@sema-agent/core 5.29.0 → 5.31.0

package/dist/core/tool-result-store.d.ts

@@ -103,10 +103,12 @@ export interface ToolResultStore {
      *   - **concurrency-tolerant**: an entry that disappears between enumeration and removal is honest
      *     absence, not an error.
      *
-     * Typed OPTIONAL, and deliberately NOT part of the published contract kit
-     * (`toolResultStoreContract`): unlike `ownerOf`, a backend that cannot enumerate by owner is still
-     * a usable offload store, so its absence must stay a checkable fact rather than a contract breach.
-     * Present ⇒ the store can complete a session deletion; absent ⇒ the deployment owns that gap.
+     * Typed OPTIONAL, and an OPTIONAL leg of the published contract kit (`toolResultStoreContract`,
+     * its #196 case): unlike `ownerOf`, a backend that cannot enumerate by owner is still a usable
+     * offload store, so absence is never a contract breach — the kit verifies the four-state
+     * semantics when the member is present and reports absence through its `onOptionalMember`
+     * callback (a checkable fact, not a failure). Present ⇒ the store can complete a session
+     * deletion; absent ⇒ the deployment owns that gap.
      *
      * Implementing it does NOT make a store `retention: "managed"` — that declaration promises the whole
      * {@link import("./retention.js").ManagedRetentionCapability} (domain enumeration, tombstones,

package/dist/core/tool-result-store.js

@@ -366,7 +366,9 @@ async function offloadOversizedDetailStrings(details, store, thresholdChars, ses
     const value = walk(details, []);
     const settled = await Promise.allSettled(pending.map((p) => p.done));
     const notices = new Map();
-    pending.forEach((p, i) => void notices.set(p.marker, p.render(settled[i].status === "fulfilled")));
+    pending.forEach((p, i) => {
+        notices.set(p.marker, p.render(settled[i].status === "fulfilled"));
+    });
     const seen = new Set();
     const finalize = (node) => {
         if (typeof node !== "object" || node === null)

package/dist/core/types.d.ts

@@ -650,6 +650,21 @@ export interface ToolExecuteContext {
      * read-only boundary ended at one level. Strictly a capability REMOVAL — it can never widen a child.
      */
     handsReadOnly?: true;
+    /**
+     * design/199 — the READ-face clamp carrier ({@link TaskSpec.readFace}): present (as "roots") ONLY
+     * when this run RESOLVED to the roots face, so a delegation tool pins every child spec to roots —
+     * without it a roots-narrowed parent's children would resolve the shared deployment seat (possibly
+     * "open") and read wider than the parent could. Strictly a tightening carrier: an open parent adds
+     * no key, and nothing in the delegation lane can spell "open". F10 ruling (v1): this seat exists
+     * ONLY as the delegation carrier — no tool adapts its model-facing behavior on it.
+     */
+    readFace?: "roots";
+    /**
+     * design/199 件B — the parent task's OWN deny-set additions ({@link TaskSpec.readDenyPatterns}),
+     * traveling the delegation tree add-only (a child judges at least every entry its parent judged).
+     * Runner-filled trusted seat, never a model argument.
+     */
+    readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
     /**
      * The HARD-HEADLESS clamp ({@link TaskSpec.interactiveTools} set to `false` — "never mount a
      * human-facing tool on this run, whatever faces exist"), Runner-filled read-only on the same trusted
@@ -2109,6 +2124,27 @@ export interface TaskSpec {
      * config read.
      */
     additionalReadDirectories?: string[];
+    /**
+     * design/199 件B — TASK-layer ADDITIONS to the built-in sensitive-path READ deny set
+     * ({@link import("../tools/fs/read-deny.js").READ_FACE_DEFAULT_DENY_ENTRIES}). Judged by the
+     * structured read faces (Read/Grep/Glob/RepoMap, their traversals, the classify shell gate's
+     * auto-allow probe and the compaction attachment reader) in BOTH containment modes. Add-only
+     * everywhere (D-4 zero-shrink ruling): entries here UNION with the built-ins and the deployment's
+     * {@link RunnerDeps.readDenyPatterns}; `[]` ≡ absent (union identity); nothing can remove a
+     * built-in. Bad entry shapes refuse loudly at prepare (#123). The write faces are untouched.
+     */
+    readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
+    /**
+     * design/199 件A — the TASK layer's read-face containment declaration
+     * ({@link import("../tools/fs/read-face.js").ReadFace}). "roots" pins this task (and, via the
+     * tighten-only clamp, its whole delegation subtree) to the historical containment; "open" lifts
+     * the roots judgment for the structured read faces — refused loudly under org governance (the
+     * task layer only tightens there; the deployment opens via {@link RunnerDeps.readFace}) and
+     * beside `handsReadOnly: true` (the verifier containment is load-bearing). Absent ⇒ the
+     * deployment seat, then the engine default ("roots" — D-1b: an upgrade never opens implicitly).
+     * Bad values refuse loudly (#123). Never affects the write faces.
+     */
+    readFace?: import("../tools/fs/read-face.js").ReadFace;
     /**
      * design/80 D-B — opt in to PLAN MODE: mount the first-party `present_plan` tool (CC `ExitPlanMode` parity).
      * The model calls it to present a plan; the engine then pauses with a durable `plan_review` checkpoint
@@ -4187,7 +4223,14 @@ export interface EngineNotice {
      *    failed; THIS attempt stored nothing (the failure arm reports, it never re-inserts under the
      *    ref) — an earlier attempt of the same idempotent re-put may already have stored the row, so
      *    the notice claims a failed write, not an empty ref; `detail: { ref, sessionId, cause }`.
-     *    Per-occurrence, not per-process-deduplicated: each failed write is a distinct fact. */
+     *    Per-occurrence, not per-process-deduplicated: each failed write is a distinct fact.
+     *  - `"workflow.governance_key_stripped"` (#235) — the fields of an LLM-authored workflow `agent(spec)`
+     *    that did NOT cross the governed default-deny whitelist: an unrecognized/control-plane field, or a
+     *    `readFace` value that is not the containment-tightening one. The spawn PROCEEDS on the deployment
+     *    baseline (the strip is not a refusal in this window), which is why the drop is announced;
+     *    `detail: { total, stripped: [{ key, reason }], omitted? }`, the rendered key list bounded in count
+     *    and length because the names come from the untrusted script. One aggregated notice per governed
+     *    child build, not de-duplicated across builds: each spec is a distinct fact. */
     code: string;
     /** The exact human-readable line the unwired build prints via `console.warn` — same words, one text. */
     message: string;
@@ -4265,6 +4308,25 @@ export interface RunnerDeps {
      * Runner 私有编排字段(taskRegistry/detachHub/execClamp/cwdRef/…)不在此面,永不开放。
      */
     hands?: HandsBandOptions;
+    /**
+     * design/199 件B — DEPLOYMENT-layer ADDITIONS to the built-in sensitive-path READ deny set
+     * ({@link import("../tools/fs/read-deny.js").READ_FACE_DEFAULT_DENY_ENTRIES}); see
+     * {@link TaskSpec.readDenyPatterns} for the judged surfaces. Add-only (D-4 zero-shrink ruling):
+     * unions with the built-ins and any task-layer additions; there is no whole-table replacement
+     * escape hatch, and `[]` ≡ absent. Bad entry shapes refuse loudly at prepare (#123).
+     */
+    readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
+    /**
+     * design/199 件A — the DEPLOYMENT's read-face declaration
+     * ({@link import("../tools/fs/read-face.js").ReadFace}; see {@link TaskSpec.readFace} for the
+     * task layer and the resolution order). An interactive single-user product declares
+     * `readFace: "open"` here in one line; the engine default stays "roots" (D-1b). Under org
+     * governance this seat may still open (it is the deployment's own declaration); the task layer
+     * may not. Beside a read-only (verifier) mount this seat's "open" silently CLAMPS to roots (a
+     * deployment default cannot override a load-bearing containment wall) — TaskSpec.readFace's own
+     * "open" there is the genuine per-task contradiction, and that one still refuses loudly (#123).
+     */
+    readFace?: import("../tools/fs/read-face.js").ReadFace;
     /**
      * design/96 §20 (P1a) — DEPLOYMENT-DECLARED training knowledge cutoff per model id (e.g.
      * `{ "qwen-3.5-35b": "2025-01", "deepseek-pro": "2024-07" }`). When the resolved model id is present, the

