deepstrike 0.2.18__tar.gz → 0.2.20__tar.gz

{deepstrike-0.2.18 → deepstrike-0.2.20}/Cargo.lock

@@ -194,7 +194,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-core"
-version = "0.2.18"
+version = "0.2.20"
 dependencies = [
  "compact_str",
  "pretty_assertions",
@@ -206,7 +206,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-node"
-version = "0.2.18"
+version = "0.2.20"
 dependencies = [
  "compact_str",
  "deepstrike-core",
@@ -218,7 +218,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-py"
-version = "0.2.18"
+version = "0.2.20"
 dependencies = [
  "compact_str",
  "deepstrike-core",
@@ -229,7 +229,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-sdk"
-version = "0.2.18"
+version = "0.2.20"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -263,7 +263,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-wasm"
-version = "0.2.18"
+version = "0.2.20"
 dependencies = [
  "compact_str",
  "deepstrike-core",

{deepstrike-0.2.18 → deepstrike-0.2.20}/Cargo.toml

@@ -3,13 +3,13 @@ resolver = "2"
 members = ["crates/deepstrike-core", "crates/deepstrike-py"]
 
 [workspace.package]
-version = "0.2.18"
+version = "0.2.20"
 edition = "2024"
 license = "MIT"
 repository = "https://github.com/kongusen/deepstrike"
 
 [workspace.dependencies]
-deepstrike-core = { path = "crates/deepstrike-core", version = "0.2.18" }
+deepstrike-core = { path = "crates/deepstrike-core", version = "0.2.20" }
 notify = "6"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

{deepstrike-0.2.18 → deepstrike-0.2.20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepstrike
-Version: 0.2.18
+Version: 0.2.20
 Requires-Dist: httpx>=0.27
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: anyio>=4.0

{deepstrike-0.2.18 → deepstrike-0.2.20}/crates/deepstrike-core/src/context/manager.rs

@@ -31,6 +31,15 @@ pub struct ContextManager {
     pub sprint: u32,
     pub last_handoff: Option<HandoffArtifact>,
     pub skills: SkillCatalog,
+    /// P1-B tool gating: the set of skills the model has loaded this session (by name). Their
+    /// declared `allowed_tools` are unioned to narrow the exposed toolset in `emit_call_llm`.
+    /// A set (not a single value) because the model may load several skills and still needs each
+    /// one's tools (D1). v1 accumulates (no eviction). Snapshotted for wake/resume.
+    pub active_skills: std::collections::BTreeSet<CompactString>,
+    /// P1-B/D stable-core: tool ids that stay exposed even when a skill narrows the toolset (the
+    /// "everyone uses these" set — read/search/bash etc.). Configured once by the SDK; empty by
+    /// default (铁律: no config ⇒ skills narrow to exactly their declared tools + meta-tools).
+    pub stable_core_tools: std::collections::HashSet<CompactString>,
     pub capabilities: CapabilityManifest,
     pub sections: ContextSectionRegistry,
     pub memory_enabled: bool,
@@ -82,6 +91,8 @@ impl ContextManager {
             partitions, max_tokens, config, engine,
             sprint: 0, last_handoff: None,
             skills: SkillCatalog::new(),
+            active_skills: std::collections::BTreeSet::new(),
+            stable_core_tools: std::collections::HashSet::new(),
             capabilities: CapabilityManifest::new(),
             sections: ContextSectionRegistry::default_agent_sections(),
             memory_enabled: false, knowledge_enabled: false, plan_tool_enabled: false,
@@ -487,6 +498,38 @@ impl ContextManager {
         self.skills.set_available(skills);
     }
 
