theorum 1.0.0 → 1.1.3

package/README.md

@@ -10,7 +10,14 @@
 
 # THEORUM: The Flat Agent Kernel
 
-**Current release: `1.0.0`** (`jsr:@theorum/core` / npm `theorum`).
+**Current release: `1.1.3`** (`jsr:@theorum/core` / npm `theorum`).
+
+> ⚠️ **Package Migration Notice:**
+> Starting with version 2.0, the package and scope are officially rebranded from `theorum` / `@theorum/core` to **`@theoremai/agents`** on both **npm** and **JSR**.
+> - **npm**: `npm install @theoremai/agents` (deprecating `theorum`)
+> - **JSR**: `deno add jsr:@theoremai/agents` (deprecating `jsr:@theorum/core`)
+>
+> All legacy `theorum` / `jsr:@theorum/core` v1.x releases are deprecated in favor of `@theoremai/agents`.
 
 > **"Profiles describe the contract. Providers move bytes. The runner enforces the turn."**
 
@@ -31,7 +38,7 @@ runner = "Single deterministic execution path for one agent turn"
 providers = "createProvider routes protocol/provider; adapters stay internal"
 tools = "Profile allowlist ceiling plus per-turn opt-in gates"
 egress = "Typed host hook for outbound disclosure checks and repair loops"
-traces = "Host-injected sinks; no environment variables or bundled destinations"
+traces = "Profile observability + host-registered destinations; no env vars or bundled DB"
 
 [non_goals]
 app_profiles = "No bundled assistants, demos, product personas, or business tasks"
@@ -40,6 +47,10 @@ realtime_voice = "Not included yet; persistent duplex sessions stay host-owned"
 product_copy = "No channel wording, refusal copy, iMessage/Alexa/Web policy, or UX defaults"
 ```
 
+React UI and the headless interface projection remain repo-private under [`react/`](./react/)
+and `src/interface/` while their public contracts are being designed. They are excluded from
+the JSR and npm packages.
+
 ---
 
 ## Architecture
@@ -245,8 +256,8 @@ THEORUM separates tool concerns into four layers.
 | Layer | Owner | Purpose |
 | :--- | :--- | :--- |
 | **Catalog** | Host (startup) | `registerTool` — schema, handler, access, loadTier, permission |
-| **Allow** | Profile | Custom: `tools.allow`. Builtins: `model.config.*.builtInTools` |
-| **Visibility** | Registry + profile | `loadTier` on tool; T1 via `tools.t1Policy`; T2 via `tools.t2Loader` |
+| **Allow** | Profile | Custom: `tools.allow`. Builtins: `models.*.builtInTools` |
+| **Visibility** | Registry + profile | `loadTier` on tool; T1 via `tools.t1Policy`; T2 via `tools.t2Loader`. Live (`runSession`) wires every allowed tool at setup; `host` profiles execute every allowed tool via `invokeTool`. |
 | **Permission** | Host app | `auto`, `session_consent`, and `always_confirm` determine whether execution pauses |
 
 ```ts
@@ -274,8 +285,8 @@ tools: { allow: ['lookup_order', 'load_tools'] }
 
 runTurn({ profile, input: { text: '…' } }, provider);
 
-// Host resume (interactive, confirmation, permission)
-invokeTool({ profile, name: 'ask_user', input: { kind: 'confirm', prompt: 'Proceed?' }, resume: { value: true } });
+// Gate resume (permission / confirm / auth) — ask_user completes awaiting; answer is a new user turn
+invokeTool({ profile, name: 'risky_tool', input: {…}, resume: { granted: true }, snapshot, turnInput });
 ```
 
 The host owns handlers and authorization state. The kernel enforces the declared contract
@@ -386,8 +397,8 @@ stay internal to the providers package.
 
 | Entrypoint | Purpose |
 | :--- | :--- |
-| `jsr:@theorum/core` / `theorum` | Main kernel API: profiles, schemas, runner, core types, provider constructors. |
-| `jsr:@theorum/core/kernel` / `theorum/kernel` | Profile/turn types, tool catalog, `requireModelSpec`, thinking clamps over host model maps. |
+| `jsr:@theorum/core` / `theorum` | Main kernel API: profiles, schemas, runner, core types, provider constructors, declarative HTTP/MCP tool execution. |
+| `jsr:@theorum/core/kernel` / `theorum/kernel` | Profile/turn types, tool catalog, `requireModelBinding`, thinking clamps over host model maps. |
 | `jsr:@theorum/core/providers` / `theorum/providers` | `createProvider` + Gemini vault types + host option bags. |
 | `jsr:@theorum/core/providers/local` / `theorum/providers/local` | Direct local OpenAI-compat adapter (`createLocalProvider`, `DEFAULT_LOCAL_BASE_URL`). |
 | `jsr:@theorum/core/guardrails` / `theorum/guardrails` | Sanitization, canary/egress gates, public error mapping, inbound injection/sensitive-data primitives. |
@@ -397,7 +408,10 @@ stay internal to the providers package.
 | `jsr:@theorum/core/cli` / `theorum/cli` | Profile inspection and stress-test CLI (`theorum` binary on npm). |
 | `jsr:@theorum/core/presets` / `theorum/presets` | Optional convenience packs (`registerGooglePreset`, …). |
 | `jsr:@theorum/core/presets/google` / `theorum/presets/google` | Google builtins (search/maps/urlContext/codeExecution) + Interactions/OpenRouter wire metadata. |
-| `jsr:@theorum/core/interface` / `theorum/interface` | Headless profile-driven runtime UI spec (`interfaceFromProfile`, `foldTurnEvents`, input validation). |
+
+Demo fixtures (travel concierge seeds, local handlers) live in the **repo-private**
+`@theorum/playground` package under `playground/` — never published with the kernel.
+Hosts that need them link `file:../theorum/playground`.
 
 Internal files remain present in source for maintainability, but package consumers should use the public entrypoints above.
