maka-agent 0.2.0-dev.76.20261009 → 0.2.0-dev.78.20261010

package/node_modules/@maka/runtime/dist/runtime-kernel.js

@@ -21,6 +21,7 @@ import { randomUUID } from 'node:crypto';
 import { decodeRuntimeBoundaryCursor, } from '@maka/core/runtime-boundary';
 import { isTerminalRuntimeEvent, } from '@maka/core/runtime-event';
 import { isDeepStrictEqual } from 'node:util';
+import { createGenesisExecutionBoundary } from '@maka/core/sandbox-boundary';
 import { resolveEffectiveOrchestration, } from '@maka/core/orchestration';
 import { AgentRun, ContinuationStartCommitError, } from './agent-run.js';
 import { createSessionEventMapMemory, isLiveBackendSessionEvent, mapSessionEventToRuntimeEvent, } from './session-event-runtime-mapper.js';
@@ -320,7 +321,17 @@ export class RuntimeKernel {
         const execution = this.takeExecutionClaim(sessionId, options.execution);
         try {
             await this.enterExecutionClaim(execution);
-            const header = await this.readBackendHeader(execution);
+            execution.executionPolicy = options.executionPolicy;
+            const existing = this.active.get(sessionId);
+            if (existing && !isDeepStrictEqual(existing.executionPolicy, options.executionPolicy)) {
+                if (existing.activeRuns.size > 0)
+                    throw new Error('Cannot change execution policy while a Turn is running');
+                await this.disposeBackend(sessionId);
+            }
+            const storedHeader = await this.readBackendHeader(execution);
+            const header = options.executionPolicy
+                ? { ...storedHeader, permissionMode: options.executionPolicy.permissionMode }
+                : storedHeader;
             let workspaceIdentity;
             if (this.deps.inspectContinuationSafety) {
                 try {
@@ -355,7 +366,12 @@ export class RuntimeKernel {
                         return active;
                     },
                     unregisterRun: (active, activeRun) => this.unregisterParentRun(active, activeRun),
-                    updateHeader: (targetSessionId, patch) => this.updateHeader(targetSessionId, patch),
+                    updateHeader: async (targetSessionId, patch) => {
+                        const updated = await this.updateHeader(targetSessionId, patch);
+                        return options.executionPolicy
+                            ? { ...updated, permissionMode: options.executionPolicy.permissionMode }
+                            : updated;
+                    },
                     updateStatus: (targetSessionId, status, blockedReason, ts) => this.updateStatus(targetSessionId, status, blockedReason, ts),
                     ...this.messageProjectionHook(),
                 },
@@ -410,7 +426,14 @@ export class RuntimeKernel {
             (this.executionClaims.get(continuation.sessionId)?.size ?? 0) > 1) {
             throw new Error('Cannot continue while another run is active');
         }
-        const header = await this.readBackendHeader(execution);
+        execution.executionPolicy = options.executionPolicy;
+        const existing = this.active.get(continuation.sessionId);
+        if (existing && !isDeepStrictEqual(existing.executionPolicy, options.executionPolicy))
+            await this.disposeBackend(continuation.sessionId);
+        const storedHeader = await this.readBackendHeader(execution);
+        const header = options.executionPolicy
+            ? { ...storedHeader, permissionMode: options.executionPolicy.permissionMode }
+            : storedHeader;
         const sessionRuns = await this.deps.runtimeEventStore.listSessionInvocations(continuation.sessionId);
         const sourceRun = sessionRuns.find((run) => run.runId === continuation.sourceRunId);
         if (!sourceRun) {
@@ -564,7 +587,12 @@ export class RuntimeKernel {
                     return active;
                 },
                 unregisterRun: (active, activeRun) => this.unregisterParentRun(active, activeRun),
-                updateHeader: (targetSessionId, patch) => this.updateHeader(targetSessionId, patch),
+                updateHeader: async (targetSessionId, patch) => {
+                    const updated = await this.updateHeader(targetSessionId, patch);
+                    return options.executionPolicy
+                        ? { ...updated, permissionMode: options.executionPolicy.permissionMode }
+                        : updated;
+                },
                 updateStatus: (targetSessionId, status, blockedReason, ts) => this.updateStatus(targetSessionId, status, blockedReason, ts),
                 ...this.messageProjectionHook(),
             },
@@ -1308,6 +1336,106 @@ export class RuntimeKernel {
             },
         ];
     }
+    /** Stop one captured owner without cancelling other queued executions in its Session. */
+    stopExecution(claim, input = {}) {
+        normalizeStopSessionSource(input.source, input.workHubActionId);
+        const execution = this.executionClaimStates.get(claim);
+        if (!execution)
+            throw new Error('Runtime execution claim belongs to another owner');
+        if (execution.scopedStopAttempt)
+            return execution.scopedStopAttempt;
+        const run = execution.run;
+        const active = run &&
+            this.backendGenerationsFor(execution.sessionId).find((candidate) => candidate.activeRuns.get(run.runId) === run);
+        if (!active && (execution.phase === 'released' || execution.phase === 'failed')) {
+            return run
+                ? this.retryStoppedRun({
+                    sessionId: execution.sessionId,
+                    runId: run.runId,
+                    turnId: run.turnId,
+                }, input)
+                : Promise.resolve();
+        }
+        if (active && run)
+            this.assertScopedStopGeneration(active, run);
+        // Validate first, then capture the capability synchronously. A pending
+        // owner carries the stop through attach/reserve without a Session fence.
