@sema-agent/core 5.23.0 → 5.25.0

package/dist/index.d.ts

@@ -88,7 +88,7 @@ export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW,
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, type BashReadonlyRootBoundary, type CompoundReadonlyVerdict, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, type ToolResultStore, type ToolResultSlice, } from "./core/tool-result-store.js";
-export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type SafetyAxis, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
+export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, type UsageWindow, type UsageWindowStore, type UsageWindowReading, type UsageWindowRecord, type UsageSlot, type UsageBucketRow, } from "./core/usage-window-store.js";
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";
 export { ENV_LIFETIME_SUSPEND_MARGIN_MS, USAGE_WINDOW_REAP_MARGIN_MS } from "./core/runner/prepare-task.js";
@@ -136,14 +136,20 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
 /**
  * design/179 — persisted ALLOW rules: the standing form of approvals a person already gave.
  *
- * Note what is NOT here. `PermissionRuleWriter` is core-private and never exported, so a deployment has
- * no API path that puts a rule in the store; every rule that enters through the engine comes out of the
- * consent protocol below (a durable approval record, an authenticated confirmation, a principal-bound
- * redemption). Removal is exported without that ceremony, because narrowing on a user's behalf is allowed
- * and widening is not.
+ * The consent boundary, restated precisely (ruled 2026-08-10): the ENGINE's only write
+ * path into a rule store is the consent protocol below (a durable approval record, an authenticated
+ * confirmation, a principal-bound redemption). That fact is a property of the engine's wiring, not of
+ * what this file exports — a deployment always owned its own storage bytes. The BACKEND CONTRACT
+ * (writer types, the writer handle key, and the fold pure functions) is therefore exported further
+ * down, so an out-of-repo store implementation (the server's SQL twin) is built against the same
+ * definitions as the file backend instead of mirroring them — mirrored types are how comment/contract
+ * drift starts. What stays deliberately absent is any convenience that mints rules AROUND consent:
+ * exporting the contract gives a store implementer the same powers it already had over its own bytes,
+ * and nothing more. Removal is exported without ceremony, because narrowing on a user's behalf is
+ * allowed and widening is not.
  */
 export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleSuggestion, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
-export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, } from "./core/permission-rule-store.js";
+export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, type PermissionRuleWriter, type WritablePermissionRuleStore, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
 export { createOrgRuleOverlay, orgRuleVerdictFor, effectivePermissionRules, orgRuleStatePersistenceOf, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, type OrgPermissionRule, type OrgRuleSnapshot, type OrgRuleSnapshotProvider, type OrgRuleStatePersistence, type PersistedOrgRuleState, type OrgRuleOverlay, type OrgOverlayResolution, type OrgOverlayStatus, type EffectivePermissionRule, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES, type RuleSyncDropReason, type RuleQuarantineReason } from "./core/governance-codes.js";

package/dist/index.js

@@ -69,7 +69,7 @@ export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW,
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, } from "./core/tool-result-store.js";
-export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, } from "./core/checkpoint-store.js";
+export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, } from "./core/usage-window-store.js";
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";
 export { ENV_LIFETIME_SUSPEND_MARGIN_MS, USAGE_WINDOW_REAP_MARGIN_MS } from "./core/runner/prepare-task.js";
@@ -112,7 +112,7 @@ export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_M
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, } from "./core/permission-rules.js";
 export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
-export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, } from "./core/permission-rule-store.js";
+export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
 export { createOrgRuleOverlay, orgRuleVerdictFor, effectivePermissionRules, orgRuleStatePersistenceOf, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES } from "./core/governance-codes.js";

