@sema-agent/core 5.12.0 → 5.13.0

package/dist/core/runner/prepare-memory.js

@@ -1,3 +1,4 @@
+import { admitMemoryScopes } from "../memory-admission.js";
 import { adoptLegacyRepoDirs, deriveRepoControlPlaneDir, deriveProjectControlDir, deriveProjectMemoryDir, deriveRepoMemoryDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, lookupProjectIdHint, recordProjectIdHint, resolveMemoryEngineRoot } from "../memory-engine/layout.js";
 import { classifyScopePlanes, derivePersonalControlDir, derivePersonalMemoryDir, mergeHarvestReports, mergeInjections, needsDualRoots, parsedProjectPlane } from "../memory-engine/dual-root.js";
 import { normalizeMemorySpec } from "../memory.js";
@@ -5,8 +6,33 @@ import { MemoryEngine } from "../memory-engine/engine.js";
 import { assertScopeContractPlacement, parseScopeKey, resolveProjectId } from "../memory-engine/scope-contract.js";
 import { FileMemoryEngineBackend } from "../memory-engine/file-backend.js";
 export async function prepareMemory(input) {
-    const { spec, deps, sessionId, taskRootPath, memoryWriteGateRef } = input;
+    const { spec, deps, sessionId, taskRootPath, memoryWriteGateRef, admissionCtx } = input;
     const memorySpec = normalizeMemorySpec(spec.memory);
+    let admittedOrgScopes = [];
+    let ownOrgVerdict;
+    if (memorySpec && memorySpec.enabled && deps.memoryBackend) {
+        const outcome = await admitMemoryScopes({
+            memorySpec,
+            principal: spec.principal,
+            admission: deps.memoryScopeAdmission,
+            deploymentScopes: new Set(deps.deploymentMemoryScopes ?? []),
+            orgMemoryDenied: admissionCtx.orgMemoryDenied,
+            complianceDegraded: admissionCtx.complianceDegraded,
+            parentAdmittedOrgScopes: admissionCtx.parentAdmittedOrgScopes,
+            priorOwnVerdict: admissionCtx.priorOwnVerdict,
+            governedProvenance: admissionCtx.governedProvenance,
+        });
+        admittedOrgScopes = outcome.admittedOrgScopes;
+        ownOrgVerdict = outcome.ownVerdict;
+        for (const droppedScope of outcome.droppedDeploymentScopes) {
+            deps.onError?.(new Error(`org memory scope "${droppedScope}" (deployment-declared) was narrowed away (admission resolver or the session's frozen verdict) — the layer is not mounted this session.`), { phase: "memory", sessionId });
+        }
+        if (outcome.writeScopeNarrowed) {
+            deps.onError?.(new Error(`org memory writeScope "${String(memorySpec.writeScope)}" was not explicitly granted by admission — the session's memory write face is read-only (org layers default read-only).`), { phase: "memory", sessionId });
+        }
+        memorySpec.scopes = outcome.scopes;
+        memorySpec.writeScope = outcome.writeScope;
+    }
     const useMemoryEngine = Boolean(memorySpec && memorySpec.enabled && deps.memoryBackend);
     let memoryEngineSession;
     if (useMemoryEngine && memorySpec) {
@@ -193,5 +219,5 @@ export async function prepareMemory(input) {
         if (memoryBlock !== undefined && injection.indexSeed !== undefined)
             seedFiles = [injection.indexSeed];
     }
-    return { memoryEngineSession, memoryBlock, ...(seedFiles !== undefined ? { seedFiles } : {}) };
+    return { memoryEngineSession, memoryBlock, admittedOrgScopes, ownOrgVerdict, ...(seedFiles !== undefined ? { seedFiles } : {}) };
 }

package/dist/core/runner/prepare-task.d.ts

@@ -304,6 +304,8 @@ export interface InheritedGate {
         rules: SessionPermissionRules;
     }>;
     shellGate?: "off" | "always" | "classify";
+    admittedOrgScopes?: readonly string[];
+    orgAdmissionGoverned?: true;
     parentConstraints?: ReadonlyArray<{
         policy: ToolPolicy;
         onAsk?: OnAsk;

