@sema-agent/core 5.13.0 → 5.15.0

package/CHANGELOG.md

@@ -1,5 +1,423 @@
 # Changelog
 
+## 5.15.0 — 2026-08-06
+
+### BREAKING
+
+- **`TaskSpec.toolMaterializeStrategy` defaults to `"swap"` again** (it defaulted to `"static"` for one
+  release window). Under `"static"` a deferred tool's placeholder never swaps: the tools block keeps
+  advertising `{"type":"object","properties":{}}` and the real schema reaches the model only as text in
+  the `ToolSearch` result. That is fine for a model whose tool arguments are free-form JSON, and
+  structurally unusable for one served with **constrained decoding**, where the advertised wire schema is
+  enforced at the sampler. On the mainstream implementations — grammar compiled from the declared
+  `properties` — `{}` becomes the only argument object the model can emit, so the engine's corrective
+  invalid-arguments rejection cannot be acted on and the run burns turns without converging. (A strictly
+  draft-faithful decoder would read the absent `additionalProperties` as permissive; the model still has
+  no schema to form other keys from, so that path degrades to guessing rather than converging.)
+  The condition for `"static"` is also a property of the WHOLE serving route rather than of one model —
+  the degrading brain can fall back across providers mid-run and `limits.degrade` can hand the run to a
+  different model outright, and neither rebuilds the disclosure strategy — so it is now a strict explicit
+  opt-in: set it only if every model the run can reach, fallback targets included, has been verified to
+  read schemas from result text. **Who is affected:** a deployment that relied on the default to keep its
+  provider prompt cache intact across activations now sees the pre-`"static"` behavior (activation calls
+  `setTools`, invalidating the cache suffix) unless it sets `toolMaterializeStrategy: "static"` itself.
+  **Pinned faces that move with the default:** the `tools_delta` attachment says "now available … Their
+  full schemas are loaded" (not "now active"), the `ToolSearch` description says activation "loads its
+  full parameter schema" (not "returns … in the result"), the `ToolSearch` result no longer inlines
+  `parameters:` per matched tool, and the post-activation tools block carries the real schema again — a
+  consumer pinning any of these under the default must re-pin. `SEMA_TOOL_MATERIALIZE_STRATEGY` still
+  fills an absent spec value, and an env-sourced `"static"` on a `deferSelfResolve: false` task still
+  degrades to `"swap"` (the explicit spec pairing stays refused with `config.tool_materialize_unreachable`).
+
+### Added
+
+- **`prompt.assembled` reports the resolved deferred-tool disclosure strategy** —
+  `toolDisclosure: {deferredTools, strategy, source}` (new exported type `ToolDisclosureManifest`;
+  absent when the leg deferred nothing). `strategy` is the EFFECTIVE value after the direct-call-lane
+  interlock, and `source` names the seat that chose it: `"spec"` / `"env"` / `"default"` /
+  `"degraded_no_direct_lane"` (the interlock narrowed a `"static"` request to `"swap"`; that value
+  implies an env-sourced request, since the spec pairing is refused at prepare and the default is not
+  `"static"`). "Which strategy did this leg run under, and who chose it" was previously answerable only
+  by re-deriving spec > env > release default by hand.
+
+### Fixed
+
+- **Model-visible text stops teaching retired tool names** (#181 census F batch). Three faces taught
+  names a model cannot call (RB-476-A retired alias resolution — a retired name is a loud roster
+  miss): the selective-recall manifest affordance said "call Recall" (a name core registers as
+  removed; the affordance's tool name is now caller-supplied via `composeSelectiveBody`'s new
+  optional `recallToolName` parameter, name-free when omitted); both `ORCHESTRATION_GUIDANCE`
+  blocks said `run_workflow` — on the deferred short form a complete dead link, since `ToolSearch`'s
+  `select:` arm matches exact wire names — and now interpolate `RUN_WORKFLOW_TOOL_NAME`
+  (`"Workflow"`); TaskOutput's lanes description and `task_id` parameter said `RunWorkflow` and now
+  say `Workflow`. A consumer pinning any of these strings must re-pin. A new gate
+  (`test/tool-name-literal-gate.test.ts`) scans every src string literal against the whole
+  `RETIRED_TOOL_NAMES` table with a frozen per-bucket ratchet, so this class cannot regrow silently.
+- **The `# Memory` write instruction requires the Write tool on the roster** (behavior face). The
+  memory engine's injection gated the CC-verbatim write instruction on a writable scope alone;
+  a `handsReadOnly` (or hands-less) run with a memory `writeScope` was instructed to write with a
+  tool its roster does not carry. `MemoryEngine.inject` takes an optional `writeToolMounted`
+  (omitted ⇒ historic behavior for engine-direct hosts; the Runner passes the real hands-write-half
+  predicate), and the RB-276 index seed follows the same gate. **Who is affected:** a deployment
+  running memory-enabled tasks with `handsReadOnly: true` (or no execution env) no longer receives
+  the `# Memory` instruction or the index read-seed on those runs — the fenced index still injects.