package/dist/stores/file/adoption/adopt.d.ts

@@ -24,9 +24,29 @@
  *   ⑥ the marker is atomically rewritten into its PERMANENT terminal record carrying the immutable
  *     report. Never deleted; a re-run short-circuits to it.
  *
- * FREEZE (design/183 §8 load-bearing premise): from the moment ② lands, the whole root is read-only
- * for everyone but this machine — live writers are excluded by the locks, and across crashes every
- * file store constructor refuses the in-flight marker (invariant I6, `assertAdoptionBootGate`).
+ * FREEZE (design/183 §8 load-bearing premise): from the moment ② lands, the root is closed to new
+ * writers — and it is worth being exact about which mechanism covers what, because the two halves
+ * meet at a seam rather than overlapping (backlog #136⑧):
+ *   · the LOCKS cover the boot-locked shape: this machine holds `LOCK` (the engine's own boot lock,
+ *     taken by `FileStorageBackend`) and `ADOPTION-LOCK` for the whole arc, so a live backend refuses
+ *     the adoption instead of interleaving with it, and a second adoption refuses too;
+ *   · invariant I6 (`assertAdoptionBootGate`) covers CONSTRUCTION over a DATA-ROOT ANCHOR: while the
+ *     marker is in flight, a store constructor handed the data root refuses it — including across a
+ *     crash, when no lock survives.
+ * What NEITHER covers, enumerated rather than implied:
+ *   · an ALREADY-constructed instance over this root through a path that does not hold `LOCK` (the
+ *     independent store faces — `new FileMemoryStore(root)`, the mailbox family). It keeps its open
+ *     handles, and I6 is a construction-time gate, not a write-time one;
+ *   · a NEW construction whose anchor is not the data root. Two faces take a directory that need not
+ *     BE the data root — `FilePermissionRuleStoreProvider` (the rule bucket) and
+ *     `createFileTaskListStore` (the document's own directory) — so each takes its root anchor as an
+ *     explicit option, and a caller that omits it constructs unGATED during a freeze. That default is
+ *     what this arc's own nested rule leg rides (it must reach the bucket while the marker is in
+ *     flight); a deployment wanting the gate passes the anchor. Both arms are pinned.
+ * That is the same boundary the file family draws everywhere else (one live writer per data root is
+ * the deployment's contract, mechanically enforced only for the backend-factory shape), and it is why
+ * "stop the engine before adopting" remains an operational instruction and not merely a machine-
+ * checked one.
  * Idempotent resume ("re-run completes the unfinished legs") is only sound because no per-store row
  * moves underneath it; the freeze is the premise of idempotence, not an implementation detail.
  *

package/dist/stores/file/adoption/adopt.js

@@ -249,6 +249,7 @@ const ZERO_ACTION_STORES = [
     "tool-result",
     "file-snapshot",
     "memory",
+    "memory-engine",
     "task-list",
     "mailbox",
     "workflow-run",
@@ -500,8 +501,8 @@ export async function adoptLocalDataRoot(opts) {
                     };
                 }
             }
-            if (opts.from.kind === "principal" && legBits[SESSION_POLICY_LEG]?.done !== true) {
-                const rows = rewriteSessionPolicyRows(opts.root, opts.from.principal, opts.toPrincipal);
+            if (legBits[SESSION_POLICY_LEG]?.done !== true) {
+                const rows = rewriteSessionPolicyRows(opts.root, opts.from.kind === "principal" ? opts.from.principal : null, opts.toPrincipal);
                 legBits = { ...legBits, [SESSION_POLICY_LEG]: { done: true, rows } };
                 publishMarker(opts.root, adoptionId, opts.from, opts.toPrincipal, 2, plan, legBits);
             }
@@ -557,12 +558,7 @@ export async function adoptLocalDataRoot(opts) {
         }
         if (plan.rulesDir !== undefined)
             legs.push({ store: "permission-rule", action: "bucket-rebind" });
-        if (opts.from.kind === "principal") {
-            legs.push({ store: SESSION_POLICY_LEG, action: "row-rewrite", rows: legBits[SESSION_POLICY_LEG]?.rows ?? 0 });
-        }
-        else {
-            legs.push({ store: SESSION_POLICY_LEG, action: "none" });
-        }
+        legs.push({ store: SESSION_POLICY_LEG, action: "row-rewrite", rows: legBits[SESSION_POLICY_LEG]?.rows ?? 0 });
         const carried = Object.entries(legBits)
             .filter(([k]) => k.startsWith(CARRIAGE_BIT_PREFIX))
             .map(([k, bit]) => ({