package/dist/core/runner/prepare-task.js

@@ -38,6 +38,10 @@ import { OUTPUT_TOOL_NAME, REPORT_FINDINGS_TOOL_NAME, SKILL_CONTENT_MAX_CHARS, S
 import { compileOutputSchema } from "./strict-output-schema.js";
 import { TOOL_SEARCH_NAME, buildDeferredRegistry, classifyDeferred, extractDiscoveredToolNames, createPlaceholderTool, createToolSearchTool, } from "./tool-disclosure.js";
 import { composeMemoryBlock } from "../memory.js";
+import { preflightLockedConfig } from "../locked-config.js";
+import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, complianceCallDenial, resolveComplianceDenies } from "../compliance.js";
+import { assertRetentionCapability } from "../retention.js";
+import { foldAdmissionFreeze } from "../memory-admission.js";
 import { prepareMemory } from "./prepare-memory.js";
 import { defaultPromptProvider, buildEnvironmentContext, buildGitSnapshot, formatLocalDate, isValidTimeZone, PROJECT_CONTEXT_FRAMING } from "../../prompts/default.js";
 import { assemblePrompt } from "../../prompt-assembly/assemble.js";
@@ -69,7 +73,7 @@ import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-
 import { createLspTool, gitCheckIgnoreFilter, resolveLspPath } from "../lsp.js";
 import { resolveKey } from "../../tools/fs/safety.js";
 import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
-import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, remainingBudgetMicroUsd, } from "../checkpoint-store.js";
+import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, remainingBudgetMicroUsd, } from "../checkpoint-store.js";
 import { boundInputHashOf } from "../canonical-json.js";
 import { GLOBAL_USAGE_KEY, resolveUsageWindows, usageRetryAfterMs } from "../usage-window-store.js";
 const RECONCILE_MAX_RETRIES = 3;
@@ -337,6 +341,16 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         e.code = "config.empty_objective";
         throw e;
     }
+    const lockedPreflight = preflightLockedConfig(spec, deps);
+    assertRetentionCapability({
+        policy: deps.retentionPolicy,
+        locked: lockedPreflight.lockedKeys.has("retentionPolicy"),
+        stores: [
+            { name: "sessionStore", store: sessions },
+            { name: "checkpointStore", store: resolveCheckpointStore(spec, deps) },
+            { name: "toolResultStore", store: deps.toolResultStore },
+        ],
+    });
     resolveTaskLimits(spec.limits);
     if (spec.resourceSuspend !== undefined) {
         const rsus = spec.resourceSuspend;
@@ -940,9 +954,24 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ? liveShellGate
                     : seedShellGate;
         const inheritedParentConstraints = liveInheritedGate?.parentConstraints;
+        const liveAdmittedOrg = liveInheritedGate?.admittedOrgScopes;
+        const seedAdmittedOrg = seedInheritedGate?.admittedOrgScopes;
+        const inheritedAdmittedOrgScopes = liveAdmittedOrg === undefined ? seedAdmittedOrg : seedAdmittedOrg === undefined ? liveAdmittedOrg : liveAdmittedOrg.filter((s) => seedAdmittedOrg.includes(s));
+        const inheritedOrgGoverned = liveInheritedGate?.orgAdmissionGoverned === true || seedInheritedGate?.orgAdmissionGoverned === true;
+        const priorOwnOrgVerdict = resume?.seed.inheritedGate?.ownAdmittedOrgScopes !== undefined
+            ? { scopes: resume.seed.inheritedGate.ownAdmittedOrgScopes, writeScope: resume.seed.inheritedGate.ownAdmittedOrgWriteScope ?? null }
+            : undefined;
+        const orgGovernedProvenance = deps.memoryScopeAdmission !== undefined ||
+            (deps.deploymentMemoryScopes !== undefined && deps.deploymentMemoryScopes.length > 0) ||
+            deps.compliancePostureResolver !== undefined ||
+            inheritedOrgGoverned ||
+            priorOwnOrgVerdict !== undefined;
         const specShellGate = spec.shellGate ?? "off";
         const effectiveShellGate = inheritedShellGate !== undefined && shellGateRank[inheritedShellGate] > shellGateRank[specShellGate] ? inheritedShellGate : specShellGate;
         const ownSessionRulesRef = {};
+        const memoryAdmittedOrgScopesRef = { current: [] };
+        const ownOrgVerdictRef = { current: undefined };
+        const orgAdmissionCheckpointState = () => inheritedAdmittedOrgScopes !== undefined || ownOrgVerdictRef.current !== undefined || orgGovernedProvenance;
         const frozenOnAsk = spec.onAsk ?? deps.onAsk;
         const frozenOnQuestion = spec.onQuestion ?? deps.onQuestion;
         const inheritedGateForChildren = () => {
@@ -950,7 +979,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 ...(inheritedAncestorRules ?? []),
                 ...(ownSessionRulesRef.current !== undefined ? [ownSessionRulesRef.current] : []),
             ];
-            const ownCallerPolicy = spec.toolPolicy ?? deps.toolPolicy;
+            const ownCallerPolicy = lockedPreflight.toolPolicy;
             const durableMandate = runtimeCaps?.forceDurableGate === true || (spec.durableApproval !== undefined && frozenOnAsk === undefined);
             const parentConstraints = [
                 ...(inheritedParentConstraints ?? []),
@@ -968,6 +997,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 ...(ancestorRules.length > 0 ? { ancestorRules } : {}),
                 ...(effectiveShellGate !== "off" ? { shellGate: effectiveShellGate } : {}),
                 ...(parentConstraints.length > 0 ? { parentConstraints } : {}),
+                admittedOrgScopes: memoryAdmittedOrgScopesRef.current,
+                ...(orgGovernedProvenance ? { orgAdmissionGoverned: true } : {}),
             };
         };
         let agentForkDenial;
@@ -1072,6 +1103,39 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 runtimeCaps = { allowWorkflows: false, allowFork: false };
             }
         }
+        let complianceDenies = new Set();
+        let complianceDegraded = false;
+        if (deps.compliancePostureResolver) {
+            try {
+                const posture = (await deps.compliancePostureResolver(spec.principal)) ?? undefined;
+                if (posture !== undefined)
+                    complianceDenies = resolveComplianceDenies(posture);
+            }
+            catch (err) {
+                deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
+                complianceDenies = new Set(COMPLIANCE_CAPABILITIES);
+                complianceDegraded = true;
+            }
+            const complianceRefuse = (capability, requested) => {
