tangle-network · drewstone · Sep 5, 2026 · Sep 5, 2026 · Sep 5, 2026 · Sep 5, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.194.0
+
+### Profiles own recursive authority
+
+Runtime now derives managed-node authority from each `AgentProfile` tool declaration.
+A profile can use a Runtime coordination tool without a fixed role, and it can recurse only when it declares `agent_runtime_coordination_spawn_worker`.
+Runtime no longer exports `supervisorPolicyPrompt` or injects a default supervisor policy.
+Consumers must put their working instructions in the profile they run.
+
+### Accepted direct submissions survive restart
+
+`submit_result` now records an accepted result before it responds.
+A resumed manager returns that result without starting another router or harness session, and concurrent passing submissions retain one accepted result.
+
 ## 0.193.1
 
 ### Bridge roots refuse unavailable work before allocation

diff --git a/api-surface.json b/api-surface.json
@@ -120,7 +120,7 @@
       "ConversationResult": "type f74fcdc4f8f0",
       "ConversationStreamEvent": "type a39182b3dbfc",
       "ConversationTurn": "type d8280ca3c636",
-      "CoordinationEvent": "type c5e4af54ef79",
+      "CoordinationEvent": "type c618020ecc5e",
       "CreateAgentCandidateWorkspacePortOptions": "type 02ca21801e67",
       "CreateKnowledgeImprovementActivationExecutorOptions": "type 4b3e5fe02df7",
       "CreateProfileImprovementHarnessOptions": "type 36de01aba28e",
@@ -1177,7 +1177,7 @@
       "ContinuityMode": "type 57d23eae19f8",
       "CoordinationBinding": "type 195715b60ec5",
       "CoordinationDeliveryEvidence": "type b9bcf48aeb2e",
-      "CoordinationEvent": "type c5e4af54ef79",
+      "CoordinationEvent": "type c618020ecc5e",
       "CoordinationLog": "type 760d6417189e",
       "CoordinationMcpHandle": "type 4ebbd68d8400",
       "CoordinationOwnerId": "type ba5552a40a12",
@@ -1216,7 +1216,7 @@
       "DownMessageDeliveryAttempt": "type 5bdd1f632583",
       "DownMessageDeliveryOutcome": "type bca367e62a6a",
       "DownMessageEvent": "type 9dd808200f9d",
-      "DriveHarness": "type 3ef6bda5ba08",
+      "DriveHarness": "type e81197face8f",
       "DriveHarnessOwnerContext": "type d0689ff0eb6e",
       "Driver": "type 4a747076b1a3",
       "DriverAttemptRecord": "type f9ce2f046564",
@@ -1259,7 +1259,7 @@
       "ExecutorContext": "type 98d2e228ea1b",
       "ExecutorExecutionBinding": "type cbd52e7e2eb8",
       "ExecutorFactory": "type 0d6f475ad3d4",
-      "ExecutorMaterialization": "type 4d1e9a2101ed",
+      "ExecutorMaterialization": "type ceafe44da26b",
       "ExecutorNodeContext": "type 7f86daa88edc",
