@sema-agent/core 5.28.0 → 5.30.0

package/dist/core/tool-result-store.d.ts

@@ -283,7 +283,7 @@ export declare function buildToolResultRef(sessionId: string, toolCallId: string
  */
 export declare const MAX_MINTED_TOOL_RESULT_REF_CHARS: number;
 /**
- * Backlog #119 (adversarial review, round 2) — the CONTENT coordinate of an offload ref.
+ * Backlog #119 (falsification review, round 2) — the CONTENT coordinate of an offload ref.
  *
  * A tool-call id carries no cross-turn uniqueness contract: a BYOM brain legitimately mints recurring
  * ids like `call-1`, and the Runner shares one store across a session's tasks on purpose. Keyed on
@@ -397,7 +397,7 @@ export declare const OFFLOAD_TOOL_NAME = "ReadToolResult";
  *   - **revival**: the put and a session purge can race. When the put loses, the marker write lands
  *     AFTER the purge — re-inserting a row into a session the deployment just deleted, alive until the
  *     backend's own TTL. A failure arm must not be able to out-write a deletion;
- *   - **retry poisoning**: the per-request re-clear legitimately re-invokes this persist with the same
+ *   - **retry contamination**: the per-request re-clear legitimately re-invokes this persist with the same
  *     (toolCallId, fullText) — the write-once retry path. With a marker occupying the ref, that
  *     retry's put of the REAL bytes hit the write-once no-op (same owner ⇒ keep what is there), so a
  *     transient first failure served the marker forever even though the full text was still in hand.

package/dist/core/tool-result-store.js

@@ -366,7 +366,9 @@ async function offloadOversizedDetailStrings(details, store, thresholdChars, ses
     const value = walk(details, []);
     const settled = await Promise.allSettled(pending.map((p) => p.done));
     const notices = new Map();
-    pending.forEach((p, i) => void notices.set(p.marker, p.render(settled[i].status === "fulfilled")));
+    pending.forEach((p, i) => {
+        notices.set(p.marker, p.render(settled[i].status === "fulfilled"));
+    });
     const seen = new Set();
     const finalize = (node) => {
         if (typeof node !== "object" || node === null)

package/dist/core/trace.d.ts

@@ -283,7 +283,7 @@ export type TraceEvent = {
      *  which anchors on the FIRST DELTA and reads 0 for a zero-delta call). Distinguishes an
      *  in-flight call cut before its first delta (present, latencyMs 0, stopReason "aborted")
      *  from a call that was never issued (absent). Compaction-summarizer rows never carry it (they
-     *  bypass the loop's per-call closures). */
+     *  circumvent the loop's per-call closures). */
     callStartedAt?: number;
     /** ABSENT when THIS call's serving model was unpriced (RB-368 — no fabricated 0). */
     costMicroUsd?: number;

