deadbyte-mcp 0.15.2 → 0.15.4

package/src/agent-backend-r44.mjs

@@ -3,6 +3,7 @@ import { EventEmitter } from 'node:events';
 import { lstat, mkdir, open, readFile, realpath, rename } from 'node:fs/promises';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
+import { classifyTermination, composeAbortSignal, createCancellationToken, createDeadline } from './deadline-cancellation.mjs';
 
 const STATE_SCHEMA='deadbyte.agent-backend-state.v1';
 const HEX64=/^[0-9a-f]{64}$/;
@@ -46,6 +47,16 @@ function validateState(state,backendId){
     insist(typeof item.method==='string'&&METHOD.test(item.method),'agent backend request method invalid');
     insist(HEX64.test(item.params_sha256??''),'agent backend params hash invalid');
     insist(typeof item.created_at_utc==='string'&&typeof item.updated_at_utc==='string','agent backend request timestamp invalid');
+    if(item.deadline!==undefined){
+      insist(item.deadline&&item.deadline.schema==='deadbyte.deadline.v1','agent backend request deadline invalid');
+      insist(item.deadline.timeout_ms===null||Number.isInteger(item.deadline.timeout_ms),'agent backend request deadline timeout invalid');
+      insist(item.deadline.deadline_ms===null||Number.isFinite(item.deadline.deadline_ms),'agent backend request deadline timestamp invalid');
+    }
+    if(item.termination!==undefined){
+      insist(item.termination&&typeof item.termination==='object'&&!Array.isArray(item.termination),'agent backend request termination invalid');
+      for(const key of ['deadline_exceeded','cancellation_requested','physical_termination','verified'])insist(typeof item.termination[key]==='boolean',`agent backend request termination ${key} invalid`);
+      insist(typeof item.termination.terminal_semantics==='string','agent backend request termination semantics invalid');
+    }
   }
   insist(typeof state.updated_at_utc==='string','agent backend state timestamp invalid');
   return state;
@@ -157,11 +168,12 @@ export async function createAgentBackendR44({
     threads:structuredClone(state.threads),requests:structuredClone(state.requests)
   });
 
-  async function terminal(id,{stateName,result=null,error=null}){
+  async function terminal(id,{stateName,result=null,error=null,termination=null}){
     const record=state.requests[id];if(!record||record.state!=='pending')return;
     record.state=stateName;record.updated_at_utc=now();
     if(result!==null)record.result=result;
     if(error!==null)record.error=String(error);
+    if(termination!==null)record.termination=termination;
     await persist();
     const waiter=pending.get(id);pending.delete(id);
     if(!waiter)return;
@@ -198,11 +210,29 @@ export async function createAgentBackendR44({
       for(const id of pending.keys())void terminal(id,{stateName:'failed',error:String(error?.message??error)});
     });
     transport.on('transport_error',error=>{
-      for(const id of pending.keys())void terminal(id,{stateName:'interrupted',error:String(error?.message??error)});
+      for(const id of pending.keys()){
+        const record=state.requests[id];
+        const termination=classifyTermination({
+          deadlineExceeded:record?.termination?.deadline_exceeded===true,
+          cancellationRequested:record?.termination?.cancellation_requested===true,
+          physicallyTerminated:false,
+          verified:false
+        });
+        void terminal(id,{stateName:'interrupted',error:String(error?.message??error),termination});
+      }
       started=false;
     });
     transport.on('exit',()=>{
-      for(const id of pending.keys())void terminal(id,{stateName:'interrupted',error:'agent backend transport exited'});
+      for(const id of pending.keys()){
+        const record=state.requests[id];
+        const termination=classifyTermination({
+          deadlineExceeded:record?.termination?.deadline_exceeded===true,
+          cancellationRequested:record?.termination?.cancellation_requested===true,
+          physicallyTerminated:true,
+          verified:true
+        });
+        void terminal(id,{stateName:'interrupted',error:'agent backend transport exited',termination});
+      }
       started=false;
     });
     await transport.start();started=true;return publicState();
@@ -223,17 +253,52 @@ export async function createAgentBackendR44({
     const sequence=++state.next_sequence;
     const paramsSha=sha(Buffer.from(canonicalJson(params),'utf8'));
     const id=sha(Buffer.from(canonicalJson({backend_id:backendId,state_epoch:state.state_epoch,sequence,method,params_sha256:paramsSha}),'utf8'));
-    state.requests[id]={state:'pending',method,params_sha256:paramsSha,created_at_utc:now(),updated_at_utc:now()};
+    const deadline=createDeadline({timeoutMs,id});
+    const cancellation=createCancellationToken({id});
+    const composed=composeAbortSignal({deadline,cancellation});
+    state.requests[id]={
+      state:'pending',method,params_sha256:paramsSha,created_at_utc:now(),updated_at_utc:now(),
+      deadline,
+      termination:classifyTermination()
+    };
     await persist();
-    let timer;
     const promise=new Promise((resolve,reject)=>{
-      pending.set(id,{resolve,reject});
-      timer=setTimeout(()=>{void terminal(id,{stateName:'failed',error:'agent backend request timeout'});},timeoutMs);
-    }).finally(()=>clearTimeout(timer));
+      pending.set(id,{resolve,reject,cancellation,composed});
+      composed.signal.addEventListener('abort',()=>{
+        const reason=String(composed.signal.reason??'cancelled');
+        const deadlineExceeded=reason==='deadline_exceeded';
+        const cancellationRequested=cancellation.snapshot().requested;
+        const termination=classifyTermination({deadlineExceeded,cancellationRequested,physicallyTerminated:false,verified:false});
+        void terminal(id,{stateName:'failed',error:deadlineExceeded?'agent backend request deadline exceeded':'agent backend request cancelled',termination});
+      },{once:true});
+    }).finally(()=>{
+      composed.close();
+      const waiter=pending.get(id);
+      if(waiter?.composed===composed)pending.delete(id);
+    });
     try{await transport.send(wire({id,method,params}));}
-    catch(error){await terminal(id,{stateName:'failed',error:String(error?.message??error)});}
+    catch(error){
+      const record=state.requests[id];
+      const termination=classifyTermination({
+        deadlineExceeded:record?.termination?.deadline_exceeded===true,
+        cancellationRequested:record?.termination?.cancellation_requested===true,
+        physicallyTerminated:false,
+        verified:false
+      });
+      await terminal(id,{stateName:'failed',error:String(error?.message??error),termination});
+    }
     return promise;
   }
+  async function cancelRequest(id,{reason='operator_request'}={}){
+    insist(HEX64.test(id),'agent backend request id invalid');
+    const record=state.requests[id];
+    if(!record)return {status:'missing',request_id:id};
+    if(record.state!=='pending')return {status:'terminal',request_id:id,state:record.state,termination:record.termination??null};
+    const waiter=pending.get(id);
+    if(!waiter?.cancellation)return {status:'pending',request_id:id,termination:record.termination??null};
+    waiter.cancellation.request(reason);
+    return {status:'requested',request_id:id};
+  }
   async function notify({method,params={}}={}){
     insist(started&&transport,'agent backend is not started');
     insist(typeof method==='string'&&METHOD.test(method),'agent backend notification method invalid');
@@ -250,5 +315,5 @@ export async function createAgentBackendR44({
     for(const [id,waiter] of pending){waiter.reject(new Error('simulated backend crash'));pending.delete(id);}
     if(transport?.stop)await transport.stop();transport=null;started=false;
   }
-  return Object.freeze({start,bindThread,request,notify,status,close,simulateCrashForTest,state_file:stateFile,wire_mode:wireMode});
+  return Object.freeze({start,bindThread,request,cancelRequest,notify,status,close,simulateCrashForTest,state_file:stateFile,wire_mode:wireMode});
 }

