chainlesschain 0.166.129 → 0.166.131

package/src/lib/cost-budget.js

@@ -75,6 +75,8 @@ export class CostBudget {
       cacheCreationTokens,
       cacheCreation5mTokens: pricingContext.cacheCreation5mTokens,
       cacheCreation1hTokens: pricingContext.cacheCreation1hTokens,
+      cacheCreation30mTokens: pricingContext.cacheCreation30mTokens,
+      cacheCreation12hTokens: pricingContext.cacheCreation12hTokens,
       cacheCreationInvalid: pricingContext.cacheCreationInvalid,
       pricingContextInvalid:
         pricingContext.pricingContextInvalid === true ||

package/src/lib/ephemeral-worktree-scope.js

@@ -0,0 +1,24 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+
+const scopes = new AsyncLocalStorage();
+
+/**
+ * An ephemeral checkout belongs to its awaited callback. This host scope is a
+ * capability restriction, not a process lease: tools that return before their
+ * consumers settle must refuse dispatch until they can transfer that ownership.
+ * Async descendants retain the restriction even after the callback returns.
+ */
+export function withEphemeralWorktreeScope(worktreePath, callback) {
+  return scopes.run(Object.freeze({ worktreePath }), callback);
+}
+
+export function ephemeralWorktreeConsumerRefusal(operation) {
+  const scope = scopes.getStore();
+  if (!scope) return null;
+  return {
+    error: `${operation} cannot outlive an ephemeral worktree. Run this work in the foreground, or launch it from a persistent checkout with its own lifecycle owner.`,
+    code: "CC_EPHEMERAL_WORKTREE_CONSUMER_UNOWNED",
+    worktreePath: scope.worktreePath,
+    policy: { decision: "deny", via: "ephemeral-worktree-lifetime" },
+  };
+}

package/src/lib/evolution/evolution-deployment-loader.js

@@ -8,10 +8,6 @@ import {
   assertEvolutionDeploymentRevisionFloor,
   readEvolutionDeploymentProfile,
 } from "./evolution-deployment-profile.js";
-import {
-  readEvolutionEnabled,
-  resolveEvolutionEnabled,
-} from "./evolution-enabled.js";
 
 export const EVOLUTION_DEPLOYMENT_DESCRIPTOR_SCHEMA =
   "chainlesschain.evolution-deployment-descriptor/v1";
@@ -1038,6 +1034,12 @@ export async function loadEvolutionDeploymentCommandDependencies(
   } = {},
 ) {
   if (!SUPPORTED_COMMANDS.has(commandName)) return null;
+  // Unsupported commands (including read-only session show) need no deployment
+  // configuration. Loading it eagerly also loads secret-store and the full
+  // process broker/platform sandbox graph before this early return.
+  const { readEvolutionEnabled, resolveEvolutionEnabled } = await import(
+    "./evolution-enabled.js"
+  );
   const localModelDependencies = () =>
     dependencies(
       {

package/src/lib/evolution/governed-skill-marketplace-abort.js

@@ -0,0 +1,14 @@
+import { raceWithAbort, throwIfAborted } from "../abort-utils.js";
+
+// Only race reads/preparation. Durable commits must retain their acknowledgement
+// and recovery path even when the caller interrupts after the append starts.
+export function awaitMarketplaceRead(operation, signal) {
+  throwIfAborted(signal);
+  return raceWithAbort(
+    Promise.resolve().then(() => {
+      throwIfAborted(signal);
+      return operation();
+    }),
+    signal,
+  );
+}