 
@@ -409,20 +423,25 @@ Named exports from the root barrel (same symbols hosts get from `theorum` /
 | Group | Symbols |
 | --- | --- |
 | Guardrails errors | `describeError`, `isAbortError`, `publicError`, `TheorumError`, `throwIfAborted`, `toErrorEvent`, `PUBLIC_CANARY` |
-| Quota | `QuotaSlotStatus`, `clientIp`, `quotaMessage`, `releaseSlot`, `resetSlots`, `skipQuota`, `takeSlot` |
-| Sanitize | `PROJECT_ID_MAX`, `sanitizeProjectId`, `sanitizeText`, `sanitizeTurnRequest`, `sanitizeTurnRequestForTrace`, `redactSensitiveOnly` |
-| Canary / egress | `mintCanary`, `bindCanary`, `wrapUserData`, `scanTextForCanaryLeak`, `redactCanary`, `OMIT_CANARY`, `createCanaryStreamGate`, `eventHasCanary`, `createCanaryGateSession`, `filterCanaryGatedEvents`, `CanaryGateResult`, `CanaryGateSession`, `CanaryStreamGate`, `standardEgressEnforce`, `createLiveOutboundGateSession`, `processLiveOutboundBatch`, `finalizeLiveOutboundTurn`, `LiveOutboundBatchResult`, `LiveOutboundGateSession` |
+| Network guardrails | `assertSafeUrl`, `isLocalhostName`, `isPrivateOrLocalAddress` |
+| Guardrail vocabulary | `AdvisoryLevel`, `TrustLevel`, `GuardrailStage`, `Severity`, `GuardrailHit`, `Verdict`, `GuardrailAction`, `GuardrailContext`, `GuardrailEvent`, `OutboundPayload`, `Provenance`, `ToolOrigin`, `ScanText`, `EgressEnforcer`, `EgressOnBlock`, `ProfileEgressSpec`, `ProfileGuardrailsSpec`, `HostGuardrailsSpec`, `NetworkGuardrailSpec`, `CanaryGuardrailSpec`, `QuotaGuardrailSpec`, `ResolvedGuardrailPolicy`, `DetectionOptions`, `GuardedToolText`, `TurnTaint`, `TaintGate`, `TaintGuardrailSpec`, `TRUST_LEVELS`, `GUARDRAIL_STAGES`, `SEVERITIES`, `TOOL_ORIGINS`, `EGRESS_ON_BLOCK` |
+| Guardrail policy | `resolveGuardrailPolicy`, `detectionForTrust`, `detectionForProfile`, `collectEgressHits`, `hitRules`, `EGRESS_RULES`, `runEnforcer` |
+| Tool boundary | `guardToolResult`, `guardToolFailureText`, `inspectToolArguments`, `toolCallEvent`, `wrapToolData`, `isRemoteOrigin`, `composeToolText`, `checkTaintGate`, `recordTaint`, `isTainted`, `isSuspicious`, `directiveHits`, `looksDirective`, `advisoryLevel`, `DIRECTIVE_RULES`, `ADVISORY_LEVELS`, `TOOL_CLOSE`, `TOOL_ORIGINS`, `TAINT_GATES`, `textForScan`, `scanTextOf` |
+| Quota | `QuotaSlotStatus`, `QuotaExhausted`, `clientIp`, `quotaExhausted`, `releaseSlot`, `resetSlots`, `skipQuota`, `takeSlot` |
+| Lexicon | `LEXICON_KEYS`, `LexiconKey`, `LexiconOverrides`, `LexiconParams`, `lexiconDefault`, `lexiconText`, `overrideLexicon`, `resetLexicon` |
+| Sanitize | `PROJECT_ID_MAX`, `sanitizeProjectId`, `sanitizeText`, `detectText`, `sanitizeTurnRequest`, `sanitizeTurnRequestWithEvents`, `sanitizeTurnRequestForTrace`, `redactSensitiveOnly`, `guardrailFromHits`, `guardrailFromVerdict`, `guardrailTurnEvent`, `projectGuardrailTurnEvent`, `hitFromSpan`, `matchPreview`, `projectGuardrailEvent`, `GUARDRAIL_MATCH_PREVIEW_MAX` |
+| Canary / egress | `mintCanary`, `bindCanary`, `wrapUserData`, `scanTextForCanaryLeak`, `redactCanary`, `OMIT_CANARY`, `createCanaryStreamGate`, `eventHasCanary`, `createCanaryGateSession`, `filterCanaryGatedEvents`, `CanaryGateResult`, `CanaryGateSession`, `CanaryStreamGate`, `standardEgressEnforce`, `createOutboundProgressiveGate`, `createProgressiveYieldGate`, `DEFAULT_HOLDBACK`, `createLiveOutboundGateSession`, `processLiveOutboundBatch`, `finalizeLiveOutboundTurn`, `LiveOutboundBatchResult`, `LiveOutboundGateSession`, `ProgressiveYieldGate`, `ProgressiveYieldGateOptions`, `ProgressiveYieldResult` |
 | Compaction | `CompactionSplit`, `CompactionTokens`, `compactionMeter`, `compactionNeeded`, `estimateHistoryTokens`, `HISTORY_MEDIA_TOKENS`, `HISTORY_TEXT_ENCODING`, `resolveCompactionTokens`, `resolveHistoryTokens`, `shouldCompact`, `splitForCompaction` |
-| Runner | `runTurn`, `runSession`, `RunSessionOptions`, `prepareLiveInboundText` |
-| Attachments | `assertAttachmentLimits`, `fileTooLargeMessage`, `maxBytesForMime`, `requireMediaLimits`, `resolveMediaLimits`, `sanitizeCsvText`, `sanitizeTurnBlobs`, `sanitizeTurnBlobsForProfile`, `tooManyFilesMessage`, `turnTooLargeMessage` |
-| Interface (headless) | `interfaceFrom`, `interfaceFromProfile`, `interfaceFromProjected`, `inputsFromSpec`, `attachmentAcceptAttr`, `validateProfileInputs`, `pickMediaRecorderMime`, `buildUserTurnBlocks`, `foldTurnEvents`, `foldConversationTurn`, `resetBlockIds`, `streamThoughtsEnabled`, `AttachmentValidationCode`, `AttachmentValidationIssue`, `AttachmentValidationResult`, `FoldTurnEventsOptions`, `ImageProfileInterface`, `LiveProfileInterface`, `NormalizeModel`, `NormalizedModel`, `PendingAttachment`, `ProfileGuardrailsView`, `ProfileInputsInterface`, `ProfileInterface`, `ProfileInterfaceSource`, `ResolvedTools`, `SpeechProfileInterface`, `TextProfileInterface`, `TranscriptBlock`, `TranscriptBlockKind`, `UserTurnDraft` |
-| Catalog | `clampThinkingLevel`, `clampThinkingLevelForApiId`, `mediaKindForMime`, `mimeAllowed`, `mimeEssence`, `modelEntryByApiId`, `requireModelSpec` |
-| Schema | `PROFILE_FIELDS`, `PROFILE_TYPES`, `PROFILE_TYPE_PROTOCOLS`, `protocolsForProfileType`, `isValidProfileProtocol`, `EXTRA_FIELDS`, `fieldMeta`, `catalogPathFor`, `DYNAMIC_FIELD_PARENTS`, `PROTOCOLS`, `PROVIDERS`, `PROTOCOL_PROVIDERS`, `providersFor`, `protocolsFor`, `isValidPair`, `coerceProvider`, `coerceProtocol`, `THINKING_LEVELS`, `CONTROL_IDS`, `KEY_SLOTS`, `OVERFLOW_KEY_SLOTS`, `MEDIA_INPUT_KINDS`, `MEDIA_INPUT_KIND_VALUES`, `MEDIA_WILDCARDS`, `ATTACHMENT_ACCEPT_MIMES`, `VOICE_ACCEPT_MIMES`, `SUMMARY_MODES`, `STREAM_MODES`, `SPEECH_AUDIO_FORMATS`, `SCHEMA_ENFORCEMENTS`, `COMPACTION_METERS`, `COMPACTION_TIMINGS`, `EGRESS_ON_BLOCK`, `TURN_STOP_KINDS`, `TOOL_LOAD_TIERS`, `TOOL_ACCESS`, `TOOL_PERMISSION`, `TOOL_TYPES`, `LIVE_ACTIVITY_HANDLINGS`, `LIVE_CONTEXT_COMPRESSIONS`, `LIVE_SPEECH_SENSITIVITIES` |
-| Profiles | `ProfileDefinition`, `ProfileDefinitionBase`, `TextProfileDefinition`, `ImageProfileDefinition`, `SpeechProfileDefinition`, `LiveProfileDefinition`, `clearProfiles`, `defineProfile`, `getProfile`, `hasProfile`, `listProfiles`, `registerProfile`, `registerProfiles`, `projectProfile`, `resolveTurn`, `pickModel` |
-| Tools | `registerTool`, `registerTools`, `invokeTool`, `registerHarnessTools`, `getTool`, `hasTool`, `requireTool`, `listTools`, `listBuiltinIds`, `listFunctionIds`, `resetTools`, `formatToolResult`, `prepareTurnToolSnapshot` |
+| Runner | `runTurn`, `runSession`, `RunSessionOptions`, `prepareLiveInboundText`, `liveIngressEnabled`, `liveIngressEnabledFromSpec`, `liveIngressChannelDefault`, `hasAnyLiveIngress`, `assertLiveIngress`, `assertLiveIngressConfigured`, `LiveIngressChannel` |
