@sema-agent/core 5.21.1 → 5.22.0

package/dist/core/tool-policy.js

@@ -1,4 +1,6 @@
+import { createHash } from "node:crypto";
 import { homedir } from "node:os";
+import { brandPolicyAskClass } from "./ask-class.js";
 import { join, normalize as normalizePath, posix as posixPath, sep, win32 as winPath } from "node:path";
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
 import { boundInputHashOf } from "./canonical-json.js";
@@ -12,6 +14,67 @@ export function isApprovalSettledBy(v) {
 export function decisionText(d) {
     return d.message;
 }
+export function checkToolPolicyProjection(projection, req) {
+    for (const c of projection.components) {
+        if (c.kind === "tool_deny") {
+            if (c.names.includes(req.toolName)) {
+                return { action: "deny", message: `tool "${req.toolName}" is denied by a frozen inherited policy projection` };
+            }
+            continue;
+        }
+        if (c.kind === "tool_allowlist") {
+            if (!c.names.includes(req.toolName)) {
+                return { action: "deny", message: `tool "${req.toolName}" is not in a frozen inherited policy projection's allowlist` };
+            }
+            continue;
+        }
+        if (!c.tools.includes(req.toolName))
+            continue;
+        const command = req.args?.command;
+        if (typeof command !== "string") {
+            if (c.unparseableAction === "deny") {
+                return { action: "deny", message: `tool "${req.toolName}" call has no parseable command string (frozen inherited policy projection)` };
+            }
+            continue;
+        }
+        const parsed = parseLeadingCommandName(command);
+        if ("reject" in parsed) {
+            if (c.unparseableAction === "deny") {
+                return { action: "deny", message: `command is not a single simple command (${parsed.reject}) (frozen inherited policy projection)` };
+            }
+            continue;
+        }
+        if (c.deny.includes(parsed.name)) {
+            return { action: "deny", message: `command "${parsed.name}" is denied by a frozen inherited policy projection` };
+        }
+        if (c.allow !== undefined && !c.allow.includes(parsed.name) && c.unmatchedAction === "deny") {
+            return { action: "deny", message: `command "${parsed.name}" is not in a frozen inherited policy projection's allowlist` };
+        }
+    }
+    return undefined;
+}
+export function constraintChainEntryOf(policy, meta) {
+    const m = {
+        ...(meta?.autoModeArmed ? { autoModeArmed: true } : {}),
+        ...(meta?.durableMandate ? { durableMandate: true } : {}),
+        ...(meta?.contentMandate ? { contentMandate: true } : {}),
+    };
+    const p = policy.projection;
+    if (p === undefined)
+        return { opaque: true, ...m };
+    return { components: p.components, requiresLiveRemainder: p.requiresLiveRemainder, ...m };
+}
+function stableJson(v) {
+    if (v === null || typeof v !== "object")
+        return JSON.stringify(v) ?? "null";
+    if (Array.isArray(v))
+        return `[${v.map(stableJson).join(",")}]`;
+    const keys = Object.keys(v).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${stableJson(v[k])}`).join(",")}}`;
+}
+export function constraintChainDigest(chain) {
+    return `cpv1:${createHash("sha256").update(stableJson(chain)).digest("hex")}`;
+}
 const ALLOW = { action: "allow" };
 const RETIRED_TEXT_FIELD = "reason";
 const RETIRED_TEXT_FIELD_DENY_MESSAGE = `a permission decision carries the retired "${RETIRED_TEXT_FIELD}" field — rename it to "message" (the one text field ` +
@@ -100,6 +163,13 @@ export function createAllowDenyPolicy(opts) {
     const allow = opts.allow ? new Set(opts.allow) : undefined;
     const deny = new Set(opts.deny ?? []);
     return {
+        projection: {
+            components: [
+                ...(opts.deny && opts.deny.length > 0 ? [{ kind: "tool_deny", names: [...opts.deny] }] : []),
+                ...(opts.allow ? [{ kind: "tool_allowlist", names: [...opts.allow] }] : []),
+            ],
+            requiresLiveRemainder: false,
+        },
         nameSets: [{ ...(opts.allow ? { allow: [...opts.allow] } : {}), ...(opts.deny ? { deny: [...opts.deny] } : {}) }],
         check(req) {
             const toolName = req.toolName;
@@ -124,6 +194,13 @@ export function createApprovalPolicy(opts) {