+                const e = new Error(`${requested} is denied for this principal by the compliance posture (capability "${capability}"` +
+                    `${complianceDegraded ? "; the posture resolver is currently failing, so every managed capability is denied fail-closed" : ""}) — ` +
+                    `the task is refused rather than silently narrowed.`);
+                e.code = complianceDegraded ? "config.compliance_required" : "config.compliance_denied";
+                throw e;
+            };
+            if (complianceDenies.has("mcp_servers") && lockedPreflight.mcp?.length) {
+                complianceRefuse("mcp_servers", "TaskSpec.mcp (MCP server materialization)");
+            }
+            if (complianceDenies.has("workflows") && spec.selfOrchestration === true) {
+                complianceRefuse("workflows", "TaskSpec.selfOrchestration (workflow self-orchestration)");
+            }
+            if (complianceDenies.has("web_fetch")) {
+                const webTool = (spec.tools ?? []).find((t) => t.name === WEB_FETCH_TOOL_NAME || (t.aliases ?? []).includes(WEB_FETCH_TOOL_NAME));
+                if (webTool !== undefined) {
+                    complianceRefuse("web_fetch", `TaskSpec.tools["${webTool.name}"] (the WebFetch tool face)`);
+                }
+            }
+        }
         agentForkDenial = forkGovernanceDenial(spec.enableFork, runtimeCaps?.allowFork);
         observersActive = runtimeCaps?.allowObservers === true;
         if (runtimeCaps?.autoMode === true && deps.autoMode !== undefined) {
@@ -1220,8 +1284,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
             tools.push(createOutputTool(outputRef, spec.outputSchema, compiled.strict ? compiled.modelSchema : undefined));
         }
-        mcp = spec.mcp?.length
-            ? await materializeMcpTools(spec.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer)
+        mcp = lockedPreflight.mcp?.length
+            ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer)
             : { tools: [], toolAxes: [], warnings: [], serverInstructions: [], instructionsDelta: { pendingAdds: [], pendingRemovals: [] }, droppedTools: [], statuses: [], refresh: async () => [], dispose: async () => { } };
         for (const w of mcp.warnings)
             deps.onError?.(w, { phase: "mcp", sessionId });
@@ -1241,7 +1305,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         tools.push(...mcp.tools.map((t) => remoteToolOffload(t)));
         const rebuildHarnessToolsRef = {};
         const toolCallGateArmedRef = { armed: false };
-        if (spec.mcp?.length) {
+        if (lockedPreflight.mcp?.length) {
             tools.push({
                 name: "RefreshMcpTools",
                 label: "RefreshMcpTools",
@@ -1632,7 +1696,31 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     .catch(() => undefined);
             }
             : undefined;
-        const { memoryEngineSession, memoryBlock: memoryBlockFromEngine, seedFiles: memorySeedFiles } = await prepareMemory({ spec, deps, sessionId, taskRootPath, memoryWriteGateRef });
+        const { memoryEngineSession, memoryBlock: memoryBlockFromEngine, seedFiles: memorySeedFiles, admittedOrgScopes: memoryAdmittedOrgScopes, ownOrgVerdict: memoryOwnOrgVerdict, } = await prepareMemory({
+            spec,
+            deps,
+            sessionId,
+            taskRootPath,
+            memoryWriteGateRef,
+            admissionCtx: {
+                orgMemoryDenied: complianceDenies.has("org_memory_mount"),
+                complianceDegraded,
+                parentAdmittedOrgScopes: foldAdmissionFreeze({
+                    delegated: internals?.isDelegatedChild === true ||
+                        internals?.inheritedGate !== undefined ||
+                        (resume?.seed.inheritedGate !== undefined &&
+                            (resume.seed.inheritedGate.ancestorRules !== undefined ||
+                                resume.seed.inheritedGate.shellGate !== undefined ||
+                                resume.seed.inheritedGate.admittedOrgScopes !== undefined ||
+                                resume.seed.inheritedGate.requiresParentConstraint)),
+                    inherited: inheritedAdmittedOrgScopes,
+                }),
+                priorOwnVerdict: priorOwnOrgVerdict,
+                governedProvenance: orgGovernedProvenance,
+            },
+        });
+        memoryAdmittedOrgScopesRef.current = memoryAdmittedOrgScopes;
+        ownOrgVerdictRef.current = memoryOwnOrgVerdict ?? priorOwnOrgVerdict;
         let memoryBlock = memoryBlockFromEngine;
         if (memorySeedFiles?.length && seedContextFiles) {
             try {
@@ -1737,7 +1825,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         { entries: [], seedAnnounced: true }
                     : undefined;
         const provider = spec.promptProvider ?? deps.promptProvider ?? defaultPromptProvider;
-        const promptPolicyEnabled = Boolean(spec.toolPolicy ?? deps.toolPolicy);
+        const promptPolicyEnabled = Boolean(lockedPreflight.toolPolicy);
         const promptHooks = spec.hooks ?? deps.hooks;
         const promptHooksEnabled = Boolean(promptHooks?.preToolUse || promptHooks?.postToolUse);
         const failClosedReason = selfOrchestrationFailClosedReason(spec, deps);
@@ -2328,7 +2416,6 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }));
             },
             ...(spec.streamingToolExecution === true ? { streamingToolExecution: true } : {}),
-            followUpMode: "all",
             env: executionEnv,
             session,
             tools: harnessTools,
@@ -2368,7 +2455,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 releaseSignal = () => sig.removeEventListener("abort", onExternalAbort);
             }
         }
-        const policy = spec.toolPolicy ?? deps.toolPolicy;
+        const policy = lockedPreflight.toolPolicy;
         const auditPolicyNames = (auditee) => {
             const nameGroups = toolPolicyNameSets(auditee);
             if (nameGroups.length > 0) {
@@ -2456,7 +2543,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         for (const layer of narrowingLayers)
             auditPolicyNames(layer);
         const denyNarrowingPolicy = narrowingLayers.length === 0 ? undefined : narrowingLayers.length === 1 ? narrowingLayers[0] : combinePolicies(...narrowingLayers);
