[OwenKephart]

Summary

Session execution, channels, clients, and trace readers previously reconstructed different lifecycle models, while dynamic capabilities depended on compiler-captured callbacks. This consolidates the reviewed pre-1.0 stack around committed v27 facts, independent delivery observations, ordinary dynamic functions with JSON memos, and consistent public APIs. Parent-side child-delivery links let shared child observations show activity for the calls they actually served.

Scope and migration

• One session protocol. Execution, channels, clients, instrumentation, traces, and evals fold committed facts. Stream version is 27, trace schema 4, and current/minimum checkpoint 18/18. Checkpoint 17 remains bound to its owning deployment. Imported history does not convert execution checkpoints.
• Accepted work has an identity. Messages, answers, and controls return deliveries. Creation with a message returns { session, delivery }; message-free creation returns { session }. Each delivery's stream and result read independently. Workflow-facing message results remain terminal-only.
• Independent observations. Recursive child following preserves authorization, namespace, and source ownership. Child observations do not rewrite root settlement or lifecycle status. Aborting a reader does not cancel work. Frontend bindings and SessionStore share this contract; Stop uses the active turn.
• Recorded child attribution. Parent child.sent facts identify accepted child deliveries and the parent call. agentCallActivity() uses the shared observer, preserves shared turns, and leaves missing provenance unlinked. Replacement children retain the original opening call's ownership; each send retains its actual sender and authorization. Concurrent sends reach the child in send order.
• Ordinary dynamic functions. defineDynamic(ctx => value) rebuilds capabilities before model calls. Session/mount-scoped JSON memos retain observations without serializing closures or schemas. Explicit child-model overrides win over inherited selection. Remote credentials retain original-parent ownership; changed parked capabilities fail closed.
• Approval provenance. Authorization runs per call. once() remembers decisions for the resolved tool/session, not input-scoped consent, and applies only when the policy returns its decision. Public approvedTools and approvalKey are removed. Policy denials settle rejected without starting the tool. Parent-agent messages cannot act as a person's typed approval.
• Narrower public contracts. Curate exports and own decision, history, sandbox, and platform types. Rename client host to baseUrl and EveAgentStore to SessionStore, without aliases. Preserve explicit "" and URL semantics. Strict HTTP envelopes reject misspelled top-level fields after authentication, while retaining nested application JSON. Remote CLI usage goes through eve connect --print.
• Remote protocol compatibility. Protocols 1 and 2 remain supported. Upgraded callers relay protocol-2 approvals, questions, and sign-ins; protocol-3 children need upgraded callers to relay human input. Upgrade callers first or together. Protocol-3 continuation keys and HTTP idempotencyKey retain receipt identity within the session's bounded recent-key window.
• Safe history and hydration. v26 history reads preserve source coordinates. meta.next attests complete source-line coverage, including trailing records that emit no facts. Hydration validates through Conversation.advancePosition; independently advanced readers cannot acknowledge unread data.
• Distribution compatibility. Retain format-3 manifests with an exact build version as the minimum consumer and a supported distribution generation. Old format-1/2 distributions require rebuilding. Epoch tooling stays retired, and historical release notes are preserved.

Main integration and review

The branch includes main through 89a1f82dd using signed, DCO merge commits, without rewriting prior history. The latest port preserves main's signed local-development peer checks in the relocated v27 auth implementation, plus the 0.83.3 release and docs updates. It also preserves main's cross-site browser protection for localDev() and OpenAPI operation-ID filters. The final integration preserves the original stream's public encryption metadata across deployment handoffs. The latest conflict ports preserve oversized-message compaction, fixed-part budgeting, summary spend across cancellation, failed final streamed-edit handling, task-wait replies, optimistic-message identity, terminal submissions, and legacy context sanitation. Main's new cross-principal task ownership regressions are ported to their v27 test owners rather than restoring retired suites.