+- **The gh rate-limit hint's Monitor clause follows the real Monitor mount.** The SR-2 reminder
+  unconditionally closed with "use the Monitor tool"; Monitor mounts only when background task tools
+  do. `ghRateLimitHint` (and `HandsToolkitOptions`/`createBashTool` `monitorToolActive`) drop exactly
+  that clause when the caller declares Monitor unmounted; omitted keeps the byte-identical historic
+  wording.
+- **`ToolSearch` no longer activates a name the roster has withdrawn.** The deferred registry is frozen
+  at prepare; the roster is not — an MCP refresh can take a deferred name off the mount. An exact
+  `select:` still resolved through the stale registry, added the name to the active set, "succeeded" at
+  a rematerialize that mounted nothing, and announced a tool that could not be called. Withdrawn names
+  are now reported as `No longer available: <names> — withdrawn by its provider and cannot be activated
+  or called`, ride the result's `details.missing`, and never enter the active set.
+- **The deferred placeholder's corrective round is now bounded.** A shape-invalid direct call is answered
+  with the real declared schema so the corrected call is one turn away — which assumes the caller can act
+  on a schema once it has one. A caller whose arguments are constrained to the ADVERTISED schema cannot,
+  and re-sent the identical rejected arguments for as many turns as the budget allowed. After
+  `DEFERRED_NO_PROGRESS_LIMIT` (3) consecutive rejections of the IDENTICAL failure shape on one
+  placeholder, the lane stops re-teaching: it returns a terminal rejection that names the condition with
+  the stable token `tool.deferred_schema_incompatible` (in the model-facing text and on the tool result's
+  `details.noProgress`) and votes the tool batch terminated. Any other outcome — a different validation
+  error, or a successful call — resets the count, so the bound tracks being STUCK, not being wrong.
+  `TaskResult.errorCode` is unchanged: this terminal is reported on the tool result, not as a task
+  failure code.
+- **The invalid-arguments rejection no longer overstates where its schema lives.** It used to say "use it
+  for this and later calls" under both strategies; under `"static"` the schema is carried by that one
+  result and is gone with the next compaction. The text now says either "the next request's tools list
+  will advertise it too" (swap) or "carried by THIS result only" plus the `ToolSearch` re-select spelling
+  (static). A declaration too large to inline is called an "ABRIDGED copy" instead of "full" — past the
+  model-facing bound the serialization comes back with its middle spliced out and is not valid JSON.
+- **A declaration the static face cannot carry in text is exempted from the static face per tool.** Under
+  `"static"` the only in-context schema carrier is result text; a declaration that does not serialize, or
+  that the model-facing bound truncates, has no carrier there, and the tool was announced as activated
+  with a schema the model never received in usable form. Such a tool now materializes into the tools block
+  on activation (the rest of the run stays static), the `ToolSearch` line says where its declaration is,
+  and the result head stops promising schemas it did not print. The `tools_delta` boundary frame carries
+  the same exception (one `Exception: <names> — too large to inline…` line) instead of asserting compact
+  placeholders for a name whose full schema is visibly on the wire; with no exemptions in play the frame
+  is byte-identical to before. The exemption is read from the LIVE roster on every call, so an MCP
+  refresh that changes a declaration's size cannot leave the lane describing the old carrier — and the
+  exemption is MONOTONE within a leg: a declaration that shrinks back under the bound does not put the
+  compact placeholder back on a tool whose schema was only ever delivered through the tools block.
+
+### Fixed (receive-time additions)
+
+- Ruled at receive: the deferred no-progress terminal stays a TOOL-RESULT face (`tool.deferred_schema_incompatible`
+  marker + `details.noProgress`) and does NOT mint a `TaskResult.errorCode` — the run can continue on other
+  tools, so a run-level code would misclassify a per-tool condition.
+- Ruled at receive: a malformed `SEMA_TOOL_MATERIALIZE_STRATEGY` still refuses the task loudly even when a
+  valid spec value is present — a deployment running with a broken env var must hear about it before the
+  first task that omits the spec value inherits the typo.