     const deny = new Set(opts.deny ?? []);
     const auto = new Set(opts.autoAllow ?? []);
     return {
+        projection: {
+            components: [
+                ...(opts.deny && opts.deny.length > 0 ? [{ kind: "tool_deny", names: [...opts.deny] }] : []),
+                ...(opts.denyByDefault === true ? [{ kind: "tool_allowlist", names: [...opts.requireApproval, ...(opts.autoAllow ?? [])] }] : []),
+            ],
+            requiresLiveRemainder: opts.requireApproval.length > 0,
+        },
         nameSets: [
             {
                 ask: [...opts.requireApproval],
@@ -179,7 +256,25 @@ export function createApprovalPolicy(opts) {
 }
 export function combinePolicies(...policies) {
     const nameSets = policies.flatMap(toolPolicyNameSets);
+    const childProjections = policies.map((p) => p.projection);
+    const projectedComponents = [];
+    let combinedRemainder = false;
+    for (const p of childProjections) {
+        if (p === undefined) {
+            combinedRemainder = true;
+            break;
+        }
+        projectedComponents.push(...p.components);
+        if (p.requiresLiveRemainder) {
+            combinedRemainder = true;
+            break;
+        }
+    }
+    const combinedProjection = childProjections.some((p) => p !== undefined)
+        ? { components: projectedComponents, requiresLiveRemainder: combinedRemainder }
+        : undefined;
     return {
+        ...(combinedProjection !== undefined ? { projection: combinedProjection } : {}),
         ...(nameSets.length > 0 ? { nameSets } : {}),
         async check(req, signal) {
             let asked;
@@ -225,7 +320,22 @@ export function createCoarseCommandNamePolicy(opts) {
     const fallback = (reason) => defaultAction === "deny"
         ? { action: "deny", message: reason, decisionReason: "rule" }
         : { action: "ask", message: reason, decisionReason: "rule" };
-    return {
+    const fallbackIsDeny = defaultAction === "deny";
+    const projection = {
+        components: [
+            {
+                kind: "shell_command",
+                tools: [...shellTools],
+                deny: [...deny],
+                ...(allow !== undefined ? { allow: [...allow] } : {}),
+                unmatchedAction: fallbackIsDeny ? "deny" : "none",
+                unparseableAction: fallbackIsDeny ? "deny" : "none",
+            },
+        ],
+        requiresLiveRemainder: !fallbackIsDeny,
+    };
+    return brandPolicyAskClass({
+        projection,
         check(req) {
             if (!shellTools.has(req.toolName))
                 return ALLOW;
@@ -245,7 +355,7 @@ export function createCoarseCommandNamePolicy(opts) {
             }
             return ALLOW;
         },
-    };
+    }, "sandbox_local");
 }
 const UNVERIFIABLE_DELETE_SAFE_VARS = ["TMPDIR", "HOME", "PWD"];
 const DELETE_HEADS = new Set(["rm", "xargs", "Remove-Item"]);
@@ -473,7 +583,7 @@ function hasRecursiveForce(argvTail) {
 export function createUnverifiableDeletePolicy(opts) {
     const safeVars = new Set([...UNVERIFIABLE_DELETE_SAFE_VARS, ...(opts?.safeVars ?? [])]);
     const shellTools = canonicalToolNameSet(opts?.tools);
-    return {
+    return brandPolicyAskClass({
         check(req) {
             if (!shellTools.has(req.toolName))
                 return ALLOW;
@@ -492,7 +602,7 @@ export function createUnverifiableDeletePolicy(opts) {
                     `(or assign the variable in the same command, e.g. \`DIR=/exact/path; rm -rf "$DIR"\`) so the target can be verified.`,
             };
         },
-    };
+    }, "external_authority");
 }
 function pathSegments(p) {
     return p.split(/[\\/]/).filter(Boolean);
@@ -569,7 +679,7 @@ export function createTranscriptIntegrityPolicy(opts) {
             `files — modifying or deleting them tampers with the run's own audit trail. Reading them (ls/cat/grep ` +
             `as a single simple command) is fine.`,
     });
-    return {
+    return brandPolicyAskClass({
         check(req) {
             const toolName = req.toolName;
             if (shellTools.has(toolName)) {
@@ -597,7 +707,7 @@ export function createTranscriptIntegrityPolicy(opts) {
             }
             return ALLOW;
         },
-    };
+    }, "external_authority");
 }
 const delegatedApproverRoot = new WeakMap();
 export function withDelegationProvenance(onAsk, delegation) {