+| Attachments | `assertAttachmentLimits`, `maxBytesForMime`, `requireMediaLimits`, `resolveMediaLimits`, `sanitizeCsvText`, `sanitizeTurnBlobs`, `sanitizeTurnBlobsForProfile` |
+| Catalog | `clampThinkingLevel`, `clampThinkingLevelForApiId`, `mediaChannelForMime`, `MediaInputChannel`, `mediaKindForMime`, `mimeAllowed`, `mimeEssence`, `modelEntryByApiId`, `requireModelBinding` |
+| Schema | `PROFILE_FIELDS`, `PROFILE_GRAPH`, `PROFILE_TYPES`, `PROFILE_TYPE_PROTOCOLS`, `protocolsForProfileType`, `isValidProfileProtocol`, `EXTRA_FIELDS`, `fieldMeta`, `catalogPathFor`, `DYNAMIC_FIELD_PARENTS`, `spineFacetsForProfileType`, `profileGraphFacet`, `ProfileGraphFacet`, `ProfileGraphFacetId`, `ProfileGraphEditor`, `ProfileGraphRole`, `PROTOCOLS`, `PROVIDERS`, `PROTOCOL_PROVIDERS`, `providersFor`, `protocolsFor`, `isValidPair`, `coerceProvider`, `coerceProtocol`, `coerceSpeechFormat`, `isSpeechFormatAllowedForProtocol`, `speechFormatsForProtocol`, `THINKING_LEVELS`, `KEY_SLOTS`, `OVERFLOW_KEY_SLOTS`, `MEDIA_INPUT_KINDS`, `MEDIA_INPUT_KIND_VALUES`, `MEDIA_WILDCARDS`, `ATTACHMENT_ACCEPT_MIMES`, `VOICE_ACCEPT_MIMES`, `SUMMARY_MODES`, `STREAM_MODES`, `SPEECH_AUDIO_FORMATS`, `SCHEMA_ENFORCEMENTS`, `COMPACTION_METERS`, `COMPACTION_TIMINGS`, `CACHE_MODES`, `CACHE_TTLS`, `TURN_STAGES`, `TURN_INJECT_STAGES`, `TURN_STOP_KINDS`, `CONTINUE_STOP_KINDS`, `TOOL_GATE_KINDS`, `AWAITING_USER_INPUT_KINDS`, `AWAITING_USER_INPUT_STATUS`, `TOOL_LOAD_TIERS`, `TOOL_ACCESS`, `TOOL_PERMISSION`, `TOOL_TYPES`, `AUTH_UNAUTHENTICATED_POLICIES`, `HTTP_METHODS`, `PLAYGROUND_AUTH_TYPES`, `TOOL_AUTH_TYPES`, `AuthUnauthenticatedPolicy`, `CustomToolType`, `HttpMethod`, `PlaygroundAuthType`, `ToolAccess`, `ToolAuthType`, `ToolPermission`, `ToolType`, `LIVE_ACTIVITY_HANDLINGS`, `LIVE_CONTEXT_COMPRESSIONS`, `LIVE_SPEECH_SENSITIVITIES`, `EGRESS_ON_BLOCK`, `EgressOnBlock` |
+| Profiles | `ProfileDefinition`, `ProfileDefinitionBase`, `TextProfileDefinition`, `ImageProfileDefinition`, `SpeechProfileDefinition`, `LiveProfileDefinition`, `HostProfileDefinition`, `clearProfiles`, `defineProfile`, `getProfile`, `hasProfile`, `listProfiles`, `registerProfile`, `registerProfiles`, `projectProfile`, `resolveTurn`, `pickModel` |
+| Tools | `registerTool`, `registerTools`, `invokeTool`, `registerHarnessTools`, `getTool`, `hasTool`, `requireTool`, `listTools`, `listBuiltinIds`, `listFunctionIds`, `resetTools`, `formatToolResult`, `prepareTurnToolSnapshot`, `buildHttpToolTarget`, `executeHttpTool`, `executeMcpTool`, `parseMcpRpcResponse`, `isUnsupportedMcpProtocolError`, `MCP_PROTOCOL_VERSIONS`, `McpProtocolVersion`, `resolveToolAuth` |
 | Structured | `getStructured`, `registerStructured` |
-| Stop / resume | `ProfileTurnResumptionSpec`, `TurnContinueFrom`, `TurnStop`, `TurnStopKind`, `AUTO_CONTINUE_DELAY_MS`, `CONTINUE_INSTRUCTION`, `DEFAULT_AUTO_CONTINUE`, `GenerationStopError`, `isGenerationStopError`, `isResumeableStop`, `isUserCancelledStop`, `shouldAutoContinue`, `turnStopFromClientStreamEnd`, `turnStopFromInteractionStatus`, `turnStopFromOpenAiFinishReason` |
-| Observability | `jsonlSink`, `memorySink`, `noopSink`, `resolveTraceDir`, `sinkFromDir`, `writeTrace`, `TraceRecord` |
+| Stop / resume | `ProfileTurnBehaviourSpec`, `ProfileTurnResumptionSpec`, `TurnContinueFrom`, `TurnStop`, `TurnStopKind`, `ContinueStopKind`, `CONTINUE_STOP_KINDS`, `AUTO_CONTINUE_DELAY_MS`, `CONTINUE_INSTRUCTION`, `DEFAULT_ALLOW_CONTINUE`, `DEFAULT_AUTO_CONTINUE`, `GenerationStopError`, `isContinueStopKind`, `isGenerationStopError`, `isResumeableStop`, `isUserCancelledStop`, `profileAllowsSteering`, `profileAllowsInject`, `profileTurnResumption`, `shouldAutoContinue`, `turnStopFromClientStreamEnd`, `turnStopFromInteractionStatus`, `turnStopFromOpenAiFinishReason` |
+| Stages (target foundation) | `TURN_STAGES`, `TURN_INJECT_STAGES`, `STAGE_AFFORDANCES`, `STAGE_AFFORDANCE_MATRIX`, `TOOL_GATE_KINDS`, `AWAITING_USER_INPUT_KINDS`, `AWAITING_USER_INPUT_STATUS`, `applyStageResult`, `parseAwaitingUserInput`, `parseToolGate`, `isTurnStage`, `isTurnInjectStage`, `isToolGateKind`, `isAwaitingUserInput`, `stageAllowsAffordance`, `stageEventFields`, `profileAllowsInject`, `StageAffordance`, `StageContext`, `StageResult`, `StageMutate`, `StageHandler`, `StageApplyInput`, `StageApplyOutput`, `StageApplyWarning`, `StageApplyWarningCode`, `StageEventExtra`, `AwaitingUserInput`, `ToolGate` — contract [`docs/contracts/stages.md`](docs/contracts/stages.md) |
+| Observability | `jsonlSink`, `memorySink`, `noopSink`, `resolveTraceDir`, `sinkFromDir`, `writeTrace`, `registerTraceDestination`, `jsonlDestination`, `requireTraceDestination`, `getTraceDestination`, `listTraceDestinationIds`, `clearTraceDestinations`, `isJsonlTraceDestination`, `isTraceSink`, `resolveTraceWriter`, `resolveObservabilityPolicy`, `TraceRecord`, `TraceSink`, `JsonlSinkOptions`, `JsonlTraceDestination`, `TraceDestination`, `ProfileObservabilitySpec`, `ResolvedObservabilityPolicy`, `ResolvedTraceInclude`, `ResolvedTraceScrub`, `TraceIncludeSpec`, `TraceScrubSpec` |
 | Providers | `CreateProviderOptions`, `GeminiTransport`, `KeyVault`, `LocalProviderConfig`, `OpenAiGatewayConfig`, `createProvider` (local: `theorum/providers/local` → `createLocalProvider`, `DEFAULT_LOCAL_BASE_URL`) |
 
 Kernel types re-exported through this barrel follow `export type *` from
@@ -446,17 +465,20 @@ On GitHub, module contracts:
 | Doc (repo only) | Export |
 | :--- | :--- |
 | [`docs/contracts/kernel.md`](docs/contracts/kernel.md) | `theorum/kernel` |
+| [`docs/contracts/stages.md`](docs/contracts/stages.md) | Turn stages — slices 1–3 landed on branch; release cut when docs match product |
 | [`docs/contracts/providers.md`](docs/contracts/providers.md) | `theorum/providers` |
 | [`docs/contracts/guardrails.md`](docs/contracts/guardrails.md) | `theorum/guardrails` |
 | [`docs/contracts/observability.md`](docs/contracts/observability.md) | `theorum/observability` |
 | [`docs/contracts/host.md`](docs/contracts/host.md) | `theorum/host` |
-| [`docs/contracts/kernel.md`](docs/contracts/kernel.md) (Headless interface) | `theorum/interface` |
+| [`docs/contracts/kernel.md`](docs/contracts/kernel.md) (repo-private headless interface) | `src/interface/` |
 | [`docs/contracts/cli.md`](docs/contracts/cli.md) | `theorum/cli` |
 | [`docs/contracts/presets.md`](docs/contracts/presets.md) | `theorum/presets` |
 | [`docs/contracts/presets-google.md`](docs/contracts/presets-google.md) | `theorum/presets/google` |
 
 Migrating from per-turn `dynamicTools`? See
 [`docs/MIGRATION-tool-system.md`](docs/MIGRATION-tool-system.md).