package/dist/engine/harness/types.d.ts

@@ -349,6 +349,16 @@ export interface ExecutionEnv extends FileSystem, Shell {
      * mechanism exists to prevent.
      */
     readonly lifetimeStartedAt?: number;
+    /**
+     * #211 (design/199 seam) — does this environment's path NAMESPACE live on the CONTROL-PLANE HOST's
+     * filesystem? Declared by the ADAPTER: `false` for a virtual/sandboxed env whose paths never map
+     * onto the host (an in-memory env, a container the host cannot mount) — consumers that record
+     * host-path receipts (the workflow workspace observer's `worktreeDir`) then refuse to present this
+     * env's cwd as a host path. Omitted ⇒ the historical structural inference stays in force
+     * (isRemoteExecutionEnv shape detection; a plain NodeExecutionEnv is host-local). `true` is a
+     * harmless explicit spelling of the local default.
+     */
+    readonly hostLocalPaths?: boolean;
 }
 /** Base fields shared by append-only session tree entries. */
 export interface SessionTreeEntryBase {

package/dist/index.d.ts

@@ -87,6 +87,8 @@ export type { InvariantKind, FunctionContract, Invariant, InvariantViolation, Ch
 export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, type BashReadonlyRootBoundary, type CompoundReadonlyVerdict, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
+export { READ_FACE_DEFAULT_DENY_ENTRIES, compileReadDeny, type ReadDenyEntry, type ReadDenyMatcher, type NormalizedReadDenyEntry, } from "./tools/fs/index.js";
+export { resolveReadFace, type ReadFace, type ReadFaceInputs } from "./tools/fs/index.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, type ToolResultProvenance, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, type ToolResultStore, type ToolResultSlice, type ToolResultDeletionReport, } from "./core/tool-result-store.js";
 export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, type UsageWindow, type UsageWindowStore, type UsageWindowReading, type UsageWindowRecord, type UsageSlot, type UsageBucketRow, } from "./core/usage-window-store.js";
@@ -168,7 +170,7 @@ export { encodeSurfacedKey, buildManifestText, validateSelectedIds, composeSelec
 export { runMemoryConsolidation, CONSOLIDATION_SYSTEM_PROMPT, DEFAULT_CONSOLIDATION_BAND, DEFAULT_CONSOLIDATION_SEARCH_LIMIT, DEFAULT_CONSOLIDATION_MAX_NOTES, DEFAULT_CONSOLIDATION_TIMEOUT_SEC, normalizeForExactMatch, type ConsolidationParams, type ConsolidationStats, type ConsolidationNote, type ConsolidationLLM, } from "./core/runner/memory-consolidation.js";
 export { consolidateScope, advanceCursorAfterInline, type ConsolidateScopeDeps, type ConsolidateScopeOptions, } from "./core/consolidate-scope.js";
 export { DEFAULT_COMPACTION_INSTRUCTIONS } from "./core/auto-compaction.js";
-export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, type EnvironmentFacts, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, type PromptBlock, analyzePromptCacheFriendliness, assertPromptCacheFriendly, type PromptProvider, type StablePromptContext, type PromptCacheReport, type PromptTextDeclaration, } from "./prompts/default.js";
+export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, type EnvironmentFacts, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, type PromptBlock, analyzePromptCacheFriendliness, assertPromptCacheFriendly, type PromptProvider, type StablePromptContext, type PromptCacheReport, type PromptTextDeclaration, } from "./prompts/default.js";
 export { SUPERVISOR_PROMPT, ORCHESTRATION_GUIDANCE, ORCHESTRATION_AWARENESS, GOAL_COMPLETION_GUIDANCE } from "./prompts/supervisor.js";
 export { compose, validatePack } from "./prompt-assembly/composer.js";
 export { SEMA_DEFAULT_PACK } from "./prompt-assembly/packs/sema-default.js";

package/dist/index.js

@@ -68,6 +68,8 @@ export { deriveInvariants, checkInvariants } from "./core/property-harness.js";
 export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
+export { READ_FACE_DEFAULT_DENY_ENTRIES, compileReadDeny, } from "./tools/fs/index.js";
+export { resolveReadFace } from "./tools/fs/index.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, } from "./core/tool-result-store.js";
 export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, } from "./core/usage-window-store.js";
@@ -131,7 +133,7 @@ export { encodeSurfacedKey, buildManifestText, validateSelectedIds, composeSelec
