deepstrike 0.2.73__tar.gz → 0.2.75__tar.gz

{deepstrike-0.2.73 → deepstrike-0.2.75}/Cargo.lock

@@ -254,7 +254,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-core"
-version = "0.2.73"
+version = "0.2.75"
 dependencies = [
  "compact_str",
  "deepstrike-tokenizer",
@@ -268,7 +268,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-node"
-version = "0.2.73"
+version = "0.2.75"
 dependencies = [
  "compact_str",
  "deepstrike-core",
@@ -280,7 +280,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-py"
-version = "0.2.73"
+version = "0.2.75"
 dependencies = [
  "compact_str",
  "deepstrike-core",
@@ -291,10 +291,11 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-sdk"
-version = "0.2.73"
+version = "0.2.75"
 dependencies = [
  "async-stream",
  "async-trait",
+ "base64 0.22.1",
  "bytes",
  "compact_str",
  "deepstrike-core",
@@ -327,7 +328,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-tokenizer"
-version = "0.2.73"
+version = "0.2.75"
 dependencies = [
  "pretty_assertions",
  "tiktoken-rs",
@@ -335,7 +336,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-wasm"
-version = "0.2.73"
+version = "0.2.75"
 dependencies = [
  "compact_str",
  "deepstrike-core",

{deepstrike-0.2.73 → deepstrike-0.2.75}/Cargo.toml

@@ -3,13 +3,13 @@ resolver = "2"
 members = ["crates/deepstrike-core", "crates/deepstrike-tokenizer", "crates/deepstrike-py"]
 
 [workspace.package]
-version = "0.2.73"
+version = "0.2.75"
 edition = "2024"
 repository = "https://github.com/kongusen/deepstrike"
 
 [workspace.dependencies]
-deepstrike-core = { path = "crates/deepstrike-core", version = "0.2.73" }
-deepstrike-tokenizer = { path = "crates/deepstrike-tokenizer", version = "0.2.73" }
+deepstrike-core = { path = "crates/deepstrike-core", version = "0.2.75" }
+deepstrike-tokenizer = { path = "crates/deepstrike-tokenizer", version = "0.2.75" }
 notify = "6"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

{deepstrike-0.2.73 → deepstrike-0.2.75}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepstrike
-Version: 0.2.73
+Version: 0.2.75
 Requires-Dist: httpx>=0.27
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: anyio>=4.0

{deepstrike-0.2.73 → deepstrike-0.2.75}/crates/deepstrike-core/src/context/manager.rs

@@ -994,6 +994,17 @@ impl ContextManager {
             .is_none()
     }
 
+    /// A refused `skill` activation: withdraw the `skill:<name>` knowledge the host staged for it,
+    /// unless the skill is already active under an earlier admission.
+    pub fn retract_refused_skill(&mut self, name: &str) -> bool {
+        if self.active_skills.contains_key(name) {
+            return false;
+        }
+        self.partitions
+            .knowledge
+            .retract_staged(&format!("skill:{name}"))
+    }
+
     /// K3: deactivate a skill — the toolset re-widens at the next `emit_call_llm` (an epoch event,
     /// same cache cost class as activation) and the skill's `skill:<name>` knowledge pin is marked
     /// for the next boundary sweep. Errs-open: not-active is a no-op (returns false).

{deepstrike-0.2.73 → deepstrike-0.2.75}/crates/deepstrike-core/src/context/partitions.rs

@@ -209,6 +209,29 @@ impl KnowledgePartition {
         }))
     }
 
+    /// Withdraw content staged under `key` for something the kernel then refused (a skill whose
+    /// activation was rejected). A freshly appended entry has never been rendered, so it is dropped
+    /// outright; an existing entry keeps its rendered bytes, loses the staged upsert, and leaves at
+    /// the next boundary. Returns whether anything was withdrawn.
+    pub fn retract_staged(&mut self, key: &str) -> bool {
+        let Some(index) = self
+            .entries
+            .iter()
+            .position(|entry| entry.key.as_deref() == Some(key))
+        else {
+            return false;
+        };
+        let entry = &mut self.entries[index];
+        if entry.pending.take().is_some() {
+            entry.evict_at_boundary = true;
+            return true;
+        }
+        let tokens = entry.tokens;
+        self.entries.remove(index);
+        self.token_count = self.token_count.saturating_sub(tokens);
+        true
+    }
+
     /// Mark the keyed entry for removal at the next boundary. Errs-open: unknown key is a no-op.
     /// Returns whether a matching entry was marked.
     pub fn remove(&mut self, key: &str) -> bool {