package/dist/stores/file/adoption/marker.d.ts

@@ -5,8 +5,11 @@
  * Two shapes live in `<dataRoot>/adoption.json`:
  *  - the IN-FLIGHT marker (`marker`): a monotonically-advanced `phase` plus per-leg completion bits
  *    for the one leg class without a self-attesting completion predicate (row rewrites). While this
- *    shape is on disk the root is FROZEN: every file store constructor refuses to build over it
- *    ({@link assertAdoptionBootGate} — invariant I6), so no writer can serve a half-migrated root.
+ *    shape is on disk the root is FROZEN: every file store constructor ANCHORED TO THE DATA ROOT
+ *    refuses to build over it ({@link assertAdoptionBootGate} — invariant I6). Coverage is stated
+ *    precisely at the gate's own docstring: two faces whose constructor argument is not the root
+ *    take an optional `dataRoot` anchor, and a caller omitting it is outside the gate (the seam is
+ *    documented and pinned where those faces live).
  *  - the PERMANENT terminal record (`adopted`): never deleted. It is the idempotence anchor (a re-run
  *    with the same (from → toPrincipal) short-circuits to the recorded receipt) and it carries the
  *    IMMUTABLE report — the byte-stable half of every receipt.
@@ -153,18 +156,26 @@ export type RootAdoptionFile = {
 export declare const ROOT_ADOPTION_FILE = "adoption.json";
 /**
  * design/183 §6 (r4) — the CLOSED SET of by-design-not-migrated assets, verbatim from the design's
- * written list. Lives HERE (beside the reader) because the terminal validator enforces EXACT
- * equality: the report is the account's recovery source, and a reduced-or-grown list at read time
- * is either damage or drift — both refused (§10.5 ①).
+ * written list. The WRITER emits exactly this list and the drift pin (§10.5 ① — the design-vs-code
+ * two-cell guard) lives in the TEST GRID, where a ruled growth of the set is a deliberate edit.
+ *
+ * #133: the terminal READ validator deliberately does NOT compare a stored report against this
+ * constant. A persisted report is a snapshot of the set AS RULED AT ADOPTION TIME; the set is
+ * allowed to grow by ruling (§10.5 ① names that road), so an exact-equality read check would mark
+ * every already-adopted root corrupt on the release after any growth (and again on rollback) — 13
+ * construction sites all refusing to serve. The read validator checks SHAPE and integrity
+ * (non-empty, well-formed entries, no duplicate assets — what an empty/mangled account rebuild
+ * actually needs), never version-crossed content equality.
  */
 export declare const NOT_MIGRATED_BY_DESIGN: ReadonlyArray<{
     asset: string;
     ruling: string;
 }>;
-/** The five baseline obligation IDENTITIES (design/183 §6 minimum face). The terminal validator
- *  requires them all: a "reduced but shaped" report would otherwise rebuild a thinner account.
- *  The writer's `baselineConfigs` emits exactly these — any drift breaks the writer's own
- *  read-back immediately (self-checking pair). */
+/** The five baseline obligation IDENTITIES (design/183 §6 minimum face). Since #133 the terminal READ
+ *  validator deliberately does NOT compare a stored report against this table (the stored report is a
+ *  snapshot of the set as ruled at adoption time; see the validator's own note) — the enforcement that
+ *  the WRITER emits exactly this set lives in the test grid (test/file-adoption-root.test.ts pins the
+ *  fresh report's identities against this constant), where a drift is a deliberate, reviewable edit. */
 export declare const BASELINE_CONFIG_IDENTITIES: ReadonlyArray<{
     deployment: string;
     key: string;
@@ -178,17 +189,29 @@ export declare function readRootAdoptionFile(root: string): RootAdoptionFile | u
 /** Atomically publish the root marker (write-temp → fsync → rename, same discipline as every store). */
 export declare function writeRootAdoptionFile(root: string, content: RootAdoptionFile): void;
 /**
- * Invariant I6 (design/183 §3.1) — the adoption BOOT GATE, called by every file store constructor:
- * an in-flight root marker means the root is mid-adoption (possibly after a crash), and serving a
- * half-migrated root is refused LOUDLY. The refusal names the in-flight arc and the way forward
- * (resume `adoptLocalDataRoot` to completion). A terminal record passes: a completed adoption is a
- * normal, readable root. A corrupt marker throws (fail-closed, see {@link readRootAdoptionFile}).
+ * Invariant I6 (design/183 §3.1) — the adoption BOOT GATE: an in-flight root marker means the root is
+ * mid-adoption (possibly after a crash), and serving a half-migrated root is refused LOUDLY. The
+ * refusal names the in-flight arc and the way forward (resume `adoptLocalDataRoot` to completion). A
+ * terminal record passes: a completed adoption is a normal, readable root. A corrupt marker throws
+ * (fail-closed, see {@link readRootAdoptionFile}).
+ *
+ * WHO calls it, precisely: every store constructor whose argument IS the data root (that is most of
+ * the family — they derive their own subdirectory from it). The two faces whose argument is a
+ * caller-chosen directory instead — `FilePermissionRuleStoreProvider` (a rule bucket) and
+ * `createFileTaskListStore` (the document's directory) — cannot anchor on their argument, so each
+ * takes the data root as an explicit option and is gated only when given one. `root` here is always
+ * the ANCHOR, never "wherever this store keeps its bytes": passing a subdirectory reads a marker that
+ * is not there and passes unconditionally.
  *
  * This gate is what turns "the engine must be stopped during adoption" from an operational assumption
  * into a machine-checked invariant across crashes: the adoption's own locks die with its process, but
- * the marker (and this gate) survive. Boundary, stated honestly: the gate fires at CONSTRUCTION time.
- * A store instance constructed BEFORE the marker landed in another OS process is outside it — cross-
- * process sharing of one data dir is the file family's documented UNSUPPORTED shape (task-list F-14,
- * mailbox RB-249); adoption adds no new promise there.
+ * the marker (and this gate) survive. Boundary, stated honestly: the gate fires at CONSTRUCTION time,
+ * and it is the ONLY thing this function does — it never reaches an object that already exists. So a
+ * store instance constructed BEFORE the marker landed keeps writing for as long as it is held, in
+ * ANOTHER OS process (cross-process sharing of one data dir is the file family's documented
+ * UNSUPPORTED shape — task-list F-14, mailbox RB-249) and, symmetrically, in THIS one (an independent
+ * store face built before the adoption started; the arc's `LOCK` acquisition excludes a live
+ * `FileStorageBackend`, which is the only shape that takes that lock). Adoption adds no new promise on
+ * either side of that seam — see the freeze note on `adoptLocalDataRoot` for the full division.
  */
 export declare function assertAdoptionBootGate(root: string, storeName: string): void;