       "ExecutorProgress": "type c91983468166",
       "ExecutorProgressEvent": "type 19b8d5b7224e",
@@ -1573,15 +1573,15 @@
       "StructuralRolloutPolicy": "type d372912ef050",
       "StructuralRolloutResult": "type 9248b72cae04",
       "SuperviseDispatchOptions": "type 55e71c9c1e6b",
-      "SuperviseOptions": "type 51029d9e2b96",
+      "SuperviseOptions": "type 5ec2e38b4671",
       "SuperviseOptionsForDispatch": "type 7d89526c1040",
       "SuperviseRegistry": "type 4fd60c297f74",
       "SuperviseRegistryTable": "type cc1468cd50c1",
       "SuperviseSurfaceOptions": "type 8a7daaf98896",
       "SuperviseSurfaceResult": "type 2c378dbc3193",
       "SupervisedResult": "type d2fabb828e07",
       "Supervisor": "type 7d9aff9cd744",
-      "SupervisorAgentDeps": "type 7ecec59281fc",
+      "SupervisorAgentDeps": "type 43201c6909f8",
       "SupervisorCleanupReceipt": "type d862eb60266d",
       "SupervisorFinalizer": "type f8628e65536f",
       "SupervisorNodeContext": "type b8e545bbb355",
@@ -1924,7 +1924,7 @@
       "selectChampion": "value db305c9b1701",
       "selectValidWinner": "value ff507a8be978",
       "sentinelCompletion": "value 4b96e3c2c63d",
-      "serveCoordinationMcp": "value 78094b37ccc3",
+      "serveCoordinationMcp": "value b704fe1b4eef",
       "settledToIteration": "value 6603cd508de9",
       "settledWorkerOut": "value 6f3bae481b15",
       "spendFromUsageEvents": "value f4bec1c9bfc6",
@@ -1942,7 +1942,6 @@
       "superviseSurface": "value 730f753cfb58",
       "supervisorAgent": "value 880407b0dab3",
       "supervisorInstructions": "value a20603be0ba8",
-      "supervisorPolicyPrompt": "value 373728f5643d",
       "supervisorRunDir": "value 3925fc5b5ced",
       "supervisorRunsRoot": "value f50183307ce8",
       "supervisorWorkersDir": "value 229aecaab891",
@@ -2029,7 +2028,7 @@
       "CodexExecutionPolicy": "type 1c10e614b168",
       "CodexTokenUsage": "type 5e574348084f",
       "ContinuationInstruction": "type b8afbf15f4e3",
-      "CoordinationEvent": "type c5e4af54ef79",
+      "CoordinationEvent": "type c618020ecc5e",
       "CoordinationTools": "type e90459fca882",
       "CoordinationToolsOptions": "type c838cac712c9",
       "CreateKbGateOptions": "type 9163935b6cf3",
@@ -2339,7 +2338,7 @@
     "./testing": {
       "AgentProfileImprovementFixture": "value 8a79d0f5c646",
       "AgentProfileImprovementProposalFixture": "value 95f42c91bc08",
-      "DriverAgentOptions": "type 56064f9cc0f7",
+      "DriverAgentOptions": "type 87c25847a608",
       "RunGraphTestOptions": "type c5b5730ba4f0",
       "SuperviseTestOptions": "type 1fd4a3f892e4",
       "SupervisorAgentTestDeps": "type f39aa3b16149",