package/dist/core/types.d.ts

@@ -599,7 +599,7 @@ export interface ToolExecuteContext {
      * ruled 2026-08-04 — the RUNNING task's EFFECTIVE synchronous approver (`spec.onAsk ?? deps.onAsk`,
      * the exact value this task's own gate resolves an `ask` at), Runner-filled read-only on the same
      * trusted seat as {@link principal}: never a model/tool argument, so a worker can neither substitute
-     * nor suppress it. Absent when the run has no approver at all (headless) — the seat is never forged.
+     * nor suppress it. Absent when the run has no approver at all (headless) — the seat is never caller-declared.
      *
      * A delegation tool (`createSubagentTool`) forwards it into every child it spawns (sync / background /
      * fork), wrapped so the approver learns which delegation raised the ask ({@link
@@ -619,7 +619,7 @@ export interface ToolExecuteContext {
      * The RUNNING task's EFFECTIVE content-ask seam (`spec.onQuestion ?? deps.onQuestion` — the exact
      * value this task's own `AskUserQuestion` resolves at), Runner-filled read-only on the same trusted
      * seat as {@link onAsk}: never a model/tool argument, so a worker can neither substitute nor suppress
-     * it. Absent when the run has no live question face at all — the seat is never forged.
+     * it. Absent when the run has no live question face at all — the seat is never caller-declared.
      *
      * A delegation tool (`createSubagentTool`) forwards it into every child it spawns (sync / background /
      * fork), because the tool's own MOUNT predicate is keyed on it: without the seat, a deployment that
@@ -650,6 +650,21 @@ export interface ToolExecuteContext {
      * read-only boundary ended at one level. Strictly a capability REMOVAL — it can never widen a child.
      */
     handsReadOnly?: true;
+    /**
+     * design/199 — the READ-face clamp carrier ({@link TaskSpec.readFace}): present (as "roots") ONLY
+     * when this run RESOLVED to the roots face, so a delegation tool pins every child spec to roots —
+     * without it a roots-narrowed parent's children would resolve the shared deployment seat (possibly
+     * "open") and read wider than the parent could. Strictly a tightening carrier: an open parent adds
+     * no key, and nothing in the delegation lane can spell "open". F10 ruling (v1): this seat exists
+     * ONLY as the delegation carrier — no tool adapts its model-facing behavior on it.
+     */
+    readFace?: "roots";
+    /**
+     * design/199 件B — the parent task's OWN deny-set additions ({@link TaskSpec.readDenyPatterns}),
+     * traveling the delegation tree add-only (a child judges at least every entry its parent judged).
+     * Runner-filled trusted seat, never a model argument.
+     */
+    readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
     /**
      * The HARD-HEADLESS clamp ({@link TaskSpec.interactiveTools} set to `false` — "never mount a
      * human-facing tool on this run, whatever faces exist"), Runner-filled read-only on the same trusted
@@ -775,7 +790,7 @@ export interface ToolExecuteContext {
      * CC's classifier covers two more scenes beyond a single tool-call ask that sema had NOT ported: a
      * delegation tool reviews the CHILD's prompt+toolset BEFORE spawning it (CC `Ipd` — a main agent
      * blocked from a dangerous action directly could otherwise write it into a sub-agent's prompt and
-     * have the child execute it, a delegation-based classifier bypass), and reviews the child's COMPLETED
+     * have the child execute it, a delegation-based classifier circumvention), and reviews the child's COMPLETED
      * work when it hands control back (CC `ein` — flags the main agent with a security warning before it
      * acts on unreviewed sub-agent output). `createSubagentTool`/the workflow spawn legs read this at
      * BOTH points and thread it into the child (never a model/tool argument), same posture as
@@ -860,7 +875,7 @@ export interface ToolExecuteContext {
      * transcript classes too (text_delta/reasoning_delta/tool_start/tool_end); other event types never cross it.
      * The delegation lane's OWN tap is trusted and forwards the child's FULL event stream (bg frames tagged
      * with bgAgentId). ⚠️ Forwarded ticks are UNTRUSTED display hints — any
-     * tool holding this ctx could forge one, so a consumer validates `parentTaskId` against its known runs.
+     * tool holding this ctx could self-declare one, so a consumer validates `parentTaskId` against its known runs.
      */
     forwardEvent?: (event: TaskEvent) => void;
     /**
@@ -882,7 +897,7 @@ export interface ToolExecuteContext {
     /**
      * design/135 §0 — the TRUSTED per-call worktree-isolation lane for the Agent tool (CC
      * `isolation: "worktree"`). The Runner fills it (prepare-task builds it over the run's ExecutionEnv +
-     * task root via `createSubagentWorktreeHelper`) for write-capable runs; a tool cannot forge it and the
+     * task root via `createSubagentWorktreeHelper`) for write-capable runs; a tool cannot self-declare it and the
      * model only REQUESTS isolation via the Agent tool's `isolation` parameter — the capability itself is
      * never a model argument. Absent ⇒ the deployment cannot mint worktrees (read-only run / outside a
      * Runner) and the Agent tool reports isolation as honestly unavailable.
@@ -1137,7 +1152,7 @@ export interface McpServerSpec {
      * design/99 §E23 — opt in to INBOUND elicitation for THIS server: when `true` AND a {@link RunnerDeps.onElicit}
      * seam is wired, core advertises the `elicitation` capability to this server and registers a handler, so the
      * server may send an `elicitation/create` request to ask the END USER for input mid-tool-call. **Default OFF
-     * (fail-closed)**: never advertise unless explicitly wired, so a hostile/over-eager server cannot pull a human
+     * (fail-closed)**: never advertise unless explicitly wired, so a untrusted/over-eager server cannot pull a human
      * into the loop. v1 is LIVE-ONLY — `onElicit` answers synchronously on the open connection (no durable
      * suspend; a durable/cross-replica elicitation needs the deferred E22 longer-lived connection).
      */
@@ -1247,7 +1262,7 @@ export interface McpElicitResponse {
  * 🔴 THROTTLING IS THE DEPLOYMENT'S JOB: once a server is opted in, it may issue elicitations at any frequency
  * (one per tool call, or many) — core imposes NO rate/count limit (an elicitation is not a tool call and does
  * not ride the policy gate). `onElicit` is the choke point: throttle, aggregate, or `decline`/`cancel` an
- * over-eager or hostile server here (the request's `AbortSignal` is forwarded so a deadline can cancel it).
+ * over-eager or untrusted server here (the request's `AbortSignal` is forwarded so a deadline can cancel it).
  */
 export type OnElicit = (req: McpElicitRequest, signal?: AbortSignal) => Promise<McpElicitResponse>;
 /**
@@ -1447,7 +1462,7 @@ export interface TaskSpec {
      * 🔴 **Trust contract (design/53 — authority stays in the control plane):** this is a control-plane value,
      * **NOT model/worker input.** Set it only from the authenticated task-submission context; it is not exposed
      * as a tool argument and the model cannot read or change it (a worker filling its own principal = a privilege
-     * bypass). Treat it as write-once for the run. The MCP server MUST trust this header only on the Runner's
