@amaster.ai/employee-runtime-connector 0.1.1-beta.0 → 0.1.1-beta.10

package/README.md

@@ -32,6 +32,25 @@ The source of truth lives under this package's `src/` directory. The package bui
 
 Runtime code belongs in the container image. Persist only connector state, the result outbox, and workspaces under the configured state directory.
 
+## Pi tool-argument transport guard
+
+`AMASTER_PI_TOOL_ARGUMENT_GUARD_MODE` defaults to `shadow`; supported values are
+`off`, `shadow`, and `enforce`. Shadow records metadata-only matches while the
+single-incident thresholds are calibrated. Promote deliberately to `enforce`
+after reviewing near misses and false positives; use `off` as the emergency
+rollback. The enforce signature
+requires at least 8 MiB transported, at most 512 KiB materialized, and at least
+16x amplification before `tool_execution_start`. Replay ratio is telemetry,
+not a kill prerequisite. Threshold overrides are available through the
+`AMASTER_PI_TOOL_ARGUMENT_*` environment variables, but production changes
+must be based on shadow telemetry and false-positive review.
+
+An enforced stop returns `pi_tool_argument_stream_amplification` with
+`retryable=false` and recommends
+`upsert_document_revision_from_workspace_file`. The command result keeps only
+byte counts, ratios, event/tool identity, thresholds, and near-miss distances;
+it omits the inline argument body.
+
 ## Pi terminal cleanup outcome
 
 Pi execution uses three separate evidence layers:
@@ -40,7 +59,7 @@ Pi execution uses three separate evidence layers:
 2. a durable, inspectable Runtime Action receipt or finalized Runtime Artifact;
 3. process cleanup disposition.
 
-An exact process-kill `EPERM` error emitted only after the first two layers have completed may be isolated as a failed `cleanupDisposition` warning without changing the command's successful business result. Both accepted shapes require `kill` and `EPERM`; generic filesystem/process permission text such as `EPERM: operation not permitted, unlink ...` is a business error. A `runtime_action.status` readback is evidence only when its call/plan ref matches an earlier submit/commit receipt in the same transcript. The diagnostic and durable evidence reference remain in the result. Text-only or action-only-without-assistant-output streams, standalone governed reads, non-effect Runtime Action tools, rejected or pending effects, pre-terminal errors, provider failures, timeout, cancellation, resource limits, any signal, live residue, and uncertain ownership remain failures.
+An exact process-kill `EPERM` error emitted only after the first two layers have completed may be isolated as a failed `cleanupDisposition` warning without changing the command's successful business result. Both accepted shapes require `kill` and `EPERM`; generic filesystem/process permission text such as `EPERM: operation not permitted, unlink ...` is a business error. Durable evidence is limited to a completed Runtime Action, a finalized Runtime Artifact, or an accepted `company_diagnosis_brief` provider receipt whose invocation and returned Diagnosis/document/work-product identities are exact. A `runtime_action.status` readback is evidence only when its call/plan ref matches an earlier submit/commit receipt in the same transcript. The diagnostic and durable evidence reference remain in the result. Text-only or action-only-without-assistant-output streams, standalone governed reads, non-effect Runtime Action tools, rejected or pending effects, pre-terminal errors, provider failures, timeout, cancellation, resource limits, any signal, live residue, and uncertain ownership remain failures.
 
 This isolation does not schedule a retry or a second business continuation. Command result delivery and the result outbox remain the sole idempotency boundary.