+    /// P1-B/D: set the stable-core tool ids (always exposed under skill gating). Replaces any prior.
+    pub fn set_stable_core_tools(&mut self, ids: impl IntoIterator<Item = CompactString>) {
+        self.stable_core_tools = ids.into_iter().collect();
+    }
+
+    /// P1-B: record that the model has loaded a skill (its content is now in context). Returns
+    /// `true` if this changed the active set — an epoch boundary the SDK can use to re-anchor the
+    /// prompt cache (D). No-op (returns false) when the skill was already active.
+    pub fn activate_skill(&mut self, name: impl Into<CompactString>) -> bool {
+        self.active_skills.insert(name.into())
+    }
+
+    /// P1-B: the tool-id allow-set to narrow the exposed toolset to, given the active skills.
+    /// Returns `None` ⇒ **do not narrow** (no skill active, or some active skill declares no
+    /// `allowed_tools` ⇒ unbounded, errs-open per D3). `Some(set)` ⇒ narrow to `set` (the union of
+    /// every active skill's declared tools). Meta-tools and stable-core are layered on in
+    /// `emit_call_llm`, not here.
+    pub fn active_skill_tool_filter(&self) -> Option<std::collections::HashSet<CompactString>> {
+        if self.active_skills.is_empty() {
+            return None;
+        }
+        let mut union = std::collections::HashSet::new();
+        for name in &self.active_skills {
+            let declared = self.skills.allowed_tools(name);
+            if declared.is_empty() {
+                return None; // an unrestricted active skill ⇒ no narrowing (D3)
+            }
+            union.extend(declared.iter().cloned());
+        }
+        Some(union)
+    }
+
     pub fn skill_tool_schema(&self) -> Option<ToolSchema> {
         self.skills.build_tool_schema()
     }
@@ -783,6 +826,39 @@ mod tests {
         assert!(mgr.sections.get("capabilities.inventory").is_some());
     }
 
+    #[test]
+    fn b1_active_skill_state_and_tool_filter() {
+        let mut mgr = ContextManager::new(1_000);
+        let mut debug = SkillMetadata::new("debug", "Debug helper");
+        debug.allowed_tools = vec![CompactString::new("read"), CompactString::new("grep")];
+        let mut review = SkillMetadata::new("review", "Reviewer");
+        review.allowed_tools = vec![CompactString::new("git_diff")];
+        let plain = SkillMetadata::new("plain", "No tools declared"); // empty allowed_tools
+        mgr.set_available_skills(vec![debug, review, plain]);
+
+        // No active skill ⇒ no narrowing.
+        assert!(mgr.active_skill_tool_filter().is_none());
+
+        // Activating returns the epoch-boundary changed flag.
+        assert!(mgr.activate_skill("debug"));
+        assert!(!mgr.activate_skill("debug")); // already active ⇒ no change
+
+        // One restricted skill ⇒ narrow to its tools.
+        let f = mgr.active_skill_tool_filter().unwrap();
+        assert_eq!(f.len(), 2);
+        assert!(f.contains(&CompactString::new("read")) && f.contains(&CompactString::new("grep")));
+
+        // Second restricted skill ⇒ union (D1).
+        mgr.activate_skill("review");
+        let f = mgr.active_skill_tool_filter().unwrap();
+        assert_eq!(f.len(), 3);
+        assert!(f.contains(&CompactString::new("git_diff")));
+
+        // An active skill with NO declared tools ⇒ unbounded ⇒ do not narrow (D3, errs-open).
+        mgr.activate_skill("plain");
+        assert!(mgr.active_skill_tool_filter().is_none());
+    }
+
     #[test]
     fn snapshot_hint_changes_when_capabilities_change() {
         let mut mgr = ContextManager::new(1_000);

{deepstrike-0.2.18 → deepstrike-0.2.20}/crates/deepstrike-core/src/context/skill_catalog.rs