{deepstrike-0.2.73 → deepstrike-0.2.75}/crates/deepstrike-core/src/governance/pipeline.rs

@@ -14,6 +14,8 @@ pub struct GovernancePipeline {
     pub veto: VetoAuthority,
     pub rate_limiter: RateLimiter,
     pub constraints: ConstraintValidator,
+    /// Withhold statically denied tools from the provider surface (see [`Self::denies_tool`]).
+    pub hide_denied_tools: bool,
 }
 
 fn severity(v: &GovernanceVerdict) -> u8 {
@@ -32,9 +34,28 @@ impl GovernancePipeline {
             veto: VetoAuthority::new(),
             rate_limiter: RateLimiter::default(),
             constraints: ConstraintValidator::new(),
+            hide_denied_tools: false,
         }
     }
 
+    /// Whether every call to `name` is denied regardless of its arguments or timing — a veto or a
+    /// `deny` permission. Argument constraints and rate limits are per-call, and `ask_user` is a
+    /// runtime decision, so none of them make a tool statically unusable.
+    pub fn denies_tool(&self, name: &str) -> bool {
+        let probe = ToolCall {
+            id: "governance-surface".into(),
+            name: name.into(),
+            arguments: serde_json::Value::Null,
+        };
+        matches!(
+            self.veto.check(&probe),
+            Some(GovernanceVerdict::Deny { .. })
+        ) || matches!(
+            self.permission.check(&probe),
+            Some(GovernanceVerdict::Deny { .. })
+        )
+    }
+
     /// Set the current timestamp for rate limiting.
     pub fn set_time(&mut self, now_ms: u64) {
         self.rate_limiter.set_time(now_ms);

{deepstrike-0.2.73 → deepstrike-0.2.75}/crates/deepstrike-core/src/mm/memory.rs

@@ -393,6 +393,65 @@ pub struct MemoryRecallLifecycle {
     pub last_recalled_at: u64,
 }
 
+/// What the host's store holds for one record it just recalled — the only input the recall
+/// lifecycle needs. The store reports state; it never reports the *next* state.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct MemoryRecallPrior {
+    pub record_id: String,
+    #[serde(default)]
+    pub recall_count: u64,
+    #[serde(default)]
+    pub pinned: bool,
+}
+
+/// A recalled record whose count crossed the promotion threshold on this recall (M4).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct MemoryPromotion {
+    pub record_id: String,
+    pub recall_count: u64,
+}
+
+/// M3/M4 · the one derivation of a recall's lifecycle, shared by the model's `query_memory`
+/// syscall and every host recall route.
+///
+/// Each distinct record counts once per derivation however many hits named it, so a prefetch that
+/// issues several overlapping queries cannot inflate a count. Promotion is edge-triggered — it is
+/// suggested on the recall that crosses the threshold, never again on later ones — and a pinned
+/// record is never suggested, because it is already where a promotion would put it.
+pub fn derive_recall_lifecycle(
+    priors: &[MemoryRecallPrior],
+    recalled_at: u64,
+    promotion_threshold: Option<u64>,
+) -> (Vec<MemoryRecallLifecycle>, Vec<MemoryPromotion>) {
+    let mut seen = std::collections::BTreeSet::new();
+    let mut recalls = Vec::with_capacity(priors.len());
+    let mut promotions = Vec::new();
+    for prior in priors {
+        if !seen.insert(prior.record_id.as_str()) {
+            continue;
+        }
+        let recall_count = prior.recall_count.saturating_add(1);
+        recalls.push(MemoryRecallLifecycle {
+            record_id: prior.record_id.clone(),
+            recall_count,
+            last_recalled_at: recalled_at,
+        });
+        if let Some(threshold) = promotion_threshold
+            && !prior.pinned
+            && prior.recall_count < threshold
+            && recall_count >= threshold
+        {
+            promotions.push(MemoryPromotion {
+                record_id: prior.record_id.clone(),
+                recall_count,
+            });
+        }
+    }
+    (recalls, promotions)
+}
+
 /// Memory validation error.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(tag = "error_kind", rename_all = "snake_case")]
@@ -770,4 +829,52 @@ mod tests {
         ));
         assert_eq!(store.len(), 1);
     }
+
+    fn prior(record_id: &str, recall_count: u64, pinned: bool) -> MemoryRecallPrior {
+        MemoryRecallPrior {
+            record_id: record_id.into(),
+            recall_count,
+            pinned,
+        }
+    }
+
+    #[test]
+    fn a_recall_counts_each_record_once_and_suggests_promotion_only_on_the_crossing() {
+        let (recalls, promotions) = derive_recall_lifecycle(
+            &[
+                prior("crossing", 2, false),
+                prior("crossing", 2, false),
+                prior("already_past", 3, false),
+                prior("pinned", 2, true),
+                prior("fresh", 0, false),
+            ],
+            42,
+            Some(3),
+        );
+        assert_eq!(
+            recalls
+                .iter()
+                .map(|recall| (recall.record_id.as_str(), recall.recall_count))
+                .collect::<Vec<_>>(),
+            vec![
+                ("crossing", 3),
+                ("already_past", 4),
+                ("pinned", 3),
+                ("fresh", 1)
+            ]
+        );
+        assert!(recalls.iter().all(|recall| recall.last_recalled_at == 42));
+        assert_eq!(
+            promotions,
+            vec![MemoryPromotion {
+                record_id: "crossing".into(),
+                recall_count: 3
+            }]
+        );
+        assert!(
+            derive_recall_lifecycle(&[prior("crossing", 2, false)], 1, None)
+                .1
+                .is_empty()
+        );
+    }
 }