+Ownership-boundary cut (playground out of package, quota/lexicon/composer)? See
+[`docs/MIGRATION-boundary.md`](docs/MIGRATION-boundary.md).
 
 Document health is enforced by `npm run lint:docs` — the **first** step of
 `npm run lint` / `deno task lint` (`docs/_map.mjs`):
@@ -478,9 +500,22 @@ Document health is enforced by `npm run lint:docs` — the **first** step of
 npm install
 npm run test
 npm run lint
-deno publish --dry-run --allow-dirty
+deno install
+deno publish --dry-run
+npm run build:npm
+cd npm && npm pack
+```
+
+To dry-run npm publish when the current version is already on the registry, bump to an ephemeral prerelease first (CI does this automatically):
+
+```bash
+cd npm
+npm version 0.0.0-pr.local --no-git-tag-version
+npm publish --dry-run --access public --tag ci-validate
 ```
 
+PR CI runs JSR and npm dry-run checks in the required `publish-dry-run` job.
+
 Run the packaged CLI locally:
 
 ```bash
@@ -520,16 +555,36 @@ THEORUM is ready for host applications when these statements stay true:
 
 ```toml
 [boundary]
+# Rule: "Host decides, Theorum runs."
 profiles_in_package = false
+demos_in_package = false
 env_files_in_package = false
 ambient_secret_reads = false
 business_logic_in_kernel = false
+unownable_user_or_model_copy = false
 provider_keys_host_owned = true
 provider_adapters_lazy = true
 trace_sinks_host_injected = true
 realtime_duplex_voice = "out of scope"
 ```
 
+**Facts vs policy.** Provider facts may ship (model capabilities, wire shapes,
+protocol metadata — e.g. `theorum/presets/google`). Product policy may not
+(prompts, personas, end-user copy, demo apps, channel behavior). Every
+user- or model-visible string is either host-supplied or an overridable
+registered default in the kernel lexicon (`overrideLexicon`). Behavioral
+defaults live as typed profile-schema fields. Optional packages
+(`playground/`) are inert extras: deleting them changes no kernel behavior.
+
+Invariant properties (machine-checked where noted):
+
+| Id | Property | Check |
+| --- | --- | --- |
+| P1 | No ambient authority — construct with every Deno permission denied | `tests/kernel/zero-permission-import.test.ts` |
+| P2 | No unownable words — user/model-visible strings are host-suppliable or lexicon defaults | lexicon + full-tree `scripts/docs-truth/copy-lint.mjs` + two-hosts test |
+| P3 | No buried policy — behavioral defaults are declared profile-schema fields | `PROFILE_FIELDS` / schema |
+| P4 | Inert extras — optional entrypoints removable without behavior change | publish-bundle gate excludes `playground/` |
+
 Provider adapters load **lazily** on the first `complete` for that transport —
 `createProvider` and `theorum/providers` stay a thin barrel (`src/providers/mod.ts`);
 implementation modules (e.g. `google/interactions/`, `openrouter/`, `local/`) are
@@ -574,8 +629,9 @@ MIT License. Copyright (c) ORCHID AI LLC.
     "Package Boundary": {
       "supports": [
         { "kind": "source", "path": "src/providers/mod.ts" },
-        { "kind": "source", "path": "src/providers/create-provider.ts" },
-        { "kind": "contract_test", "path": "tests/providers/create-provider.test.ts" }
+        { "kind": "source", "path": "src/guardrails/lexicon.ts" },
+        { "kind": "contract_test", "path": "tests/kernel/two-hosts-boundary.test.ts" },
+        { "kind": "contract_test", "path": "tests/kernel/zero-permission-import.test.ts" }
       ]
     }
   }

package/esm/mod.d.ts

@@ -11,24 +11,31 @@
  *
  * const profile = defineProfile({
  *   id: "assistant.basic",
- *   model: {
- *     allow: ["gemini35FlashLite"],
- *     config: {
- *       gemini35FlashLite: {
- *         apiId: "gemini-3.5-flash-lite",
- *         thinking: { on: "high", off: "minimal" },
- *         thinkingLevels: ["minimal", "low", "medium", "high"],
- *         summaries: { on: "auto", off: "none" },
- *         maxOutputTokens: 8192,
- *         temperature: 1,
- *         builtInTools: [],
- *       },
+ *   type: "text",
+ *   identity: {
+ *     handle: "assistant",
+ *     system: "Answer plainly.",
+ *   },
+ *   models: {
+ *     default: {
+ *       protocol: "openAi",
+ *       provider: "openrouter",
+ *       apiId: "perplexity/sonar",
+ *       efforts: { normal: "minimal" },
+ *       summaries: false,
+ *       maxOutputTokens: 8192,
+ *       temperature: 1,
  *     },
  *   },
+ *   maxSteps: 1,
  *   tools: { allow: [] },
  *   inputs: { text: true },
- *   outputs: {},
- *   guardrails: { quota: { perDay: 100 } },
+ *   outputs: {
+ *     streaming: { streamThoughts: false },
+ *   },
+ *   guardrails: {
+ *     quota: { perDay: 100 },
+ *   },
  * });
  *
  * registerProfile(profile);
@@ -38,32 +45,44 @@
  */
 import "./_dnt.polyfills.js";
 export { describeError, isAbortError, PUBLIC_CANARY, publicError, TheorumError, throwIfAborted, toErrorEvent, } from './src/guardrails/error.js';
-export type { CanaryGateResult, CanaryGateSession, CanaryStreamGate, LiveOutboundBatchResult, LiveOutboundGateSession, } from './src/guardrails/mod.js';
-export { bindCanary, createCanaryGateSession, createCanaryStreamGate, createLiveOutboundGateSession, eventHasCanary, filterCanaryGatedEvents, finalizeLiveOutboundTurn, mintCanary, OMIT_CANARY, processLiveOutboundBatch, redactCanary, scanTextForCanaryLeak, standardEgressEnforce, wrapUserData, } from './src/guardrails/mod.js';
-export type { QuotaSlotStatus } from './src/guardrails/quota.js';
-export { clientIp, quotaMessage, releaseSlot, resetSlots, skipQuota, takeSlot, } from './src/guardrails/quota.js';
-export { PROJECT_ID_MAX, redactSensitiveOnly, sanitizeProjectId, sanitizeText, sanitizeTurnRequest, sanitizeTurnRequestForTrace, } from './src/guardrails/sanitize.js';
+export { guardrailFromHits, guardrailFromVerdict, guardrailTurnEvent, projectGuardrailTurnEvent, } from './src/guardrails/events.js';
+export { GUARDRAIL_MATCH_PREVIEW_MAX, hitFromSpan, matchPreview, projectGuardrailEvent, } from './src/guardrails/hits.js';
+export type { LexiconKey, LexiconOverrides, LexiconParams } from './src/guardrails/lexicon.js';
+export { LEXICON_KEYS, lexiconDefault, lexiconText, overrideLexicon, resetLexicon, } from './src/guardrails/lexicon.js';
