when the wire could not be established — see `selfSkillTools`. */
+    readonly tools: SelfSkillTools | undefined;
+    readonly body?: string;
+}): string;