package/dist/stores/file/adoption/marker.js

@@ -74,7 +74,7 @@ function isRootAdoptionFileShape(v) {
             }
         }
         const legs = (m.legs ?? {});
-        if (m.phase >= 3 && m.from.kind === "principal" && legs["session-policy"]?.done !== true)
+        if (m.phase >= 3 && legs["session-policy"]?.done !== true)
             return false;
         if (m.phase === 5) {
             for (const store of p.carriage) {
@@ -123,14 +123,21 @@ function isRootAdoptionFileShape(v) {
                     return false;
                 configIds.add(id);
                 return true;
-            }) &&
-            BASELINE_CONFIG_IDENTITIES.every((b) => configIds.has(JSON.stringify([b.deployment, b.key])));
+            });
         const nmd = r.notMigratedByDesign;
+        const nmdAssets = new Set();
         const closedSetOk = Array.isArray(nmd) &&
-            nmd.length === NOT_MIGRATED_BY_DESIGN.length &&
-            NOT_MIGRATED_BY_DESIGN.every((m, i) => {
-                const e = nmd[i];
-                return (e !== null && typeof e === "object" && e.asset === m.asset && e.ruling === m.ruling);
+            nmd.length > 0 &&
+            nmd.every((e) => {
+                if (e === null || typeof e !== "object")
+                    return false;
+                const m = e;
+                if (typeof m.asset !== "string" || m.asset === "" || typeof m.ruling !== "string" || m.ruling === "")
+                    return false;
+                if (nmdAssets.has(m.asset))
+                    return false;
+                nmdAssets.add(m.asset);
+                return true;
             });
         const legsOk = Array.isArray(r.legs) &&
             r.legs.every((l) => {