diff --git a/bench/src/atom-mcp-e2e.mts b/bench/src/atom-mcp-e2e.mts
@@ -176,6 +176,7 @@ async function main(): Promise<void> {
         blobs,
         makeWorkerAgent: (raw) => makeWorker(raw, ws, n++),
         perWorker: { maxIterations: 2, maxTokens: 200_000 },
+        toolNames: ['spawn_worker', 'await_event', 'stop'],
       })
       // The supervisor's cwd carries the REAL skill file (opencode loads it from the cwd skill dirs).
       const supCwd = mkdtempSync(join(tmpdir(), 'e2e-sup-'))

diff --git a/bench/src/coordination-mcp-container-reach.mts b/bench/src/coordination-mcp-container-reach.mts
@@ -118,6 +118,7 @@ async function main(): Promise<void> {
         blobs,
         makeWorkerAgent: () => trivialWorker('w'),
         perWorker: { maxIterations: 4, maxTokens: 2000 },
+        toolNames: ['spawn_worker', 'await_event'],
         host: HOST_BIND,
       })
       // Docker containers reach the host through the bridge gateway, not the 0.0.0.0 bind URL.

diff --git a/bench/src/mcp-mount-probe.mts b/bench/src/mcp-mount-probe.mts
@@ -90,6 +90,7 @@ async function main(): Promise<void> {
         blobs,
         makeWorkerAgent: () => deliveringLeaf('w', { ok: true }),
         perWorker: { maxIterations: 4, maxTokens: 2000 },
+        toolNames: ['spawn_worker', 'await_event', 'stop'],
       })
       console.error(`[probe] coordination MCP live at ${mcp.url}`)
       try {

diff --git a/bench/src/tb-supervisor-sidecar.mts b/bench/src/tb-supervisor-sidecar.mts
@@ -113,6 +113,7 @@ async function main(): Promise<void> {
         blobs,
         makeWorkerAgent,
         perWorker: { maxIterations: 40, maxTokens: 200_000 },
+        toolNames: ['spawn_worker', 'observe_agent', 'await_event', 'stop'],
         host: '0.0.0.0',
         onEvent: (event) => logEvent('bus', event),
       })

diff --git a/docs/api/durable.md b/docs/api/durable.md
@@ -1077,9 +1077,9 @@ The independent completion check for backend-derived workers and direct supervis
 
 > `readonly` `optional` **resolveDeliverable?**: (`input`) => [`DeliverableSpec`](runtime.md#deliverablespec)\<`unknown`\> \| `undefined`
 
-Resolve the completion check for one exact authorized backend-derived leaf. The callback runs
-after spawn authorization and driver classification, receives a detached immutable context,
-and may return `undefined` to use the run-wide `deliverable`. Driver profiles never call it.
+Resolve the completion check for one exact authorized backend-derived child. The callback runs
+after spawn authorization and receives a detached immutable context. It may return `undefined`
+to use the run-wide `deliverable`; a managed child receives its selected check for direct work.
 
 ###### Parameters
 
@@ -1298,29 +1298,6 @@ authorized task. The exact worker identity and detached bytes are recorded befor
 
 [`SuperviseOptions`](runtime.md#superviseoptions).[`authorizeMessage`](runtime.md#authorizemessage-1)
 
-##### isDriverProfile?
-
-> `readonly` `optional` **isDriverProfile?**: (`input`) => `boolean`
-
-Decide whether an authorized child becomes another supervisor. By default only
- `metadata.role === 'driver'` does. Products receive the same frozen post-authorization
- context as `resolveDeliverable`, so trusted execution/assignment authority can override
- model-authored metadata without a side channel.
-
-###### Parameters
-
-###### input
-
-[`AuthorizedSpawnContext`](runtime.md#authorizedspawncontext)
-
-###### Returns
-
-`boolean`
-
-###### Inherited from
-
-[`SuperviseOptions`](runtime.md#superviseoptions).[`isDriverProfile`](runtime.md#isdriverprofile-1)
-
 ##### router?
 
 > `readonly` `optional` **router?**: [`RouterTransportConfig`](runtime.md#routertransportconfig)
@@ -1485,9 +1462,9 @@ A re-prompt is the retry path, not a second loop: same scope, same coordination
 live children, and the same budget, deadline, abort, and `driverRetry.maxAttempts` bounds. A
 run the coordination server already stopped is never re-prompted — that stop was a decision.
 
-Requires `deliverable`, and applies to the ROOT manager — the one that declares the run's
-completion check. A recursive manager declares none of its own, so it is left unchanged.
-Refused for a router-brained root, which runs its turn loop in process. Omit/`0` = never.
+Requires `deliverable`, and applies to every external manager with a completion check. A
+recursive manager receives the check selected for its exact assignment. Refused for a
+router-brained manager, which runs its turn loop in process. Omit/`0` = never.
 
