kiokuko-dsh 0.2.39 → 0.2.41

package/dist/dsh/lisp/supervision.js

@@ -0,0 +1,89 @@
+import { mkdtemp, readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { CompiledLispCache } from './compiled-cache.js';
+import { LispError } from './contracts.js';
+import { prepareLayout } from './sandbox.js';
+import { LispWorker } from './worker.js';
+/** One host owns admission, startup and confirmed release for every Lisp child.
+ * The operation journals remain in LispManager; this supervisor never replays work. */
+export class LispSupervisor {
+    config;
+    dataRoot;
+    library;
+    #children = new Map();
+    #restarts = new WeakMap();
+    #compiled;
+    constructor(config, dataRoot, library) {
+        this.config = config;
+        this.dataRoot = dataRoot;
+        this.library = library;
+        this.#compiled = new CompiledLispCache(join(dataRoot, 'compiled'), library, config);
+    }
+    async start(owner, assignment) {
+        assignment.assertCurrent();
+        // Reserve synchronously, before compilation or filesystem awaits. A broken
+        // child retains its slot until the OS confirms it and its jobs have stopped.
+        for (const [key, child] of this.#children)
+            if (child?.stopped)
+                this.#children.delete(key);
+        if (this.#children.has(owner))
+            throw new LispError('BUSY', 'この所有者の Lisp は起動中または実行中です。');
+        if (this.#children.size >= this.config.maxWorkers)
+            throw new LispError('WORKER_LIMIT', 'Lisp の起動枠はすべて使用中です。既存の worker と状態は保持します。');
+        this.#children.set(owner, undefined);
+        let worker;
+        try {
+            const compiled = await this.#compiled.ensure(assignment.signal, status => assignment.compilation?.(status));
+            assignment.assertCurrent();
+            const base = await mkdtemp(join(this.dataRoot, 'w-'));
+            const layout = await prepareLayout(base, this.library);
+            layout.compiled = compiled.path;
+            if (assignment.workspace)
+                layout.workspace = assignment.workspace;
+            layout.protected = true;
+            assignment.assertCurrent();
+            worker = new LispWorker(layout, { ...this.config, executionMode: assignment.executionMode }, assignment.hostCall, assignment.rpcAllowed, assignment.beforeJob, assignment.auditJob, error => { if (worker)
+                assignment.failed?.(worker, error); });
+            assignment.assigned(worker);
+            await worker.start();
+            this.#children.set(owner, worker);
+            assignment.assertCurrent();
+            const canary = join(base, 'host-canary');
+            await writeFile(canary, 'protected', { mode: 0o600 });
+            const path = JSON.stringify(canary);
+            const probe = await assignment.inspect(worker, `(let ((read-denied (handler-case (progn (with-open-file (s ${path}) (read-char s)) nil) (file-error () t))) (delete-denied (handler-case (progn (delete-file ${path}) nil) (file-error () t)))) (unless (and read-denied delete-denied) (error "ISOLATION_FAILED")) (kioku.files:write-text (merge-pathnames "probe" (kioku.files:scratch)) "ok") :protected)`);
+            if (!probe.ok || await readFile(canary, 'utf8') !== 'protected')
+                throw new LispError('ISOLATION_FAILED', 'OS によるファイル保護を確認できません。');
+            assignment.assertCurrent();
+            return worker;
+        }
+        catch (error) {
+            if (worker) {
+                // Keep the exact child even when startup or termination is unconfirmed.