+     * circumvention). Treat it as write-once for the run. The MCP server MUST trust this header only on the Runner's
      * authenticated/TLS channel and default to deny/public when it is absent — never default-admin.
      *
      * 🔴🔴 **This is the GOVERNANCE key.** Per-principal entitlements are resolved off this value:
@@ -1455,7 +1470,7 @@ export interface TaskSpec {
      * self-orchestration / `RunWorkflow` is permitted). So a caller MUST set `spec.principal` to a
      * **cryptographically VERIFIED** identity — **never a raw, spoofable request header**. A deployment that holds
      * both an unverified header value AND a verified one (e.g. a "direct-door" path) MUST pass the VERIFIED one
-     * here: keying a gate on a spoofable principal is a multi-tenant governance BYPASS (a forged header would
+     * here: keying a gate on a spoofable principal is a multi-tenant governance BYPASS (a caller-declared header would
      * inherit another tenant's entitlements). Core cannot verify identity itself (no crypto context) — it trusts
      * this value by contract; getting it wrong is a privilege-escalation hole, not a core bug.
      */
@@ -2052,7 +2067,7 @@ export interface TaskSpec {
     /**
      * Restrict the injected "hand" band (design/44) to its effect:read tools for this task — read_file /
      * grep / glob (+ `bash_readonly` when a shell is available); edit_file / write_file / `bash` are not
-     * mounted. This is the verifier read-only boundary (§6): an adversarial verifier inspects but must not
+     * mounted. This is the verifier read-only boundary (§6): an falsification-style verifier inspects but must not
      * modify the project. No effect unless an `executionEnv` is injected. Default false.
      */
     handsReadOnly?: boolean;
@@ -2109,6 +2124,27 @@ export interface TaskSpec {
      * config read.
      */
     additionalReadDirectories?: string[];
+    /**
+     * design/199 件B — TASK-layer ADDITIONS to the built-in sensitive-path READ deny set
+     * ({@link import("../tools/fs/read-deny.js").READ_FACE_DEFAULT_DENY_ENTRIES}). Judged by the
+     * structured read faces (Read/Grep/Glob/RepoMap, their traversals, the classify shell gate's
+     * auto-allow probe and the compaction attachment reader) in BOTH containment modes. Add-only
+     * everywhere (D-4 zero-shrink ruling): entries here UNION with the built-ins and the deployment's
+     * {@link RunnerDeps.readDenyPatterns}; `[]` ≡ absent (union identity); nothing can remove a
+     * built-in. Bad entry shapes refuse loudly at prepare (#123). The write faces are untouched.
+     */
+    readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
+    /**
+     * design/199 件A — the TASK layer's read-face containment declaration
+     * ({@link import("../tools/fs/read-face.js").ReadFace}). "roots" pins this task (and, via the
+     * tighten-only clamp, its whole delegation subtree) to the historical containment; "open" lifts
+     * the roots judgment for the structured read faces — refused loudly under org governance (the
+     * task layer only tightens there; the deployment opens via {@link RunnerDeps.readFace}) and
+     * beside `handsReadOnly: true` (the verifier containment is load-bearing). Absent ⇒ the
+     * deployment seat, then the engine default ("roots" — D-1b: an upgrade never opens implicitly).
+     * Bad values refuse loudly (#123). Never affects the write faces.
+     */
+    readFace?: import("../tools/fs/read-face.js").ReadFace;
     /**
      * design/80 D-B — opt in to PLAN MODE: mount the first-party `present_plan` tool (CC `ExitPlanMode` parity).
      * The model calls it to present a plan; the engine then pauses with a durable `plan_review` checkpoint
@@ -3278,7 +3314,7 @@ export type TaskEvent = ({
      * `errorKind` leg is what makes a LOOP-THROWN error's frame classifiable: the loop's thrown-error
      * fold and the resume legs write the discriminator under that name. Lifted so a consumer never
      * has to parse the (contract-stable) result text. Engine-minted vocabulary today includes
-     * `"tool.not_found"` (unknown tool name) and `"gate.parked"` (an abort short-circuit poisoned
+     * `"tool.not_found"` (unknown tool name) and `"gate.parked"` (an abort short-circuit contaminated
      * this call because a durable gate parked the batch — the "Operation aborted" family). Additive:
      * absent on error frames minted before this field existed, and on error results whose details
      * carry no string discriminator under either name.
@@ -3938,7 +3974,7 @@ export interface RuntimeCaps {
     allowWorkflows?: boolean;
     /** `false` DENIES fork (`Agent(subagent_type:"fork")` — design/136: the only fork face since the standalone
      *  tool was retired; the deny is the honest `fork.disabled` result, and since 1.256 it binds the Agent-fork
-     *  route too, closing the 1.254 governance bypass) for this principal server-side — even on a fork-capable
+     *  route too, closing the 1.254 governance circumvention) for this principal server-side — even on a fork-capable
      *  (durable-store) deployment. Fork is a compute-amplification primitive (a principal spawns
      *  context-inheriting children, each spending on its own quota), so a multi-tenant operator gates it
      *  per-principal the SAME way as {@link allowWorkflows}. `undefined`/`true` = no per-principal restriction
@@ -4261,10 +4297,29 @@ export interface RunnerDeps {
      * `createHandsToolkit` 整厂(部署自装配塞 `spec.tools` 会被 Runner 的自动装配同名覆盖=反模式;
      * CC 亦无 options-bag 开放面,走单例+hook)。只开放安全子集,Runner 装配时合成:
      * - `beforeWrite` 与引擎的 MemoryEngine 写扫描门 **COMPOSE 而非替换**(部署 hook 先判,拒即拒;
-     *   放行后引擎门仍全量生效——写保护不可能被部署配置绕过)。
+     *   放行后引擎门仍全量生效——写保护不可能被部署配置规避)。
      * Runner 私有编排字段(taskRegistry/detachHub/execClamp/cwdRef/…)不在此面,永不开放。
      */
     hands?: HandsBandOptions;
+    /**
+     * design/199 件B — DEPLOYMENT-layer ADDITIONS to the built-in sensitive-path READ deny set
+     * ({@link import("../tools/fs/read-deny.js").READ_FACE_DEFAULT_DENY_ENTRIES}); see
+     * {@link TaskSpec.readDenyPatterns} for the judged surfaces. Add-only (D-4 zero-shrink ruling):
+     * unions with the built-ins and any task-layer additions; there is no whole-table replacement
+     * escape hatch, and `[]` ≡ absent. Bad entry shapes refuse loudly at prepare (#123).
+     */
+    readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
+    /**
+     * design/199 件A — the DEPLOYMENT's read-face declaration
+     * ({@link import("../tools/fs/read-face.js").ReadFace}; see {@link TaskSpec.readFace} for the
+     * task layer and the resolution order). An interactive single-user product declares
+     * `readFace: "open"` here in one line; the engine default stays "roots" (D-1b). Under org
+     * governance this seat may still open (it is the deployment's own declaration); the task layer
+     * may not. Beside a read-only (verifier) mount this seat's "open" silently CLAMPS to roots (a
+     * deployment default cannot override a load-bearing containment wall) — TaskSpec.readFace's own
+     * "open" there is the genuine per-task contradiction, and that one still refuses loudly (#123).
+     */
+    readFace?: import("../tools/fs/read-face.js").ReadFace;
     /**
      * design/96 §20 (P1a) — DEPLOYMENT-DECLARED training knowledge cutoff per model id (e.g.
      * `{ "qwen-3.5-35b": "2025-01", "deepseek-pro": "2024-07" }`). When the resolved model id is present, the