{deepstrike-0.2.73 → deepstrike-0.2.75}/crates/deepstrike-core/src/orchestration/workflow/run.rs

@@ -320,6 +320,11 @@ impl WorkflowRun {
         self.graph.ready_tasks()
     }
 
+    /// Whether every workflow node has reached a terminal state.
+    pub fn is_complete(&self) -> bool {
+        self.graph.all_done()
+    }
+
     pub fn set_scheduler_policy(
         &mut self,
         policy: crate::scheduler::policy::SchedulerPolicyConfig,
@@ -1002,12 +1007,6 @@ impl WorkflowRun {
         })
     }
 
-    /// Test instrument: every node reached one of the four terminal statuses.
-    #[cfg(test)]
-    pub(crate) fn is_complete(&self) -> bool {
-        self.graph.all_done()
-    }
-
     /// Close a workflow and return exactly one typed terminal outcome per graph node.
     pub fn finish(&mut self) -> Vec<WorkflowNodeOutcome> {
         for node in 0..self.graph.len() {

{deepstrike-0.2.73 → deepstrike-0.2.75}/crates/deepstrike-core/src/runtime/chain_validator/mod.rs

@@ -2097,6 +2097,8 @@ mod tests {
                             ),
                             tokens: Some(64),
                             tool_call_id: None,
+                            is_error: false,
+                            tool_calls: Vec::new(),
                         })
                         .collect(),
                     ..InitialContext::default()
@@ -2184,6 +2186,7 @@ mod tests {
                                     Vec::new()
                                 },
                                 tool_call_id: None,
+                                is_error: false,
                                 tokens: None,
                             },
                             observed_input_tokens: None,

{deepstrike-0.2.73 → deepstrike-0.2.75}/crates/deepstrike-core/src/runtime/kernel/observation.rs