The documentation audit covers all 80 PR-changed documentation pages plus the adjacent judge page. Consolidated changesets describe released-main to final behavior, not intermediate implementation repairs. The migration guide covers the broader framework upgrade; its final release-version title remains unconfirmed.

The original consolidation, superseded PR discussions, and backup branches remain available. #5321 remains closed unmerged; its hydration fix is included directly. This is a standalone PR targeting main; the old native stack is retired.

Deliberate limits

• Recovery, transport identity, and approvals do not guarantee exactly-once external effects. Idempotency retains the 1,024-key eviction window, not permanent deduplication.
• Child cleanup remains best effort. Logical cancellation does not prove physical shutdown or sandbox release. No delivery-targeted cancellation or per-delivery reply redesign is included.
• MCP polling and other readers can still fold full history. The human review thread about polling cost remains open and explicitly deferred; reusable authorized snapshots and bounded replay are separate work.
• Consent-revision invalidation, workflow-generation pinning, durable cleanup deadlines, and broader template persistence are outside scope.
• Old converted archives without coverage metadata need reconversion. Empty-root coverage remains conservative; another reader's cursor is not a safe substitute.

Validation

Published candidate: b4e9143dfeea68e73004bfaf1324cf66e7db443b. All required checks pass on this exact head. Sixteen targeted localDev() tests and core typechecking also passed locally.

Core CI, local e2e, Postgres e2e, Vercel e2e, and Bundle Analysis passed on b4e9143df. The rollup has 157 successful checks, one skipped check, one neutral check, and the advisory benchmark failure described below; none remain pending. No failed-job reruns were needed. No PR merge or auto-merge is authorized.

Local validation for the conflict resolution:

• Workspace typecheck, formatting, lint, docs validation, mechanical invariants, and diff checks passed. No invariant baseline was increased.
• 105 focused unit tests passed across six files for the initial conflict ports and opening-call attribution. Another 14 wire/session tests passed across three files.
• Three selected compaction integration cases passed after correcting an empty-prompt test fixture. Three newly ported task/principal-isolation unit cases passed.
• A targeted prewarm-handoff integration run was interrupted without a result; it is not counted as a pass. Full integration, scenario, and e2e tiers are left to CI.
• Fresh-context review of 4f71cd0fe found no critical correctness, data-loss, or security issue. The subsequent 36d72195c merge adds only main's task/principal tests and their v27 port.

On 6aa99a4ec, core lint, types, unit, scenario, framework, template, webchat, and TUI checks passed. Both integration platforms exposed the same missing instrumentation settlement after a committed compaction hook cancelled. Fix 273759e6b reports the committed settlement before propagating cancellation and retains its attribution even after operational records retire. Both failing cases and 16 instrumentation unit tests passed locally; core types, lint, and invariants passed. Final-head CI confirms the repair on Linux and Windows.

Historical CI on 27273544d passed local/model, Postgres, and Vercel e2e plus Bundle Analysis, but had no core-CI run. Those results do not validate this candidate. The exact-head advisory eve-code benchmark failed during harness preparation: the external runner generates task-mcp.ts with retired defineDynamic({ events }) APIs. This is the same deterministic compatibility blocker as the older run. A runner migration remains necessary; no blind rerun or restoration of retired framework APIs was performed. Not every check is green.

Checklist

• I added tests and documentation where relevant
• I added a changeset if this touches the published eve package
• DCO sign-off is present and the new commits are cryptographically signed

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
eve-docs	Ready	Preview, v0	Oct 26, 2026 7:52pm UTC
eve-pkg	Ready	Preview, v0	Oct 26, 2026 7:52pm UTC

[github-actions]

Bundle + Package Summary: apps/fixtures/weather-agent

Key takeaways

• Runtime delta: function payloads 20.94 MB -> 21.33 MB (+397.2 kB ⚠️); 1 changed payload.
• Dependency delta: 8 peer deps added; 1 peer dep changed.