+                this.#children.set(owner, worker);
+                await this.stop(worker);
+            }
+            else
+                this.#children.delete(owner);
+            throw error;
+        }
+    }
+    async stop(worker) {
+        if (!worker)
+            return;
+        await worker.stop();
+        for (const [owner, child] of this.#children)
+            if (child === worker)
+                this.#children.delete(owner);
+    }
+    /** Bound fault replacements, not ordinary idle/cold starts. No retry timer or queue. */
+    admitRestart(owner) {
+        const now = Date.now(), recent = (this.#restarts.get(owner) ?? []).filter(at => now - at < 60_000);
+        if (recent.length >= 2)
+            return false;
+        this.#restarts.set(owner, [...recent, now]);
+        return true;
+    }
+    assertCompilationStopped() { this.#compiled.assertStopped(); }
+}
+//# sourceMappingURL=supervision.js.map

package/dist/dsh/lisp/supervision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervision.js","sourceRoot":"","sources":["../../../src/dsh/lisp/supervision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,iBAAiB,EAA0B,MAAM,qBAAqB,CAAA;AAC/E,OAAO,EAAE,SAAS,EAA6C,MAAM,gBAAgB,CAAA;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAiBxC;uFACuF;AACvF,MAAM,OAAO,cAAc;IAIJ;IAAoC;IAA2B;IAH3E,SAAS,GAAG,IAAI,GAAG,EAAkC,CAAA;IACrD,SAAS,GAAG,IAAI,OAAO,EAAoB,CAAA;IAC3C,SAAS,CAAmB;IACrC,YAAqB,MAAyB,EAAW,QAAgB,EAAW,OAAe;QAA9E,WAAM,GAAN,MAAM,CAAmB;QAAW,aAAQ,GAAR,QAAQ,CAAQ;QAAW,YAAO,GAAP,OAAO,CAAQ;QACjG,IAAI,CAAC,SAAS,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IACrF,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,UAA4B;QACrD,UAAU,CAAC,aAAa,EAAE,CAAA;QAC1B,2EAA2E;QAC3E,6EAA6E;QAC7E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,KAAK,EAAE,OAAO;gBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACzF,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAA;QACvF,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU;YAC/C,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,0CAA0C,CAAC,CAAA;QACjF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QACpC,IAAI,MAA8B,CAAA;QAClC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;YAC3G,UAAU,CAAC,aAAa,EAAE,CAAA;YAC1B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAA;YACrD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;YACtD,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAA;YAC/B,IAAI,UAAU,CAAC,SAAS;gBAAE,MAAM,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;YACjE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAA;YACvB,UAAU,CAAC,aAAa,EAAE,CAAA;YAC1B,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,EACzF,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,EACrF,KAAK,CAAC,EAAE,GAAG,IAAI,MAAM;gBAAE,UAAU,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YAC9D,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAC3B,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;YACpB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YACjC,UAAU,CAAC,aAAa,EAAE,CAAA;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;YACxC,MAAM,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YACrD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YACnC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,8DAA8D,IAAI,8FAA8F,IAAI,2LAA2L,CAAC,CAAA;YAC/Y,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,WAAW;gBAC7D,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAA;YAClE,UAAU,CAAC,aAAa,EAAE,CAAA;YAC1B,OAAO,MAAM,CAAA;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,EAAE,CAAC;gBACX,wEAAwE;gBACxE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;gBACjC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACzB,CAAC;;gBAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACnC,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAA8B;QACvC,IAAI,CAAC,MAAM;YAAE,OAAM;QACnB,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QACnB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,KAAK,KAAK,MAAM;gBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACjG,CAAC;IAED,wFAAwF;IACxF,YAAY,CAAC,KAAa;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,CAAA;QAClG,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACpC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;QAC3C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,wBAAwB,KAAW,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAA,CAAC,CAAC;CACpE"}

package/dist/dsh/lisp/surface.d.ts

@@ -40,12 +40,12 @@ export declare const ToolInput: z.ZodObject<{
     leftRef: z.ZodOptional<z.ZodString>;
     rightRef: z.ZodOptional<z.ZodString>;
     target: z.ZodOptional<z.ZodEnum<{
-        build: "build";
         package: "package";
+        build: "build";
         lisp: "lisp";
         test: "test";
-        typecheck: "typecheck";
         vendor: "vendor";
+        typecheck: "typecheck";
     }>>;
     script: z.ZodOptional<z.ZodString>;
     timeoutMs: z.ZodOptional<z.ZodNumber>;

package/dist/dsh/lisp/surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../../../src/dsh/lisp/surface.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAA;AAI1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAE9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAM1D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,cAAc,IAAI,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAGtE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAmB1C,OAAO,EAAkE,KAAK,iBAAiB,EAAkB,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AA8DtJ,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAa8F,CAAA;AAEpH,uFAAuF;AACvF,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,YAAY,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE,eAAe,EAAE,kBAAkB,CAAC,EAAE,6BAA6B,GAAG,OAAO,CAAC;IAAE,IAAI,IAAI,IAAI,CAAC;IAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC,CAwpB/R;AAkBD,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAiCrD"}
