pi-background-tasks 1.0.4 → 1.0.7

package/src/core/fusion/prompts.ts

@@ -190,6 +190,7 @@ Return only JSON matching this exact closed schema:
   "limitations": ["non-blank statement of what you could not cover"]
 }
 Use an empty findings array when no issues were found; do not omit verified or limitations.
+Do not wrap the JSON in Markdown fences or prose. Emit exactly one bare JSON object.
 
 Do not inflate severity and do not invent issues to appear thorough. If the work is correct, say so plainly in verified/limitations. A report with no findings that names the evidence behind that conclusion is a valid and valuable result; a padded report is not.
 

package/src/core/fusion/types.ts

@@ -14,16 +14,19 @@ export const FUSION_MODEL_CONFIG_SCHEMA_VERSION = 'pi-background-tasks.fusion-mo
 export const FUSION_LEGACY_INPUT_SCHEMA_VERSION = 'pi-background-tasks.fusion-input.v4';
 export const FUSION_INPUT_SCHEMA_VERSION = 'pi-background-tasks.fusion-input.v5';
 export const FUSION_EVALUATION_SCHEMA_VERSION = 'pi-background-tasks.fusion-evaluation.v1';
-export const FUSION_VALIDATE_CANDIDATE_SCHEMA_VERSION = 'pi-background-tasks.fusion-validation-candidate.v1';
+export const FUSION_VALIDATE_CANDIDATE_SCHEMA_VERSION =
+  'pi-background-tasks.fusion-validation-candidate.v1';
 export const FUSION_LEGACY_RESULT_SCHEMA_VERSION = 'pi-background-tasks.fusion-result.v4';
 export const FUSION_RESULT_SCHEMA_VERSION = 'pi-background-tasks.fusion-result.v5';
 export const FUSION_LEGACY_MANIFEST_SCHEMA_VERSION = 'pi-background-tasks.fusion-manifest.v3';
 export const FUSION_MANIFEST_SCHEMA_VERSION = 'pi-background-tasks.fusion-manifest.v4';
 export const FUSION_CONTEXT_LEDGER_SCHEMA_VERSION = 'pi-background-tasks.fusion-context-ledger.v2';
 export const FUSION_SOURCE_POLICY_SCHEMA_VERSION = 'pi-background-tasks.fusion-source-policy.v1';
-export const FUSION_BUDGET_PLAN_SCHEMA_VERSION = 'pi-background-tasks.fusion-budget-plan.v3';
+export const FUSION_BUDGET_PLAN_SCHEMA_VERSION = 'pi-background-tasks.fusion-budget-plan.v4';
 export const FUSION_CALIBRATION_VIOLATION_SCHEMA_VERSION =
-  'pi-background-tasks.fusion-calibration-violation.v1';
+  'pi-background-tasks.fusion-calibration-violation.v2';
+export const FUSION_VALIDATE_CANDIDATE_CONTRACT_EVENT_SCHEMA_VERSION =
+  'pi-background-tasks.fusion-validation-candidate-contract-event.v1';
 export const FUSION_TOOL_CALL_LOG_SCHEMA_VERSION = 'pi-background-tasks.fusion-tool-call.v1';
 
 /**
@@ -186,6 +189,7 @@ export interface ResolvedFusionModel {
   qualifiedId: string;
   thinkingLevel: FusionThinkingLevel;
   contextWindow: number;
+  maxOutputTokens: number;
 }
 