+export type { AdvisoryLevel, CanaryGateResult, CanaryGateSession, CanaryGuardrailSpec, CanaryStreamGate, DetectionOptions, EgressEnforcer, EgressOnBlock, GuardedToolText, GuardrailAction, GuardrailContext, GuardrailEvent, GuardrailHit, GuardrailStage, HostGuardrailsSpec, LiveOutboundBatchResult, LiveOutboundGateSession, NetworkGuardrailSpec, OutboundPayload, ProfileEgressSpec, ProfileGuardrailsSpec, ProgressiveYieldGate, ProgressiveYieldGateOptions, ProgressiveYieldResult, Provenance, QuotaGuardrailSpec, ResolvedGuardrailPolicy, ScanText, Severity, TaintGate, TaintGuardrailSpec, ToolOrigin, TrustLevel, TurnTaint, Verdict, } from './src/guardrails/mod.js';
+export { ADVISORY_LEVELS, bindCanary, checkTaintGate, collectEgressHits, composeToolText, createCanaryGateSession, createCanaryStreamGate, createLiveOutboundGateSession, createOutboundProgressiveGate, createProgressiveYieldGate, DEFAULT_HOLDBACK, DIRECTIVE_RULES, detectionForTrust, directiveHits, EGRESS_ON_BLOCK, EGRESS_RULES, eventHasCanary, filterCanaryGatedEvents, finalizeLiveOutboundTurn, GUARDRAIL_STAGES, guardToolFailureText, guardToolResult, hitRules, inspectToolArguments, isRemoteOrigin, isSuspicious, isTainted, looksDirective, mintCanary, OMIT_CANARY, processLiveOutboundBatch, recordTaint, redactCanary, resolveGuardrailPolicy, runEnforcer, SEVERITIES, scanTextForCanaryLeak, scanTextOf, standardEgressEnforce, TAINT_GATES, TOOL_CLOSE, TOOL_ORIGINS, TRUST_LEVELS, textForScan, toolCallEvent, wrapToolData, wrapUserData, } from './src/guardrails/mod.js';
+export { assertSafeUrl, isLocalhostName, isPrivateOrLocalAddress, } from './src/guardrails/network.js';
+export type { QuotaExhausted, QuotaSlotStatus } from './src/guardrails/quota.js';
+export { clientIp, quotaExhausted, releaseSlot, resetSlots, skipQuota, takeSlot, } from './src/guardrails/quota.js';
+export { detectionForProfile, detectText, PROJECT_ID_MAX, redactSensitiveOnly, sanitizeProjectId, sanitizeText, sanitizeTurnRequest, sanitizeTurnRequestForTrace, sanitizeTurnRequestWithEvents, } from './src/guardrails/sanitize.js';
 export type { CompactionSplit, CompactionTokens } from './src/kernel/engine/compaction.js';
 export { compactionMeter, compactionNeeded, estimateHistoryTokens, HISTORY_MEDIA_TOKENS, HISTORY_TEXT_ENCODING, resolveCompactionTokens, resolveHistoryTokens, shouldCompact, splitForCompaction, } from './src/kernel/engine/compaction.js';
 export { prepareLiveInboundText } from './src/kernel/engine/live-inbound.js';
+export type { LiveIngressChannel } from './src/kernel/engine/live-ingress.js';
+export { assertLiveIngress, assertLiveIngressConfigured, hasAnyLiveIngress, liveIngressChannelDefault, liveIngressEnabled, liveIngressEnabledFromSpec, } from './src/kernel/engine/live-ingress.js';
 export { runTurn } from './src/kernel/engine/runner.js';
 export type { RunSessionOptions } from './src/kernel/engine/session/mod.js';
 export { runSession } from './src/kernel/engine/session/mod.js';
-export { assertAttachmentLimits, fileTooLargeMessage, maxBytesForMime, requireMediaLimits, resolveMediaLimits, sanitizeCsvText, sanitizeTurnBlobs, sanitizeTurnBlobsForProfile, tooManyFilesMessage, turnTooLargeMessage, } from './src/kernel/registry/attachments.js';
-export { clampThinkingLevel, clampThinkingLevelForApiId, mediaKindForMime, mimeAllowed, mimeEssence, modelEntryByApiId, requireModelSpec, } from './src/kernel/registry/catalog.js';
+export type { ProfileGraphEditor, ProfileGraphFacet, ProfileGraphFacetId, ProfileGraphRole, } from './src/kernel/profile-graph.js';
+export { PROFILE_GRAPH, profileGraphFacet, spineFacetsForProfileType, } from './src/kernel/profile-graph.js';
+export { assertAttachmentLimits, maxBytesForMime, requireMediaLimits, resolveMediaLimits, sanitizeCsvText, sanitizeTurnBlobs, sanitizeTurnBlobsForProfile, } from './src/kernel/registry/attachments.js';
+export type { MediaInputChannel } from './src/kernel/registry/catalog.js';
+export { clampThinkingLevel, clampThinkingLevelForApiId, mediaChannelForMime, mediaKindForMime, mimeAllowed, mimeEssence, modelEntryByApiId, requireModelBinding, } from './src/kernel/registry/catalog.js';
 export type { ImageProfileDefinition, LiveProfileDefinition, ProfileDefinition, ProfileDefinitionBase, SpeechProfileDefinition, TextProfileDefinition, } from './src/kernel/registry/profiles.js';
 export { clearProfiles, defineProfile, getProfile, hasProfile, listProfiles, registerProfile, registerProfiles, } from './src/kernel/registry/profiles.js';
 export { pickModel, projectProfile, resolveTurn } from './src/kernel/registry/resolve.js';
 export { getStructured, registerStructured } from './src/kernel/registry/schemas.js';
-export type { TurnStopKind } from './src/kernel/schema.js';
-export { ATTACHMENT_ACCEPT_MIMES, COMPACTION_METERS, COMPACTION_TIMINGS, CONTROL_IDS, catalogPathFor, coerceProtocol, coerceProvider, DYNAMIC_FIELD_PARENTS, EGRESS_ON_BLOCK, EXTRA_FIELDS, fieldMeta, isValidPair, isValidProfileProtocol, KEY_SLOTS, LIVE_ACTIVITY_HANDLINGS, LIVE_CONTEXT_COMPRESSIONS, LIVE_SPEECH_SENSITIVITIES, MEDIA_INPUT_KIND_VALUES, MEDIA_INPUT_KINDS, MEDIA_WILDCARDS, OVERFLOW_KEY_SLOTS, PROFILE_FIELDS, PROFILE_TYPE_PROTOCOLS, PROFILE_TYPES, PROTOCOL_PROVIDERS, PROTOCOLS, PROVIDERS, protocolsFor, protocolsForProfileType, providersFor, SCHEMA_ENFORCEMENTS, SPEECH_AUDIO_FORMATS, STREAM_MODES, SUMMARY_MODES, THINKING_LEVELS, TOOL_ACCESS, TOOL_LOAD_TIERS, TOOL_PERMISSION, TOOL_TYPES, TURN_STOP_KINDS, VOICE_ACCEPT_MIMES, } from './src/kernel/schema.js';
-export type { ProfileTurnResumptionSpec, TurnContinueFrom, TurnStop, } from './src/kernel/stop.js';
-export { AUTO_CONTINUE_DELAY_MS, CONTINUE_INSTRUCTION, DEFAULT_AUTO_CONTINUE, GenerationStopError, isGenerationStopError, isResumeableStop, isUserCancelledStop, shouldAutoContinue, turnStopFromClientStreamEnd, turnStopFromInteractionStatus, turnStopFromOpenAiFinishReason, } from './src/kernel/stop.js';
-export { formatToolResult, getTool, hasTool, invokeTool, listBuiltinIds, listFunctionIds, listTools, prepareTurnToolSnapshot, registerHarnessTools, registerTool, registerTools, requireTool, resetTools, } from './src/kernel/tools/mod.js';
+export type { AuthUnauthenticatedPolicy, ContinueStopKind, CustomToolType, HttpMethod, PlaygroundAuthType, ToolAccess, ToolAuthType, ToolPermission, ToolType, TurnStopKind, } from './src/kernel/schema.js';
