effect-agent 0.1.0-beta.124 → 0.1.0-beta.126

package/dist/{AgentRuntime-BUxDdLpw.d.mts → AgentRuntime-DEDvMkAR.d.mts}

@@ -15,7 +15,7 @@ import { n as CompactionError } from "./ContextCompactor-WwSIG_Z2.mjs";
 import { t as DurableStep } from "./DurableStep-Cry_iol4.mjs";
 import { B as RunSubagentChildIdentity, H as RunSubagentEstablishRequest, M as RunOptions, S as RunContextPreparationError, W as RunSubagentJoinRequest, i as ChildEstablishStatus, l as ModelUsageAccounting, t as AgentUpdateAcceptance, x as RunContextPreparation } from "./RunOptions-CSBsSj0X.mjs";
 import { t as MessagingHost } from "./MessagingHost-CqzpxbGz.mjs";
-import { o as SubagentHost } from "./SubagentHost-4WB8Hj0C.mjs";
+import { o as SubagentHost } from "./SubagentHost-DQjHFGqH.mjs";
 import { t as RunEventSink } from "./RunEventSink-D5aVhISG.mjs";
 import { AiError, LanguageModel, Model, Prompt, Tool, Toolkit } from "effect/unstable/ai";
 import { Cause, Context, Effect, Layer, Option, Schema, Scope, Stream, Tracer } from "effect";
@@ -343,4 +343,4 @@ declare namespace AgentRuntime_d_exports {
 }
 //#endregion
 export { start as A, decodeFinalOutput as C, renderInputPrompt as D, projectCompletionOutput as E, withTerminalDefectEvent as F, stream as M, streamUnknown as N, run as O, streamWithUsageAccountingUnknown as P, ToolCallWaiting as S, projectCompletionFromToolOutput as T, SubagentDurability as _, AgentResultSchema as a, SubagentDurabilityError as b, AgentSpawner as c, DetachedRun as d, EngineProvidedToolServices as f, SpawnedChildRun as g, SpawnRunOptions as h, AgentResult as i, startUnknown as j, runUnknown as k, AgentSpawnerParent as l, SpawnDelegation as m, AgentChildPending as n, AgentRuntimeFailure as o, RuntimeBinding as p, AgentCompletionProjectionRequirements as r, AgentRuntimeRequirements as s, AgentRuntime_d_exports as t, AgentSpawnerService as u, SubagentDurabilityDurable as v, encodeRunDisposition as w, SubagentDurabilityService as x, SubagentDurabilityEphemeral as y };
-//# sourceMappingURL=AgentRuntime-BUxDdLpw.d.mts.map
+//# sourceMappingURL=AgentRuntime-DEDvMkAR.d.mts.map

package/dist/Digest-U69rDHuO.d.mts

@@ -0,0 +1,22 @@
+import { _ as Digest, h as DefinitionDigests, m as DefinitionDigestInput, s as CanonicalBatch } from "./Records-B5GFWCpn.mjs";
+import { Crypto, Effect, Schema } from "effect";
+declare namespace Digest_d_exports {
+  export { DigestError, EMPTY_TAIL_DIGEST, digestCanonicalBatch, digestDefinition, digestDefinitions, digestJson };
+}
+declare const DigestError_base: Schema.Class<DigestError, Schema.TaggedStruct<"DigestError", {
+  readonly message: Schema.String;
+  readonly cause: Schema.optionalKey<Schema.Defect>;
+}>, import("effect/Cause").YieldableError>;
+declare class DigestError extends DigestError_base {}
+/** Digest a JSON value using a stable, locale-independent object-key ordering (UTF-16 code units, RFC 8785 style). */
+declare const digestJson: (value: Schema.Json) => Effect.Effect<string & import("effect/Brand").Brand<"@effect-agent/thread/Digest">, DigestError, Crypto.Crypto>;
+/** Digest a canonical batch together with the prior tail to form an append-only hash chain. */
+declare const digestCanonicalBatch: (previousTailDigest: Digest, batch: CanonicalBatch) => Effect.Effect<Digest, DigestError, Crypto.Crypto>;
+/** Digest one schema-encoded Agent, Model, or Toolkit definition. */
+declare const digestDefinition: (definition: Schema.Json) => Effect.Effect<string & import("effect/Brand").Brand<"@effect-agent/thread/Digest">, DigestError, Crypto.Crypto>;
+/** Digest all replay-relevant definitions without hiding which authority changed. */
+declare const digestDefinitions: (definitions: DefinitionDigestInput) => Effect.Effect<DefinitionDigests, DigestError, Crypto.Crypto>;
+declare const EMPTY_TAIL_DIGEST: string & import("effect/Brand").Brand<"@effect-agent/thread/Digest">;
+//#endregion
+export { digestDefinition as a, digestCanonicalBatch as i, Digest_d_exports as n, digestDefinitions as o, EMPTY_TAIL_DIGEST as r, digestJson as s, DigestError as t };