 export interface ResolvedFusionModels {
@@ -556,7 +560,11 @@ export interface FusionResultDetails {
   source: FusionSource;
   status: 'completed';
   context: { kind: FusionContextKind; policy_id: string };
-  tool_policy: { candidate_tools: readonly string[]; evaluation_tools: readonly []; merge_tools: readonly [] };
+  tool_policy: {
+    candidate_tools: readonly string[];
+    evaluation_tools: readonly [];
+    merge_tools: readonly [];
+  };
   artifact_dir: string;
   models: {
     candidates: readonly [string, string, string];
@@ -595,6 +603,8 @@ export type FusionErrorCode =
   | 'child_stdin_failed'
   | 'child_event_invalid'
   | 'child_exit_failed'
+  | 'child_runtime_budget_exceeded'
+  | 'child_cache_policy_invalid'
   | 'child_timeout'
   | 'child_output_cap'
   | 'child_cancelled'
@@ -761,7 +771,12 @@ export interface FusionChildRunResult {
   model: string;
   qualifiedId: string;
   text: string;
+  /** Aggregate usage across the complete child agent loop. */
   usage: FusionUsage;
+  /** First provider request, used for like-for-like prompt forecast calibration. */
+  firstRequestUsage?: FusionUsage;
+  /** Number of provider requests represented by aggregate usage. */
+  providerRequestCount?: number;
   events: Buffer;
   stderr: Buffer;
   exitCode: number;
@@ -815,8 +830,17 @@ export interface FusionArtifactManifest {
     evaluation: FusionCapability;
     merge: FusionCapability;
   };
-  context: { kind: FusionContextKind; policy_id: string; ledger_artifact?: string; source_policy_artifact?: string };
-  tool_policy: { candidate_tools: readonly string[]; evaluation_tools: readonly []; merge_tools: readonly [] };
+  context: {
+    kind: FusionContextKind;
+    policy_id: string;
+    ledger_artifact?: string;
+    source_policy_artifact?: string;
+  };
+  tool_policy: {
+    candidate_tools: readonly string[];
+    evaluation_tools: readonly [];
+    merge_tools: readonly [];
+  };
   usage: FusionUsage;
   attempts: readonly FusionAttemptArtifactRecord[];
   artifacts: Readonly<Record<string, FusionArtifactRef>>;
@@ -900,7 +924,11 @@ export interface FusionBudgetPlanV1 {
   workflow: FusionWorkflowId;
   context: { kind: FusionContextKind; policy_id: string };
   fixed_candidate_policy: { capability: FusionCapability; tools: readonly string[] };
-  tool_policy: { candidate_tools: readonly string[]; evaluation_tools: readonly []; merge_tools: readonly [] };
+  tool_policy: {
+    candidate_tools: readonly string[];
+    evaluation_tools: readonly [];
+    merge_tools: readonly [];
+  };
   policy: FusionBudgetPolicyDescriptor;
   routes: readonly FusionRouteCapacity[];
   stages: readonly FusionStageBudgetPlanEntry[];
@@ -913,7 +941,8 @@ export interface FusionBudgetPlanV1 {
 
 /** Documented, versioned budget policy. */
 export interface FusionBudgetPolicyDescriptor {
-  id: 'fusion-budget-policy-v3';
+  id: 'fusion-budget-policy-v4';
+  route_output_reserve_strategy: 'max_fusion_contract_or_model_max';
   calibration_version: string;
   calibration_table: Readonly<Record<TokenBudgetFamily, TokenBudgetFamilyCalibration>>;
   reserved_output_tokens: number;
@@ -940,6 +969,8 @@ export interface FusionCalibrationViolation {
   rate_source: TokenBudgetRateSource;
   prompt_utf8_bytes: number;
   prompt_sha256: string;
+  observation_scope: 'first_provider_request';
+  provider_request_count: number;
   forecast_input_tokens: number;
   billed_input_tokens: number;
   billed_input_breakdown: {

package/src/fusion-child-extension.ts

@@ -9,8 +9,14 @@ import {
   writeSync,
 } from 'node:fs';
 import { dirname } from 'node:path';
+import { parseJsonText } from './core/common.js';
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
 import { Type, type Static } from 'typebox';
+import {
+  estimateInputTokens,
+  knownJsonSegment,
+  resolveTokenBudgetFamily,
+} from './core/context/token-budget.js';
 import {
   FUSION_TOOL_CALL_LOG_SCHEMA_VERSION,
   FUSION_WEB_FETCH_TOOL_NAME,
@@ -26,32 +32,75 @@ import {
   parseFusionSourcePolicy,
 } from './core/fusion/source-policy.js';
 import {
+  nonAnthropicFusionCacheObservation,
+  normalizeFusionClaudeCachePayload,
+  type FusionClaudeCacheObservation,
+} from './core/fusion/claude-cache.js';
+import {
+  FUSION_CHILD_MAX_PROVIDER_REQUESTS,
+  FUSION_CHILD_MAX_TOOL_CALLS,
   FUSION_CHILD_MAX_TOTAL_TOOL_RESULT_BYTES,
+  FUSION_CHILD_MIN_OUTPUT_RESERVE_TOKENS,
   FUSION_CHILD_RESULT_PREFIX,
+  FUSION_CHILD_SAFETY_RESERVE_TOKENS,
+  FUSION_CHILD_SETTLEMENT_PREFIX,
   FUSION_RESEARCH_ENABLED_ENV,
+  FUSION_RUNTIME_GUARD_PREFIX,
+  FUSION_RUNTIME_GUARD_SCHEMA_VERSION,
   FUSION_SOURCE_POLICY_PATH_ENV,
   FUSION_SOURCE_POLICY_SHA256_ENV,
   FUSION_TOOL_CALL_LOG_PATH_ENV,
   FUSION_TOOL_CALL_SEAL_SCHEMA_VERSION,
   FUSION_TOOL_CALL_SEAL_SUFFIX,
   buildFusionChildResultMetadata,
+  buildFusionChildSettlement,
   type FusionChildResultMetadata,
+  type FusionChildSettlementRecord,
+  type FusionRuntimeGuardCode,
+  type FusionRuntimeGuardRecord,
 } from './core/fusion/child-protocol.js';
 