-        const basePolicyForResumeEdit = spec.toolPolicy ?? deps.toolPolicy;
+        const basePolicyForResumeEdit = lockedPreflight.toolPolicy;
         const sameInstanceAncestorCount = policy === undefined ? 0 : (inheritedParentConstraints ?? []).reduce((n, pc) => (pc.policy === policy ? n + 1 : n), 0);
         const sharedFirstDecision = new Map();
         const SHARED_FIRST_DECISION_CAP = 256;
@@ -2994,10 +3081,20 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 inheritedGate: (() => {
                     const requiresParentConstraint = (inheritedParentConstraints?.length ?? 0) > 0 || seedInheritedGate?.requiresParentConstraint === true;
                     const parentConstraintCount = (inheritedParentConstraints?.length ?? 0) > 0 ? inheritedParentConstraints.length : seedInheritedGate?.parentConstraintCount;
-                    return inheritedAncestorRules !== undefined || inheritedShellGate !== undefined || requiresParentConstraint
+                    return inheritedAncestorRules !== undefined ||
+                        inheritedShellGate !== undefined ||
+                        inheritedAdmittedOrgScopes !== undefined ||
+                        ownOrgVerdictRef.current !== undefined ||
+                        orgGovernedProvenance ||
+                        requiresParentConstraint
                         ? {
                             ...(inheritedAncestorRules !== undefined ? { ancestorRules: structuredClone(inheritedAncestorRules) } : {}),
                             ...(inheritedShellGate !== undefined ? { shellGate: inheritedShellGate } : {}),
+                            ...(inheritedAdmittedOrgScopes !== undefined ? { admittedOrgScopes: [...inheritedAdmittedOrgScopes] } : {}),
+                            ...(ownOrgVerdictRef.current !== undefined
+                                ? { ownAdmittedOrgScopes: [...ownOrgVerdictRef.current.scopes], ownAdmittedOrgWriteScope: ownOrgVerdictRef.current.writeScope }
+                                : {}),
+                            ...(orgGovernedProvenance ? { orgAdmissionGoverned: true } : {}),
                             requiresParentConstraint,
                             ...(requiresParentConstraint && parentConstraintCount !== undefined ? { parentConstraintCount } : {}),
                         }
@@ -3112,7 +3209,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 const mintedAt = Date.now();
                 const cp = {
                     token,
-                    version: resourceLedgerOut.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : RESOURCE_CHECKPOINT_VERSION,
+                    version: orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : resourceLedgerOut.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : RESOURCE_CHECKPOINT_VERSION,
                     scope,
                     sessionId,
                     leafId,
@@ -3194,7 +3291,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const mintedAt = Date.now();
                     const cp = {
                         token,
-                        version: reviewLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
+                        version: orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : reviewLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
                         scope,
                         sessionId,
                         leafId,
@@ -3230,8 +3327,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 : undefined;
             const suspendAsk = checkpointStore && (durableApproval || irreversibleTools.size > 0 || egressTools.size > 0)
                 ? async (req, postHookArgs, safety, approverUnavailable) => {
-                    if (safety === undefined &&
-                        onAsk !== undefined &&
+                    if (onAsk !== undefined &&
                         runtimeCaps?.forceDurableGate !== true &&
                         approverUnavailable !== true &&
                         req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
@@ -3320,7 +3416,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         const mintedAt = Date.now();
                         cp = {
                             token,
-                            version: approvalLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
+                            version: orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : approvalLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
                             scope,
                             sessionId,
                             leafId,
@@ -3381,11 +3477,28 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 if (eff !== undefined && !toolEffects.has(t.name))
                     toolEffects.set(t.name, eff);
             }
-            toolCallGateArmedRef.armed = effectivePolicy !== undefined || hooks?.preToolUse !== undefined || egressTools.size > 0 || irreversibleTools.size > 0 || spec.enablePlanMode === true;
+            toolCallGateArmedRef.armed =
+                effectivePolicy !== undefined ||
+                    hooks?.preToolUse !== undefined ||
+                    egressTools.size > 0 ||
+                    irreversibleTools.size > 0 ||
+                    spec.enablePlanMode === true ||
+                    complianceDenies.has("web_fetch");
             if (toolCallGateArmedRef.armed) {
                 harness.on("tool_call", async (e) => {
                     blockedToolCalls.delete(e.toolCallId);
                     inheritedAskGrants.delete(e.toolCallId);
+                    {
+                        const complianceDeny = complianceCallDenial(complianceDenies, e.toolName);
+                        if (complianceDeny !== undefined) {
+                            if (blockedTracked)
+                                blockedToolCalls.add(e.toolCallId);
+                            if (notifyPermissionDenied) {
+                                await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: complianceDeny, source: "safety" });
+                            }
+                            return { block: true, reason: formatHookFeedback(complianceDeny), preToolContext: [] };
+                        }
+                    }
                     if (planModeRef.active && (toolEffects.get(e.toolName) ?? "write") !== "read") {
                         if (blockedTracked)
                             blockedToolCalls.add(e.toolCallId);

