@sema-agent/core 5.21.1 → 5.22.0

package/dist/core/checkpoint-store.d.ts

@@ -774,6 +774,25 @@ export interface CheckpointState {
          *  (`resume.parent_constraint_mismatch`) — a partial re-supply is a typed error, never a silently
          *  thinner chain. Absent on older checkpoints ⇒ only the non-empty check applies. */
         parentConstraintCount?: number;
+        /**
+         * F-012 L1 — the persisted CONSTRAINT PROJECTIONS of the inherited chain, one ordered entry per
+         * `parentConstraints` layer: the layer's deterministic deny data
+         * ({@link import("./tool-policy.js").ToolPolicyProjection} content) or an explicit `{opaque:true}`
+         * placeholder for a layer that exports none. The resume leg EXECUTES these persisted projections
+         * (extra deny-narrowing layers + the pre-CAS edit re-adjudication) rather than trusting a
+         * re-supplied policy's execution half for the frozen deny data — a re-supplied closure that
+         * matches the digest but behaves differently cannot un-deny what the suspend froze. Present iff
+         * `requiresParentConstraint` on new mints; absent on older checkpoints (⇒ no frozen deny data —
+         * the count-only contract governs, and an EDIT resume is refused for want of a validatable chain). */
+        constraintChain?: ReadonlyArray<import("./tool-policy.js").ConstraintChainEntry>;
+        /**
+         * F-012 L1 — the content digest over `constraintChain` ({@link import("./tool-policy.js").constraintChainDigest}):
+         * binds the ordered chain topology (layer boundaries + opaque placeholders) and each projection's
+         * content. The resume pre-CAS ladder recomputes the digest over the RE-SUPPLIED chain's
+         * projections and rejects a mismatch (`resume.parent_constraint_mismatch`) — replacing the
+         * count-only shape check with a content contract (a same-length chain of different frozen deny
+         * data no longer passes). Present iff `constraintChain` is. */
+        constraintDigest?: string;
     };
     /**
      * [c209-C] Q5 — the listing frames' announced NAME-SETS at suspend (agent types / skills the model
@@ -799,6 +818,16 @@ export interface CheckpointState {
         skills?: string[];
         models?: string[];
     };
+    /**
+     * design/180 R-4 (R-2 cross-process variant) — the armed delegation child's MONOTONIC runtime-provenance
+     * aggregate at suspend ({@link import("./memory-engine/delegation-provenance.js").DelegationProvenanceAggregate}:
+     * version + coverageStartTurn + the two never-cleared bits sawExternal/incomplete). Persisted so a
+     * resume — a cross-process one especially, which lost the in-memory ref — CONTINUES accumulating from
+     * the recorded bits instead of restarting a fresh aggregate that could prove "clean" on the post-resume
+     * segment alone. Plain data → JSON/structuredClone round-trips. Present ONLY when the suspended leg ran
+     * with a recorder armed; ABSENT on an unarmed leg AND on an older checkpoint — the resume side reads
+     * absence-on-an-armed-child fail-closed as `incomplete`. */
+    delegationProvenance?: import("./memory-engine/delegation-provenance.js").DelegationProvenanceAggregate;
 }
 /**
  * {@link CheckpointState} with **every** field made required-PRESENT, while each value keeps its original
@@ -867,13 +896,26 @@ export declare const TOKEN_CHECKPOINT_VERSION = 5;
  * memory see zero version movement.
  */
 export declare const ORG_ADMISSION_CHECKPOINT_VERSION = 6;
+/**
+ * F-012 (2026-08-09 — the ORG_ADMISSION_CHECKPOINT_VERSION precedent replayed a fifth time, codex
+ * adversarial finding): the schema version a suspend stamps when its state carries the F-012 durable
+ * enforcement fields — `inheritedGate.constraintChain`/`constraintDigest` (the frozen ancestor
+ * projection chain the resume-edit re-adjudication executes) or `delegationProvenance` (the monotonic
+ * provenance aggregate a resume re-seeds). Both enforcements live ENTIRELY in the resuming worker: a
+ * pre-F-012 worker (MAX_SUPPORTED=6) would accept the row, ignore constraintChain (so an approver-edited
+ * resume executes WITHOUT the frozen ancestor deny), and restart the aggregate clean (false-clean after
+ * pre-suspend external activity). Stamping v7 forces such a worker to reject PRE-CAS
+ * (`unsupported_version`, stays `pending`, retried on an enforcing worker). A checkpoint with NO F-012
+ * state keeps the historic stamps — deployments not delegating see zero version movement.