+export { ATTACHMENT_ACCEPT_MIMES, AUTH_UNAUTHENTICATED_POLICIES, AWAITING_USER_INPUT_KINDS, AWAITING_USER_INPUT_STATUS, COMPACTION_METERS, COMPACTION_TIMINGS, CONTINUE_STOP_KINDS, catalogPathFor, coerceProtocol, coerceProvider, coerceSpeechFormat, DYNAMIC_FIELD_PARENTS, EXTRA_FIELDS, fieldMeta, HTTP_METHODS, isSpeechFormatAllowedForProtocol, isToolGateKind, isTurnInjectStage, isTurnStage, isValidPair, isValidProfileProtocol, KEY_SLOTS, LIVE_ACTIVITY_HANDLINGS, LIVE_CONTEXT_COMPRESSIONS, LIVE_SPEECH_SENSITIVITIES, MEDIA_INPUT_KIND_VALUES, MEDIA_INPUT_KINDS, MEDIA_WILDCARDS, OVERFLOW_KEY_SLOTS, PLAYGROUND_AUTH_TYPES, PROFILE_FIELDS, PROFILE_TYPE_PROTOCOLS, PROFILE_TYPES, PROTOCOL_PROVIDERS, PROTOCOLS, PROVIDERS, protocolsFor, protocolsForProfileType, providersFor, SCHEMA_ENFORCEMENTS, SPEECH_AUDIO_FORMATS, STREAM_MODES, SUMMARY_MODES, speechFormatsForProtocol, THINKING_LEVELS, TOOL_ACCESS, TOOL_AUTH_TYPES, TOOL_GATE_KINDS, TOOL_LOAD_TIERS, TOOL_PERMISSION, TOOL_TYPES, TURN_INJECT_STAGES, TURN_STAGES, TURN_STOP_KINDS, VOICE_ACCEPT_MIMES, } from './src/kernel/schema.js';
+export type { AwaitingUserInput, StageAffordance, StageApplyInput, StageApplyOutput, StageApplyWarning, StageApplyWarningCode, StageContext, StageEventExtra, StageHandler, StageMutate, StageResult, } from './src/kernel/stages.js';
+export { applyStageResult, isAwaitingUserInput, parseAwaitingUserInput, parseToolGate, STAGE_AFFORDANCE_MATRIX, STAGE_AFFORDANCES, stageAllowsAffordance, stageEventFields, } from './src/kernel/stages.js';
+export type { ProfileTurnBehaviourSpec, ProfileTurnResumptionSpec, TurnContinueFrom, TurnStop, } from './src/kernel/stop.js';
+export { AUTO_CONTINUE_DELAY_MS, CONTINUE_INSTRUCTION, DEFAULT_ALLOW_CONTINUE, DEFAULT_AUTO_CONTINUE, GenerationStopError, isContinueStopKind, isGenerationStopError, isResumeableStop, isUserCancelledStop, profileAllowsInject, profileAllowsSteering, profileTurnResumption, shouldAutoContinue, turnStopFromClientStreamEnd, turnStopFromInteractionStatus, turnStopFromOpenAiFinishReason, } from './src/kernel/stop.js';
+export type { McpProtocolVersion, McpRpcResponse } from './src/kernel/tools/mod.js';
+export { buildHttpToolTarget, executeHttpTool, executeMcpTool, formatToolResult, getTool, hasTool, invokeTool, isUnsupportedMcpProtocolError, listBuiltinIds, listFunctionIds, listTools, MCP_PROTOCOL_VERSIONS, parseMcpRpcResponse, prepareTurnToolSnapshot, registerHarnessTools, registerTool, registerTools, requireTool, resetTools, resolveToolAuth, } from './src/kernel/tools/mod.js';
 export type * from './src/kernel/types.js';
-export { jsonlSink, memorySink, noopSink, resolveTraceDir, sinkFromDir, writeTrace, } from './src/observability/trace.js';
-export type { TraceRecord } from './src/observability/trace-record.js';
+export type { JsonlSinkOptions, JsonlTraceDestination, ProfileObservabilitySpec, ResolvedObservabilityPolicy, ResolvedTraceInclude, ResolvedTraceScrub, TraceDestination, TraceIncludeSpec, TraceRecord, TraceScrubSpec, TraceSink, } from './src/observability/mod.js';
+export { clearTraceDestinations, getTraceDestination, isJsonlTraceDestination, isTraceSink, jsonlDestination, jsonlSink, listTraceDestinationIds, memorySink, noopSink, registerTraceDestination, requireTraceDestination, resolveObservabilityPolicy, resolveTraceDir, resolveTraceWriter, sinkFromDir, writeTrace, } from './src/observability/mod.js';
 export * from './src/presets/mod.js';
 export type { CreateProviderOptions, GeminiTransport, KeyVault, LocalProviderConfig, OpenAiGatewayConfig, } from './src/providers/mod.js';
 export { createProvider } from './src/providers/mod.js';
-export * from './src/interface/mod.js';

package/esm/mod.js

@@ -11,24 +11,31 @@
  *
  * const profile = defineProfile({
  *   id: "assistant.basic",
- *   model: {
- *     allow: ["gemini35FlashLite"],
- *     config: {
- *       gemini35FlashLite: {
- *         apiId: "gemini-3.5-flash-lite",
- *         thinking: { on: "high", off: "minimal" },
- *         thinkingLevels: ["minimal", "low", "medium", "high"],
- *         summaries: { on: "auto", off: "none" },
- *         maxOutputTokens: 8192,
- *         temperature: 1,
- *         builtInTools: [],
- *       },
+ *   type: "text",
+ *   identity: {
+ *     handle: "assistant",
+ *     system: "Answer plainly.",
+ *   },
+ *   models: {
+ *     default: {
+ *       protocol: "openAi",
+ *       provider: "openrouter",
+ *       apiId: "perplexity/sonar",
+ *       efforts: { normal: "minimal" },
+ *       summaries: false,
+ *       maxOutputTokens: 8192,
+ *       temperature: 1,
  *     },
  *   },
+ *   maxSteps: 1,
  *   tools: { allow: [] },
  *   inputs: { text: true },
- *   outputs: {},
- *   guardrails: { quota: { perDay: 100 } },
+ *   outputs: {
+ *     streaming: { streamThoughts: false },
+ *   },
+ *   guardrails: {
+ *     quota: { perDay: 100 },
+ *   },
  * });
  *
  * registerProfile(profile);
@@ -38,22 +45,28 @@
  */
 import "./_dnt.polyfills.js";
 export { describeError, isAbortError, PUBLIC_CANARY, publicError, TheorumError, throwIfAborted, toErrorEvent, } from './src/guardrails/error.js';
-export { bindCanary, createCanaryGateSession, createCanaryStreamGate, createLiveOutboundGateSession, eventHasCanary, filterCanaryGatedEvents, finalizeLiveOutboundTurn, mintCanary, OMIT_CANARY, processLiveOutboundBatch, redactCanary, scanTextForCanaryLeak, standardEgressEnforce, wrapUserData, } from './src/guardrails/mod.js';
-export { clientIp, quotaMessage, releaseSlot, resetSlots, skipQuota, takeSlot, } from './src/guardrails/quota.js';
-export { PROJECT_ID_MAX, redactSensitiveOnly, sanitizeProjectId, sanitizeText, sanitizeTurnRequest, sanitizeTurnRequestForTrace, } from './src/guardrails/sanitize.js';
+export { guardrailFromHits, guardrailFromVerdict, guardrailTurnEvent, projectGuardrailTurnEvent, } from './src/guardrails/events.js';
+export { GUARDRAIL_MATCH_PREVIEW_MAX, hitFromSpan, matchPreview, projectGuardrailEvent, } from './src/guardrails/hits.js';
+export { LEXICON_KEYS, lexiconDefault, lexiconText, overrideLexicon, resetLexicon, } from './src/guardrails/lexicon.js';
+export { ADVISORY_LEVELS, bindCanary, checkTaintGate, collectEgressHits, composeToolText, createCanaryGateSession, createCanaryStreamGate, createLiveOutboundGateSession, createOutboundProgressiveGate, createProgressiveYieldGate, DEFAULT_HOLDBACK, DIRECTIVE_RULES, detectionForTrust, directiveHits, EGRESS_ON_BLOCK, EGRESS_RULES, eventHasCanary, filterCanaryGatedEvents, finalizeLiveOutboundTurn, GUARDRAIL_STAGES, guardToolFailureText, guardToolResult, hitRules, inspectToolArguments, isRemoteOrigin, isSuspicious, isTainted, looksDirective, mintCanary, OMIT_CANARY, processLiveOutboundBatch, recordTaint, redactCanary, resolveGuardrailPolicy, runEnforcer, SEVERITIES, scanTextForCanaryLeak, scanTextOf, standardEgressEnforce, TAINT_GATES, TOOL_CLOSE, TOOL_ORIGINS, TRUST_LEVELS, textForScan, toolCallEvent, wrapToolData, wrapUserData, } from './src/guardrails/mod.js';