 export { runMemoryConsolidation, CONSOLIDATION_SYSTEM_PROMPT, DEFAULT_CONSOLIDATION_BAND, DEFAULT_CONSOLIDATION_SEARCH_LIMIT, DEFAULT_CONSOLIDATION_MAX_NOTES, DEFAULT_CONSOLIDATION_TIMEOUT_SEC, normalizeForExactMatch, } from "./core/runner/memory-consolidation.js";
 export { consolidateScope, advanceCursorAfterInline, } from "./core/consolidate-scope.js";
 export { DEFAULT_COMPACTION_INSTRUCTIONS } from "./core/auto-compaction.js";
-export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, analyzePromptCacheFriendliness, assertPromptCacheFriendly, } from "./prompts/default.js";
+export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, analyzePromptCacheFriendliness, assertPromptCacheFriendly, } from "./prompts/default.js";
 export { SUPERVISOR_PROMPT, ORCHESTRATION_GUIDANCE, ORCHESTRATION_AWARENESS, GOAL_COMPLETION_GUIDANCE } from "./prompts/supervisor.js";
 export { compose, validatePack } from "./prompt-assembly/composer.js";
 export { SEMA_DEFAULT_PACK } from "./prompt-assembly/packs/sema-default.js";

package/dist/orchestration/run-workflow-tool.d.ts

@@ -219,6 +219,12 @@ export interface RunWorkflowToolDeps {
     /** Call-time getter for the HOST task's current thinking level — a spawned agent with no explicit
      *  script/baseline `thinking` inherits it (the parentCwd/model-snapshot companion). */
     parentThinking?: () => import("../core/types.js").TaskSpec["thinking"];
+    /** 5.30 merge-rescan (design/199 parity gap) — call-time getter for the HOST task's RESOLVED
+     *  read-face containment; folds stricter-wins into every spawned workflow child (see
+     *  `buildWorkflowPrimitives`'s injection block for the full rationale). */
+    parentReadFace?: () => import("../core/types.js").TaskSpec["readFace"];
+    /** Twin of the above for the deny-set additions (union, not replace). */
+    parentReadDenyPatterns?: () => import("../core/types.js").TaskSpec["readDenyPatterns"];
     /** [1238](A) — call-time getter for the HOST task's RESOLVED Model object: a spawned agent whose
      *  fold chain produced no model inherits the parent's full object (baseUrl/key routing included),
      *  mirroring the subagent lane's ctx.model semantics. */
@@ -254,6 +260,26 @@ export interface RunWorkflowToolDeps {
     autoModeReview?: () => {
         decider: import("../core/auto-mode.js").AutoModeDecider;
     } | undefined;
+    /** 5.30 merge-rescan round 2 — the HOST task's durable OFF SWITCH (`spec.checkpointStore === null`,
+     *  ruled 2026-08-04 to inherit into every spawned agent, see `buildWorkflowPrimitives`'s call
+     *  above). Known at prepare-time (no lazy getter needed — `spec` is available at mount). A dep for
+     *  the same reason as `forwardEvent`/`inheritedGateForChildren`: the auto-mounted tool's execute
+     *  ctx is minimal `{toolCallId, signal}`, so `ctx.checkpointStoreDisabledForChildren` was a DEAD
+     *  read there — the off-switch never actually reached this lane's children. */
+    parentCheckpointStoreDisabled?: boolean;
+    /** #235 — the deployment's structured notice sink (`RunnerDeps.onNotice`), forwarded into the governed
+     *  build so the fields a script's agent spec wrote that did NOT reach the child are announced instead of
+     *  vanishing (`workflow.governance_key_stripped`). A dep for the same reason as the seats above: this
+     *  auto-mount's execute ctx is minimal. Absent ⇒ the historic `console.warn` loudness. */
+    onNotice?: (n: import("../core/types.js").EngineNotice) => void;
+    /** Twin of the above for design/148 S1's center-artifact inheritance (see the `ctx.centerArtifactDigest`/
+     *  `ctx.centerSourceRevision` reads at the `startWorkflow` options site) — `centerAdoption` resolves
+     *  LATE in prepare-task.ts (well after this tool's mount point), so this is a call-time getter, not
+     *  a value, mirroring `parentReadFace`. `ctx.centerArtifactDigest` still wins when a wrapping path
+     *  provides it. */
+    parentCenterArtifactDigest?: () => string | undefined;
+    /** Publish-provenance companion of the above. */
+    parentCenterSourceRevision?: () => string | undefined;
 }
 /**
  * Build the `run_workflow` tool. ASSERTS the runner is a hard sandbox (defense in depth — prepare-task only