+{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../../../src/dsh/lisp/surface.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAA;AAI1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAE9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAM1D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,cAAc,IAAI,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAGtE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAoB1C,OAAO,EAAkE,KAAK,iBAAiB,EAAkB,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AA8DtJ,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAa8F,CAAA;AAEpH,uFAAuF;AACvF,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,YAAY,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE,eAAe,EAAE,kBAAkB,CAAC,EAAE,6BAA6B,GAAG,OAAO,CAAC;IAAE,IAAI,IAAI,IAAI,CAAC;IAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC,CAuuB/R;AAkBD,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAiCrD"}

package/dist/dsh/lisp/surface.js

@@ -6,7 +6,7 @@ import { nativeStopReceipt } from './native-stop-receipt.js';
 import { canonicalContentHash } from '../../serialization/validate.js';
 import { isCodingWorkflowTool } from '../coding-workflow/host.js';
 import { AsyncLocalStorage } from 'node:async_hooks';
-import { rememberLispImplementation, isLispConversation, rootLispAdmission, withLispNativeCommand, isLispNativeCommand, isLispNativeCommandFence } from '../lisp-tool-identity.js';
+import { rememberLispImplementation, isLispConversation, rootLispAdmission, withRootLispAdmission, withLispNativeCommand, isLispNativeCommand, isLispNativeCommandFence } from '../lisp-tool-identity.js';
 import { assertProtocolRoute } from '../guardrail/service.js';
 import { isOwnedExecutionCall } from '../owned-execution.js';
 import { CodeIntelligenceAdapterV1 } from './code-intelligence.js';
@@ -34,6 +34,7 @@ import { mountLispHttp } from './http.js';
 import { createLispCiAdapter } from './ci.js';
 import { createLispPackageAdapter } from './packages.js';
 import { withTaskAuthority } from '../task-authority-context.js';
+import { isNativeSubagent } from '../native-subagent.js';
 import { TASK_AUTHORITY } from '../task-state.js';
 import { createLispMemoryVerification } from './memory-verification.js';
 import { isSavedLispResultRead } from '../memory-application.js';
@@ -117,10 +118,11 @@ export const ToolInput = z.object({ operationId: identifier.optional(), code: z.
 export async function mountLispSurface(ctx, runtime, config, skillPrompts, decisions, semanticCompaction) {
     const root = (ctx.root ?? ctx);
     const tools = root.get('tools', false);
+    const pluginTools = ctx.get('tools', false);
     const agents = root.get('agents', false);
     const sessions = root.get('sessions', false);
     const commands = ctx.get('commands', false);
-    if (!tools || !agents || !sessions || !commands)
+    if (!tools || !pluginTools || !agents || !sessions || !commands)
         fail('HOST_CAPABILITY_MISSING', 'Lisp には DSH のツール・セッション・コマンドサービスが必要です。');
     const dispatchHostTool = await createLispHostDispatch(ctx, tools);
     const questions = ctx.get('userQuestions', false);
@@ -377,6 +379,19 @@ export async function mountLispSurface(ctx, runtime, config, skillPrompts, decis
             && tools.get(active.name, active.agent)?.execute === active.pinned.execute && isOwnedExecutionCall(execution));
     };
     const disposers = [];
+    // Native children compose their preset, not the parent's agent-local tools.
+    // Publish restrictable descriptors before child creation. Only an admitted
+    // session's local implementations can execute; the persistent guard also
+    // rejects these unbound descriptors. Native allow/deny masks remain visible.
+    // Registrations belong to this activation, not the host root's lifetime.
+    // The independent host fence above still denies effects after plugin unload.
+    if (config.enabled)
+        for (const name of LISP_TOOLS)
+            disposers.push(pluginTools.register({
+                name, description: description(name), modelFacing: true, parameters: lispToolSchema(name),
+                output: { schema: {}, render: (_, result) => [{ type: 'text', text: renderResult(result) }] },
+                execute: async () => failure(new LispError('LISP_DISABLED', 'This session has no admitted Lisp worker.')),
+            }, { when: () => false }));
     if (semanticCompaction)
         for (const tool of ['lisp_eval', 'lisp_inspect'])
             disposers.push(semanticCompaction.registerProjector(tool, renderHistoryResult));
@@ -456,6 +471,9 @@ export async function mountLispSurface(ctx, runtime, config, skillPrompts, decis
             const local = [];
             agentDisposers.set(agent.id, local);
             const scopedTools = agent.ctx.get('tools');
+            // A child-local registration must not reintroduce capabilities hidden by
+            // its native inherited-tool filter. Metadata alone cannot widen its scope.