package/dist/core/runner/runtask.js

@@ -1450,6 +1450,12 @@ export class Runner {
                 errorMessage: err instanceof Error ? err.message : String(err),
                 errorCode: code,
                 ...(remoteEnvFailure !== undefined ? { remoteEnvFailures: remoteEnvFailure } : {}),
+                ...(() => {
+                    const hinted = err.retryAfterMs;
+                    return code === "memory.admission_required" && typeof hinted === "number" && Number.isFinite(hinted) && hinted > 0
+                        ? { retryAfterMs: hinted }
+                        : {};
+                })(),
                 stats: { turns: 0, tokens: 0, toolCalls: 0, cachedTokens: 0, costMicroUsd: 0 },
             };
             emitTrace(spec.tracer ?? this.deps.tracer, () => ({
@@ -1703,9 +1709,7 @@ export class Runner {
             queue.push({ type: "task_notification", notification: item.payload, ...notificationIdent() });
             if (notificationHarness) {
                 const xml = renderTaskNotificationXml(item.payload);
-                const deliver = item.priority === "later"
-                    ? notificationHarness.followUp(xml, { provenance: "engine-note", enginePayload: item.payload })
-                    : notificationHarness.steer(xml, { provenance: "engine-note", enginePayload: item.payload });
+                const deliver = notificationHarness.steer(xml, { provenance: "engine-note", enginePayload: item.payload });
                 void deliver.then(() => item.onDisposition?.("queued"), () => {
                     parkTaskNotification(item.payload, item.priority);
                     item.onDisposition?.("parked");
@@ -2323,6 +2327,22 @@ export class Runner {
         });
         const stopHook = (spec.hooks ?? this.deps.hooks)?.stop;
         const finalVerificationOn = spec.finalVerification === true;
+        const finalVerifyBudgetFill = () => {
+            let worst = 0;
+            if (rs.budget.maxTokensWindow !== undefined && rs.budget.maxTokensWindow > 0)
+                worst = Math.max(worst, stats.tokens / rs.budget.maxTokensWindow);
+            if (rs.budget.maxCostMicroUsd !== undefined && rs.budget.maxCostMicroUsd > 0)
+                worst = Math.max(worst, stats.costMicroUsd / rs.budget.maxCostMicroUsd);
+            if (walltimeMonotonicDeadline !== undefined && prepared.suspendForResource === undefined) {
+                const windowMs = walltimeMonotonicDeadline - rs.telemetry.taskStartMonotonic;
+                if (windowMs > 0)
+                    worst = Math.max(worst, (performance.now() - rs.telemetry.taskStartMonotonic) / windowMs);
+            }
+            return worst;
+        };
+        const emitFinalVerifyEcho = (body) => {
+            queue.push({ type: "steering_injected", source: "final_verification", preview: body.slice(0, 220), ...ident() });
+        };
         if (stopHook || finalVerificationOn) {
             let consecutiveBlocks = 0;
             prepared.harness.setStopGate(async () => {
@@ -2332,58 +2352,69 @@ export class Runner {
                     (rs.counters.finalVerifyInjections === 0 || (rs.counters.finalVerifyInjections === 1 && rs.counters.groundingSignalPreR9 && !rs.counters.groundingSignalPostR9)) &&
                     rs.counters.wroteThisRun &&
                     prepared.outputRef.set !== true &&
-                    !(rs.limits.effectiveMaxTurns !== undefined && rs.limits.effectiveMaxTurns > 0 && stats.turns >= rs.limits.effectiveMaxTurns - 1)) {
+                    !(rs.limits.effectiveMaxTurns !== undefined && rs.limits.effectiveMaxTurns > 0 && stats.turns >= rs.limits.effectiveMaxTurns - 1) &&
+                    finalVerifyBudgetFill() < 0.9) {
                     rs.counters.finalVerifyInjections += 1;
                     if (rs.counters.finalVerifyInjections === 2) {
+                        const reentryBody = "<system-reminder>[final verification] Your tool calls in this run worked with raw bytes, structural parsing, " +
+                            "or checksum/digest computation — the deliverable very likely embeds verifiable structure (structural fields, an " +
+                            "embedded checksum-family value, reference data it must match, or a replayable deterministic path). You MUST " +
+                            "execute the grounding check that structure supports — recompute the embedded value and compare it against the " +
+                            "declared one, re-parse the structure from the raw bytes and reconcile it with your output, compare against the " +
+                            "reference data, or replay the deterministic path — and REPORT the check's concrete result before finishing. " +
+                            "A closing statement without a reported check result is not verification. If you already ran such a check, state " +
+                            "its concrete result now; if the check mismatches, fix the deliverable first. This is the final reminder from " +
+                            "this verification gate — it will not intervene again.</system-reminder>";
+                        emitFinalVerifyEcho(reentryBody);
                         return [
                             {
                                 role: "user",
                                 engineMinted: true,
-                                content: "<system-reminder>[final verification] Your tool calls in this run worked with raw bytes, structural parsing, " +
-                                    "or checksum/digest computation — the deliverable very likely embeds verifiable structure (structural fields, an " +
-                                    "embedded checksum-family value, reference data it must match, or a replayable deterministic path). You MUST " +
-                                    "execute the grounding check that structure supports — recompute the embedded value and compare it against the " +
-                                    "declared one, re-parse the structure from the raw bytes and reconcile it with your output, compare against the " +
-                                    "reference data, or replay the deterministic path — and REPORT the check's concrete result before finishing. " +
-                                    "A closing statement without a reported check result is not verification. If you already ran such a check, state " +
-                                    "its concrete result now; if the check mismatches, fix the deliverable first. This is the final reminder from " +
-                                    "this verification gate — it will not intervene again.</system-reminder>",
+                                content: reentryBody,
                                 timestamp: Date.now(),
                             },
                         ];
                     }
+                    const nudgeBody = "<system-reminder>[final verification] Before finishing: re-verify the FINAL deliverable through its REAL entry point, " +
+                        "exactly as the acceptance criteria would exercise it — execute the binary/function/endpoint directly and read the ACTUAL " +
+                        "output and exit code. Do NOT rely on earlier self-tests, shell redirections, or assumptions (a program that prints to " +
+                        "stdout is not a program that writes the required file). If anything mismatches the task's requirements, fix it before " +
+                        "finishing. " +
+                        "Treat verification writes as state-harmless: when the deliverable itself is a persisted final " +