package/dist/core/untrusted-text.d.ts

@@ -179,6 +179,12 @@ export declare function defuseControlChars(text: string): string;
  * Defense-in-depth, NOT a guarantee (same posture as the rest of this module).
  */
 export declare function inlineUntrusted(text: string, maxLen?: number): string;
+/** The one body bound every "reviewer note" relay passes to {@link delimitUntrusted} — the decider's
+ *  free text attached to a deny (sync `AskOutcome.reason` and the durable `ResumeOutcome` `reason`
+ *  legs alike). A note is steering, not payload: unbounded it can flood the transcript/context the
+ *  refusal lands in. 2048 code points matches the note cap the interactive card layer already
+ *  enforces on its own input, so a note that fit the card arrives whole. */
+export declare const REVIEWER_NOTE_MAX_BODY = 2048;
 /**
  * Wrap untrusted text in a clearly labeled opaque fence. The consuming prompt should instruct the model to
  * treat everything inside as untrusted data — never as instructions. Sanitizes internally (system-reminder

package/dist/core/untrusted-text.js

@@ -111,6 +111,7 @@ export function inlineUntrusted(text, maxLen = LABEL_MAX) {
 function sanitizeLabel(label) {
     return inlineUntrusted(label, LABEL_MAX);
 }
+export const REVIEWER_NOTE_MAX_BODY = 2048;
 export function delimitUntrusted(label, text, maxBody) {
     const tag = sanitizeLabel(label);
     let body = defuseFenceMarkers(sanitizeUntrustedText(text));

package/dist/engine/compaction/compaction.d.ts

@@ -201,7 +201,7 @@ export interface CompactionForkContext {
 }
 /** Extract the fork-form summary from its envelope; `undefined` = non-conforming response.
  *
- *  Grammar (adversarial round 3, both arms pinned): after stripping the permitted `<analysis>`
+ *  Grammar (falsification-style round 3, both arms pinned): after stripping the permitted `<analysis>`
  *  scratch blocks, the ENTIRE remaining response must be one envelope — text outside it is a
  *  rejection, not noise ("<summary>placeholder</summary> I refuse" must not pass as "placeholder").
  *  The inner match is GREEDY with the closing tag anchored at the END, because the summary quotes

package/dist/engine/harness/messages.d.ts

@@ -18,7 +18,7 @@ export declare function createCustomMessage(customType: string, content: string
  *  product, not authored content. */
 export declare const NORMALIZED_CONTENT_PREFIX = "[invalid content block normalized to text]";
 /**
- * Fail-soft salvage for a possibly-poisoned LLM message ([868] 件b): any structurally-invalid
+ * Fail-soft salvage for a possibly-contaminated LLM message ([868] 件b): any structurally-invalid
  * `content` shape (bare object as the whole field, or a typeless/unknown-type block in the array) is
  * normalized to a prefixed text block. Legal messages are returned BY REFERENCE, untouched. Shared by
  * `convertToLlm` (provider leg) and `serializeConversation` (compaction leg) — one helper, two mouths.

package/dist/engine/harness/types.d.ts

@@ -106,7 +106,7 @@ export declare class FileError extends Error {
 export type ExecutionErrorCode = "aborted" | "timeout"
 /** The shell binary/config could not be resolved BEFORE spawning — the command never started. */
  | "shell_unavailable"
-/** CONTRACT (2026-07-13, TB cwd-poison batch): spawn_error MUST mean the command NEVER STARTED (the
+/** CONTRACT (2026-07-13, TB cwd-contamination batch): spawn_error MUST mean the command NEVER STARTED (the
  *  OS-level spawn itself failed: dead cwd, missing binary, EMFILE/ENOMEM…). The Bash tool reroutes
  *  spawn_error + shell_unavailable to a STRUCTURAL error (throw → isError:true) and runs a dead-cwd
  *  diagnosis on them; an env that maps "command ran and failed" onto spawn_error breaks that
@@ -349,6 +349,16 @@ export interface ExecutionEnv extends FileSystem, Shell {
      * mechanism exists to prevent.
      */
     readonly lifetimeStartedAt?: number;
+    /**
+     * #211 (design/199 seam) — does this environment's path NAMESPACE live on the CONTROL-PLANE HOST's
+     * filesystem? Declared by the ADAPTER: `false` for a virtual/sandboxed env whose paths never map
+     * onto the host (an in-memory env, a container the host cannot mount) — consumers that record
+     * host-path receipts (the workflow workspace observer's `worktreeDir`) then refuse to present this
+     * env's cwd as a host path. Omitted ⇒ the historical structural inference stays in force
+     * (isRemoteExecutionEnv shape detection; a plain NodeExecutionEnv is host-local). `true` is a
+     * harmless explicit spelling of the local default.
+     */
+    readonly hostLocalPaths?: boolean;
 }
 /** Base fields shared by append-only session tree entries. */
 export interface SessionTreeEntryBase {
@@ -525,7 +535,7 @@ export declare function isValidModelChange(e: {
 }): boolean;
 /** RB-128: a `label` / `session_info.name` that is not a string reaches `.trim()` inside
  *  `BaseSessionStorage`'s CONSTRUCTOR — and the file backend validates BEFORE constructing any storage, so
- *  the poison lands on disk and every later `open()` throws a raw `TypeError` (not even a `SessionError`).
+ *  the contamination lands on disk and every later `open()` throws a raw `TypeError` (not even a `SessionError`).
  *  Unrecoverable through the API, which is why this belongs at the import door. */
 export declare function isOptionalDisplayString(v: unknown, max?: number): boolean;
 export declare function normalizeAnnouncedListing(v: unknown): {