+        execution.stopIntent ??= { input, claims: new Set([execution]) };
+        if (active && run)
+            this.captureScopedRunStop(active, run, input);
+        else
+            run?.stop(input.source, input.workHubActionId);
+        execution.abortController.abort(execution.cancellation);
+        const attempt = this.stopCapturedExecution(execution, input).finally(() => {
+            if (execution.scopedStopAttempt === attempt)
+                execution.scopedStopAttempt = undefined;
+        });
+        execution.scopedStopAttempt = attempt;
+        return attempt;
+    }
+    /** A failed cleanup attempt keeps its captured owner parked until a successful retry. */
+    waitForExecutionStop(claim) {
+        const run = this.executionClaimStates.get(claim)?.run;
+        const operation = run &&
+            this.retainedRunStopOperation({
+                sessionId: claim.sessionId,
+                runId: run.runId,
+                turnId: run.turnId,
+            });
+        return operation ? operation.completion : Promise.resolve();
+    }
+    /** Whether a retained stop operation still owns cleanup for this exact Run. */
+    hasPendingRunStop(identity) {
+        return this.retainedRunStopOperation(identity) !== undefined;
+    }
+    retainedRunStopOperation(identity) {
+        const operation = this.stopOperations.get(identity.sessionId);
+        return operation &&
+            [...operation.targets.values()].some((target) => target.runs.get(identity.runId)?.turnId === identity.turnId)
+            ? operation
+            : undefined;
+    }
+    /** Exact identity lookup never redirects a completed Run's stop to its successor. */
+    stopRun(identity, input = {}) {
+        normalizeStopSessionSource(input.source, input.workHubActionId);
+        const execution = [...(this.executionClaims.get(identity.sessionId) ?? [])].find((candidate) => candidate.run?.runId === identity.runId && candidate.run.turnId === identity.turnId);
+        if (execution)
+            return this.stopExecution(execution.handle, input);
+        for (const active of this.backendGenerationsFor(identity.sessionId)) {
+            const run = active.activeRuns.get(identity.runId);
+            if (!run || run.turnId !== identity.turnId)
+                continue;
+            this.assertScopedStopGeneration(active, run);
+            this.captureScopedRunStop(active, run, input);
+            return this.retryStoppedRun(identity, input);
+        }
+        return this.retryStoppedRun(identity, input);
+    }
+    assertScopedStopGeneration(active, run) {
+        if ([...active.activeRuns.values()].some((other) => other !== run && !other.isStopped())) {
+            throw new Error('Cannot stop one Run while its backend generation owns another active Run');
+        }
+    }
+    captureScopedRunStop(active, run, input) {
+        const operation = this.claimRunForStop(active.sessionId, input, active, run);
+        if (operation && active.phase === 'active')
+            active.phase = 'stopping';
+    }
+    async stopCapturedExecution(execution, input) {
+        await execution.settled;
+        if (execution.run) {
+            await this.retryStoppedRun({
+                sessionId: execution.sessionId,
+                runId: execution.run.runId,
+                turnId: execution.run.turnId,
+            }, input);
+        }
+    }
+    async retryStoppedRun(identity, input) {
+        const operation = this.retainedRunStopOperation(identity);
+        if (operation)
+            await this.enqueueStopOperation(identity.sessionId, operation, input, true);
+    }
     stopSession(sessionId, input = {}) {
         normalizeStopSessionSource(input.source, input.workHubActionId);
         const existing = this.stopAttempts.get(sessionId);
@@ -1403,12 +1531,22 @@ export class RuntimeKernel {
     buildStopOperation(input) {
         const abortSource = normalizeStopSessionSource(input.source, input.workHubActionId);
         const ts = this.deps.now();
+        let resolveCompletion;
+        let rejectCompletion;
+        const completion = new Promise((resolve, reject) => {
+            resolveCompletion = resolve;
+            rejectCompletion = reject;
+        });
+        void completion.catch(() => undefined);
         return {