+export { assertSafeUrl, isLocalhostName, isPrivateOrLocalAddress, } from './src/guardrails/network.js';
+export { clientIp, quotaExhausted, releaseSlot, resetSlots, skipQuota, takeSlot, } from './src/guardrails/quota.js';
+export { detectionForProfile, detectText, PROJECT_ID_MAX, redactSensitiveOnly, sanitizeProjectId, sanitizeText, sanitizeTurnRequest, sanitizeTurnRequestForTrace, sanitizeTurnRequestWithEvents, } from './src/guardrails/sanitize.js';
 export { compactionMeter, compactionNeeded, estimateHistoryTokens, HISTORY_MEDIA_TOKENS, HISTORY_TEXT_ENCODING, resolveCompactionTokens, resolveHistoryTokens, shouldCompact, splitForCompaction, } from './src/kernel/engine/compaction.js';
 export { prepareLiveInboundText } from './src/kernel/engine/live-inbound.js';
+export { assertLiveIngress, assertLiveIngressConfigured, hasAnyLiveIngress, liveIngressChannelDefault, liveIngressEnabled, liveIngressEnabledFromSpec, } from './src/kernel/engine/live-ingress.js';
 export { runTurn } from './src/kernel/engine/runner.js';
 export { runSession } from './src/kernel/engine/session/mod.js';
-export { assertAttachmentLimits, fileTooLargeMessage, maxBytesForMime, requireMediaLimits, resolveMediaLimits, sanitizeCsvText, sanitizeTurnBlobs, sanitizeTurnBlobsForProfile, tooManyFilesMessage, turnTooLargeMessage, } from './src/kernel/registry/attachments.js';
-export { clampThinkingLevel, clampThinkingLevelForApiId, mediaKindForMime, mimeAllowed, mimeEssence, modelEntryByApiId, requireModelSpec, } from './src/kernel/registry/catalog.js';
+export { PROFILE_GRAPH, profileGraphFacet, spineFacetsForProfileType, } from './src/kernel/profile-graph.js';
+export { assertAttachmentLimits, maxBytesForMime, requireMediaLimits, resolveMediaLimits, sanitizeCsvText, sanitizeTurnBlobs, sanitizeTurnBlobsForProfile, } from './src/kernel/registry/attachments.js';
+export { clampThinkingLevel, clampThinkingLevelForApiId, mediaChannelForMime, mediaKindForMime, mimeAllowed, mimeEssence, modelEntryByApiId, requireModelBinding, } from './src/kernel/registry/catalog.js';
 export { clearProfiles, defineProfile, getProfile, hasProfile, listProfiles, registerProfile, registerProfiles, } from './src/kernel/registry/profiles.js';
 export { pickModel, projectProfile, resolveTurn } from './src/kernel/registry/resolve.js';
 export { getStructured, registerStructured } from './src/kernel/registry/schemas.js';
-export { ATTACHMENT_ACCEPT_MIMES, COMPACTION_METERS, COMPACTION_TIMINGS, CONTROL_IDS, catalogPathFor, coerceProtocol, coerceProvider, DYNAMIC_FIELD_PARENTS, EGRESS_ON_BLOCK, EXTRA_FIELDS, fieldMeta, isValidPair, isValidProfileProtocol, KEY_SLOTS, LIVE_ACTIVITY_HANDLINGS, LIVE_CONTEXT_COMPRESSIONS, LIVE_SPEECH_SENSITIVITIES, MEDIA_INPUT_KIND_VALUES, MEDIA_INPUT_KINDS, MEDIA_WILDCARDS, OVERFLOW_KEY_SLOTS, PROFILE_FIELDS, PROFILE_TYPE_PROTOCOLS, PROFILE_TYPES, PROTOCOL_PROVIDERS, PROTOCOLS, PROVIDERS, protocolsFor, protocolsForProfileType, providersFor, SCHEMA_ENFORCEMENTS, SPEECH_AUDIO_FORMATS, STREAM_MODES, SUMMARY_MODES, THINKING_LEVELS, TOOL_ACCESS, TOOL_LOAD_TIERS, TOOL_PERMISSION, TOOL_TYPES, TURN_STOP_KINDS, VOICE_ACCEPT_MIMES, } from './src/kernel/schema.js';
-export { AUTO_CONTINUE_DELAY_MS, CONTINUE_INSTRUCTION, DEFAULT_AUTO_CONTINUE, GenerationStopError, isGenerationStopError, isResumeableStop, isUserCancelledStop, shouldAutoContinue, turnStopFromClientStreamEnd, turnStopFromInteractionStatus, turnStopFromOpenAiFinishReason, } from './src/kernel/stop.js';
-export { formatToolResult, getTool, hasTool, invokeTool, listBuiltinIds, listFunctionIds, listTools, prepareTurnToolSnapshot, registerHarnessTools, registerTool, registerTools, requireTool, resetTools, } from './src/kernel/tools/mod.js';
-export { jsonlSink, memorySink, noopSink, resolveTraceDir, sinkFromDir, writeTrace, } from './src/observability/trace.js';
+export { ATTACHMENT_ACCEPT_MIMES, AUTH_UNAUTHENTICATED_POLICIES, AWAITING_USER_INPUT_KINDS, AWAITING_USER_INPUT_STATUS, COMPACTION_METERS, COMPACTION_TIMINGS, CONTINUE_STOP_KINDS, catalogPathFor, coerceProtocol, coerceProvider, coerceSpeechFormat, DYNAMIC_FIELD_PARENTS, EXTRA_FIELDS, fieldMeta, HTTP_METHODS, isSpeechFormatAllowedForProtocol, isToolGateKind, isTurnInjectStage, isTurnStage, isValidPair, isValidProfileProtocol, KEY_SLOTS, LIVE_ACTIVITY_HANDLINGS, LIVE_CONTEXT_COMPRESSIONS, LIVE_SPEECH_SENSITIVITIES, MEDIA_INPUT_KIND_VALUES, MEDIA_INPUT_KINDS, MEDIA_WILDCARDS, OVERFLOW_KEY_SLOTS, PLAYGROUND_AUTH_TYPES, PROFILE_FIELDS, PROFILE_TYPE_PROTOCOLS, PROFILE_TYPES, PROTOCOL_PROVIDERS, PROTOCOLS, PROVIDERS, protocolsFor, protocolsForProfileType, providersFor, SCHEMA_ENFORCEMENTS, SPEECH_AUDIO_FORMATS, STREAM_MODES, SUMMARY_MODES, speechFormatsForProtocol, THINKING_LEVELS, TOOL_ACCESS, TOOL_AUTH_TYPES, TOOL_GATE_KINDS, TOOL_LOAD_TIERS, TOOL_PERMISSION, TOOL_TYPES, TURN_INJECT_STAGES, TURN_STAGES, TURN_STOP_KINDS, VOICE_ACCEPT_MIMES, } from './src/kernel/schema.js';
+export { applyStageResult, isAwaitingUserInput, parseAwaitingUserInput, parseToolGate, STAGE_AFFORDANCE_MATRIX, STAGE_AFFORDANCES, stageAllowsAffordance, stageEventFields, } from './src/kernel/stages.js';
+export { AUTO_CONTINUE_DELAY_MS, CONTINUE_INSTRUCTION, DEFAULT_ALLOW_CONTINUE, DEFAULT_AUTO_CONTINUE, GenerationStopError, isContinueStopKind, isGenerationStopError, isResumeableStop, isUserCancelledStop, profileAllowsInject, profileAllowsSteering, profileTurnResumption, shouldAutoContinue, turnStopFromClientStreamEnd, turnStopFromInteractionStatus, turnStopFromOpenAiFinishReason, } from './src/kernel/stop.js';
+export { buildHttpToolTarget, executeHttpTool, executeMcpTool, formatToolResult, getTool, hasTool, invokeTool, isUnsupportedMcpProtocolError, listBuiltinIds, listFunctionIds, listTools, MCP_PROTOCOL_VERSIONS, parseMcpRpcResponse, prepareTurnToolSnapshot, registerHarnessTools, registerTool, registerTools, requireTool, resetTools, resolveToolAuth, } from './src/kernel/tools/mod.js';
+export { clearTraceDestinations, getTraceDestination, isJsonlTraceDestination, isTraceSink, jsonlDestination, jsonlSink, listTraceDestinationIds, memorySink, noopSink, registerTraceDestination, requireTraceDestination, resolveObservabilityPolicy, resolveTraceDir, resolveTraceWriter, sinkFromDir, writeTrace, } from './src/observability/mod.js';
 export * from './src/presets/mod.js';
 export { createProvider } from './src/providers/mod.js';
-export * from './src/interface/mod.js';

package/esm/src/cli/commands/bench.js

@@ -16,7 +16,8 @@ import { bindCanary, eventHasCanary, mintCanary } from '../../guardrails/canary.
