@sema-agent/core 2.12.0 → 3.0.0

package/dist/internal/llm.d.ts

@@ -1,2 +1,2 @@
 export { createAssistantMessageEventStream, stripEngineMetadata } from "../engine/llm/index.js";
-export type { AnthropicMessagesCompat, AssistantMessage, AssistantMessageDiagnostic, AssistantMessageEvent, Context, DocumentContent, ImageContent, Message, Model, ResilienceOptions, SimpleStreamOptions, StallTimeouts, StopReason, StreamFn, TextContent, ThinkingContent, Tool, ToolCall, ToolResultMessage, Usage, UserMessage, } from "../engine/llm/index.js";
+export type { AnthropicMessagesCompat, AssistantMessage, AssistantMessageDiagnostic, AssistantMessageEvent, CompleteSimpleFn, Context, DocumentContent, ImageContent, Message, Model, ResilienceOptions, SimpleStreamOptions, StallTimeouts, StopReason, StreamFn, TextContent, ThinkingContent, Tool, ToolCall, ToolResultMessage, Usage, UserMessage, } from "../engine/llm/index.js";

package/dist/orchestration/workflow-governance.js

@@ -37,6 +37,32 @@ function minDefined(...vals) {
     const xs = vals.filter((v) => typeof v === "number" && Number.isFinite(v));
     return xs.length ? Math.min(...xs) : undefined;
 }
+function minPositiveDefined(...vals) {
+    const xs = vals.filter((v) => typeof v === "number" && Number.isFinite(v) && v > 0);
+    return xs.length ? Math.min(...xs) : undefined;
+}
+const NON_POSITIVE_LIMIT_MSG = (field, what) => `agent(spec): \`limits.${field}\` must be a POSITIVE number — a value of 0 or less DISABLES the ${what} ` +
+    `downstream (it is a sentinel, not a tighter ceiling), and a workflow script may only tighten a limit, never remove it`;
+function pickImageInput(el, i) {
+    const at = `agent(spec): \`images[${i}]\``;
+    if (typeof el !== "object" || el === null || Array.isArray(el)) {
+        throw new WorkflowScriptError(`${at} must be an object — either { url } or { data, mimeType }`);
+    }
+    const o = el;
+    if ("url" in o) {
+        if (typeof o.url !== "string" || o.url.length === 0) {
+            throw new WorkflowScriptError(`${at}.url must be a non-empty string`);
+        }
+        return { url: o.url };
+    }
+    if (typeof o.data !== "string") {
+        throw new WorkflowScriptError(`${at}.data must be a base64 string (or supply { url } instead)`);
+    }
+    if (typeof o.mimeType !== "string" || o.mimeType.length === 0) {
+        throw new WorkflowScriptError(`${at}.mimeType must be a non-empty string, e.g. "image/png"`);
+    }
+    return { data: o.data, mimeType: o.mimeType };
+}
 function pickWhitelist(scriptSpec) {
     if (typeof scriptSpec !== "object" || scriptSpec === null || Array.isArray(scriptSpec)) {
         throw new WorkflowScriptError("agent(spec): spec must be an object with at least an `objective` string");
@@ -60,7 +86,7 @@ function pickWhitelist(scriptSpec) {
     if (s.images !== undefined) {
         if (!Array.isArray(s.images))
             throw new WorkflowScriptError("agent(spec): `images` must be an array");
-        safe.images = s.images;
+        safe.images = s.images.map(pickImageInput);
     }
     if (s.limits !== undefined) {
         if (typeof s.limits !== "object" || s.limits === null || Array.isArray(s.limits)) {
@@ -71,11 +97,15 @@ function pickWhitelist(scriptSpec) {
         if (l.maxTurns !== undefined) {
             if (typeof l.maxTurns !== "number" || !Number.isFinite(l.maxTurns))
                 throw new WorkflowScriptError("agent(spec): `limits.maxTurns` must be a number");
+            if (l.maxTurns <= 0)
+                throw new WorkflowScriptError(NON_POSITIVE_LIMIT_MSG("maxTurns", "turn cap"));
             limits.maxTurns = l.maxTurns;
         }
         if (l.timeoutSec !== undefined) {
             if (typeof l.timeoutSec !== "number" || !Number.isFinite(l.timeoutSec))
                 throw new WorkflowScriptError("agent(spec): `limits.timeoutSec` must be a number");
+            if (l.timeoutSec <= 0)
+                throw new WorkflowScriptError(NON_POSITIVE_LIMIT_MSG("timeoutSec", "wall-clock window"));
             limits.timeoutSec = l.timeoutSec;
         }
         safe.limits = limits;
@@ -116,20 +146,24 @@ function clampResourceLimits(safe, base, caps) {
     }
     const requestedTimeoutSec = safe.limits?.timeoutSec;
     const requestedMaxTurns = safe.limits?.maxTurns;
-    const timeoutSec = minDefined(safe.limits?.timeoutSec, base.limits?.timeoutSec, caps?.perAgentTimeoutSec);
-    const maxTurns = minDefined(safe.limits?.maxTurns, base.limits?.maxTurns, caps?.childMaxTurns);
+    const timeoutSec = minPositiveDefined(safe.limits?.timeoutSec, base.limits?.timeoutSec, caps?.perAgentTimeoutSec);
+    const maxTurns = minPositiveDefined(safe.limits?.maxTurns, base.limits?.maxTurns, caps?.childMaxTurns);
     if (timeoutSec !== undefined && timeoutSec !== requestedTimeoutSec) {
         notes.push({ field: "timeoutSec", requested: requestedTimeoutSec, applied: timeoutSec });
     }
     if (maxTurns !== undefined && maxTurns !== requestedMaxTurns) {
         notes.push({ field: "maxTurns", requested: requestedMaxTurns, applied: maxTurns });
     }
-    if (timeoutSec !== undefined || maxTurns !== undefined) {
-        safe.limits = {
-            ...(maxTurns !== undefined ? { maxTurns } : {}),
-            ...(timeoutSec !== undefined ? { timeoutSec } : {}),
-        };
-    }
+    const baseOtherLimits = { ...base.limits };
+    delete baseOtherLimits.maxTurns;
+    delete baseOtherLimits.timeoutSec;
+    const rebuilt = {
+        ...baseOtherLimits,
+        ...(maxTurns !== undefined ? { maxTurns } : {}),
+        ...(timeoutSec !== undefined ? { timeoutSec } : {}),
+    };
+    if (base.limits !== undefined || Object.keys(rebuilt).length > 0)
+        safe.limits = rebuilt;
     return notes;
 }
 export function buildGovernedChildSpec(scriptSpec, baseline, models, caps, onResourceClamp) {