package/dist/core/trace.d.ts

@@ -16,7 +16,7 @@
  * core's own contract is only the field names here; it deliberately stops at supplying the FACTS a bridge
  * needs (ids, turn indices, token counts) rather than adopting the convention's vocabulary internally.
  */
-import type { TaskStatus, ToolEffect } from "./types.js";
+import type { BrainRetryErrClass, TaskStatus, ToolEffect } from "./types.js";
 import type { ThinkingLevel } from "../internal/harness-types.js";
 import type { ToolManifestRow } from "../prompt-assembly/tool-catalog.js";
 /**
@@ -382,6 +382,29 @@ export type TraceEvent = {
     taskId: string;
     message: string;
     ts: number;
+} | {
+    /**
+     * F-012 L2 — a pending ask was AUTO-ADMITTED by the sandbox-admission leg: the deployment's
+     * execution env declares an isolated sandbox, every surviving ask on the call was
+     * engine-classified `sandbox_local`, and the call crosses no declared boundary. This record is
+     * the durable admission ledger's operator half (the transcript half rides the tool result's
+     * system-reminder context); a consumer anchors on THIS kind, never on wording.
+     */
+    kind: "permission.sandbox_admitted";
+    version: 1;
+    taskId: string;
+    toolName: string;
+    toolCallId: string;
+    /** The engine ask classes of the admitted call's surviving asks (all `sandbox_local` by the
+     *  admission predicate; carried explicitly so the ledger states what was judged, not just that
+     *  judgment passed). */
+    askClasses: readonly string[];
+    /** Which layers raised the admitted asks (`caller_policy` / `ancestor_constraint` /
+     *  `gate_safety_tighten`). */
+    sourceLayers: readonly string[];
+    /** The boundary classification the admission asserted. */
+    boundary: "sandbox_internal";
+    ts: number;
 } | {
     /** C1 — the failover brain served this call from a FALLBACK entry (`createFailoverBrain`): the
      *  primary (and possibly earlier hops) failed cleanly upfront. Without this, same-model gateway
@@ -418,6 +441,14 @@ export type TraceEvent = {
     /** 1-based attempt number that was ABANDONED (the retry that follows is attempt+1). */
     attempt: number;
     phase: "connect" | "midstream";
+    /** WHY the attempt is being retried, as the closed neutral bucket the user-facing status frame
+     *  also carries ({@link BrainRetryErrClass}) — an operator reading this and a user reading a
+     *  progress line then agree on the reason. Optional: absent on frames minted before it existed. */
+    errClass?: BrainRetryErrClass;
+    /** The backoff about to be slept, ms — 0 for an immediate re-send. Together with `attempt` this
+     *  makes a whole retry chain reconstructible from the trace alone, which is what a caller that saw
+     *  only silence needs to explain where the time went. */
+    nextDelayMs?: number;
     ts: number;
 } | {
     /** C2 — the agent loop drove one of its self-heal recoveries (malformed-tool retry / thinking-only