 ###### Inherited from
 

diff --git a/docs/api/index.md b/docs/api/index.md
@@ -12350,7 +12350,7 @@ Mode → configured runner. Partial: only register the modes a
 
 ### CoordinationEvent
 
-> **CoordinationEvent** = \{ `type`: `"question"`; `question`: [`QuestionRecord`](mcp.md#questionrecord); \} \| \{ `type`: `"settled"`; `worker`: [`SettledWorker`](mcp.md#settledworker); \} \| \{ `type`: `"finding"`; `finding`: [`AnalystFindingEvent`](runtime.md#analystfindingevent); \} \| \{ `type`: `"steer"`; `down`: [`DownMessageEvent`](runtime.md#downmessageevent); `analyst?`: `string`; \} \| \{ `type`: `"answer"`; `down`: [`DownMessageEvent`](runtime.md#downmessageevent); `questionId`: `string`; \} \| \{ `type`: `"instruction"`; `instruction`: [`ContinuationInstruction`](runtime.md#continuationinstruction); \} \| \{ `type`: `"delivery-attempt"`; `attempt`: [`DownMessageDeliveryAttempt`](runtime.md#downmessagedeliveryattempt); \} \| \{ `type`: `"mail"`; `mail`: [`PeerMailEvent`](runtime.md#peermailevent); \} \| \{ `type`: `"escalation"`; `escalation`: [`QuestionEscalationRecord`](runtime.md#questionescalationrecord); \} \| \{ `type`: `"analyst-defined"`; `analyst`: [`DefinedAnalystRecord`](runtime.md#definedanalystrecord); \}
+> **CoordinationEvent** = \{ `type`: `"question"`; `question`: [`QuestionRecord`](mcp.md#questionrecord); \} \| \{ `type`: `"settled"`; `worker`: [`SettledWorker`](mcp.md#settledworker); \} \| \{ `type`: `"finding"`; `finding`: [`AnalystFindingEvent`](runtime.md#analystfindingevent); \} \| \{ `type`: `"submission"`; `result`: `unknown`; \} \| \{ `type`: `"steer"`; `down`: [`DownMessageEvent`](runtime.md#downmessageevent); `analyst?`: `string`; \} \| \{ `type`: `"answer"`; `down`: [`DownMessageEvent`](runtime.md#downmessageevent); `questionId`: `string`; \} \| \{ `type`: `"instruction"`; `instruction`: [`ContinuationInstruction`](runtime.md#continuationinstruction); \} \| \{ `type`: `"delivery-attempt"`; `attempt`: [`DownMessageDeliveryAttempt`](runtime.md#downmessagedeliveryattempt); \} \| \{ `type`: `"mail"`; `mail`: [`PeerMailEvent`](runtime.md#peermailevent); \} \| \{ `type`: `"escalation"`; `escalation`: [`QuestionEscalationRecord`](runtime.md#questionescalationrecord); \} \| \{ `type`: `"analyst-defined"`; `analyst`: [`DefinedAnalystRecord`](runtime.md#definedanalystrecord); \}
 
 Every message on the one typed pipe. UP (child→parent): question / settled / finding — queued for
  the driver to `pull`. An `instruction` is the pre-delivery authorization receipt and is retained
@@ -12381,6 +12381,16 @@ Every message on the one typed pipe. UP (child→parent): question / settled / f
 
 ##### Type Literal
 
+\{ `type`: `"submission"`; `result`: `unknown`; \}
+
+A direct manager result that passed its injected completion check. Record-only: the caller
+ already received the tool response, and a restarted manager restores this exact accepted
+ result instead of running the check or its harness again.
+
+***
+
+##### Type Literal
+
 \{ `type`: `"steer"`; `down`: [`DownMessageEvent`](runtime.md#downmessageevent); `analyst?`: `string`; \}
 
 ###### type

diff --git a/docs/api/mcp.md b/docs/api/mcp.md
@@ -1886,7 +1886,7 @@ Optional per-delegation typecheck command. Same shape as `testCmd`.
 
 **`Experimental`**
 
-Wall-clock cap per harness subprocess (ms). Default 5min.
+Optional wall-clock cap per harness subprocess (ms). Omit it for no timer.
 
 ##### postCheckTimeoutMs?
 
@@ -2295,7 +2295,8 @@ Absolute host paths that reproducible Codex must not read. The normalized set is
 
 **`Experimental`**
 
-Wall-clock kill deadline (ms). Default 5 min. Subprocess SIGTERMed on expiry.
+Optional wall-clock kill deadline (ms). Omit it for no timer. A positive value sends
+ SIGTERM on expiry.
 
