car-runtime 0.31.0 → 0.32.1

package/index.d.ts

@@ -184,18 +184,23 @@ export class CarRuntime {
 
   // --- State ---
 
-  /** Set a state key (value must be a JSON string). */
-  stateSet(key: string, valueJson: string): void;
+  /** Set a state key (value must be a JSON string). `tenant` (optional)
+   * scopes the write to one tenant's keyspace (E3). */
+  stateSet(key: string, valueJson: string, tenant?: string): void;
 
-  /** Get a state key. Returns the value as a JSON string, or `"null"`. */
-  stateGet(key: string): string;
+  /** Get a state key. Returns the value as a JSON string, or `"null"`.
+   * `tenant` (optional) scopes the read to one tenant's keyspace (E3). */
+  stateGet(key: string, tenant?: string): string;
 
-  stateExists(key: string): boolean;
+  /** `tenant` (optional) scopes the check to one tenant's keyspace (E3). */
+  stateExists(key: string, tenant?: string): boolean;
 
-  /** Snapshot of all state as a JSON string. */
-  stateSnapshot(): string;
+  /** Snapshot of all state as a JSON string. `tenant` (optional) scopes
+   * the snapshot to one tenant's keyspace (E3). */
+  stateSnapshot(tenant?: string): string;
 
-  stateKeys(): string[];
+  /** `tenant` (optional) scopes the key list to one tenant's keyspace (E3). */
+  stateKeys(tenant?: string): string[];
 
   // --- Memory / Facts (graph-backed) ---
 
@@ -243,8 +248,129 @@ export class CarRuntime {
   /** Run memory consolidation ("dream") pass. Returns a JSON report. */
   consolidate(): string;
 
+  /**
+   * Get the live engine's utility-aware retrieval blend (U-Mem).
+   * Returns JSON `{ utility_weight, utility_exploration }`.
+   */
+  utilityRetrieval(): string;
+
+  /**
+   * Set the live engine's utility-aware retrieval blend (U-Mem).
+   * `utilityWeight` 0 = pure relevance (ordering unchanged);
+   * `utilityExploration` scales the UCB uncertainty term (only consulted
+   * when weight > 0). Omitting `utilityExploration` keeps the engine's
+   * current value (read-modify-write), it does NOT reset it to 0. Takes
+   * effect on the next context build. Returns the applied JSON
+   * `{ utility_weight, utility_exploration }`.
+   */
+  setUtilityRetrieval(utilityWeight: number, utilityExploration?: number | null): Promise<string>;
+
+  /**
+   * Run the U-Mem cost-aware knowledge cascade (Slice 5 live evolve loop) on
+   * the daemon. `requestJson` is `{ current_confidence, policy, observed,
+   * claim? }`; the daemon runs each tier's mechanic (self_reflect → reflect(),
+   * human_expert → ApprovalLedger HITL) + the budget/target walk, escalating
+   * cheapest-first on the caller-supplied observed confidence. Returns JSON
+   * `{ run, pending_approval? }`.
+   */
+  cascadeRun(requestJson: string): Promise<string>;
+
+  /**
+   * Plan an evolution cycle over the daemon's **live** engine signals — the
+   * self-evolution governor's host surface (arXiv 2507.21046). `requestJson` is
+   * `{ policy?: { pressure_threshold?, budget? } }`; the daemon folds the session
+   * memgine's real per-component pressure/evidence and runs the governor. Returns
+   * the `EvolutionPlan` JSON `{ decisions, spent, evolve_now }` — the live
+   * counterpart to the stateless `planEvolution` helper. Plans only; the caller
+   * dispatches the chosen components.
+   */
+  planEvolutionLive(requestJson: string): Promise<string>;
+  /** `sync.status` — roster, journal frontier, stable frontier, state hash (B6). */
+  syncStatus(requestJson: string): Promise<string>;
+  /** `sync.append` — record an op on any surface: `{ surface, payload, scope? }` (B6). */
+  syncAppend(requestJson: string): Promise<string>;
+  /** `sync.record_turn` — route a conversation turn through the oplog so `syncResume` is real (B6). */
+  syncRecordTurn(requestJson: string): Promise<string>;
+  /** `sync.record_intent` — write the leased-execution intent ledger; feeds the fence oracle (B6). */
+  syncRecordIntent(requestJson: string): Promise<string>;
+  /** `sync.pump` — one push/pull/ack reconciliation round against the relay (B6). */
+  syncPump(requestJson: string): Promise<string>;
+  /** `sync.checkpoint` — publish a device-side checkpoint at the stable frontier (B6). */
+  syncCheckpoint(requestJson: string): Promise<string>;
+  /** `sync.rebase` — cold bootstrap / straggler re-entry onto the latest checkpoint (B6). */
+  syncRebase(requestJson: string): Promise<string>;
+  /** `sync.transcript` — the ordered role-threaded `Turn[]` projection (B6). */
+  syncTranscript(requestJson: string): Promise<string>;
+  /** `sync.resume` — the repaired, provider-valid `Message[]` for replay (B6). */
+  syncResume(requestJson: string): Promise<string>;
+  /** `sync.fence_check` — the dispatch fence at the point of effect; only `may_dispatch` authorizes (B6). */
+  syncFenceCheck(requestJson: string): Promise<string>;
+  /** `lease.acquire` — CAS-acquire the per-agent execution lease; epoch bumps on grant (B6). */
+  leaseAcquire(requestJson: string): Promise<string>;
+  /** `lease.renew` — heartbeat the lease (no epoch bump), iff still the holder (B6). */
+  leaseRenew(requestJson: string): Promise<string>;
+  /** `lease.release` — clean handoff (next acquire skips the TTL wait) (B6). */
+  leaseRelease(requestJson: string): Promise<string>;
+  /** `lease.status` — the linearizable read of the current lease, or `null` (B6). */
+  leaseStatus(requestJson: string): Promise<string>;
+
+  /**
+   * Run one evolution cycle over the daemon's **live** signals — the
+   * self-evolution governor's real executor (arXiv 2507.21046). `requestJson`
+   * is `{ policy?, dry_run?, harness_baseline_metrics?,
+   * harness_candidate_metrics? }`; the daemon plans over all five live
+   * components (Memory/Skills/Context from the engine, Harness from the event
+   * log, Tools from connector health) and dispatches each `EvolveNow`
+   * component: Memory → consolidate (sized by decide_maintenance), Skills →
+   * evolve_skills over event-log failure traces, Harness → the HITL-gated
+   * harness_evolution loop (pending approvals resolve via
+   * `permission.approve`/`reject` by fingerprint); Context/Tools record
+   * `not_executable`. Returns the cycle record JSON
+   * `{ plan, steps, evolved, pending_approvals? }`.
+   */
+  runEvolutionCycleLive(requestJson: string): Promise<string>;
+
   // --- Skills ---
 