package/dist/stores/file/permission-rule-store.d.ts

@@ -157,12 +157,26 @@ declare class FilePermissionRuleStore implements WritablePermissionRuleStore {
  *
  * An absent principal resolves to a store that reads zero rules and refuses to write — an unauthenticated
  * task does not share anyone's bucket.
+ *
+ * ROOT FREEZE (design/183 invariant I6, backlog #136⑤): every sibling file store gates construction on
+ * the DATA ROOT's adoption marker, but this provider is built over the RULE BUCKET directory, which is
+ * a caller-chosen path that need not sit under (or equal) the data root — so `dir` is not a usable
+ * anchor for that gate and the bucket was writable straight through a root freeze. The anchor is
+ * therefore taken EXPLICITLY, via `opts.dataRoot`: supply it whenever the rule bucket belongs to a data
+ * root that `adoptLocalDataRoot` may adopt, and construction is refused while that root is mid-adoption
+ * exactly like `FileStorageBackend`'s. Omitting it keeps the previous behavior (no root gate) — which is
+ * also the EXEMPTION the adoption machine itself rides: its nested design/182 rule leg constructs this
+ * provider without a `dataRoot` precisely because it runs while the marker is in flight, and the
+ * bucket-level marker (read in `forPrincipal`/`forLocalOwner`) is what governs writes inside that arc.
  */
 export declare class FilePermissionRuleStoreProvider implements PermissionRuleStoreProvider {
     private readonly dir;
     private readonly onError?;
     private lock;
-    constructor(dir: string, onError?: ((message: string) => void) | undefined);
+    constructor(dir: string, onError?: ((message: string) => void) | undefined, opts?: {
+        /** The data root whose adoption marker gates construction (design/183 I6). Absent ⇒ no root gate. */
+        dataRoot?: string;
+    });
     /** Take the writer lock, once, on first use of a write face. Reading never calls this. */
     private acquireWriteLock;
     forPrincipal(principal: string | undefined): PermissionRuleStore;

package/dist/stores/file/permission-rule-store.js

@@ -4,6 +4,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { PERMISSION_RULE_WRITER, applySyncJoin, applyTombstones, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, foldDelta, } from "../../core/permission-rule-store.js";
 import { canonicalize } from "../../core/canonical-json.js";
 import { BootLock } from "./fs-atomic.js";
+import { assertAdoptionBootGate } from "./adoption/marker.js";
 const LOCAL_OWNER_FILE = "local-owner.json";
 const ADOPTION_FILE = "PERMISSION-RULES-ADOPTION.json";
 export function readRuleAdoptionFile(dir) {
@@ -298,9 +299,11 @@ export class FilePermissionRuleStoreProvider {
     dir;
     onError;
     lock;
-    constructor(dir, onError) {
+    constructor(dir, onError, opts) {
         this.dir = dir;
         this.onError = onError;
+        if (opts?.dataRoot !== undefined)
+            assertAdoptionBootGate(opts.dataRoot, "FilePermissionRuleStoreProvider");
     }
     acquireWriteLock = () => {
         if (this.lock !== undefined)

package/dist/stores/file/session-policy-store.d.ts

@@ -31,6 +31,15 @@ export interface FileSessionPolicyStoreOptions {
 export declare class FileSessionPolicyStore implements SessionPolicyStore {
     private readonly dir;
     private readonly onCorruptRead;
+    /** #132 — the ADOPTED identity of a local-owner root's anonymous lane, or undefined on an
+     *  unadopted (or principal-adopted) root. A local-owner adoption rebinds the anonymous
+     *  `[sid,null]` estate rows to `toPrincipal`; until the deployment's principal wiring lands
+     *  (`REQUIRE_PRINCIPAL` et al. — recorded `migrated:false` in the config account, an operator
+     *  action), the runtime still queries anonymously, and ENOENT there would silently drop the very
+     *  tighten-only deny rules the rebind moved. Adoption is a transfer of the whole anonymous
+     *  identity, so on such a root the anonymous key IS the adopted principal — reads and writes
+     *  alike (a window-era anonymous write must not mint a fresh orphan row). */
+    private readonly anonymousAlias;
     constructor(root: string, opts?: FileSessionPolicyStoreOptions);
     /** The one delivery point for {@link onCorruptRead}. Swallow-guarded here so no caller has to remember. */
     private disclose;
@@ -41,7 +50,8 @@ export declare class FileSessionPolicyStore implements SessionPolicyStore {
      *  (swallow-guarded; never on a plain ENOENT, which really is absence). */
     private discloseCorrupt;
     /** `(sessionId, principal)` → a safe, INJECTIVE filename (sanitizeScope appends the full sha256 of the raw
-     *  composite key, so distinct keys never collide on disk). */
+     *  composite key, so distinct keys never collide on disk). On a local-owner-adopted root the
+     *  anonymous lane resolves to the adopted principal's key (#132 — see {@link anonymousAlias}). */
     private pathFor;
     private read;
     getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;