package/src/atomic-mutation.mjs

@@ -0,0 +1,55 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { open, rename, rm } from 'node:fs/promises';
+import path from 'node:path';
+
+const sha256Bytes = bytes => createHash('sha256').update(bytes).digest('hex');
+
+export async function atomicMutation({
+  target,
+  bytes,
+  expected,
+  readState,
+  assertExpected,
+  authorityCheck = null,
+  tempTag = 'deadbyte-atomic',
+  verifyPostcondition = null
+}) {
+  if (typeof target !== 'string' || target.length === 0) throw new Error('atomic mutation target is required');
+  if (!Buffer.isBuffer(bytes)) throw new Error('atomic mutation bytes must be a Buffer');
+  if (typeof readState !== 'function' || typeof assertExpected !== 'function') {
+    throw new Error('atomic mutation requires readState and assertExpected');
+  }
+  const before = await readState(target);
+  assertExpected(before, expected);
+  const temp = path.join(
+    path.dirname(target),
+    `.\${path.basename(target)}.\${tempTag}-\${process.pid}-\${randomBytes(8).toString('hex')}.tmp`
+  );
+  let handle;
+  try {
+    if (authorityCheck) await authorityCheck();
+    handle = await open(temp, 'wx', 0o600);
+    await handle.writeFile(bytes);
+    await handle.sync();
+    await handle.close();
+    handle = null;
+
+    const race = await readState(target);
+    assertExpected(race, expected);
+    if (authorityCheck) await authorityCheck();
+
+    await rename(temp, target);
+  } catch (error) {
+    if (handle) await handle.close().catch(() => {});
+    await rm(temp, { force: true }).catch(() => {});
+    throw error;
+  }
+
+  const after = await readState(target);
+  const expectedAfter = sha256Bytes(bytes);
+  if (!after.exists || after.sha256 !== expectedAfter) {
+    throw new Error('atomic mutation post-commit hash mismatch');
+  }
+  if (verifyPostcondition) await verifyPostcondition({ before, after, expected_after_sha256: expectedAfter });
+  return { before, after, expected_after_sha256: expectedAfter };
+}

package/src/autonomous-mcp-tools.mjs

@@ -72,11 +72,12 @@ export function registerAutonomousTools(server,{ autonomousRuntime, nativeDiffRu
     inputSchema:z.strictObject({ submission_id:id, root_id:id, title:z.string().max(160).default(''),
       goal:z.string().min(1).max(8192), acceptance:z.string().max(4096).default(''),
       task_contract:taskContract.nullable().default(null),
-      max_iterations:z.number().int().min(1).max(64).nullable().default(null) }),
+      max_iterations:z.number().int().min(1).max(64).nullable().default(null),
+      timeout_ms:z.number().int().min(100).max(900000).nullable().default(null) }),
     outputSchema:autonomousGoalSubmitOutputSchema
-  },async({submission_id,root_id,title,goal,acceptance,task_contract,max_iterations})=>{ try {
+  },async({submission_id,root_id,title,goal,acceptance,task_contract,max_iterations,timeout_ms})=>{ try {
       return result(autonomousGoalSubmitOutputSchema,await autonomousRuntime.submit({ submissionId:submission_id,
-        rootId:root_id,title,goal,acceptance,taskContract:task_contract,maxIterations:max_iterations })); }
+        rootId:root_id,title,goal,acceptance,taskContract:task_contract,maxIterations:max_iterations,timeoutMs:timeout_ms })); }
     catch(error){ return fail(autonomousGoalSubmitOutputSchema,error); } });
   server.registerTool('autonomous_goal_run',{
     description:'Advance one autonomous production goal through inspect/native-diff/build/test/benchmark/replan cycles. Client-planner mode returns a typed input_required sentinel for the Bridge MRTR adapter.',

