[sathish-mg]

Release v1.13.0: a plan configures each LLM node, tools come from the run input, and locked parameters are applied.

Closes #391, closes #392, closes #393, closes #394, closes #396, closes #397.

What ships (see CHANGELOG [1.13.0])

• Per-node LLM configuration on a plan: system prompt, instruction, state selection, tool subset, structured output, temperature, tool results into state #391: a per-node llm block on a plan. It sets system, instruction or instruction_from, state, tools, response (json_schema or json), temperature (a number or "omit"), max_tokens, parallel_tool_calls and tool_results_into. The block is frozen in the manifest, journaled as sent under input.llm, and shown by run inspect.
• Offer an abstract node tools declared in the run input (tools_from), dispatched through a pinned Definition with locked parameters #392: tools_from, tools declared in the run input. Each one dispatches through a pinned Definition with locked and args_into. llm.dispatch pins a Definition that no node binds, such as mcp.call, and never offers it to the model.
• locked_params is stored on a Tool Definition but never applied when a run dispatches a model-issued call #393: locked_params are applied by run dispatch. They are merged over the model's arguments with the lock winning, stripped from the offered schema, journaled merged and frozen with the pin. A client or decision Definition carrying them is ignored with a RUN-W001 warning instead of being refused.
• OpenAI-compatible streaming: set served_model from the stream; expose parallel_tool_calls and the request profile through the bindings #394: streamed turns record served_model. parallel_tool_calls is a request field. llm_profile is the last argument of runStart/runResume/triggerRun/triggerDeliver (Node) and of their Python twins. The bindings read the AREEV_RUN_LLM_* variables, and the CLI's --llm-* profile flags now take effect.
• Tool-offer narrowing: a per-node opt-out and the dynamic tools' descriptions #396: per-node tool-offer narrowing (narrow: false | {top_k}), and dynamic tools are described in the narrowing question.
• tools_from: a dynamic tool's input_schema is refused for the annotation keywords $schema, $id, title, examples #397: JSON Schema annotation keywords ($schema, $id, $comment, deprecated, readOnly, writeOnly, x-*) are accepted and dropped instead of refused.

Hardening from the branch reviews

1. Without args_into, a dynamic entry's schema is closed: unnamed keys and locked keys are refused. With args_into, the entry's own additionalProperties decides.
2. The model's arguments are validated against the schema it was shown (locked keys stripped), then the merged input against the Definition's.
3. Dotted lock keys, and a lock on the args_into key, are refused at start.
4. json_object mode adds "Answer with a JSON object." to a node system text that never says JSON. A json_schema that strict mode would reject is refused at start; the check walks nested properties, items, anyOf, a schema-valued additionalProperties and nullable object types.
5. Fenced (```json) final answers are accepted.
6. Under an egress policy, llm.system and a dynamic tool's prose are pseudonymized. The tools_from list is left out of the whole-state prompt.
7. Shadow rehearses a run with the incumbent's frozen locks, so a 1.12 run still scores same on an unchanged plan.
8. A dispatch pin that is another version of a bound or dispatch-pinned tool_name is refused.
9. locked_params on client or decision tools produce a warning (RUN-W001), not an error, so 1.12 plans keep running.
10. Transports report the temperature actually sent, and results record temperature_sent.
11. Profiles reach the trigger paths and areev eval. The env twins are read only when a model is configured. off, no, 0 and false mean off, and a bare --llm-no-temperature takes no value. Note: the space form --llm-no-temperature false no longer means off; write --llm-no-temperature=false.
12. The resume test now parks on a client gate and resumes against a superseded plan.
13. The docs say where locks apply (areev-run, not loop/server/mcp).

Dependencies

• rustls 0.23.45 → 0.23.46 (RUSTSEC-2026-0346 to 0349), a lockfile-only change in the root and areev-js lockfiles. No new dependencies.

Notes

• The Linux CLI release assets carry a GLIBC 2.39 floor (the runner image). On older distributions they fail with a dynamic-linker error; use the PyPI wheel or npm package (glibc 2.31) or build from source there.
• A node with no llm block journals byte-identically, so the scheduler epoch did not move.

Pre-flight (local)

cargo test --workspace --locked (3,468 passed), clippy -D warnings, cargo doc, cargo deny check, check_versions.py, repo_stats.py --check, the areev-js build plus node --test (115 passed), pytest (185 passed), cargo +nightly fuzz build, and cargo publish --workspace --dry-run (13 crates) all pass.