package/dist/stores/file/session-policy-store.js

@@ -2,15 +2,19 @@ import { readFileSync, readdirSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { loosenReasons, normalizeRules, stripRev, SessionPolicyError, } from "../../core/session-policy-store.js";
 import { atomicWriteFile, ensureDir, sanitizeScope } from "./fs-atomic.js";
-import { assertAdoptionBootGate } from "./adoption/marker.js";
+import { assertAdoptionBootGate, readRootAdoptionFile } from "./adoption/marker.js";
 export class FileSessionPolicyStore {
     dir;
     onCorruptRead;
+    anonymousAlias;
     constructor(root, opts) {
         assertAdoptionBootGate(root, "FileSessionPolicyStore");
         this.dir = join(root, "session-policy");
         ensureDir(this.dir);
         this.onCorruptRead = opts?.onCorruptRead;
+        const adoption = readRootAdoptionFile(root);
+        this.anonymousAlias =
+            adoption !== undefined && "adopted" in adoption && adoption.adopted.from.kind === "local-owner" ? adoption.adopted.toPrincipal : undefined;
     }
     disclose(info) {
         try {
@@ -23,7 +27,8 @@ export class FileSessionPolicyStore {
         this.disclose({ sessionId, ...(principal !== undefined ? { principal } : {}), path: this.pathFor(sessionId, principal), reason });
     }
     pathFor(sessionId, principal) {
-        const composite = JSON.stringify([sessionId, principal ?? null]);
+        const effective = principal ?? this.anonymousAlias;
+        const composite = JSON.stringify([sessionId, effective ?? null]);
         return join(this.dir, `${sanitizeScope(composite)}.json`);
     }
     read(sessionId, principal) {
@@ -78,7 +83,7 @@ export class FileSessionPolicyStore {
             }
         }
         const next = { ...clean, rev: (prior?.rev ?? 0) + 1 };
-        atomicWriteFile(join(this.dir, "tmp"), this.pathFor(sessionId, principal), JSON.stringify({ ...next, __sid: sessionId, __principal: principal ?? null }));
+        atomicWriteFile(join(this.dir, "tmp"), this.pathFor(sessionId, principal), JSON.stringify({ ...next, __sid: sessionId, __principal: (principal ?? this.anonymousAlias) ?? null }));
         return next;
     }
     async listBySession(sessionId) {

package/dist/stores/file/task-list-store.d.ts

@@ -1,2 +1,16 @@
 import type { TaskListStore } from "../../tools/task-list.js";
-export declare function createFileTaskListStore(root: string): TaskListStore;
+export declare function createFileTaskListStore(root: string, opts?: {
+    /**
+     * The DATA ROOT whose adoption marker gates construction (design/183 I6). Most of the file family
+     * takes the data root and derives `join(root, "<family>")` itself; this factory is one of the TWO
+     * faces that instead take a caller-chosen directory (the other being
+     * `FilePermissionRuleStoreProvider`, which takes a rule bucket) — here, the document's own
+     * directory. So when a deployment hands in a SUBDIRECTORY the I6 check would look for the marker
+     * inside that subdirectory, find nothing, and pass unconditionally: a gate that is always open
+     * (backlog #136⑦). Supply the data root here and the gate reads the anchor the root-taking faces
+     * read. Absent ⇒ the directory argument doubles as the anchor, which is exact when it IS the data
+     * root (the conventional wiring) and is the previous behavior otherwise; the adoption freeze note
+     * on `adoptLocalDataRoot` lists that default among the seams it does not cover.
+     */
+    dataRoot?: string;
+}): TaskListStore;

package/dist/stores/file/task-list-store.js

@@ -4,9 +4,9 @@ import { assertJsonMetadata, normalizeTaskShape } from "../../tools/task-list.js
 import { canonicalStoreKey, atomicWriteFile, ensureDir } from "./fs-atomic.js";
 import { assertAdoptionBootGate } from "./adoption/marker.js";
 const dirLocks = new Map();
-export function createFileTaskListStore(root) {
+export function createFileTaskListStore(root, opts) {
     const dir = resolve(root);
-    assertAdoptionBootGate(dir, "createFileTaskListStore");
+    assertAdoptionBootGate(opts?.dataRoot !== undefined ? resolve(opts.dataRoot) : dir, "createFileTaskListStore");
     const tmpDir = join(dir, "tmp");
     const path = join(dir, "task-list.json");
     ensureDir(dir);