+
+## 5.14.0 — 2026-08-06
+
+> **Post-release addendum (2026-08-06, disclosure gap reported by a consumer):** the fail-open survey
+> (shipped in 5.13.0's window, but its consequence surfaced against 5.14.0 pickups) hardened
+> `canonicalizeTarget`'s existence probe — an ERRORED `exists` no longer reads as "does not exist yet"
+> and instead reports `{ok:false, unresolvedSymlink:true}`. Combined with `createSensitivePathPolicy`'s
+> deny on `unresolvedSymlink`, an execution env whose `exists` always throws (a stub/lexical env with
+> no real filesystem) now sees every write target denied — the gate degrades from "guarded" to
+> "closed". That is the intended fail-closed direction for a PROBE FAILURE, but such an env should
+> answer honestly instead of throwing: return `ok(false)` ("this env cannot see a filesystem") and the
+> gate resolves normally. Also: `DelegationTaskType` was named in the ship note but missed the package
+> root; the export lands in the next release — type the `taskType` key as an open `string` until then.
+
+### BREAKING
+
+- **`CheckpointStore.setPendingSteer` APPENDS to a bounded ordered queue instead of overwriting a single seat**
+  (design/171 §5.3/§6.1/§6.3). Two people steering one durably-suspended run used to mean the second steer
+  silently destroyed the first — an undelivered operator instruction, gone with no record that anything was
+  lost. `CheckpointState` gains `pendingSteerQueue: PendingSteerEntry[]`
+  (`{text, trusted, actor?, seq, inputId, priority?}`); resume drains the WHOLE queue in `seq` order, each
+  entry framed under its own trust semantics. New exports: `readPendingSteerQueue` (the single read point —
+  it folds a pre-queue row's legacy `pendingSteer` seat in as member 0, so old checkpoints deliver unchanged
+  with no migration step), `appendPendingSteer` (the shared append every backend must build its next queue
+  with: bounds + `seq` mint live there, not once per store), `PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES` (48,000 —
+  under a MySQL `TEXT` column with UTF-8 headroom), `MAX_PENDING_STEER_ENTRIES` (derived from it and
+  `MAX_PENDING_STEER_CHARS`), `PENDING_STEER_FROZEN_FIELDS` / `ACTOR_ASSERTION_FROZEN_FIELDS`, and the
+  `ActorAssertion` type (`{id (namespaced), hostAsserted, issuer?}` — attribution ONLY, never authority;
+  `hostAsserted` must be derived by the host from ingress credentials and never taken from a request body).
+  Bounds are fail-loud: crossing either throws the **new error code `steering.queue_full`** rather than
+  evicting an accepted instruction. `validatePendingSteer` now REFUSES an unknown field
+  (`steering.invalid_content`) instead of dropping it, so a producer one release ahead learns its field would
+  not survive the parked leg. Idempotency moved from last-writer-wins to the `inputId` key: re-appending the
+  same `inputId` with an IDENTICAL payload is a no-op returning `true`, while the same `inputId` carrying
+  DIFFERENT content is refused with the **new error code `steering.duplicate_input_id`** (swallowing it would
+  reintroduce exactly the silent instruction loss the queue replaces); an absent `inputId` is minted (uuidv7),
+  and the synthetic id a pre-queue seat reads back as is reserved against caller supply. The file backend's
+  ledger replay also gained a fail-loud arm: an event kind the reader does not recognise now refuses the whole
+  replay (`checkpoint.unsupported_version`) instead of folding in as a silent no-op — **note that a binary
+  released BEFORE this one still ignores unknown kinds, so rolling back across the queue event loses steers
+  parked in the un-compacted ledger tail.**
+  **Consumer flips**: ① any code reading `state.pendingSteer` directly sees `undefined` for every new write —
+  read through `readPendingSteerQueue`; ② probes pinning "a second setPendingSteer overwrites the first" red;
+  ③ a custom `CheckpointStore` must round-trip BOTH state fields and build its next queue with
+  `appendPendingSteer` (the cross-backend contract kit gained the queue arms and will fail it otherwise);
+  ④ `steering.queue_full` and `steering.duplicate_input_id` are new members of the `CheckpointError` code
+  union — exhaustive consumers add both arms.
+
+### Added
+
+- **Shared-session attribution (design/171, core half).** Four pieces, one contract: ① `UserMessage.actor`
+  carries an `ActorAssertion` (attribution ONLY, never authority; snapshot-minted at the API boundary, wire
+  metadata stripped). ② ONE projection point (`human-input-projection.ts`, exported `projectHumanInput` /
+  `buildHumanInputEvent`) renders the speaker envelope for every human-input carrier — objective, live steer,
+  nextTurn, parked-steer resume frames, wake — as `[from "<id>"]` (+ ` (unverified)` when the host did not
+  derive the identity from ingress credentials), through the same neutralizers as the external-notification
+  header, always INSIDE the trust frame it attributes. No actor, or `source:"system"` ⇒ byte-identical
+  passthrough, so every pre-171 caller and single-user host is pinned unchanged. ③ **New TaskEvent arm
+  `human_input`** — the lifecycle ledger of who fed the run what: `{inputId, sessionSeq (leg-scoped),
+  carrier, source, delivery, issuer?, actor?, principal?, entryId?}`; live emissions precede the commit and
+  omit `entryId` (join via `message_committed` + stream order). Exhaustive TaskEvent switches need an arm.