Delta vs main (89a1f82)

Area	Metric	Baseline	Current	Delta
Package	Packed tarball	7.79 MB	7.84 MB	+45.5 kB ⚠️
Package	Unpacked publish size	27.35 MB	27.33 MB	-15.6 kB ✅
Package	Installed footprint	75.79 MB	75.78 MB	-14.9 kB ✅
Package	Published files	4230	4364	+134
Package	Installed files	8227	8361	+134
Package	Installed package instances	34	34	0
Package	Distinct installed package names	32	32	0
Package	Installed dependency edges	51	51	0
Package	Installed optional peer edges	9	17	+8
Runtime	Unique function payloads	2	2	0
Runtime	Total function bytes	20.94 MB	21.33 MB	+397.2 kB ⚠️
Runtime	Public routes	18	18	0

Dependency manifest changes vs main (89a1f82)

Peer dependencies

• Added: @linqapp/sdk@^0.47.1 (optional), @nuxt/kit@^4.0.0 (optional), @nuxt/schema@^4.0.0 (optional), @vercel/connect@^2.5.2 (optional), react@^19.0.0 (optional), svelte@^5.0.0 (optional), vite@^8.3.1 (optional), vue@^3.5.0 (optional)
• Changed: just-bash@^3.1.0 (optional) -> just-bash@^3.6.0 (optional)

Changed function payloads vs main (89a1f82) (2)

Function	Status	Baseline	Current	Delta	Route changes
functions/__server.func	changed	10.47 MB	10.67 MB	+198.6 kB ⚠️	public +/eve/v1/session/[sessionId]/descendants/stream public -/eve/v1/task-input/[token]
functions/.well-known/workflow/v1/flow.func	changed	10.47 MB	10.67 MB	+198.6 kB ⚠️	none

eve init install

Metric	Baseline	Current	Delta
Installed footprint	114.17 MB	114.16 MB	-14.9 kB ✅
Installed packages	97	97	0
dependencies	4	4	0
devDependencies	2	2	0
Dependency package bytes	45.88 MB	45.86 MB	-15.6 kB ✅
devDependency package bytes	5.11 MB	5.11 MB	0 B ➖

Build Metadata

• Preset: vercel
• Nitro: nitro@3.0.260903-beta
• Output directory: apps/fixtures/weather-agent/.vercel/output
• Build metadata timestamp: 2026-10-26T19:52:48.411Z
• Route aliases: 18 public, 1 internal (19 total aliases)
• Vercel routes in config: 21
• Severity legend: 🔴 dominant/large, 🟠 notable, 🟡 watch, ⚪ small

Package Drill-Down

Package Details

• Package: eve@0.83.3
• Package directory: packages/eve
• Tarball: 7.84 MB (eve-0.83.3.tgz)
• Unpacked payload: 27.33 MB across 4364 published files
• Installed footprint: 75.78 MB across 8361 installed files
• Installed root package: 27.33 MB
• Installed dependencies: 48.44 MB
• Installed package instances: 34
• Distinct installed package names: 32
• Installed dependency edges: 51
• Installed optional peer edges: 17
• Runtime dependencies: 2
• Peer dependencies: 15 (14 optional)

Installed footprint is measured from an isolated temporary npm install of the packed tarball.
Graph metrics read only package.json files in package directories directly beneath a node_modules boundary, including nested boundaries. Each directory is one package instance; distinct names come from those manifests. Dependency edges count each unique name in dependencies or optionalDependencies per instance; optional peer edges count peerDependencies marked optional.