+//# sourceMappingURL=Digest-U69rDHuO.d.mts.map

package/dist/{DurableAgentRuntime-B-9w7jDt.mjs → DurableAgentRuntime-BydyN_n-.mjs}

@@ -21,7 +21,7 @@ import { getToolExecutionClass } from "./engine/DurableStep.mjs";
 import { CompactionError, ContextCompactor } from "./engine/ContextCompactor.mjs";
 import { RunPolicyUsage } from "./core/RunPolicyUsage.mjs";
 import { AgentUpdateAcceptance, CurrentToolFailureObserver, ModelUsageAccounting, RunContextPreparation, RunContextPreparationPassthrough, RunToolAuthorization, RunToolScheduling } from "./engine/RunOptions.mjs";
-import { AbortRequested, AgentUpdateEmitted, BatchId, CanonicalBatch, CanonicalRecordEnvelope, CanonicalSequence, CompactionCreated, DefinitionDigests, Digest, ModelResponseInterrupted, PeerMessagePrepared, PersistedJson, ProducerEpoch, RecordEnvelope, RecordId, RepairAnnotated, RunDurationExhausted, RunPolicyUsageReserved, RunStartedRecord, SettlementFailureDiagnostic, SubagentJoined, SubagentLineageRecorded, SubagentRequested, SubagentStarted, SubmissionSettled, SubmissionSettledRecord, SubtreeBudgetReserved, ThreadCreated, ToolApprovalDecided, ToolApprovalRequested, ToolCallPrepared, ToolCallResolved, ToolCallSettled, ToolCallUnknown, ToolOperation, ToolStepSettled, ToolUnavailable, UserInputRecorded, WorkerAdmission, WorkerInputCompleted, WorkerInputRequested, WorkerOrigin, WorkerOriginRecorded, WorkerReportPrepared, WorkerReportRefused, WorkerReportingIntent, WorkerStopRequested } from "./durable/Records.mjs";
+import { AbortRequested, AgentUpdateEmitted, BatchId, CanonicalBatch, CanonicalRecordEnvelope, CanonicalSequence, CompactionCreated, DefinitionDigests, Digest, ModelResponseInterrupted, PeerMessagePrepared, PersistedJson, ProducerEpoch, RecordEnvelope, RecordId, RepairAnnotated, RunDurationExhausted, RunPolicyUsageReserved, RunStartedRecord, SettlementFailureDiagnostic, SubagentJoined, SubagentLineageRecorded, SubagentRequested, SubagentStarted, SubmissionSettled, SubmissionSettledRecord, SubtreeBudgetReserved, ThreadCreated, ToolApprovalDecided, ToolApprovalRequested, ToolCallPrepared, ToolCallResolved, ToolCallSettled, ToolCallUnknown, ToolOperation, ToolStepSettled, ToolUnavailable, UserInputRecorded, WorkerAdmission, WorkerContinuation, WorkerInputCompleted, WorkerInputRequested, WorkerOrigin, WorkerOriginRecorded, WorkerReportPrepared, WorkerReportRefused, WorkerReportingIntent, WorkerStopRequested } from "./durable/Records.mjs";
 import { AbortCommand, AbortIntentRequest, AdmissionPolicyError, AdmissionRequest, ApprovalDecisionCommand, ApprovalPendingSuspension, AttachChildToReservationRequest, BeginChildBudgetReleaseRequest, ChildBudgetReservationRequest, ChildReservationId, ChildSettledNotification, ClaimJoiningRequest, ClaimRequest, LedgerError, MarkInputAppliedRequest, MarkJoinedRequest, MarkReadyRequest, MarkUnknownRequest, OwnershipToken, ParentLinkage, RecoverySnapshotRequest, ReleaseChildBudgetRequest, ReleaseOwnershipRequest, RenewOwnershipRequest, RevertJoiningRequest, Settlement, SettlementFinalization, SettlementReservation, SubmissionLedger, SubmissionLookupById, SubmissionLookupByKey, SuspendRequest, UnknownResolutionCommand, WaitingChild, WaitingForChildSuspension, WorkerLedgerState, submissionAbortBatchId, submissionAbortRecordId, submissionInputBatchId, submissionInputRecordId, submissionSettlementBatchId, submissionSettlementId, submissionSettlementRecordId } from "./durable/SubmissionLedger.mjs";
 import { DeclaredPendingBatchEvidence, OpenDelegationCallEvidence, OpenToolCallEvidence, PendingApprovalEvidence, RecoveryDecision, RecoveryEvidence, classifyRecovery } from "./durable/Recovery.mjs";
 import { ExplainedEvidence, ExplainedSubmission, ExplainedUnknownCall, IntegrityCheck, IntegrityReport, ObligationEntry, ObligationReport, RecoveryExplanation, RetryRefused, obligationSeverityOf, predictRecoveryDisposition, recoveryDecisionMeaning } from "./durable/Admin.mjs";
@@ -653,12 +653,14 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 	};