+ */
+export declare const F012_CHECKPOINT_VERSION = 7;
 /** The highest {@link Checkpoint.version} `runner.resume` will act on; a higher one is rejected pre-CAS with
  *  {@link CheckpointError} `unsupported_version` (the checkpoint stays `pending`, retryable on a newer worker).
- *  Raised to 6 for org-admission-bearing checkpoints — this worker reads v1 (legacy human), v2
- *  (resource), v3 (binding human/irreversible_ask), v4 (a pre-164 row, refused only when it carries the
- *  retired wall-clock allocation), v5 (token-allocation-bearing resource/approval) and v6
- *  (org-admission freeze state). */
-export declare const MAX_SUPPORTED_CHECKPOINT_VERSION = 6;
+ *  Raised to 7 for F-012-bearing checkpoints — this worker reads v1 (legacy human), v2 (resource), v3
+ *  (binding human/irreversible_ask), v4 (a pre-164 row, refused only when it carries the retired
+ *  wall-clock allocation), v5 (token-allocation-bearing resource/approval), v6 (org-admission freeze
+ *  state) and v7 (F-012 constraint-chain / delegation-provenance enforcement state). */
+export declare const MAX_SUPPORTED_CHECKPOINT_VERSION = 7;
 /**
  * Read a checkpoint's schema version, defaulting an absent field to **legacy `0`** (a 1.67-era checkpoint
  * written before the field existed — it carries no `workspaceHandle`, so resuming it the v1 way is safe).
@@ -992,8 +1034,16 @@ export interface ResolvedOutcome {
  * RETRY of the ALREADY-APPROVED action — the re-resume MUST replay the persisted {@link ResolvedOutcome}
  * winner, never a new vote — while a `tool_unavailable` reopen (the action could not run, may now be
  * invalid — P-7) lets a human RE-DECIDE with the tool present, so a fresh operator decision IS allowed.
+ *
+ * `constraint_rejected` (F-012 L3) carries the same FRESH-REDECISION semantics as `tool_unavailable`:
+ * a resolve was retracted because its decided INPUT failed a constraint re-adjudication (a frozen
+ * ancestor projection / resume-edit policy denied the approver's edit) — the ask itself is unconsumed,
+ * so the returned-to-pending row takes a fresh operator decision, never a forced replay of the
+ * rejected one. Core's own edit re-adjudication runs PRE-CAS (nothing to reopen there); this reason
+ * exists for a deployment lane that discovers the same rejection only after its own resolve landed
+ * and must return the row to pending without inventing an out-of-vocabulary reason.
  */
-export type ReopenReason = "env_failed" | "tool_unavailable";
+export type ReopenReason = "env_failed" | "tool_unavailable" | "constraint_rejected";
 /**
  * design/80 D-1 (atomicity fix): the optimistic-concurrency precondition a {@link CheckpointStore.resolve}
  * caller passes so its CAS is atomic with the validation it did against an earlier `get()` snapshot. The
@@ -1361,10 +1411,23 @@ export declare class CheckpointError extends Error {
      | "resume.parent_constraint_missing"
     /** Parent effective-policy inheritance (shape check): the resume DID re-supply
      *  `internals.inheritedGate.parentConstraints`, but its length differs from the checkpoint's recorded
-     *  `parentConstraintCount` — a partial/mismatched re-supply would silently run the child under a
+     *  `parentConstraintCount` — or (F-012 L1) its projection CONTENT digests differently from the
+     *  recorded `constraintDigest` — a partial/mismatched re-supply would silently run the child under a
      *  thinner (or different) ancestor chain than it suspended with. Rejected pre-CAS (the checkpoint
      *  stays `pending`); re-resume with the full original chain. */
-     | "resume.parent_constraint_mismatch";
+     | "resume.parent_constraint_mismatch"
+    /** F-012 L3: the resume carried an approver EDIT (`updatedInput`) and a FROZEN inherited ancestor
+     *  constraint (the persisted projection chain) — or the deployment's resume-edit policy — DENIES the
+     *  edited args. Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
+     *  the same token remains decidable (approve as shown, deny, or edit differently) — the rejection
+     *  consumed the decision's INPUT, never the ask itself. */
+     | "resume.constraint_rejected"
+    /** F-012 L3: the resume carried an approver EDIT but the inherited ancestor chain cannot be
+     *  re-adjudicated statically — an OPAQUE layer is present, a layer declares a live remainder beyond
+     *  its projection, or the checkpoint predates the projection chain. "Would have been allowed" is not