Heavy installed dependencies

• eve: 27.33 MB (36.1%)
• @rolldown/binding-linux-x64-gnu: 19.89 MB (26.3%)
• ai: 8.50 MB (11.2%)
• zod: 6.15 MB (8.1%)
• undici: 3.58 MB (4.7%)

Publish payload breakdown

Published file size
🟠 dist/src/compiled/shadcn-registry/index.js       [#####...................] 3.85 MB 14.1%
🟠 dist/src/compiled/@photon-ai/chat-adapter-ime... [###.....................] 2.29 MB 8.4%
🟠 dist/src/compiled/run/index.js                   [#.......................] 1.00 MB 3.7%
🟡 dist/src/compiled/@vercel/blob/index.js          [#.......................] 604.9 kB 2.2%
🟡 dist/src/compiled/_chunks/workflow/undici-D-I... [#.......................] 521.9 kB 1.9%
🔴 Other published files                            [########################] 19.07 MB 69.8%

Installed footprint breakdown

Installed package size
🔴 eve                             [########################] 27.33 MB 36.1%
🔴 @rolldown/binding-linux-x64-gnu [#################.......] 19.89 MB 26.3%
🔴 ai                              [#######.................] 8.50 MB 11.2%
🔴 zod                             [#####...................] 6.15 MB 8.1%
🟠 undici                          [###.....................] 3.58 MB 4.7%
🟠 nitro                           [##......................] 1.89 MB 2.5%
🔴 Other installed packages        [#######.................] 8.44 MB 11.1%

Runtime dependencies (2)

Package	Range	Notes
nitro	3.0.260903-beta
undici	8.10.2

Peer dependencies (15)

Package	Range	Notes
@linqapp/sdk	^0.47.1	optional peer
@nuxt/kit	^4.0.0	optional peer
@nuxt/schema	^4.0.0	optional peer
@opentelemetry/api	^1.0.0	optional peer
@vercel/connect	^2.5.2	optional peer
ai	catalog:
braintrust	^3.0.0	optional peer
chat	^4.42.0	optional peer
dd-trace	^6.13.0	optional peer
just-bash	^3.6.0	optional peer
next	^16.0.0	optional peer
react	^19.0.0	optional peer
svelte	^5.0.0	optional peer
vite	^8.3.1	optional peer
vue	^3.5.0	optional peer

eve init install drill-down

eve init install details

• Command: eve init my-agent
• Package manager: npm
• Installed footprint: 114.16 MB across 10278 installed files
• Installed packages: 97 total (91 transitive-only)
• dependencies: 4 direct packages totaling 45.86 MB
• devDependencies: 2 direct packages totaling 5.11 MB
• Other transitive package files: 63.19 MB

Installed footprint is measured from an isolated temporary eve init my-agent using the current packed eve tarball.

Heavy installed dependencies

• @typescript/typescript-linux-x64: 27.95 MB (24.5%)
• eve: 27.33 MB (23.9%)
• @rolldown/binding-linux-x64-gnu: 19.89 MB (17.4%)
• zod: 9.76 MB (8.5%)
• ai: 8.50 MB (7.4%)

Installed footprint breakdown

Installed package size
🔴 @typescript/typescript-linux-x64 [########################] 27.95 MB 24.5%
🔴 eve                              [#######################.] 27.33 MB 23.9%
🔴 @rolldown/binding-linux-x64-gnu  [#################.......] 19.89 MB 17.4%
🔴 zod                              [########................] 9.76 MB 8.5%
🔴 ai                               [#######.................] 8.50 MB 7.4%
🟠 undici                           [###.....................] 3.58 MB 3.1%
🔴 Other installed packages         [###############.........] 17.16 MB 15.0%

dependencies (4)

Package	Range	Installed size	Share
@vercel/connect	2.5.2	276.3 kB	0.2%
ai	^7.0.137	8.50 MB	7.4%
eve	file:eve-0.83.3.tgz	27.33 MB	23.9%
zod	4.5.4	9.76 MB	8.5%

devDependencies (2)

Package	Range	Installed size	Share
@types/node	24.x	2.61 MB	2.3%
typescript	7.0.2	2.50 MB	2.2%