package/dist/orchestration/run-workflow-tool.js

@@ -167,7 +167,7 @@ export async function createRunWorkflowTool(d) {
                 : {}),
         }
         : d.governanceBaseline;
-    const governance = { baseline: baselineWithParentFace, models: d.models, caps: childCaps };
+    const governance = { baseline: baselineWithParentFace, models: d.models, caps: childCaps, onNotice: d.onNotice };
     const builtinsEnabled = d.builtinWorkflows !== false;
     const namedWorkflowSection = renderNamedWorkflowListing(await collectNamedWorkflowListings(d.scriptStore, builtinsEnabled));
     const sizeGuidelineSection = workflowSizeGuidelineSection(d.sizeGuideline ?? lim.sizeGuideline);
@@ -380,7 +380,7 @@ export async function createRunWorkflowTool(d) {
                 return structuredError(`workflow script failed to compile: ${err instanceof Error ? err.message : String(err)}`);
             }
             const scriptFn = (wfCtx) => {
-                const primitives = buildWorkflowPrimitives(wfCtx, governance, d.onAgentSpawn, d.parentThinking, principal, ctx.checkpointStoreDisabledForChildren === true);
+                const primitives = buildWorkflowPrimitives(wfCtx, governance, d.onAgentSpawn, d.parentThinking, principal, ctx.checkpointStoreDisabledForChildren === true || d.parentCheckpointStoreDisabled === true, d.parentReadFace, d.parentReadDenyPatterns);
                 return d.scriptRunner.run({ scriptSource: script, primitives, scriptArgs: effectiveArgs, signal: wfCtx.signal }).then((r) => r.result);
             };
             if (ctx.signal?.aborted) {
@@ -389,6 +389,9 @@ export async function createRunWorkflowTool(d) {
             let handle;
             const workflowTaskId = d.taskRegistry?.mintTaskId("workflow");
             const autoModeReview = ctx.autoModeReview ?? d.autoModeReview?.();
+            const centerFromCtx = ctx.centerArtifactDigest !== undefined;
+            const parentCenterArtifactDigest = centerFromCtx ? ctx.centerArtifactDigest : d.parentCenterArtifactDigest?.();
+            const parentCenterSourceRevision = centerFromCtx ? ctx.centerSourceRevision : d.parentCenterSourceRevision?.();
             try {
                 handle = startWorkflow(d.runner, scriptFn, {
                     store: d.store,
@@ -417,8 +420,8 @@ export async function createRunWorkflowTool(d) {
                     ...((ctx.interactionPosture ?? d.parentInteractionPosture) !== undefined ? { interactionPosture: (ctx.interactionPosture ?? d.parentInteractionPosture) } : {}),
                     ...(d.parentModel !== undefined ? { defaultModel: d.parentModel } : {}),
                     ...(d.parentGetApiKeyAndHeaders !== undefined ? { defaultGetApiKeyAndHeaders: d.parentGetApiKeyAndHeaders } : {}),
-                    ...(ctx.centerArtifactDigest !== undefined ? { parentCenterArtifactDigest: ctx.centerArtifactDigest } : {}),
-                    ...(ctx.centerSourceRevision !== undefined ? { parentCenterSourceRevision: ctx.centerSourceRevision } : {}),
+                    ...(parentCenterArtifactDigest !== undefined ? { parentCenterArtifactDigest } : {}),
+                    ...(parentCenterSourceRevision !== undefined ? { parentCenterSourceRevision } : {}),
                     ...((ctx.forwardEvent ?? d.forwardEvent) !== undefined ? { onForwardEvent: (ctx.forwardEvent ?? d.forwardEvent) } : {}),
                     ...((ctx.inheritedGateForChildren ?? d.inheritedGateForChildren) !== undefined
                         ? { inheritedGate: (ctx.inheritedGateForChildren ?? d.inheritedGateForChildren)() }