+  ④ The compaction attribution invariant: speaker labels survive summarization across all three summary-path
+  variants (the summarizer is instructed to preserve `[from …]` attributions).
+
+- **Assembly self-evidence (design/173, all eight items).** The engine can now PROVE what it wired instead of
+  the operator inferring it from behavior:
+  - `describeStaticWiring(spec, deps)` (package-root export) — the pure static half of the wiring manifest;
+    per-leg EFFECTIVE manifests are built at prepare and emitted as the **new TaskEvent arm `wiring_manifest`**
+    (root/child/resume legs each emit their own). Together with `human_input` above this release takes
+    `TaskEvent` **16→18** — an exhaustive switch adds TWO arms, not one. A child leg's manifest rides the
+    CHILD's own stream and is deliberately not in the parent-forwarding whitelist: "every leg self-evidences"
+    means on its own stream; a host that wants a delegated child's manifest subscribes to the child. The manifest covers ask (form/provenance/effective),
+    question (three-valued channel state incl. the engine-stripped bg lane, plus the composition-lie flag
+    `interactiveToolsWithoutDeliveryFace`), elicit, the park lane (capability vs effective policy, reason
+    codes, checkpoint durability), session-store durability, fleet seats, and a governance presence section
+    stamped `audience:"operator"` — **a serving layer forwarding this event to a multi-tenant stream MUST
+    project the governance section for operators only; no projection ⇒ do not disclose**. `configFingerprint`
+    (sha256 prefix over the manifest's own resolved facts) correlates legs that ran under the same assembly.
+  - **Store durability declarations**: `SessionStore`/`CheckpointStore` gain `readonly durability?`
+    ("durable" | "process-local"); absent reads fail-closed as process-local, unparseable is refused loud
+    (`config.store_durability_invalid`). Built-ins declare themselves; an armed park lane over a
+    process-local store is now a REPORTABLE degrade shape instead of a silent one.
+  - **`TaskSpec.interactionPosture` / `RunnerDeps.interactionPosture`** ("interactive" | "headless") with a
+    fail-loud prepare door: posture `"interactive"` refuses a leg whose resolved wiring cannot reach a human
+    (`config.interaction_posture` / `config.interaction_wiring`) instead of silently auto-answering. Child
+    legs resolve `spec ?? parent posture (trusted internals) ?? deps`. A deployment that declares interactive
+    at deps level must supply a persistent question face for session-scoped bg legs — the door refusing that
+    leg is the honest reading of an unfulfillable declaration.
+  - **AskUserQuestion's three exits mint an in-band card** (`details.type: "ask-question"`, a new
+    `CC_DETAIL_TYPES` member): `continuationSource: "human_response" | "synthetic_self_answer_instruction"`
+    plus reason codes (a THREE-member closed set: `seam_absent` / `callback_failed` /
+    `declined_unavailable`), so a consumer can tell a human answer from the engine's self-answer fallback
+    without prose-matching. The card is a two-arm union — the coded-failure arm (`question.human_channel_failed` /
+    `question.human_unavailable`) carries neither `continuationSource` nor `runContinues`, so consumers
+    must branch on `code` FIRST and only then read `continuationSource`. Under posture `"interactive"`, the callback-failed
+    arm becomes a coded failure (`question.human_channel_failed`) unless the explicit
+    `interactiveQuestionFallback` knob opts back into degrade; the degrade path emits onError
+    (phase `"degraded"`, classification `"no-human-autoanswered"`).
+  - **The four question-face strip sites pair-produce a disclosure flag** through one helper: when the engine
+    deliberately strips a spawn turn's per-request question face from a bg/fork child, the manifest reports
+    the channel as `"stripped_bg_lane"` (flag minted only when a face was actually stripped).
+  - **`effectiveShellGate === "off"` with a real writable shell now leaves a per-prepare forensic note**
+    (onError phase `"config"`, classification `"shell-gate-off"`) — the assembly state that previously had
+    zero observable trace. onError `classification` is filled on the config phase for the first time.
+  - `isDelegatedAgentTerminal` is re-exported at the package root so a serving layer's escalation code shares
+    core's own terminal classification.