package/dist/orchestration/workflow-sandbox-conformance.js

@@ -1,20 +1,31 @@
 import assert from "node:assert/strict";
 const META = "export const meta = { name: 'conformance', description: 'sandbox escape probes' }\n";
+const WITNESS_FN = "__probeWitness";
+const WITNESS_PRELUDE = `function ${WITNESS_FN}(v) {\n` +
+    `  if (v === null || v === undefined) return null\n` +
+    `  var t = typeof v\n` +
+    `  if (t === 'function') return { hostCapabilityReached: true, via: 'function' }\n` +
+    `  if (t !== 'object') return null\n` +
+    `  var names = ['pid', 'env', 'version', 'mainModule', 'binding']\n` +
+    `  var hit = []\n` +
+    `  for (var i = 0; i < names.length; i++) { try { if (names[i] in v) hit.push(names[i]) } catch (err) { } }\n` +
+    `  return hit.length > 0 ? { hostCapabilityReached: true, via: 'object', keys: hit } : null\n` +
+    `}\n`;
 const ESCAPE_BODIES = [
-    `return agent.constructor.constructor("return typeof process !== 'undefined' ? process : null")()`,
-    `return log.constructor.constructor("return typeof process !== 'undefined' ? process : null")()`,
-    `return budget.constructor.constructor("return typeof process !== 'undefined' ? process : null")()`,
-    `return ({}).constructor.constructor("return typeof process !== 'undefined' ? process : null")()`,
-    `return args.constructor.constructor("return typeof require !== 'undefined' ? require : null")()`,
-    `const r = await agent({ objective: 'x' }); return (r ?? {}).constructor.constructor("return typeof require !== 'undefined' ? require : null")()`,
-    `return (typeof process !== 'undefined' ? process : null)`,
-    `return (typeof require !== 'undefined' ? require : null)`,
-    `return (typeof globalThis !== 'undefined' && globalThis.process) ? globalThis.process : null`,
+    `return ${WITNESS_FN}(agent.constructor.constructor("return typeof process !== 'undefined' ? process : null")())`,
+    `return ${WITNESS_FN}(log.constructor.constructor("return typeof process !== 'undefined' ? process : null")())`,
+    `return ${WITNESS_FN}(budget.constructor.constructor("return typeof process !== 'undefined' ? process : null")())`,
+    `return ${WITNESS_FN}(({}).constructor.constructor("return typeof process !== 'undefined' ? process : null")())`,
+    `return ${WITNESS_FN}(args.constructor.constructor("return typeof require !== 'undefined' ? require : null")())`,
+    `const r = await agent({ objective: 'x' }); return ${WITNESS_FN}((r ?? {}).constructor.constructor("return typeof require !== 'undefined' ? require : null")())`,
+    `return ${WITNESS_FN}(typeof process !== 'undefined' ? process : null)`,
+    `return ${WITNESS_FN}(typeof require !== 'undefined' ? require : null)`,
+    `return ${WITNESS_FN}((typeof globalThis !== 'undefined' && globalThis.process) ? globalThis.process : null)`,
 ];
 const ERROR_PATH_BODIES = [
-    `try { await agent({ objective: 'x' }); return null } catch (e) { return e.constructor.constructor("return typeof process !== 'undefined' ? process : null")() }`,
-    `try { await parallel([]); return null } catch (e) { return e.constructor.constructor("return typeof require !== 'undefined' ? require : null")() }`,
-    `try { await agent({}); return null } catch (e) { return (e && e.constructor && e.constructor.constructor) ? e.constructor.constructor("return (typeof globalThis !== 'undefined' && globalThis.process) ? globalThis.process : null")() : null }`,
+    `try { await agent({ objective: 'x' }); return null } catch (e) { return ${WITNESS_FN}(e.constructor.constructor("return typeof process !== 'undefined' ? process : null")()) }`,
+    `try { await parallel([]); return null } catch (e) { return ${WITNESS_FN}(e.constructor.constructor("return typeof require !== 'undefined' ? require : null")()) }`,
+    `try { await agent({}); return null } catch (e) { return ${WITNESS_FN}((e && e.constructor && e.constructor.constructor) ? e.constructor.constructor("return (typeof globalThis !== 'undefined' && globalThis.process) ? globalThis.process : null")() : null) }`,