+  /**
+   * Gate a skill's deployment capability against its provenance on the daemon,
+   * folding the named skill's **live** track record into the decision
+   * (arXiv 2602.12430 "Agent Skills"). `requestJson` is `{ skill_name,
+   * provenance, requested_tier }` where `requested_tier` is
+   * `"read_only" | "sandbox_edit" | "full_access"`. The daemon overrides the
+   * provenance's lifecycle counts with the skill's real success/fail record, so
+   * a skill failing in the field is denied despite an official signature.
+   * Returns the `SkillDeploymentDecision` JSON. Live counterpart to the
+   * stateless `gateSkillDeployment` helper.
+   */
+  gateSkillDeploymentLive(requestJson: string): Promise<string>;
+
+  /**
+   * Enforce a skill's deployment at load time against the session's durable
+   * approval ledger (arXiv 2602.12430 "Agent Skills" Slice 4 — the HITL bridge).
+   * `requestJson` is `{ skill_name, provenance, requested_tier }`; the daemon
+   * gates the skill (folding its live track record), then resolves the verdict
+   * against standing operator decisions: `Allow`/`Downgrade` deploy
+   * autonomously, a `Deny` is overridden/blocked/pending. Returns
+   * `{ decision, enforcement, pending_approval? }`; a pending approval is
+   * resolved via `permission.approve`/`permission.reject` by the returned
+   * `fingerprint`.
+   */
+  enforceSkillDeploymentLive(requestJson: string): Promise<string>;
+
+  /**
+   * Ingest a skill through the deployment gate on the daemon (arXiv 2602.12430
+   * "Agent Skills" — the loader integration). `requestJson` carries the skill
+   * fields (`name`, `code`, `platform`, `persona?`, `url_pattern?`,
+   * `description?`, `supersedes?`, `task_keywords?`) plus `provenance?` and
+   * `requested_tier`. The daemon gates + enforces against the session ledger and
+   * **only ingests when deployment is permitted**, stamping the granted ceiling
+   * onto the skill. Returns `{ ingested, node?, decision, enforcement,
+   * pending_approval? }`; a pending deny is resolved via
+   * `permission.approve`/`permission.reject` by the returned `fingerprint`.
+   */
+  ingestSkillGoverned(requestJson: string): Promise<string>;
+
   /**
    * Save a learned skill with trigger context. Returns the node
    * index.
@@ -754,6 +880,15 @@ export class CarRuntime {
    * `limit` caps results (clamped to [1, 50]; null = default 5).
    */
   discoveryResolve(need: string, limit?: number | undefined | null): Promise<string>;
+  /**
+   * Record a discovery-routed run's outcome (`"success"` | `"failure"`) into
+   * the routing learning store, keyed by the service's `agentdns://`
+   * identifier — for EVERY provider kind (connector, registry, external, a2a,
+   * declarative). This is the feedback loop `discoveryResolve`'s success
+   * prior learns from. Returns `{ identifier, outcome, successes, failures }`
+   * JSON.
+   */
+  discoveryReport(identifier: string, outcome: "success" | "failure" | string): Promise<string>;
   /**
    * Compose a decompose/retrieve/plan route over all discoverable services.
    * Returns `{ plan, decomposition, candidates, metadata }` JSON. Planning only;
@@ -820,6 +955,58 @@ export class CarRuntime {
   /** Count of events in this runtime's execution log. */
   eventCount(): Promise<number>;
 