+
+- **The brain honors a provider's explicit retry verdict, and recovers from the context-overflow 400.**
+  ① The `x-should-retry` response header is now read double-sided: `true` retries a normally-terminal status,
+  `false` stops retrying a normally-retryable one; header absent ⇒ prior behavior byte-identical.
+  ② The `input length and max_tokens exceed context limit` 400 (previously terminal `invalid_request`) now
+  adaptively lowers `max_tokens` and retries, with two loud guards: a floor (3000 output tokens — at the
+  floor and still overflowing ⇒ give up) and a no-progress check (same error after a cut ⇒ give up); every
+  cut is disclosed as a status frame. The narrow error-shape parser refuses anything it does not recognize
+  (prior terminal behavior preserved).
+
+- **Question sync-first (design/174).** With a live question face, an adjudicated `AskUserQuestion` is
+  answered in-stream — same turn, no checkpoint; the durable park is what happens when nobody is there
+  (no live face / the face affirms nobody is reachable / `forceDurableGate` — and the third park-lane arming,
+  the safety vocabulary, behaves the same: **any park-lane arming keeps the park**, sync-first only applies
+  to the durable-approval posture with a live face). Assemblies without a live face are pinned byte-identical
+  to the previous release. `OnQuestion` may now return `{kind: "unavailable"}` — implementers additive,
+  **callers BREAKING** (`.answers` direct access goes red; `isQuestionUnavailable` is exported for relaying
+  wrappers). `AskQuestionRequest` gains `boundInputHash` and an engine-minted per-delivery `deliveryId`
+  (the identity; `(taskId, toolCallId, boundInputHash)` repeats for two identical sequential questions and is
+  reconciliation data only). The question tool executes in its own batch (`executionMode: "sequential"`).
+  New closed-set members: `SyntheticContinuationReason` += `declined_unavailable`; card `code` +=
+  `question.human_unavailable`; onError classification += `"unconsumed-human-answer"` and
+  `"interaction-posture-refused"`.
+
+- **Pre-release verification hardening (test AI's A/B groups + the convergence review).**
+  - A question outcome claiming NEITHER arm (no `unavailable` discriminant, no `answers` array — a failed
+    decode) is now refused as a delivery failure instead of being read as "the user selected nothing";
+    the explicit `{answers: []}` stays a real answer. The resume lane applies the same rule pre-CAS and
+    captures the redeemed answer ONCE (`structuredClone`) — the persisted outcome and the delivered answer
+    are the same snapshot, so a stateful getter can no longer make audit and delivery diverge.
+  - **`TaskResult.strandedHumanAnswers`** (new field): `{deliveryId, toolCallId}` records of questions a
+    person answered that no call executed to collect — keyed by the engine-minted delivery identity, since
+    call ids can repeat (two lost answers on one call id are two records). This is the MANDATORY disclosure
+    face; the `onError` (classification `"unconsumed-human-answer"`) alert remains as an additional lane.
+    An answer arriving after the result is already terminal can only reach `onError` — the structural limit
+    of a result face; a value that does not READ as an answer is never recorded as one.
+  - **`AskRequest.riskAxes`** (additive): `{irreversible?, egress?}`, filled by the gate from the SAME
+    resolved axes the safety tightens read (declared tiers + `toolAxes` folds + shellGate marks; `"maybe"`
+    counts as irreversible). Either axis ABSENT = the engine did not judge it — consumers must render
+    "unjudged", never fold absence to `false`. An EXPLICIT caller negative (`egress:false` /
+    `irreversibility:"never"` via MCP/A2A `toolAxes`) now survives the override algebra and reports as a
+    judged `false` — enforcement stays tighten-only and ignores negatives.
+  - **`WiringManifest.interaction.posture`** (new section): the posture declaration ("interactive" /
+    "headless" / "absent") joins the manifest — previously the one interactive-face declaration it did not
+    report. A posture refusal now also emits an onError frame (phase `"config"`,
+    classification `"interaction-posture-refused"`): the coded `TaskResult.errorCode` remains the primary
+    carrier (neither entry point throws), the frame serves hosts wired only to `onError`.
+  - **`configFingerprint` now hashes the ASSEMBLY, excluding leg identity AND seat provenance** (the
+    delegation lane re-homes a parent's deps face onto the child's spec seat — same callback, different
+    seat) — root/child/resume legs of one assembly really do share a fingerprint (its advertised use).
+    Fingerprint VALUES change with this release; pin the equality relation, not literals.
+    Presence condition for the resume leg: a resume's assembly comes from the `ResumeTaskConfig` you
+    pass, not from the root's spec — omit a seam face there (e.g. `onQuestion`) and the resume leg
+    HONESTLY reports a different assembly (and a different fingerprint), because that leg really has no
+    in-stream answerer. Re-supply the same faces on resume to keep the fingerprint equal.