package/dist/tools/fs/fs-bash.js

@@ -14,9 +14,12 @@ import { BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadon
 export function bashReversibilityProbe(allow, boundary) {
     const allowSet = new Set(allow ?? BASH_READONLY_DEFAULT_ALLOW);
     return (args) => {
-        const command = args?.command;
+        const a = args;
+        const command = a?.command;
         if (typeof command !== "string")
             return { reversible: false };
+        if (a?.run_in_background === true)
+            return { reversible: false };
         const resolved = typeof boundary === "function" ? boundary() : boundary;
         if (classifyCompoundReadonly(command, allowSet, resolved) === undefined)
             return { reversible: true };
@@ -555,8 +558,8 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
                 const bgCappedByMax = appliedTimeoutSec !== undefined && requestedTimeoutSec !== undefined && typeof bgCaps.maxBgTimeoutSec === "number" && requestedTimeoutSec > bgCaps.maxBgTimeoutSec;
                 const budgetNote = appliedTimeoutSec !== undefined
                     ? bgCappedByMax
-                        ? ` Time budget: requested ${requestedTimeoutSec}s, capped at ${bgCaps.maxBgTimeoutSec}s (env ceiling: requests above ${bgCaps.maxBgTimeoutSec}s are reduced to it) — auto-terminates if still running after ${appliedTimeoutSec}s.`
-                        : ` Time budget: auto-terminates if still running after ${appliedTimeoutSec}s (hard cap ${bgCaps.maxBgTimeoutSec}s).`
+                        ? ` Time budget: requested ${requestedTimeoutSec}s, capped at ${bgCaps.maxBgTimeoutSec}s (env ceiling: requests above ${bgCaps.maxBgTimeoutSec}s are reduced to it) — the process may run up to ${appliedTimeoutSec}s.`
+                        : ` Time budget: the process may run up to ${appliedTimeoutSec}s (hard cap ${bgCaps.maxBgTimeoutSec}s).`
                     : "";
                 const lifetimeNote = backgroundLifetimeNote(bgCaps, bgSessionScoped, bgEnvIsolatedOwned);
                 const registry = taskOpts.taskRegistry;
@@ -655,7 +658,7 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
                         const tail = stdoutSoFar.slice(-1_000);
                         const adoptCaps = detachEnv.backgroundCapabilities;
                         const adoptBudgetNote = typeof adoptCaps.defaultBgTimeoutSec === "number" && typeof adoptCaps.maxBgTimeoutSec === "number"
-                            ? ` Time budget: auto-terminates if still running after ${Math.min(adoptCaps.defaultBgTimeoutSec, adoptCaps.maxBgTimeoutSec)}s (hard cap ${adoptCaps.maxBgTimeoutSec}s).`
+                            ? ` Time budget: the process may run up to ${Math.min(adoptCaps.defaultBgTimeoutSec, adoptCaps.maxBgTimeoutSec)}s (hard cap ${adoptCaps.maxBgTimeoutSec}s).`
                             : "";
                         return {
                             content: (cause === "timeout"