package/dist/engine/llm/types.d.ts

@@ -36,7 +36,7 @@ export interface ResilienceOptions {
     allowFailover?: boolean;
     /** true = this task ignores an OPEN circuit breaker's fast-fail (the probe goes through; outcomes
      *  are STILL recorded so shared observation is undiminished). Operator-facing — an open breaker
-     *  exists to protect the provider; bypass only where true failure shape matters (benchmarks). */
+     *  exists to protect the provider; circumvention only where true failure shape matters (benchmarks). */
     bypassBreaker?: boolean;
 }
 /** 1.296 件A — per-call advisory stall-watchdog values (see {@link StreamOptions.stallTimeouts}). */

package/dist/engine/loop/types.d.ts

@@ -42,7 +42,7 @@ export type AgentToolCall = Extract<AssistantMessage["content"][number], {
  *
  * Returning `{ updatedInput }` (without `block`) REWRITES the arguments the tool executes with — the
  * loop replaces the validated args with `updatedInput` and **re-runs `validateToolArguments` on it**
- * before execution, so a rewrite can never smuggle schema-invalid args into `tool.execute()`. This is
+ * before execution, so a rewrite can never carry across schema-invalid args into `tool.execute()`. This is
  * the generic carrier the higher layer uses for arg redaction/clamping (design/37); the loop itself
  * stays policy-agnostic. `block` wins over `updatedInput` if both are set.
  *
@@ -377,7 +377,7 @@ export interface AgentLoopConfig extends SimpleStreamOptions {
      * family). When supplied, a non-undefined return value is attached as the minted result's
      * `details` — a host that KNOWS why the signal fired (e.g. a durable approval gate parked the
      * batch) stamps a structured marker such as `{ code: "gate.parked" }`, so a consumer can
-     * distinguish a park poison frame from a plain cancel WITHOUT parsing the result text. The
+     * distinguish a park contamination frame from a plain cancel WITHOUT parsing the result text. The
      * abort texts themselves are a consumer contract and never change here. Evaluated at mint time
      * (after the abort fired), so the host reads its own post-abort state, not a snapshot.
      */

package/dist/engine/session/import-validate.d.ts

@@ -7,7 +7,7 @@ export interface ImportValidatorOptions {
      * re-assert who spoke in a history it did not witness (`hostAsserted:true` is an ingress-derived
      * claim, and import is not an ingress). `true` = the operator DECLARES the source trusted
      * (e.g. a same-deployment backend migration) and well-formed assertions are preserved verbatim;
-     * shape-poisoned ones are still stripped like the sibling metadata fields.
+     * shape-contaminated ones are still stripped like the sibling metadata fields.
      */
     preserveActorAssertions?: boolean;
 }

package/dist/engine/session/log-digest.d.ts

@@ -43,7 +43,7 @@ import type { SessionTreeEntry } from "../harness/types.js";
  * path, exactly like a value mismatch.
  *
  * ## What is hashed, and why not the engine's canonical serializer
- * v1 hashed `canonicalize` (the approval-binding serializer). An adversarial review of the shipped v1 found
+ * v1 hashed `canonicalize` (the approval-binding serializer). An falsification review of the shipped v1 found
  * that choice unsound for a WIRE digest, on four counts that all trace to the same root — that serializer is
  * built for a single runtime comparing a value to ITSELF, not for two runtimes comparing what they hold:
  *

package/dist/fixtures/index.d.ts

@@ -34,11 +34,27 @@ export declare const ASK_REQUEST_HOST: AskRequest;
  *  - `fromSubagent: true` — the explicit, unforgeable discriminator (1.378);
  *  - `sourceAgentName` — display identity (UNTRUSTED-for-display; redact + bound before render);
  *    present only when the spawn named the child (an unnamed child omits it);
- *  - `sourceTaskId` — the CHILD's session id (≠ the host's).
+ *  - `sourceTaskId` — the CHILD's session id (≠ the host's);
+ *  - `isDelegatedChild: true` — the refusal-POSTURE fact (the raw trusted internals fact, set by
+ *    every core spawn leg — a FORK carries it too, its interaction contract being one-shot). NOT a
+ *    synonym for `fromSubagent` (`parentTaskId` presence): a directly-started workflow's children
+ *    carry this one WITHOUT `fromSubagent`. Downstream must not fold the two into one flag.
  */
 export declare const ASK_REQUEST_SUBAGENT: AskRequest;
-/** Both AskRequest forms, keyed for iteration in downstream key-set diff gates. */
+/**
+ * AskRequest, DIRECTLY-STARTED WORKFLOW CHILD form — the shape when a workflow with NO launching
+ * tool call (e.g. cron-triggered) spawns an agent whose gate raises the ask. THE form that keeps
+ * `isDelegatedChild` and `fromSubagent` from being conflated downstream:
+ *  - `isDelegatedChild: true` — refusals speak the child posture to it;
+ *  - `fromSubagent` ABSENT — there is no nameable `parentTaskId` and no id is ever fabricated;
+ *  - `sourceAgentName` — the workflow spawn's display label.
+ * A consumer that requires the two flags together, or classifies by `fromSubagent` alone, misreads
+ * exactly this request.
+ */
+export declare const ASK_REQUEST_WORKFLOW_CHILD: AskRequest;
+/** All AskRequest forms, keyed for iteration in downstream key-set diff gates. */
 export declare const ASK_REQUEST_FIXTURES: {
     readonly host: AskRequest;
     readonly subagent: AskRequest;
+    readonly workflowChild: AskRequest;
 };