 	const withCrypto = (effect) => Effect.provideService(effect, Crypto.Crypto, deps.crypto);
 	const authorizeBudget = Effect.fn("WorkerHost.authorizeBudget")(function* (origin, principal) {
+		yield* verifyContinuation(origin);
 		if (origin.budgetScope !== "worker-run") return;
 		if (origin.depth !== 1) return yield* failure("start", "denied");
 		yield* deps.budgetAuthorizer.authorize({
 			source: origin.source,
 			principal,
 			worker: origin.worker,
+			...origin.continuationOf === void 0 ? {} : { continuationOf: origin.continuationOf },
 			policy: origin.policy,
 			budget: origin.budget
 		});
@@ -670,6 +672,59 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 			recordId
 		}).pipe(Effect.provideService(ThreadStore, deps.store), Effect.mapError(storageFailure(operation)));
 	});
+	const completedContinuation = Effect.fn("WorkerHost.completedContinuation")(function* (source, worker, targetAgentId, delegationId, expected) {
+		const selected = yield* decode(WorkerRef, worker, "start");
+		if (selected.targetAgentId !== targetAgentId || selected.delegationId !== delegationId || selected.threadId === source.threadId || deps.ledger.inspectWorker === void 0) return yield* failure("start", "worker-mismatch");
+		const sourceState = yield* readWorkerState$1(source.threadId, "start");
+		if (sourceState.records.some(({ record }) => record.payload._tag === "WorkerStopRequested" && record.payload.command.worker.threadId === selected.threadId)) return yield* failure("start", "denied");
+		const first = sourceState.records.find(({ record }) => record.recordId === firstWorkerInputRecordId(selected))?.record.payload;
+		const origin = first?._tag === "WorkerInputRequested" ? first.admission.origin : void 0;
+		if (origin === void 0 || origin.lifecycle !== "assignment" || !Schema.toEquivalence(WorkerRef)(origin.worker, selected) || origin.source.threadId !== source.threadId || origin.source.agentId !== source.agentId || first?._tag !== "WorkerInputRequested" || first.admission.messageId !== origin.firstMessageId) return yield* failure("start", "worker-mismatch");
+		const recorded = Option.getOrUndefined(yield* exactRecord(selected.threadId, workerOriginRecordId(selected.threadId), "start"))?.record.payload;
+		if (recorded?._tag !== "WorkerOriginRecorded" || !sameOrigin(recorded.origin, origin)) return yield* failure("start", "worker-mismatch");
+		const control = yield* deps.ledger.inspectWorker(selected.threadId).pipe(Effect.mapError(storageFailure("start")));
+		if (control.terminal !== "completed" || !control.stopped || control.active !== null) return yield* failure("start", "denied");
+		const tail = yield* deps.store.inspectTail(ThreadTailRequest.make({ threadId: selected.threadId })).pipe(Effect.mapError(storageFailure("start")));
+		const run = (yield* deps.store.read({
+			threadId: selected.threadId,
+			selection: {
+				_tag: "WorkerExecution",
+				expectedTailSequence: tail.tailSequence,
+				expectedTailDigest: tail.tailDigest
+			},
+			page: { limit: 2 }
+		}).pipe(Stream.runCollect, Effect.mapError(storageFailure("start")))).find(({ record }) => record.payload._tag === "RunStarted")?.record.payload;
+		if (run?._tag !== "RunStarted") return yield* failure("start", "corrupt");
+		const input = Option.getOrUndefined(yield* getRunInput({
+			threadId: selected.threadId,
+			runId: run.runId
+		}).pipe(Effect.provideService(ThreadStore, deps.store), Effect.mapError(storageFailure("start"))))?.record.payload;
+		if (input?._tag !== "UserInputRecorded" || input.submissionId === void 0) return yield* failure("start", "corrupt");
+		const found = yield* deps.ledger.lookup(SubmissionLookupById.make({ submissionId: input.submissionId })).pipe(Effect.mapError(storageFailure("start")));
+		const row = Option.getOrUndefined(found);
+		const settlement = Option.getOrUndefined(yield* exactRecord(selected.threadId, submissionSettlementRecordId(input.submissionId), "start"))?.record.payload;