@@ -76,6 +76,14 @@ pub enum KernelObservation {
         subject: Option<String>,
         reason: String,
     },
+    /// A model `skill` syscall the kernel admitted. Hosts pin the skill's content only on this
+    /// fact, never on the raw call: activation is a capability mutation the kernel adjudicates.
+    SkillAdmitted {
+        turn: u32,
+        name: String,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        expires_at_turn: Option<u32>,
+    },
     CapabilityChanged {
         turn: u32,
         #[serde(default, skip_serializing_if = "Vec::is_empty")]
@@ -236,6 +244,31 @@ pub enum KernelObservation {
         #[serde(default, skip_serializing_if = "Option::is_none")]
         submitter: Option<String>,
     },
+    /// The host's dynamic plan was accepted and bound to this kernel workflow transition. The
+    /// canonical DAG remains authoritative for scheduling; this fact preserves replay identity,
+    /// dependencies and the host's replay disposition in the journal.
+    DynamicWorkflowPlanCommitted {
+        turn: u32,
+        run_id: String,
+        sequence: u32,
+        node_ids: Vec<String>,
+        dependencies: Vec<Vec<String>>,
+        prompt_fingerprints: Vec<String>,
+        replay: Vec<String>,
+    },
+    /// A dynamic invocation replay decision observed by the kernel.
+    DynamicWorkflowReplayRecorded {
+        turn: u32,
+        run_id: String,
+        sequence: u32,
+        node_id: String,
+        prompt_fingerprint: String,
+        status: String,
+        replay: String,
+        result_digest: String,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        termination: Option<String>,
+    },
     /// A runtime node batch was rejected before any graph mutation.
     NodesRejected {
         turn: u32,

{deepstrike-0.2.73 → deepstrike-0.2.75}/crates/deepstrike-core/src/runtime/kernel/wire/command.rs

@@ -2,7 +2,7 @@
 
 use serde::{Deserialize, Serialize};
 
-use super::root::{CapabilityGrant, CapabilityRef, KnowledgeEntry};
+use super::root::{CapabilityGrant, CapabilityRef, KnowledgeEntry, WorkflowNode};
 use super::scalar::{CallId, WireU64};
 
 /// Live commands a host may issue against a running operation.
@@ -22,6 +22,15 @@ pub enum HostCommand {
     Cancel(CancelCommand),
     ForceCompact(ForceCompactCommand),
     UpdateTask(UpdateTaskCommand),
+    /// Dynamic workflow controller growth. The host remains the author of the request, while the
+    /// kernel still owns DAG validation, quota gating, trust coercion, scheduling, and durable
+    /// spawn facts. This is intentionally separate from the model-facing append syscall: it has
+    /// host authority and no caller-supplied agent identity.
+    AppendWorkflowNodes(AppendWorkflowNodesCommand),
+    /// A host replay decision recorded in the canonical journal alongside workflow facts.
+    RecordDynamicWorkflowReplay(DynamicWorkflowReplayCommand),
+    /// Close a host-driven dynamic workflow after its script and all submitted batches settle.
+    CompleteDynamicWorkflow(CompleteDynamicWorkflowCommand),
     ApplyCapabilityPatch(ApplyCapabilityPatchCommand),
     ApplyKnowledgeMutation(ApplyKnowledgeMutationCommand),
     /// DEC-9: the host seeding entries into the knowledge partition. Named apart from the P1
@@ -34,6 +43,12 @@ pub enum HostCommand {
     ApplySkillActivation(ApplySkillActivationCommand),
     ApplyPolicyPatch(ApplyPolicyPatchCommand),
     UpdateDeadline(UpdateDeadlineCommand),
+    /// §22.13 · a memory write the host authored while this operation runs (a session extract, a
+    /// semantic archive summary). The host still performs the I/O; the kernel is the one that says
+    /// whether the write may happen, by the same validation rule and the same rolling write quota
+    /// the model's `write_memory` syscall answers to. A refusal is journaled as
+    /// `memory_validation_failed`; an admitted write journals nothing and the host persists it.
+    AdmitMemoryWrite(AdmitMemoryWriteCommand),
 }
 
 /// Cancellation. The operation id lives in the envelope and is **not** repeated here: the
@@ -67,6 +82,52 @@ pub struct UpdateTaskCommand {
     pub update: TaskUpdate,
 }
 
+#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct AppendWorkflowNodesCommand {
+    pub nodes: Vec<WorkflowNode>,
+    /// Host-generated plan metadata. The kernel records it, but scheduling remains driven by the
+    /// canonical DAG built from `nodes`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub plan: Option<DynamicWorkflowPlan>,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct DynamicWorkflowPlan {
+    pub run_id: String,
+    pub sequence: u32,
+    pub nodes: Vec<DynamicWorkflowPlanNode>,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct DynamicWorkflowPlanNode {
+    pub node_id: String,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub depends_on: Vec<String>,
+    pub prompt_fingerprint: String,
+    pub replay: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct DynamicWorkflowReplayCommand {
+    pub run_id: String,
+    pub sequence: u32,
+    pub node_id: String,
+    pub prompt_fingerprint: String,
+    pub status: String,
+    pub replay: String,
+    pub result_digest: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub termination: Option<String>,
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct CompleteDynamicWorkflowCommand {}
+
 /// A partial edit of the task state. Every field is optional; absent ⇒ unchanged.
 #[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
@@ -126,6 +187,16 @@ pub struct SeedKnowledgeCommand {
     pub entries: Vec<KnowledgeEntry>,
 }
 
