@sema-agent/core 5.31.0 → 5.33.0

package/dist/core/runner/prepare-config-doors.js

@@ -0,0 +1,250 @@
+import { resolveBrainCallGuardrailMs } from "../../brain/timeout.js";
+import { assertReadFaceValue } from "../../tools/fs/index.js";
+import { resolveCheckpointStore } from "../checkpoint-store.js";
+import { preflightLockedConfig } from "../locked-config.js";
+import { assertRetentionCapability } from "../retention.js";
+import { resolveModel, resolveTaskModel, roleModelIfSet } from "../roles.js";
+import { resolveUsageWindows } from "../usage-window-store.js";
+import { deriveAskEffective, resolveAskSeamForm, resolveQuestionSeam } from "../wiring-manifest.js";
+const TASK_LIMIT_KEY_DICT = {
+    maxTokens: true,
+    maxCostUsd: true,
+    maxTurns: true,
+    maxWalltimeMs: true,
+    maxOutputTokens: true,
+    approachNotice: true,
+    budgetStreamCancel: true,
+    degrade: true,
+    brainCallGuardrailMs: true,
+};
+const TASK_LIMIT_KEYS = Object.keys(TASK_LIMIT_KEY_DICT);
+const NUMERIC_TASK_LIMIT_KEYS = ["maxTokens", "maxCostUsd", "maxTurns", "maxWalltimeMs", "maxOutputTokens"];
+const RETIRED_TASK_LIMIT_KEYS = {
+    timeoutSec: "maxWalltimeMs (milliseconds, not seconds)",
+    deadlineNudge: "approachNotice",
+    callCapByDeadline: "(retired — no replacement)",
+    gracefulFinalize: "(retired — the approach notice is the only end-of-budget prompt)",
+};
+export function limitConfigError(code, message) {
+    const e = new Error(message);
+    e.code = code;
+    return e;
+}
+export function resolveTaskLimits(limits) {
+    if (limits === undefined)
+        return undefined;
+    if (typeof limits !== "object" || Array.isArray(limits)) {
+        throw limitConfigError("config.limit_invalid", `TaskSpec.limits must be an object (got ${Array.isArray(limits) ? "an array" : typeof limits})`);
+    }
+    const raw = limits;
+    const legal = TASK_LIMIT_KEYS;
+    for (const key of Object.keys(raw)) {
+        if (legal.includes(key))
+            continue;
+        const replacement = RETIRED_TASK_LIMIT_KEYS[key];
+        throw limitConfigError("config.limit_unknown_key", `TaskSpec.limits.${key} is not a limit this engine reads` +
+            (replacement !== undefined ? ` — it was replaced by \`${replacement}\`` : "") +
+            `. Legal keys: ${TASK_LIMIT_KEYS.join(", ")}. Refused rather than ignored: a limit that is silently dropped reads to the caller as an armed ceiling.`);
+    }
+    for (const key of NUMERIC_TASK_LIMIT_KEYS) {
+        const value = raw[key];
+        if (value === undefined)
+            continue;
+        if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+            throw limitConfigError("config.limit_invalid", `TaskSpec.limits.${key} must be a finite, non-negative number (got ${String(value)}) — an unevaluable ceiling is not a ceiling, and folding it to a default would run the task under a limit nobody chose.`);
+        }
+    }
+    const notice = raw.approachNotice;
+    if (notice !== undefined && notice !== false) {
+        if (typeof notice !== "object" || notice === null || Array.isArray(notice)) {
+            throw limitConfigError("config.limit_invalid", `TaskSpec.limits.approachNotice must be \`false\` or { at?: [first, second] } (got ${String(notice)})`);
+        }
+        const at = notice.at;
+        if (at !== undefined) {
+            const ok = Array.isArray(at) &&
+                at.length === 2 &&
+                at.every((n) => typeof n === "number" && Number.isFinite(n) && n > 0 && n <= 1) &&
+                at[0] <= at[1];
+            if (!ok) {
+                throw limitConfigError("config.limit_invalid", `TaskSpec.limits.approachNotice.at must be two fractions in (0, 1] with first <= second (got ${JSON.stringify(at)})`);
+            }
+        }
+    }
+    return limits;
+}
+export function isFableFamilyModelId(id) {
+    const tail = id.toLowerCase().split("/").pop() ?? "";
+    return /^claude-fable-\d/.test(tail) || /^claude-mythos-5(?!\d)/.test(tail);
+}
+export function resolveModelPromptTraits(model, spec, internals) {
+    return {
+        promptProfile: spec.promptProfile ?? internals?.promptProfile ?? "simple",
+        fableMitigations: isFableFamilyModelId(model.id),
+    };
+}
+export function prepareConfigDoors(input) {
+    const { deps, sessions, resume, internals } = input;
+    let spec = input.spec;
+    const toolFaceSnapshot = {