 export {
+  FUSION_CLAUDE_CACHE_BREAKPOINT_LIMIT,
+  FUSION_CLAUDE_CACHE_DEFAULT_RETENTION,
+  FUSION_CLAUDE_CACHE_OBSERVATION_SCHEMA_VERSION,
+  FUSION_CLAUDE_CACHE_RETENTION_ENV,
+  nonAnthropicFusionCacheObservation,
+  normalizeFusionClaudeCachePayload,
+  resolveFusionClaudeCachePolicy,
+  type FusionClaudeCacheNormalization,
+  type FusionClaudeCacheObservation,
+  type FusionClaudeCachePolicySource,
+  type FusionClaudeCacheRetention,
+} from './core/fusion/claude-cache.js';
+
+export {
+  FUSION_CHILD_MAX_PROVIDER_REQUESTS,
+  FUSION_CHILD_MAX_TOOL_CALLS,
   FUSION_CHILD_MAX_TOTAL_TOOL_RESULT_BYTES,
+  FUSION_CHILD_MIN_OUTPUT_RESERVE_TOKENS,
   FUSION_CHILD_RESULT_PREFIX,
   FUSION_CHILD_RESULT_SCHEMA_VERSION,
+  FUSION_CHILD_SAFETY_RESERVE_TOKENS,
+  FUSION_CHILD_SETTLEMENT_PREFIX,
+  FUSION_CHILD_SETTLEMENT_SCHEMA_VERSION,
   FUSION_RESEARCH_ENABLED_ENV,
+  FUSION_RUNTIME_GUARD_PREFIX,
+  FUSION_RUNTIME_GUARD_SCHEMA_VERSION,
   FUSION_SOURCE_POLICY_PATH_ENV,
   FUSION_SOURCE_POLICY_SHA256_ENV,
   FUSION_TOOL_CALL_LOG_PATH_ENV,
   FUSION_TOOL_CALL_SEAL_SCHEMA_VERSION,
   FUSION_TOOL_CALL_SEAL_SUFFIX,
   buildFusionChildResultMetadata,
+  buildFusionChildSettlement,
   type FusionChildResultMetadata,
   type FusionChildResultUsageMetadata,
+  type FusionChildSettlementFailureReason,
+  type FusionChildSettlementRecord,
   type FusionChildTextBlockMetadata,
+  type FusionRuntimeGuardCode,
+  type FusionRuntimeGuardRecord,
 } from './core/fusion/child-protocol.js';
 
 const FUSION_CHILD_O_NOFOLLOW = typeof constants.O_NOFOLLOW === 'number' ? constants.O_NOFOLLOW : 0;
@@ -263,6 +312,237 @@ async function writeMetadata(record: FusionChildResultMetadata): Promise<void> {
   });
 }
 