@@ -47,6 +47,16 @@ impl SkillCatalog {
         self.available.len()
     }
 
+    /// P1-B tool gating: the tool ids the named skill declares it needs. Empty when the skill is
+    /// unknown or declares none (⇒ that skill does not narrow the toolset). The kernel unions these
+    /// across the active-skill set in `emit_call_llm`.
+    pub fn allowed_tools(&self, name: &str) -> &[CompactString] {
+        self.available
+            .get(name)
+            .map(|s| s.allowed_tools.as_slice())
+            .unwrap_or(&[])
+    }
+
     pub fn is_empty(&self) -> bool {
         self.available.is_empty()
     }
@@ -152,4 +162,20 @@ mod tests {
         assert_eq!(catalog.available_count(), 1);
         assert!(!catalog.is_empty());
     }
+
+    #[test]
+    fn allowed_tools_round_trip_through_catalog() {
+        // P1-B B0: a skill's declared `allowed_tools` survives registration and is looked up by name.
+        let mut skill = SkillMetadata::new("debug", "Debug helper");
+        skill.allowed_tools = vec![CompactString::new("read"), CompactString::new("grep")];
+        let mut catalog = SkillCatalog::new();
+        catalog.set_available(vec![skill]);
+
+        let tools = catalog.allowed_tools("debug");
+        assert_eq!(tools.len(), 2);
+        assert!(tools.iter().any(|t| t == "read"));
+        assert!(tools.iter().any(|t| t == "grep"));
+        // Unknown skill / skill with no declaration ⇒ empty (no narrowing).
+        assert!(catalog.allowed_tools("missing").is_empty());
+    }
 }

{deepstrike-0.2.18 → deepstrike-0.2.20}/crates/deepstrike-core/src/runtime/kernel.rs

@@ -115,6 +115,17 @@ pub enum KernelInputEvent {
     SetAvailableSkills {
         skills: Vec<SkillMetadata>,
     },
+    /// P1-B tool gating: the model loaded a skill (`name`). The SDK emits this when it resolves a
+    /// `skill` tool call. The kernel records it in the active-skill set and resolves the skill's
+    /// `allowed_tools` from the catalog to narrow the toolset on subsequent turns.
+    SkillActivated {
+        name: String,
+    },
+    /// P1-B/D: configure the stable-core tool ids (always exposed under skill gating). Set once by
+    /// the SDK; empty/absent ⇒ skills narrow to exactly their declared tools + meta-tools.
+    SetStableCoreTools {
+        tool_ids: Vec<String>,
+    },
     SetMemoryEnabled {
         enabled: bool,
     },
@@ -662,6 +673,16 @@ impl KernelRuntime {
                 self.sm.ctx.set_available_skills(skills);
                 return KernelStep::empty(self.sm.take_observations());
             }
+            KernelInputEvent::SkillActivated { name } => {
+                // B1: record the activation (B2 reads it in emit_call_llm to narrow tools).
+                // The returned `changed` flag is the epoch boundary for D's cache re-anchor.
+                self.sm.ctx.activate_skill(name);
+                return KernelStep::empty(self.sm.take_observations());
+            }
+            KernelInputEvent::SetStableCoreTools { tool_ids } => {
+                self.sm.ctx.set_stable_core_tools(tool_ids.into_iter().map(Into::into));
+                return KernelStep::empty(self.sm.take_observations());
+            }
             KernelInputEvent::SetMemoryEnabled { enabled } => {
                 self.sm.ctx.set_memory_enabled(enabled);
                 return KernelStep::empty(self.sm.take_observations());
@@ -1081,6 +1102,27 @@ mod tests {
         assert_eq!(runtime.state_machine().tools.len(), 1);
     }
 
+    #[test]
+    fn skill_activated_input_records_active_skill() {
+        // P1-B B1: the SkillActivated event (serde `skill_activated`) records the active skill and,
+        // via the catalog's declared tools, yields a narrowing filter — without itself acting.
+        let mut runtime = KernelRuntime::new(LoopPolicy::default());
+        let mut debug = SkillMetadata::new("debug", "Debug helper");
+        debug.allowed_tools = vec!["read".into(), "grep".into()];
+        runtime.step(KernelInput::new(KernelInputEvent::SetAvailableSkills {
+            skills: vec![debug],
+        }));
+
+        let step = runtime.step(KernelInput::new(KernelInputEvent::SkillActivated {
+            name: "debug".to_string(),
+        }));
+
+        assert!(step.actions.is_empty(), "activation is config, not an action");
+        assert!(runtime.state_machine().ctx.active_skills.contains("debug"));
+        let filter = runtime.state_machine().ctx.active_skill_tool_filter().unwrap();
+        assert_eq!(filter.len(), 2);
+    }
+
     #[test]
     fn update_task_input_mutates_task_state() {
         let mut runtime = KernelRuntime::new(LoopPolicy::default());