package/dist/orchestration/workflow-governance.d.ts

@@ -13,7 +13,8 @@
  * cost/token caps — codex Q4).
  */
 import type { Model } from "../internal/llm.js";
-import type { ImageInput, TaskSpec, ThinkingLevel, WorkflowGovernanceBaseline } from "../core/types.js";
+import type { EngineNotice, ImageInput, TaskSpec, ThinkingLevel, WorkflowGovernanceBaseline } from "../core/types.js";
+import { type ReadDenyEntry } from "../tools/fs/read-deny.js";
 /** Thrown when an LLM-authored script picks a `modelName` not in the workflow model allowlist (or no
  *  allowlist is configured). FAIL-CLOSED: a script can only ever name a model the deployment pre-approved. */
 export declare class WorkflowModelNotAllowedError extends Error {
@@ -41,12 +42,56 @@ export interface WorkflowAgentSpec {
         maxTokens?: number;
         maxCostUsd?: number;
     };
+    /**
+     * design/199 件A, TIGHTEN-ONLY: `"roots"` — the read-face containment judgment — is the ONLY value a
+     * script may set. `"open"` is the WIDENING direction (it removes the containment step), so it is
+     * stripped and announced rather than applied; the type states the asymmetry, and
+     * {@link pickWhitelist} enforces it on the untrusted value.
+     */
+    readFace?: "roots";
+    /**
+     * design/199 件B, TIGHTEN-ONLY: additional read-deny entries. Add-only at every layer (the built-in
+     * table and the baseline's entries are always in force and cannot be removed or replaced — see
+     * `compileReadDeny`'s zero-shrink contract and `tightenTaskSpec`'s union), so anything a script
+     * writes here can only ever narrow what the child may read.
+     */
+    readDenyPatterns?: readonly ReadDenyEntry[];
 }
 /**
  * The SINGLE source of truth for the whitelist (a test pins that it contains no control-plane key). `objective`
  * + `modelName` are handled explicitly in {@link buildGovernedChildSpec}; the rest map 1:1 onto `TaskSpec`.
+ *
+ * WHAT HAPPENS TO EVERY OTHER FIELD — {@link pickWhitelist} READS these keys and only these keys; it never
+ * enumerates the script's fields to judge them, which is precisely the complete-by-construction property this
+ * module is built on (nothing can leak by being forgotten in a denylist). The consequence is that an
+ * unrecognized field is STRIPPED, not refused: the spawn proceeds on the baseline as if the field had never
+ * been written. That silence is what {@link STRIPPED_KEYS_NOTICE_CODE} exists to close — one aggregated
+ * notice per governed build names the fields that did not cross the seam, so a mistyped budget axis (a
+ * top-level `maxCostUsd` that belongs inside `limits` since design/164, which would run the child unbounded
+ * on exactly the axis the author tried to bound) or a rejected containment request is visible to the operator
+ * instead of evaporating. Turning the strip into a LOUD REFUSAL that fails the spawn is a deliberate
+ * NON-GOAL of this window: it would break every existing script carrying a harmless extra field, and is held
+ * for a BREAKING window.
+ */
+export declare const WHITELIST_KEYS: readonly ["objective", "modelName", "thinking", "systemPrompt", "images", "limits", "readFace", "readDenyPatterns"];
+/**
+ * One field of an untrusted agent spec that did NOT reach the child, and why.
+ *  - `not_whitelisted` — the field is outside {@link WHITELIST_KEYS}: a control-plane field, a work field
+ *    spelled at the wrong nesting level, or plain noise. It was never read.
+ *  - `not_a_tightening_value` — the KEY is whitelisted but only its containment-TIGHTENING value may cross
+ *    the seam, and the script wrote a different one. Today that is `readFace`, where `"roots"` tightens and
+ *    anything else (`"open"`, or garbage) would either widen the child's read face or ask for a value the
+ *    resolver does not define.
  */
-export declare const WHITELIST_KEYS: readonly ["objective", "modelName", "thinking", "systemPrompt", "images", "limits"];
+export interface StrippedSpecKeyNote {
+    key: string;
+    reason: "not_whitelisted" | "not_a_tightening_value";
+}
+/** The {@link EngineNotice} family for the strip announcement (see {@link WHITELIST_KEYS}). ONE notice per
+ *  governed build, listing every field that did not cross the seam — a governed script can carry an
+ *  arbitrary number of unrecognized fields, and a per-field notice would turn one authoring mistake into a
+ *  flood. Not de-duplicated across builds: each spawn is a distinct fact about a distinct spec. */
+export declare const STRIPPED_KEYS_NOTICE_CODE = "workflow.governance_key_stripped";
 /** Per-child workflow ceilings the engine forces onto every spawned agent (design/98 §D.6), independent of
  *  what the script asks for. The child's effective limits = min(script, baseline, these). */
 export interface WorkflowChildCaps {
@@ -91,5 +136,10 @@ export declare function resolveModelName(name: string, allowlist: string[] | und
  * disclosure hook the caller can wire to a log/event channel (see `buildWorkflowPrimitives`, which logs it
  * onto the run's log stream so the LLM-authored script's caller can see requested→applied per field instead
  * of the child silently running under different limits than the script wrote).
+ *
+ * `onNotice` is the deployment's structured notice sink (`RunnerDeps.onNotice`): step 1's strip is announced
+ * through it as one aggregated {@link STRIPPED_KEYS_NOTICE_CODE} notice (see {@link WHITELIST_KEYS}). An
+ * absent sink keeps the historic loudness (`console.warn`); the delivery itself is swallow-guarded, so no
+ * sink can turn an announcement into a failed spawn.
  */
-export declare function buildGovernedChildSpec(scriptSpec: unknown, baseline: WorkflowGovernanceBaseline, models: Record<string, Model> | undefined, caps?: WorkflowChildCaps, onResourceClamp?: (notes: ResourceClampNote[]) => void): TaskSpec;
+export declare function buildGovernedChildSpec(scriptSpec: unknown, baseline: WorkflowGovernanceBaseline, models: Record<string, Model> | undefined, caps?: WorkflowChildCaps, onResourceClamp?: (notes: ResourceClampNote[]) => void, onNotice?: (n: EngineNotice) => void): TaskSpec;