+		if (row === void 0 || row.threadId !== selected.threadId || row.state !== "settled" || row.settledOutcome !== "completed" || row.workerAdmission === void 0 || !sameOrigin(row.workerAdmission.origin, origin) || settlement?._tag !== "SubmissionSettled" || settlement.outcome !== "completed" || settlement.runDisposition !== "completed" || settlement.finishReason !== void 0 || settlement.runId !== run.runId || settlement.submissionId !== row.submissionId || settlement.receiptId !== row.receiptId) return yield* failure("start", "denied");
+		const evidence = WorkerContinuation.make({
+			worker: selected,
+			receipt: Receipt.make({
+				threadId: row.threadId,
+				submissionId: row.submissionId,
+				receiptId: row.receiptId,
+				queueSequence: row.queueSequence
+			}),
+			settlementId: settlement.settlementId
+		});
+		if (expected !== void 0 && !Schema.toEquivalence(WorkerContinuation)(expected, evidence)) return yield* failure("start", "worker-mismatch");
+		return {
+			evidence,
+			origin
+		};
+	});
+	const verifyContinuation = Effect.fn("WorkerHost.verifyContinuation")(function* (origin) {
+		if (origin.continuationOf === void 0) return;
+		const previous = yield* completedContinuation(origin.source, origin.continuationOf.worker, origin.worker.targetAgentId, origin.worker.delegationId, origin.continuationOf);
+		if (origin.worker.threadId === previous.origin.worker.threadId || origin.lifecycle !== "assignment" || !samePolicy(origin.policy, previous.origin.policy) || !Schema.toEquivalence(WorkerOrigin.fields.budget)(origin.budget, previous.origin.budget) || !Schema.toEquivalence(SubagentGrant)(origin.grant, previous.origin.grant) || origin.budgetScope !== previous.origin.budgetScope || origin.depth !== previous.origin.depth || origin.toolCallAllowance !== previous.origin.toolCallAllowance || origin.expiresAtMillis > previous.origin.expiresAtMillis) return yield* failure("start", "denied");
+	});
 	const readIdentity = Effect.fn("WorkerHost.readIdentity")(function* (threadId, operation) {
 		const tail = yield* deps.store.inspectTail(ThreadTailRequest.make({ threadId })).pipe(Effect.mapError(storageFailure(operation)));
 		const first = yield* deps.store.read(ThreadRead.make({
@@ -901,10 +956,12 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 	});
 	const reservation = Effect.fn("WorkerHost.reserveInput")(function* (admission, inputDigest, input, principal, retainedFrameworkInput) {
 		const origin = admission.origin;
+		yield* verifyContinuation(origin);
 		const id = workerInputRecordId(admission.messageId);
 		for (let attempt = 0; attempt < 16; attempt++) {
 			const source = yield* sourceAuthority(origin.source.threadId, admission.sourceSubmissionId, true);
 			const current = source.current;
+			if (origin.continuationOf !== void 0 && current.records.some(({ record }) => record.payload._tag === "WorkerStopRequested" && record.payload.command.worker.threadId === origin.continuationOf?.worker.threadId)) return yield* failure("start", "denied");
 			const rows = requests(current.records);
 			const existing = current.records.find(({ record }) => record.recordId === id)?.record.payload;
 			if (existing !== void 0) {
@@ -931,6 +988,7 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 			const selected = yield* resolveTargetPolicy(admission.messageId === origin.firstMessageId ? {
 				...targetRequest,
 				_tag: "InitialInput",
+				...origin.continuationOf === void 0 ? {} : { continuationOf: origin.continuationOf },
 				input,
 				inputDigest,
 				...source.submission === void 0 ? {} : { sourceSubmission: source.submission }
@@ -963,6 +1021,7 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 			const selectedConcurrency = yield* deps.concurrencyResolver.resolve({
 				source: origin.source,
 				worker: origin.worker,
+				...origin.continuationOf === void 0 ? {} : { continuationOf: origin.continuationOf },
 				principal,
 				...source.submission === void 0 ? {} : { sourceSubmission: source.submission }
 			});