+  /** Drain buffered chunks + current status for a detached
+   * (streaming/long-running) tool invocation (C2). `handle` is the
+   * `tool_handle` a detached ToolCall action (`invocation_mode: "streaming"
+   * | "long_running"`) returned as its output. Returns the ToolPollResult
+   * JSON string `{handle, tool, action_id, status, chunks, result?,
+   * error?}`, or `null` for an unknown / already fully-consumed handle. */
+  toolPoll(handle: string): Promise<string | null>;
+
+  /** Request cooperative cancellation of a detached (streaming/long-running)
+   * tool invocation (C2). Resolves `true` when the handle was known (the
+   * invocation is sealed `cancelled` unless already terminal), `false` for
+   * an unknown handle. */
+  toolCancel(handle: string): Promise<boolean>;
+
+  /** Structured audit query over the event log (G2). `queryJson` is an
+   * EventQuery object (kinds/actionId/proposalId/since/until/dataMatches/limit);
+   * returns `{count, events}` as a JSON string, most-recent-first. */
+  eventQuery(queryJson: string): Promise<string>;
+
+  /** Get/set the event-log retention policy (G2). Pass a
+   * `{maxEvents, maxAgeSecs}` JSON string to install it, or omit to read the
+   * current policy. Returns a JSON string. */
+  eventRetention(policyJson?: string): Promise<string>;
+
+  /** Per-agent token/cost report (G3), folded from metered inference events.
+   * Returns a JSON array of `{agent, calls, tokensIn, tokensOut, costUsd}`. */
+  eventCostByAgent(): Promise<string>;
+
+  /** Turn on tamper-evident hash chaining for the session event log (A9).
+   * Every event appended from now on links to its predecessor by a content
+   * hash. Idempotent. */
+  enableEventLogHashChaining(): Promise<void>;
+
+  /** Verify the session event log's tamper-evidence chain (A9). Returns
+   * `{"verified": n}` (chained events verified) or `{"tampered_at": i}`
+   * (index of the first interior edit/deletion/reorder) as a JSON string.
+   * Head/tail truncation is not detectable (no anchored head hash). */
+  verifyEventLogChain(): Promise<string>;
+
+  /** Live operational metrics rollup (G1) — success/error rate, cost, latency,
+   * approvals, gate rejections, per-agent cost. `cost_usd` is the fold over the
+   * retained window; `cumulative_cost_usd` is the monotonic lifetime spend
+   * (survives retention trims). Returns JSON. */
+  metricsSummary(): Promise<string>;
+
+  /** Evaluate live metrics against thresholds (G1). `thresholdsJson` is an
+   * AlertThresholds object (omit for defaults); returns `{summary, alerts}` as
+   * JSON. The `max_cost_usd` budget is checked against the monotonic
+   * `cumulative_cost_usd` counter, so a retention trim never un-fires the
+   * `cost_overage` alert. */
+  metricsAlerts(thresholdsJson?: string): Promise<string>;
+
   /** Execution log counts and approximate retained native bytes. Returns JSON. */
   eventLogStats(): Promise<string>;
 
@@ -1586,8 +1773,34 @@ export function removeEnrollment(rt: CarRuntime, label: string): string;
  * Run a multi-stage workflow definition. Reuses the agent runner
  * registered via `registerAgentRunner` for any agent stages in the
  * workflow.
+ *
+ * `initialStateJson`, when given, is a JSON object seeded into workflow state
+ * before the run starts — the inter-workflow chaining hook (hand a prior
+ * result's `final_state` to the next workflow). Omitted = prior behavior.
+ * The reserved `goal` drift anchor cannot be injected this way.
  */
-export function runWorkflow(workflowJson: string): Promise<string>;
+export function runWorkflow(
+  workflowJson: string,
+  initialStateJson?: string | undefined | null,
+): Promise<string>;
+
+/**
+ * Run a JSON array of workflow definitions sequentially as a chain: each next
+ * workflow's initial state is the previous result's `final_state`, merged
+ * over `initialStateJson` (the previous result wins). Every workflow is
+ * statically pre-validated before any executes — structural garbage rejects
+ * the chain up front. Stops at the first non-`completed` result. Returns
+ * `{ results: [WorkflowResult, ...], status, paused_at_index?, error?,
+ * failed_at_index? }` JSON; a paused intermediate carries its `paused`
+ * checkpoint inside its result (checkpoint persistence stays caller-owned,
+ * like `runWorkflow`), and a mid-chain runtime engine error preserves the
+ * results so far (with top-level `error` + `failed_at_index`) instead of
+ * throwing. Reuses the agent runner registered via `registerAgentRunner`.
+ */
+export function workflowChain(
+  workflowsJson: string,
+  initialStateJson?: string | undefined | null,
+): Promise<string>;
 
 /**
  * Resume a workflow that paused at a human-in-the-loop approval gate.
@@ -1598,6 +1811,23 @@ export function runWorkflow(workflowJson: string): Promise<string>;
  */
 export function resumeWorkflow(pausedJson: string, inputJson: string): Promise<string>;
 
+/** List resumable workflow checkpoints under `runsDir` (H1). Returns a JSON
+ * array of `{run_id, paused_stage_id, prompt, created_at}` — rediscover
+ * resumable runs after a restart. */
+export function listPausedWorkflows(runsDir: string): string;
+
+/** NLP (F4): identify the dominant language of `text`. Returns
+ * `{language, backend}` JSON (Apple NaturalLanguage on macOS, pure-Rust
+ * fallback elsewhere). */
+export function nlpIdentifyLanguage(text: string): string;
+
+/** NLP (F4): word-tokenize `text`. Returns `{tokens, backend}` JSON. */
+export function nlpTokenize(text: string): string;
+
+/** NLP (F4): extract named entities from `text`. Returns `{entities, backend}`
+ * JSON; entities are `{text, kind, byte_range}`. */
+export function nlpExtractEntities(text: string): string;
+
 /** Static analysis on a workflow definition. Returns verification report JSON. */
 export function verifyWorkflow(workflowJson: string): string;
 
@@ -1840,6 +2070,468 @@ export function transactionCheck(
   stateJson?: string | null,
 ): string;
 
