@responsibleai/agent-hooks 0.1.0-alpha.2 → 0.1.0-alpha.4

package/dist/ctk/index.d.ts

@@ -63,8 +63,13 @@ export interface Harness {
      * register the interceptors and resolver, set the enforcement mode,
      * the vector's composition profile (§7.1), and its identity provider
      * (§10.1; vectors declare `"jcs-sha256"` or `null` — custom providers
-     * are functions and not vector-expressible). */
-    setup(scenario: Scenario, interceptors: Interceptor[], resolver: ApprovalResolver | null, mode: EnforcementMode, composition: CompositionConfig, identityProvider: 'jcs-sha256' | null): void;
+     * are functions and not vector-expressible). When
+     * `redactForApproval` is non-empty the harness MUST register a §9
+     * approval redactor that replaces each listed §5.2 path in the
+     * request context's target with the string `"[redacted]"`
+     * (write-back mirrored per §4.3), leaving unresolvable paths
+     * untouched. */
+    setup(scenario: Scenario, interceptors: Interceptor[], resolver: ApprovalResolver | null, mode: EnforcementMode, composition: CompositionConfig, identityProvider: 'jcs-sha256' | 'ctk-fault' | null, redactForApproval?: string[]): void;
     run(): Promise<RunRecord>;
     teardown(): void;
 }

package/dist/ctk/reference.d.ts

@@ -14,7 +14,7 @@ export declare class ReferenceHarness implements Harness {
     private emitter;
     private builder;
     private toolLog;
-    setup(scenario: Scenario, interceptors: Interceptor[], resolver: ApprovalResolver | null, mode: EnforcementMode, composition: CompositionConfig, identityProvider: 'jcs-sha256' | null): void;
+    setup(scenario: Scenario, interceptors: Interceptor[], resolver: ApprovalResolver | null, mode: EnforcementMode, composition: CompositionConfig, identityProvider: 'jcs-sha256' | 'ctk-fault' | null, redactForApproval?: string[]): void;
     run(): Promise<RunRecord>;
     teardown(): void;
 }

package/dist/ctk/reference.js

@@ -14,6 +14,7 @@ const node_crypto_1 = require("node:crypto");
 const index_1 = require("../index");
 const builder_1 = require("../builder");
 const emitter_1 = require("../emitter");
+const native_1 = require("../native");
 class ReferenceHarness {
     name = "reference-agent";
     capabilities = new Set(["model_calls", "tool_calls"]);
@@ -21,12 +22,33 @@ class ReferenceHarness {
     emitter;
     builder;
     toolLog = [];
-    setup(scenario, interceptors, resolver, mode, composition, identityProvider) {
+    setup(scenario, interceptors, resolver, mode, composition, identityProvider, redactForApproval = []) {
         this.scenario = scenario;
         this.toolLog = [];
         const em = new emitter_1.InterceptionEmitter(mode, resolver);
         em.setComposition(composition);
-        em.setIdentityProvider(identityProvider);
+        if (redactForApproval.length > 0) {
+            // §9 redaction seam, CTK convention: each listed path is replaced
+            // with "[redacted]" via the §5.2/§4.3 transform machinery;
+            // unresolvable paths are left untouched.
+            em.setApprovalRedactor((ctx) => {
+                let out = JSON.stringify(ctx);
+                for (const path of redactForApproval) {
+                    try {
+                        out = native_1.native.applyTransformCtx(out, path, '"[redacted]"');
+                    }
+                    catch {
+                        /* unresolvable at this point — skip */
+                    }
+                }
+                return JSON.parse(out);
+            });
+        }
+        // §13.2: "ctk-fault" is a custom provider that throws, pinning the
+        // §10.1 provider-failure rule (deny context_invalid pre-dispatch).
+        em.setIdentityProvider(identityProvider === 'ctk-fault'
+            ? { name: 'ctk-fault', fn: () => { throw new Error('ctk scripted provider fault'); } }
+            : identityProvider);
         for (const i of interceptors)
             em.register(i);
         this.emitter = em;