@@ -1009,13 +1068,15 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 			if (!Schema.is(WorkerUpdate)(options.messageAdmission)) return yield* failure("start", "denied");
 			yield* validateCompletion(options.messageAdmission, options, agentId, inputDigest);
 		}
+		yield* verifyContinuation(admission.origin);
 		yield* deps.authorizer.authorize({
 			sourceThreadId: admission.origin.source.threadId,
 			...admission.sourceSubmissionId === void 0 ? {} : { sourceSubmissionId: admission.sourceSubmissionId },
 			principal: options.principal,
 			operation: "start",
 			access: "send",
-			worker: admission.origin.worker
+			worker: admission.origin.worker,
+			...admission.origin.continuationOf === void 0 ? {} : { continuationOf: admission.origin.continuationOf }
 		});
 		yield* authorizeBudget(admission.origin, options.principal);
 		if (admission.origin.worker.threadId !== options.threadId || admission.origin.worker.targetAgentId !== agentId || !definitionDigestsEqual(admission.origin.targetDigests, options.definitions) || options.idempotencyKey !== admission.messageId || admission.deliveryPrincipal !== void 0 && admission.deliveryPrincipal !== options.principal) return yield* failure("start", "worker-mismatch");
@@ -1041,6 +1102,7 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 		const now = yield* Clock.currentTimeMillis;
 		const deadlineAtMillis = Math.min(origin.expiresAtMillis, receivingOrigin?.expiresAtMillis ?? Infinity);
 		if (now >= deadlineAtMillis) return yield* failure("followUp", "denied");
+		if (reports[0].reportUpdate !== void 0 && !reports[0].reportUpdate(update)) return void 0;
 		const input = destination.input;
 		let workerAdmission;
 		if (retained !== void 0) workerAdmission = {
@@ -1158,11 +1220,12 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 					budgetExhausted: host.finishReason === "budget-exhausted"
 				}
 			};
-			const projection = yield* Effect.suspend(() => descriptor.prepare(report)).pipe(Effect.timeout(Math.min(deps.limits.reportPreparationTimeoutMillis ?? 5e3, deadlineAtMillis - now)), Effect.map((value) => ({
+			const projection = yield* Effect.suspend(() => descriptor.reportCompletion?.(report) === false ? Effect.succeed(void 0) : descriptor.prepare(report)).pipe(Effect.timeout(Math.min(deps.limits.reportPreparationTimeoutMillis ?? 5e3, deadlineAtMillis - now)), Effect.map((value) => ({
 				_tag: "Prepared",
 				value
 			})), Effect.catchTag("WorkerReportPreparationFailure", (error) => Effect.succeed(refused(error.stage))), Effect.catchTag("TimeoutError", () => Effect.succeed(refused("timeout"))), Effect.catchCauseIf((cause) => !Cause.hasInterrupts(cause), () => Effect.succeed(refused("defect"))));
 			if (projection._tag === "WorkerReportRefused") return projection;
+			if (projection.value === void 0) return refused("filtered");
 			const message = projection.value.message;
 			if (!Schema.is(WorkerCompletion)(message)) return refused("input");
 			if (!Schema.toEquivalence(WorkerRef)(message.report.worker, origin.worker) || !Schema.toEquivalence(Receipt)(message.report.receipt, report.observation.receipt) || message.report.runId !== runId || message.report.settlementId !== host.settlementId || message.report.outcome !== host.outcome || message.budgetExhausted !== report.observation.budgetExhausted) return refused("input");
@@ -1283,17 +1346,18 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 		return yield* failure("inspect", "storage");
 	});
 	const facet = (context, principal, sourceSubmissionId) => {
-		const authorize = (operation, access, worker) => deps.authorizer.authorize({
+		const authorize = (operation, access, worker, continuationOf) => deps.authorizer.authorize({
 			sourceThreadId: context.source.threadId,
 			...sourceSubmissionId === void 0 ? {} : { sourceSubmissionId },
 			principal,
 			operation,
 			access,
-			...worker === void 0 ? {} : { worker }
+			...worker === void 0 ? {} : { worker },
+			...continuationOf === void 0 ? {} : { continuationOf }
 		});