 ];
 const POLLUTION_BODIES = [
     `return JSON.parse('{"__proto__":{"polluted":1}}')`,
@@ -24,9 +35,9 @@ const POLLUTION_BODIES = [
     `return [JSON.parse('{"__proto__":{"polluted":1}}')]`,
 ];
 const SIGNAL_BODIES = [
-    `return (typeof signal !== 'undefined' && signal) ? signal.constructor.constructor("return typeof process !== 'undefined' ? process : null")() : null`,
-    `return (typeof input !== 'undefined' && input && input.signal) ? input.signal.constructor.constructor("return typeof process !== 'undefined' ? process : null")() : null`,
-    `try { return (typeof signal !== 'undefined' && signal) ? (signal.addEventListener ? signal.addEventListener.constructor("return typeof process !== 'undefined' ? process : null")() : null) : null } catch (e) { return null }`,
+    `return ${WITNESS_FN}((typeof signal !== 'undefined' && signal) ? signal.constructor.constructor("return typeof process !== 'undefined' ? process : null")() : null)`,
+    `return ${WITNESS_FN}((typeof input !== 'undefined' && input && input.signal) ? input.signal.constructor.constructor("return typeof process !== 'undefined' ? process : null")() : null)`,
+    `try { return ${WITNESS_FN}((typeof signal !== 'undefined' && signal) ? (signal.addEventListener ? signal.addEventListener.constructor("return typeof process !== 'undefined' ? process : null")() : null) : null) } catch (e) { return null }`,
 ];
 function benignPrimitives() {
     return {
@@ -84,6 +95,49 @@ function looksLikeHostCapability(v) {
     }
     return false;
 }
+function witnessReportsHostCapability(v) {
+    return typeof v === "object" && v !== null && v.hostCapabilityReached === true;
+}
+function reachedHostCapability(v) {
+    return looksLikeHostCapability(v) || witnessReportsHostCapability(v);
+}
+const CANARY_MARKER = "workflow-conformance-canary";
+let canarySeq = 0;
+const CANARY_BODY = `const c = args.canary\n` +
+    `return { marker: '${CANARY_MARKER}', nonce: c.nonce, sum: c.x + c.y, joined: ['${CANARY_MARKER}', c.nonce].join(':') }`;
+async function runLivenessCanary(runner) {
+    const nonce = `n${++canarySeq}`;
+    const scriptArgs = { canary: { nonce, x: 17, y: 25 } };
+    let result;
+    try {
+        const out = await runner.run({ scriptSource: META + CANARY_BODY, primitives: benignPrimitives(), scriptArgs });
+        result = out.result;
+    }
+    catch (err) {
+        return { ok: false, detail: `run() REJECTED with: ${err instanceof Error ? err.message : String(err)}` };
+    }
+    const expected = { marker: CANARY_MARKER, nonce, sum: 42, joined: `${CANARY_MARKER}:${nonce}` };
+    try {
+        assert.deepEqual(result, expected);
+    }
+    catch {
+        return { ok: false, detail: `run() returned ${JSON.stringify(result)} — expected ${JSON.stringify(expected)}` };
+    }
+    return { ok: true, detail: "" };
+}
+async function runProbeBody(runner, scriptSource, primitives, family, signal) {
+    try {
+        const out = await runner.run({ scriptSource, primitives, scriptArgs: { probe: true }, signal });
+        return { executed: true, result: out.result };
+    }
+    catch (err) {
+        const live = await runLivenessCanary(runner);
+        assert.ok(live.ok, `${family}: the probe threw AND the runner then failed the liveness canary — this runner is BROKEN, ` +
+            `not blocking, so nothing about its membrane was proven. probe: ${scriptSource.slice(META.length)} | ` +
+            `probe threw: ${err instanceof Error ? err.message : String(err)} | canary: ${live.detail}`);
+        return { executed: false };
+    }
+}
 export async function assertWorkflowPrimitivesWiring(runner) {
     assert.equal(runner.safeForUntrustedScripts, true, "wiring conformance targets a HARD runner (safeForUntrustedScripts must be true)");
     const hostSeen = { phaseCalls: [], scopedBodyRan: false, logs: [] };