+     *  computable from a self-reported closure, so the edited resume is refused typed pre-CAS (the
+     *  checkpoint stays `pending`, still decidable); an UNEDITED approval is untouched. */
+     | "resume.constraint_unprojectable";
     /** Structured discrimination a caller can branch on where the code alone is ambiguous. Today one
      *  member: `field` names WHICH part of the decision payload was rejected on a
      *  `checkpoint.invalid_outcome` — `"boundCallId"` (the action you decided on has been replaced:
@@ -1457,10 +1520,23 @@ export declare class CheckpointError extends Error {
      | "resume.parent_constraint_missing"
     /** Parent effective-policy inheritance (shape check): the resume DID re-supply
      *  `internals.inheritedGate.parentConstraints`, but its length differs from the checkpoint's recorded
-     *  `parentConstraintCount` — a partial/mismatched re-supply would silently run the child under a
+     *  `parentConstraintCount` — or (F-012 L1) its projection CONTENT digests differently from the
+     *  recorded `constraintDigest` — a partial/mismatched re-supply would silently run the child under a
      *  thinner (or different) ancestor chain than it suspended with. Rejected pre-CAS (the checkpoint
      *  stays `pending`); re-resume with the full original chain. */
-     | "resume.parent_constraint_mismatch", message: string, 
+     | "resume.parent_constraint_mismatch"
+    /** F-012 L3: the resume carried an approver EDIT (`updatedInput`) and a FROZEN inherited ancestor
+     *  constraint (the persisted projection chain) — or the deployment's resume-edit policy — DENIES the
+     *  edited args. Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
+     *  the same token remains decidable (approve as shown, deny, or edit differently) — the rejection
+     *  consumed the decision's INPUT, never the ask itself. */
+     | "resume.constraint_rejected"
+    /** F-012 L3: the resume carried an approver EDIT but the inherited ancestor chain cannot be
+     *  re-adjudicated statically — an OPAQUE layer is present, a layer declares a live remainder beyond
+     *  its projection, or the checkpoint predates the projection chain. "Would have been allowed" is not
+     *  computable from a self-reported closure, so the edited resume is refused typed pre-CAS (the
+     *  checkpoint stays `pending`, still decidable); an UNEDITED approval is untouched. */
+     | "resume.constraint_unprojectable", message: string, 
     /** Structured discrimination a caller can branch on where the code alone is ambiguous. Today one
      *  member: `field` names WHICH part of the decision payload was rejected on a
      *  `checkpoint.invalid_outcome` — `"boundCallId"` (the action you decided on has been replaced:
@@ -1633,6 +1709,19 @@ export interface CheckpointStore {
      * that still matches.
      */
     readonly fidelity?: StoreFidelity;
+    /**
+     * F-012 L2/L3 — the RE-DECISION capability declaration: whether this store's `reopen` (and, when
+     * present, a durable validating-lease discipline) actually works — a promise, not a method-presence
+     * sniff (`reopen` is optional and a stub that returns `false` still satisfies the type). The
+     * sandbox-admission mode's pre-flight REQUIRES `redecision.reopen === true` (its boundary asks park
+     * to a human and must be re-decidable); absent reads fail-closed as "no declared re-decision face"
+     * and the mode refuses to arm, loudly. Same "declaration, never duck-typing" posture as
+     * {@link retention}/{@link durability}/{@link fidelity}.
+     */
+    readonly redecision?: {
+        reopen: boolean;
+        validatingLease?: boolean;
+    };
     /** Create-once. Throws {@link CheckpointError} `already_exists` on a token collision (never a silent
      *  overwrite — a reused token would clobber a live suspension). */
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;
@@ -1887,6 +1976,10 @@ export declare class InMemoryCheckpointStore implements CheckpointStore {
     /** Honest declaration on the fidelity axis: `put`/`get` are `structuredClone`, so a row keeps the
      *  whole structured-clone domain — a `Date` filed here is a `Date` when it comes back. */
     readonly fidelity: "structured-clone";
+    /** F-012 L2: this store's `reopen` is a real resolved→pending CAS (below) — declared, not sniffed. */
+    readonly redecision: {
+        readonly reopen: true;
+    };
     private cps;
     private fault;
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;