 		const binding = (target, operation) => resolveDefinitionBinding(deps.bindings, target).pipe(Effect.mapError((cause) => failure(operation, "declaration-unavailable", cause)));
 		const deliveryStatus = (row, operation) => messageStatus(row).pipe(Effect.mapError((cause) => failure(operation, "corrupt", cause)));
-		const preparedTarget = Effect.fn("WorkerHost.preparedTarget")(function* (target, encodedInput) {
+		const preparedTarget = Effect.fn("WorkerHost.preparedTarget")(function* (target, encodedInput, continuationOf) {
 			const resolved = yield* binding(target, "start");
 			yield* Schema.decodeUnknownEffect(Schema.toEncoded(target.input))(encodedInput).pipe(Effect.mapError((cause) => failure("start", "corrupt", cause)));
 			const input = yield* decode(PersistedJson, encodedInput, "start");
@@ -1304,6 +1368,7 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 				source,
 				policy: yield* resolveTargetPolicy({
 					_tag: "InitialInput",
+					...continuationOf === void 0 ? {} : { continuationOf },
 					definition: resolved.definition,
 					definitions: resolved.digests,
 					source: context.source,
@@ -1538,11 +1603,13 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 				};
 			}),
 			resolveTargetPolicy: Effect.fn("WorkerHost.resolvePreparedTargetPolicy")(function* (request) {
-				yield* authorize("start", "send");
-				return (yield* preparedTarget(request.target, request.encodedInput)).policy;
+				const previous = request.continuationOf === void 0 ? void 0 : yield* completedContinuation(context.source, request.continuationOf, request.target.id, request.continuationOf.delegationId);
+				yield* authorize("start", "send", void 0, previous?.evidence);
+				return (yield* preparedTarget(request.target, request.encodedInput, previous?.evidence)).policy;
 			}),
 			start: Effect.fn("WorkerHost.start")(function* (command) {
-				const principal = yield* authorize("start", "send");
+				const previous = command.continuationOf === void 0 ? void 0 : yield* completedContinuation(context.source, command.continuationOf, command.target.id, command.delegationId);
+				const principal = yield* authorize("start", "send", void 0, previous?.evidence);
 				if (context.depth !== 0 && sourceSubmissionId === void 0) return yield* failure("start", "denied");
 				const grant = yield* Schema.decodeUnknownEffect(SubagentGrant)(command.encodedGrant).pipe(Effect.mapError((cause) => failure("start", "corrupt", cause)));
 				const parameters = yield* decode(PersistedJson, command.encodedParameters, "start");
@@ -1558,12 +1625,14 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 					messageId
 				}).pipe(Effect.mapError(storageFailure("start")));
 				const replay = (saved) => Effect.gen(function* () {
-					const replayPrincipal = yield* authorize("start", "send");
+					const currentPrevious = command.continuationOf === void 0 ? void 0 : yield* completedContinuation(context.source, command.continuationOf, command.target.id, command.delegationId, previous?.evidence);
+					const replayPrincipal = yield* authorize("start", "send", void 0, currentPrevious?.evidence);
 					yield* binding(command.target, "start");
 					const metadata = saved.envelope.workerAdmission;
 					if (metadata === void 0) return yield* failure("start", "idempotency-conflict");
 					const origin = metadata.origin;
-					if (origin.firstMessageId !== messageId || metadata.messageId !== messageId || origin.source.threadId !== context.source.threadId || origin.worker.delegationId !== command.delegationId || origin.worker.targetAgentId !== command.target.id || !sameJson(metadata.parameters, parameters) || !Schema.toEquivalence(SubagentGrant)(origin.grant, grant) || origin.budgetScope !== command.budgetScope || origin.depth !== context.depth + 1 || !("prepare" in command) && (!samePolicy(origin.policy, command.policy) || !Schema.toEquivalence(WorkerOrigin.fields.budget)(origin.budget, command.budget) || origin.toolCallAllowance !== command.toolCallAllowance)) return yield* failure("start", "idempotency-conflict");