+                        "state (for example a committed or pushed file, a deployed artifact, or a required output file), " +
+                        "do not change that state merely to test it. This constrains HOW you verify — it is never a " +
+                        "license to skip the real acceptance path or to check a substitute of your own making: expected " +
+                        "values must come from the task's requirements, never from content you generated. If the real " +
+                        "acceptance path requires a write, use disposable inputs or an isolated target, end in the exact " +
+                        "required final state, and verify that final state before finishing. " +
+                        "If the work relied on a third-party API, library, or model, check the usage contract the object itself declares " +
+                        "(docstrings, metadata, configuration — e.g. prompt conventions shipped with a model) and confirm your calls follow " +
+                        "it rather than a default symmetric usage. Verify not only that the deliverable EXISTS but that the METHOD that " +
+                        "produced it matches the task's requirements. " +
+                        "Choose the verification SURFACE deliberately: check against the reference data, oracle, or evaluation tooling the " +
+                        "task itself provides — re-running your own implementation and getting the same answer is self-consistency, not " +
+                        "correctness — and cross-check through an independent second path where the task or environment offers one " +
+                        "(checksums, runtime artifacts). Verify the PERSISTED artifact — re-read what is actually on disk or committed, " +
+                        "not in-memory state — against every hard constraint from the original task text (numeric bounds, allowed-value " +
+                        "lists, naming semantics, required files), reconciling whole-set completeness: nothing missing, nothing duplicated. " +
+                        "If the deliverable embeds verifiable structure — structural fields, an embedded checksum-family value, " +
+                        "reference data it must match, or a replayable deterministic path — you MUST execute the grounding check " +
+                        "that structure supports and REPORT its concrete result in your closing summary: for such a deliverable, " +
+                        "no reported check result means the work is not finished. " +
+                        "If the task produced neither an executable deliverable nor any verifiable structure or acceptance " +
+                        "oracle to check against, briefly confirm completion and stop. " +
+                        "Residue YOUR OWN testing created (scratch files, running processes, generated outputs the task does not ask for) " +
+                        "is not protected state — if the task's required final state is a clean target, removing your own residue is part " +
+                        "of delivering it. " +
+                        "Verification must never LAUNDER uncertainty: if part of your conclusion was uncertain before this check, keep " +
+                        "reporting it as uncertain unless the check you actually ran resolved it — a re-stated conclusion is not new " +
+                        "evidence.</system-reminder>";
+                    emitFinalVerifyEcho(nudgeBody);
                     return [
                         {
                             role: "user",
                             engineMinted: true,
-                            content: "<system-reminder>[final verification] Before finishing: re-verify the FINAL deliverable through its REAL entry point, " +
-                                "exactly as the acceptance criteria would exercise it — execute the binary/function/endpoint directly and read the ACTUAL " +
-                                "output and exit code. Do NOT rely on earlier self-tests, shell redirections, or assumptions (a program that prints to " +
-                                "stdout is not a program that writes the required file). If anything mismatches the task's requirements, fix it before " +
-                                "finishing. " +
-                                "Treat verification writes as state-harmless: when the deliverable itself is a persisted final " +
-                                "state (for example a committed or pushed file, a deployed artifact, or a required output file), " +
-                                "do not change that state merely to test it. This constrains HOW you verify — it is never a " +
-                                "license to skip the real acceptance path or to check a substitute of your own making: expected " +
-                                "values must come from the task's requirements, never from content you generated. If the real " +
-                                "acceptance path requires a write, use disposable inputs or an isolated target, end in the exact " +
-                                "required final state, and verify that final state before finishing. " +
-                                "If the work relied on a third-party API, library, or model, check the usage contract the object itself declares " +
-                                "(docstrings, metadata, configuration — e.g. prompt conventions shipped with a model) and confirm your calls follow " +
-                                "it rather than a default symmetric usage. Verify not only that the deliverable EXISTS but that the METHOD that " +
-                                "produced it matches the task's requirements. " +
-                                "Choose the verification SURFACE deliberately: check against the reference data, oracle, or evaluation tooling the " +
-                                "task itself provides — re-running your own implementation and getting the same answer is self-consistency, not " +
-                                "correctness — and cross-check through an independent second path where the task or environment offers one " +
-                                "(checksums, runtime artifacts). Verify the PERSISTED artifact — re-read what is actually on disk or committed, " +
-                                "not in-memory state — against every hard constraint from the original task text (numeric bounds, allowed-value " +
-                                "lists, naming semantics, required files), reconciling whole-set completeness: nothing missing, nothing duplicated. " +
-                                "If the deliverable embeds verifiable structure — structural fields, an embedded checksum-family value, " +
-                                "reference data it must match, or a replayable deterministic path — you MUST execute the grounding check " +
-                                "that structure supports and REPORT its concrete result in your closing summary: for such a deliverable, " +
-                                "no reported check result means the work is not finished. " +
-                                "If the task produced neither an executable deliverable nor any verifiable structure or acceptance " +
-                                "oracle to check against, briefly confirm completion and stop.</system-reminder>",
+                            content: nudgeBody,
                             timestamp: Date.now(),
                         },
                     ];