 import { sanitizeTurnRequest } from '../../guardrails/sanitize.js';
 import { runTurn } from '../../kernel/engine/runner.js';
 import { clearProfiles, registerProfile } from '../../kernel/registry/profiles.js';
-import { pickSystemRole, resolveTurn } from '../../kernel/registry/resolve.js';
+import { resolveTurn } from '../../kernel/registry/resolve.js';
+import { pickSystemRole } from '../../kernel/registry/system-role.js';
 import { buildRecord } from '../../observability/trace-record.js';
 const DEFAULT_CHUNKS = 200;
 const DEFAULT_ITERATIONS = 50;
@@ -31,23 +32,19 @@ function registerBenchProfile() {
             handle: 'bench',
             system: 'You are a benchmark stub.',
         },
-        model: {
-            protocol: 'openAi',
-            provider: 'openrouter',
-            allow: ['bench-model'],
-            config: {
-                'bench-model': {
-                    apiId: 'bench-model',
-                    thinking: { on: 'none', off: 'none' },
-                    thinkingLevels: ['none'],
-                    summaries: { on: 'none', off: 'none' },
-                    maxOutputTokens: 4096,
-                    temperature: 0,
-                    builtInTools: [],
-                },
+        models: {
+            'bench-model': {
+                protocol: 'openAi',
+                provider: 'openrouter',
+                apiId: 'bench-model',
+                efforts: { normal: 'none' },
+                summaries: false,
+                maxOutputTokens: 4096,
+                temperature: 0,
+                builtInTools: [],
             },
-            thinking: 'none',
         },
+        defaultModel: 'bench-model',
         tools: { allow: [] },
         inputs: { text: true },
         guardrails: {

package/esm/src/cli/commands/fuzz-canary.js

@@ -8,10 +8,10 @@
  * @module
  */
 import { bindCanary, mintCanary, scanTextForCanaryLeak } from '../../guardrails/canary.js';
-import { createCanaryGateSession, filterCanaryGatedEvents } from '../../guardrails/canary-gate.js';
 import { buildCanaryEgressAttacks, FIXED_CANARY, } from '../../guardrails/corpus/canary-egress-attacks.js';
+import { createLiveOutboundGateSession, finalizeLiveOutboundTurn, processLiveOutboundBatch, } from '../../guardrails/live-outbound-gate.js';
 import { yieldProviderEvents } from '../../kernel/engine/runner/stream.js';
-import { clearProfiles, registerProfile } from '../../kernel/registry/profiles.js';
+import { clearProfiles, getProfile, registerProfile } from '../../kernel/registry/profiles.js';
 import { resolveTurn } from '../../kernel/registry/resolve.js';
 const FUZZ_PROFILE_ID = '__fuzz_canary__';
 function registerFuzzCanaryProfile() {
@@ -19,23 +19,19 @@ function registerFuzzCanaryProfile() {
         type: 'text',
         id: FUZZ_PROFILE_ID,
         identity: { handle: 'fuzz-canary', system: 'Canary fuzz profile.' },
-        model: {
-            protocol: 'openAi',
-            provider: 'openrouter',
-            allow: ['fuzz-model'],
-            config: {
-                'fuzz-model': {
-                    apiId: 'fuzz-model',
-                    thinking: { on: 'none', off: 'none' },
-                    thinkingLevels: ['none'],
-                    summaries: { on: 'none', off: 'none' },
-                    maxOutputTokens: 4096,
-                    temperature: 0,
-                    builtInTools: [],
-                },
+        models: {
+            'fuzz-model': {
+                protocol: 'openAi',
+                provider: 'openrouter',
+                apiId: 'fuzz-model',
+                efforts: { normal: 'none' },
+                summaries: false,
+                maxOutputTokens: 4096,
+                temperature: 0,
+                builtInTools: [],
             },
-            thinking: 'none',
         },
+        defaultModel: 'fuzz-model',
         tools: { allow: [] },
         inputs: { text: true },
         guardrails: { canary: true },
@@ -72,6 +68,7 @@ async function runStreamChannel(attack, generation, canary) {
         }
     }
     const events = await collectEvents(yieldProviderEvents({
+        profile: getProfile(FUZZ_PROFILE_ID),
         generation,
         system: bindCanary('fuzz system', canary),
         provider: { complete: mockProvider },
@@ -89,10 +86,10 @@ async function runStreamChannel(attack, generation, canary) {
         clientWire: clientVisibleWire(events),
     };
 }
-function runLiveBatchChannel(attack, canary) {
-    const session = createCanaryGateSession(canary);
-    const filtered = filterCanaryGatedEvents(session, attack.events);
-    if (filtered.leaked) {
+async function runLiveBatchChannel(attack, canary) {
+    const session = createLiveOutboundGateSession(getProfile(FUZZ_PROFILE_ID), canary);
+    const batch = await processLiveOutboundBatch(session, attack.events);
+    if (batch.action === 'withhold') {
         return {
             attack,
             channel: 'live.batch',
@@ -102,9 +99,9 @@ function runLiveBatchChannel(attack, canary) {
             clientWire: '',
         };
     }
-    const emitted = [...filtered.events];
-    const tail = session.gate.flush();
-    if (tail.leak) {
+    const emitted = batch.action === 'emit' ? [...batch.events] : [];
+    const finalized = await finalizeLiveOutboundTurn(session);
+    if (finalized.action === 'withhold') {
         return {
             attack,
             channel: 'live.batch',
@@ -114,18 +111,17 @@ function runLiveBatchChannel(attack, canary) {
             clientWire: clientVisibleWire(emitted),
         };
     }
-    if (tail.emit) {
-        emitted.push({ type: session.lastStreamType ?? 'text', text: tail.emit });
+    if (finalized.action === 'emit') {
+        emitted.push(...finalized.events);
     }
     const bypassed = attack.shouldBlock && literalCanaryReachedClient(emitted, canary);
     const blocked = attack.shouldBlock && !bypassed;
-    const falseAlarm = !attack.shouldBlock && filtered.leaked;
     return {
         attack,
         channel: 'live.batch',
         blocked,
         bypassed,
-        falseAlarm,
+        falseAlarm: false,
         clientWire: clientVisibleWire(emitted),
     };
 }
@@ -181,7 +177,7 @@ export async function fuzzCanaryCommand(options) {
     const results = [];
     for (const attack of attacks) {
         results.push(await runStreamChannel(attack, generation, canary));
-        results.push(runLiveBatchChannel(attack, canary));
+        results.push(await runLiveBatchChannel(attack, canary));
     }
     // Spot-check scan helper matches expectations
     if (!scanTextForCanaryLeak(canary, canary)) {