package/src/autonomous-output-contracts.mjs

@@ -3,7 +3,17 @@ import * as z from 'zod/v4';
 const hex64 = z.string().regex(/^[0-9a-f]{64}$/);
 const goalId = hex64;
 const jsonObject = z.record(z.string(),z.json());
+const streamCoverage = z.strictObject({
+  logical_first_seq:z.number().int().min(1), logical_last_seq:z.number().int().min(0),
+  retained_first_seq:z.number().int().min(1), retained_last_seq:z.number().int().min(0),
+  complete:z.boolean(), truncated:z.boolean(),
+  missing_ranges:z.array(z.strictObject({from:z.number().int().min(1),to:z.number().int().min(0)})).max(100000),
+  logical_item_count:z.number().int().min(0), retained_item_count:z.number().int().min(0),
+  logical_bytes:z.number().int().min(0), retained_bytes:z.number().int().min(0),
+  dropped_items:z.number().int().min(0), dropped_bytes:z.number().int().min(0), status:z.enum(['open','closed'])
+});
 const goalState = z.enum(['pending','running','paused','cancelled','succeeded']);
+const deadline = z.strictObject({ schema:z.literal('deadbyte.deadline.v1'), id:z.string().nullable(), created_at_ms:z.number(), timeout_ms:z.number().int().min(1).nullable(), deadline_ms:z.number().nullable() });
 const loopPhase = z.enum(['PLANNING','INSPECTING','ACTING','VERIFYING','REPLANNING','WAITING','COMPLETE']);
 const loopStep = z.strictObject({
   step_id:z.string().regex(/^[A-Za-z0-9._-]{1,64}$/), intent:z.string().min(1).max(512), status:z.literal('active')
@@ -106,7 +116,7 @@ export const autonomousGoalSubmitOutputSchema = statusContract({
 const runShape = Object.fromEntries(Object.entries(derivedShape).map(([key,schema]) => [key,schema.optional()]));
 export const autonomousGoalRunOutputSchema = z.strictObject({
   status:z.enum(['terminal','paused','cancelled','completed','yielded','running','input_required','failed']), error:z.string().optional(),
-  goal_id:goalId.optional(), release:jsonObject.optional(), planner_request:jsonObject.optional(), loop:publicLoopSchema.optional(),
+  goal_id:goalId.optional(), release:jsonObject.optional(), planner_request:jsonObject.optional(), deadline:deadline.optional(), loop:publicLoopSchema.optional(),
   cycles:z.number().int().min(1).max(32).optional(), ...runShape
 }).superRefine((value,ctx) => {
   if (value.error !== undefined) { if (value.status !== 'failed') ctx.addIssue({code:'custom',path:['error'],message:'error wrapper requires failed'}); return; }
@@ -119,12 +129,15 @@ export const autonomousGoalStatusOutputSchema = statusContract({
   shape:{ goal_id:goalId.optional(), goal_sha256:hex64.optional(), title:z.string().optional(), root_id:z.string().optional(),
     journal_verified:z.literal(true).optional(), run_busy:z.boolean().optional(),
     run_owner_pid:z.number().int().min(1).nullable().optional(),
-    run_lock_created_at_utc:z.string().nullable().optional(), loop:publicLoopSchema.optional(), ...runShape }
+    run_lock_created_at_utc:z.string().nullable().optional(), timeout_ms:z.number().int().min(100).max(900000).nullable().optional(), deadline:deadline.optional(), loop:publicLoopSchema.optional(),
+    stream_id:goalId.nullable().optional(), stream_generation:z.number().int().min(1).nullable().optional(),
+    stream_next_seq:z.number().int().min(1).nullable().optional(), stream_coverage:streamCoverage.nullable().optional(), ...runShape }
 });
 export const autonomousGoalEventsOutputSchema = statusContract({
   statuses:['ok','failed'], success:['ok'], required:['goal_id','journal_verified','journal_head_sha256','events'],
   shape:{ goal_id:goalId.optional(), journal_verified:z.literal(true).optional(), journal_head_sha256:hex64.optional(),
-    events:z.array(jsonObject).max(200).optional() }
+    events:z.array(jsonObject).max(200).optional(), stream_id:goalId.optional(), stream_generation:z.number().int().min(1).optional(),
+    stream_next_seq:z.number().int().min(1).optional(), stream_coverage:streamCoverage.optional() }
 });
 export const autonomousGoalCancelOutputSchema = statusContract({
   statuses:['terminal','requested','existing','failed'], success:['terminal','requested','existing'], required:['goal_id','state'],

package/src/autonomous-runtime.mjs

@@ -17,6 +17,8 @@ import { deriveAgentMemory } from './agent-memory-plane.mjs';
 import { effectIdentity, loopGuardDisposition, bindEffectCompletion } from './effect-ledger.mjs';
 import { createWorkerScheduler } from './worker-scheduler.mjs';
 import { issueObservationLease, verifyObservationLease } from './observation-lease.mjs';
+import { createJournalStream } from './workload-substrate.mjs';
+import { createDeadline, deadlineState } from './deadline-cancellation.mjs';
 