+/**
+ * Like `transactionCheck`, but unions each action's write set with the keys a
+ * verified Code World Model predicts it writes (Code World Models Slice 3b —
+ * pre-flight conflict detection; `docs/proposals/code-world-models.md`).
+ * `transactionCheck` reasons over *declared* effects; a tool that writes a key
+ * it didn't declare produces a hazard that only surfaces at runtime. Once a
+ * model is verified you can predict those writes and fold them in here.
+ *
+ * `predictionsJson` is a JSON object mapping `actionId` → array of predicted
+ * write keys (the caller produced them by running the generated model). Returns
+ * the same `TransactionReport` JSON as `transactionCheck` `{ consistent,
+ * conflicts }`.
+ */
+export function transactionCheckWithPredictions(
+  proposalJson: string,
+  versionsJson: string | null | undefined,
+  stateJson: string | null | undefined,
+  predictionsJson: string,
+): string;
+
+/**
+ * Score a Code World Model against recorded trajectories (Slice 1 of
+ * `docs/proposals/code-world-models.md`, applying arXiv 2510.04542 "Code
+ * World Models for General Game Playing"). The paper validates an
+ * LLM-generated world model by unit-testing its `apply(state, action)`
+ * against recorded transitions; this is that transition-accuracy metric.
+ *
+ * `transitionsJson` is a JSON array of `{ stateBefore, action, stateAfter }`
+ * records (e.g. from `cwmTransitionsFromEvents`). `predictionsJson` is an
+ * index-aligned JSON array; each element is the model's predicted post-state
+ * object, or `{ "error": "<stack trace>" }` when running the generated code
+ * threw. Code execution is the caller's responsibility (e.g. a sandbox), so
+ * this stays a pure scoring function.
+ *
+ * Returns the `ScoreReport` JSON `{ total, correct, errored, accuracy,
+ * failures: [{ index, action, expected, predicted?, error? }] }`. A
+ * length mismatch between transitions and predictions is an error, not a
+ * silent truncation.
+ */
+export function cwmScore(
+  transitionsJson: string,
+  predictionsJson: string,
+): string;
+
+/**
+ * Gate a skill's deployment capability against its provenance
+ * (`docs/proposals/skill-trust-governance.md`, applying arXiv 2602.12430 "Agent
+ * Skills"). Maps a skill's provenance to a trust tier and caps the
+ * `PermissionTier` capability that tier permits — the supply-chain governance
+ * lens motivated by the paper's finding that 26.1% of community skills are
+ * vulnerable.
+ *
+ * `provenanceJson` is a `SkillProvenance` `{ signed?, signer_trusted?, scanned?,
+ * vulnerabilities?, source?: "official" | "first_party" | "community" |
+ * "unknown", success_count?, fail_count? }`; `requestedTier` is `"read_only" |
+ * "sandbox_edit" | "full_access"`. Returns the `SkillDeploymentDecision` JSON
+ * `{ trust: "untrusted" | "community" | "verified" | "official", ceiling,
+ * granted, outcome: "allow" | "downgrade" | "deny", reason }`. A vulnerable,
+ * unsigned, or degraded skill is denied regardless of the requested tier.
+ */
+export function gateSkillDeployment(
+  provenanceJson: string,
+  requestedTier: string,
+): string;
+
+/**
+ * Static information-flow + tool-sequence safety check over a plan
+ * (`docs/proposals/verifiable-tool-safety.md`, applying arXiv 2601.08012
+ * "Towards Verifiably Safe Tool Use for LLM Agents"). Catches hazards no
+ * per-action check covers: sensitive data reaching an exfiltration/untrusted
+ * sink, and forbidden tool orderings — statically, before execution.
+ *
+ * `labelsJson` is a JSON object mapping `toolName` → capability-enhanced-MCP
+ * labels `{ capability?: string, confidentiality?: "public" | "internal" |
+ * "secret", trust?: "trusted" | "untrusted", sink?: boolean, declassifier?:
+ * boolean }` (all fields default to public/trusted/non-sink). `policyJson`
+ * (optional) is `{ minConfidential?: "public" | "internal" | "secret",
+ * forbiddenSequences?: [string, string][] }` — the minimum confidentiality
+ * guarded at sinks and forbidden ordered `(before, after)` capability pairs.
+ *
+ * Returns the `FlowReport` JSON `{ safe: boolean, violations: [{ kind:
+ * "sensitive_to_sink" | "forbidden_sequence", actions: string[], key?: string,
+ * explanation: string, mitigation: string }] }`. Tools absent from `labelsJson`
+ * are unconstrained, so an empty map is trivially safe. Reasons over declared
+ * `state_dependencies`/`expected_effects` (the edges the executor sequences on);
+ * flows through undeclared channels are out of scope.
+ */
+export function checkInformationFlow(
+  proposalJson: string,
+  labelsJson: string,
+  policyJson?: string | null,
+): string;
+
+/**
+ * Map an information-flow `FlowReport` (from `checkInformationFlow`) to an
+ * enforcement decision (Slice 2 of `docs/proposals/verifiable-tool-safety.md`).
+ * Turns the advisory check into a gate: clear data exfiltration is blocked,
+ * ambiguous forbidden orderings are escalated to a human, the rest proceed.
+ *
+ * `gatePolicyJson` (optional) is `{ onSensitiveToSink?: "allow" |
+ * "require_approval" | "block", onForbiddenSequence?: "allow" |
+ * "require_approval" | "block" }` (defaults: block exfiltration, escalate
+ * orderings). Returns the `FlowGateDecision` JSON `{ action: "allow" |
+ * "require_approval" | "block", blocked: FlowViolation[], needs_approval:
+ * FlowViolation[], reason: string }`, where `action` is the most severe across
+ * violations. Wiring `require_approval` to the permission-tier HITL ledger is
+ * the engine step.
+ */
+export function gateInformationFlow(
+  reportJson: string,
+  gatePolicyJson?: string | null,
+): string;
+
+/**
+ * Enforce a `FlowGateDecision` (from `gateInformationFlow`) against the durable
+ * human-in-the-loop approval ledger (Slice 3 of
+ * `docs/proposals/verifiable-tool-safety.md`). A `require_approval` hazard a
+ * human previously **approved** (by its stable flow fingerprint) is allowed
+ * through, one **rejected** is blocked, and an unseen one becomes pending — so
+ * the runtime confirms only the hazardous flows, and only once.
+ *
+ * `approvalsJson` (optional) is a JSON array of prior `ApprovalRecord`s
+ * (`{ fingerprint, required_tier, decision: "approved" | "rejected", reviewer,
+ * reason, evidence?, decided_at }`). Returns the `FlowEnforcement` JSON `{ allow:
+ * boolean, blocked: FlowViolation[], pending: [{ fingerprint, violation }],
+ * reason }`. Stateless — the ledger is rebuilt from `approvalsJson` each call.
+ */
+export function enforceInformationFlow(
+  decisionJson: string,
+  approvalsJson?: string | null,
+): string;
+
+/**
+ * Analyze a schedule of multi-agent read-generate-write operations for the four
+ * concurrency anomalies of *Verified Detection and Prevention of Concurrency
+ * Anomalies in Multi-Agent LLM Systems* (`docs/proposals/concurrency-anomalies.md`,
+ * applying arXiv 2606.17182) and classify the achieved consistency level. The
+ * time-extended, inter-agent complement to `transactionCheck`.
+ *
+ * `opsJson` is a JSON array of `AgentOp` (serde snake_case keys): `{ id, agent?,
+ * read_set?, write_set?, tools_read?, tools_written?, depends_on?, read_at?,
+ * commit_at? }` (omitted fields default). Returns the `ConcurrencyReport` JSON:
+ * `{ level: "l0" | "l1" | "l2" | "l3" | "l4", serializable, anomalies: [{
+ * anomaly: "stale_generation" | "phantom_tool" | "causal_cascade" |
+ * "tool_effect_reorder", key, ops, explanation }] }` — `level` is set by the
+ * most severe anomaly present (causal-cascade → l0 … none → l4 serializable).
+ */
+export function analyzeConcurrency(opsJson: string): string;
+
+/**
+ * Gate a concurrency report (from `analyzeConcurrency`) into remediations under a
+ * policy (`docs/proposals/concurrency-anomalies.md`, arXiv 2606.17182 Slice 2 —
+ * the analogue of `gateInformationFlow` for concurrency). Maps each anomaly to a
+ * structural fix and a dispatch disposition by severity.
+ *
+ * `reportJson` is the `ConcurrencyReport`; `policyJson` (optional) is a
+ * `ConcurrencyGatePolicy` `{ abort_at_or_below, require_approval_at_or_below }`