package/dist/core/checkpoint-store.js

@@ -133,7 +133,8 @@ export const RESOURCE_CHECKPOINT_VERSION = 2;
 export const BINDING_CHECKPOINT_VERSION = 3;
 export const TOKEN_CHECKPOINT_VERSION = 5;
 export const ORG_ADMISSION_CHECKPOINT_VERSION = 6;
-export const MAX_SUPPORTED_CHECKPOINT_VERSION = 6;
+export const F012_CHECKPOINT_VERSION = 7;
+export const MAX_SUPPORTED_CHECKPOINT_VERSION = 7;
 export function checkpointVersionOf(cp) {
     return cp.version ?? 0;
 }
@@ -458,6 +459,7 @@ export class InMemoryCheckpointStore {
     retention = "none";
     durability = "process-local";
     fidelity = "structured-clone";
+    redecision = { reopen: true };
     cps = new Map();
     fault = null;
     async put(token, cp) {

package/dist/core/governance-codes.d.ts

@@ -29,3 +29,41 @@ export declare const NON_GOVERNANCE_MEMORY_CODES: ReadonlySet<string>;
  * `undefined` (NOT governance — the caller falls through to its ordinary taxonomy).
  */
 export declare function governanceRetryClass(code: string): GovernanceRetryClass | undefined;
+/**
+ * The CLOSED registry of reasons a permission-rule sync round may refuse an inbound record or move a
+ * local row into the quarantine area (design/182 §4.3/§5.2/§8.1). Same doctrine as
+ * {@link GOVERNANCE_CODES}: the machine reads THIS table, never free text — "silently dropped" is a
+ * contract violation, so every drop names a registered code and a consumer can branch on it.
+ *
+ * These are DISCLOSURE codes, not subagent error codes: they never enter {@link GOVERNANCE_CODES}
+ * (that table classifies a failed child's error for retry, and its gate enforces a suffix convention
+ * these codes do not carry). The value states which side of the wire loses bytes:
+ * `inbound-refused` = the peer's copy was refused here (the peer still holds it — no loss);
+ * `local-quarantined` = a LOCAL row left the live view into the quarantine area (bytes preserved,
+ * disclosed, re-enterable only through a new consent).
+ */
+export declare const RULE_SYNC_DROP_CODES: {
+    /** The single validator refused the rule text (e.g. a bare-interpreter prefix). Both directions. */
+    readonly invalid_rule_text: "inbound-refused-or-local-quarantined";
+    /** Stored tool/match/command disagree with the re-projection of the rule text. Both directions. */
+    readonly metadata_mismatch: "inbound-refused-or-local-quarantined";
+    /** An inbound dot claims THIS replica's actor above its minted counter — forgery on our own name.
+     *  Covers adds, a tombstone's `deletedBy`, AND a tombstone's `removedDots` (a tombstone naming our
+     *  future dot would pre-position a kill for an approval not yet given). */
+    readonly own_actor_forged: "inbound-refused";
+    /** An inbound add reuses a dot that already identifies a DIFFERENT (rule, scope) row — a dot is
+     *  minted once for one add, so a reuse is damage or forgery, and admitting it would let quarantine
+     *  or tombstone identity on one row reach the other. */
+    readonly dot_identity_conflict: "inbound-refused";
+    /** A live local add at-or-below the collected GC frontier and absent from the inbound state — the
+     *  residue of an already-recycled tombstone. Never resurrected; quarantined and disclosed. */
+    readonly below_gc_frontier: "local-quarantined";
+    /** The server refused this local row (its response `dropped` names it); it leaves the live view so
+     *  it does not ride — and get refused on — every future round. */
+    readonly server_rejected: "local-quarantined";
+};
+/** Every reason a sync round may drop or quarantine a record. Closed set; free text is not a member. */
+export type RuleSyncDropReason = keyof typeof RULE_SYNC_DROP_CODES;
+/** The subset that may appear on a LOCAL quarantined row (design/182 §8.1 `quarantine` instruction /
+ *  fence arm / local screening). `own_actor_forged` is inbound-only by construction. */
+export type RuleQuarantineReason = Exclude<RuleSyncDropReason, "own_actor_forged">;

package/dist/core/governance-codes.js

@@ -14,6 +14,9 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.partition_split",
     "memory.tail",
     "memory.pollution_mark_failed",
+    "memory.challenge_sweep_failed",
+    "memory.lineage_settle_failed",
+    "memory.challenge_ledger_corrupt",
 ]);
 export function governanceRetryClass(code) {
     if (Object.prototype.hasOwnProperty.call(GOVERNANCE_CODES, code)) {
@@ -23,3 +26,11 @@ export function governanceRetryClass(code) {
         return "terminal";
     return undefined;
 }
+export const RULE_SYNC_DROP_CODES = {
+    invalid_rule_text: "inbound-refused-or-local-quarantined",
+    metadata_mismatch: "inbound-refused-or-local-quarantined",
+    own_actor_forged: "inbound-refused",
+    dot_identity_conflict: "inbound-refused",
+    below_gc_frontier: "local-quarantined",
+    server_rejected: "local-quarantined",
+};