package/dist/ctk/runner.d.ts

@@ -8,12 +8,6 @@
  */
 import { JsonValue } from "../index";
 import type { Harness } from "./index";
-/** TODO(stage-4): vectors still authored in the pre-P-003 five-verdict
- * wire vocabulary (`warn`, `escalate`, `approval_resolver_missing`).
- * Stage 4 rewrites them to the three-verdict shapes (§5.1); until then
- * their scripted verdicts fail the §5 gate by design (fail closed) and
- * no longer exercise the seam/warning semantics they were written for,
- * so they are skipped here. */
 export interface VectorResult {
     id: string;
     title: string;

package/dist/ctk/runner.js

@@ -38,7 +38,18 @@ class ScriptedInterceptor {
     intercept(ctx) {
         const w = JSON.parse(native_1.native.ctkScriptedIntercept(this.rulesJson, JSON.stringify(ctx)));
         if (w !== null && typeof w === "object" && "__ctk_fault__" in w) {
-            // NOW-10 fault injection: exercise §6.3 interceptor_failed.
+            if (w.__ctk_fault__ === "mutate") {
+                // §7 isolation fault (TM-05): tamper with the received context
+                // in-place; the emitter's copy isolation must keep enforcement,
+                // identity, and siblings unaffected.
+                ctx.target = "TAMPERED";
+                const tc = ctx.tool_call;
+                if (tc && typeof tc === "object") {
+                    tc.args = { tampered: true };
+                }
+                return { decision: "allow", reason: "ctk:mutated" };
+            }
+            // Fault injection: exercise §6.3 interceptor_failed.
             throw new Error("ctk scripted fault: raise");
         }
         return w;
@@ -63,7 +74,7 @@ class ScriptedResolver {
         const requestIdentity = req.context_identity ?? "";
         const r = JSON.parse(native_1.native.ctkScriptedResolve(this.rulesJson, JSON.stringify(req.context), requestIdentity));
         if (r !== null && typeof r === "object" && "__ctk_fault__" in r) {
-            // NOW-10 fault injection: exercise §9 approval_resolver_failed.
+            // Fault injection: exercise §9 approval_resolver_failed.
             throw new Error("ctk scripted fault: raise");
         }
         if (r.context_identity === "" && req.context_identity === null) {
@@ -115,8 +126,11 @@ async function runVector(harness, vector) {
     // absent means the pre-P-003 default (`sequential/first_deny, stop`).
     const composition = v.composition ?? index_1.Composition.default();
     // §10.1: absent → the default provider; explicit null → unbound.
-    const identityProvider = 'identity_provider' in v ? v.identity_provider : 'jcs-sha256';
-    harness.setup(v.scenario, interceptors, resolver, mode, composition, identityProvider);
+    const identityProvider = 'identity_provider' in v
+        ? v.identity_provider
+        : 'jcs-sha256';
+    const redactForApproval = v.redact_for_approval ?? [];
+    harness.setup(v.scenario, interceptors, resolver, mode, composition, identityProvider, redactForApproval);
     let rr;
     try {
         rr = await harness.run();