+ * (levels `"l0".."l4"`; defaults abort on `l0`, approval on `l1`). Returns the
+ * `ConcurrencyGate` JSON: `{ safe, level, abort, remediations: [{ anomaly,
+ * remediation: { kind: "reread_and_regenerate" | "pin_tool_registry" |
+ * "enforce_causal_order" | "serialize_writers", ... }, disposition:
+ * "auto_remediate" | "require_approval" | "abort" }] }`.
+ */
+export function gateConcurrency(
+  reportJson: string,
+  policyJson?: string | null,
+): string;
+
+/**
+ * Statically verify a workflow graph for structural defects
+ * (`docs/proposals/workflow-graph-verification.md`, applying arXiv 2603.20356
+ * "Agentproof"). Catches topology-level defects a schema check misses — a
+ * dead-end stage, an unreachable exit, a trap loop — before execution, each with
+ * a witness path (the counter-example for a repair loop).
+ *
+ * `graphJson` is a `WorkflowGraph` `{ entry: string, terminals: string[],
+ * stages: string[], edges: [{ from, to, condition? }] }`. Returns the
+ * `WorkflowVerifyReport` JSON `{ sound: boolean, defects: [{ kind:
+ * "missing_entry" | "dangling_edge" | "unreachable_stage" | "dead_end" |
+ * "no_exit_reachable" | "unreachable_terminal", subject, witness: string[],
+ * explanation }] }`.
+ */
+export function verifyWorkflowGraph(graphJson: string): string;
+
+/**
+ * Check temporal safety policies over a workflow graph
+ * (`docs/proposals/workflow-graph-verification.md`, arXiv 2603.20356 "Agentproof"
+ * Slice 2 — the static half of the policy layer). The headline policy is the
+ * human-gate: a guard stage must precede a sensitive stage on *every* path.
+ *
+ * `graphJson` is a `WorkflowGraph`; `policiesJson` is a JSON array of
+ * `TemporalPolicy` (`{ kind: "precedes", earlier: string, later: string, name?:
+ * string }`). Returns the `PolicyReport` JSON `{ compliant: boolean, violations:
+ * [{ policy, stage, witness: string[], explanation }] }` — each violation's
+ * witness is a path that reaches the guarded stage without the required
+ * predecessor.
+ */
+export function checkWorkflowPolicies(
+  graphJson: string,
+  policiesJson: string,
+): string;
+
+/**
+ * Verify a plan's sequential feasibility by symbolic forward simulation
+ * (`docs/proposals/plan-precondition-verification.md`, applying arXiv 2603.14730
+ * "GNNVerifier" — the deterministic, training-free counterpart). Catches a step
+ * whose preconditions the earlier steps never establish, and an unreached goal,
+ * before anything runs (the STRIPS applicability check).
+ *
+ * `requestJson` is a `PlanCheckRequest` `{ initial: string[], steps: [{ id:
+ * string, preconditions?: string[], add_effects?: string[], del_effects?:
+ * string[] }], goal: string[] }`. Returns the `PlanCheckReport` JSON `{ valid:
+ * boolean, defects: [{ kind: "unmet_precondition" | "goal_not_achieved", step?,
+ * fact, explanation }], final_state: string[] }`. Effects apply even when a
+ * precondition fails, so one pass surfaces every defect.
+ */
+export function checkPlan(requestJson: string): string;
+
+/**
+ * Intent-grounded verify-before-commit (arXiv 2601.05755 "VIGIL" — defending
+ * against tool stream injection). Flags actions that drift outside the user's
+ * declared intent, blocking commit when the drifting action is influenced by an
+ * untrusted tool result (the injection signature). `requestJson` is `{ intent: {
+ * allowed_tools?: string[], allowed_resources?: string[], forbidden_capabilities?:
+ * string[] }, actions: [{ id: string, tool?: string, targets?: string[],
+ * capabilities?: string[], depends_on?: string[], untrusted?: boolean }] }`.
+ * Returns the `IntentReport` JSON `{ safe: boolean, commit_blocked: string[],
+ * violations: [{ action, kind: "tool_out_of_intent" | "target_out_of_intent" |
+ * "forbidden_capability", detail, tool_influenced: boolean, explanation }] }`.
+ * Pure, zero-inference.
+ */
+export function checkIntent(requestJson: string): string;
+
+/**
+ * Intent-grounded verify-before-commit straight from a plan's IR actions (VIGIL
+ * Slice 4 — the IR populater + check in one call). `requestJson` is `{ intent,
+ * actions: Action[], untrusted_tools?: string[], untrusted_ids?: string[] }`. The
+ * runtime derives the `IntentAction`s from its own IR (tool, `expected_effects` →
+ * targets, dependency edges → `depends_on`, `metadata.capabilities` →
+ * capabilities, `untrusted` from the supplied provenance) then runs the intent
+ * check. Returns the same `IntentReport` JSON.
+ */
+export function checkIntentPlan(requestJson: string): string;
+
+/**
+ * Map an intent report to an enforcement disposition (VIGIL Slice 2 — the gate).
+ * `reportJson` is a `checkIntent` report; `gatePolicyJson` is an optional
+ * `IntentGatePolicy` `{ on_untainted_drift: "allow" | "require_approval" | "block"
+ * }` (default `require_approval`). Injections (tool-stream-influenced drift) and
+ * forbidden capabilities always block regardless of policy. Returns the
+ * `IntentGateDecision` JSON `{ action, blocked, needs_approval, reason }`.
+ */
+export function gateIntent(reportJson: string, gatePolicyJson?: string): string;
+
+/**
+ * Enforce an `IntentGateDecision` against the durable approval ledger (VIGIL
+ * Slice 3 — the HITL bridge). `decisionJson` is a `gateIntent` decision;
+ * `approvalsJson` is an optional `ApprovalRecord[]` seeding the ledger. An
+ * out-of-intent action a human approved commits; one they rejected is blocked; a
+ * novel one is pending. Hard blocks (injections / forbidden capabilities) are
+ * never committable. Returns the `IntentEnforcement` JSON `{ commit, blocked,
+ * pending: [{ fingerprint, violation }], reason }`.
+ */
+export function enforceIntent(decisionJson: string, approvalsJson?: string): string;
+
+/**
+ * Plan a deterministic, budget-bounded context eviction over typed trajectory
+ * episodes (`docs/proposals/context-eviction.md`, applying arXiv 2606.11213
+ * "CWL" + the Governance-Decay guard, arXiv 2606.22528). The cheaper-than-
+ * summarization first move when the context window fills: shed action results
+ * whose effects are already persisted, preserve user turns and the active
+ * reasoning frontier, and never evict a pinned constraint.
+ *
+ * `episodesJson` is a JSON array of `ContextEpisode` `{ id, kind: "constraint" |
+ * "user_turn" | "agent_reasoning" | "action_result" | "observation", tokens?,
+ * persisted?, pinned?, recency? }`; `budget` is the token ceiling. Returns the
+ * `EvictionPlan` JSON `{ evicted: string[], retained_tokens, pinned_tokens,
+ * within_budget }`. `within_budget = false` means even the pinned/retained floor
+ * exceeds budget — the caller must fall back to summarizing compaction.
+ */
+export function planContextEviction(
+  episodesJson: string,
+  budget: number,
+): string;
+
+/**
+ * Merge divergent replicas of a CRDT shared state into the single state they
+ * all converge to, with strong eventual consistency
+ * (`docs/proposals/convergent-shared-state.md`, applying arXiv 2510.18893
+ * "CodeCRDT"). Supplies the deterministic *resolution* that complements
+ * `transactionCheck`'s conflict *detection*, and the merge layer the
+ * multi-device-sync design defers to.
+ *
+ * `replicasJson` is a JSON array of last-writer-wins maps, each `{ "<key>": {
+ * value: any, version: number, replica: string } }` (per-key version, e.g. from
+ * the versioned state store, plus the writing replica/agent id). Per shared key
+ * the dominating `(version, replica)` wins. Returns `{ registers, state }`: the
+ * merged LWW map (tags retained, so it can be merged again) and a materialized
+ * `key → value` state for feeding `verify`/`simulate`. Order-independent and
+ * idempotent (zero merge failures by construction).
+ */
+export function crdtMerge(replicasJson: string): string;
+
+/**
+ * Export a device/agent's state as a CRDT LWW map for replication — the *export*
+ * half of multi-device sync (`docs/proposals/convergent-shared-state.md`).
+ * `snapshotJson` is the plain state `{ key: value }` (e.g. from the state