             abortSource,
             ts,
             statusProjected: false,
             targets: new Map(),
             queue: Promise.resolve(),
+            completion,
+            resolveCompletion,
+            rejectCompletion,
         };
     }
     enqueueStopOperation(sessionId, operation, input, deliverPending) {
@@ -1507,7 +1645,16 @@ export class RuntimeKernel {
             if (target.delivery.kind === 'failed')
                 failures.add(target.delivery.error);
         }
-        failures.throwIfAny(`Stop cleanup failed for session ${sessionId}`);
+        try {
+            failures.throwIfAny(`Stop cleanup failed for session ${sessionId}`);
+            if (completed)
+                operation.resolveCompletion();
+        }
+        catch (error) {
+            if (completed)
+                operation.rejectCompletion(error);
+            throw error;
+        }
     }
     async respondToSandboxBoundary(sessionId, response) {
         const key = interactionOwnerKey(sessionId, response.requestId);
@@ -1570,6 +1717,32 @@ export class RuntimeKernel {
     hasActiveRun(sessionId, runId, turnId) {
         return this.activeRunsFor(sessionId).some((run) => run.runId === runId && (turnId === undefined || run.turnId === turnId));
     }
+    readExecutionPolicy(sessionId, runId) {
+        for (const generation of this.backendGenerationsFor(sessionId)) {
+            if (generation.activeRuns.has(runId))
+                return generation.executionPolicy;
+        }
+        return [...(this.executionClaims.get(sessionId) ?? [])].find((execution) => execution.run?.runId === runId)?.executionPolicy;
+    }
+    returnExecutionQuestions(sessionId, runId) {
+        for (const generation of this.backendGenerationsFor(sessionId)) {
+            const run = generation.activeRuns.get(runId);
+            if (!run)
+                continue;
+            const policy = {
+                permissionMode: run.headerSnapshot().permissionMode,
+                questions: 'return',
+            };
+            generation.executionPolicy = policy;
+            for (const execution of this.executionClaims.get(sessionId) ?? []) {
+                if (execution.run?.runId === runId)
+                    execution.executionPolicy = policy;
+            }
+            return;
+        }
+        // A terminal backend can precede the Host's terminal admission. Its queued
+        // steering is recovered into a successor with the durable delegated policy.
+    }
     requestRunHandoff(sessionId, runId, pause, signal) {
         if (!this.deps.inspectContinuationSafety)
             return undefined;
@@ -1868,11 +2041,17 @@ export class RuntimeKernel {
                 }));
             execution.run?.bindProviderStateIdentity(prepared.providerStateIdentity);
             const subagent = await this.resolveSubagentActivation(header);
+            const kernel = this;
             const backend = await prepared.build({
                 sessionId,
                 workspaceRoot: header.workspaceRoot,
                 header,
-                store: this.deps.store,
+                store: execution.executionPolicy
+                    ? this.executionPolicyStore(sessionId, execution.executionPolicy)
+                    : this.deps.store,
+                get executionPolicy() {
+                    return kernel.active.get(sessionId)?.executionPolicy ?? execution.executionPolicy;
+                },
                 abortSignal: execution.abortController.signal,
                 ...(subagent
                     ? {
@@ -1888,12 +2067,39 @@ export class RuntimeKernel {
             });
             await this.rejectCancelledBackendActivation(backend, header, execution);
             const generation = this.createBackendGeneration(sessionId, backend, header, prepared.providerStateIdentity);
+            generation.executionPolicy = execution.executionPolicy;
             this.active.set(sessionId, generation);
             return generation;
         });
         entry.cachedHeader = header;
         return entry;
     }
+    executionPolicyStore(targetSessionId, policy) {
+        const store = this.deps.store;
+        // Host stores are frozen. Proxy invariants forbid replacing their own
+        // non-configurable methods, so intercept on an independent facade instead.