 export const AUTONOMOUS_GOAL_SCHEMA = 'deadbyte.autonomous-goal.v1';
 export const AUTONOMOUS_EVENT_SCHEMA = 'deadbyte.autonomous-event.v1';
@@ -229,7 +231,7 @@ function profileOutcome(profile, checked) {
       { median_ms:receipt.median_ms, p95_ms:receipt.p95_ms, regression_pct:receipt.regression_pct, verdict:receipt.verdict }) } };
 }
 async function executeProfile({ ctx, events, goalId, actionKey, profileId, epoch, policy, codingRuntime, signingKeyPath,
-  r34ResumePhase = null }) {
+  r34ResumePhase = null, childDeadline = null }) {
   const profile = policy.profiles[profileId];
   if (!profile) throw new Error(`autonomous profile '${profileId}' not found`);
   const prior = [...events].reverse().find(event => event.type === 'profile_completed' && event.payload?.action_key === actionKey && event.payload?.profile_id === profileId);
@@ -274,6 +276,9 @@ async function executeProfile({ ctx, events, goalId, actionKey, profileId, epoch
     await appendEvent(ctx,events,signingKeyPath,'profile_completed',payload);
     return { status:outcome.passed ? 'passed' : 'failed', observation:payload, existing:false };
   }
+  const childRemainingRaw = childDeadline ? deadlineState(childDeadline).remaining_ms : null;
+  const childRemainingMs = childRemainingRaw === null ? null : Math.floor(childRemainingRaw);
+  if (childRemainingMs !== null && childRemainingMs < 100) throw new Error('deadline_exceeded');
   const autonomousAuthority = await assertAutonomousArmed(policy,profile.root_id);
   if (Number.isFinite(autonomousAuthority.remaining_ms) && autonomousAuthority.remaining_ms < 100) {
     throw new Error('autonomous lease expires too soon to execute profile');
@@ -283,20 +288,22 @@ async function executeProfile({ ctx, events, goalId, actionKey, profileId, epoch
     authority_instance_nonce:autonomousAuthority.instance_nonce,
     authority_expires_at_utc:autonomousAuthority.expires_at_utc });
   const preExecutionCheck = () => recheckAutonomousAuthority(policy,autonomousAuthority,profile.root_id);
+  const childTimeoutMs = childRemainingMs === null ? profile.timeout_ms : Math.max(100, Math.min(profile.timeout_ms, childRemainingMs));
   let result;
   try {
     result = profile.kind === 'command'
       ? await codingRuntime.commandRun({ rootId:profile.root_id, commandId:profile.command_id, scriptPath:profile.script_path,
-          scriptSha256:profile.script_sha256, args:profile.args, cwd:profile.cwd, timeoutMs:profile.timeout_ms,
+          scriptSha256:profile.script_sha256, args:profile.args, cwd:profile.cwd, timeoutMs:childTimeoutMs,
           executionDeadlineUtc:autonomousAuthority.expires_at_utc, preExecutionCheck, receiptId, requestSha256 })
       : await codingRuntime.benchmarkRun({ rootId:profile.root_id, commandId:profile.command_id, scriptPath:profile.script_path,
-          scriptSha256:profile.script_sha256, args:profile.args, cwd:profile.cwd, timeoutMs:profile.timeout_ms,
+          scriptSha256:profile.script_sha256, args:profile.args, cwd:profile.cwd, timeoutMs:childTimeoutMs,
           executionDeadlineUtc:autonomousAuthority.expires_at_utc, preExecutionCheck,
           warmups:profile.warmups, iterations:profile.iterations, baselineMedianMs:profile.baseline_median_ms,
           maxRegressionPct:profile.max_regression_pct, receiptId, requestSha256 });
   } catch (error) {
     const checked = await codingRuntime.verifyReceiptDetailed(receiptId);
     if (!checked.ok) {
+      if (childDeadline && deadlineState(childDeadline).expired) throw new Error('deadline_exceeded');
       const r34Paused=await pauseR34Ambiguous(checked.reason ?? error);
       if (r34Paused) return r34Paused;
       await appendEvent(ctx,events,signingKeyPath,'goal_paused',{ reason:'profile_execution_without_receipt', profile_id:profileId,
@@ -311,6 +318,7 @@ async function executeProfile({ ctx, events, goalId, actionKey, profileId, epoch
     if (r34Paused) return r34Paused;
     throw new Error(`profile '${profileId}' post-execution receipt verification failed`);
   }
+  if (childDeadline && deadlineState(childDeadline).expired) throw new Error('deadline_exceeded');
   const outcome = profileOutcome(profile,checked);
   if (!outcome.valid) {
     const r34Paused=await pauseR34Ambiguous(outcome.reason);
@@ -363,7 +371,7 @@ function normalizeTaskContract(raw) {
     constraints:list('constraints',32,512),evidence_requirements:list('evidence_requirements',32,512),
     risk_level:value.risk_level,clarification_policy:value.clarification_policy,...rigor});
 }
-function normalizeGoal(policy, { submissionId, rootId, title = '', goal, acceptance = '', taskContract = null, maxIterations = null }) {
+function normalizeGoal(policy, { submissionId, rootId, title = '', goal, acceptance = '', taskContract = null, maxIterations = null, timeoutMs = null }) {
   if (!ID_RE.test(submissionId ?? '')) throw new Error('autonomous submission_id invalid');
   if (!policy.root_ids.includes(rootId)) throw new Error(`autonomous root '${rootId}' is not allowed`);
   if (typeof title !== 'string' || title.length > 160) throw new Error('autonomous title must be <=160 characters');
@@ -371,9 +379,10 @@ function normalizeGoal(policy, { submissionId, rootId, title = '', goal, accepta
   if (typeof acceptance !== 'string' || acceptance.length > 4096) throw new Error('autonomous acceptance must be <=4096 characters');
   const iterations = maxIterations ?? policy.limits.max_iterations;
   if (!Number.isInteger(iterations) || iterations < 1 || iterations > policy.limits.max_iterations) throw new Error('autonomous max_iterations exceeds policy');
+  if (timeoutMs !== null && (!Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 900000)) throw new Error('autonomous timeout_ms must be null or in [100,900000]');
   const body = { schema:AUTONOMOUS_GOAL_SCHEMA, policy_sha256:policy.policy_sha256,
     coding_policy_sha256:policy.coding_policy_sha256, submission_id:submissionId, root_id:rootId,
-    title, goal, acceptance, task_contract:normalizeTaskContract(taskContract),max_iterations:iterations };
+    title, goal, acceptance, task_contract:normalizeTaskContract(taskContract),max_iterations:iterations, timeout_ms:timeoutMs };
   return Object.freeze({ ...body, goal_sha256:sha256Object(body) });
 }
 