+ * store's snapshot); `versionsJson` is `{ key: version }` (per-key versions);
+ * `replica` is this device/agent id. Returns the LWW map JSON `{ "<key>": {
+ * value, version, replica } }`, ready to exchange between replicas and feed to
+ * `crdtMerge`. Keys absent from `versionsJson` default to version 0.
+ */
+export function crdtExport(
+  snapshotJson: string,
+  versionsJson: string,
+  replica: string,
+): string;
+
+/**
+ * Merge replicas of a first-claim-wins claim registry for observation-driven
+ * multi-agent task coordination (Slice 3 of
+ * `docs/proposals/convergent-shared-state.md`). `registriesJson` is a JSON array
+ * of registries `{ "<task>": { claimant, version, replica } }`; per shared task
+ * the earliest `(version, replica)` claim wins. Returns `{ registry, owners: {
+ * [task]: claimant } }` — the merged CRDT plus the resolved one-owner-per-task
+ * view agents read to self-partition work without a coordinator. Order-independent
+ * and idempotent.
+ */
+export function crdtMergeClaims(registriesJson: string): string;
+
+/**
+ * Rank memory-retrieval candidates by utility-aware UCB — the deterministic
+ * variant of U-Mem's Semantic-Aware Thompson Sampling
+ * (`docs/proposals/autonomous-memory-agents.md`, applying arXiv 2602.22406).
+ * Blends each candidate's semantic `relevance` with a learned utility posterior
+ * (`Beta(success+1, fail+1)`): proven-useful memories rise, untried ones get an
+ * exploration bonus from their uncertainty, and it's reproducible (no RNG).
+ *
+ * `candidatesJson` is a JSON array of `{ id: string, relevance: number,
+ * success?: number, fail?: number }`. `exploration` weights the cold-start
+ * uncertainty bonus; `utilityWeight` (0..1) blends utility vs. raw relevance
+ * (`0` = pure relevance, so enabling this never changes ranking unless opted
+ * in). Returns the ranked JSON array `[{ id, score, relevance, utility }]`,
+ * highest score first.
+ */
+export function utilityRank(
+  candidatesJson: string,
+  exploration: number,
+  utilityWeight: number,
+): string;
+
+/**
+ * Decide U-Mem's cost-aware knowledge cascade — the *Evolve* escalation
+ * (`docs/proposals/autonomous-memory-agents.md`, applying arXiv 2602.22406).
+ * Given the current confidence in a piece of knowledge and an escalation policy,
+ * returns the cheapest tier (self-reflect → tool-verify → human-expert) that
+ * reaches the confidence target within a cost budget — or that the answer is
+ * already confident enough, or that the budget is exhausted.
+ *
+ * `policyJson` is `{ confidence_target: number, budget: number, tiers: [{ tier:
+ * "self_reflect" | "tool_verify" | "human_expert", cost: number,
+ * expected_confidence: number }] }` (tiers cheapest-first). Returns the outcome
+ * JSON — one of `{ decision: "already_confident", confidence }`, `{ decision:
+ * "accept", tier, confidence, cost_spent }`, or `{ decision: "exhausted",
+ * best_tier, confidence, cost_spent }`. Pure decision core; the caller runs the
+ * chosen tier (`reflect()`, tools, or the HITL approval ledger).
+ */
+export function cascadeDecide(
+  currentConfidence: number,
+  policyJson: string,
+): string;
+
+/**
+ * Diagnose a memory system along the four system-level dimensions of *Are We
+ * Ready For An Agent-Native Memory System?*
+ * (`docs/proposals/agent-native-memory-diagnostic.md`, applying arXiv
+ * 2606.24775): representation fidelity, retrieval precision, update correctness,
+ * long-horizon stability. Scores the memory store as a data system rather than
+ * by end-to-end task success, and names the bottleneck module to invest in next.
+ *
+ * `statsJson` is aggregate counters (parsed by serde — keys are snake_case):
+ * `{ total_facts, structured_facts, total_edges, total_retrievals,
+ * helpful_retrievals, conflicts_resolved, outstanding_outdated, facts_created,
+ * facts_superseded }` (omitted fields default to 0). Returns the report JSON:
+ * `{ representation_fidelity, retrieval_precision, update_correctness,
+ * long_horizon_stability, overall }` (each 0..1), `bottleneck` (one of
+ * `"representation" | "retrieval" | "update_correctness" |
+ * "long_horizon_stability" | "none"`), `recommendation`, and `evaluated`.
+ */
+export function memorySystemDiagnose(statsJson: string): string;
+
+/**
+ * Decide localized-vs-global memory maintenance
+ * (`docs/proposals/agent-native-memory-diagnostic.md`, applying arXiv
+ * 2606.24775's finding that localized maintenance is more cost-efficient than
+ * global reorganization). Both strategies resolve the dirty regions; global only
+ * wins when its store-wide structural gain (valued) clears the extra cost of
+ * touching the whole store.
+ *
+ * `inputJson` is (serde snake_case keys) `{ dirty_regions, total_regions,
+ * localized_cost_per_region, global_cost_per_region, global_structural_gain,
+ * gain_value }` (omitted fields default to 0). Returns the decision JSON:
+ * `{ strategy: "no_op" | "localized" | "global", localized_cost, global_cost,
+ * global_extra_value, global_net_advantage, rationale }`.
+ */
+export function maintenanceDecide(inputJson: string): string;
+
+/**
+ * Plan an evolution cycle — the survey's *when + what to evolve* (arXiv
+ * 2507.21046, *A Survey of Self-Evolving Agents*). `requestJson` is `{ components:
+ * [{ component: "memory" | "skills" | "harness" | "context" | "tools", pressure?,
+ * evidence?, min_evidence?, cost? }], policy?: { pressure_threshold?, budget? } }`.
+ * Returns the `EvolutionPlan` JSON `{ decisions: [{ component, action:
+ * "evolve_now" | "defer" | "skip", priority, defer_reason?, reason }], spent,
+ * evolve_now }`. Evolves only under pressure, only with enough evidence,
+ * prioritized by `pressure / cost` within the budget.
+ */
+export function planEvolution(requestJson: string): string;
+
+/**
+ * Rebuild `(stateBefore, action, stateAfter)` transitions from a JSONL tail
+ * of a session's event log — the trajectories CAR already records, turned
+ * into the unit-test records `cwmScore` consumes. Folds the recorded
+ * `StateChanged` deltas (`data.changes`) over `initialStateJson` in log
+ * order.
+ *
+ * `actionsJson` (optional) is a JSON object mapping an action id → the action
+ * JSON to attach (pass a proposal's actions so a transition carries
+ * `tool`/`parameters`); absent a match the action is `{ id }`. Lines that
+ * don't parse as events are skipped. Returns a JSON array of transitions.
+ */
+export function cwmTransitionsFromEvents(
+  eventsJsonl: string,
+  initialStateJson?: string | null,
+  actionsJson?: string | null,
+): string;
+
+/**
+ * Predictive simulation (Code World Models Slice 2 of
+ * `docs/proposals/code-world-models.md`). Like the static simulator, but
+ * applies per-action effect predictions from a verified Code World Model,
+ * gated by accuracy — turning `simulate`'s placeholder-propagation into a
+ * predicted final state.
+ *
+ * `proposalJson` is an `ActionProposal`; `initialStateJson` (optional) seeds
+ * state; `predictionsJson` maps `actionId` → `{ effects: { key: value, ... },
+ * accuracy: number }`, where `effects` are what the caller's run of the
+ * generated model predicts the action writes. A prediction is applied only
+ * when `accuracy >= minAccuracy`; otherwise — and for any action with no
+ * prediction — the simulator falls back to that action's declared
+ * `expectedEffects` (i.e. the static `simulate` behavior). An under-accurate
+ * model therefore can never worsen the result; at worst it is ignored.
+ *
+ * Returns the final state as a JSON object.
+ */
+export function simulateWithPredictions(
+  proposalJson: string,
+  initialStateJson: string | null | undefined,
+  predictionsJson: string,
+  minAccuracy: number,
+): string;
+
 /**
  * Compute harness-level evaluation metrics (survey "Code as Agent Harness"
  * §5.2.1) from a JSONL tail of a session's event log (one event per line).
@@ -1853,6 +2545,53 @@ export function transactionCheck(
  */
 export function harnessMetrics(eventsJsonl: string): string;
 