+            const inheritedLisp = isNativeSubagent(agent) ? new Set(tools.schemas(agent).map(tool => tool.name)) : undefined;
             // Current hosts own native/PTC selection for the Agent's lifetime. Preserve
             // that selection. Protected scopes retain their monotonic registry guards;
             // reserved PTC transport is denied before its program can execute.
@@ -501,6 +519,8 @@ export async function mountLispSurface(ctx, runtime, config, skillPrompts, decis
             // Lisp and owned/native tools coexist. A worker failure does not restrict
             // the inherited development surface.
             for (const name of LISP_TOOLS) {
+                if (inheritedLisp && !inheritedLisp.has(name))
+                    continue;
                 const definition = { name, get description() { return `${description(name)} Current Lisp approval mode: ${approvalPolicy.mode()} (profile).`; }, modelFacing: true,
                     parameters: lispToolSchema(name), output: { schema: {}, render: (_, result) => [{ type: 'text', text: renderResult(result) }] },
                     execute: async (args, execution) => {
@@ -628,7 +648,8 @@ export async function mountLispSurface(ctx, runtime, config, skillPrompts, decis
             registeredAgents.add(agent);
             const prompt = agent.ctx.get('systemPrompt', false);
             if (prompt) {
-                local.push(prompt.section({ name: 'kiokuko:lisp', order: -90000, text: guide }));
+                if (!policyPrompt)
+                    local.push(prompt.section({ name: 'kiokuko:lisp', order: -90000, text: guide }));
                 if (!policyPrompt)
                     local.push(prompt.section({ name: 'kiokuko:lisp-approval', order: -89999, text: approvalText }));
             }
@@ -774,6 +795,38 @@ export async function mountLispSurface(ctx, runtime, config, skillPrompts, decis
                 }), manualSelected: (agent) => manualMode(agent), manualOverride: (agent) => preparation.manualOverride(agent), selectTask: (input, choice, answerRef) => preparation.selectTask(input, choice, answerRef), prepareNative: (input) => preparation.prepare(input), choiceFor: (agent, task) => preparation.choiceFor(agent, task),
                 cancelled: (agent, task) => preparation.cancelled(agent, task),
                 answered: (agent, task, choice, answerRef) => preparation.answered(agent, task, choice, answerRef) }));
+        const workerRouter = (binding) => {
+            const parentId = binding.agent.session.header.parentSession, parent = parentId ? agents.get(parentId) : undefined;
+            return () => !!parent && agents.get(parent.id) === parent && sessions.get(parent.session.id) === parent.session
+                && agents.isOwnedBy?.(binding.agent.id, parent) === true && manager.enabled.get(parent.session.id) === binding.owner.root;
+        };
+        const admitWorker = async (candidate, signal) => {
+            const binding = owner(candidate);
+            if (!config.enabled || !isNativeSubagent(binding.agent))
+                return;
+            const liveParent = workerRouter(binding);
+            if (!liveParent() || !tools.schemas(binding.agent).some(tool => LISP_TOOLS.includes(tool.name)))
+                return;
+            // The router shares the execution preference, never its process,
+            // heap or task lease. Each work session owns a persistent runtime.