package/dist/emitter.d.ts

@@ -27,7 +27,7 @@
  * on the event loop; sequence assignment and record append are atomic on
  * a single JS thread. Sharing one emitter across workers is unsupported.
  */
-import { AgentContext, ApprovalResolver, CompositionConfig, EnforcementMode, IdentityProvider, InterceptionRecord, Interceptor } from "./index";
+import { AgentContext, ApprovalResolver, CompositionConfig, EnforcementMode, IdentityProvider, EmitOutcome, InterceptionRecord, Interceptor } from "./index";
 /** §7 RECOMMENDED interceptor/resolver timeout (milliseconds). */
 export declare const DEFAULT_TIMEOUT_MS = 5000;
 export declare class InterceptionEmitter {
@@ -35,9 +35,14 @@ export declare class InterceptionEmitter {
     private readonly resolver;
     private readonly timeoutMs;
     private readonly interceptors;
-    private readonly _records;
+    private _records;
     private composition;
     private identity;
+    private readonly names;
+    private approvalRedactor;
+    private recordSink;
+    private maxRecords;
+    private _recordsDropped;
     /**
      * `timeoutMs` bounds each interceptor `intercept()` and resolver
      * `resolve()` call (§7, RECOMMENDED default 5000 ms); breach fails
@@ -50,14 +55,57 @@ export declare class InterceptionEmitter {
     /** Race `fn`'s result against the §7 timeout. */
     private withTimeout;
     get records(): readonly InterceptionRecord[];
-    register(interceptor: Interceptor): this;
-    /** Declare the composition profile for subsequent emissions (§7.1). */
+    /** Register an interceptor, optionally with a host-chosen
+     * payload-free `name` recorded on `verdicts[].name` (§10.3). */
+    register(interceptor: Interceptor, name?: string): this;
+    /**
+     * Declare the composition profile for subsequent emissions (§7.1).
+     * The profile and knob values are validated against the closed §7.2
+     * sets at call time (the compile-time types do not protect plain-JS
+     * callers): an undeclared value throws `RangeError` so no emission
+     * can start under semantics the operator did not declare.
+     *
+     * The default (`sequential/first_deny`, `on_approval: stop`) is the
+     * configuration §14 warns about: after an approval lifts a liftable
+     * deny, interceptors registered after the escalating one never run
+     * for that emission (`fold_truncated` on the record). Register
+     * must-run controls first, or use `sequential/run_all` / a parallel
+     * profile. See docs/PRODUCTION.md.
+     */
     setComposition(composition: CompositionConfig): this;
-    /** Declare the identity provider (§10.1). Default `"jcs-sha256"`. */
+    /** Declare the identity provider (§10.1). Default `"jcs-sha256"`.
+     * §10.1 name rules are enforced: a custom provider name must match
+     * `^[a-z][a-z0-9_-]*$` and must not begin with `jcs` (reserved so a
+     * custom function can never claim golden-vector semantics). */
     setIdentityProvider(provider: IdentityProvider): this;
+    /** Register the §9/§14 approval redactor: a pure function producing
+     * the context to place in every ApprovalRequest. The §9 identity is
+     * computed over the redacted context (binding the approval to what
+     * the approver saw); the record's identities are unaffected. A
+     * redactor that throws fails the consultation closed as
+     * `host_error:approval_resolver_failed`. */
+    setApprovalRedactor(redactor: (ctx: AgentContext) => AgentContext): this;
+    /** Register a per-emission record callback (§10.3), invoked
+     * synchronously after every emission before buffering; a sink
+     * exception is swallowed (audit delivery is the host's liveness
+     * concern, not the control plane's). */
+    setRecordSink(sink: (record: InterceptionRecord) => void): this;
+    /** Bound the in-memory record buffer: when full, the OLDEST record
+     * is dropped and {@link recordsDropped} increments. Unbounded by
+     * default. */
+    setMaxRecords(max: number): this;
+    /** Records evicted by the {@link setMaxRecords} bound. */
+    get recordsDropped(): number;
+    /** Drain the in-memory record buffer (retention stays bounded on
+     * long-running sessions). */
+    takeRecords(): InterceptionRecord[];
     /** Run the emission and **throw** {@link InterceptionBlocked} if the
-     * guarded action must not proceed (§6). Primary entry point. */
-    emit(ctx: AgentContext): Promise<InterceptionRecord>;
+     * guarded action must not proceed (§6). Primary entry point.
+     *
+     * Returns the record plus the **effective** (post-composition)
+     * target the guarded action MUST consume (§4.3) — a reference
+     * captured before `emit` may predate a transform. */
+    emit(ctx: AgentContext): Promise<EmitOutcome>;
     /** Run the emission and return the record without throwing. The
      * caller MUST inspect `proceeds` and halt the guarded action itself;
      * prefer {@link emit}. */
@@ -102,6 +150,9 @@ export declare class InterceptionEmitter {
     /** The declared provider's output for `ctx` (§10.1); `null` iff the
      * provider is `null`. Throws {@link AgentHooksCoreError} iff the
      * provider rejected the context (§10.2 fail-closed value domain). */
+    /** Custom-provider identity, or null when the provider fails (the
+     * emission has already been decided at this point). */
+    private tryCustomIdentity;
     private identityOf;
     /** Consult the approval seam for a liftable deny (§9), when the
      * profile conditions allow it: `enforce` mode, not `agent_shutdown`,