package/dist/core/hooks.d.ts

@@ -1,6 +1,7 @@
 import type { DocumentContent, ImageContent, TextContent } from "../internal/llm.js";
 import type { ExecutionEnv, FileError, Result, SessionTreeEntry } from "../internal/harness-types.js";
 import type { PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy } from "./tool-policy.js";
+import { type AskClass } from "./ask-class.js";
 /**
  * In-process hook seam (design/37) — a small, provider-agnostic interception layer modeled on CC's
  * hooks but reduced to three process-internal callbacks (no shell/HTTP executors, no settings files):
@@ -712,6 +713,44 @@ export interface ToolGateInput {
             rule: string;
         }) => void;
     };
+    /**
+     * F-012 L2 — the SANDBOX ADMISSION leg. Present ONLY when the runner armed the mode: the execution
+     * env DECLARES isolation (`RemoteExecutionEnv.capabilities.isolation === true` — a Runner-resolved
+     * fact, never caller self-report) AND the park prerequisites hold (durable park configured + a
+     * checkpoint store that explicitly declares `redecision.reopen`). Absent ⇒ the whole step does not
+     * exist and the decision path is byte-identical to a build without it.
+     *
+     * Semantics (clay's ruling): inside a declared sandbox, an engine-authored "confirm a potentially
+     * destructive local action" ask is answered by containment itself — auto-allow + durable
+     * disclosure (`permission.sandbox_admitted`), never a headless deny that pollutes the model.
+     * STRICT dominance governs: the leg admits only when EVERY surviving ask on the call is classified
+     * `sandbox_local` in the engine's private envelope (deployment-policy asks are `unknown`, hook
+     * asks `hook`, marked calls `mandate`, `requiresRealApproval` asks external — none admit), and
+     * the call crosses NO declared boundary (`boundaryCapable`: egress-marked tools and
+     * protocol-mounted (MCP/A2A) tools — a server's self-report is always boundary-capable). A
+     * boundary-crossing ask under the armed mode takes the ordinary durable-park leg below — "park to
+     * a human", never an auto-deny.
+     */
+    sandboxAdmission?: {
+        /** The ask classes recorded for this call's fold-layer asks (with their source layers), or
+         *  `undefined` when no fold layer asked — the gate's own safety tighten is then the only asker. */
+        askClassesOf: (toolCallId: string) => ReadonlyArray<{
+            cls: AskClass;
+            layer: string;
+        }> | undefined;
+        /** This call's tool crosses a DECLARED boundary (egress axis / protocol-mounted) — never admitted. */
+        boundaryCapable: boolean;
+        /** The durable disclosure sink — fired on every admission BEFORE the allow is returned. */
+        onAdmitted: (info: {
+            toolCallId: string;
+            toolName: string;
+            askClasses: ReadonlyArray<{
+                cls: AskClass;
+                layer: string;
+            }>;
+            boundary: "sandbox_internal";
+        }) => void;
+    };
 }
 /**
  * Fold a {@link Hooks.preToolUse} callback into a {@link ToolPolicy} layer, so a screening face a task

package/dist/core/hooks.js

@@ -1,4 +1,5 @@
 import { decisionText, refuseOutOfContractDecision } from "./tool-policy.js";
+import { brandPolicyAskClass } from "./ask-class.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 import { createSafeNotifier } from "./safe-notify.js";
@@ -99,7 +100,7 @@ function screenPreToolUseResult(r) {
     return refuseOutOfContractDecision(r);
 }
 export function createPreToolUseConstraintPolicy(preToolUse, env, onCrash) {
-    return {
+    return brandPolicyAskClass({
         check: async (req) => {
             let r;
             try {
@@ -128,7 +129,7 @@ export function createPreToolUseConstraintPolicy(preToolUse, env, onCrash) {
             }
             return r.updatedInput !== undefined ? { action: "allow", updatedInput: r.updatedInput } : { action: "allow" };
         },
-    };
+    }, "hook");
 }
 function traceHookCrash(input, err, notifier) {
     notifier.notify(() => input.onHookError?.(err), "toolGate.onHookError");
@@ -293,6 +294,29 @@ export async function runToolGate(input) {
                 denySource = "classifier";
             }
         }
+        if (input.sandboxAdmission !== undefined &&
+            decision.action === "ask" &&
+            req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
+            input.isMarkedUnresolvable?.(input.event.toolCallId) !== true &&
+            decision.requiresRealApproval !== true &&
+            decision.decisionReason !== "hook" &&
+            hookAsk === undefined &&
+            input.egress !== true &&
+            input.sandboxAdmission.boundaryCapable !== true) {
+            const recorded = input.sandboxAdmission.askClassesOf(toolCallId);
+            const admissible = recorded !== undefined && recorded.length > 0 && recorded.every((r) => r.cls === "sandbox_local");
+            if (admissible) {
+                const askClasses = recorded;
+                input.sandboxAdmission.onAdmitted({ toolCallId, toolName, askClasses, boundary: "sandbox_internal" });
+                preToolContext.push(`permission.sandbox_admitted: this call's pending approval was auto-admitted because the deployment declares an isolated sandbox execution env and the request stays inside it. Recorded for audit.`);
+                decision = {
+                    action: "allow",
+                    message: "admitted inside the deployment-declared sandbox (permission.sandbox_admitted)",
+                    decisionReason: "sandbox",
+                    ...(policyRewrite !== undefined ? { updatedInput: policyRewrite } : {}),
+                };
+            }
+        }
         const egressTool = input.egress === true;
         const irreversibleTool = input.irreversibility === "always" || input.irreversibility === "maybe";
         const safety = egressTool || irreversibleTool ? { egress: egressTool, irreversible: irreversibleTool } : undefined;