@@ -144,54 +198,34 @@ export async function assertWorkflowPrimitivesWiring(runner) {
 }
 export async function assertWorkflowSandboxConformance(runner) {
     assert.equal(runner.safeForUntrustedScripts, true, "conformance is only meaningful for a HARD runner (safeForUntrustedScripts must be true)");
+    const live = await runLivenessCanary(runner);
+    assert.ok(live.ok, `POSITIVE CONTROL FAILED — this runner did not execute the canary script and return its value, so the ` +
+        `escape battery below cannot certify anything about it (a runner that runs nothing produces the same ` +
+        `"nothing leaked" results as a perfect sandbox). ${live.detail}`);
     for (const escBody of ESCAPE_BODIES) {
-        const scriptSource = META + escBody;
-        let result;
-        try {
-            const out = await runner.run({ scriptSource, primitives: benignPrimitives(), scriptArgs: { probe: true } });
-            result = out.result;
-        }
-        catch {
+        const out = await runProbeBody(runner, META + WITNESS_PRELUDE + escBody, benignPrimitives(), "sandbox escape");
+        if (!out.executed)
             continue;
-        }
-        assert.equal(looksLikeHostCapability(result), false, `sandbox escape REACHED a host capability via: ${escBody}`);
+        assert.equal(reachedHostCapability(out.result), false, `sandbox escape REACHED a host capability via: ${escBody}`);
     }
     for (const errBody of ERROR_PATH_BODIES) {
-        const scriptSource = META + errBody;
-        let result;
-        try {
-            const out = await runner.run({ scriptSource, primitives: throwingPrimitives(), scriptArgs: { probe: true } });
-            result = out.result;
-        }
-        catch {
+        const out = await runProbeBody(runner, META + WITNESS_PRELUDE + errBody, throwingPrimitives(), "error-path");
+        if (!out.executed)
             continue;
-        }
-        assert.equal(looksLikeHostCapability(result), false, `error-path: a host-side primitive error leaked a host capability via: ${errBody}`);
+        assert.equal(reachedHostCapability(out.result), false, `error-path: a host-side primitive error leaked a host capability via: ${errBody}`);
     }
     for (const polBody of POLLUTION_BODIES) {
-        const scriptSource = META + polBody;
-        let result;
-        try {
-            const out = await runner.run({ scriptSource, primitives: benignPrimitives(), scriptArgs: { probe: true } });
-            result = out.result;
-        }
-        catch {
+        const out = await runProbeBody(runner, META + polBody, benignPrimitives(), "prototype pollution");
+        if (!out.executed)
             continue;
-        }
-        assert.equal(graphHasInjectedProtoKey(result), false, `prototype pollution: the marshalled result carries an injected __proto__/constructor/prototype own key via: ${polBody}`);
+        assert.equal(graphHasInjectedProtoKey(out.result), false, `prototype pollution: the marshalled result carries an injected __proto__/constructor/prototype own key via: ${polBody}`);
     }
     const hostSignal = new AbortController().signal;
     for (const sigBody of SIGNAL_BODIES) {
-        const scriptSource = META + sigBody;
-        let result;
-        try {
-            const out = await runner.run({ scriptSource, primitives: benignPrimitives(), scriptArgs: { probe: true }, signal: hostSignal });
-            result = out.result;
-        }
-        catch {
+        const out = await runProbeBody(runner, META + WITNESS_PRELUDE + sigBody, benignPrimitives(), "signal-path", hostSignal);
+        if (!out.executed)
             continue;
-        }
-        assert.equal(looksLikeHostCapability(result), false, `signal-path: the host AbortSignal leaked a host capability via: ${sigBody}`);
+        assert.equal(reachedHostCapability(out.result), false, `signal-path: the host AbortSignal leaked a host capability via: ${sigBody}`);
     }
 }
 const DETERMINISM_FORBIDDEN_BODIES = [