+async function writeSettlement(record: FusionChildSettlementRecord): Promise<void> {
+  const line = `${FUSION_CHILD_SETTLEMENT_PREFIX}${JSON.stringify(record)}\n`;
+  await new Promise<void>((resolve, reject) => {
+    process.stderr.write(line, (error) => {
+      if (error) reject(error);
+      else resolve();
+    });
+  });
+}
+
+async function writeRuntimeGuard(record: FusionRuntimeGuardRecord): Promise<void> {
+  const line = `${FUSION_RUNTIME_GUARD_PREFIX}${JSON.stringify(record)}\n`;
+  await new Promise<void>((resolve, reject) => {
+    process.stderr.write(line, (error) => {
+      if (error) reject(error);
+      else resolve();
+    });
+  });
+}
+
+export interface FusionRuntimeRequestEvaluationInput {
+  payload: unknown;
+  provider: string | undefined;
+  model: string | undefined;
+  contextWindowTokens: number | undefined;
+  maxOutputTokens: number | undefined;
+  requestOrdinal: number;
+  toolCallCount: number;
+}
+
+function invalidFusionRuntimeRequest(
+  input: FusionRuntimeRequestEvaluationInput,
+  detail: string,
+  code: Extract<
+    FusionRuntimeGuardCode,
+    'provider_payload_invalid' | 'claude_cache_policy'
+  > = 'provider_payload_invalid',
+): FusionRuntimeGuardRecord {
+  const contextWindowTokens =
+    input.contextWindowTokens !== undefined &&
+    Number.isSafeInteger(input.contextWindowTokens) &&
+    input.contextWindowTokens > 0
+      ? input.contextWindowTokens
+      : 0;
+  const modelOutputTokens =
+    input.maxOutputTokens !== undefined &&
+    Number.isSafeInteger(input.maxOutputTokens) &&
+    input.maxOutputTokens > 0
+      ? input.maxOutputTokens
+      : 0;
+  const reservedOutputTokens = Math.max(FUSION_CHILD_MIN_OUTPUT_RESERVE_TOKENS, modelOutputTokens);
+  const allowedInputTokens = Math.max(
+    0,
+    contextWindowTokens - reservedOutputTokens - FUSION_CHILD_SAFETY_RESERVE_TOKENS,
+  );
+  const emptyPayload = Buffer.alloc(0);
+  return {
+    schema_version: FUSION_RUNTIME_GUARD_SCHEMA_VERSION,
+    code,
+    provider: input.provider ?? 'unknown',
+    model: input.model ?? 'unknown',
+    request_ordinal: input.requestOrdinal,
+    tool_call_count: input.toolCallCount,
+    payload_bytes: 0,
+    payload_sha256: sha256(emptyPayload),
+    estimated_input_tokens: 0,
+    context_window_tokens: contextWindowTokens,
+    reserved_output_tokens: reservedOutputTokens,
+    safety_reserve_tokens: FUSION_CHILD_SAFETY_RESERVE_TOKENS,
+    allowed_input_tokens: allowedInputTokens,
+    message: `fusion child could not validate provider request ${String(input.requestOrdinal)}: ${detail}`,
+  };
+}
+
+export interface PreparedFusionRuntimeRequest {
+  payload: unknown;
+  guard: FusionRuntimeGuardRecord | undefined;
+}
+
+export function prepareFusionRuntimeRequest(
+  input: FusionRuntimeRequestEvaluationInput,
+): PreparedFusionRuntimeRequest {
+  try {
+    const serialized: unknown = JSON.stringify(input.payload);
+    if (typeof serialized !== 'string') {
+      throw new Error('provider payload serialized to a non-string value');
+    }
+    const payload = parseJsonText(serialized);
+    if (typeof payload !== 'object' || payload === null || Array.isArray(payload)) {
+      throw new Error('provider payload must serialize to a JSON object');
+    }
+    if (JSON.stringify(payload) !== serialized) {
+      throw new Error('provider payload does not have a stable JSON serialization');
+    }
+    return { payload, guard: evaluateFusionRuntimeRequest({ ...input, payload }) };
+  } catch (error) {
+    return {
+      payload: input.payload,
+      guard: invalidFusionRuntimeRequest(
+        input,
+        error instanceof Error ? error.message : String(error),
+      ),
+    };
+  }
+}
+
+export function evaluateFusionRuntimeRequest(
+  input: FusionRuntimeRequestEvaluationInput,
+): FusionRuntimeGuardRecord | undefined {
+  let code: FusionRuntimeGuardCode | undefined;
+  let message = '';
+  let payloadBytes = Buffer.alloc(0);
+  let estimatedInputTokens = 0;
+  let allowedInputTokens = 0;
+  const provider = input.provider ?? 'unknown';
+  const model = input.model ?? 'unknown';
+  const contextWindowTokens = input.contextWindowTokens ?? 0;
+  const reservedOutputTokens = Math.max(
+    FUSION_CHILD_MIN_OUTPUT_RESERVE_TOKENS,
+    input.maxOutputTokens ?? 0,
+  );
+  try {
+    if (input.provider === undefined || input.model === undefined) {
+      throw new Error('active model is unavailable');
+    }
+    if (!Number.isSafeInteger(contextWindowTokens) || contextWindowTokens <= 0) {
+      throw new Error('active model context window is unavailable');
+    }
+    if (
+      input.maxOutputTokens === undefined ||
+      !Number.isSafeInteger(input.maxOutputTokens) ||
+      input.maxOutputTokens <= 0
+    ) {
+      throw new Error('active model maximum output tokens are unavailable');
+    }
+    allowedInputTokens =
+      contextWindowTokens - reservedOutputTokens - FUSION_CHILD_SAFETY_RESERVE_TOKENS;
+    if (allowedInputTokens <= 0) {
+      throw new Error('active model has no safe provider input capacity');
+    }
+    const payloadText = JSON.stringify(input.payload);
+    if (payloadText === undefined) throw new Error('provider payload serialized to undefined');
+    payloadBytes = Buffer.from(payloadText, 'utf8');
+    const family = resolveTokenBudgetFamily({ provider, model });
+    estimatedInputTokens = estimateInputTokens({
+      family: family.family,
+      calibrationBacked: family.backed,
+      familyResolution: family.resolution,
+      allowedInputTokens,
+      scope: 'fusion',
+      segments: [knownJsonSegment(payloadText)],
+    }).tokens;
+    if (input.requestOrdinal > FUSION_CHILD_MAX_PROVIDER_REQUESTS) {
+      code = 'provider_request_limit';
+      message = `fusion child reached provider request ${String(input.requestOrdinal)}, exceeding the ${String(FUSION_CHILD_MAX_PROVIDER_REQUESTS)}-request execution limit`;
+    } else if (estimatedInputTokens > allowedInputTokens) {
+      code = 'provider_request_budget';
+      message = `fusion child blocked provider request ${String(input.requestOrdinal)} before transport: exact final payload is ${String(payloadBytes.length)} UTF-8 bytes (estimated <= ${String(estimatedInputTokens)} input tokens), exceeding ${String(allowedInputTokens)} allowed input tokens after reserving ${String(reservedOutputTokens)} model output + ${String(FUSION_CHILD_SAFETY_RESERVE_TOKENS)} safety from the ${String(contextWindowTokens)}-token context window`;
+    }
+  } catch (error) {
+    code = 'provider_payload_invalid';