package/dist/core/types.d.ts

@@ -737,6 +737,17 @@ export interface ToolExecuteContext {
      * tool runs outside a Runner task.
      */
     inheritedGateForChildren?: () => import("./runner/prepare-task.js").InheritedGate;
+    /**
+     * design/180 half A — the delegation runtime-provenance ARMING face. Runner-filled; a delegation
+     * tool calls it at spawn time: a non-undefined return means this (parent) run is armed (it mounts
+     * a memory session, or is itself recording for its own parent) and carries the chain's FROZEN
+     * content-safety snapshot — the tool then mints the child's recorder ref and threads both into
+     * the child's trusted `RunInternals.delegationProvenance`. Undefined return / absent field ⇒ the
+     * child spawns without a recorder (its deliveries read `unknown` and every judgment stays on the
+     * static floor — v1 behavior byte-identical). Same trust posture as
+     * {@link inheritedGateForChildren}: never a model/tool argument, never a TaskSpec field.
+     */
+    delegationProvenanceForChildren?: () => import("./memory-engine/delegation-provenance.js").DelegationContentSafety | undefined;
     /**
      * RB-201 FO-3 (form-one audit, CC 220 `Ipd`/`ein` parity) — the auto-mode classifier decider ARMED
      * for THIS task (`RuntimeCaps.autoMode === true` AND `RunnerDeps.autoMode` both present; the same
@@ -1802,6 +1813,17 @@ export interface TaskSpec {
     agents?: AgentDefinition[];
     /** Gate tool calls before they run (allow/deny/approval). Overrides `RunnerDeps.toolPolicy`. */
     toolPolicy?: import("./tool-policy.js").ToolPolicy;
+    /**
+     * #93 (F-012 L3) — the OVERRIDE seat for the durable resume-edit re-adjudication policy: the policy
+     * an approver's `updatedInput` EDIT is re-checked against before a resumed pending call executes
+     * (and, at park-mint time, the policy a store-codec-moved projection is re-adjudicated by). ABSENT
+     * falls back to the caller policy (`toolPolicy ?? RunnerDeps.toolPolicy`) — never to a silent skip:
+     * the pre-#93 shape skipped the whole recheck for deployments with no caller policy, which let a
+     * fidelity-projection-moved value land unadjudicated. Supply this only to make the resume-edit
+     * boundary STRICTER/different from the live caller policy; it never widens (the frozen ancestor
+     * projections and the deny-narrowing layers still apply regardless).
+     */
+    basePolicyForResumeEdit?: import("./tool-policy.js").ToolPolicy;
     /** How `ask` decisions resolve for this task (headless auto-deny by default). Overrides `RunnerDeps.onAsk`. */
     onAsk?: import("./tool-policy.js").OnAsk;
     /** Content-ask seam (design/64 §5): routes an AskUserQuestion tool call to a real human/UI. When set, the
@@ -2999,6 +3021,24 @@ export type BrainStatusPhase = "rate_limited" | "retrying" | "reconnecting" | "c
  * Both mean the same thing to a renderer — stop showing the retry state.
  */
  | "recovered" | "gave_up";
+/**
+ * WHY a retry wait is happening, as a closed, provider-NEUTRAL bucket — the companion to
+ * {@link BrainStatusPhase}, which says what the brain is doing about it. A consumer rendering an
+ * unattended progress line ("no answer for three minutes") needs the reason, and until this existed the
+ * only carriers of it were the HTTP status and the syscall code, neither of which may cross this
+ * channel. Values are about the SHAPE of the failure, never its provider taxonomy:
+ *  - `connect_refused` — the attempt got a definite negative about the target itself (nothing accepts
+ *    at that address, or the name has no address). This is the class the SHORT retry lane serves.
+ *  - `transport`      — any other transport-level failure: a connect timeout, a reset, a mid-stream
+ *    tear, a stalled stream. No verdict about the target; the full ladder applies.