package/src/lib/evolution/governed-skill-marketplace-candidate.js

@@ -1,6 +1,8 @@
 import { createHash } from "node:crypto";
 import { isAbsolute } from "node:path";
 import { types as utilTypes } from "node:util";
+import { throwIfAborted } from "../abort-utils.js";
+import { awaitMarketplaceRead } from "./governed-skill-marketplace-abort.js";
 import {
   SkillCandidateRegistry,
   SKILL_CANDIDATE_MAX_ARTIFACT_BYTES,
@@ -250,7 +252,8 @@ export function createGovernedSkillMarketplaceCandidateInstaller({
   };
   const installer = Object.freeze({
     tenantId,
-    async materialize(inspected) {
+    async materialize(inspected, { signal } = {}) {
+      throwIfAborted(signal);
       const { manifest, adapted, target } = inspected;
       if (manifest.tenantId !== tenantId)
         throw new Error("marketplace candidate tenant mismatch");
@@ -262,7 +265,11 @@ export function createGovernedSkillMarketplaceCandidateInstaller({
         adaptedOutputDigest: adapted.outputDigest,
         sbomDigest: manifest.sbomDigest,
       });
-      const resolved = await Reflect.apply(resolve, artifacts, [request]);
+      const resolved = await awaitMarketplaceRead(
+        () => Reflect.apply(resolve, artifacts, [request, { signal }]),
+        signal,
+      );
+      throwIfAborted(signal);
       const sourceBytes = bytes(
         resolved?.packageBytes,
         request.packageDigest,
@@ -307,6 +314,7 @@ export function createGovernedSkillMarketplaceCandidateInstaller({
         ...core,
         bindingDigest: bindingDigest(core),
       });
+      throwIfAborted(signal);
       const result = create(candidateInput(candidate));
       if (result.candidate.candidateId !== candidate.candidateId)
         throw new Error(

package/src/lib/evolution/governed-skill-marketplace-cli-host.js

@@ -1,4 +1,6 @@
 import { types as utilTypes } from "node:util";
+import { throwIfAborted } from "../abort-utils.js";
+import { awaitMarketplaceRead } from "./governed-skill-marketplace-abort.js";
 import { GovernedSkillMarketplace } from "./governed-skill-marketplace.js";
 import { isGovernedSkillMarketplaceLedgerAdapter } from "./governed-skill-marketplace-ledger-adapter.js";
 import { isGovernedSkillMarketplaceCandidateInstaller } from "./governed-skill-marketplace-candidate.js";
@@ -105,12 +107,16 @@ export function createGovernedSkillMarketplaceCliHost({
       candidateInstaller.verify(state);
     return state;
   };
-  const resolveManifest = async (skillName, version) => {
+  const resolveManifest = async (skillName, version, { signal } = {}) => {
+    throwIfAborted(signal);
     id(skillName, "skillName");
     if (version !== null) id(version, "version");
-    const manifest = await resolve(
-      Object.freeze({ tenantId, skillName, version }),
+    const manifest = await awaitMarketplaceRead(
+      () =>
+        resolve(Object.freeze({ tenantId, skillName, version }), { signal }),
+      signal,
     );
+    throwIfAborted(signal);
     if (
       manifest?.tenantId !== tenantId ||
       manifest.skillName !== skillName ||
@@ -217,20 +223,30 @@ export function createGovernedSkillMarketplaceCliHost({
       });
     },
     state: ({ skillName } = {}) => stateFor(skillName),
-    async install({
-      skillName,
-      version = null,
-      manifestDigest,
-      expectedStateDigest = null,
-    } = {}) {
+    async install(
+      {
+        skillName,
+        version = null,
+        manifestDigest,
+        expectedStateDigest = null,
+      } = {},
+      { signal } = {},
+    ) {
+      throwIfAborted(signal);
       digest(manifestDigest, "manifestDigest");
       if (expectedStateDigest !== null)
         digest(expectedStateDigest, "expectedStateDigest");
-      const manifest = await resolveManifest(skillName, version);
+      const manifest = await resolveManifest(skillName, version, { signal });
       if (manifest.manifestDigest !== manifestDigest)
         throw new Error("marketplace catalog manifest changed; inspect again");
-      const inspected = await marketplace.inspect(manifest, target);
-      if (await isManifestRevoked({ skillName, manifestDigest }))
+      const inspected = await marketplace.inspect(manifest, target, { signal });
+      throwIfAborted(signal);
+      if (
+        await awaitMarketplaceRead(
+          () => isManifestRevoked({ skillName, manifestDigest }),
+          signal,
+        )
+      )
         throw new Error(
           "marketplace manifest was revoked and cannot be staged again",
         );
@@ -251,7 +267,12 @@ export function createGovernedSkillMarketplaceCliHost({
           state,
         });
       };
-      const current = await stateFor(skillName);
+      throwIfAborted(signal);
+      const current = await awaitMarketplaceRead(
+        () => stateFor(skillName),
+        signal,
+      );
+      throwIfAborted(signal);
       if (isReplay(current)) return result(current, true);
       if (
         current?.manifestDigest === manifestDigest &&
@@ -264,15 +285,21 @@ export function createGovernedSkillMarketplaceCliHost({
         );
       if ((current?.stateDigest ?? null) !== expectedStateDigest)
         throw new Error("marketplace install baseline changed");
-      const candidateBinding = await candidateInstaller.materialize(inspected);
+      const candidateBinding = await candidateInstaller.materialize(inspected, {
+        signal,
+      });
+      throwIfAborted(signal);
       try {
         return result(
-          await marketplace.stage({
-            manifest,
-            target,
-            expectedStateDigest,
-            candidateBinding,
-          }),
+          await marketplace.stage(
+            {
+              manifest,
+              target,
+              expectedStateDigest,
+              candidateBinding,
+            },
+            { signal },
+          ),
           false,
         );
       } catch (error) {