Function Drill-Down

Payload Size Graph

Unique function payload size and share of total
🔴 functions/.well-known/workflow/v1/flow.func     [########################] 10.67 MB 50.0%
🔴 functions/__server.func                         [########################] 10.67 MB 50.0%

Top Function Payloads

🟠 functions/.well-known/workflow/v1/flow.func • 1 public route • 10.67 MB

Metric	Value
Public routes	/.well-known/workflow/v1/flow
Runtime	nodejs24.x
Handler	index.mjs
Payload	10.67 MB
Function files	10.67 MB across 124 files
Traced dependencies	0 B
Signal	🟠 Bundled file _chunks/vercel.web.mjs is 2.60 MB (24.4%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 _chunks/vercel.web.mjs                         [#############...........] 2.60 MB 24.4%
🟡 _libs/undici.mjs                               [#####...................] 994.5 kB 9.3%
🟡 _chunks/sandbox2.mjs                           [####....................] 815.0 kB 7.6%
🟡 _chunks/compiled-artifacts-instrumentation.mjs [####....................] 730.7 kB 6.8%
🟡 _chunks/token-util-Bla5Z0G9.mjs                [####....................] 704.5 kB 6.6%
🔴 Other bundled files                            [########################] 4.82 MB 45.2%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x",
  "maxDuration": "max",
  "experimentalTriggers": [
    {
      "type": "queue/v2beta",
      "topic": "__eve776561746865722d6167656e74_wkf_workflow_*",
      "consumer": "default",
      "retryAfterSeconds": 5,
      "initialDelaySeconds": 0
    }
  ],
  "environment": {
    "WORKFLOW_PRECONDITION_GUARD": "1"
  }
}

---

🟠 functions/__server.func • 17 public routes, 1 internal alias • 10.67 MB

Metric	Value
Public routes	/ /.well-known/workflow/v1/webhook/[token] /eve/v1/callback/[token] /eve/v1/connections/[name]/callback/[attemptId]/[token] /eve/v1/connections/[name]/callback/[token] /eve/v1/health /eve/v1/info /eve/v1/session /eve/v1/session/[parentSessionId]/subagents/[callId]/[childSessionId]/stream /eve/v1/session/[sessionId] /eve/v1/session/[sessionId]/cancel /eve/v1/session/[sessionId]/clear /eve/v1/session/[sessionId]/compact /eve/v1/session/[sessionId]/descendants/stream /eve/v1/session/[sessionId]/reset /eve/v1/session/[sessionId]/stream /eve/v1/session/[sessionId]/stubs
Internal aliases	/__server
Runtime	nodejs24.x
Handler	index.mjs
Payload	10.67 MB
Function files	10.67 MB across 124 files
Traced dependencies	0 B
Signal	🟠 Bundled file _chunks/vercel.web.mjs is 2.60 MB (24.4%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 _chunks/vercel.web.mjs                         [#############...........] 2.60 MB 24.4%
🟡 _libs/undici.mjs                               [#####...................] 994.5 kB 9.3%
🟡 _chunks/sandbox2.mjs                           [####....................] 815.0 kB 7.6%
🟡 _chunks/compiled-artifacts-instrumentation.mjs [####....................] 730.7 kB 6.9%
🟡 _chunks/token-util-Bla5Z0G9.mjs                [####....................] 704.5 kB 6.6%
🔴 Other bundled files                            [########################] 4.82 MB 45.2%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x"
}

Build Timing: e2e/fixtures/agent-tools-sandbox

This is an informational timing measurement inside eve build, from preflight through publication. Output-size measurement and profile writing are excluded.

Build mode: deployable Vercel build with sandbox template prewarm included.

• Build pipeline: 4.20 s -> 3.58 s (-616.1 ms) vs main (89a1f82).
• Timing is informational: shared GitHub runners are too variable for a hard timing budget.