+/**
+ * Detect tool-result hallucinations by cross-checking the model's claims about
+ * tool use against the runtime's receipts of what actually executed
+ * (`docs/proposals/tool-receipt-verification.md`, applying arXiv 2603.10060
+ * "Tool Receipts"). Deterministic and zero-inference — the runtime owns the
+ * ground truth, so the model can't fake a receipt.
+ *
+ * `claimsJson` is a JSON array of `ToolClaim` `{ kind: "invoked" | "count" |
+ * "absence", tool: string, call_id?, count?, text? }`; `receiptsJson` is a JSON
+ * array of `ToolReceipt` `{ tool: string, call_id?, ok?, result_count? }`.
+ * `windowComplete` (default `true`) declares whether the receipts cover the
+ * full window the claims are about — pass `false` when they were projected
+ * from a retention-trimmed log, so a receiptless claim is reported in
+ * `ungroundable` ("window evicted") instead of accused as fabricated.
+ * Returns the `ReceiptReport` JSON `{ grounded: boolean, hallucinations: [{
+ * kind: "fabricated_tool_reference" | "count_misstatement" | "false_absence",
+ * tool, claim_text?, explanation }], ungroundable?: [{ tool, claim_text?,
+ * explanation }] }`.
+ */
+export function verifyToolReceipts(
+  claimsJson: string,
+  receiptsJson: string,
+  windowComplete?: boolean | undefined | null,
+): string;
+
+/**
+ * Diagnose runtime-harness interventions from a JSONL event-log tail
+ * (`docs/proposals/runtime-harness-adaptation.md`, applying arXiv 2605.22166
+ * "Adapting the Interface, Not the Model"). Converts *recurring* interaction
+ * failures into typed, reusable fixes across Life-Harness's four lifecycle
+ * layers — `environment_contract` (calibrate a tool's description/constraints),
+ * `action_realization` (normalize malformed calls), `trajectory_regulation`
+ * (circuit-break runtime-failure / retry / replan thrash), and
+ * `procedural_skill` — i.e. "fix the harness, not the model". Complements
+ * `evolutionDiagnose` (which gates/applies mutations); this is the diagnosis
+ * pass over trajectories.
+ *
+ * `minOccurrences` is the recurrence threshold (one-offs are noise; pass 2 for
+ * "recurring"). Returns the `AdaptationReport` JSON `{ interventions: [{ layer,
+ * target, trigger, intervention, evidence_count }], parse_errors }`, sorted by
+ * evidence descending.
+ */
+export function diagnoseHarnessInterventions(
+  eventsJsonl: string,
+  minOccurrences: number,
+): string;
+
 // --- Agentic Harness Engineering: Evolution Agent (survey §3.5, §5.2.3) ---
 //
 // A governed meta-agent that proposes harness mutations from telemetry and
@@ -2095,6 +2834,21 @@ export function createTask(
  */
 export function renderOsSchedule(taskJson: string, program: string, argsJson: string): string;
 