package/dist/fixtures/index.js

@@ -14,8 +14,19 @@ export const ASK_REQUEST_SUBAGENT = {
     sourceTaskId: "<issuing-session-id>",
     fromSubagent: true,
     sourceAgentName: "<agent-name>",
+    isDelegatedChild: true,
+};
+export const ASK_REQUEST_WORKFLOW_CHILD = {
+    toolName: "target",
+    toolCallId: "<tool-call-id>",
+    args: { "<arg-key>": "<arg-value>" },
+    message: "<message>",
+    sourceTaskId: "<issuing-session-id>",
+    sourceAgentName: "<agent-name>",
+    isDelegatedChild: true,
 };
 export const ASK_REQUEST_FIXTURES = {
     host: ASK_REQUEST_HOST,
     subagent: ASK_REQUEST_SUBAGENT,
+    workflowChild: ASK_REQUEST_WORKFLOW_CHILD,
 };

package/dist/index.d.ts

@@ -87,6 +87,8 @@ export type { InvariantKind, FunctionContract, Invariant, InvariantViolation, Ch
 export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, type BashReadonlyRootBoundary, type CompoundReadonlyVerdict, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
+export { READ_FACE_DEFAULT_DENY_ENTRIES, compileReadDeny, type ReadDenyEntry, type ReadDenyMatcher, type NormalizedReadDenyEntry, } from "./tools/fs/index.js";
+export { resolveReadFace, type ReadFace, type ReadFaceInputs } from "./tools/fs/index.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, type ToolResultProvenance, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, type ToolResultStore, type ToolResultSlice, type ToolResultDeletionReport, } from "./core/tool-result-store.js";
 export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, type UsageWindow, type UsageWindowStore, type UsageWindowReading, type UsageWindowRecord, type UsageSlot, type UsageBucketRow, } from "./core/usage-window-store.js";
@@ -168,7 +170,7 @@ export { encodeSurfacedKey, buildManifestText, validateSelectedIds, composeSelec
 export { runMemoryConsolidation, CONSOLIDATION_SYSTEM_PROMPT, DEFAULT_CONSOLIDATION_BAND, DEFAULT_CONSOLIDATION_SEARCH_LIMIT, DEFAULT_CONSOLIDATION_MAX_NOTES, DEFAULT_CONSOLIDATION_TIMEOUT_SEC, normalizeForExactMatch, type ConsolidationParams, type ConsolidationStats, type ConsolidationNote, type ConsolidationLLM, } from "./core/runner/memory-consolidation.js";
 export { consolidateScope, advanceCursorAfterInline, type ConsolidateScopeDeps, type ConsolidateScopeOptions, } from "./core/consolidate-scope.js";
 export { DEFAULT_COMPACTION_INSTRUCTIONS } from "./core/auto-compaction.js";
-export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, type EnvironmentFacts, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, type PromptBlock, analyzePromptCacheFriendliness, assertPromptCacheFriendly, type PromptProvider, type StablePromptContext, type PromptCacheReport, type PromptTextDeclaration, } from "./prompts/default.js";
+export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, type EnvironmentFacts, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, type PromptBlock, analyzePromptCacheFriendliness, assertPromptCacheFriendly, type PromptProvider, type StablePromptContext, type PromptCacheReport, type PromptTextDeclaration, } from "./prompts/default.js";
 export { SUPERVISOR_PROMPT, ORCHESTRATION_GUIDANCE, ORCHESTRATION_AWARENESS, GOAL_COMPLETION_GUIDANCE } from "./prompts/supervisor.js";
 export { compose, validatePack } from "./prompt-assembly/composer.js";
 export { SEMA_DEFAULT_PACK } from "./prompt-assembly/packs/sema-default.js";

package/dist/index.js

@@ -68,6 +68,8 @@ export { deriveInvariants, checkInvariants } from "./core/property-harness.js";
 export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
+export { READ_FACE_DEFAULT_DENY_ENTRIES, compileReadDeny, } from "./tools/fs/index.js";
+export { resolveReadFace } from "./tools/fs/index.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, } from "./core/tool-result-store.js";
 export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, } from "./core/usage-window-store.js";
@@ -131,7 +133,7 @@ export { encodeSurfacedKey, buildManifestText, validateSelectedIds, composeSelec
 export { runMemoryConsolidation, CONSOLIDATION_SYSTEM_PROMPT, DEFAULT_CONSOLIDATION_BAND, DEFAULT_CONSOLIDATION_SEARCH_LIMIT, DEFAULT_CONSOLIDATION_MAX_NOTES, DEFAULT_CONSOLIDATION_TIMEOUT_SEC, normalizeForExactMatch, } from "./core/runner/memory-consolidation.js";
 export { consolidateScope, advanceCursorAfterInline, } from "./core/consolidate-scope.js";
 export { DEFAULT_COMPACTION_INSTRUCTIONS } from "./core/auto-compaction.js";
-export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, analyzePromptCacheFriendliness, assertPromptCacheFriendly, } from "./prompts/default.js";
+export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, analyzePromptCacheFriendliness, assertPromptCacheFriendly, } from "./prompts/default.js";
 export { SUPERVISOR_PROMPT, ORCHESTRATION_GUIDANCE, ORCHESTRATION_AWARENESS, GOAL_COMPLETION_GUIDANCE } from "./prompts/supervisor.js";
 export { compose, validatePack } from "./prompt-assembly/composer.js";
 export { SEMA_DEFAULT_PACK } from "./prompt-assembly/packs/sema-default.js";

package/dist/orchestration/goal.d.ts

@@ -1,7 +1,7 @@
 /**
  * design/96 §C (S2) — **Goal 模式**:LLM 自报完成 + core 校验续跑(CC goal 对标:目标 + 完成判定 + 续跑)。
  * `runGoal` 是 `runRepairLoop`/`verifyCompleted` 的 SIBLING —— thin composition over `runner.runTask`,零
- * Runner core 改动。详 `design/96-references/GOAL-IMPLEMENTER-SPEC.md`(v3,codex r1+r2 异源对抗收敛)。
+ * Runner core 改动。详 `design/96-references/GOAL-IMPLEMENTER-SPEC.md`(v3,codex r1+r2 异源证伪式对照收敛)。
  *
  * 🔴 **完成判定双闸(reward-hack 红线)**:① LLM 自报完成 = 调内置 `declare_done` 工具(或 `submit_output`,有
  * outputSchema 时)= **机器信号**,非泛化 `completed`;② core `doneCheck`(机械/oracle 校验)。**AND**:仅二者