package/dist/core/session-store.d.ts

@@ -10,6 +10,7 @@ export interface TtlSessionStoreOptions {
     evict?: EvictPolicy;
 }
 export declare class TtlSessionStore implements SessionStore {
+    readonly retention: "none";
     private repo;
     private entries;
     private owners;

package/dist/core/session-store.js

@@ -4,6 +4,7 @@ const DAY_MS = 24 * 60 * 60 * 1000;
 import { SESSION_DEFAULT_TTL_DAYS } from "../config/defaults.js";
 export { SESSION_DEFAULT_TTL_DAYS };
 export class TtlSessionStore {
+    retention = "none";
     repo;
     entries = new Map();
     owners = new Map();

package/dist/core/tool-result-store.d.ts

@@ -1,5 +1,6 @@
 import type { AgentTool } from "../internal/harness-types.js";
 export interface ToolResultStore {
+    readonly retention?: import("./retention.js").RetentionDeclaration;
     put(ref: string, content: string): Promise<void> | void;
     get(ref: string, opts?: {
         offset?: number;
@@ -15,6 +16,7 @@ export interface ToolResultSlice {
 }
 export declare class InMemoryToolResultStore implements ToolResultStore {
     private readonly opts?;
+    readonly retention: "none";
     private readonly map;
     private totalChars;
     constructor(opts?: {

package/dist/core/tool-result-store.js

@@ -25,6 +25,7 @@ function refSegment(raw) {
 }
 export class InMemoryToolResultStore {
     opts;
+    retention = "none";
     map = new Map();
     totalChars = 0;
     constructor(opts) {