{deepstrike-0.2.18 → deepstrike-0.2.20}/crates/deepstrike-core/src/scheduler/state_machine/mod.rs

@@ -810,6 +810,20 @@ impl LoopStateMachine {
             });
         }
 
+        // P1-B epoch skill gating (applied *after* the run-level filter ③, so A is the outer bound
+        // and B narrows within it — D6). When skills are active and declare tools, expose only
+        // `meta-tools ∪ stable-core ∪ ⋃(active skills' allowed_tools)`. `None` ⇒ no active/declared
+        // skill ⇒ no narrowing (D3, errs-open). Meta-tools are always exempt (D5) so the model can
+        // still load more skills. Byte-stable within an epoch: the set only changes on activation.
+        if let Some(allowed) = self.ctx.active_skill_tool_filter() {
+            let stable = &self.ctx.stable_core_tools;
+            tools.retain(|tool| {
+                matches!(tool.name.as_str(), "skill" | "memory" | "knowledge" | "update_plan")
+                    || stable.contains(&tool.name)
+                    || allowed.contains(&tool.name)
+            });
+        }
+
         LoopAction::CallLLM { context, tools }
     }
 

{deepstrike-0.2.18 → deepstrike-0.2.20}/crates/deepstrike-core/src/scheduler/state_machine/tests.rs

@@ -306,6 +306,84 @@
         }
     }
 
+    /// P1-B B2: once a skill with declared `allowed_tools` is active, `emit_call_llm` exposes only
+    /// `meta-tools ∪ stable-core ∪ allowed_tools`. Meta-tools stay (D5); undeclared/inactive = full.
+    #[test]
+    fn active_skill_gates_exposed_tools_with_stable_core() {
+        let mut sm = sm();
+        sm.tools = vec![
+            make_tool_schema("read"),
+            make_tool_schema("write"),
+            make_tool_schema("bash"),
+            make_tool_schema("grep"),
+        ];
+        // A skill that declares only {read, grep}; stable-core keeps {bash}; `write` is gated out.
+        let mut debug = SkillMetadata::new("debug", "Debug helper");
+        debug.allowed_tools = vec![compact_str::CompactString::new("read"), compact_str::CompactString::new("grep")];
+        sm.ctx.set_available_skills(vec![debug]);
+        sm.ctx.set_stable_core_tools([compact_str::CompactString::new("bash")]);
+
+        // Before activation: all tools exposed (no narrowing).
+        match sm.start(RuntimeTask::new("go")) {
+            LoopAction::CallLLM { tools, .. } => {
+                let names: Vec<&str> = tools.iter().map(|t| t.name.as_str()).collect();
+                assert!(["read", "write", "bash", "grep"].iter().all(|n| names.contains(n)));
+                // skill meta-tool present (skills registered) and must survive gating later.
+                assert!(names.contains(&SKILL_TOOL_NAME));
+            }
+            _ => panic!("expected CallLLM"),
+        }
+
+        // Activate the skill → next emit narrows.
+        sm.ctx.activate_skill("debug");
+        match sm.emit_call_llm() {
+            LoopAction::CallLLM { tools, .. } => {
+                let names: Vec<&str> = tools.iter().map(|t| t.name.as_str()).collect();
+                assert!(names.contains(&"read") && names.contains(&"grep"), "declared: {names:?}");
+                assert!(names.contains(&"bash"), "stable-core kept: {names:?}");
+                assert!(names.contains(&SKILL_TOOL_NAME), "meta-tool exempt: {names:?}");
+                assert!(!names.contains(&"write"), "undeclared gated out: {names:?}");
+            }
+            _ => panic!("expected CallLLM"),
+        }
+    }
+
+    /// P1-B B4: the gated toolset is byte-stable *within* an epoch (no active-set change ⇒ identical
+    /// tools every turn — the cache prefix never churns mid-epoch) and changes only when the active
+    /// set changes (the single epoch boundary where D re-anchors the cache).
+    #[test]
+    fn gating_is_byte_stable_within_an_epoch() {
+        fn names(action: LoopAction) -> Vec<String> {
+            match action {
+                LoopAction::CallLLM { tools, .. } => {
+                    let mut n: Vec<String> = tools.iter().map(|t| t.name.to_string()).collect();
+                    n.sort();
+                    n
+                }
+                _ => panic!("expected CallLLM"),
+            }
+        }
+        let mut sm = sm();
+        sm.tools = vec![make_tool_schema("read"), make_tool_schema("write"), make_tool_schema("grep")];
+        let mut debug = SkillMetadata::new("debug", "d");
+        debug.allowed_tools = vec![compact_str::CompactString::new("read")];
+        let mut review = SkillMetadata::new("review", "r");
+        review.allowed_tools = vec![compact_str::CompactString::new("grep")];
+        sm.ctx.set_available_skills(vec![debug, review]);
+
+        sm.start(RuntimeTask::new("go"));
+        sm.ctx.activate_skill("debug");
+        let n1 = names(sm.emit_call_llm());
+        let n2 = names(sm.emit_call_llm()); // no activation change → identical
+        assert_eq!(n1, n2, "toolset must be byte-stable within an epoch");
+        assert!(n1.contains(&"read".to_string()) && !n1.contains(&"write".to_string()));
+
+        sm.ctx.activate_skill("review"); // epoch boundary
+        let n3 = names(sm.emit_call_llm());
+        assert_ne!(n1, n3, "activating another skill changes the toolset");
+        assert!(n3.contains(&"grep".to_string()), "union now includes review's tools: {n3:?}");
+    }
+
     #[test]
     fn skill_tool_injected_in_call_llm_when_skills_registered() {
         let mut sm = sm();
@@ -332,6 +410,69 @@
         }
     }
 