package/dist/tools/fs/fs-shared.js

@@ -89,12 +89,19 @@ export function envErrorDetail(message) {
 }
 const announcedTimeoutConfig = new Set();
 function announceDiscardedTimeout(knob, raw, usedMs) {
-    if (!Number.isFinite(raw) || raw <= 0)
-        return;
-    const defect = bashTimeoutDefect(Math.floor(raw));
-    if (defect === undefined)
+    if (typeof raw === "string" && raw === "")
         return;
-    const line = `${knob}=${raw} was ignored — it ${defect}. Using ${usedMs}ms instead.`;
+    const n = typeof raw === "number" ? raw : Number(raw);
+    let line;
+    if (!Number.isFinite(n) || n <= 0) {
+        line = `${knob}=${String(raw)} was ignored — not a positive finite millisecond count. Using ${usedMs}ms instead.`;
+    }
+    else {
+        const defect = bashTimeoutDefect(Math.floor(n));
+        if (defect === undefined)
+            return;
+        line = `${knob}=${String(raw)} was ignored — it ${defect}. Using ${usedMs}ms instead.`;
+    }
     if (announcedTimeoutConfig.has(line))
         return;
     announcedTimeoutConfig.add(line);
@@ -126,11 +133,20 @@ export function resolveBashTimeoutCaps(opts) {
     if (opts?.bashDefaultTimeoutMs !== undefined)
         announceDiscardedTimeout("bashDefaultTimeoutMs", opts.bashDefaultTimeoutMs, defaultMs);
     else if (process.env.BASH_DEFAULT_TIMEOUT_MS !== undefined)
-        announceDiscardedTimeout("BASH_DEFAULT_TIMEOUT_MS", Number(process.env.BASH_DEFAULT_TIMEOUT_MS), defaultMs);
+        announceDiscardedTimeout("BASH_DEFAULT_TIMEOUT_MS", process.env.BASH_DEFAULT_TIMEOUT_MS, defaultMs);
     if (opts?.bashMaxTimeoutMs !== undefined)
         announceDiscardedTimeout("bashMaxTimeoutMs", opts.bashMaxTimeoutMs, maxMs);
     else if (process.env.BASH_MAX_TIMEOUT_MS !== undefined)
-        announceDiscardedTimeout("BASH_MAX_TIMEOUT_MS", Number(process.env.BASH_MAX_TIMEOUT_MS), maxMs);
+        announceDiscardedTimeout("BASH_MAX_TIMEOUT_MS", process.env.BASH_MAX_TIMEOUT_MS, maxMs);
+    const requestedCap = validTimeoutMs(opts?.bashMaxTimeoutMs) ?? validTimeoutMs(Number(process.env.BASH_MAX_TIMEOUT_MS));
+    if (requestedCap !== undefined && requestedCap < defaultMs) {
+        const knob = opts?.bashMaxTimeoutMs !== undefined ? "bashMaxTimeoutMs" : "BASH_MAX_TIMEOUT_MS";
+        const line = `${knob}=${requestedCap} is below the resolved default budget (${defaultMs}ms) — the ceiling was raised to ${maxMs}ms (the default always fits under the cap).`;
+        if (!announcedTimeoutConfig.has(line)) {
+            announcedTimeoutConfig.add(line);
+            console.warn(line);
+        }
+    }
     return { defaultMs, maxMs };
 }
 export function __resetBashTimeoutAnnouncements() {

package/dist/tools/monitor.js

@@ -121,7 +121,7 @@ export function createMonitorTool(env, opts) {
             const envWallMs = bgTimeout !== undefined ? bgTimeout * 1000 : undefined;
             const envWallWins = !isPersistent && envWallMs !== undefined && envWallMs < timeoutMs;
             const persistentBudget = bgTimeout !== undefined
-                ? `the execution environment kills background processes after ${bgTimeout}s`
+                ? `the execution environment's background time budget ends the watch after ${bgTimeout}s`
                 : `the execution environment's background time budget still applies`;
             const retainedByEnv = env.backgroundCapabilities.retainBackgroundProcesses === true;
             const retainedBySpec = opts.retainBackgroundProcesses === true;
@@ -142,8 +142,8 @@ export function createMonitorTool(env, opts) {
             const lifetime = isPersistent
                 ? `It is persistent: no watch timeout of its own${timeoutIgnoredNote}, but ${persistentBudget}${persistentAnchor}`
                 : envWallWins
-                    ? `It will be killed after ${envWallMs}ms if still running — the execution environment's background time budget (${bgTimeout}s) is shorter than the ${timeoutMs}ms watch timeout${clampNote}, and the shorter of the two wins.`
-                    : `It will be killed after ${timeoutMs}ms${clampNote} if still running.`;
+                    ? `The watch may run up to ${envWallMs}ms — the execution environment's background time budget (${bgTimeout}s) is shorter than the ${timeoutMs}ms watch timeout${clampNote}, and the shorter of the two wins.`
+                    : `The watch may run up to ${timeoutMs}ms${clampNote}.`;
             const content = onNotify !== undefined
                 ? `Monitoring in background; task_id=${taskId}. Each stdout line becomes a notification event (lines within ` +
                     `~200ms are batched); you'll get a final notification with the exit code when it ends — do not poll. ` +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.23.0",
+  "version": "5.25.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",