+ *  - `rate_limit`     — the provider asked the caller to slow down.
+ *  - `server`         — the provider reported a failure on its own side.
+ *  - `http`           — a response the status predicate calls terminal, retried anyway because the
+ *    provider's own explicit retry verdict said to.
+ *  - `output_cap`     — not a failure of the connection at all: the request is being re-sent with a
+ *    lowered output cap after the provider reported the context limit exceeded (no backoff).
+ */
+export type BrainRetryErrClass = "connect_refused" | "transport" | "rate_limit" | "server" | "http" | "output_cap";
 /** design/99 §E3/§E10 — the payload of a {@link TaskEvent} `status` event (and the brain→runner signal). */
 export interface BrainStatus {
     phase: BrainStatusPhase;
@@ -3013,8 +3053,14 @@ export interface BrainStatus {
     /** RB-420-c — 1-based index of the attempt that just failed (the wait precedes attempt `attempt + 1`);
      *  same numbering as the `brain.retry` telemetry frame. Absent on frames that are not a retry wait. */
     attempt?: number;
-    /** RB-420-c — the retry budget of THIS lane, so a consumer can render "attempt 3 of 10". */
+    /** RB-420-c — the retry budget of THIS lane, so a consumer can render "attempt 3 of 10". Lane, not
+     *  engine: a failure class served by a shorter ladder reports that ladder's budget, so the fraction a
+     *  consumer renders is the one actually in force rather than the engine-wide ceiling. */
     maxRetries?: number;
+    /** Why this wait is happening ({@link BrainRetryErrClass}). Present on retry-wait frames whose cause
+     *  the engine classified; absent on frames that are not a retry wait (`recovered`/`gave_up`) and on a
+     *  `circuit_open` fast-fail, which is a local verdict rather than an observed failure. */
+    errClass?: BrainRetryErrClass;
 }
 /**
  * design/97 CORE-8 (③): one lightweight TOOL-ACTIVITY beat surfaced from a running task, for a per-agent live
@@ -3955,8 +4001,11 @@ export interface BackgroundChildEvent {
      */
     editedFiles?: import("../agents/subagent-steps.js").SubagentEditedFile[];
     /**
-     * terminal (residual observability, lane E): `true` when the child can be revived with `SendMessage` (its session is
-     * retained and it was not stopped by the user); `false` for a user-stopped / non-resumable child.
+     * terminal (residual observability, lane E): `true` when the child can be revived with `SendMessage` —
+     * either its session is retained live and the run was not killed, or it has a NAMED durable row that no
+     * USER stop closed (a parent teardown, a reap or a host death is precisely what the durable revival
+     * lane recovers from). `false` for a user-stopped child, an anonymous or store-less one, and for the
+     * session-teardown reap frame, whose lane cannot know what survives the teardown.
      * Lets a parent's orchestration logic decide "continue it" vs "start fresh" without trial-and-error.
      */
     resumable?: boolean;
@@ -4543,6 +4592,10 @@ export interface RunnerDeps {
     mcpImageResizer?: import("./mcp.js").McpImageResizer;
     /** Default tool-call gate for all tasks (a task's own `toolPolicy` overrides this). */
     toolPolicy?: import("./tool-policy.js").ToolPolicy;
+    /** Deployment default for {@link TaskSpec.basePolicyForResumeEdit} (#93 / F-012 L3): the resume-edit
+     *  re-adjudication override. Resolution: `spec.basePolicyForResumeEdit ?? THIS ?? (spec.toolPolicy ??
+     *  deps.toolPolicy)` — absence falls back to the caller policy, never to a silent skip. */
+    basePolicyForResumeEdit?: import("./tool-policy.js").ToolPolicy;
     /**
      * How `ask` decisions resolve when a policy/hook requests human confirmation (design/37). Default
      * (omitted) = `"deny"`: **headless auto-deny** — no approver, so `ask` resolves deterministically to