package/src/lib/evolution/governed-skill-marketplace.js

@@ -1,5 +1,7 @@
 import { createHash } from "node:crypto";
 import { types as utilTypes } from "node:util";
+import { throwIfAborted } from "../abort-utils.js";
+import { awaitMarketplaceRead } from "./governed-skill-marketplace-abort.js";
 import { verifyGovernedSkillMarketplaceCandidateBinding } from "./governed-skill-marketplace-candidate.js";
 
 import {
@@ -322,23 +324,33 @@ export class GovernedSkillMarketplace {
     this._verifyRevocation = capture(ports, "verifyRevocation");
   }
 
-  async verifyListing(input, target) {
+  async verifyListing(input, target, { signal } = {}) {
+    throwIfAborted(signal);
     const manifest = normalizeManifest(input, this.tenantId);
-    if ((await this._verifySignature({ manifest })) !== true)
+    if (
+      (await awaitMarketplaceRead(
+        () => this._verifySignature({ manifest }, { signal }),
+        signal,
+      )) !== true
+    )
       throw new Error("marketplace manifest signature is invalid");
+    throwIfAborted(signal);
     const cell = targetCell(manifest, target);
     if (cell.safetyPassed !== true)
       throw new Error("marketplace target safety gate failed");
     return freeze({ manifest, target: clone(target), cell });
   }
 
-  async inspect(input, target) {
-    const { manifest, cell } = await this.verifyListing(input, target);
-    const adapted = await this._adapt({
-      manifest,
-      target: clone(target),
-      cell,
+  async inspect(input, target, { signal } = {}) {
+    const { manifest, cell } = await this.verifyListing(input, target, {
+      signal,
     });
+    throwIfAborted(signal);
+    const adapted = await awaitMarketplaceRead(
+      () => this._adapt({ manifest, target: clone(target), cell }, { signal }),
+      signal,
+    );
+    throwIfAborted(signal);
     if (
       adapted?.authenticated !== true ||
       adapted.manifestDigest !== manifest.manifestDigest ||
@@ -357,16 +369,22 @@ export class GovernedSkillMarketplace {
     });
   }
 
-  async stage({
-    manifest: input,
-    target,
-    expectedStateDigest = null,
-    candidateBinding = null,
-  } = {}) {
-    const inspected = await this.inspect(input, target);
-    const current = await this._load({
-      skillName: inspected.manifest.skillName,
-    });
+  async stage(
+    {
+      manifest: input,
+      target,
+      expectedStateDigest = null,
+      candidateBinding = null,
+    } = {},
+    { signal } = {},
+  ) {
+    const inspected = await this.inspect(input, target, { signal });
+    throwIfAborted(signal);
+    const current = await awaitMarketplaceRead(
+      () => this._load({ skillName: inspected.manifest.skillName }),
+      signal,
+    );
+    throwIfAborted(signal);
     if ((current?.stateDigest || null) !== expectedStateDigest)
       throw new Error("marketplace install baseline changed");
     const state = {
@@ -400,6 +418,9 @@ export class GovernedSkillMarketplace {
         );
       state.candidateBinding = binding;
     }
+    // Once the durable append starts, await its acknowledgement/recovery. An
+    // abort cannot truthfully turn a committed state into a cancelled install.
+    throwIfAborted(signal);
     return this._persist(state, expectedStateDigest, "marketplace.staged");
   }
 