package/dist/orchestration/workflow-script-store.js

@@ -1,5 +1,5 @@
-import { mkdirSync, readFileSync, writeFileSync, existsSync } from "node:fs";
-import { join, resolve, sep } from "node:path";
+import { mkdirSync, readFileSync, realpathSync, writeFileSync, existsSync } from "node:fs";
+import { basename, dirname, join, resolve, sep } from "node:path";
 import { sanitizeScope } from "../stores/file/fs-atomic.js";
 function isPlainObject(v) {
     return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -30,6 +30,26 @@ export function normalizeStringArg(callArgs, defaultArgs, key = "topic") {
 function safeFileStem(id) {
     return /^[A-Za-z0-9._-]{1,120}$/.test(id) && !id.startsWith(".") ? id : undefined;
 }
+function containedBy(root, p) {
+    return p === root || p.startsWith(root + sep);
+}
+function canonicalizeDeepestExisting(p) {
+    let cur = p;
+    const missingTail = [];
+    for (;;) {
+        try {
+            const real = realpathSync(cur);
+            return missingTail.length === 0 ? real : join(real, ...[...missingTail].reverse());
+        }
+        catch {
+            const parent = dirname(cur);
+            if (parent === cur)
+                return undefined;
+            missingTail.push(basename(cur));
+            cur = parent;
+        }
+    }
+}
 export function createFileWorkflowScriptStore(dir) {
     const root = resolve(dir);
     const scopeDir = (scope) => join(root, sanitizeScope(scope));
@@ -48,10 +68,20 @@ export function createFileWorkflowScriptStore(dir) {
         load(scriptPath, scope) {
             const base = scopeDir(scope);
             const full = resolve(scriptPath);
-            if (full !== base && !full.startsWith(base + sep)) {
+            if (!containedBy(base, full)) {
                 throw new Error(`workflow script store: scriptPath is outside this scope's script partition`);
             }
-            return readFileSync(full, "utf-8");
+            const physRoot = canonicalizeDeepestExisting(root);
+            const physBase = canonicalizeDeepestExisting(base);
+            const physFull = canonicalizeDeepestExisting(full);
+            const refusePhysical = () => {
+                throw new Error(`workflow script store: scriptPath is outside this scope's script partition after symlink resolution`);
+            };
+            if (physRoot !== undefined && physBase !== undefined && !containedBy(physRoot, physBase))
+                refusePhysical();
+            if (physBase !== undefined && physFull !== undefined && !containedBy(physBase, physFull))
+                refusePhysical();
+            return readFileSync(physFull ?? full, "utf-8");
         },
         resolveName(name) {
             if (/^wf_/i.test(name))