package/dist/core/locked-config.d.ts

@@ -18,7 +18,7 @@ export declare const LOCKED_KEY_REGISTRY: {
         readonly specFields: readonly ["mcp"];
     };
     readonly toolPolicy: {
-        readonly specFields: readonly ["toolPolicy"];
+        readonly specFields: readonly ["toolPolicy", "basePolicyForResumeEdit"];
     };
     readonly compliancePosture: {
         readonly specFields: readonly [];
@@ -46,6 +46,12 @@ export interface LockedPreflight {
      *  always enforced, resolved ONCE here. With `toolPolicy` locked, the deployment's own
      *  `deps.toolPolicy` is the whole answer (a spec-supplied policy has already been refused). */
     toolPolicy: ToolPolicy | undefined;
+    /** F-012 (codex round 8): the effective resume-edit re-adjudication OVERRIDE, resolved lock-aware in
+     *  the SAME slot as {@link toolPolicy}. With `toolPolicy` locked, a spec-supplied
+     *  `basePolicyForResumeEdit` has already been refused wholesale, so this is the deployment's own
+     *  `deps.basePolicyForResumeEdit` (or undefined — the caller-policy fallback then applies at the use
+     *  site). Unlocked: `spec.basePolicyForResumeEdit ?? deps.basePolicyForResumeEdit`. */
+    basePolicyForResumeEdit: ToolPolicy | undefined;
 }
 /**
  * Validate a deployment's lock declaration against the closed registry. Fail-loud on any unknown

package/dist/core/locked-config.js

@@ -1,6 +1,6 @@
 export const LOCKED_KEY_REGISTRY = {
     mcp: { specFields: ["mcp"] },
-    toolPolicy: { specFields: ["toolPolicy"] },
+    toolPolicy: { specFields: ["toolPolicy", "basePolicyForResumeEdit"] },
     compliancePosture: { specFields: [] },
     retentionPolicy: { specFields: [] },
 };
@@ -38,5 +38,6 @@ export function preflightLockedConfig(spec, deps) {
         lockedKeys,
         mcp: lockedKeys.has("mcp") ? undefined : spec.mcp,
         toolPolicy: lockedKeys.has("toolPolicy") ? deps.toolPolicy : (spec.toolPolicy ?? deps.toolPolicy),
+        basePolicyForResumeEdit: lockedKeys.has("toolPolicy") ? deps.basePolicyForResumeEdit : (spec.basePolicyForResumeEdit ?? deps.basePolicyForResumeEdit),
     };
 }

package/dist/core/memory-engine/delegation-provenance.d.ts

@@ -0,0 +1,62 @@
+/**
+ * design/180 half A — delegation RUNTIME provenance: the three-value attestation and its monotonic
+ * aggregate. The static tool-face judgment ({@link import("./content-origin.js").delegationCallIsExternal})
+ * stays the PERMANENT FLOOR: runtime evidence may only retire the static verdict when a COMPLETE
+ * clean proof is in hand; any evidence gap falls back to the floor. "We could not prove it clean"
+ * and "it is clean" are different answers — replacing the floor outright would fail OPEN on every
+ * evidence gap (old child vintages, crashes, un-armed sessions).
+ *
+ * The aggregate is two MONOTONIC bits plus versioning:
+ *  - `sawExternal` — an actually-observed polluting-class invocation (own recorder, or a delivered
+ *    child attestation of `external`). Once set, never cleared.
+ *  - `incomplete` — some stretch of the session's conduct is unprovable (a delegation delivered no /
+ *    an unknown attestation, a resume lost the aggregate, the recorder was not armed from turn 0).
+ *    Once set, never cleared.
+ * Reduction order is FIXED (design/180 r3): `sawExternal ⇒ external` > `incomplete ⇒ unknown` >
+ * `clean` — an observed external event always outranks an evidence gap (missing evidence can make
+ * "clean" unprovable; it can never make an observed event disappear).
+ */
+/** The three-value delegation attestation. Only `clean` changes behavior (the parent skips the
+ *  static mark); `unknown` is byte-equivalent to absence (static floor governs); `external` marks
+ *  unconditionally, with the observed-event reason. */
+export type DelegationAttestation = "clean" | "external" | "unknown";
+/** The monotonic per-run provenance aggregate (in-process this slice; the durable-checkpoint
+ *  persistence leg rides the background-face slice — absence after a resume reads `incomplete`,
+ *  which is the fail-closed default this shape is built around). */
+export interface DelegationProvenanceAggregate {
+    version: 1;
+    /** Turn index the recorder was armed from. 0 ⇔ armed at prepare (full coverage). */
+    coverageStartTurn: number;
+    sawExternal: boolean;
+    incomplete: boolean;
+}
+/** The frozen content-safety snapshot a parent hands its delegated children (design/180 A-2): the
+ *  classification config the child's recorder must judge under. Inherit-narrow-only — see
+ *  {@link narrowContentSafety}. */
+export interface DelegationContentSafety {
+    trustedTools: readonly string[];
+    execIsExternalContent: boolean;
+}
+export declare function newDelegationProvenanceAggregate(): DelegationProvenanceAggregate;
+/**
+ * Effective content-safety for a run: the parent chain's frozen snapshot ∩ the run's own config.
+ * A child may NARROW what the chain trusts (fewer trusted tools, stricter exec), never widen it —
+ * a wider child-side allowlist must not launder a chain-external tool into `local` on the way up.
+ * At least one input must be present (the caller only computes this when armed).
+ */
+export declare function narrowContentSafety(parent: DelegationContentSafety | undefined, own: {
+    trustedTools: ReadonlySet<string>;
+    execIsExternalContent: boolean;
+} | undefined): {
+    trustedTools: Set<string>;
+    execIsExternalContent: boolean;
+};
+/** Reduce an aggregate to the delivered attestation. `completed` = the child reached its terminal
+ *  normally with its full result delivered — a salvage/partial/errored child can never prove clean
+ *  (its conduct after the cut is unobserved), though an OBSERVED external event still reports. */
+export declare function reduceDelegationAttestation(agg: DelegationProvenanceAggregate | undefined, opts: {
+    completed: boolean;
+}): DelegationAttestation;
+/** Read a delivered card's attestation field (the explicit-whitelist handback seat). Anything but
+ *  the three spellings — including absence — reads as undefined, i.e. the static floor governs. */
+export declare function readCardAttestation(details: unknown): DelegationAttestation | undefined;