package/dist/emitter.js

@@ -117,6 +117,11 @@ class InterceptionEmitter {
     _records = [];
     composition = index_1.Composition.default();
     identity = index_1.JCS_SHA256;
+    names = [];
+    approvalRedactor = null;
+    recordSink = null;
+    maxRecords = null;
+    _recordsDropped = 0;
     /**
      * `timeoutMs` bounds each interceptor `intercept()` and resolver
      * `resolve()` call (§7, RECOMMENDED default 5000 ms); breach fails
@@ -151,27 +156,105 @@ class InterceptionEmitter {
     get records() {
         return this._records;
     }
-    register(interceptor) {
+    /** Register an interceptor, optionally with a host-chosen
+     * payload-free `name` recorded on `verdicts[].name` (§10.3). */
+    register(interceptor, name) {
         this.interceptors.push(interceptor);
+        this.names.push(name ?? null);
         return this;
     }
-    /** Declare the composition profile for subsequent emissions (§7.1). */
+    /**
+     * Declare the composition profile for subsequent emissions (§7.1).
+     * The profile and knob values are validated against the closed §7.2
+     * sets at call time (the compile-time types do not protect plain-JS
+     * callers): an undeclared value throws `RangeError` so no emission
+     * can start under semantics the operator did not declare.
+     *
+     * The default (`sequential/first_deny`, `on_approval: stop`) is the
+     * configuration §14 warns about: after an approval lifts a liftable
+     * deny, interceptors registered after the escalating one never run
+     * for that emission (`fold_truncated` on the record). Register
+     * must-run controls first, or use `sequential/run_all` / a parallel
+     * profile. See docs/PRODUCTION.md.
+     */
     setComposition(composition) {
+        const profiles = Object.values(index_1.CompositionProfile);
+        if (!profiles.includes(composition.profile)) {
+            throw new RangeError(`unknown composition profile ${JSON.stringify(composition.profile)}: the profile set is closed (§7.2)`);
+        }
+        const knobs = [
+            ["on_approval", composition.on_approval, ["stop", "resume"]],
+            ["on_disagreement", composition.on_disagreement, ["deny", "approval"]],
+            ["on_transform_conflict", composition.on_transform_conflict, ["deny", "approval"]],
+        ];
+        for (const [name, value, allowed] of knobs) {
+            if (value !== undefined && !allowed.includes(value)) {
+                throw new RangeError(`unknown ${name} value ${JSON.stringify(value)}: ${allowed.map((a) => `"${a}"`).join(" | ")} (§7.4–§7.5)`);
+            }
+        }
         this.composition = composition;
         return this;
     }
-    /** Declare the identity provider (§10.1). Default `"jcs-sha256"`. */
+    /** Declare the identity provider (§10.1). Default `"jcs-sha256"`.
+     * §10.1 name rules are enforced: a custom provider name must match
+     * `^[a-z][a-z0-9_-]*$` and must not begin with `jcs` (reserved so a
+     * custom function can never claim golden-vector semantics). */
     setIdentityProvider(provider) {
+        if (provider !== null && provider !== index_1.JCS_SHA256) {
+            if (!/^[a-z][a-z0-9_-]*$/.test(provider.name) || provider.name.startsWith("jcs")) {
+                throw new RangeError("identity provider name must match ^[a-z][a-z0-9_-]*$ and must not begin with 'jcs' (§10.1)");
+            }
+        }
         this.identity = provider;
         return this;
     }
+    /** Register the §9/§14 approval redactor: a pure function producing
+     * the context to place in every ApprovalRequest. The §9 identity is
+     * computed over the redacted context (binding the approval to what
+     * the approver saw); the record's identities are unaffected. A
+     * redactor that throws fails the consultation closed as
+     * `host_error:approval_resolver_failed`. */
+    setApprovalRedactor(redactor) {
+        this.approvalRedactor = redactor;
+        return this;
+    }
+    /** Register a per-emission record callback (§10.3), invoked
+     * synchronously after every emission before buffering; a sink
+     * exception is swallowed (audit delivery is the host's liveness
+     * concern, not the control plane's). */
+    setRecordSink(sink) {
+        this.recordSink = sink;
+        return this;
+    }
+    /** Bound the in-memory record buffer: when full, the OLDEST record
+     * is dropped and {@link recordsDropped} increments. Unbounded by
+     * default. */
+    setMaxRecords(max) {
+        this.maxRecords = max;