package/dist/orchestration/workflow.js

@@ -480,13 +480,15 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
         if (row !== undefined)
             row.sessionId = sessionId;
     };
-    const bceTick = (callKey, e) => {
+    const bceTick = (callKey, e, fromSessionId) => {
         if (!bceSink)
             return;
         const id = waIdOf(callKey);
         const row = bceLive.get(id);
         if (row === undefined)
             return;
+        if (fromSessionId !== undefined && row.sessionId !== undefined && fromSessionId !== row.sessionId)
+            return;
         bceEmit({
             kind: "tick",
             taskId: id,
@@ -507,8 +509,10 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
         if (!bceSink)
             return;
         const id = waIdOf(callKey);
+        const row = bceLive.get(id);
         if (!bceLive.delete(id))
             return;
+        const coord = sessionId ?? row?.sessionId;
         bceEmit({
             kind: "terminal",
             taskId: id,
@@ -516,7 +520,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
             owner: runId,
             workflowRunId: runId,
             ...(scope !== undefined ? { scope } : {}),
-            ...(sessionId !== undefined ? { sessionId, transcriptId: sessionId } : {}),
+            ...(coord !== undefined ? { sessionId: coord, transcriptId: coord } : {}),
             status,
             summary: boundedRedactedSummary(summary, 300),
             ...(stats !== undefined ? { usage: { tokens: stats.tokens, turns: stats.turns, ...(stats.costMicroUsd !== undefined ? { costMicroUsd: stats.costMicroUsd } : {}) } } : {}),
@@ -873,7 +877,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                             ? {
                                 onForwardEvent: (e) => {
                                     if (e.type === "task_progress")
-                                        bceTick(callKey, e);
+                                        bceTick(callKey, e, attemptSessionId);
                                     try {
                                         baseInternals.onForwardEvent?.(e);
                                     }
@@ -927,7 +931,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                     const onTurnEndUsage = (usage) => {
                         if (finalized)
                             return;
-                        const turnTokens = usage ? usage.inputTokens + usage.outputTokens : 0;
+                        const turnTokens = usage ? usage.totalInputTokens + usage.outputTokens : 0;
                         const turnCost = usage?.costMicroUsd ?? 0;
                         beatTokens += turnTokens;
                         beatTurns += 1;
@@ -1181,7 +1185,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                         ? {
                             onForwardEvent: (e) => {
                                 if (e.type === "task_progress")
-                                    bceTick(callKey, e);
+                                    bceTick(callKey, e, childSessionId);
                                 try {
                                     enrichedForwardS?.(e);
                                 }
@@ -1229,7 +1233,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
             const onTurnEndUsage = (usage) => {
                 if (finalized)
                     return;
-                const turnTokens = usage ? usage.inputTokens + usage.outputTokens : 0;
+                const turnTokens = usage ? usage.totalInputTokens + usage.outputTokens : 0;
                 const turnCost = usage?.costMicroUsd ?? 0;
                 beatTokens += turnTokens;
                 beatTurns += 1;

package/dist/prompt-assembly/artifact-store.d.ts

@@ -58,6 +58,8 @@ export declare class CenterPromptSource implements PromptArtifactSource {
     private readonly engineVersion;
     private candidate;
     private state;
+    private tail;
+    private exclusive;
     constructor(opts: {
         store: PromptArtifactStore;
         stateStore?: PromptSourceStateStore;

package/dist/prompt-assembly/artifact-store.js

@@ -1,6 +1,9 @@
 import { mkdirSync, promises as fs } from "node:fs";
 import path from "node:path";
 import { verifyPromptArtifact, } from "./artifact.js";
+function normalizedEnvelope(parsed, artifact) {
+    return { ...parsed, artifact };