+            hostFence?.protect(binding.owner.sessionId);
+            try {
+                const status = await manager.enableSessionWorker(binding.owner, binding.agent.status === 'running', signal ? AbortSignal.any([binding.signal, signal]) : binding.signal);
+                owner(candidate);
+                if (!liveParent()) {
+                    await manager.disable(binding.owner);
+                    fail('SESSION_MISMATCH', 'Worker router ownership changed during startup.');
+                }
+                if (!['READY', 'EVALUATING'].includes(status.state))
+                    fail('RECOVERY_REQUIRED', 'The session Lisp worker must be recovered before continuing.');
+            }
+            finally {
+                if (!binding.signal.aborted && manager.enabled.has(binding.owner.sessionId))
+                    register(binding.agent);
+                else if (!manager.enabled.has(binding.owner.sessionId))
+                    hostFence?.release(binding.owner.sessionId);
+            }
+        };
         const requestSurface = {
             capabilities: LISP_TOOLS.map(name => ({ name, description: description(name) })),
             inventory: candidate => inventoryReaders.get(candidate.id)?.() ?? tools.schemas(candidate),
@@ -816,21 +869,25 @@ export async function mountLispSurface(ctx, runtime, config, skillPrompts, decis
             },
             async project(candidate, assembly) {
                 const binding = owner(candidate);
+                await admitWorker(candidate);
                 const workflow = await runtime.withDatabase(db => sessionCodingWorkflow(db, binding.owner.sessionId));
                 if (workflow && (!development || workflow.protocol || !isLispConversation(candidate)) && (workflow.choice.state !== 'yes' || ['preparing', 'awaiting_lisp_choice', 'cancelled', 'superseded', 'completed'].includes(workflow.state))) {
                     unregister(binding.agent);
                     const surface = assembly;
                     return { ...assembly, tools: surface.tools?.filter(tool => !LISP_TOOLS.includes(tool.name)) ?? [] };
                 }
-                if (!manager.enabled.has(binding.owner.sessionId))
-                    return { ...assembly, sections: [...assembly.sections, { name: 'kiokuko:lisp-coding-preparation', text: JSON.stringify(preparation.status(binding.agent)) }] };
+                if (!manager.enabled.has(binding.owner.sessionId)) {
+                    const surface = assembly;
+                    return { ...assembly, sections: [...assembly.sections, { name: 'kiokuko:lisp-coding-preparation', text: JSON.stringify(preparation.status(binding.agent)) }],
+                        ...(surface.tools ? { tools: surface.tools.filter(tool => !LISP_TOOLS.includes(tool.name)) } : {}) };
+                }
                 register(binding.agent);
                 // Native DSH snapshots providers before its assembly waterfall. Admission
                 // can activate Lisp inside that waterfall: refresh this request, not only
                 // the next one. Use native visibility plus the exact guarded definitions.
                 const schemas = tools.schemas(binding.agent).filter(schema => development || fence.definitions.get(`${candidate.id}:${schema.name}`) === tools.get(schema.name, binding.agent));
-                if (!LISP_TOOLS.every(name => schemas.some(schema => schema.name === name)))
-                    fail('HOST_CAPABILITY_MISSING', 'Lisp のツール定義を要求へ反映できません。');
+                // Native scopes may intentionally expose only a subset. Preserve their
+                // exact schemas instead of turning one denied capability into a turn gate.
                 const sections = assembly.sections.filter(section => section.name !== 'kiokuko:lisp');
                 sections.splice(Math.max(0, sections.findIndex(section => section.name === 'kiokuko:soul') + 1), 0, { name: 'kiokuko:lisp', text: '{{kiokuko_lisp}}' });
                 sections.push({ name: 'kiokuko:lisp-coding-preparation', text: JSON.stringify(preparation.status(binding.agent)) });
@@ -842,6 +899,43 @@ export async function mountLispSurface(ctx, runtime, config, skillPrompts, decis
             },
         };
         disposers.push(ctx.provide(LISP_ASSEMBLY_SERVICE, requestSurface));
+        // Bind before DSH captures the first step's executable tool set. Prompt-only
+        // registration is too late: the model can see tools that cannot dispatch.
+        disposers.push(ctx.on('agent/created', async (event) => {
+            if (isNativeSubagent(event.agent))
+                await admitWorker(event.agent, event.signal);
+        }, { global: true }));
+        // Native children deliberately bypass parent intake. Give their exact root
+        // Lisp dispatch its own command capability after native guards/approvals;
+        // never lend the router's task lease or admit arbitrary nested tool calls.