@@ -731,7 +740,9 @@ function assertDelegatedIdentity(events, operation) {
     }
   }
 }
-async function invokeDelegatedOperation(goal, operation, runtimes, desktopContext=null) {
+async function invokeDelegatedOperation(goal, operation, runtimes, desktopContext=null, childDeadline=null) {
+  const remainingMs = childDeadline ? Math.max(100, Math.floor(deadlineState(childDeadline).remaining_ms)) : null;
+  if (childDeadline && deadlineState(childDeadline).expired) throw new Error('deadline_exceeded');
   const { codingRuntime, semanticRuntime, nativeDiffRuntime, machineFsRuntime, observationRuntime, processRuntime, desktopRuntime } = runtimes;
   switch (operation.kind) {
     case 'stat':
@@ -804,7 +815,7 @@ async function invokeDelegatedOperation(goal, operation, runtimes, desktopContex
       return observationRuntime.systemStatus();
     case 'process_start':
       if (!processRuntime) throw new Error('process runtime unavailable');
-      return processRuntime.start({ profileId:operation.profile_id, rootId:goal.root_id, cwd:operation.cwd, args:operation.args??[] });
+      return processRuntime.start({ profileId:operation.profile_id, rootId:goal.root_id, cwd:operation.cwd, args:operation.args??[], timeoutMs:remainingMs });
     case 'process_read':
       if (!processRuntime) throw new Error('process runtime unavailable');
       return processRuntime.read({ sessionId:operation.session_id, offset:operation.offset, maxBytes:operation.max_bytes });
@@ -893,7 +904,7 @@ async function verifyDelegatedEvidence(operation, result, runtimes, verifyKeyPat
   return { kind:'runtime_result', result_sha256:sha256Object(result) };
 }
 async function executeDelegate({ ctx, events, goal, decisionEvent, decision, policy, runtimes, assertRunAuthority,
-  signingKeyPath, verifyKeyPath }) {
+  signingKeyPath, verifyKeyPath, childDeadline = null }) {
   const capabilityId=capabilityIdForOperation(decision.operation);
   if(!capabilityId) throw new Error(`unsupported typed capability action '${String(decision.operation?.kind)}'`);
   const actionKey = `capability-${decisionEvent.event_sha256}`;
@@ -939,7 +950,7 @@ async function executeDelegate({ ctx, events, goal, decisionEvent, decision, pol
         }
       };
     }
-    const result = await invokeDelegatedOperation(goal,decision.operation,runtimes,desktopContext);
+    const result = await invokeDelegatedOperation(goal,decision.operation,runtimes,desktopContext,childDeadline);
     if (Buffer.byteLength(canonicalJson(result),'utf8') > policy.limits.max_context_bytes) {
       throw new Error('delegated result exceeds autonomous context bound');
     }
@@ -971,7 +982,7 @@ async function executeDelegate({ ctx, events, goal, decisionEvent, decision, pol
   }
 }
 
-async function executeProfileWithLease({workerScheduler,ctx,events,goal,epoch,actionKey,profileId,policy,codingRuntime,signingKeyPath,r34ResumePhase=null}) {
+async function executeProfileWithLease({workerScheduler,ctx,events,goal,epoch,actionKey,profileId,policy,codingRuntime,signingKeyPath,r34ResumePhase=null,childDeadline=null}) {
   if(!workerScheduler) throw new Error('R37 worker scheduler unavailable');
   const taskId=`${goal.goal_id}:${actionKey}:${profileId}`;
   const lease=workerScheduler.acquire({taskId,workerClass:'profile',cpuUnits:1,memoryMb:256});
@@ -981,7 +992,7 @@ async function executeProfileWithLease({workerScheduler,ctx,events,goal,epoch,ac
   });
   let outcomeStatus='failed';
   try {
-    const result=await executeProfile({ctx,events,goalId:goal.goal_id,actionKey,profileId,epoch,policy,codingRuntime,signingKeyPath,r34ResumePhase});
+    const result=await executeProfile({ctx,events,goalId:goal.goal_id,actionKey,profileId,epoch,policy,codingRuntime,signingKeyPath,r34ResumePhase,childDeadline});
     outcomeStatus=result.status;
     return result;
   } finally {
@@ -993,14 +1004,14 @@ async function executeProfileWithLease({workerScheduler,ctx,events,goal,epoch,ac
   }
 }
 