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct AdmitMemoryWriteCommand {
+    /// The host's record id, named by the audit fact when the write is refused.
+    pub record_id: String,
+    pub name: String,
+    /// UTF-8 byte length of the content the host intends to persist.
+    pub content_bytes: u32,
+}
+
 /// §13.2 · skill activation state. Both directions in one command so a swap is atomic.
 #[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
@@ -210,6 +281,11 @@ pub struct GovernancePolicy {
     pub rate_limits: Vec<RateLimitSpec>,
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub constraints: Vec<ParamConstraint>,
+    /// Withhold tools this policy statically denies (veto or `deny` permission) from the provider
+    /// surface, and say so once in the knowledge slot. The kernel decides the hidden set with the
+    /// same rules that enforce the calls, so the surface and the gate cannot disagree.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub hide_denied_tools: Option<bool>,
 }
 
 /// Per-tool rolling-window rate limit.
@@ -503,6 +579,9 @@ impl LivePolicyPatch {
                 next.governance_policy.vetoed_tools = policy.vetoed_tools.clone();
                 next.governance_policy.rate_limits = policy.rate_limits.clone();
                 next.governance_policy.constraints = policy.constraints.clone();
+                next.governance_policy.hide_denied_tools = policy
+                    .hide_denied_tools
+                    .unwrap_or(current.governance_policy.hide_denied_tools);
                 super::config::validate_governance(
                     &next.governance_policy,
                     current.kernel_limits.collection_limits.governance_rules,

{deepstrike-0.2.73 → deepstrike-0.2.75}/crates/deepstrike-core/src/runtime/kernel/wire/config.rs

@@ -659,6 +659,8 @@ pub struct ResolvedGovernancePolicy {
     pub vetoed_tools: Vec<String>,
     pub rate_limits: Vec<super::command::RateLimitSpec>,
     pub constraints: Vec<super::command::ParamConstraint>,
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub hide_denied_tools: bool,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
@@ -831,6 +833,56 @@ pub struct ResolvedMemoryPolicy {
     pub promotion_recall_threshold: Option<WireU64>,
 }
 