+        exclude: spec.excludeTools ? Object.freeze([...spec.excludeTools]) : undefined,
+        defer: spec.deferTools ? Object.freeze([...spec.deferTools]) : undefined,
+        alwaysLoad: spec.alwaysLoadTools ? Object.freeze([...spec.alwaysLoadTools]) : undefined,
+    };
+    const promptProfile = resolveModelPromptTraits({ id: "" }, spec, internals).promptProfile;
+    if (spec.resumeAt !== undefined) {
+        if (resume) {
+            const e = new Error("resumeAt cannot be combined with a durable resume");
+            e.code = "resume_at.conflicts_resume";
+            throw e;
+        }
+        if (!spec.sessionId) {
+            const e = new Error("resumeAt requires a sessionId (the session to branch)");
+            e.code = "resume_at.no_session";
+            throw e;
+        }
+    }
+    assertReadFaceValue(spec.readFace, "TaskSpec.readFace");
+    assertReadFaceValue(deps.readFace, "readFace (deployment seat)");
+    if (spec.resumeAtMode !== undefined) {
+        if (spec.resumeAt === undefined) {
+            const e = new Error(`resumeAtMode "${spec.resumeAtMode}" requires resumeAt (there is no branch target to position against)`);
+            e.code = "resume_at.mode_without_target";
+            throw e;
+        }
+        if (spec.resumeAtMode !== "at" && spec.resumeAtMode !== "before") {
+            const e = new Error(`resumeAtMode "${String(spec.resumeAtMode)}" is invalid — expected "at" (inclusive branch, the default) or "before" (exclusive branch)`);
+            e.code = "resume_at.invalid_mode";
+            throw e;
+        }
+    }
+    if (spec.toolMaterializeStrategy !== undefined && spec.toolMaterializeStrategy !== "swap" && spec.toolMaterializeStrategy !== "static") {
+        const e = new Error(`toolMaterializeStrategy must be "swap" or "static" (got ${JSON.stringify(spec.toolMaterializeStrategy)}).`);
+        e.code = "config.tool_materialize_invalid";
+        throw e;
+    }
+    if (spec.memoryPersistenceCapable !== undefined && typeof spec.memoryPersistenceCapable !== "boolean") {
+        const e = new Error(`memoryPersistenceCapable must be a boolean when present (got ${JSON.stringify(spec.memoryPersistenceCapable)}) — a non-boolean would silently read as capable.`);
+        e.code = "config.memory_persistence_invalid";
+        throw e;
+    }
+    if (spec.toolMaterializeStrategy === "static" && spec.deferSelfResolve === false) {
+        const e = new Error(`toolMaterializeStrategy "static" cannot be combined with deferSelfResolve: false — with the direct-call ` +
+            `lane disabled a placeholder is never swapped and never self-resolves, so no deferred tool could ever be ` +
+            `called. Use "swap", or leave deferSelfResolve on.`);
+        e.code = "config.tool_materialize_unreachable";
+        throw e;
+    }
+    if (resume === undefined && spec.objective.trim().length === 0) {
+        const e = new Error("TaskSpec.objective is empty — a task needs an instruction (an empty user message is rejected by strict model endpoints and would fail every later request of the session).");
+        e.code = "config.empty_objective";
+        throw e;
+    }
+    const lockedPreflight = preflightLockedConfig(spec, deps);
+    assertRetentionCapability({
+        policy: deps.retentionPolicy,
+        locked: lockedPreflight.lockedKeys.has("retentionPolicy"),
+        stores: [
+            { name: "sessionStore", store: sessions },
+            { name: "checkpointStore", store: resolveCheckpointStore(spec, deps) },
+            { name: "toolResultStore", store: deps.toolResultStore },
+        ],
+    });
+    const resolvedInteractionPosture = spec.interactionPosture ?? internals?.parentInteractionPosture ?? deps.interactionPosture;
+    {
+        const interactionPosture = resolvedInteractionPosture;
+        const discloseInteractionPostureRefusal = (err) => {
+            try {
+                deps.onError?.(err, { phase: "config", sessionId: spec.sessionId ?? "(pre-session)", classification: "interaction-posture-refused" });
+            }
+            catch {
+            }
+        };
+        if (interactionPosture !== undefined && interactionPosture !== "interactive" && interactionPosture !== "headless") {
+            const e = new Error(`interactionPosture ${JSON.stringify(interactionPosture)} is not a recognized posture ("interactive" | "headless") — ` +