+  - The synthetic-continuation disclosure dedup is **per ask-call** (key = tool-call id; one call may carry
+    1–4 questions and discloses once) and scoped to ONE leg — a continuation leg re-discloses, and a host
+    aggregating across legs dedups on `(sessionId, toolCallId)` itself.
+
+- **Capture-domain narrowing (design/174 convergence review, rounds 9–14).** Deployment-supplied resume
+  values are read ONCE and captured as canonical plain data; the canonicalizer refuses what the JSON
+  checkpoint store cannot faithfully round-trip. Concretely:
+  - resume `updatedInput` and a content-ask `answer` now REFUSE (pre-CAS, `checkpoint.invalid_outcome`,
+    checkpoint stays pending) values carrying Map/Set/Date/buffers/class instances, shared references or
+    cycles, sparse or expando arrays, non-finite numbers, bigint/symbol/function anywhere in the tree;
+    object keys with `undefined` values drop and `-0` normalizes to `0` (JSON semantics, applied at capture
+    so audit, replay comparison and execution all read the same value);
+  - `decision` is domain-checked at capture: anything other than `"allow"`/`"deny"` refuses pre-CAS
+    (previously an unknown word could fall past the deny check into the execute arm);
+  - `updatedInput: null` flows into the tool's own validation and fails THERE, instead of silently
+    executing the ORIGINAL arguments while the record said the input was rewritten;
+  - the gate discriminant and every `policy_ask` field are read once into a plain twin consumed by all
+    guards, the env-failed replay equality, persistence and the answer face; array equality visits every
+    index and compares named non-index keys;
+  - upgrade note: a winner persisted RAW by an older release still replays (equality compares canonical
+    forms — no checkpoint migration), but an OLD row whose winner is outside the new domain fails closed
+    on replay; the row stays recoverable by re-deciding.
+  - The direct tool lane applies the same one reader: an answer payload with a throwing accessor refuses
+    the WHOLE outcome (no partial salvage of well-formed siblings), and `{}` is a failed decode, not
+    "selected nothing" — `{answers: []}` remains the legitimate empty selection.
+
+- **`AskRequest.boundInputHash`** (additive): the canonical digest of the presented args, minted once at
+  the `resolveAsk` chokepoint over the retained snapshot — the SAME `boundInputHashOf` digest a durable
+  park binds its checkpoint to, so an aggregating approver can reconcile a synchronous ask row against a
+  parked checkpoint row for the same call on `(toolCallId, hash)` equality. Reconciliation metadata only
+  (repeats for identical args; re-minted per `updatedInput` edit round); a caller-supplied value is not
+  trusted over the chokepoint's own.
+
+- **Cross-process revival inherits the row's org-admission verdict (issue #22, tier-3 half).**
+  `BackgroundAgentRecord` gains `admittedOrgScopes?: string[]` and `admittedOrgWriteScope?: string | null`
+  (both additive): each leg writes its own adjudicated org verdict at the injector-ready barrier, and a
+  tier-3 claim seeds the revived child's admission fold from the row (seed ∩ live — narrow-only, the same
+  fold the in-process half uses). A row with the fields ABSENT reads as ZERO admission (`{scopes: [],
+  writeScope: null}`) — "no record" and "adjudicated to nothing" deliberately converge fail-closed.
+  Store contract additions (the cross-backend kit enforces both): the two fields round-trip verbatim
+  (`null` write-scope stays `null`), and ABSENT must read back absent, never materialize as `[]`.
+  Behavioral note: a revival leg that carries a seeded verdict now counts as governed, so an `org:`-shaped
+  scope in a non-v2 spelling is refused on that leg even with no resolver configured. Fork rows are not
+  written (they refuse tier-3 claims).
+
+- **`task_progress` gains `taskType`** (additive; new exported type `DelegationTaskType` =
+  `"background_agent" | "workflow"`): the discriminator a consumer needs to route a progress frame
+  without inferring the task's kind from its id shape. Stamped at both mint sites for background/fork
+  legs and both workflow spawn legs (retained-resume included); absent on a synchronous child's frames —
+  absence means "no fleet row", tolerate it.
+
+- **The scratchpad prompt section states volatility**: one added sentence ("Treat it as ephemeral — it may
+  not survive a long suspension or a resume on a different worker; keep durable outputs in the working
+  directory"); the CC-verbatim remainder is byte-unchanged. sema runs under durable suspend / multi-replica
+  serving where the scratchpad is a local-disk copy; without the sentence a model parks critical
+  intermediates in a directory that can vanish mid-task.