+    /// P0-A (tool gating): a top-level run carrying an `AgentRunSpec` with a
+    /// capability filter must only expose the allow-listed tools each turn — the
+    /// static per-run profile. The filter is an allow-list (empty = allow all),
+    /// applied in `emit_call_llm`, and is byte-stable across the run, so it never
+    /// busts the cache prefix. Gates the same path sub-agents already use.
+    #[test]
+    fn top_level_run_capability_filter_gates_exposed_tools() {
+        use crate::types::agent::{
+            AgentCapabilityFilter, AgentIdentity, AgentRole, AgentRunSpec,
+        };
+        let mut sm = sm();
+        sm.tools = vec![
+            make_tool_schema("read"),
+            make_tool_schema("write"),
+            make_tool_schema("bash"),
+            make_tool_schema("search"),
+        ];
+        // Static profile: only `read` + `search` are exposed for this run.
+        let mut spec = AgentRunSpec::new(
+            AgentIdentity::new("root", "root-session"),
+            AgentRole::Custom,
+            "do the task",
+        );
+        spec.capability_filter = AgentCapabilityFilter {
+            allowed_kinds: Vec::new(),
+            allowed_ids: vec![
+                compact_str::CompactString::new("read"),
+                compact_str::CompactString::new("search"),
+            ],
+        };
+        sm.run_spec = Some(spec);
+
+        match sm.start(RuntimeTask::new("do the task")) {
+            LoopAction::CallLLM { tools, .. } => {
+                let names: Vec<&str> = tools.iter().map(|t| t.name.as_str()).collect();
+                assert!(names.contains(&"read"), "read should be exposed: {names:?}");
+                assert!(names.contains(&"search"), "search should be exposed: {names:?}");
+                assert!(!names.contains(&"write"), "write must be gated out: {names:?}");
+                assert!(!names.contains(&"bash"), "bash must be gated out: {names:?}");
+            }
+            _ => panic!("expected CallLLM"),
+        }
+    }
+
+    /// Counterpart: with no run spec (the default top-level run), every base tool
+    /// is exposed — i.e. gating is strictly opt-in (铁律: no config = old behavior).
+    #[test]
+    fn top_level_run_without_spec_exposes_all_tools() {
+        let mut sm = sm();
+        sm.tools = vec![
+            make_tool_schema("read"),
+            make_tool_schema("write"),
+            make_tool_schema("bash"),
+        ];
+        match sm.start(RuntimeTask::new("do the task")) {
+            LoopAction::CallLLM { tools, .. } => {
+                let names: Vec<&str> = tools.iter().map(|t| t.name.as_str()).collect();
+                assert!(names.contains(&"read") && names.contains(&"write") && names.contains(&"bash"));
+            }
+            _ => panic!("expected CallLLM"),
+        }
+    }
+
     #[test]
     fn compression_emits_observation() {
         let mut sm = LoopStateMachine::new(LoopPolicy {