+                `an unevaluable declaration is refused loudly, never folded to either posture.`);
+            e.code = "config.interaction_posture";
+            discloseInteractionPostureRefusal(e);
+            throw e;
+        }
+        if (interactionPosture === "interactive") {
+            const askDoor = resolveAskSeamForm(spec, deps);
+            const humanReachable = deriveAskEffective(askDoor.form, "unresolved") === "human_reachable";
+            const questionDoor = resolveQuestionSeam(spec, deps);
+            const strippedByEngine = internals?.questionFaceStripped === true;
+            if (spec.interactiveTools === false) {
+                const e = new Error(`interaction posture "interactive" declared together with interactiveTools: false — the hard-headless ` +
+                    `clamp removes the AskUserQuestion mount, so no content question can ever reach the human this posture ` +
+                    `promises. Drop one of the two declarations.`);
+                e.code = "config.interaction_posture";
+                discloseInteractionPostureRefusal(e);
+                throw e;
+            }
+            if (!humanReachable || !(questionDoor.wired || strippedByEngine)) {
+                const missing = [];
+                if (!humanReachable) {
+                    missing.push(askDoor.form === "absent"
+                        ? "no onAsk approver is wired (spec.onAsk ?? deps.onAsk is absent — asks would auto-deny or park)"
+                        : `the resolved onAsk seat is the blanket policy "${askDoor.form}" (${askDoor.provenance ?? "?"}) — a policy setting is not a reachable human`);
+                }
+                if (!questionDoor.wired && !strippedByEngine) {
+                    missing.push("no content-question channel (spec.onQuestion ?? deps.onQuestion is absent, and this leg is not an engine-stripped background lane)");
+                }
+                const e = new Error(`interaction posture "interactive" declared, but this assembly cannot reach a human: ${missing.join("; ")}. ` +
+                    `Wire the missing seam(s), or drop the posture declaration (absent = no check).`);
+                e.code = "config.interaction_posture";
+                discloseInteractionPostureRefusal(e);
+                throw e;
+            }
+        }
+    }
+    resolveTaskLimits(spec.limits);
+    if (spec.resourceSuspend !== undefined) {
+        const rsus = spec.resourceSuspend;
+        if (typeof rsus.scope !== "string" || rsus.scope === "") {
+            throw limitConfigError("config.limit_invalid", `TaskSpec.resourceSuspend.scope must be a non-empty string (got ${String(rsus.scope)}) — it is the multi-tenant isolation key every resource checkpoint is filed under.`);
+        }
+        for (const key of ["totalBudgetUsd", "totalTokens", "maxSlices", "ttlMs"]) {
+            const value = rsus[key];
+            if (value === undefined)
+                continue;
+            if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+                throw limitConfigError("config.limit_invalid", `TaskSpec.resourceSuspend.${key} must be a finite, non-negative number (got ${String(value)}) — an unevaluable allocation is not an allocation, and a NaN here blinds even the validated per-slice window.`);
+            }
+        }
+    }
+    const usageWindows = resolveUsageWindows(deps.usageWindows);
+    const brainCallGuardrailRef = {};
+    const brainCallGuardrailMs = resolveBrainCallGuardrailMs(spec.limits?.brainCallGuardrailMs ?? deps.brainCallGuardrailMs);
+    if (spec.agents !== undefined && spec.agents.length > 0) {
+        const pool = spec.tools ?? [];
+        if (!pool.some((t) => typeof t.withAgents === "function")) {
+            const e = new Error(`TaskSpec.agents was provided but no delegation tool (createSubagentTool) is mounted in spec.tools — the per-task agents could never be offered. Mount the delegation tool, or drop spec.agents.`);
+            e.code = "config.agents.no_delegation_tool";
+            throw e;
+        }
+        const perTask = spec.agents;
+        spec = { ...spec, tools: pool.map((t) => (typeof t.withAgents === "function" ? t.withAgents(perTask) : t)) };
+    }
+    const resolvedRole = resolveTaskModel(spec, deps);
+    const model = resolvedRole.model;
+    const fableMitigations = resolveModelPromptTraits(model, spec, internals).fableMitigations;