+    message = `fusion child could not validate provider request ${String(input.requestOrdinal)}: ${error instanceof Error ? error.message : String(error)}`;
+  }
+  if (code === undefined) return undefined;
+  return {
+    schema_version: FUSION_RUNTIME_GUARD_SCHEMA_VERSION,
+    code,
+    provider,
+    model,
+    request_ordinal: input.requestOrdinal,
+    tool_call_count: input.toolCallCount,
+    payload_bytes: payloadBytes.length,
+    payload_sha256: sha256(payloadBytes),
+    estimated_input_tokens: estimatedInputTokens,
+    context_window_tokens: contextWindowTokens,
+    reserved_output_tokens: reservedOutputTokens,
+    safety_reserve_tokens: FUSION_CHILD_SAFETY_RESERVE_TOKENS,
+    allowed_input_tokens: allowedInputTokens,
+    message,
+  };
+}
+
+export interface FusionRuntimeToolLimitEvaluationInput {
+  provider: string | undefined;
+  model: string | undefined;
+  contextWindowTokens: number | undefined;
+  maxOutputTokens: number | undefined;
+  requestOrdinal: number;
+  toolCallCount: number;
+}
+
+export function evaluateFusionRuntimeToolLimit(
+  input: FusionRuntimeToolLimitEvaluationInput,
+): FusionRuntimeGuardRecord | undefined {
+  if (input.toolCallCount <= FUSION_CHILD_MAX_TOOL_CALLS) return undefined;
+  const contextWindowTokens =
+    input.contextWindowTokens !== undefined &&
+    Number.isSafeInteger(input.contextWindowTokens) &&
+    input.contextWindowTokens > 0
+      ? input.contextWindowTokens
+      : 0;
+  const modelOutputTokens =
+    input.maxOutputTokens !== undefined &&
+    Number.isSafeInteger(input.maxOutputTokens) &&
+    input.maxOutputTokens > 0
+      ? input.maxOutputTokens
+      : 0;
+  const reservedOutputTokens = Math.max(FUSION_CHILD_MIN_OUTPUT_RESERVE_TOKENS, modelOutputTokens);
+  const allowedInputTokens = Math.max(
+    0,
+    contextWindowTokens - reservedOutputTokens - FUSION_CHILD_SAFETY_RESERVE_TOKENS,
+  );
+  const emptyPayload = Buffer.alloc(0);
+  return {
+    schema_version: FUSION_RUNTIME_GUARD_SCHEMA_VERSION,
+    code: 'tool_call_limit',
+    provider: input.provider ?? 'unknown',
+    model: input.model ?? 'unknown',
+    request_ordinal: input.requestOrdinal,
+    tool_call_count: input.toolCallCount,
+    payload_bytes: 0,
+    payload_sha256: sha256(emptyPayload),
+    estimated_input_tokens: 0,
+    context_window_tokens: contextWindowTokens,
+    reserved_output_tokens: reservedOutputTokens,
+    safety_reserve_tokens: FUSION_CHILD_SAFETY_RESERVE_TOKENS,
+    allowed_input_tokens: allowedInputTokens,
+    message: `fusion child reached tool call ${String(input.toolCallCount)}, exceeding the ${String(FUSION_CHILD_MAX_TOOL_CALLS)}-call execution limit`,
+  };
+}
+
 function strictFusionWebFetchArgs(args: unknown): FusionWebFetchParamsValue {
   if (typeof args !== 'object' || args === null || Array.isArray(args)) {
     throw new Error(`${FUSION_WEB_FETCH_TOOL_NAME} arguments must be an object`);
@@ -401,6 +681,82 @@ export default function fusionChildExtension(pi: ExtensionAPI): void {
   }
   const declaredResearchUrls = researchEnabled === '1' ? loadDeclaredResearchUrls() : undefined;
   const fetchAuditMetadata = new Map<string, FusionWebFetchAuditMetadata>();
+  let providerRequestCount = 0;
+  let toolCallCount = 0;
+  let runtimeGuardFailed = false;
+  let settlementPublished = false;
+  const childResultRecords: FusionChildResultMetadata[] = [];
+  let pendingCacheObservation: FusionClaudeCacheObservation | undefined;
+
+  pi.on('before_provider_request', async (event, ctx) => {
+    providerRequestCount += 1;
+    if (runtimeGuardFailed) {
+      ctx.abort();
+      return event.payload;
+    }
+
+    const model = ctx.model;
+    let cacheNormalizedPayload = event.payload;
+    let cacheObservation: FusionClaudeCacheObservation;
+    try {
+      if (model?.provider === 'anthropic') {
+        const supportsLongCacheRetention =
+          model.compat !== undefined && 'supportsLongCacheRetention' in model.compat
+            ? model.compat.supportsLongCacheRetention
+            : undefined;
+        const normalized = normalizeFusionClaudeCachePayload({
+          payload: event.payload,
+          requestOrdinal: providerRequestCount,
+          supportsLongCacheRetention:
+            typeof supportsLongCacheRetention === 'boolean'
+              ? supportsLongCacheRetention
+              : undefined,
+        });
+        cacheNormalizedPayload = normalized.payload;
+        cacheObservation = normalized.observation;
+      } else {
+        cacheObservation = nonAnthropicFusionCacheObservation(providerRequestCount);
+      }
+    } catch (error) {
+      const guard = invalidFusionRuntimeRequest(
+        {
+          payload: event.payload,
+          provider: model?.provider,
+          model: model?.id,
+          contextWindowTokens: model?.contextWindow,
+          maxOutputTokens: model?.maxTokens,
+          requestOrdinal: providerRequestCount,
+          toolCallCount,
+        },
+        `Claude cache policy rejected the final payload: ${error instanceof Error ? error.message : String(error)}`,
+        'claude_cache_policy',
+      );
+      runtimeGuardFailed = true;
+      latchAuditProcessFailure();
+      ctx.abort();
+      await writeRuntimeGuard(guard);
+      return event.payload;
+    }
+    pendingCacheObservation = cacheObservation;
+
+    const prepared = prepareFusionRuntimeRequest({
+      payload: cacheNormalizedPayload,
+      provider: model?.provider,
+      model: model?.id,
+      contextWindowTokens: model?.contextWindow,
+      maxOutputTokens: model?.maxTokens,
+      requestOrdinal: providerRequestCount,
+      toolCallCount,
+    });
+    const guard = prepared.guard;
+    if (guard === undefined) return prepared.payload;
+    runtimeGuardFailed = true;
+    latchAuditProcessFailure();
+    ctx.abort();
+    await writeRuntimeGuard(guard);
+    return prepared.payload;
+  });
+
   if (toolCallLogPath !== undefined) {
     // Establish the audit file before tools can run. Exclusive creation makes a reused
     // attempt path or redirected file loud instead of appending to untrusted history.
@@ -441,7 +797,8 @@ export default function fusionChildExtension(pi: ExtensionAPI): void {
       }
       phase = 'finalizing';
       const unmatchedStarts = starts.size;
-      const complete = normalSettlement && !auditFailed && unmatchedStarts === 0;
+      const complete =
+        normalSettlement && !auditFailed && !runtimeGuardFailed && unmatchedStarts === 0;
       if (!complete) {
         auditFailed = true;
         latchAuditProcessFailure();
@@ -460,9 +817,30 @@ export default function fusionChildExtension(pi: ExtensionAPI): void {
       }
     };
 