+        return new Proxy(Object.create(store), {
+            get(_facade, property) {
+                if (property === 'readHeader')
+                    return async (sessionId) => {
+                        const header = await store.readHeader(sessionId);
+                        return sessionId === targetSessionId
+                            ? { ...header, permissionMode: policy.permissionMode }
+                            : header;
+                    };
+                if (property === 'readExecutionBoundary')
+                    return async (sessionId) => {
+                        const boundary = await store.readExecutionBoundary(sessionId);
+                        if (sessionId === targetSessionId &&
+                            (policy.permissionMode === 'bypass' || boundary.kind === 'bypass'))
+                            return createGenesisExecutionBoundary(policy.permissionMode);
+                        return boundary;
+                    };
+                const value = Reflect.get(store, property);
+                return typeof value === 'function' ? value.bind(store) : value;
+            },
+        });
+    }
     async shareBackendActivation(activationKey, activate) {
         let activation = this.backendActivationBuilds.get(activationKey);
         if (!activation) {
@@ -2038,7 +2244,9 @@ export class RuntimeKernel {
     releaseStoppedRunReferences(operation, run) {
         for (const target of operation.targets.values()) {
             const stoppedRun = target.runs.get(run.runId);
-            if (stoppedRun?.run === run)
+            // A failed terminal append still needs this captured Run on retry, even
+            // after its stream exits. Drop it only once stop settlement succeeded.
+            if (stoppedRun?.run === run && stoppedRun.stopCompleted)
                 stoppedRun.run = undefined;
             if (target.active &&
                 target.delivery.kind !== 'pending' &&
@@ -2077,7 +2285,7 @@ export class RuntimeKernel {
     async clearBackendQuarantineForActivation(sessionId, execution) {
         const ownsCurrentStop = execution.phase === 'attached' &&
             execution.stopIntent !== undefined &&
-            this.stopIntents.get(sessionId) === execution.stopIntent;
+            execution.stopIntent.claims.has(execution);
         if (this.stopOperations.has(sessionId) && !ownsCurrentStop) {
             throw new Error(`Session ${sessionId} is quarantined by a retained stop operation`);
         }

package/node_modules/@maka/runtime/dist/sandbox-boundary-tool.js

@@ -31,6 +31,18 @@ export const SANDBOX_BOUNDARY_UNAVAILABLE = 'request_sandbox_boundary is not ava
     'Retrying will fail the same way — redo the work inside the paths already allowed, or tell the ' +
     'user which path needs access.';
 export const REQUEST_SANDBOX_BOUNDARY_TOOL_NAME = 'request_sandbox_boundary';
+/**
+ * Session-stable required names for the widening tool. Host only binds it when
+ * the Session is not Full access. Passing the name through `requiredToolNames`
+ * keeps the schema visible without a `tool_search` hop, and without depending
+ * on a live boundary prompt that would change the provider prefix per Turn
+ * (#5879). Returns empty when the tool is not bound.