{deepstrike-0.2.18 → deepstrike-0.2.20}/deepstrike/__init__.py

@@ -43,6 +43,16 @@ from deepstrike.runtime import (
     default_sub_agent_orchestrator,
     DEFAULT_SANDBOX_POLICY,
     validate_declarative_policy,
+    ReplayProvider,
+    ReplayProviderOpts,
+    extract_recorded_messages,
+    Criterion,
+    Verdict,
+    VerdictDetail,
+    judge,
+    build_eval_messages,
+    parse_verdict,
+    verdict_output_schema,
 )
 from deepstrike.governance import Governance, GovernanceVerdict
 from deepstrike.providers import (

{deepstrike-0.2.18 → deepstrike-0.2.20}/deepstrike/runtime/__init__.py

@@ -7,6 +7,7 @@ from deepstrike.runtime.runner import (
   RuntimeOptions,
   RuntimeRunner,
   SubAgentHarnessConfig,
+  TurnMetrics,
   collect_text,
 )
 from deepstrike.runtime.session_log import (
@@ -60,10 +61,22 @@ from deepstrike.runtime.os_profile import (
   os_profile,
   validate_declarative_policy,
 )
+from deepstrike.runtime.replay_provider import ReplayProvider, ReplayProviderOpts
+from deepstrike.runtime.replay_fixture import extract_recorded_messages
+from deepstrike.runtime.eval import (
+  Criterion,
+  Verdict,
+  VerdictDetail,
+  judge,
+  build_eval_messages,
+  parse_verdict,
+  verdict_output_schema,
+)
 
 __all__ = [
   "RuntimeRunner",
   "RuntimeOptions",
+  "TurnMetrics",
   "ResourceQuota",
   "MemoryPolicy",
   "MemoryWriteRateLimit",
@@ -116,4 +129,14 @@ __all__ = [
   "assert_native_profile",
   "os_profile",
   "validate_declarative_policy",
+  "ReplayProvider",
+  "ReplayProviderOpts",
+  "extract_recorded_messages",
+  "Criterion",
+  "Verdict",
+  "VerdictDetail",
+  "judge",
+  "build_eval_messages",
+  "parse_verdict",
+  "verdict_output_schema",
 ]