+        disposers.push(ctx.on('tools/execute', async (execution, next) => {
+            if (!development || execution.parent !== undefined || !execution.agent || !isNativeSubagent(execution.agent)
+                || !LISP_TOOLS.includes(execution.name))
+                return next();
+            const binding = owner(execution.agent), liveParent = workerRouter(binding);
+            const definition = fence.definitions.get(`${binding.agent.id}:${execution.name}`);
+            if (!definition || tools.get(execution.name, binding.agent) !== definition || !await manager.isSessionWorker(binding.owner))
+                return next();
+            const execute = definition.execute, argumentsDigest = canonicalContentHash(execution.arguments);
+            const name = execution.name, callId = execution.callId, rootCallId = execution.rootCallId;
+            const current = () => {
+                try {
+                    const now = owner(execution.agent);
+                    return execution.agent === binding.agent && execution.name === name && execution.callId === callId && execution.rootCallId === rootCallId
+                        && !execution.signal?.aborted && !binding.signal.aborted && now.signal === binding.signal
+                        && now.owner.root === binding.owner.root && liveParent() && execution.parent === undefined
+                        && manager.enabled.get(binding.owner.sessionId) === binding.owner.root
+                        && tools.get(execution.name, binding.agent) === definition && definition.execute === execute
+                        && canonicalContentHash(execution.arguments) === argumentsDigest;
+                }
+                catch {
+                    return false;
+                }
+            };
+            if (!current())
+                fail('SESSION_MISMATCH', 'The worker Lisp dispatch is no longer current.');
+            return withRootLispAdmission(execution, current, next);
+        }, { global: true }));
         disposers.push(mountLispHttp(ctx, manager, (sessionId, recover) => {
             const agent = agents.get(sessionId);
             const binding = owner(agent);
@@ -951,13 +1045,13 @@ export async function mountLispSurface(ctx, runtime, config, skillPrompts, decis
 }
 function description(name) {
     return ({ lisp_eval: 'Evaluate Common Lisp, the selected route for computation and command orchestration while Lisp is ON. Use kioku.process:run / start-job for external programs including git, gh, builds and tests; direct native shell calls are rejected. Ordinary development does not require a preliminary prototype. Explicitly protected coding workflows require prototype:true and saved-result inspection before implementation. In persistent mode, define and reuse cohesive functions in one worker generation; proposals use the current host approval policy. In enable-task mode, each evaluation is a disposable scratch experiment without workspace inputs or proposals. Exact operationId replay never re-evaluates.',
-        lisp_hot_contract: 'Authorize immutable schemas through the current host approval policy and finite input/expected cases for a project-shared function. Profile auto-approval or explicit human consent grants approval; model declarations do not. Requires enable-task.',
-        lisp_hot_install: 'Validate a candidate against the current approved contract in workers using the selected execution mode, then atomically select it at expectedRevision. Dependency code is snapshotted. Failed checks preserve the active version.',
+        lisp_hot_contract: 'Authorize immutable schemas through the current host approval policy and finite input/expected cases for a project-shared function. Profile auto-approval or explicit human consent grants approval; model declarations do not. No task-mode switch is needed; publishing still requires current task authority.',
+        lisp_hot_install: 'Validate a candidate against the current approved contract in protected scratch, then atomically select it at expectedRevision. Dependency code is snapshotted. Failed checks preserve the active version.',
         lisp_hot_call: 'Call a project-shared function by name, pinning its active immutable version. Input/result refs remain private to this session and agent. Exact operationId replay never executes again.',
         lisp_hot_status: 'Read project-shared function names, revisions and contract refs; paginate with offset. Supply name to inspect approved checks; contractOffset pages their JSON in 2000 Unicode characters. No worker execution.',
         lisp_hot_deactivate: 'Use the current host approval policy to deactivate a project-shared function at expectedRevision. Existing calls and results remain available; new calls stop.',
-        lisp_define: 'Save a generated Lisp lambda and exact dependency refs as a reusable task tool. Requires /kioku-lisp enable-task. Compiles in an isolated worker and checks declared examples.',
-        lisp_call: 'Run a saved task tool with JSON input or a saved resultRef. Exact retries return the journal result; new calls use isolated workers.',
+        lisp_define: 'Save a generated Lisp lambda and exact dependency refs as a reusable task tool. No enable-task switch or Working task is needed. Compile and check examples in protected scratch; schemas do not grant host effects.',
+        lisp_call: 'Run a saved task tool with JSON input or a saved resultRef. Reuse only your own protected worker; otherwise use private protected scratch with no repository mount or host RPC. Exact retries return the journal result.',
         lisp_observe: 'Capture explicitly named workspace files as immutable task input, returning a resultRef without sending contents to the model.',
         lisp_stage: 'Turn a generated result into a guarded, immutable workspace change candidate bound to an observed baseRef. No workspace write.',
         lisp_verify: 'Materialize one candidate from frozen observed bytes in private scratch, then run an approved host verifier. The receipt remains bound to that candidate; unknown test reporting is not a pass.',