+
+- **`shellGate:"classify"` now auto-allows a bounded read-only polling loop** (`classifyBoundedReadonlyPollLoop`,
+  consulted by `bashReversibilityProbe` only after the plain compound face rejects). A monitoring consumer's
+  core idiom is `for i in $(seq 1 8); do tail -n 5 x.log; sleep 2; done`; the compound classifier rejects any
+  control structure (`for` is not an allowlisted name), so `classify` behaved like `always` for the Monitor
+  tool — an approval prompt on every poll. The new arm accepts EXACTLY that grammar and nothing else: a loop
+  head with a LITERAL finite bound (`$(seq <int> <int>)`, ascending `{<int>..<int>}`, or a literal word list,
+  capped at 120 iterations), a body of `;`-separated allowlisted readers plus a literal `sleep` (≤600s), the
+  SAME read-boundary scan the plain face runs (RB-412/413, unchanged; an unexpanded glob rejects — stricter
+  than the plain face), and everything else banned wholesale (redirection, pipes, backgrounding, substitution
+  other than the one `$(seq)` exemption, subshells, braces, escapes, nested control structures, and any
+  non-ASCII/control whitespace). The loop variable must be a single lowercase letter, so it cannot shadow
+  `PATH`/`IFS`/`LD_PRELOAD` and alter how the body's commands resolve. Additive and fail-closed: it only ever
+  converts a rejection into an allow for this exact shape, never the reverse, and any unparseable input falls
+  through to a rejection — so a deployment on `off`/`always`, or one not polling, is byte-identical. New
+  exports from the fs tools barrel: `classifyBoundedReadonlyPollLoop`, `POLL_LOOP_MAX_BEATS` (120),
+  `POLL_LOOP_MAX_SLEEP_SECONDS` (600).
+
+- **`HookToolContext.env`** (additive): a read-only path-resolution capability face over the env the task's
+  hands run against, on the PreToolUse / PostToolUse / PostToolUseFailure contexts alike. A hook that judges
+  paths (containment, symlink destinations) must resolve them in the filesystem the tools actually write to —
+  for a sandboxed or remote deployment that env is minted by `executionEnvFactory` DURING prepare, after the
+  caller built its hooks, so a hook closed over a spec-time env answers about the wrong machine; reading it
+  off the CALL context removes the ordering problem and picks up a resumed leg's rebuilt env with no
+  re-instantiation protocol. The face (new exported type `HookEnvCapabilities`, builder
+  `createHookEnvCapabilities` — public because `runToolGate` is) carries FOUR wrapped read primitives under
+  the env's own names: `canonicalPath`, `exists`, `readLink`, `cwd()` (the seam sketch's `canonicalize`/`root`
+  — `ExecutionEnv` declares no "root", so the honest anchor is the env's own working directory, read live).
+  **`cwd()` is the ENVIRONMENT's directory, not the task's tracked cwd** — the engine tracks a separate
+  per-task cwd (starting at the resolved task root, moving with `cd`/worktree entry) that the TOOLS' relative
+  paths resolve against and the env is never told about, so a hook judging a RELATIVE target must judge
+  absolute paths or get the tracked cwd through the deployment's own channel.
+  Deliberately capabilities and not the env object: no back-reference, null prototype, frozen, each primitive
+  captured once at build time. **Every member is optional and ABSENCE is the capability signal** — a member is
+  present iff the env exposes that primitive, never a stub that throws or an emulation that guesses, so a hook
+  branches on the shape; `ctx.env` itself is absent when the deployment wired no execution env at all
+  (`null` included). Existing hooks are unaffected.
+
+### Fixed
+
+- **The auto-mode handback review now runs on EVERY sub-agent completion path, not only the synchronous
+  spawn.** A child finishing on the sync-fork path, on either background resolve leg (plain and fork),
+  through the parked-resume drive, or on a woken retained-resume cycle handed its output to the parent
+  without the completed-work review the sync path has performed since it landed — so exactly the
+  delegation shapes that outlive the spawning call were the ones that skipped it. The review, its
+  evidence set (the child's final text, the step recorder's observed tool activity, and — on the one path
+  that delivers it — the streamed partial-findings tail of a child that stopped without completing), its
+  framing and its fail-open posture are now one shared mint point that every call site uses. Carriers per path: the
+  fork report card leads with the warning line exactly as the sync card does; a background or resumed
+  child's warning is prefixed to the one value the durable row and the completion notification BOTH
+  derive from, so those two faces can never disagree about whether a child was flagged. Two deliberate
+  skips: a lane whose abort already fired (a stopped child settles on its stop story instead of waiting
+  on a classifier — the residual is stated at `reviewHandback`), and a durably-paused child (it has
+  handed nothing back yet — its resumed cycle gets the review). Deployments without auto-mode armed are
+  byte-identical on every path.