+}
 export class MemoryPromptArtifactStore {
     byDigest = new Map();
     async get(artifactDigest, opts) {
@@ -17,7 +20,7 @@ export class MemoryPromptArtifactStore {
         const v = verifyPromptArtifact(parsed, opts);
         if (!v.ok || v.artifact.artifactDigest !== artifactDigest)
             return undefined;
-        return parsed;
+        return normalizedEnvelope(parsed, v.artifact);
     }
     async put(envelope) {
         this.byDigest.set(envelope.artifact.artifactDigest, JSON.stringify(envelope));
@@ -54,7 +57,7 @@ export class FilePromptArtifactStore {
         const v = verifyPromptArtifact(parsed, opts);
         if (!v.ok || v.artifact.artifactDigest !== artifactDigest)
             return undefined;
-        return parsed;
+        return normalizedEnvelope(parsed, v.artifact);
     }
     async put(envelope) {
         const file = this.fileFor(envelope.artifact.artifactDigest);
@@ -113,6 +116,12 @@ export class CenterPromptSource {
     engineVersion;
     candidate;
     state = "unavailable";
+    tail = Promise.resolve();
+    exclusive(fn) {
+        const run = this.tail.then(fn, fn);
+        this.tail = run.then(() => undefined, () => undefined);
+        return run;
+    }
     constructor(opts) {
         this.store = opts.store;
         this.stateStore = opts.stateStore ?? new MemoryPromptSourceStateStore();
@@ -128,20 +137,22 @@ export class CenterPromptSource {
         return env?.artifact;
     }
     async restore() {
-        const state = await this.stateStore.load();
-        if (state?.state === "disabled") {
-            this.candidate = undefined;
-            this.state = "disabled";
-            return;
-        }
-        if (state?.state !== "active") {
-            this.candidate = undefined;
-            this.state = "unavailable";
-            return;
-        }
-        const env = await this.store.get(state.artifactDigest, { engineVersion: this.engineVersion });
-        this.candidate = env !== undefined ? { artifact: env.artifact, sourceRevision: state.sourceRevision } : undefined;
-        this.state = env !== undefined ? "active" : "unavailable";
+        return this.exclusive(async () => {
+            const state = await this.stateStore.load();
+            if (state?.state === "disabled") {
+                this.candidate = undefined;
+                this.state = "disabled";
+                return;
+            }
+            if (state?.state !== "active") {
+                this.candidate = undefined;
+                this.state = "unavailable";
+                return;
+            }
+            const env = await this.store.get(state.artifactDigest, { engineVersion: this.engineVersion });
+            this.candidate = env !== undefined ? { artifact: env.artifact, sourceRevision: state.sourceRevision } : undefined;
+            this.state = env !== undefined ? "active" : "unavailable";
+        });
     }
     sourceState() {
         return this.state;
@@ -151,15 +162,19 @@ export class CenterPromptSource {
         if (!v.ok)
             return v;
         const envelope = raw;
-        await this.store.put(envelope);
-        await this.stateStore.save({ state: "active", artifactDigest: v.artifact.artifactDigest, sourceRevision: envelope.sourceRevision });
-        this.candidate = { artifact: v.artifact, sourceRevision: envelope.sourceRevision };
-        this.state = "active";
-        return { ok: true, artifactDigest: v.artifact.artifactDigest };
+        return this.exclusive(async () => {
+            await this.store.put(envelope);
+            await this.stateStore.save({ state: "active", artifactDigest: v.artifact.artifactDigest, sourceRevision: envelope.sourceRevision });
+            this.candidate = { artifact: v.artifact, sourceRevision: envelope.sourceRevision };
+            this.state = "active";
+            return { ok: true, artifactDigest: v.artifact.artifactDigest };
+        });
     }
     async applyDisabled(sourceRevision) {
-        await this.stateStore.save({ state: "disabled", sourceRevision });
-        this.candidate = undefined;
-        this.state = "disabled";
+        return this.exclusive(async () => {
+            await this.stateStore.save({ state: "disabled", sourceRevision });
+            this.candidate = undefined;
+            this.state = "disabled";
+        });
     }
 }