package/dist/orchestration/run-workflow-tool.d.ts

@@ -219,6 +219,12 @@ export interface RunWorkflowToolDeps {
     /** Call-time getter for the HOST task's current thinking level — a spawned agent with no explicit
      *  script/baseline `thinking` inherits it (the parentCwd/model-snapshot companion). */
     parentThinking?: () => import("../core/types.js").TaskSpec["thinking"];
+    /** 5.30 merge-rescan (design/199 parity gap) — call-time getter for the HOST task's RESOLVED
+     *  read-face containment; folds stricter-wins into every spawned workflow child (see
+     *  `buildWorkflowPrimitives`'s injection block for the full rationale). */
+    parentReadFace?: () => import("../core/types.js").TaskSpec["readFace"];
+    /** Twin of the above for the deny-set additions (union, not replace). */
+    parentReadDenyPatterns?: () => import("../core/types.js").TaskSpec["readDenyPatterns"];
     /** [1238](A) — call-time getter for the HOST task's RESOLVED Model object: a spawned agent whose
      *  fold chain produced no model inherits the parent's full object (baseUrl/key routing included),
      *  mirroring the subagent lane's ctx.model semantics. */
@@ -254,6 +260,21 @@ export interface RunWorkflowToolDeps {
     autoModeReview?: () => {
         decider: import("../core/auto-mode.js").AutoModeDecider;
     } | undefined;
+    /** 5.30 merge-rescan round 2 — the HOST task's durable OFF SWITCH (`spec.checkpointStore === null`,
+     *  ruled 2026-08-04 to inherit into every spawned agent, see `buildWorkflowPrimitives`'s call
+     *  above). Known at prepare-time (no lazy getter needed — `spec` is available at mount). A dep for
+     *  the same reason as `forwardEvent`/`inheritedGateForChildren`: the auto-mounted tool's execute
+     *  ctx is minimal `{toolCallId, signal}`, so `ctx.checkpointStoreDisabledForChildren` was a DEAD
+     *  read there — the off-switch never actually reached this lane's children. */
+    parentCheckpointStoreDisabled?: boolean;
+    /** Twin of the above for design/148 S1's center-artifact inheritance (see the `ctx.centerArtifactDigest`/
+     *  `ctx.centerSourceRevision` reads at the `startWorkflow` options site) — `centerAdoption` resolves
+     *  LATE in prepare-task.ts (well after this tool's mount point), so this is a call-time getter, not
+     *  a value, mirroring `parentReadFace`. `ctx.centerArtifactDigest` still wins when a wrapping path
+     *  provides it. */
+    parentCenterArtifactDigest?: () => string | undefined;
+    /** Publish-provenance companion of the above. */
+    parentCenterSourceRevision?: () => string | undefined;
 }
 /**
  * Build the `run_workflow` tool. ASSERTS the runner is a hard sandbox (defense in depth — prepare-task only

package/dist/orchestration/run-workflow-tool.js

@@ -380,7 +380,7 @@ export async function createRunWorkflowTool(d) {
                 return structuredError(`workflow script failed to compile: ${err instanceof Error ? err.message : String(err)}`);
             }
             const scriptFn = (wfCtx) => {
-                const primitives = buildWorkflowPrimitives(wfCtx, governance, d.onAgentSpawn, d.parentThinking, principal, ctx.checkpointStoreDisabledForChildren === true);
+                const primitives = buildWorkflowPrimitives(wfCtx, governance, d.onAgentSpawn, d.parentThinking, principal, ctx.checkpointStoreDisabledForChildren === true || d.parentCheckpointStoreDisabled === true, d.parentReadFace, d.parentReadDenyPatterns);
                 return d.scriptRunner.run({ scriptSource: script, primitives, scriptArgs: effectiveArgs, signal: wfCtx.signal }).then((r) => r.result);
             };
             if (ctx.signal?.aborted) {
@@ -389,6 +389,9 @@ export async function createRunWorkflowTool(d) {
             let handle;
             const workflowTaskId = d.taskRegistry?.mintTaskId("workflow");
             const autoModeReview = ctx.autoModeReview ?? d.autoModeReview?.();
+            const centerFromCtx = ctx.centerArtifactDigest !== undefined;
+            const parentCenterArtifactDigest = centerFromCtx ? ctx.centerArtifactDigest : d.parentCenterArtifactDigest?.();
+            const parentCenterSourceRevision = centerFromCtx ? ctx.centerSourceRevision : d.parentCenterSourceRevision?.();
             try {
                 handle = startWorkflow(d.runner, scriptFn, {
                     store: d.store,
@@ -417,8 +420,8 @@ export async function createRunWorkflowTool(d) {
                     ...((ctx.interactionPosture ?? d.parentInteractionPosture) !== undefined ? { interactionPosture: (ctx.interactionPosture ?? d.parentInteractionPosture) } : {}),
                     ...(d.parentModel !== undefined ? { defaultModel: d.parentModel } : {}),
                     ...(d.parentGetApiKeyAndHeaders !== undefined ? { defaultGetApiKeyAndHeaders: d.parentGetApiKeyAndHeaders } : {}),
-                    ...(ctx.centerArtifactDigest !== undefined ? { parentCenterArtifactDigest: ctx.centerArtifactDigest } : {}),
-                    ...(ctx.centerSourceRevision !== undefined ? { parentCenterSourceRevision: ctx.centerSourceRevision } : {}),
+                    ...(parentCenterArtifactDigest !== undefined ? { parentCenterArtifactDigest } : {}),
+                    ...(parentCenterSourceRevision !== undefined ? { parentCenterSourceRevision } : {}),
                     ...((ctx.forwardEvent ?? d.forwardEvent) !== undefined ? { onForwardEvent: (ctx.forwardEvent ?? d.forwardEvent) } : {}),
                     ...((ctx.inheritedGateForChildren ?? d.inheritedGateForChildren) !== undefined
                         ? { inheritedGate: (ctx.inheritedGateForChildren ?? d.inheritedGateForChildren)() }