-    pi.on('tool_call', (event) => {
+    pi.on('tool_call', async (event, ctx) => {
       try {
         requireOpen('tool_call');
+        if (runtimeGuardFailed) {
+          ctx.abort();
+          return { block: true, reason: 'fusion child runtime guard already refused the run' };
+        }
+        toolCallCount += 1;
+        const model = ctx.model;
+        const guard = evaluateFusionRuntimeToolLimit({
+          provider: model?.provider,
+          model: model?.id,
+          contextWindowTokens: model?.contextWindow,
+          maxOutputTokens: model?.maxTokens,
+          requestOrdinal: providerRequestCount,
+          toolCallCount,
+        });
+        if (guard !== undefined) {
+          runtimeGuardFailed = true;
+          latchAuditProcessFailure();
+          ctx.abort();
+          await writeRuntimeGuard(guard);
+          return { block: true, reason: guard.message };
+        }
         if (starts.has(event.toolCallId)) {
           throw new Error(`fusion tool-call log duplicate start for ${event.toolCallId}`);
         }
@@ -470,8 +848,9 @@ export default function fusionChildExtension(pi: ExtensionAPI): void {
           startedAt: Date.now(),
           toolName: event.toolName,
         });
+        return undefined;
       } catch (error) {
-        failAudit(error);
+        return failAudit(error);
       }
     });
     pi.on('tool_result', (event) => {
@@ -597,6 +976,36 @@ export default function fusionChildExtension(pi: ExtensionAPI): void {
 