package/dist/index.d.ts

@@ -87,8 +87,8 @@ export type { InvariantKind, FunctionContract, Invariant, InvariantViolation, Ch
 export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, type BashReadonlyRootBoundary, type CompoundReadonlyVerdict, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
-export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, type ToolResultStore, type ToolResultSlice, } from "./core/tool-result-store.js";
-export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type SafetyAxis, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
+export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, type ToolResultStore, type ToolResultSlice, } from "./core/tool-result-store.js";
+export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type SafetyAxis, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, type UsageWindow, type UsageWindowStore, type UsageWindowReading, type UsageWindowRecord, type UsageSlot, type UsageBucketRow, } from "./core/usage-window-store.js";
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";
 export { ENV_LIFETIME_SUSPEND_MARGIN_MS, USAGE_WINDOW_REAP_MARGIN_MS } from "./core/runner/prepare-task.js";
@@ -128,7 +128,7 @@ export type { SchedulerCapability, SchedulerErrorCode, ScheduledIntent, Schedule
 export { createSchedulerTools, type SchedulerToolContext, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, type AutonomousLoopPromptOptions, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, type ApprovalSettledBy, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, } from "./core/tool-policy.js";
+export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, type ApprovalSettledBy, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, } from "./core/tool-policy.js";
 export { parseAutoModeResponse, createAutoModeDecider, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassifyFn, type AutoModeClassifyInput, } from "./core/auto-mode.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, type AutoModeRules, type BuildAutoModePromptOptions, type AutoModeWindowOptions, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
@@ -143,13 +143,17 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
  * and widening is not.
  */
 export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleSuggestion, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
-export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, } from "./core/permission-rule-store.js";
+export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, } from "./core/permission-rule-store.js";
+export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
+export { createOrgRuleOverlay, orgRuleVerdictFor, effectivePermissionRules, orgRuleStatePersistenceOf, ORG_UNAVAILABLE_DECISION_REASON, type OrgPermissionRule, type OrgRuleSnapshot, type OrgRuleSnapshotProvider, type OrgRuleStatePersistence, type PersistedOrgRuleState, type OrgRuleOverlay, type OrgOverlayResolution, type OrgOverlayStatus, type EffectivePermissionRule, } from "./core/permission-rule-org.js";
+export { RULE_SYNC_DROP_CODES, type RuleSyncDropReason, type RuleQuarantineReason } from "./core/governance-codes.js";
 export { prepareCardApproval, confirmRuleApproval, type ConfirmResult, type ConfirmRefusalReason, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, type RuleTicket, type RuleCandidate, type RuleApprovalKind, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleConsentDeps, type RedeemResult, type CcImportLayer, type ImportedSettingsLayer, type ImportPreview, type ImportResult, } from "./core/permission-rule-consent.js";
 export { FilePermissionRuleStoreProvider } from "./stores/file/permission-rule-store.js";
+export { adoptFilePermissionRuleStore, type AdoptFileRuleStoreResult } from "./stores/file/permission-rule-adopt.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, type Hooks, type HookToolContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type MemoryGetDetails, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
-export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type MemoryGetDetails, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
+export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryPagedList, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, type SharedMemoryFixture, type SharedMemoryStoreContractHooks, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";
 export { encodeSurfacedKey, buildManifestText, validateSelectedIds, composeSelectiveBody, formatMemoryAge, resolveLinkedIds, RECALL_CAVEAT, DEFAULT_MAX_SELECTED, DEFAULT_MAX_LINKED, type MemorySelector, type MemorySelectRequest, type SelectiveRecallOptions, type SelectiveRecallResult, type LayeredRecallOptions, type LayeredRecallResult, type ScopedNoteHeader, type ScopedNoteRecord, } from "./core/memory-recall.js";
@@ -199,6 +203,7 @@ export { checkpointStoreContract } from "./core/store-contracts/checkpoint-store
 export { sessionRepoContract } from "./core/store-contracts/session-repo-contract.js";
 export { toolResultStoreContract } from "./core/store-contracts/tool-result-store-contract.js";
 export { fileSnapshotStoreContract } from "./core/store-contracts/file-snapshot-store-contract.js";
+export { permissionRuleSyncContract, type PermissionRuleSyncContractHooks } from "./core/store-contracts/permission-rule-sync-contract.js";
 export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, } from "./core/store-contracts/mailbox-store-contract.js";
 export { BACKGROUND_AGENT_CONTRACT_SCOPE, backgroundAgentStoreContract, backgroundAgentStoreScopesContract, } from "./core/store-contracts/background-agent-store-contract.js";
 export { type BackgroundAgentStore, type BackgroundAgentRecord, type BackgroundAgentRowSummary, type BackgroundAgentUsage, canAccessAgentRecord, STALE_RUNNING_REAP_ATTRIBUTION, BackgroundAgentStoreError, InMemoryBackgroundAgentStore, reconcileParkedAgents, queryBackgroundAgents, type BackgroundAgentQuery, } from "./core/background-agent-store.js";
@@ -237,7 +242,7 @@ export { retryBackoffMs, parseRetryAfter } from "./brain/retry.js";
 export { type BrainTimeoutConfig } from "./brain/timeout.js";
 export { createAssistantMessageEventStream } from "./internal/llm.js";
 export type { AssistantMessage, AssistantMessageEvent, CompleteSimpleFn, Context, DocumentContent, ImageContent, Message, StopReason, StreamFn, TextContent, ThinkingContent, ToolCall, ToolResultMessage, Usage, UserMessage, } from "./internal/llm.js";
-export type { AgentDefinition, BeforeWriteHook, BeforeWriteRequest, BeforeWriteResult, HandsBandOptions, Brain, BrainStatus, BrainStatusPhase, ImageInput, McpElicitRequest, McpElicitResponse, McpServerSpec, A2aServerSpec, OnElicit, Model, ModelRef, ProjectMemoryLoad, RunnerDeps, RuntimeCaps, BackgroundChildEvent, SkillManifest, SkillSpec, TaskEvent, TaskEventIdentity, ToolActivity, TaskLimits, StaleToolResultOffloadOptions, TaskResult, RemoteEnvFailureNote, TaskSpec, TaskStatus, TaskStream, CompactOutcome, ThinkingLevel, ToolExecuteContext, ToolReturn, ToolSpec, ToolEffect, ToolContentOrigin, WorkflowGovernanceBaseline, DelegationTaskType, } from "./core/types.js";
+export type { AgentDefinition, BeforeWriteHook, BeforeWriteRequest, BeforeWriteResult, HandsBandOptions, Brain, BrainStatus, BrainStatusPhase, BrainRetryErrClass, ImageInput, McpElicitRequest, McpElicitResponse, McpServerSpec, A2aServerSpec, OnElicit, Model, ModelRef, ProjectMemoryLoad, RunnerDeps, RuntimeCaps, BackgroundChildEvent, SkillManifest, SkillSpec, TaskEvent, TaskEventIdentity, ToolActivity, TaskLimits, StaleToolResultOffloadOptions, TaskResult, RemoteEnvFailureNote, TaskSpec, TaskStatus, TaskStream, CompactOutcome, ThinkingLevel, ToolExecuteContext, ToolReturn, ToolSpec, ToolEffect, ToolContentOrigin, WorkflowGovernanceBaseline, DelegationTaskType, } from "./core/types.js";
 export { Type } from "typebox";
 export type { TSchema, Static } from "typebox";
 export { explainPromptAssembly, describeDefaultPack, type DefaultPackDescription, type ExplainInput } from "./prompt-assembly/explain.js";