package/dist/core/memory-engine/delegation-provenance.js

@@ -0,0 +1,26 @@
+export function newDelegationProvenanceAggregate() {
+    return { version: 1, coverageStartTurn: 0, sawExternal: false, incomplete: false };
+}
+export function narrowContentSafety(parent, own) {
+    if (parent === undefined) {
+        return { trustedTools: new Set(own?.trustedTools ?? []), execIsExternalContent: own?.execIsExternalContent ?? false };
+    }
+    const fromParent = new Set(parent.trustedTools);
+    const trustedTools = own === undefined ? fromParent : new Set([...fromParent].filter((t) => own.trustedTools.has(t)));
+    return { trustedTools, execIsExternalContent: parent.execIsExternalContent || (own?.execIsExternalContent ?? false) };
+}
+export function reduceDelegationAttestation(agg, opts) {
+    if (agg === undefined)
+        return "unknown";
+    if (agg.sawExternal)
+        return "external";
+    if (agg.incomplete || !opts.completed || agg.version !== 1 || agg.coverageStartTurn !== 0)
+        return "unknown";
+    return "clean";
+}
+export function readCardAttestation(details) {
+    if (details === null || typeof details !== "object")
+        return undefined;
+    const v = details.attestation;
+    return v === "clean" || v === "external" || v === "unknown" ? v : undefined;
+}