@@ -629,12 +650,14 @@ export class GovernedSkillMarketplace {
     }
     let current = await this._verifiedState(request.skillName);
     const expectedStateDigest = request.dependency.digest;
-    if (!(
-      current.revoked === true &&
-      current.stage === "rolled-back" &&
-      current.revocationBaselineStateDigest === expectedStateDigest &&
-      current.revocationPropagationRequestDigest === request.requestDigest
-    )) {
+    if (
+      !(
+        current.revoked === true &&
+        current.stage === "rolled-back" &&
+        current.revocationBaselineStateDigest === expectedStateDigest &&
+        current.revocationPropagationRequestDigest === request.requestDigest
+      )
+    ) {
       if (current.stateDigest !== expectedStateDigest) {
         throw new Error("marketplace revocation dependency baseline changed");
       }

package/src/lib/goal-assess.js

@@ -223,7 +223,10 @@ export async function assessGoalProgress({
   } catch (error) {
     if (
       error?.code === "CC_AGENT_EVOLUTION_INGRESS_FAILED" ||
-      error?.runtimeLedgerPersistence === true
+      error?.runtimeLedgerPersistence === true ||
+      error?.goalModelFailure === true ||
+      (typeof error?.code === "string" &&
+        error.code.startsWith("CC_SESSION_BUDGET_"))
     )
       throw error;
     return { assessment: null, goal };

package/src/lib/goal-check-evidence.js

@@ -1,8 +1,18 @@
 // Bounded, current-turn observations for the optional model goal checker.
-// These are tool observations, not an independent verification of the workspace.
+// Workspace binding verifies freshness, not the semantic truth of a verdict.
 const MAX_TOOLS = 24;
 const EXIT_CODE_TOOLS = new Set(["run_shell", "check_shell", "git"]);
 
+export function sameGoalWorkspace(left, right) {
+  return (
+    left?.verified === true &&
+    right?.verified === true &&
+    ["scope", "workspaceId", "digest", "freshnessDigest"].every(
+      (key) => left[key] === right[key],
+    )
+  );
+}
+
 function previewText(text, limit) {
   if (text.length <= limit) return text;
   const half = Math.floor((limit - 30) / 2);
@@ -37,8 +47,9 @@ function preview(value, limit) {
 }
 
 export class GoalCheckEvidence {
-  constructor({ readOnlyTools = [] } = {}) {
+  constructor({ readOnlyTools = [], captureWorkspace = null } = {}) {
     this.readOnlyTools = new Set(readOnlyTools);
+    this.captureWorkspace = captureWorkspace;
     this.beginTurn();
   }
 
@@ -50,7 +61,7 @@ export class GoalCheckEvidence {
     this.tools = [];
   }
 
-  started(call) {
+  async started(call) {
     // Unknown tools may mutate state. A later mutator makes earlier evidence
     // stale, including reads/checks that were still running when it started.
     if (!this.readOnlyTools.has(call.tool)) this.revision++;
@@ -61,14 +72,17 @@ export class GoalCheckEvidence {
       revision: this.revision,
       settled: false,
       successful: false,
+      call,
     };
     this.pending.set(call, record);
     this.pendingCount++;
     this.tools.push(record);
     if (this.tools.length > MAX_TOOLS) this.tools.shift();
+    if (this.captureWorkspace)
+      record.workspaceBefore = await this.captureWorkspace(call);
   }
 
-  settled(call, result, isError) {
+  async settled(call, result, isError) {
     const record = this.pending.get(call);
     if (!record) return;
     this.pending.delete(call);
@@ -97,6 +111,41 @@ export class GoalCheckEvidence {
       ].includes(result.status) &&
       (hasExitCode ? result.exitCode === 0 : !EXIT_CODE_TOOLS.has(call.tool));
     if (hasExitCode) record.exitCode = result.exitCode ?? null;
+    if (this.captureWorkspace && record.successful) {
+      const after = await this.captureWorkspace(call);
+      record.workspace = {
+        ...after,
+        current: sameGoalWorkspace(record.workspaceBefore, after),
+        ...(!sameGoalWorkspace(record.workspaceBefore, after)
+          ? {
+              reason:
+                after.reason ||
+                record.workspaceBefore?.reason ||
+                "workspace-changed",
+            }
+          : {}),
+      };
+    }
+  }
+
+  async refreshWorkspace() {
+    if (!this.captureWorkspace) return;
+    const snapshots = new Map();
+    for (const record of this.tools) {
+      if (record.revision !== this.revision || !record.workspace?.current)
+        continue;
+      const key = JSON.stringify([
+        record.workspace.scope,
+        record.workspace.artifacts?.map((entry) => entry.path),
+      ]);
+      if (!snapshots.has(key))
+        snapshots.set(key, await this.captureWorkspace(record.call));
+      const current = snapshots.get(key);
+      if (!sameGoalWorkspace(record.workspace, current)) {
+        record.workspace.current = false;
+        record.workspace.reason = current.reason || "workspace-changed";
+      }
+    }
   }
 