package/dist/orchestration/workflow-governance.js

@@ -1,5 +1,7 @@
+import { deliverEngineNotice } from "../core/types.js";
 import { tightenTaskSpec } from "../core/tighten-task-spec.js";
 import { sanitizeUntrustedText } from "../core/untrusted-text.js";
+import { compileReadDeny } from "../tools/fs/read-deny.js";
 import { WorkflowScriptError } from "./workflow-meta.js";
 export class WorkflowModelNotAllowedError extends Error {
     modelName;
@@ -17,7 +19,43 @@ export const WHITELIST_KEYS = [
     "systemPrompt",
     "images",
     "limits",
+    "readFace",
+    "readDenyPatterns",
 ];
+const WHITELIST_KEY_SET = new Set(WHITELIST_KEYS);
+export const STRIPPED_KEYS_NOTICE_CODE = "workflow.governance_key_stripped";
+const MAX_STRIPPED_KEYS_ANNOUNCED = 20;
+const MAX_STRIPPED_KEY_CHARS = 64;
+const UNSAFE_KEY_CODE_POINT = /[\p{Cc}\p{Cf}\p{Cs}\p{Zl}\p{Zp}]/u;
+function renderStrippedKey(key) {
+    let out = "";
+    let seen = 0;
+    for (const point of key) {
+        if (seen === MAX_STRIPPED_KEY_CHARS)
+            return `${out}…`;
+        out += UNSAFE_KEY_CODE_POINT.test(point) ? "?" : point;
+        seen++;
+    }
+    return out;
+}
+function emitStrippedKeysNotice(survey, onNotice) {
+    const shown = survey.sample.map((s) => ({ key: renderStrippedKey(s.key), reason: s.reason }));
+    const omitted = survey.total - shown.length;
+    const list = shown.map((s) => JSON.stringify(s.key)).join(", ") + (omitted > 0 ? `, +${omitted} more` : "");
+    const message = `workflow governance: ${survey.total} field(s) of an agent spec were NOT applied to the child (${list}). ` +
+        `A governed workflow script may set only: ${WHITELIST_KEYS.join(", ")} — and \`readFace\` only as "roots" ` +
+        `(the containment-tightening direction; "open" widens and is never taken from a script). Every other field ` +
+        `of the child comes from the deployment baseline.`;
+    try {
+        deliverEngineNotice(onNotice, {
+            code: STRIPPED_KEYS_NOTICE_CODE,
+            message,
+            detail: { total: survey.total, stripped: shown, ...(omitted > 0 ? { omitted } : {}) },
+        });
+    }
+    catch {
+    }
+}
 const VALID_THINKING = new Set(["off", "minimal", "low", "medium", "high", "xhigh", "max"]);
 export function resolveModelName(name, allowlist, models) {
     if (!allowlist || allowlist.length === 0) {
@@ -49,49 +87,121 @@ function pickImageInput(el, i) {
     }
     const o = el;
     if ("url" in o) {
-        if (typeof o.url !== "string" || o.url.length === 0) {
+        const url = o.url;
+        if (typeof url !== "string" || url.length === 0) {
             throw new WorkflowScriptError(`${at}.url must be a non-empty string`);
         }
-        return { url: o.url };
+        return { url };
     }
-    if (typeof o.data !== "string") {
+    const data = o.data;
+    const mimeType = o.mimeType;
+    if (typeof data !== "string") {
         throw new WorkflowScriptError(`${at}.data must be a base64 string (or supply { url } instead)`);
     }
-    if (typeof o.mimeType !== "string" || o.mimeType.length === 0) {
+    if (typeof mimeType !== "string" || mimeType.length === 0) {
         throw new WorkflowScriptError(`${at}.mimeType must be a non-empty string, e.g. "image/png"`);
     }
-    return { data: o.data, mimeType: o.mimeType };
+    return { data, mimeType };
+}
+const MAX_SCRIPT_DENY_ENTRIES = 16;
+const MAX_SCRIPT_DENY_PATTERN_CHARS = 256;
+const MAX_SCRIPT_DENY_WILDCARDS_PER_SEGMENT = 1;
+const MAX_SCRIPT_IMAGES = 32;
+function assertScriptDenyPatternBounded(pattern, at) {
+    if (pattern.length > MAX_SCRIPT_DENY_PATTERN_CHARS) {
+        throw new WorkflowScriptError(`${at} is ${pattern.length} characters — a workflow script's deny pattern is limited to ${MAX_SCRIPT_DENY_PATTERN_CHARS} (the matcher runs on every read of the child's run).`);
+    }
+    for (const segment of pattern.split("/")) {
+        const wildcards = segment.split("*").length - 1;
+        if (wildcards > MAX_SCRIPT_DENY_WILDCARDS_PER_SEGMENT) {
+            throw new WorkflowScriptError(`${at} has a path segment with ${wildcards} \`*\` wildcards — a workflow script's deny pattern allows at most ` +
+                `${MAX_SCRIPT_DENY_WILDCARDS_PER_SEGMENT} per path segment (the same expressiveness the engine's built-in deny table ` +
+                `uses). Each \`*\` compiles to a greedy match, and more than one in a single segment makes the judgment cost grow ` +
+                `superlinearly with the path length, on every read the child performs. Write the intent as separate entries ` +
+                `(the set is a union, so more entries deny strictly more) or anchor it with literal segments.`);
+        }
+    }
+}
+function mapUntrustedArray(value, at, atMost, why, build) {
+    const declared = value.length;
+    if (typeof declared !== "number" || !Number.isSafeInteger(declared) || declared < 0) {
+        throw new WorkflowScriptError(`${at} does not report a valid array length.`);
+    }
+    if (declared > atMost) {
+        throw new WorkflowScriptError(`${at} carries ${declared} entries — a workflow script may set at most ${atMost}. ${why}`);
+    }
+    const out = [];
+    for (let i = 0; i < declared; i++)
+        out.push(build(value[i], i));
+    return out;
+}
+function pickReadDenyEntry(el, i) {
+    const at = `agent(spec): \`readDenyPatterns[${i}]\``;
+    if (typeof el === "string") {
+        if (el.length === 0)
+            throw new WorkflowScriptError(`${at} must be a non-empty pattern string`);
+        assertScriptDenyPatternBounded(el, at);
+        return el;
+    }
+    if (typeof el !== "object" || el === null || Array.isArray(el)) {
+        throw new WorkflowScriptError(`${at} must be a pattern string or an object { pattern, caseSensitive? }`);
+    }
+    const o = el;
+    const pattern = o.pattern;
+    const caseSensitive = o.caseSensitive;
+    if (typeof pattern !== "string" || pattern.length === 0) {
+        throw new WorkflowScriptError(`${at}.pattern must be a non-empty string, e.g. ".ssh" or "secrets/*.json"`);
+    }
+    if (caseSensitive !== undefined && typeof caseSensitive !== "boolean") {