+impl ResolvedMemoryPolicy {
+    /// The baseline every operation starts from, and the policy a host without a live operation
+    /// is judged by when it names none.
+    pub const DEFAULT: Self = Self {
+        stale_warning_days: 2,
+        retrieval_top_k: 5,
+        validation_enabled: true,
+        max_content_bytes: 10_000,
+        max_name_length: 100,
+        promotion_recall_threshold: None,
+    };
+
+    /// §22.13 · the one admission rule for a memory write, whoever proposes it.
+    ///
+    /// The model's `write_memory` syscall, a host write inside a live operation and a host write
+    /// with no operation at all are judged by this function and nothing else — historically each
+    /// SDK carried its own copy, and the copies disagreed about bytes versus characters, about
+    /// which fields were required, and about whether the model's path was checked at all.
+    ///
+    /// The content is judged by its UTF-8 byte length, so a host need not ship a body across the
+    /// boundary just to have it measured.
+    pub fn check_write(&self, name: &str, content_bytes: usize) -> Result<(), String> {
+        if !self.validation_enabled {
+            return Ok(());
+        }
+        if name.trim().is_empty() {
+            return Err("memory name must not be empty".to_string());
+        }
+        if name.chars().count() > self.max_name_length as usize {
+            return Err(format!(
+                "memory name exceeds {} characters",
+                self.max_name_length
+            ));
+        }
+        if content_bytes > self.max_content_bytes as usize {
+            return Err(format!(
+                "memory content exceeds {} bytes",
+                self.max_content_bytes
+            ));
+        }
+        Ok(())
+    }
+
+    /// The same resolution an operation's genesis applies, for a host that holds a policy but no
+    /// live operation: absent fields fall back to [`Self::DEFAULT`] and the same invariants hold.
+    pub fn resolve(policy: Option<&MemoryPolicy>) -> Result<Self, WireRejection> {
+        resolve_memory_policy(policy, &Self::DEFAULT)
+    }
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct ResolvedFeaturePolicy {
@@ -887,6 +939,7 @@ impl ConfigDefaults {
                     vetoed_tools: Vec::new(),
                     rate_limits: Vec::new(),
                     constraints: Vec::new(),
+                    hide_denied_tools: false,
                 },
                 scheduler_policy: ResolvedSchedulerPolicy {
                     critical_path_weight: 1_000_000,
@@ -948,14 +1001,7 @@ impl ConfigDefaults {
                     },
                 },
                 memory_access: None,
-                memory_policy: ResolvedMemoryPolicy {
-                    stale_warning_days: 2,
-                    retrieval_top_k: 5,
-                    validation_enabled: true,
-                    max_content_bytes: 10_000,
-                    max_name_length: 100,
-                    promotion_recall_threshold: None,
-                },
+                memory_policy: ResolvedMemoryPolicy::DEFAULT,
                 tool_catalog: Vec::new(),
                 skill_catalog: Vec::new(),
                 verification_contracts: Vec::new(),
@@ -1525,6 +1571,7 @@ fn resolve_governance(
         resolved.vetoed_tools = policy.vetoed_tools.clone();
         resolved.rate_limits = policy.rate_limits.clone();
         resolved.constraints = policy.constraints.clone();
+        resolved.hide_denied_tools = policy.hide_denied_tools.unwrap_or(false);
     }
     validate_governance(&resolved, rule_bound)?;
     Ok(resolved)
@@ -2150,6 +2197,7 @@ mod tests {
                     tool: "write".to_string(),
                     param_path: "destination".to_string(),
                 })],
+                hide_denied_tools: None,
             }),
             scheduler_policy: Some(SchedulerPolicy {
                 critical_path_weight: Some(900_000),
@@ -2440,6 +2488,7 @@ mod tests {
                         window_ms: WireU64::new(1_000),
                     }],
                     constraints: Vec::new(),
+                    hide_denied_tools: None,
                 },
             }),
             LivePolicyPatch::TightenResourceQuota(TightenResourceQuota {

{deepstrike-0.2.73 → deepstrike-0.2.75}/crates/deepstrike-core/src/runtime/kernel/wire/crash_point.rs

@@ -342,6 +342,7 @@ fn provider_result(
                     content: String::new(),
                     tool_calls: calls,
                     tool_call_id: None,
+                    is_error: false,
                     tokens: None,
                 },
                 observed_input_tokens: None,
@@ -394,6 +395,7 @@ fn provider_answer(id: &str, at: u64, effect: &EffectId, text: &str) -> WireEnve
                     content: text.to_string(),
                     tool_calls: Vec::new(),
                     tool_call_id: None,
+                    is_error: false,
                     tokens: None,
                 },
                 observed_input_tokens: None,

{deepstrike-0.2.73 → deepstrike-0.2.75}/crates/deepstrike-core/src/runtime/kernel/wire/driver/continuation.rs

@@ -412,6 +412,24 @@ impl CanonicalOperationDriver {
         if let Some(output_schema) = &info.output_schema {
             metadata.insert("output_schema".to_string(), output_schema.clone());
         }
+        if let Some(token_budget) = info.token_budget {
+            metadata.insert(
+                "token_budget".to_string(),
+                serde_json::Value::Number(token_budget.into()),
+            );
+        }
+        if let Some(max_turns) = info.max_turns {
+            metadata.insert(
+                "max_turns".to_string(),
+                serde_json::Value::Number(max_turns.into()),
+            );
+        }
+        if let Some(max_wall_ms) = info.max_wall_ms {
+            metadata.insert(
+                "max_wall_ms".to_string(),
+                serde_json::Value::Number(max_wall_ms.into()),
+            );
+        }
         if !info.input_agent_ids.is_empty() {
             metadata.insert(
                 "input_agent_ids".to_string(),