+  **Consumer notes**: ① the completed-agent structured card (`details`) gained an optional
+  **`handbackWarning`** key — the content face has always led with the warning line, but a host reading
+  `details` (afterToolCall hooks, persisted tool results) saw nothing; it rides as its own key because
+  `result` is contracted to be the child's text verbatim. Present only when a child was flagged, so
+  presence must not be read as a signal of anything else. ② the classifier sees one new `toolName` value,
+  `Agent(fork handback)`, beside the existing `Agent(handback)`. ③ `createSubagentResume` gained a
+  `currentAutoModeReview` seat in the same `current*` family as `currentOnQuestion`/`currentClamps` (the
+  waking run's decider, not the frozen spawn snapshot's); a host wiring SendMessage itself supplies it
+  from its own tool ctx, and absent it a woken cycle carries through unreviewed.
+
+- **A retained background child's revival leg now inherits the session's own org-admission verdict.** The
+  in-process resume leg (a settled retained child woken onto its existing session) is a same-session
+  continuation that never goes through a checkpoint, so it re-adjudicated org memory admission from scratch
+  with no session freeze: a resolver whose answer WIDENED between the two legs remounted a tenant layer the
+  session had already lost, and a read-only first leg could gain an org WRITE grant on the revival — the
+  exact "a continuation can never widen" invariant the checkpoint plane enforces with seed ∩ live. The
+  verdict now rides `RunInternals.ownOrgAdmissionRef` (trusted internal, one ref per spawned child, threaded
+  through the frozen internals snapshot the revival replays); prepare INTERSECTS it with any checkpoint seed
+  rather than picking one, so the fold narrows along both the scope and the write axis. Deployments with no
+  governance surface are byte-identical (the ref is never read or written). The CROSS-PROCESS (tier-3) revival
+  half stays open and is now recorded in `memory-admission.ts`'s header instead of the old blanket residual
+  note: that leg rebuilds the spec from the reviving caller's mount, and the durable agent row records lookup
+  keys only, so it has no carrier for the original verdict.
+
+- **A background delegation no longer needs a NAME to park at an approval gate.** The §7.3 park predicate
+  carried an `agentName !== undefined` term, so an ANONYMOUS background child that hit an approval gate was
+  sentenced to `no_park_lane`: the row settled `failed`, and the approval never surfaced anywhere an operator
+  could decide it (the checkpoint stayed committed but undiscoverable through the agent faces). A name was
+  never a structural precondition — the park is keyed on the taskId (`parkBackgroundAgent(taskId, …)`), the
+  claim/resume chain addresses the row by handle, and every revival face already treats `row.name` as optional.
+  The term is dropped from BOTH sites of the family in one commit: the settle-time park predicate and the
+  `durableApproval` forwarding predicate (a divergence would auto-deny an anonymous child's plain ask while its
+  safety-tier ask parks). The fork lane is unaffected (r4 F-07 — it has no park block at all), and genuinely
+  un-wired deployments still take `no_park_lane`, with the reason text no longer naming the retired
+  precondition. Consumer note: probes pinning "an anonymous background child never parks" red.
+
 ## 5.13.0 — 2026-08-05
 
 ### BREAKING

package/dist/agents/send-message-tool.js

@@ -534,6 +534,7 @@ export function createSendMessageTool(opts) {
                         ...(ctx.interactiveTools === false ? { interactiveTools: false } : {}),
                         ...(ctx.oneShot === true ? { oneShot: true } : {}),
                     },
+                    ...(ctx.autoModeReview !== undefined ? { currentAutoModeReview: ctx.autoModeReview } : {}),
                 });
                 const fromPrefix = senderIsChild ? `(message from teammate "${senderLabel}")\n` : "";
                 try {

package/dist/agents/subagent.d.ts

@@ -66,6 +66,7 @@ export declare function completedAgentCard(child: {
     worktreePath?: string;
     toolStats?: SubagentToolStats;
     modelFallback?: "inherit_no_tier_binding";
+    handbackWarning?: string;
 }): Record<string, unknown>;
 export declare const SUBAGENT_SUSPENDED_AWAITING_APPROVAL = "suspended.awaiting_approval";
 export declare const SUBAGENT_SUSPENDED_NEEDS_REVIEW = "suspended.needs_review";
@@ -96,6 +97,9 @@ export declare function createSubagentResume(deps: {
         interactiveTools?: false;
         oneShot?: true;
     };
+    currentAutoModeReview?: {
+        decider: import("../core/auto-mode.js").AutoModeDecider;
+    };
     taskId?: string;
     taskAccess?: import("../core/task-registry.js").TaskAccess;
     bgSink?: (event: import("../core/types.js").BackgroundChildEvent) => void;