+ */
+export function requiredSandboxBoundaryToolNames(hostTools) {
+    return hostTools.some((tool) => tool.name === REQUEST_SANDBOX_BOUNDARY_TOOL_NAME)
+        ? new Set([REQUEST_SANDBOX_BOUNDARY_TOOL_NAME])
+        : new Set();
+}
 export const SANDBOX_BOUNDARY_DENIED_FOR_TURN = 'The user denied a sandbox boundary expansion for this Turn. Do not request another expansion. ' +
     'Continue only with the authority already available, or explain the remaining blocker.';
 export const SANDBOX_BOUNDARY_FINALIZATION_PROMPT = [

package/node_modules/@maka/runtime/dist/session-manager.js

@@ -27,7 +27,7 @@ import { PLAN_USER_ABANDON_REASON, PLAN_USER_CANCEL_REASON, PlanConflictError, a
 import { DEFAULT_SESSION_NAME } from '@maka/core/session-name';
 import { SUBAGENT_SESSION_RUNTIME_SCHEMA_VERSION, SUBAGENT_SESSION_SPAWN_SCHEMA_VERSION, childSessionsForParent, subagentSessionRuntimeSummary, } from '@maka/core/session';
 import { decodeAgentGraphIntentClaim } from '@maka/core/agent-graph-control';
-import { executionBoundaryContains } from '@maka/core/sandbox-boundary';
+import { createGenesisExecutionBoundary, executionBoundaryContains, } from '@maka/core/sandbox-boundary';
 import { failureClassFromCompleteStopReason } from '@maka/core/events';
 import { isActiveShellRunStatus } from '@maka/core/shell-run';
 import { isTerminalRuntimeEvent } from '@maka/core/runtime-event';
@@ -1436,6 +1436,22 @@ export class SessionManager {
     async preflightContextCompaction(sessionId) {
         await this.runtimeKernel.preflightContextCompaction(sessionId);
     }
+    returnExecutionQuestions(sessionId, runId) {
+        if (!this.runtimeKernel.returnExecutionQuestions)
+            throw new Error('Runtime does not support execution question policy');
+        this.runtimeKernel.returnExecutionQuestions(sessionId, runId);
+    }
+    async readExecutionPolicy(sessionId, runId) {
+        return (this.runtimeKernel.readExecutionPolicy?.(sessionId, runId) ??
+            (await this.deps.resolveExecutionPolicy?.(sessionId, runId)));
+    }
+    async readExecutionBoundaryForRun(sessionId, runId) {
+        const policy = await this.readExecutionPolicy(sessionId, runId);
+        const boundary = await this.deps.store.readExecutionBoundary(sessionId);
+        return policy && (policy.permissionMode === 'bypass' || boundary.kind === 'bypass')
+            ? createGenesisExecutionBoundary(policy.permissionMode)
+            : boundary;
+    }
     /**
      * Create and run a durable linked child Session.
      *
@@ -1504,7 +1520,7 @@ export class SessionManager {
         const [parentHeader, sourceRun, parentBoundary] = await Promise.all([
             this.deps.store.readHeader(input.source.sessionId),
             this.readInvocation(input.source.sessionId, input.source.runId),
-            this.deps.store.readExecutionBoundary(input.source.sessionId),
+            this.readExecutionBoundaryForRun(input.source.sessionId, input.source.runId),
         ]);
         if (sourceRun.sessionId !== input.source.sessionId ||
             sourceRun.runId !== input.source.runId ||
@@ -1530,7 +1546,10 @@ export class SessionManager {
         const resolvedToolNames = executorId
             ? []
             : await this.resolveChildToolNames(input.source.sessionId, parentHeader, definition);
-        const childPermissionMode = parentHeader.permissionMode === 'bypass' ? 'bypass' : definition.permissionMode;
+        const childPermissionMode = ((await this.readExecutionPolicy(input.source.sessionId, input.source.runId))
+            ?.permissionMode ?? parentHeader.permissionMode) === 'bypass'
+            ? 'bypass'
+            : definition.permissionMode;
         const initialTurnId = this.deps.newId();
         const initialRunId = this.deps.newId();
         const identityHash = stableHash({
@@ -1698,9 +1717,28 @@ export class SessionManager {
             return await inFlight.promise;
         }
         const runtimeExecution = this.runtimeKernel.claimExecution(claim.targetSessionId);
-        const promise = this.enqueueClaimedAgentGraphIntent(resolved, runtimeExecution).finally(() => runtimeExecution.release());
+        const owner = {
+            identity: {
+                sessionId: claim.targetSessionId,
+                runId: claim.targetRunId,
+                turnId: claim.targetTurnId,
+            },
+            execution: runtimeExecution,
+            hostAdmitted: false,
+        };
+        resolved.onHostAdmission = () => {
+            owner.hostAdmitted = true;
+        };
+        const promise = this.enqueueClaimedAgentGraphIntent(resolved, runtimeExecution, async () => {
+            runtimeExecution.release();
+            // Keep the existing Session slot until scoped backend cleanup completes.