Detailed phase timings vs `main (89a1f82)`

Phase	Baseline	Current	Delta
extension.check	18.1 ms	18.9 ms	+0.8 ms
project.resolve	0.4 ms	2.0 ms	+1.6 ms
workspace.create	0.5 ms	0.9 ms	+0.4 ms
host.prepare	799.1 ms	501.2 ms	-297.9 ms
vercel.service-prefix.resolve	1.5 ms	1.6 ms	+0.1 ms
nitro.create	683.4 ms	398.7 ms	-284.7 ms
sandbox.prewarm	558.0 ms	569.2 ms	+11.2 ms
nitro.cache.prepare	0.2 ms	0.2 ms	0.0 ms
nitro.prepare	0.7 ms	0.6 ms	-0.1 ms
nitro.public-assets	0.8 ms	0.7 ms	-0.1 ms
nitro.prerender	0.6 ms	0.6 ms	0.0 ms
nitro.bundle	2.00 s	1.97 s	-30.4 ms
nitro.cache.write	0.3 ms	0.2 ms	-0.1 ms
vercel.workflow-function.materialize	40.4 ms	37.2 ms	-3.2 ms
agent-summary.emit	0.6 ms	0.6 ms	0.0 ms
connect-manifest.emit	0.3 ms	0.3 ms	0.0 ms
nitro.close	0.1 ms	0.1 ms	0.0 ms
output.publish	3.1 ms	2.8 ms	-0.3 ms
workspace.remove	2.4 ms	2.0 ms	-0.4 ms

[OwenKephart]

Restacked this PR onto the new chain: #4695 → #4854 → #4726 → #4855. GitHub's native stack was rebuilt as stack 4856; the PR numbers and review threads are unchanged.

The old template tip 143737dda is backed up locally. Shared view exposure and snapshot-copy reuse now live in #4854. This PR retains mid-turn placement, admitted-answer restoration, Trace/composer changes, and template simplification. The integration commit preserves optimistic IDs across split messages, adapts receipt-returning callbacks, saves rich-chat snapshots at shared-state phase boundaries, and prevents duplicate TUI cancellation notices.

Current template tip: b69e1aa42, on coverage 5d816b4ce. The later coverage commit only adapts two frontend evals to acceptance-based commands; template code is unchanged from the initial integration. If continuing from an older checkout, preserve local work, fetch, and replay only unpublished commits onto origin/v27/lab-fixes; do not force-push the old stack history. All updated commits are signed and DCO verified. Fresh CI is running; earlier packed-template/browser results are explicitly marked pre-restack in the PR body.

[OwenKephart]

Pushed the historical-hydration fix directly on this branch as ed630ac69ab631d353c792835ad0672f44f4618e (verified signed/DCO commit, fast-forward from fd08755d6). #5321 is closed unmerged, with its review history and branch preserved.

Accepted and resolved the bot comment: hydration now reuses Conversation.advancePosition through the existing ConversationClient.hydrate method. There is no second store cursor and no production change to session-store.ts. Original event coordinates remain intact; known source coverage drives position(view), the published session cursor, and the resume GET consistently.

All 114 focused tests pass, plus core TypeScript, formatting, lint, docs, and invariants. A fresh read-only review of this direct implementation found no critical issue. Current-head CI was dispatched once and is pending; prior #5321 results are not being claimed for this SHA.

No merge into main or auto-merge. This update does not rebase onto newer main; GitHub currently reports a conflict against that moving target.

[OwenKephart]

Fleet confidence testing found a mixed-version transport failure: a protocol-3 caller cannot start the published eve@0.83.2 protocol-2 receiver, which explicitly rejects before admission. Draft #5346 targets this branch with one bounded negotiation after that definitive refusal; accepted/ambiguous requests never resend. The local built candidate passes real isolated CLI-to-CLI terminal-result delivery in both directions, plus protocol-3 approval relay, forwarded-user task reuse, child reads and cancellation. The api fleet remains pinned to your published 28de6fc build; I have not substituted the candidate artifact or authorized a production rollout.