+					if (!Schema.toEquivalence(Schema.UndefinedOr(WorkerContinuation))(origin.continuationOf, currentPrevious?.evidence) || origin.firstMessageId !== messageId || metadata.messageId !== messageId || origin.source.threadId !== context.source.threadId || origin.worker.delegationId !== command.delegationId || origin.worker.targetAgentId !== command.target.id || !sameJson(metadata.parameters, parameters) || !Schema.toEquivalence(SubagentGrant)(origin.grant, grant) || origin.budgetScope !== command.budgetScope || origin.depth !== context.depth + 1 || !("prepare" in command) && (!samePolicy(origin.policy, command.policy) || !Schema.toEquivalence(WorkerOrigin.fields.budget)(origin.budget, command.budget) || origin.toolCallAllowance !== command.toolCallAllowance)) return yield* failure("start", "idempotency-conflict");
+					yield* verifyContinuation(origin);
 					return {
 						worker: origin.worker,
 						delivery: yield* send(origin, messageId, "prepare" in command ? saved.envelope.input : command.encodedInput, parameters, replayPrincipal, "start")
@@ -1576,7 +1645,11 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 						...yield* command.prepare,
 						...command
 					} : command;
-					const prepared = yield* preparedTarget(request.target, request.encodedInput);
+					const currentPrevious = command.continuationOf === void 0 ? void 0 : yield* completedContinuation(context.source, command.continuationOf, command.target.id, command.delegationId, previous?.evidence);
+					if (currentPrevious !== void 0) {
+						if ((yield* authorize("start", "send", void 0, currentPrevious.evidence)) !== principal) return yield* failure("start", "denied");
+					}
+					const prepared = yield* preparedTarget(request.target, request.encodedInput, currentPrevious?.evidence);
 					const resolved = prepared.resolved;
 					const sourcePolicy = Option.getOrElse(prepared.source.policyOverride, () => context.policy);
 					const now = yield* Clock.currentTimeMillis;
@@ -1592,6 +1665,7 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 							threadId: Schema.decodeSync(ThreadId)(messageId)
 						},
 						source: context.source,
+						...currentPrevious === void 0 ? {} : { continuationOf: currentPrevious.evidence },
 						...resolved.definition.runDisposition?.workerLifecycle === "assignment" ? { lifecycle: "assignment" } : {},
 						targetDigests: resolved.digests,
 						policy: request.policy,
@@ -1601,7 +1675,7 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 						depth: context.depth + 1,
 						firstMessageId: messageId,
 						createdAtMillis: now,
-						expiresAtMillis: now + deps.limits.lifetimeMillis,
+						expiresAtMillis: Math.min(now + deps.limits.lifetimeMillis, currentPrevious?.origin.expiresAtMillis ?? Infinity),
 						...reporting === void 0 ? {} : { reporting },
 						...request.toolCallAllowance === void 0 ? {} : { toolCallAllowance: request.toolCallAllowance }
 					}, "start");
@@ -1815,7 +1889,7 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 			...sourceSubmissionId === void 0 ? {} : { sourceSubmissionId },
 			principal: options.principal,
 			operation: "followUp",
-			access: "send",
+			access: "report",
 			worker: receiving?.origin.worker ?? origin.worker
 		})) !== options.principal) return yield* failure("followUp", "denied");
 		return message;
@@ -7058,4 +7132,4 @@ var DurableAgentRuntime = class DurableAgentRuntime extends Context.Service()("@
 //#endregion
 export { DurableApprovalSuspension as a, RecoveryFailure as c, childReservationIdFor as d, isolateRecovery as f, threadCreatedRecordId as g, threadCreatedBatchId as h, DurableApprovalResolver as i, RecoveryReport as l, recoveryRepairRecordId as m, DurableAgentRuntime as n, DurableRuntimeConfig as o, recoveryRepairBatchId as p, DurableAgentRuntime_exports as r, RecoveryBlocked as s, ApprovalSuspensionError as t, RecoverySweepResult as u };
 
-//# sourceMappingURL=DurableAgentRuntime-B-9w7jDt.mjs.map
+//# sourceMappingURL=DurableAgentRuntime-BydyN_n-.mjs.map