+            // Other queued claims retain their own uncancelled runtime capabilities.
+            await owner.stopTask?.catch(() => undefined);
+            await this.runtimeKernel.waitForExecutionStop?.(runtimeExecution);
+        });
         this.claimedAgentGraphIntentRuns.set(claim.claimId, {
             requestFingerprint,
+            owner,
             promise,
         });
         try {
@@ -1712,7 +1750,7 @@ export class SessionManager {
             }
         }
     }
-    enqueueClaimedAgentGraphIntent(input, runtimeExecution) {
+    enqueueClaimedAgentGraphIntent(input, runtimeExecution, release) {
         const sessionId = input.claim.targetSessionId;
         const previous = this.claimedAgentGraphSessionTails.get(sessionId) ?? Promise.resolve();
         let enteredQueue = false;
@@ -1729,7 +1767,8 @@ export class SessionManager {
             }
             enteredQueue = true;
             return this.runClaimedAgentGraphIntentOnce(input, runtimeExecution);
-        });
+        })
+            .finally(release);
         const tail = queuedExecution.then(() => { }, () => { });
         this.claimedAgentGraphSessionTails.set(sessionId, tail);
         void tail.then(() => {
@@ -1742,8 +1781,10 @@ export class SessionManager {
             rejectStopped = reject;
         });
         const onRuntimeStop = () => {
-            if (!enteredQueue)
+            if (!enteredQueue) {
+                runtimeExecution.release();
                 rejectStopped(runtimeExecution.stopSignal.reason);
+            }
         };
         runtimeExecution.stopSignal.addEventListener('abort', onRuntimeStop, { once: true });
         if (runtimeExecution.stopSignal.aborted)
@@ -1769,6 +1810,7 @@ export class SessionManager {
             throw new Error('Claimed graph execution target must be a linked child session');
         }
         await this.assertLinkedChildBoundaryMatchesParent(child.subagentParent.parentSessionId, child.id);
+        const executionPolicy = await this.readExecutionPolicy(child.subagentParent.parentSessionId, child.subagentParent.spawnedBy.parentRunId);
         const rootExecution = {
             kind: 'claimed_agent_graph_intent',
             claim,
@@ -1804,6 +1846,9 @@ export class SessionManager {
             this.assertClaimedAgentGraphRun(child, snapshot, claim, run);
             if (input.hostedGraphExecution) {
                 const admission = await this.requireClaimedGraphAdmissionIdentity(claim, input.hostedGraphExecution);
+                if (input.hostedGraphExecution && runtimeExecution.stopSignal.aborted)
+                    throw runtimeExecution.stopSignal.reason;
+                input.onHostAdmission?.();
                 await this.consumeLinkedRootExecution({
                     sessionId: child.id,
                     turnId: claim.targetTurnId,
@@ -1839,13 +1884,22 @@ export class SessionManager {
         await this.finalizeChildWorkspacePatches(child.id);
         // An invocation is what makes a Turn exist on the ledger, so the run listing
         // is the whole occupancy check: a Turn with durable content has one.
-        const turnOwner = (await this.listInvocations(child.id)).find((candidate) => candidate.turnId === claim.targetTurnId);
+        const invocations = await this.listInvocations(child.id);
+        const turnOwner = invocations.find((candidate) => candidate.turnId === claim.targetTurnId);
         if (turnOwner) {
             throw new Error(`Claimed graph turn ${claim.targetTurnId} is already owned by run ${turnOwner.runId}`);
         }
-        if (child.isArchived || child.status === 'aborted') {
+        if (child.isArchived) {
             throw new Error('Claimed graph execution target child session is terminated');
         }
+        if (child.status === 'aborted') {
+            const latest = [...invocations].sort((left, right) => right.openedAt - left.openedAt)[0];
+            // A graph stop ends one activation, not the reusable operator. Only a
+            // durable graph-supervisor stop permits a new claim on an aborted child.