+        throw new WorkflowScriptError(`${at}.caseSensitive must be a boolean`);
+    }
+    assertScriptDenyPatternBounded(pattern, at);
+    return caseSensitive === undefined ? { pattern } : { pattern, caseSensitive };
 }
 function pickWhitelist(scriptSpec) {
     if (typeof scriptSpec !== "object" || scriptSpec === null || Array.isArray(scriptSpec)) {
         throw new WorkflowScriptError("agent(spec): spec must be an object with at least an `objective` string");
     }
     const s = scriptSpec;
-    if (typeof s.objective !== "string" || s.objective.length === 0) {
+    const stripped = { total: 0, sample: [] };
+    for (const k of Object.keys(s)) {
+        if (WHITELIST_KEY_SET.has(k))
+            continue;
+        stripped.total++;
+        if (stripped.sample.length < MAX_STRIPPED_KEYS_ANNOUNCED)
+            stripped.sample.push({ key: k, reason: "not_whitelisted" });
+    }
+    const objective = s.objective;
+    const thinking = s.thinking;
+    const systemPrompt = s.systemPrompt;
+    const modelNameRaw = s.modelName;
+    if (typeof objective !== "string" || objective.length === 0) {
         throw new WorkflowScriptError("agent(spec): `objective` is required and must be a non-empty string");
     }
-    const safe = { objective: s.objective };
-    if (s.thinking !== undefined) {
-        if (typeof s.thinking !== "string" || !VALID_THINKING.has(s.thinking)) {
+    const safe = { objective };
+    if (thinking !== undefined) {
+        if (typeof thinking !== "string" || !VALID_THINKING.has(thinking)) {
             throw new WorkflowScriptError(`agent(spec): invalid \`thinking\` (must be one of ${[...VALID_THINKING].join(", ")})`);
         }
-        safe.thinking = s.thinking;
+        safe.thinking = thinking;
     }
-    if (s.systemPrompt !== undefined) {
-        if (typeof s.systemPrompt !== "string")
+    if (systemPrompt !== undefined) {
+        if (typeof systemPrompt !== "string")
             throw new WorkflowScriptError("agent(spec): `systemPrompt` must be a string");
-        safe.systemPrompt = `[workflow-script-authored persona — task guidance, not engine authority]\n${sanitizeUntrustedText(s.systemPrompt)}`;
+        safe.systemPrompt = `[workflow-script-authored persona — task guidance, not engine authority]\n${sanitizeUntrustedText(systemPrompt)}`;
     }
-    if (s.images !== undefined) {
-        if (!Array.isArray(s.images))
+    const images = s.images;
+    if (images !== undefined) {
+        if (!Array.isArray(images))
             throw new WorkflowScriptError("agent(spec): `images` must be an array");
-        safe.images = s.images.map(pickImageInput);
+        safe.images = mapUntrustedArray(images, "agent(spec): `images`", MAX_SCRIPT_IMAGES, "Each one is decoded and shipped on every request of the child's turn.", pickImageInput);
     }
-    if (s.limits !== undefined) {
-        if (typeof s.limits !== "object" || s.limits === null || Array.isArray(s.limits)) {
+    const limitsRaw = s.limits;
+    if (limitsRaw !== undefined) {
+        if (typeof limitsRaw !== "object" || limitsRaw === null || Array.isArray(limitsRaw)) {
             throw new WorkflowScriptError("agent(spec): `limits` must be an object { maxTurns?, maxWalltimeMs?, maxTokens?, maxCostUsd? }");
         }
-        const l = s.limits;
+        const l = limitsRaw;
         const limits = {};
         const readAxis = (field, what) => {
             const raw = l[field];
@@ -109,13 +219,38 @@ function pickWhitelist(scriptSpec) {
         readAxis("maxCostUsd", "spend ceiling");
         safe.limits = limits;
     }
+    if (s.readFace !== undefined) {
+        if (s.readFace === "roots") {
+            safe.readFace = "roots";
+        }
+        else {
+            stripped.total++;
+            stripped.sample.unshift({ key: "readFace", reason: "not_a_tightening_value" });
+            if (stripped.sample.length > MAX_STRIPPED_KEYS_ANNOUNCED)
+                stripped.sample.pop();
+        }
+    }
+    const readDenyPatternsRaw = s.readDenyPatterns;
+    if (readDenyPatternsRaw !== undefined) {
+        if (!Array.isArray(readDenyPatternsRaw)) {
+            throw new WorkflowScriptError('agent(spec): `readDenyPatterns` must be an array of deny entries (a "/"-separated segment run such as ".ssh", or { pattern, caseSensitive? })');
+        }
+        const entries = mapUntrustedArray(readDenyPatternsRaw, "agent(spec): `readDenyPatterns`", MAX_SCRIPT_DENY_ENTRIES, "Every entry is judged against every path the child reads, for the child's whole run; the built-in and deployment entries are always in force on top of these.", pickReadDenyEntry);
+        try {
+            compileReadDeny(entries, "agent(spec).readDenyPatterns");
+        }
+        catch (err) {
+            throw new WorkflowScriptError(err instanceof Error ? err.message : String(err));
+        }
+        safe.readDenyPatterns = entries;
+    }
     let modelName;
-    if (s.modelName !== undefined) {
-        if (typeof s.modelName !== "string")
+    if (modelNameRaw !== undefined) {
+        if (typeof modelNameRaw !== "string")
             throw new WorkflowScriptError("agent(spec): `modelName` must be a string (a model NAME, never a Model object)");
-        modelName = s.modelName;
+        modelName = modelNameRaw;
     }
-    return { safe, modelName };
+    return { safe, modelName, stripped };
 }
 function clampResourceLimits(safe, base, caps) {
     const trustedCandidates = [
@@ -172,8 +307,10 @@ function clampResourceLimits(safe, base, caps) {
         safe.limits = rebuilt;
     return notes;
 }
-export function buildGovernedChildSpec(scriptSpec, baseline, models, caps, onResourceClamp) {
-    const { safe, modelName } = pickWhitelist(scriptSpec);
+export function buildGovernedChildSpec(scriptSpec, baseline, models, caps, onResourceClamp, onNotice) {
+    const { safe, modelName, stripped } = pickWhitelist(scriptSpec);
+    if (stripped.total > 0)
+        emitStrippedKeysNotice(stripped, onNotice);
     if (modelName !== undefined) {
         safe.model = resolveModelName(modelName, baseline.workflowModelAllowlist, models);
     }