deepstrike-0.2.20/deepstrike/runtime/eval.py

@@ -0,0 +1,110 @@
+"""`judge()` — one-shot quality scoring against a goal + criteria.
+
+Python port of node/src/runtime/eval.ts. Wraps the kernel's `gen_eval` free functions
+(`build_eval_messages` / `parse_verdict` / `verdict_output_schema`) into a small typed
+surface so callers can score one (goal, criteria, result) pair without standing up
+HarnessLoop.
+
+Single LLM call: build the eval prompt → stream → parse verdict.
+"""
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass, field
+from typing import Any
+
+from deepstrike._kernel import (  # type: ignore
+    Message,
+    build_eval_messages as _kernel_build_eval_messages,
+    parse_verdict as _kernel_parse_verdict,
+    verdict_output_schema as _kernel_verdict_output_schema,
+)
+from deepstrike.providers.base import LLMProvider, RenderedContext  # type: ignore
+
+
+@dataclass
+class Criterion:
+    text: str
+    required: bool = True
+    weight: float | None = None
+
+
+@dataclass
+class VerdictDetail:
+    criterion: str
+    passed: bool
+    score: float
+    feedback: str
+
+
+@dataclass
+class Verdict:
+    passed: bool
+    overall_score: float
+    feedback: str
+    details: list[VerdictDetail] = field(default_factory=list)
+
+
+def build_eval_messages(goal: str, criteria: list[Criterion], result: str) -> list[Message]:
+    """Render the kernel's eval prompt for (goal, criteria, result)."""
+    native_criteria = [
+        {"text": c.text, "required": c.required, **({"weight": c.weight} if c.weight is not None else {})}
+        for c in criteria
+    ]
+    return _kernel_build_eval_messages(goal, native_criteria, result, 1, False)
+
+
+def parse_verdict(text: str) -> Verdict:
+    """Parse a Verdict from raw judge-LLM text."""
+    raw = _kernel_parse_verdict(text)
+    details_raw = raw.get("details") if isinstance(raw, dict) else getattr(raw, "details", None)
+    details: list[VerdictDetail] = []
+    for d in details_raw or []:
+        if isinstance(d, dict):
+            details.append(VerdictDetail(
+                criterion=d.get("criterion", ""),
+                passed=bool(d.get("passed", False)),
+                score=float(d.get("score", 0.0)),
+                feedback=d.get("feedback", ""),
+            ))
+    if isinstance(raw, dict):
+        return Verdict(
+            passed=bool(raw.get("passed", False)),
+            overall_score=float(raw.get("overallScore", raw.get("overall_score", 0.0))),
+            feedback=raw.get("feedback", ""),
+            details=details,
+        )
+    return Verdict(
+        passed=bool(getattr(raw, "passed", False)),
+        overall_score=float(getattr(raw, "overall_score", 0.0)),
+        feedback=getattr(raw, "feedback", ""),
+        details=details,
+    )
+
+
+def verdict_output_schema() -> dict[str, Any]:
+    """The JSON Schema the kernel expects judge output to conform to."""
+    return json.loads(_kernel_verdict_output_schema(False))
+
+
+async def judge(
+    provider: LLMProvider,
+    goal: str,
+    criteria: list[Criterion],
+    result: str,
+) -> Verdict:
+    """Run one judge pass: render eval prompt, stream the provider, parse the verdict."""
+    msgs = build_eval_messages(goal, criteria, result)
+    sys_text = "\n\n".join(m.get("content", "") if isinstance(m, dict) else getattr(m, "content", "")
+                           for m in msgs
+                           if (m.get("role") if isinstance(m, dict) else getattr(m, "role", None)) == "system")
+    turns = [m for m in msgs if (m.get("role") if isinstance(m, dict) else getattr(m, "role", None)) != "system"]
+    ctx: RenderedContext = {"systemText": sys_text, "turns": turns}  # type: ignore[assignment]
+
+    text = ""
+    async for evt in provider.stream(ctx, [], None):
+        if (evt.get("type") if isinstance(evt, dict) else getattr(evt, "type", None)) == "text_delta":
+            text += (evt.get("delta") if isinstance(evt, dict) else getattr(evt, "delta", "")) or ""
+    if not text:
+        raise RuntimeError("judge: provider produced no text")
+    return parse_verdict(text)

{deepstrike-0.2.18 → deepstrike-0.2.20}/deepstrike/runtime/kernel_step.py

@@ -76,6 +76,10 @@ def skill_metadata_to_kernel(skill: Any) -> dict[str, Any]:
     out["when_to_use"] = when_to_use
   if effort is not None:
     out["effort"] = effort
+  # P1-B: forward declared tool ids (additive; omitted when empty so existing skills' wire is unchanged).
+  allowed_tools = getattr(skill, "allowed_tools", None)
+  if allowed_tools:
+    out["allowed_tools"] = list(allowed_tools)
   return out