package/dist/index.js

@@ -68,8 +68,8 @@ export { deriveInvariants, checkInvariants } from "./core/property-harness.js";
 export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
-export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, } from "./core/tool-result-store.js";
-export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, } from "./core/checkpoint-store.js";
+export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, } from "./core/tool-result-store.js";
+export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, } from "./core/usage-window-store.js";
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";
 export { ENV_LIFETIME_SUSPEND_MARGIN_MS, USAGE_WINDOW_REAP_MARGIN_MS } from "./core/runner/prepare-task.js";
@@ -106,18 +106,22 @@ export { hasScheduler, isValidCronExpr, SchedulerError } from "./core/scheduler.
 export { createSchedulerTools, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, } from "./core/tool-policy.js";
+export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, } from "./core/tool-policy.js";
 export { parseAutoModeResponse, createAutoModeDecider, } from "./core/auto-mode.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, } from "./core/permission-rules.js";
 export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
-export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, } from "./core/permission-rule-store.js";
+export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, } from "./core/permission-rule-store.js";
+export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
+export { createOrgRuleOverlay, orgRuleVerdictFor, effectivePermissionRules, orgRuleStatePersistenceOf, ORG_UNAVAILABLE_DECISION_REASON, } from "./core/permission-rule-org.js";
+export { RULE_SYNC_DROP_CODES } from "./core/governance-codes.js";
 export { prepareCardApproval, confirmRuleApproval, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, } from "./core/permission-rule-consent.js";
 export { FilePermissionRuleStoreProvider } from "./stores/file/permission-rule-store.js";
+export { adoptFilePermissionRuleStore } from "./stores/file/permission-rule-adopt.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";
@@ -167,6 +171,7 @@ export { checkpointStoreContract } from "./core/store-contracts/checkpoint-store
 export { sessionRepoContract } from "./core/store-contracts/session-repo-contract.js";
 export { toolResultStoreContract } from "./core/store-contracts/tool-result-store-contract.js";
 export { fileSnapshotStoreContract } from "./core/store-contracts/file-snapshot-store-contract.js";
+export { permissionRuleSyncContract } from "./core/store-contracts/permission-rule-sync-contract.js";
 export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, } from "./core/store-contracts/mailbox-store-contract.js";
 export { BACKGROUND_AGENT_CONTRACT_SCOPE, backgroundAgentStoreContract, backgroundAgentStoreScopesContract, } from "./core/store-contracts/background-agent-store-contract.js";
 export { canAccessAgentRecord, STALE_RUNNING_REAP_ATTRIBUTION, BackgroundAgentStoreError, InMemoryBackgroundAgentStore, reconcileParkedAgents, queryBackgroundAgents, } from "./core/background-agent-store.js";

package/dist/stores/file/checkpoint-store.d.ts

@@ -18,6 +18,10 @@ export declare class FileCheckpointStore implements CheckpointStore {
      *  the loss is invisible until something reads the disk; the declaration is what makes it visible to
      *  the mint BEFORE the row is filed. */
     readonly fidelity: "json";
+    /** F-012 L2: `reopen` here is a real resolved→pending CAS journaled to the ledger — declared, not sniffed. */
+    readonly redecision: {
+        readonly reopen: true;
+    };
     private readonly fsyncEnabled;
     private readonly compactEvery;
     /** RB-134: the directory's ONE authority (map + token mutex + append log), joined not rebuilt. */