+        return this;
+    }
+    /** Records evicted by the {@link setMaxRecords} bound. */
+    get recordsDropped() {
+        return this._recordsDropped;
+    }
+    /** Drain the in-memory record buffer (retention stays bounded on
+     * long-running sessions). */
+    takeRecords() {
+        const out = this._records;
+        this._records = [];
+        return out;
+    }
     /** Run the emission and **throw** {@link InterceptionBlocked} if the
-     * guarded action must not proceed (§6). Primary entry point. */
+     * guarded action must not proceed (§6). Primary entry point.
+     *
+     * Returns the record plus the **effective** (post-composition)
+     * target the guarded action MUST consume (§4.3) — a reference
+     * captured before `emit` may predate a transform. */
     async emit(ctx) {
         const record = await this.emitUnchecked(ctx);
         if (!(0, index_1.proceeds)(record))
             throw new index_1.InterceptionBlocked(record);
-        return record;
+        return { record, target: ctx["target"] };
     }
     /** Run the emission and return the record without throwing. The
      * caller MUST inspect `proceeds` and halt the guarded action itself;
@@ -187,15 +270,17 @@ class InterceptionEmitter {
             outcome = synthesized(index_1.HostError.ContextInvalid, (0, index_1.nonFiniteDetail)(hit));
         }
         else {
-            // §10.3: input identity binds to the context BEFORE dispatch, so
-            // neither interceptor mutation nor fold-through can retroactively
-            // alter what the record claims was evaluated.
+            // §4/§6.3: an invalid envelope is denied before any interceptor
+            // or identity provider sees it; §10.3: input identity binds to
+            // the context BEFORE dispatch.
             try {
+                native_1.native.validateEnvelope(JSON.stringify(ctx));
                 inputIdentity = this.identityOf(ctx);
             }
             catch (e) {
-                // §10.2: the default provider rejected the value domain. Fail
-                // closed before any interceptor runs.
+                // §10.1/§10.2: envelope invalid, value domain rejected, or the
+                // provider itself failed. Fail closed before any interceptor
+                // runs.
                 outcome = synthesized(...codeAndDetail(e));
             }
         }
@@ -208,14 +293,20 @@ class InterceptionEmitter {
             identity_provider: providerName,
             enforced_identity: 
             // Custom providers only; the core computes jcs-sha256 itself.
+            // A provider that fails here yields honest absence (§10.1) —
+            // the pre-dispatch failure path already denies.
             !identityFailed && this.identity !== null && this.identity !== index_1.JCS_SHA256
-                ? this.identity.fn(ctx)
+                ? this.tryCustomIdentity(ctx)
                 : null,
             decided_by: outcome.decidedBy,
             composition: this.composition,
-            verdicts: outcome.verdicts,
+            verdicts: outcome.verdicts.map((v) => ({
+                ...v,
+                ...(this.names[v.index] != null ? { name: this.names[v.index] } : {}),
+            })),
             fold_truncated: outcome.foldTruncated,
             resolved_by: outcome.resolvedBy,
+            interceptors_registered: this.interceptors.length,
         };
         let record;
         if (identityFailed) {
@@ -229,6 +320,21 @@ class InterceptionEmitter {
         else {
             record = (0, index_1.finalize)(ctx, outcome.combined, this.mode, meta);
         }
+        if (this.recordSink) {
+            // Audit delivery must not take down the control plane (§10.3).
+            try {
+                this.recordSink(record);
+            }
+            catch {
+                /* swallowed by design */
+            }
+        }
+        if (this.maxRecords !== null) {
+            while (this._records.length >= Math.max(this.maxRecords, 1)) {
+                this._records.shift();
+                this._recordsDropped += 1;
+            }
+        }
         this._records.push(record);
         return record;
     }
@@ -247,8 +353,14 @@ class InterceptionEmitter {
                 return this.dispatchFirstDeny(ctx);
             case index_1.CompositionProfile.SequentialRunAll:
                 return this.dispatchRunAll(ctx);
-            default:
+            case index_1.CompositionProfile.ParallelStrictest:
+            case index_1.CompositionProfile.ParallelUnanimous:
                 return this.dispatchParallel(ctx);
+            default:
+                // Unreachable through the public API: setComposition validates
+                // against the closed §7.2 set. Fail closed rather than silently
+                // dispatch under undeclared semantics.
+                return synthesized(index_1.HostError.ContextInvalid, "undeclared composition profile (§7.2)");
         }
     }
     /** Invoke one interceptor on its own copy of `ctx` (§7) and pass the
@@ -328,13 +440,14 @@ class InterceptionEmitter {
                     };
                 }
                 if (!c.permitted) {
-                    // Reject / unresolved / echo violation: a deny stands (§9).
+                    // Reject / unresolved / echo violation: a deny stands (§9);
+                    // the consultation is still recorded (§10.3 resolved_by).
                     return {
                         combined: withUnions(c.verdict, pool),
                         decidedBy: isHostSynthesized(c.verdict) ? null : i,
                         verdicts: summaries(perInterceptor),
                         foldTruncated: truncated(i),
-                        resolvedBy,
+                        resolvedBy: "rejection",
                     };
                 }
                 resolvedBy = "approval";
@@ -483,6 +596,8 @@ class InterceptionEmitter {
                     combined = (0, index_1.permits)(sub.decision) ? withUnions(sub, [...all, sub]) : sub;
                 }
                 else {
+                    // §10.3: consultation without a permit substitution.
+                    resolvedBy = "rejection";
                     combined = withUnions(c.verdict, all);
                     if (isHostSynthesized(c.verdict))
                         decidedBy = null;
@@ -522,6 +637,16 @@ class InterceptionEmitter {
     /** The declared provider's output for `ctx` (§10.1); `null` iff the
      * provider is `null`. Throws {@link AgentHooksCoreError} iff the
      * provider rejected the context (§10.2 fail-closed value domain). */
+    /** Custom-provider identity, or null when the provider fails (the
+     * emission has already been decided at this point). */
+    tryCustomIdentity(ctx) {
+        try {
+            return this.identityOf(ctx);
+        }
+        catch {
+            return null;
+        }
+    }
     identityOf(ctx) {
         if (this.identity === null)
             return null;
@@ -531,7 +656,9 @@ class InterceptionEmitter {
             return this.identity.fn(ctx);
         }
         catch (e) {
-            throw new native_1.AgentHooksCoreError(index_1.HostError.ContextInvalid, `identity provider ${this.identity.name} raised: ${e?.message ?? e}`);
+            // §14/TM-09: exception *type* only — a provider error message can
+            // embed the context it was hashing.
+            throw new native_1.AgentHooksCoreError(index_1.HostError.ContextInvalid, `identity provider failed: ${e?.constructor?.name ?? "Error"} (see spec §10.1)`);
         }
     }
     /** Consult the approval seam for a liftable deny (§9), when the
@@ -552,11 +679,23 @@ class InterceptionEmitter {
             verdict: (0, index_1.hostErrorVerdict)(err, detail),
             permitted: false,
         });
+        // §9/§14: the host's approval redactor minimizes the context
+        // egressing through the seam; a throwing redactor fails closed.
+        let presented = ctx;
+        if (this.approvalRedactor) {
+            try {
+                presented = this.approvalRedactor(ctx);
+            }
+            catch (e) {
+                return fail(index_1.HostError.ApprovalResolverFailed, e?.constructor?.name ?? "Error");
+            }
+        }
         // §9: identity of the context as presented to the resolver —
-        // consultation time, after any transforms that folded earlier.
+        // consultation time, after any transforms that folded earlier and
+        // after any redaction.
         let identity;
         try {
-            identity = this.identityOf(ctx);
+            identity = this.identityOf(presented);
         }
         catch (e) {
             const [code, detail] = codeAndDetail(e);
@@ -568,7 +707,7 @@ class InterceptionEmitter {
                 context_identity: identity,
                 interception_point: ctx.interception_point,
                 verdict,
-                context: ctx,
+                context: presented,
             }));
         }
         catch (e) {