package/dist/orchestration/workflow-primitives.d.ts

@@ -22,6 +22,11 @@ export interface WorkflowGovernance {
     baseline: WorkflowGovernanceBaseline;
     models?: Record<string, Model>;
     caps?: WorkflowChildCaps;
+    /** The deployment's structured notice sink (`RunnerDeps.onNotice`), threaded here because the governed
+     *  build is the only place that can report which spec fields did NOT reach the child (see
+     *  `buildGovernedChildSpec`'s `onNotice` param). Only meaningful in governed mode — the trusted-dev lane
+     *  strips nothing. Absent ⇒ the notice falls back to `console.warn`. */
+    onNotice?: (n: import("../core/types.js").EngineNotice) => void;
 }
 /**
  * Build the flat {@link WorkflowPrimitives} a {@link WorkflowScriptRunner} runs the script against. The
@@ -30,4 +35,13 @@ export interface WorkflowGovernance {
 export declare function buildWorkflowPrimitives(ctx: WorkflowRunContext, governance?: WorkflowGovernance, onAgentSpawn?: (handle: WorkflowAgentHandle) => void, parentThinking?: () => TaskSpec["thinking"], parentPrincipal?: string, 
 /** ruled 2026-08-04 — the host run set `TaskSpec.checkpointStore: null` (the per-run durable off
  *  switch). Every agent this workflow spawns inherits it; see the injection below. */
-parentCheckpointStoreDisabled?: boolean): WorkflowPrimitives;
+parentCheckpointStoreDisabled?: boolean, 
+/** 5.30 merge-rescan (design/199 parity gap) — the host run's RESOLVED read-face containment
+ *  (post deps/org/mount resolution, not the raw spec value). `TaskSpec.readFace`'s own JSDoc
+ *  promises "roots pins this task, and via the tighten-only clamp, its whole delegation subtree" —
+ *  a workflow child is that subtree; the Task/SendMessage delegation lane already carries this,
+ *  the workflow lane was the one gap. Lazy (read at spawn time, after prepare has resolved it). */
+parentReadFace?: () => TaskSpec["readFace"], 
+/** Twin of the above for the deny-set additions (built-ins always apply; these are the extra
+ *  entries the host's own deployment/task layers stacked on). */
+parentReadDenyPatterns?: () => TaskSpec["readDenyPatterns"]): WorkflowPrimitives;