package/dist/orchestration/workflow-primitives.d.ts

@@ -30,4 +30,13 @@ export interface WorkflowGovernance {
 export declare function buildWorkflowPrimitives(ctx: WorkflowRunContext, governance?: WorkflowGovernance, onAgentSpawn?: (handle: WorkflowAgentHandle) => void, parentThinking?: () => TaskSpec["thinking"], parentPrincipal?: string, 
 /** ruled 2026-08-04 — the host run set `TaskSpec.checkpointStore: null` (the per-run durable off
  *  switch). Every agent this workflow spawns inherits it; see the injection below. */
-parentCheckpointStoreDisabled?: boolean): WorkflowPrimitives;
+parentCheckpointStoreDisabled?: boolean, 
+/** 5.30 merge-rescan (design/199 parity gap) — the host run's RESOLVED read-face containment
+ *  (post deps/org/mount resolution, not the raw spec value). `TaskSpec.readFace`'s own JSDoc
+ *  promises "roots pins this task, and via the tighten-only clamp, its whole delegation subtree" —
+ *  a workflow child is that subtree; the Task/SendMessage delegation lane already carries this,
+ *  the workflow lane was the one gap. Lazy (read at spawn time, after prepare has resolved it). */
+parentReadFace?: () => TaskSpec["readFace"], 
+/** Twin of the above for the deny-set additions (built-ins always apply; these are the extra
+ *  entries the host's own deployment/task layers stacked on). */
+parentReadDenyPatterns?: () => TaskSpec["readDenyPatterns"]): WorkflowPrimitives;

package/dist/orchestration/workflow-primitives.js

@@ -22,7 +22,7 @@ function formatResourceClampNote(notes) {
     const parts = notes.map((n) => `${n.field}: requested ${n.requested === undefined ? "unset" : n.requested} → applied ${n.applied}`);
     return `workflow governance tightened this agent's resource limits (${parts.join("; ")})`;
 }
-export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentThinking, parentPrincipal, parentCheckpointStoreDisabled) {
+export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentThinking, parentPrincipal, parentCheckpointStoreDisabled, parentReadFace, parentReadDenyPatterns) {
     const agent = (spec, opts) => {
         if (typeof spec === "string")
             spec = { objective: spec };
@@ -42,6 +42,17 @@ export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentThi
         if (parentCheckpointStoreDisabled === true) {
             childSpec.checkpointStore = null;
         }
+        if (parentReadFace) {
+            const pf = parentReadFace();
+            if (pf === "roots" && childSpec.readFace !== "roots")
+                childSpec.readFace = "roots";
+        }
+        if (parentReadDenyPatterns) {
+            const pd = parentReadDenyPatterns();
+            if (pd !== undefined && pd.length > 0) {
+                childSpec.readDenyPatterns = childSpec.readDenyPatterns !== undefined ? [...childSpec.readDenyPatterns, ...pd] : [...pd];
+            }
+        }
         if (onAgentSpawn) {
             return ctx.agentStream(childSpec, agentOpts).then((handle) => {
                 onAgentSpawn(handle);

package/dist/orchestration/workflow-types.d.ts

@@ -95,10 +95,11 @@ export interface WorkflowAgentRun {
      *  `isolation: "worktree"` agent whose worktree the engine actually minted (reported by the runner's
      *  workspace-observation seam and folded on while the agent is still RUNNING, so an interrupted run's
      *  recovery path has the coordinate instead of enumerating the worktrees directory and guessing). ABSENCE
-     *  means the agent ran in the SHARED working tree — never "unknown": the shared root is deliberately not
+     *  means the agent ran in the SHARED working tree OR in a REMOTE isolated sandbox (#197 BGW-7: a sandbox's
+     *  cwd is remote-internal, not a host path) — never "unknown": neither the shared root nor a remote path is
      *  written here, so a consumer acting on this path (diff / merge / remove, the userland half of the
-     *  isolate-only contract) can never be handed a tree it must not touch. A host path, not content → same
-     *  scope-gated, unredacted posture as {@link sessionId}. */
+     *  isolate-only contract) can never be handed a tree it must not touch or a path the host does not hold.
+     *  Always a HOST path, not content → same scope-gated, unredacted posture as {@link sessionId}. */
     worktreeDir?: string;
 }
 /**
@@ -288,7 +289,7 @@ export declare class WorkflowBudgetExceededError extends Error {
  * capped at ONE level (design/97 §H.1, the S8 prerequisite). A workflow's agent (a `runner.runTask` child)
  * cannot itself start a workflow: the LLM-facing `run_workflow` tool hits this guard, and so does a
  * trusted-dev nested `runWorkflow(...)` call. The depth is read from the TRUSTED
- * {@link WorkflowInternals.workflowDepth} first (the cross-process channel — a worker/script cannot forge it,
+ * {@link WorkflowInternals.workflowDepth} first (the cross-process channel — a worker/script cannot self-declare it,
  * it is not a `TaskSpec` field) then the in-process {@link workflowDepthStore} (AsyncLocalStorage), so neither
  * a spec field nor a tool param can defeat it (design/98 §0.1 BLOCKER3).
  */