   pi.on('message_end', async (event) => {
     if (event.message.role !== 'assistant') return;
-    await writeMetadata(buildFusionChildResultMetadata(event.message));
+    const cacheObservation = pendingCacheObservation;
+    if (cacheObservation === undefined) {
+      latchAuditProcessFailure();
+      throw new Error('fusion child assistant result has no matching cache-policy observation');
+    }
+    pendingCacheObservation = undefined;
+    const record = buildFusionChildResultMetadata(event.message, cacheObservation);
+    await writeMetadata(record);
+    childResultRecords.push(record);
+  });
+  pi.on('agent_settled', async (_event, ctx) => {
+    if (settlementPublished) {
+      latchAuditProcessFailure();
+      throw new Error('fusion child received duplicate agent_settled for result settlement');
+    }
+    if (!ctx.isIdle()) {
+      latchAuditProcessFailure();
+      throw new Error('fusion child result settlement observed agent_settled while not idle');
+    }
+    settlementPublished = true;
+    const cacheObservationFailed = pendingCacheObservation !== undefined;
+    const settlement = buildFusionChildSettlement(
+      childResultRecords,
+      runtimeGuardFailed,
+      cacheObservationFailed,
+    );
+    if (settlement.status !== 'complete') latchAuditProcessFailure();
+    await writeSettlement(settlement);
+  });
+  pi.on('session_shutdown', () => {
+    if (!settlementPublished) latchAuditProcessFailure();
   });
 }