-async function runMutationProfiles({ ctx, events, goal, epoch, actionKey, policy, codingRuntime, signingKeyPath, workerScheduler }) {
+async function runMutationProfiles({ ctx, events, goal, epoch, actionKey, policy, codingRuntime, signingKeyPath, workerScheduler, childDeadline=null }) {
   const profileIds = Object.entries(policy.profiles)
     .filter(([,profile]) => profile.run_after_mutation)
     .map(([id]) => id);
   const results = [];
   for (const profileId of profileIds) {
     const result = await executeProfileWithLease({workerScheduler,ctx,events,goal,epoch,
-      actionKey:`${actionKey}:${profileId}`,profileId,policy,codingRuntime,signingKeyPath});
+      actionKey:`${actionKey}:${profileId}`,profileId,policy,codingRuntime,signingKeyPath,childDeadline});
     results.push({ profile_id:profileId, status:result.status, observation:result.observation });
     if (result.status === 'paused') break;
   }
@@ -1402,7 +1413,7 @@ function r34ReasonHash(goal,decisionEvent,reason) {
 }
 async function executeR34Decision({ctx,events,goal,state,decisionEvent,decision,policy,codingRuntime,
   nativeDiffRuntime,machineFsRuntime,observationRuntime,processRuntime,semanticRuntime,desktopRuntime,assertRunAuthority,
-  signingKeyPath,verifyKeyPath,workerScheduler}) {
+  signingKeyPath,verifyKeyPath,workerScheduler,childDeadline=null}) {
   let loop=deriveLoopState(goal,events);
   if (decision.kind === 'plan_create') {
     if (loop.phase !== 'PLAN' || loop.plan) throw new Error('R34 plan_create requires empty PLANNING state');
@@ -1460,11 +1471,11 @@ async function executeR34Decision({ctx,events,goal,state,decisionEvent,decision,
       await assertRunAuthority(goal.root_id);
       outcome=await executeProfileWithLease({workerScheduler,ctx,events,goal,
         actionKey:`r34-${decisionEvent.event_sha256}`,profileId:decision.action.profile_id,
-        epoch:state.mutation_epoch,policy,codingRuntime,signingKeyPath,r34ResumePhase:loop.phase});
+        epoch:state.mutation_epoch,policy,codingRuntime,signingKeyPath,r34ResumePhase:loop.phase,childDeadline});
     } else if (decision.action.kind === 'delegate') {
       outcome=await executeDelegate({ctx,events,goal,decisionEvent,
         decision:{operation:decision.action.operation},policy,
-        runtimes:{codingRuntime,semanticRuntime,nativeDiffRuntime,machineFsRuntime,observationRuntime,processRuntime,desktopRuntime},assertRunAuthority,signingKeyPath,verifyKeyPath});
+        runtimes:{codingRuntime,semanticRuntime,nativeDiffRuntime,machineFsRuntime,observationRuntime,processRuntime,desktopRuntime},assertRunAuthority,signingKeyPath,verifyKeyPath,childDeadline});
     } else if (decision.action.kind === 'native_diff_apply') {
       await assertRunAuthority(goal.root_id);
       outcome=await executePreparedDiff({ctx,events,goal,state,decisionEvent,diffId:decision.action.diff_id,
@@ -1493,7 +1504,7 @@ async function executeR34Decision({ctx,events,goal,state,decisionEvent,decision,
     } else if (capabilityIdForOperation(decision.action)) {
       outcome=await executeDelegate({ctx,events,goal,decisionEvent,
         decision:{operation:decision.action},policy,
-        runtimes:{codingRuntime,semanticRuntime,nativeDiffRuntime,machineFsRuntime,observationRuntime,processRuntime,desktopRuntime},assertRunAuthority,signingKeyPath,verifyKeyPath});
+        runtimes:{codingRuntime,semanticRuntime,nativeDiffRuntime,machineFsRuntime,observationRuntime,processRuntime,desktopRuntime},assertRunAuthority,signingKeyPath,verifyKeyPath,childDeadline});
     } else {
       throw new Error(`unsupported R34 action '${String(decision.action.kind)}'`);
     }
@@ -1612,12 +1623,12 @@ async function executeR34Decision({ctx,events,goal,state,decisionEvent,decision,
 
 async function executeDecisionCore({ ctx, events, goal, state, decisionEvent, policy, codingRuntime,
   nativeDiffRuntime, machineFsRuntime, observationRuntime, processRuntime, semanticRuntime, desktopRuntime, assertRunAuthority,
-  signingKeyPath, verifyKeyPath, workerScheduler }) {
+  signingKeyPath, verifyKeyPath, workerScheduler, childDeadline = null }) {
   const decision = decisionEvent.decision;
   if (decision?.schema === 'deadbyte.autonomous-decision.v2') {
     const outcome=await executeR34Decision({ctx,events,goal,state,decisionEvent,decision,policy,codingRuntime,
       nativeDiffRuntime,machineFsRuntime,observationRuntime,processRuntime,semanticRuntime,desktopRuntime,assertRunAuthority,
-      signingKeyPath,verifyKeyPath,workerScheduler});
+      signingKeyPath,verifyKeyPath,workerScheduler,childDeadline});
     await appendEvent(ctx,events,signingKeyPath,'decision_completed',{
       decision_event_sha256:decisionEvent.event_sha256,action:decision.kind,
       outcome_status:outcome.status ?? 'completed'
@@ -1650,12 +1661,12 @@ async function executeDecisionCore({ ctx, events, goal, state, decisionEvent, po
       policy,codingRuntime,signingKeyPath,workerScheduler });
   } else if (decision.action === 'delegate') {
     outcome = await executeDelegate({ ctx,events,goal,decisionEvent,decision,policy,
-      runtimes:{ machineFsRuntime,observationRuntime,processRuntime },assertRunAuthority,signingKeyPath,verifyKeyPath });
+      runtimes:{ machineFsRuntime,observationRuntime,processRuntime },assertRunAuthority,signingKeyPath,verifyKeyPath,childDeadline });
   } else if (decision.action === 'run_profile') {
     await assertRunAuthority(goal.root_id);
     outcome = await executeProfileWithLease({workerScheduler,ctx,events,goal,
       actionKey:`planner-${decisionEvent.event_sha256}`,profileId:decision.profile_id,
-      epoch:state.mutation_epoch,policy,codingRuntime,signingKeyPath});
+      epoch:state.mutation_epoch,policy,codingRuntime,signingKeyPath,childDeadline});
   } else if (decision.action === 'pause') {
     await appendEvent(ctx,events,signingKeyPath,'goal_paused',{
       reason:decision.reason, planner_summary:decision.summary
@@ -1817,9 +1828,9 @@ export function createAutonomousRuntime({ policy, codingRuntime, nativeDiffRunti
     return { autonomous, coding };
   }
 