+            if (latest?.terminalEvent?.actions?.stateDelta?.abortSource !== 'graph.supervisor') {
+                throw new Error('Claimed graph execution target child session is terminated');
+            }
+        }
         if (input.abortSignal?.aborted) {
             throw new Error('Claimed graph execution was cancelled before runtime admission');
         }
@@ -1860,11 +1914,28 @@ export class SessionManager {
         let aborted = false;
         let stopPromise;
         const userMessageId = await this.claimedGraphUserMessageId(claim, input.hostedGraphExecution);
+        if (input.hostedGraphExecution && runtimeExecution.stopSignal.aborted)
+            throw runtimeExecution.stopSignal.reason;
+        // Host runs this gate in its Session admission lease immediately before
+        // the durable admission. Until it passes, a graph stop only cancels the
+        // local capability and the gate refuses the Turn; after it passes, the
+        // stop must go through the Host fence.
+        const hostedAdmitExecution = input.hostedGraphExecution
+            ? async () => {
+                if (runtimeExecution.stopSignal.aborted)
+                    return 'cancelled';
+                const admission = admitExecution ? await admitExecution() : 'executing';
+                if (admission === 'cancelled' || runtimeExecution.stopSignal.aborted)
+                    return 'cancelled';
+                input.onHostAdmission?.();
+                return 'executing';
+            }
+            : admitExecution;
         const execution = this.consumeLinkedRootExecution({
             ...identity,
             userMessageId,
             execution: rootExecution,
-            ...(admitExecution ? { admitExecution } : {}),
+            ...(hostedAdmitExecution ? { admitExecution: hostedAdmitExecution } : {}),
             content: { text: input.prompt },
             start: ({ runId, userMessageId, onRunStarted }) => this.sendMessage(child.id, {
                 turnId: claim.targetTurnId,
@@ -1882,6 +1953,7 @@ export class SessionManager {
                     : {}),
                 onRunStarted,
                 execution: runtimeExecution,
+                ...(executionPolicy ? { executionPolicy } : {}),
             }),
             onReady: notifyReady,
             onEvent: (event) => {
@@ -2002,8 +2074,9 @@ export class SessionManager {
         const [parentHeader, parentRun, parentBoundary] = await Promise.all([
             this.deps.store.readHeader(parentSessionId),
             this.readInvocation(parentSessionId, input.spawnedBy.parentRunId),
-            this.deps.store.readExecutionBoundary(parentSessionId),
+            this.readExecutionBoundaryForRun(parentSessionId, input.spawnedBy.parentRunId),
         ]);
+        const executionPolicy = await this.readExecutionPolicy(parentSessionId, input.spawnedBy.parentRunId);
         this.assertActiveParentRun(parentSessionId, parentRun, input.spawnedBy.parentTurnId);
         const definition = requireBuiltinAgentDefinitionByProfile(input.agentProfile);
         const executorId = input.executorId ?? (input.resolvedPreset ? undefined : parentHeader.executorId);
@@ -2163,6 +2236,7 @@ export class SessionManager {
                     durability: 'required',
                     onRunStarted,
                     execution: runtimeOwner.execution,
+                    ...(executionPolicy ? { executionPolicy } : {}),
                 }),
                 onReady: notifyReady,
                 onEvent: (event) => {
@@ -2312,8 +2386,11 @@ export class SessionManager {
         return target;
     }
     async assertLinkedChildBoundaryMatchesParent(parentSessionId, childSessionId) {
+        const child = await this.deps.store.readHeader(childSessionId);
+        if (!child.subagentParent)
+            throw new Error('Linked child is missing parent provenance');
         const [parentBoundary, childBoundary] = await Promise.all([
-            this.deps.store.readExecutionBoundary(parentSessionId),
+            this.readExecutionBoundaryForRun(parentSessionId, child.subagentParent.spawnedBy.parentRunId),
             this.deps.store.readExecutionBoundary(childSessionId),
         ]);
         if (!executionBoundaryContains(parentBoundary, childBoundary)) {
@@ -2478,6 +2555,61 @@ export class SessionManager {
             },
         };
     }
+    /** Stop the captured graph activation, never a newer Run or a queued sibling. */
+    async stopAgentGraphActivation(identity, input = { source: 'graph_supervisor' }) {
+        const authority = isRuntimeHostedRootAuthority(this.deps.messageAuthority)
+            ? this.deps.messageAuthority
+            : undefined;
+        // Until the Host admission gate passes, the capability is only local
+        // ownership: cancel it synchronously, and both the pre-submission check
+        // and that gate refuse the Turn. Once admitted, Host must commit its
+        // durable fence before Runtime stop.