package/dist/index.d.ts

@@ -98,6 +98,9 @@ export declare const Verdict: Readonly<{
     /** What earlier drafts called `warn`: an `allow` carrying one
      * warning (§5.1). */
     warn(reason?: string, message?: string): Verdict;
+    /** A plain, final deny: no `approval` block, so the approval seam
+     * cannot lift it (§5.1). */
+    deny(reason?: string, message?: string): Verdict;
     /** What earlier drafts called `escalate`: a liftable deny — denied
      * as-is unless the approval seam lifts it (§5.1, §9). */
     escalate(reason?: string, message?: string): Verdict;
@@ -186,6 +189,8 @@ export interface VerdictSummary {
     index: number;
     decision: Decision;
     reason?: string | null;
+    /** Host-chosen payload-free registration identifier (§10.3). */
+    name?: string;
 }
 /** Host-side record of one emission (§10.3).
  *
@@ -211,6 +216,15 @@ export interface InterceptionRecord {
     session_id: string;
     /** `ctx.sequence` — total order within the session (§12.2.3). */
     sequence: number;
+    /** RFC 3339 instant copied from `ctx.timestamp` (§10.3); absent when
+     * the context lacked the field. */
+    timestamp?: string;
+    /** W3C Trace Context correlation echoed from the context's optional
+     * `trace` block (§4.5); absent when the context carried none. */
+    trace?: {
+        trace_id?: string;
+        span_id?: string;
+    };
     /** Registration index of the interceptor whose verdict won the
      * aggregation or whose liftable deny was consulted (§7.6); `null`
      * for a pure-allow combination or a host-synthesized verdict. */
@@ -221,11 +235,15 @@ export interface InterceptionRecord {
      * (`sequential/run_all`, `parallel/*`). */
     verdicts?: VerdictSummary[];
     /** `true` iff one or more registered interceptors were never invoked
-     * in this emission. Defined only for `sequential/first_deny` (§7.4). */
+     * in this emission (short-circuit, approval-stop, or a failed
+     * fold-transform). Defined for the sequential profiles (§7.4). */
     fold_truncated?: boolean;
-    /** `"approval"` iff an approval resolution substituted for a verdict
-     * in this emission (§7.6). */
-    resolved_by?: "approval" | null;
+    /** Consultation outcome (§7.6, §10.3): `"approval"` iff a permit
+     * resolution substituted; `"rejection"` iff consulted without a
+     * lift; absent iff never consulted. */
+    resolved_by?: "approval" | "rejection" | null;
+    /** Interceptors registered at emission time (§10.3). */
+    interceptors_registered: number;
 }
 /** Whether the guarded action executes (§6, §8). */
 export declare function proceeds(r: InterceptionRecord): boolean;
@@ -299,10 +317,12 @@ export interface FinalizeMeta {
     composition: CompositionConfig;
     /** Per-interceptor summaries (multi-verdict profiles, §10.3). */
     verdicts?: VerdictSummary[] | null;
-    /** `sequential/first_deny` only (§7.4). */
+    /** Sequential profiles (§7.4). */
     fold_truncated?: boolean | null;
-    /** `"approval"` iff a resolution substituted for a verdict (§7.6). */
-    resolved_by?: "approval" | null;
+    /** Consultation outcome: `"approval"` / `"rejection"` / none (§7.6). */
+    resolved_by?: "approval" | "rejection" | null;
+    /** Interceptors registered at emission time (§10.3). */
+    interceptors_registered?: number;
 }
 /** §10.3: build the `InterceptionRecord` for one completed emission.
  * `meta.input_identity` MUST have been computed before interceptor
@@ -322,6 +342,13 @@ export declare function composeAggregate(composition: CompositionConfig, verdict
 export { AgentContextBuilder } from "./builder";
 export { InterceptionEmitter } from "./emitter";
 /** Raised by a host when a verdict blocks the guarded action (§6). */
+/** Returned by `InterceptionEmitter.emit` on a proceeding emission:
+ * the record plus the **effective** (post-composition) target the
+ * guarded action MUST consume (§4.3). */
+export interface EmitOutcome {
+    record: InterceptionRecord;
+    target: unknown;
+}
 export declare class InterceptionBlocked extends Error {
     readonly result: InterceptionRecord;
     constructor(result: InterceptionRecord);