-  async function submit({ submissionId, rootId, title = '', goal, acceptance = '', taskContract = null, maxIterations = null }) {
+  async function submit({ submissionId, rootId, title = '', goal, acceptance = '', taskContract = null, maxIterations = null, timeoutMs = null }) {
     await assertRunAuthority(rootId);
-    const normalized = normalizeGoal(policy,{ submissionId,rootId,title,goal,acceptance,taskContract,maxIterations });
+    const normalized = normalizeGoal(policy,{ submissionId,rootId,title,goal,acceptance,taskContract,maxIterations,timeoutMs });
     const goalId = goalIdFor(policy.policy_sha256,submissionId);
     const ctx = goalContext(policy,goalId);
     if (await exists(ctx.dir)) {
@@ -1838,7 +1849,7 @@ export function createAutonomousRuntime({ policy, codingRuntime, nativeDiffRunti
     await appendEvent(ctx,journal,signingKeyPath,'goal_created',{
       submission_id:submissionId, root_id:rootId, title, acceptance:normalized.acceptance,
       task_contract:normalized.task_contract,goal_sha256:normalized.goal_sha256,
-      max_iterations:normalized.max_iterations,
+      max_iterations:normalized.max_iterations, timeout_ms:normalized.timeout_ms,
       ...(memoryProvider?{source_release_manifest:memoryProvider.source_release_manifest}:{})
     });
     return { status:'accepted', goal_id:goalId, goal_sha256:normalized.goal_sha256, state:'pending' };
@@ -1849,11 +1860,18 @@ export function createAutonomousRuntime({ policy, codingRuntime, nativeDiffRunti
     const goal = await loadGoal(ctx,policy,verifyKeyPath);
     const journal = await readEvents(ctx,verifyKeyPath);
     const derived = deriveState(goal,journal);
+    const goalCreated = journal.find(event => event.type === 'goal_created');
+    const goalCreatedAtMs = goalCreated ? Date.parse(goalCreated.created_at_utc) : NaN;
+    if (!Number.isFinite(goalCreatedAtMs)) throw new Error('autonomous goal creation timestamp invalid');
+    const deadline = createDeadline({ timeoutMs:goal.timeout_ms, nowMs:goalCreatedAtMs, id:goalId });
     const loop = publicLoopState(loopStateOrNull(goal,journal),goal,journal);
     const lock=await runLockStatus(ctx);
+    const stream=createJournalStream({streamId:goalId,events:journal,maxItems:10000,maxBytes:16*1024*1024,producer:'autonomous-goal',channel:'event'});
+    const snapshot=stream.snapshot();
     return { status:'ok', goal_id:goalId, goal_sha256:goal.goal_sha256,
-      title:goal.title, root_id:goal.root_id, journal_verified:true, ...derived, ...lock,
-      ...(loop ? {loop} : {}) };
+      title:goal.title, root_id:goal.root_id, timeout_ms:goal.timeout_ms, deadline, journal_verified:true, ...derived, ...lock,
+      stream_id:snapshot.stream_id, stream_generation:snapshot.generation, stream_next_seq:snapshot.next_seq,
+      stream_coverage:stream.coverage(), ...(loop ? {loop} : {}) };
   }
 