 ##### maxOutputBytes?
 

diff --git a/docs/api/primitive-catalog.md b/docs/api/primitive-catalog.md
@@ -7,7 +7,7 @@
 
 # Primitive catalog — the never-stale anti-reinvention inventory
 
-> **GENERATED** from `@tangle-network/agent-runtime@0.193.1` and `@tangle-network/agent-eval@0.173.0` by `scripts/gen-primitive-catalog.mjs`. Do NOT hand-edit — run `pnpm run docs:api`. This is the mechanical companion to the JUDGMENT in `canonical-api.md` (§2 decision table + §1.5 AgentProfile law): that doc says WHICH primitive to reach for and what NOT to build; this catalog proves WHAT exists. Per-symbol signatures + `file:line` live in the per-module pages under `docs/api/`.
+> **GENERATED** from `@tangle-network/agent-runtime@0.194.0` and `@tangle-network/agent-eval@0.173.0` by `scripts/gen-primitive-catalog.mjs`. Do NOT hand-edit — run `pnpm run docs:api`. This is the mechanical companion to the JUDGMENT in `canonical-api.md` (§2 decision table + §1.5 AgentProfile law): that doc says WHICH primitive to reach for and what NOT to build; this catalog proves WHAT exists. Per-symbol signatures + `file:line` live in the per-module pages under `docs/api/`.
 
 ## 1. agent-runtime — own public surface
 
@@ -571,7 +571,7 @@ Import from `@tangle-network/agent-runtime/intelligence` — 171 exports.
 
 ### Execution kernel — recursive atom, supervision, executors, round-synchronous loop
 
-Import from `@tangle-network/agent-runtime/kernel` — 921 exports.
+Import from `@tangle-network/agent-runtime/kernel` — 920 exports.
 
 | Symbol | Kind | Summary |
 |---|---|---|
@@ -807,7 +807,7 @@ Import from `@tangle-network/agent-runtime/kernel` — 921 exports.
 | `superviseDispatch` | function | Run one recursive supervised tree inside Eval's pre-execution paid-call lifecycle. |
 | `superviseSurface` | function | Drive a team of agents (spawned + steered by `profile`) to solve a graded `AgenticSurface` task, and |
 | `supervisorAgent` | function | Build a supervisor `Agent` from its profile: the brain resolves from `profile.harness` |
-| `supervisorInstructions` | function | The supervisor SKILL — the how-to the supervisor reads (its system prompt). THE optimizable |
+| `supervisorInstructions` | function | The supervisor skill: an explicit profile-authoring instruction, never an implicit Runtime |
 | `supervisorRunDir` | function | The run directory every artifact of one supervisor run lives under. |
 | `supervisorRunsRoot` | function | The root every supervisor run of one workspace lives under. |
 | `supervisorWorkersDir` | function | The directory holding every per-worker file of one run (inboxes and control-event logs). |
@@ -877,7 +877,6 @@ Import from `@tangle-network/agent-runtime/kernel` — 921 exports.
 | `sampleThenRefine` | const | The explore-then-exploit MIX: spend ⌈budget/2⌉ on independent samples (kept open), |
 | `strategyAuthorContract` | const | The compressed consumable a skill carries: everything an author needs to emit a loop. |
 | `strategyAuthorSystemPrompt` | const | Standing behavior callers put in the strategy-author AgentProfile. |
-| `supervisorPolicyPrompt` | const | THE supervisor policy — one stance, both front doors. The work-vs-delegate rule is conditional |
 | `TERMINAL_DECISIONS` | const | Decision values the kernel treats as terminal. Every other value returned by |
 | `VERIFY_TAIL_CHARS` | const | Tail of the verify output — the failing assertion lives at the END of a test log. |
 | `WORKER_TOOL_TRACE_SCHEMA_VERSION` | const | Schema version for content-addressed worker tool-trace artifacts. |