package/dist/index.js

@@ -90,6 +90,11 @@ exports.Verdict = Object.freeze({
     warn(reason, message) {
         return { decision: exports.Decision.Allow, warnings: [{ reason, message }] };
     },
+    /** A plain, final deny: no `approval` block, so the approval seam
+     * cannot lift it (§5.1). */
+    deny(reason, message) {
+        return { decision: exports.Decision.Deny, reason, message };
+    },
     /** What earlier drafts called `escalate`: a liftable deny — denied
      * as-is unless the approval seam lifts it (§5.1, §9). */
     escalate(reason, message) {
@@ -249,6 +254,7 @@ function finalize(ctx, verdict, mode, meta) {
         verdicts: meta.verdicts ?? null,
         fold_truncated: meta.fold_truncated ?? null,
         resolved_by: meta.resolved_by ?? null,
+        interceptors_registered: meta.interceptors_registered ?? 0,
     })));
 }
 /** §7.3/§7.5 aggregation for the multi-verdict profiles: severity-max
@@ -261,7 +267,6 @@ var builder_1 = require("./builder");
 Object.defineProperty(exports, "AgentContextBuilder", { enumerable: true, get: function () { return builder_1.AgentContextBuilder; } });
 var emitter_1 = require("./emitter");
 Object.defineProperty(exports, "InterceptionEmitter", { enumerable: true, get: function () { return emitter_1.InterceptionEmitter; } });
-/** Raised by a host when a verdict blocks the guarded action (§6). */
 class InterceptionBlocked extends Error {
     result;
     constructor(result) {

package/dist/native.d.ts

@@ -16,6 +16,7 @@ export declare const native: {
     canonicalJson: (valueJson: string) => string;
     contextIdentity: (ctxJson: string) => string;
     validateVerdict: (verdictJson: string) => string;
+    validateEnvelope: (ctxJson: string) => string;
     applyTransform: (targetJson: string, path: string, valueJson: string) => string;
     applyTransformCtx: (ctxJson: string, path: string, valueJson: string) => string;
     validateTransformCtx: (ctxJson: string, path: string, valueJson: string) => string;

package/dist/native.js

@@ -44,6 +44,7 @@ exports.native = {
     canonicalJson: wrap(binding.canonicalJson),
     contextIdentity: wrap(binding.contextIdentity),
     validateVerdict: wrap(binding.validateVerdict),
+    validateEnvelope: wrap(binding.validateEnvelope),
     applyTransform: wrap(binding.applyTransform),
     applyTransformCtx: wrap(binding.applyTransformCtx),
     validateTransformCtx: wrap(binding.validateTransformCtx),