   async function events({ goalId, fromSeq = 1, limit = 100 }) {
@@ -1861,9 +1879,13 @@ export function createAutonomousRuntime({ policy, codingRuntime, nativeDiffRunti
     if (!Number.isInteger(limit) || limit < 1 || limit > 200) throw new Error('autonomous event limit must be in [1,200]');
     const ctx = goalContext(policy,goalId); await loadGoal(ctx,policy,verifyKeyPath);
     const journal = await readEvents(ctx,verifyKeyPath);
+    const stream=createJournalStream({streamId:goalId,events:journal,maxItems:10000,maxBytes:16*1024*1024,producer:'autonomous-goal',channel:'event'});
+    const page=stream.read(fromSeq,limit);
+    const snapshot=stream.snapshot();
     return { status:'ok', goal_id:goalId, journal_verified:true,
       journal_head_sha256:journal.at(-1)?.event_sha256 ?? ZERO_HASH,
-      events:journal.slice(fromSeq-1,fromSeq-1+limit) };
+      stream_id:snapshot.stream_id, stream_generation:snapshot.generation, stream_next_seq:snapshot.next_seq,
+      stream_coverage:stream.coverage(), events:page.items.map(item=>item.value) };
   }
   async function cancel({ goalId, reason = 'operator_request' }) {
     if (typeof reason !== 'string' || reason.length < 1 || reason.length > 256) throw new Error('autonomous cancel reason invalid');
@@ -1896,6 +1918,7 @@ export function createAutonomousRuntime({ policy, codingRuntime, nativeDiffRunti
       const current = deriveState(goal,journal);
       if (terminalState(current)) return withLoopResult(goal,journal,{ status:'terminal', goal_id:goalId, state:current.state });
       if (!pauseState(current)) throw new Error('autonomous goal is not paused');
+      if (current.reason === 'deadline_exceeded') throw new Error('autonomous goal deadline expired');
       if (decision === 'reject') {
         await appendEvent(ctx,journal,signingKeyPath,'goal_cancelled',{ reason:'resume_rejected' });
         return withLoopResult(goal,journal,{ status:'rejected', goal_id:goalId, state:'cancelled' });
@@ -2026,9 +2049,26 @@ export function createAutonomousRuntime({ policy, codingRuntime, nativeDiffRunti
       if (await consumeCancel(ctx,journal,signingKeyPath,verifyKeyPath)) {
         state = deriveState(goal,journal); return withLoopResult(goal,journal,{ status:'cancelled', goal_id:goalId, ...state });
       }
-      await appendEvent(ctx,journal,signingKeyPath,'goal_run_started',{ max_cycles:maxCycles });
+      const goalCreated = journal.find(event => event.type === 'goal_created');
+      const goalCreatedAtMs = goalCreated ? Date.parse(goalCreated.created_at_utc) : NaN;
+      if (!Number.isFinite(goalCreatedAtMs)) throw new Error('autonomous goal creation timestamp invalid');
+      const deadline = createDeadline({ timeoutMs:goal.timeout_ms, nowMs:goalCreatedAtMs, id:goalId });
+      const deadlineExpired = () => goal.timeout_ms !== null && deadlineState(deadline).expired;
+      const stopAtDeadline = async () => {
+        if (!deadlineExpired()) return false;
+        const existing = deriveState(goal,journal);
+        if (!(existing.state === 'paused' && existing.reason === 'deadline_exceeded')) {
+          await appendEvent(ctx,journal,signingKeyPath,'goal_paused',{ reason:'deadline_exceeded', deadline });
+        }
+        return true;
+      };
+      await appendEvent(ctx,journal,signingKeyPath,'goal_run_started',{ max_cycles:maxCycles, deadline });
       let cycles = 0; let suppliedResponse = plannerResponse;
       while (cycles < maxCycles) {
+        if (await stopAtDeadline()) {
+          state = deriveState(goal,journal);
+          return withLoopResult(goal,journal,{ status:'paused', reason:'deadline_exceeded', goal_id:goalId, deadline, ...state });
+        }
         state = deriveState(goal,journal);
         if (terminalState(state) || pauseState(state)) return withLoopResult(goal,journal,{ status:state.state, goal_id:goalId, ...state });
         if (await consumeCancel(ctx,journal,signingKeyPath,verifyKeyPath)) {
@@ -2039,14 +2079,23 @@ export function createAutonomousRuntime({ policy, codingRuntime, nativeDiffRunti
           try {
             outcome = await executeDecision({ ctx,events:journal,goal,state,
               decisionEvent:state.pending_decision,policy,codingRuntime,nativeDiffRuntime,machineFsRuntime,
-              observationRuntime,processRuntime,semanticRuntime,desktopRuntime,assertRunAuthority,signingKeyPath,verifyKeyPath,workerScheduler });
+              observationRuntime,processRuntime,semanticRuntime,desktopRuntime,assertRunAuthority,signingKeyPath,verifyKeyPath,workerScheduler,childDeadline:deadline });
           } catch (error) {
+            if (deadlineExpired() || error?.message === 'deadline_exceeded') {
+              await stopAtDeadline();
+              state = deriveState(goal,journal);
+              return withLoopResult(goal,journal,{ status:'paused', reason:'deadline_exceeded', goal_id:goalId, deadline, ...state });
+            }
             const loop=loopStateOrNull(goal,journal);
             if (!loop || loop.pending_action || !isAuthorityUnavailable(error)) throw error;
             outcome=await r34EnterWaiting({ctx,events:journal,goal,signingKeyPath,
               reason:'authority_unavailable',resumePhase:loop.phase});
           }
           cycles += 1; state = deriveState(goal,journal);
+          if (await stopAtDeadline()) {
+            state = deriveState(goal,journal);
+            return withLoopResult(goal,journal,{ status:'paused', reason:'deadline_exceeded', goal_id:goalId, deadline, ...state });
+          }
           if (outcome.status === 'paused' || pauseState(state)) return withLoopResult(goal,journal,{ status:'paused', goal_id:goalId, ...state });
           if (outcome.status === 'finish_requested') {
             const gate = await releaseGateLocked(ctx,goal,journal);
@@ -2063,6 +2112,10 @@ export function createAutonomousRuntime({ policy, codingRuntime, nativeDiffRunti
           }
           continue;
         }
+        if (await stopAtDeadline()) {
+          state = deriveState(goal,journal);
+          return withLoopResult(goal,journal,{ status:'paused', reason:'deadline_exceeded', goal_id:goalId, deadline, ...state });
+        }
         const accepted = await acceptPlannerDecision({ ctx,events:journal,goal,state,policy,codingRuntime,capabilityManifest,
           desktopMemoryProvider,memoryProvider,signingKeyPath,plannerResponse:suppliedResponse,plannerProviderRuntime });
         suppliedResponse = null;
@@ -2079,7 +2132,7 @@ export function createAutonomousRuntime({ policy, codingRuntime, nativeDiffRunti
         if (pauseState(state)) return withLoopResult(goal,journal,{ status:'paused', goal_id:goalId, ...state });
       }
       state = deriveState(goal,journal);
-      return withLoopResult(goal,journal,{ status:'yielded', goal_id:goalId, cycles, ...state });
+      return withLoopResult(goal,journal,{ status:'yielded', goal_id:goalId, cycles, deadline, ...state });
     } finally { await releaseLock(ctx); }
   }