package/dist/core/memory-engine/engine.d.ts

@@ -1,4 +1,4 @@
-import { type MemoryPartitionIncidentSink, type RetrievedAccountRow, type SessionPollutionRecord } from "./layout.js";
+import { type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, type MemoryPartitionIncidentSink, type RetrievedAccountRow, type SessionPollutionRecord } from "./layout.js";
 import type { HarvestReport, MemoryAnnouncement, MemoryBackend, MemorySessionHandle, ScanFinding } from "./types.js";
 /**
  * The CC `# Memory` instruction section — VERBATIM from the live capture
@@ -31,6 +31,15 @@ export declare function buildMemoryInstruction(memoryDir: string, instructionFil
  * dual-root instruction merge ("the write plane's instruction wins") never sees a second candidate.
  */
 export declare const MEMORY_RECALL_DISCIPLINE = "Before answering questions about earlier work, decisions, dates, people, or the user's preferences, look them up: `memory_search` finds entries by keyword and `memory_get` reads a full entry \u2014 the injected memory index only lists what exists. When a lookup comes up empty, say that you checked memory and found nothing instead of guessing.";
+/**
+ * design/180 B-3 — the preference-header discipline paragraph. Same carriage as
+ * {@link MEMORY_RECALL_DISCIPLINE}: a runner-appended segment OUTSIDE `inject()`, so the
+ * CC-verbatim `# Memory` instruction stays byte-identical to its sha256-pinned capture. Appended
+ * only when a WRITE channel exists (prepare-memory gates it) — the lines it teaches are frontmatter
+ * the MODEL writes; the engine has no write arm for them (writing usage evidence for the model
+ * would forge the very account the three-tier discipline forbids forging).
+ */
+export declare const MEMORY_PREFERENCE_DISCIPLINE = "When the user confirms a stored preference or fact still holds, refresh that entry's `last-confirmed: <YYYY-MM-DD>` frontmatter line (add it when absent). When you save a preference, add an `applies-when: <context>` frontmatter line naming when it applies. Both are plain frontmatter lines \u2014 write them yourself; nothing fills them in for you.";
 /** CC index-injection parameters: MEMORY.md's first 200 lines / 25KB enter the prompt. */
 export declare const MEMORY_INDEX_MAX_LINES = 200;
 export declare const MEMORY_INDEX_MAX_BYTES: number;
@@ -188,6 +197,62 @@ export declare class MemoryEngine {
     /** The session's pollution record (in-process mark first, then the durable marker) — undefined =
      *  clean. Reads are side-effect-free. */
     sessionPollution(sessionId: string): SessionPollutionRecord | undefined;
+    /** Entry ids the session's memory tools RETURNED this process — the retrieved half of the
+     *  challenged-history mechanical event (B-3). In-process on purpose: "same session" is one runner
+     *  process by architecture, and the durable retrieved account is not session-keyed. */
+    private readonly retrievedThisSession;
+    /**
+     * The model-visible read faces' EXCLUSION view: entry id → why it is withheld.
+     *  - `challenged` — an unresolved S-grade challenge generation exists (B-2');
+     *  - `lineage_pending` — the dirty latch: a staged lineage row for this id has not been settled
+     *    (credentialed-but-unpromoted, or the undecidable crash window) — "the account is not
+     *    settled, the content does not go on the table" (r4).
+     * THROWS {@link import("./layout.js").ControlPlaneCorruptError} when either ledger's integrity is
+     * unknowable — consumers must refuse service loudly (corrupt ≠ clean), the same law the pollution
+     * marker already follows.
+     */
+    readChallengeExclusions(): Map<string, {
+        code: "challenged" | "lineage_pending";
+        generation?: number;
+        at?: number;
+    }>;
+    /** The shared challenge writer: append events idempotently, then announce OPAQUELY (id + code +
+     *  generation only — the announcement is a model-visible face, so no name/description/free reason
+     *  rides it; content stays on the host audit face). Failures are disclosed, never thrown past. */
+    private challengeAndAnnounce;
+    /**
+     * Host API (advisory, control-plane trust level — the same plane that can mark pollution):
+     * challenge entries by id. `requestId` is REQUIRED (the generation ledger's idempotency identity;
+     * this engine never mints one for the caller — a retried request must carry the SAME id so a lost
+     * ack cannot open a second generation). Each entry's eventId derives as `<requestId>:<entryId>`,
+     * so one batched request stays per-entry attributable.
+     */
+    challengeEntries(ids: readonly string[], reason: string, requestId: string): ChallengeAssignment[];
+    /** Host API: challenge every entry the lineage ledger attributes to `sessionId` (post-hoc source
+     *  falsification — trustedTools misconfigured, a tool re-classified, late delegation evidence).
+     *  Same requestId contract as {@link challengeEntries}. */
+    challengeSession(sessionId: string, reason: string, requestId: string): ChallengeAssignment[];
+    /** Host API: the TRUSTED resolve — closes exactly the named generation (a later challenge stays
+     *  open; a resolve never blanket-clears, and there is no model-face path to this call). Returns
+     *  false ⇔ no such generation was ever opened. */
+    resolveChallenge(entryId: string, generation: number, reason: string, requestId?: string): boolean;
+    /** Host API: adjudicate one UNDECIDABLE pending lineage transaction (the applyPatches-success →
+     *  credential-write crash window; design/180 r5 — never auto-discarded). The host, holding its own
+     *  deployment facts, states whether the commit landed. */
+    adjudicatePendingLineage(txnId: string, action: "promote" | "discard"): LineagePromotion[];
+    /** Host observability: the staged lineage transactions still awaiting settlement (their entry ids
+     *  are latched — see {@link readChallengeExclusions}). Throws on a corrupt ledger. */
+    listPendingLineage(): Record<string, LineagePendingTxn>;
+    /** Host audit reads (throw on corruption — audit must not read a laundered ledger as clean). */
+    readChallengeLedger(): ChallengeEvent[];
+    /** Observability/tests — the collect-only challenged-history account (B-3; zero engine consumers). */
+    readChallengedHistoryAccount(): Record<string, ChallengedHistoryRow>;
+    /** Promotion settlement (shared by harvest step ⑤, reconciliation and host adjudication): a
+     *  promoted contribution whose session ALREADY carries a durable pollution marker is challenged
+     *  on the spot — "mark first, promote later" must converge exactly like the reverse order. The
+     *  eventId anchors on the pollution record (sessionId + marked-at), so however many times this
+     *  settlement replays the same pollution event, the generation is allocated once. */
+    private settlePromotions;
     materialize(scopes: readonly string[], writeScope: string | null): Promise<MemorySessionHandle>;
     inject(handle: MemorySessionHandle, opts?: {
         writeToolMounted?: boolean;
@@ -222,6 +287,7 @@ export declare class MemoryEngine {
         polluted?: {
             reason: string;
         };
+        sessionId?: string;
     }): Promise<HarvestReport>;
     private harvestCore;
     /**