package/dist/core/types.d.ts

@@ -584,7 +584,7 @@ export type TaskEvent = ({
     reason?: string;
 } & TaskEventIdentity) | ({
     type: "steering_injected";
-    source: "limit_approach" | "todo_reminder" | "task_reminder" | "tool_search_usage_reminder" | "changed_files" | "plan_mode" | "date_change" | "instructions_change" | "workflow_size_guideline_change" | "budget_usd" | "background_tasks" | "tools_delta" | "agent_listing" | "skills_listing" | "mcp_instructions" | "mcp_dropped_tools";
+    source: "limit_approach" | "todo_reminder" | "task_reminder" | "tool_search_usage_reminder" | "changed_files" | "plan_mode" | "date_change" | "instructions_change" | "workflow_size_guideline_change" | "budget_usd" | "background_tasks" | "tools_delta" | "agent_listing" | "skills_listing" | "mcp_instructions" | "mcp_dropped_tools" | "final_verification";
     preview: string;
 } & TaskEventIdentity) | ({
     type: "diagnostics";
@@ -737,6 +737,11 @@ export interface RunnerDeps {
     fileSnapshotStore?: import("./file-snapshot-store.js").FileSnapshotStore;
     sessionPolicyStore?: import("./session-policy-store.js").SessionPolicyStore;
     runtimeCapsResolver?: (principal: string | undefined) => RuntimeCaps | undefined | Promise<RuntimeCaps | undefined>;
+    lockedConfig?: import("./locked-config.js").LockedConfig;
+    compliancePostureResolver?: (principal: string | undefined) => import("./compliance.js").CompliancePosture | undefined | Promise<import("./compliance.js").CompliancePosture | undefined>;
+    memoryScopeAdmission?: import("./memory-admission.js").MemoryScopeAdmission;
+    deploymentMemoryScopes?: readonly string[];
+    retentionPolicy?: import("./retention.js").RetentionPolicy;
     autoMode?: {
         rules?: import("./auto-mode-prompt.js").AutoModeRules;
         settingsDenyRules?: readonly string[];

package/dist/engine/harness/agent-harness.js

@@ -27,6 +27,7 @@ function createUserMessage(text, images, provenance) {
     };
 }
 const engineNotePayloads = new WeakMap();
+const ENGINE_NOTE_STEER_BACKLOG_CAP = 50;
 function createFailureMessage(model, error, aborted) {
     return {
         role: "assistant",
@@ -418,7 +419,13 @@ export class AgentHarness {
         };
     }
     async drainQueuedMessages(queue, mode) {
-        const messages = mode === "all" ? queue.splice(0) : queue.splice(0, 1);
+        let count = mode === "all" ? queue.length : 1;
+        if (mode !== "all" && queue.length > 1 && engineNotePayloads.has(queue[0])) {
+            count = 1;
+            while (count < queue.length && engineNotePayloads.has(queue[count]))
+                count++;
+        }
+        const messages = queue.splice(0, count);
         if (messages.length === 0) {
             return messages;
         }
@@ -713,6 +720,9 @@ export class AgentHarness {
     async enqueueInjection(queue, text, options) {
         if (AgentHarness.emptyInjection(text, options))
             return;
+        if (options?.enginePayload !== undefined && queue.filter((q) => engineNotePayloads.has(q)).length >= ENGINE_NOTE_STEER_BACKLOG_CAP) {
+            throw new AgentHarnessError("invalid_state", `engine-note backlog at cap (${ENGINE_NOTE_STEER_BACKLOG_CAP}) — park the payload for the session's next run`);
+        }
         const m = createUserMessage(text, options?.images, options);
         if (options?.enginePayload !== undefined)
             engineNotePayloads.set(m, options.enginePayload);

package/dist/engine/llm/validation.js

@@ -288,5 +288,15 @@ export function validateToolArguments(tool, toolCall) {
         .Errors(args)
         .map((error) => `  - ${formatValidationPath(error)}: ${error.message}`)
         .join("\n") || "Unknown validation error";
-    throw new Error(`Validation failed for tool "${toolCall.name}":\n${errors}\n\nReceived arguments:\n${JSON.stringify(toolCall.arguments, null, 2)}`);
+    const schemaJson = (() => {
+        try {
+            const s = JSON.stringify(tool.parameters);
+            return s.length > VALIDATION_ERROR_SCHEMA_MAX_CHARS ? `${s.slice(0, VALIDATION_ERROR_SCHEMA_MAX_CHARS)}… (schema truncated)` : s;
+        }
+        catch {
+            return "(schema not serializable)";
+        }
+    })();
+    throw new Error(`Validation failed for tool "${toolCall.name}":\n${errors}\n\nReceived arguments:\n${JSON.stringify(toolCall.arguments, null, 2)}\n\nExpected parameter schema:\n${schemaJson}`);
 }
+const VALIDATION_ERROR_SCHEMA_MAX_CHARS = 4_000;