package/dist/stores/file/checkpoint-store.js

@@ -61,6 +61,7 @@ const checkpointLedgers = new SharedLedgerTable({
 export class FileCheckpointStore {
     durability = "durable";
     fidelity = "json";
+    redecision = { reopen: true };
     fsyncEnabled;
     compactEvery;
     ledger;

package/dist/stores/file/permission-rule-adopt.d.ts

@@ -0,0 +1,62 @@
+/**
+ * design/182 §4.5 (F-011) — adopting a local rule bucket into a cloud principal: a RECOVERABLE state
+ * machine, not a rename.
+ *
+ * "Local first, connect later, keep everything" is the arc this helper carries. It is assembled from
+ * facts the store already holds — per-add provenance stores NO principal (so a rebind rewrites zero
+ * rows), the actor is a replica axis orthogonal to identity (so every dot stays valid), and the store
+ * seam is backend-agnostic (so the same contract covers a PG bucket, whose row-migration half lives on
+ * the server). What this file adds is ATOMICITY: an exclusive writer lock plus a durable intent marker
+ * whose `phase` field is a monotonically-advanced position — each mutating stage persists its phase
+ * BEFORE the next stage runs, so a crash anywhere resumes idempotently and no stage can lose bytes.
+ *
+ *   ① take the write lock (a concurrent redemption/writer is refused loudly while adoption runs)
+ *   ② land the durable intent marker            → phase 2
+ *   ③ rename the bucket file to the principal's → phase 3   (complete ⟺ target present ∧ source absent)
+ *   ④ flip owner resolution — the marker IS the truth `forLocalOwner` reads, so publishing phase 4 is
+ *     itself the switch; host configuration follows the marker, never the reverse → phase 4
+ *   ⑤ first sync round against the (empty) cloud bucket — the full local state rides up → phase 5
+ *   ⑥ rewrite the marker into its PERMANENT terminal record. Never deleted: after phase 4 the marker
+ *     is the owner-resolution truth, and deleting it would resolve local-owner back to a retired empty
+ *     bucket — rules gone from adjudication, new writes forking into a grave.
+ *
+ * A pre-existing TARGET bucket refuses the whole adoption: merging two existing buckets is a sync
+ * join, deliberately not a rename. Rows the far side refuses during ⑤ move to the local quarantine
+ * area — preserved and disclosed, never deleted (the F-011 "nothing is lost" floor).
+ */
+import type { RuleOwner } from "../../core/permission-rule-store.js";
+import { type PermissionRuleSyncResult, type PermissionRuleSyncTransport } from "../../core/permission-rule-sync.js";
+export type AdoptFileRuleStoreResult = 
+/** The full arc completed (this call, or an earlier one — the terminal marker makes it idempotent). */
+{
+    status: "adopted";
+    syncResult?: PermissionRuleSyncResult;
+}
+/** A stage failed. The marker holds the last COMPLETED phase; call again to resume from there.
+ *  No bytes were lost — that is the state machine's whole contract. */
+ | {
+    status: "stalled";
+    phase: 2 | 3 | 4 | 5;
+    error: string;
+};
+/**
+ * Run (or resume) the adoption state machine for the bucket directory `dir`.
+ *
+ * Contract notes for the calling deployment:
+ *  - stop (dispose) any live writer over this directory first — the adoption takes the same exclusive
+ *    lock, and a live holder is refused loudly rather than interleaved with;
+ *  - after the arc completes, run tasks under the NEW principal: a deployment still declaring
+ *    local-owner resolves through the terminal marker to the adopted bucket (fail-closed against the
+ *    retired one), but the honest configuration names the principal;
+ *  - pending approval records are NOT migrated: their recorded owner stays historical, so an old
+ *    ticket redeemed after adoption is refused by the existing owner-binding arm — the person simply
+ *    sees the card again. That refusal is the invalidation mechanism, not a defect.
+ */
+export declare function adoptFilePermissionRuleStore(opts: {
+    dir: string;
+    from: RuleOwner;
+    toPrincipal: string;
+    transport: PermissionRuleSyncTransport;
+    now?: () => number;
+    onError?: (message: string) => void;
+}): Promise<AdoptFileRuleStoreResult>;