package/dist/prompt-assembly/assemble.js

@@ -40,6 +40,7 @@ function mountDeclarations(basePack, decls, onWarn) {
     const counters = {};
     const extra = [];
     let replacesRoleBase = false;
+    let replacedRoleBaseBy;
     for (const d of decls) {
         if (!d.id || d.id.startsWith("core/") || d.id.length > 128 || !/^[a-z0-9][a-z0-9/._-]*$/.test(d.id)) {
             throw new Error(`prompt-provider stableBlocks: invalid section id ${JSON.stringify(d.id).slice(0, 140)} (must match ^[a-z0-9][a-z0-9/._-]*$, ≤128 chars, non-core/)`);
@@ -47,8 +48,10 @@ function mountDeclarations(basePack, decls, onWarn) {
         const base = SLOT_BASE[d.slot];
         if (base === undefined)
             throw new Error(`prompt-provider stableBlocks: unknown slot "${String(d.slot)}" ("${d.id}")`);
-        if (d.slot === "identity")
+        if (d.slot === "identity") {
             replacesRoleBase = true;
+            replacedRoleBaseBy ??= d.id;
+        }
         const n = (counters[d.slot] = (counters[d.slot] ?? 0) + 1);
         const declaredContentHash = verifyDeclaredContentHash(d, onWarn);
         extra.push({
@@ -68,10 +71,21 @@ function mountDeclarations(basePack, decls, onWarn) {
         });
     }
     return {
-        ...basePack,
-        sections: [...basePack.sections.filter((s) => !(replacesRoleBase && s.id === "core/role.base")), ...extra],
+        pack: {
+            ...basePack,
+            sections: [...basePack.sections.filter((s) => !(replacesRoleBase && s.id === "core/role.base")), ...extra],
+        },
+        ...(replacedRoleBaseBy !== undefined && basePack.sections.some((s) => s.id === "core/role.base")
+            ? { replacedRoleBaseBy }
+            : {}),
     };
 }
+function warnRoleBaseEviction(replacedRoleBaseBy, origin, onWarn) {
+    if (replacedRoleBaseBy === undefined || origin === "pack-default")
+        return;
+    const what = origin === "task-system-prompt" ? "the caller's per-task systemPrompt" : "the PromptProvider's own role text";
+    onWarn?.(`prompt-constitution: identity declaration "${replacedRoleBaseBy}" supplants the role base, so ${what} does NOT compose into this prompt (identity sections replace the role layer by design). Fold that text into the declaration, or use a scenario/behavior slot to keep the role base.`, "prompt-constitution");
+}
 export function assemblePrompt(inputs) {
     const { provider, facts } = inputs;
     const onWarn = inputs.onWarn
@@ -93,6 +107,7 @@ export function assemblePrompt(inputs) {
     };
     let pack = SEMA_DEFAULT_PACK;
     let roleBase = inputs.userSystemPrompt ?? DEFAULT_SYSTEM_PROMPT;
+    let roleBaseOrigin = inputs.userSystemPrompt !== undefined ? "task-system-prompt" : "pack-default";
     let constitution = "core";
     let mountedCenter = [];
     if (!inputs.isDefaultProvider && provider.stableBlocks) {
@@ -108,6 +123,10 @@ export function assemblePrompt(inputs) {
             if (inputs.centerDeclarations && inputs.centerDeclarations.length > 0) {
                 onWarn?.("prompt-constitution: a center prompt artifact is adopted but the provider's assembled-identity pass-through owns the prompt — the center sections cannot mount on this migration path.", "prompt-constitution");
             }
+            const droppedDecls = decls.filter((d) => d !== assembledIdentity);
+            if (droppedDecls.length > 0) {
+                onWarn?.(`prompt-provider stableBlocks: the assembled-identity pass-through owns the prompt — ${droppedDecls.length} other declaration(s) do NOT compose this run: ${droppedDecls.map((d) => `"${d.id}" (${d.slot})`).join(", ")}. Declare ONLY the role layer in the identity block to let them mount.`, "prompt-constitution");
+            }
             const renderInputsPT = (date) => ({
                 roleBase: assembledIdentity.text,
                 facts,
@@ -153,29 +172,41 @@ export function assemblePrompt(inputs) {
             return true;
         });
         mountedCenter = centerDecls;
-        pack = mountDeclarations(SEMA_DEFAULT_PACK, [...centerDecls, ...decls], onWarn);
+        const mountedSB = mountDeclarations(SEMA_DEFAULT_PACK, [...centerDecls, ...decls], onWarn);
+        pack = mountedSB.pack;
+        warnRoleBaseEviction(mountedSB.replacedRoleBaseBy, roleBaseOrigin, onWarn);
     }
     else if (!inputs.isDefaultProvider && provider.stableSystem) {
         const roleOut = provider.stableSystem(stableCtx);
         if (provider.replaceAll) {
             constitution = "replaced";
             roleBase = roleOut;
+            roleBaseOrigin = "provider";
             pack = subsetPack(SEMA_DEFAULT_PACK, { exclude: REPLACE_ALL_EXCLUDED, roleBaseLegacyId: "provider.replace_all" });
         }
         else if (roleOut.includes(CYBER_RISK) && roleOut.includes(URL_SAFETY) && roleOut.includes(HARNESS_SECTION_ANCHOR)) {
             constitution = "provider-assembled";
             roleBase = roleOut;
+            roleBaseOrigin = "provider";
             pack = subsetPack(SEMA_DEFAULT_PACK, { keep: OPAQUE_KEPT, roleBaseLegacyId: "provider.assembled" });
             onWarn?.("prompt-constitution: this PromptProvider returns an already-assembled prompt (constitution anchor found). Core now appends the constitution structurally — return ONLY the role base from stableSystem (or set replaceAll:true to own the whole base). Passed through un-doubled.", "prompt-constitution");
         }
         else {
             roleBase = roleOut;
+            roleBaseOrigin = "provider";
         }
     }
     if (inputs.centerDeclarations && inputs.centerDeclarations.length > 0 && !(!inputs.isDefaultProvider && provider.stableBlocks)) {
-        const composedCenter = inputs.centerDeclarations;
-        pack = mountDeclarations(pack, composedCenter, onWarn);
-        mountedCenter = composedCenter;
+        if (constitution === "provider-assembled") {
+            onWarn?.("prompt-constitution: a center prompt artifact is adopted but this PromptProvider returned an already-assembled prompt — the pass-through owns the prompt and the center sections cannot mount on this migration path (an identity section would evict the provider text that carries the constitution). Return ONLY the role base from stableSystem to let center sections compose.", "prompt-constitution");
+        }
+        else {
+            const composedCenter = inputs.centerDeclarations;
+            const mountedC = mountDeclarations(pack, composedCenter, onWarn);
+            pack = mountedC.pack;
+            warnRoleBaseEviction(mountedC.replacedRoleBaseBy, roleBaseOrigin, onWarn);
+            mountedCenter = composedCenter;
+        }
     }
     const renderInputs = (date) => ({
         roleBase,