+/**
+ * Analyze a static execution DAG as a scheduler
+ * (`docs/proposals/scheduler-graph-analysis.md`, applying arXiv 2604.11378 "From
+ * Agent Loops to Structured Graphs"). Makes a plan's schedule inspectable before
+ * running it: critical path, makespan, available parallelism, topological waves,
+ * cycle detection, and the serial "Agent-Loop pathology" flag.
+ *
+ * `graphJson` is a `ScheduleGraph` `{ units: [{ id: string, duration?: number,
+ * depends_on?: string[] }] }`. Returns the `ScheduleAnalysis` JSON `{ has_cycle:
+ * boolean, critical_path: string[], makespan: number, max_parallelism: number,
+ * levels: string[][], serial: boolean }`. `serial` is true when the plan
+ * collapses to one-unit-at-a-time; `has_cycle` flags a never-terminating plan.
+ */
+export function analyzeSchedule(graphJson: string): string;
+
 /**
  * Install a durable OS-level schedule (launchd on macOS, crontab on Linux) so
  * the task fires even when the CAR daemon is down. Idempotent. Returns the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "car-runtime",
-  "version": "0.31.0",
+  "version": "0.32.1",
   "description": "Common Agent Runtime — a deterministic execution layer for AI agents",
   "main": "index.js",
   "types": "index.d.ts",