+        if (authority) {
+            const admission = await this.deps.hostedAgentGraphExecution?.readRootTurnAdmissionIdentity(identity.sessionId, identity.turnId);
+            if (admission && admission.runId !== identity.runId) {
+                throw new Error('Graph stop identity does not match its durable admission');
+            }
+            // A recovered local claim can be new while the Host already owns its Run.
+            // Recheck the gate after the durable read closes that lookup race.
+            if (admission || this.findGraphRuntimeActivation(identity)?.hostAdmitted) {
+                await authority.stopRootRun(identity, input);
+                return;
+            }
+        }
+        await this.stopGraphRuntimeActivation(identity, input);
+    }
+    /** Whether a failed stop left cleanup retained for this exact graph activation. */
+    hasPendingAgentGraphActivationStop(identity) {
+        return this.runtimeKernel.hasPendingRunStop?.(identity) ?? false;
+    }
+    findGraphRuntimeActivation(identity) {
+        return [...this.claimedAgentGraphIntentRuns.values()]
+            .map((entry) => entry.owner)
+            .find((candidate) => candidate.identity.sessionId === identity.sessionId &&
+            candidate.identity.runId === identity.runId &&
+            candidate.identity.turnId === identity.turnId);
+    }
+    stopGraphRuntimeActivation(identity, input) {
+        const owner = this.findGraphRuntimeActivation(identity);
+        if (owner) {
+            if (owner.stopTask)
+                return owner.stopTask;
+            if (!this.runtimeKernel.stopExecution) {
+                throw new Error('Runtime kernel does not support scoped graph activation stops');
+            }
+            const task = this.runtimeKernel.stopExecution(owner.execution, input);
+            owner.stopTask = task;
+            void task.catch(() => {
+                if (owner.stopTask === task)
+                    owner.stopTask = undefined;
+            });
+            return task;
+        }
+        if (!this.runtimeKernel.stopRun) {
+            throw new Error('Runtime kernel does not support exact Run stops');
+        }
+        return this.runtimeKernel.stopRun(identity, input);
+    }
     async stopSession(sessionId, input = {}) {
         const hostedAuthority = isRuntimeHostedRootAuthority(this.deps.messageAuthority)
             ? this.deps.messageAuthority
@@ -2488,15 +2620,20 @@ export class SessionManager {
             ? hostedAuthority.stopSession(childSessionId, input)
             : this.runtimeKernel.stopSession(childSessionId, input));
     }
-    async deliverHostedRootStop(sessionId, input = {}) {
+    async deliverHostedRootStop(sessionId, input = {}, identity) {
+        if (identity && identity.sessionId !== sessionId) {
+            throw new Error('Hosted stop identity belongs to another Session');
+        }
         const authority = isRuntimeHostedRootAuthority(this.deps.messageAuthority)
             ? this.deps.messageAuthority
             : undefined;
-        await this.#stopSessionTree(sessionId, this.runtimeKernel.stopSession(sessionId, input), (childSessionId) => authority
+        await this.#stopSessionTree(sessionId, identity
+            ? this.stopGraphRuntimeActivation(identity, input)
+            : this.runtimeKernel.stopSession(sessionId, input), (childSessionId) => authority
             ? authority.stopSession(childSessionId, input)
-            : this.runtimeKernel.stopSession(childSessionId, input));
+            : this.runtimeKernel.stopSession(childSessionId, input), identity);
     }
-    async #stopSessionTree(sessionId, ownStop, stopChild) {
+    async #stopSessionTree(sessionId, ownStop, stopChild, parentIdentity) {
         // Observe immediately while child lookup runs; await below still propagates the original error.
         void ownStop.catch(() => undefined);
         let childStops = [];
@@ -2504,7 +2641,9 @@ export class SessionManager {
         try {
             const children = await this.listChildSessions(sessionId);
             childStops = await Promise.allSettled(children
-                .filter((child) => child.subagentParent?.lifecycle === 'foreground')
+                .filter((child) => child.subagentParent?.lifecycle === 'foreground' &&
+                (!parentIdentity ||
+                    child.subagentParent.spawnedBy.parentTurnId === parentIdentity.turnId))
                 .map((child) => stopChild(child.id)));
         }
         catch (error) {