   snapshot() {
@@ -105,10 +154,13 @@ export class GoalCheckEvidence {
       scope: "current-outer-turn",
       pending: this.pendingCount,
       omitted: Math.max(0, this.sequence - this.tools.length),
-      tools: this.tools.map(({ revision, ...record }) => ({
-        ...record,
-        current: revision === this.revision,
-      })),
+      ...(this.captureWorkspace ? { workspaceBindingRequired: true } : {}),
+      tools: this.tools.map(
+        ({ revision, call, workspaceBefore, ...record }) => ({
+          ...record,
+          current: revision === this.revision,
+        }),
+      ),
     };
   }
 }
@@ -116,7 +168,13 @@ export class GoalCheckEvidence {
 export function usableGoalEvidence(evidence) {
   if (!evidence || evidence.pending !== 0) return [];
   return (evidence.tools || []).filter(
-    (record) => record.current && record.settled && record.successful,
+    (record) =>
+      record.current &&
+      record.settled &&
+      record.successful &&
+      (!evidence.workspaceBindingRequired ||
+        (record.workspace?.verified === true &&
+          record.workspace.current === true)),
   );
 }
 
@@ -127,6 +185,7 @@ export function buildGoalJudgePrompt(condition, transcript) {
     "The assistant output is a claim, not proof. Do not infer tests passed from a file write or a claim.",
     "Earlier results marked current:false predate a possible mutation; they cannot verify the current workspace.",
     "Use only settled, successful, current tool observations relevant to the condition. Unknown exits are not success.",
+    "When workspaceBindingRequired is true, cite only workspace verified:true/current:true observations. Artifact scope proves only the named file; Git scope excludes ignored and external files. A digest proves freshness, not test success or independent quality.",
     "If evidence is missing, stale, contradictory, or insufficient, return met:false and say what check is needed.",
     'Reply with STRICT JSON: {"met": false, "reason": "...", "evidenceIds": []}.',
     "A true verdict must cite one or more relevant tool observation IDs in evidenceIds.",
@@ -154,6 +213,15 @@ export function validateGoalJudgeVerdict(verdict, evidence) {
       kind: "model",
       source: "current-turn-tools",
       toolIds: grounded ? [...new Set(ids)] : [],
+      ...(evidence?.workspaceBindingRequired
+        ? {
+            workspaceBindings: grounded
+              ? usableGoalEvidence(evidence)
+                  .filter((record) => ids.includes(record.id))
+                  .map((record) => ({ toolId: record.id, ...record.workspace }))
+              : [],
+          }
+        : {}),
     },
   };
 }

package/src/lib/goal-condition-engine.js

@@ -81,6 +81,7 @@ export function normalizeGoalBudget(input = {}) {
  *   file-exists:dist/app.js   → met iff the path exists
  *   contains:ALL GREEN        → met iff the last output contains the text
  *   regex:^BUILD OK$          → met iff the last output matches
+ *   verify:acceptance.json    → all frozen host acceptance commands must pass
  *   model:the tests pass      → a model judges the transcript
  *   the tests pass            → (bare) model-judged
  */
@@ -99,6 +100,9 @@ export function parseGoalCondition(spec) {
     case "file":
       if (!rest) throw new Error("file-exists condition needs a path");
       return { kind: "file-exists", path: rest, source: raw };
+    case "verify":
+      if (!rest) throw new Error("verify condition needs a manifest path");
+      return { kind: "verify", path: rest, source: raw };
     case "contains":
       if (!rest) throw new Error("contains condition needs text");
       return { kind: "contains", text: rest, source: raw };
@@ -387,9 +391,22 @@ export class GoalConditionEngine {
     const state = snap?.state;
     if (
       !snap?.condition ||
-      !["model", "exit-zero", "file-exists", "contains", "regex"].includes(
-        snap.condition.kind,
-      ) ||
+      ![
+        "model",
+        "exit-zero",
+        "file-exists",
+        "contains",
+        "regex",
+        "verify",
+      ].includes(snap.condition.kind) ||
+      (snap.condition.kind === "verify" &&
+        (typeof snap.condition.path !== "string" ||
+          !snap.condition.path.trim() ||
+          snap.condition.verification?.schema !==
+            "chainlesschain.prepared-goal-verification/v1" ||
+          !/^sha256:[a-f0-9]{64}$/u.test(
+            snap.condition.verification?.digest || "",
+          ))) ||
       !state ||
       !Number.isSafeInteger(state.outerTurns) ||
       state.outerTurns < 0 ||

package/src/lib/goal-model-call.js

@@ -0,0 +1,107 @@
+import { runMeteredDirectModelCall } from "./direct-model-usage.js";
+
+// A verdict is small. Keep its output bounded even when the authoring model has
+// a much larger default; a caller's smaller limit still wins.
+export const GOAL_MODEL_MAX_OUTPUT_TOKENS = 2048;
+
+export function goalModelCallError(reason, cause) {
+  const details = {
+    max_turns: ["error_max_turns", "No model turns remain for Goal evaluation"],
+    "cost-budget-exhausted": [
+      "error_max_budget",
+      "The run cost budget is exhausted",
+    ],
+    "usage-unknown": [
+      "error_goal_usage_unknown",
+      "Goal model usage is unknown; reconcile the request before continuing",
+    ],
+    cancelled: ["error_goal_cancelled", "Goal model evaluation was cancelled"],
+  }[reason];
+  return Object.assign(new Error(details[1], { cause }), {
+    goalModelFailure: true,
+    endReason: reason,
+    subtype: details[0],
+  });
+}
+
+/** One auxiliary Goal call, charged to the same run as the authoring loop. */
+export async function runGoalModelCall({
+  sessionId,
+  persist,
+  sessionBudget,
+  iterationBudget,
+  costBudget,
+  signal,
+  operationId,
+  chat,
+  chatOptions,
+  prompt,
+  onUsage,
+}) {
+  const signals = [signal, sessionBudget?.signal].filter(Boolean);
+  const dispatchSignal =
+    signals.length > 1 ? AbortSignal.any(signals) : signals[0];
+  const checkCancellation = () => {
+    if (dispatchSignal?.aborted)
+      throw goalModelCallError("cancelled", dispatchSignal.reason);
+  };
+  checkCancellation();
+  if (costBudget.exceeded()) throw goalModelCallError("cost-budget-exhausted");
+  if (iterationBudget.isExhausted()) throw goalModelCallError("max_turns");
+  const outputLimit = chatOptions.maxOutputTokens;
+  const maxOutputTokens =
+    Number.isSafeInteger(outputLimit) && outputLimit > 0
+      ? Math.min(outputLimit, GOAL_MODEL_MAX_OUTPUT_TOKENS)
+      : GOAL_MODEL_MAX_OUTPUT_TOKENS;
+
+  let dispatched = false;
+  let settled;
+  // Reserve synchronously before awaiting persistence; other agents can share
+  // this iteration budget and must not take the same final turn meanwhile.
+  iterationBudget.consume();
+  try {
+    settled = await runMeteredDirectModelCall({
+      // Ephemeral runs still settle usage in memory. The callback below writes
+      // no session file when persistence is disabled, and makes no durable claim.
+      sessionId: sessionId || "ephemeral-goal-evaluation",
+      persist: async (type, event) => {
+        if (persist) await persist(type, event);
+        if (type === "token_usage") onUsage(event);
+      },
+      provider: chatOptions.provider,
+      model: chatOptions.model,
+      source: "model",
+      operationId,
+      sessionBudget,
+      dispatchSignal: dispatchSignal || null,
+      includeSettlement: true,
+      call: () => {
+        checkCancellation();
+        dispatched = true;
+        return chat([{ role: "user", content: prompt }], {
+          ...chatOptions,
+          signal: dispatchSignal,
+          maxOutputTokens,
+          enabledToolNames: [],
+        });
+      },
+    });
+  } catch (error) {
+    if (
+      error?.runtimeLedgerPersistence ||
+      error?.goalModelFailure ||
+      error?.code === "CC_AGENT_EVOLUTION_INGRESS_FAILED" ||
+      (typeof error?.code === "string" &&
+        error.code.startsWith("CC_SESSION_BUDGET_"))
+    )
+      throw error;
+    checkCancellation();
+    // A failed request is not a negative verdict that authorizes another turn.
+    if (dispatched) throw goalModelCallError("usage-unknown", error);
+    throw error;
+  }
+  if (settled.settlement !== "known") throw goalModelCallError("usage-unknown");
+  checkCancellation();
+  if (costBudget.exceeded()) throw goalModelCallError("cost-budget-exhausted");
+  return settled.result;
+}