+    const thinking = spec.thinking ?? resolvedRole.thinking ?? model.defaultThinking;
+    const compModel = spec.compactionModel
+        ? resolveModel(spec.compactionModel, deps.models)
+        : roleModelIfSet("summarize", spec, deps);
+    return {
+        spec,
+        toolFaceSnapshot,
+        promptProfile,
+        lockedPreflight,
+        resolvedInteractionPosture,
+        resolvedRole,
+        model,
+        thinking,
+        compModel,
+        fableMitigations,
+        usageWindows,
+        brainCallGuardrailRef,
+        brainCallGuardrailMs,
+    };
+}

package/dist/core/runner/prepare-safety-scan.d.ts

@@ -0,0 +1,53 @@
+import type { RunnerDeps, TaskSpec, ToolEffect } from "../types.js";
+/** The namespaced-name shapes the protocol table currently owns, rendered for the two messages that have
+ *  to name them (the caller-name reservation and the policy audit's unprefixed-name arm). Read from the
+ *  table rather than written out: a message that hard-codes ONE protocol becomes wrong — while staying
+ *  green — the moment a second one is appended, and both messages tell a deployment what to write. */
+export declare const NAMESPACED_NAME_SHAPES: string;
+export interface PrepareSafetyScanInput {
+    /** borrowed-readonly — the REBOUND spec (`spec′`, the config-doors result). The scan reads
+     *  `tools`, `handsReadOnly` and `enablePlanMode`; it never mutates. */
+    spec: TaskSpec;
+    /** borrowed-readonly — read only for the hands-enablement fact (`executionEnvFactory`/
+     *  `executionEnv` presence gates the hand-band effect preseed). */
+    deps: RunnerDeps;
+}
+/**
+ * The scan's outputs. Ownership annotations (design/238 §4.2 four-class form):
+ *
+ * `ownToolNames` is **borrowed-readonly** — a first-await snapshot with no mutation anywhere after
+ * the scan; its one later read is the sandbox-boundary predicate's `.has()`.
+ *
+ * The six collections are **borrowed-mutable**: the driver and later phases fold into them IN
+ * PLACE (identity is part of the contract — closures alias these exact objects). Mutation owners
+ * after this phase, in driver order:
+ *  · the workflow mount (registers the run-workflow tool's write effect);
+ *  · the MCP/A2A materialize fold + the runtime refresh seam (protocol-axis tighten registration;
+ *    on refresh, `toolEffects.delete` resets a replaced tool's effect record for the fresh fold —
+ *    the irreversible/egress sets deliberately KEEP their entries, the tighten-only residue);
+ *  · the hands/read-face block's shellGate fold (Bash/Monitor tier escalation + probe seeding);
+ *  · the background-task / Monitor / worktree mounts (fixed-name effect registration);
+ *  · the prepare-final effect sync (fills MISSING entries from the final tool set — never
+ *    overrides a scanned value).
+ */
+export interface PrepareSafetyScanResult {
+    /** borrowed-mutable — per-tool effect registry (alias-complete), the reconcile/path-policy read. */
+    toolEffects: Map<string, ToolEffect>;
+    /** borrowed-mutable — egress-marked tools (external writes; the gate never auto-allows them). */
+    egressTools: Set<string>;
+    /** borrowed-mutable — tools whose effect is irreversible (`always`, or `maybe` incl. by probe). */
+    irreversibleTools: Set<string>;
+    /** borrowed-mutable — static per-tool irreversibility tier (prepare-time resolution). */
+    irreversibilityTier: Map<string, "never" | "maybe" | "always">;
+    /** borrowed-mutable — explicit NEGATIVE axis judgments (report-face only; `riskAxesOf` reads). */
+    axisExplicitNegatives: Map<string, {
+        irreversible?: false;
+        egress?: false;
+    }>;
+    /** borrowed-mutable — declared reversibility probes by tool name. */
+    reversibilityProbes: Map<string, NonNullable<TaskSpec["tools"]>[number]["reversibilityProbe"]>;
+    /** borrowed-readonly — the caller roster's own names, snapshotted before the first await. */
+    ownToolNames: ReadonlySet<string>;
+}
+/** The B-2 phase body — the safety-scan slice, verbatim (see the module header for the contract). */
+export declare function prepareSafetyScan(input: PrepareSafetyScanInput): PrepareSafetyScanResult;

package/dist/core/runner/prepare-safety-scan.js

@@ -0,0 +1,80 @@
+import { PROTOCOL_TABLE } from "../protocol-table.js";
+import { HAND_TOOL_EFFECTS } from "../../tools/fs/index.js";
+import { OFFLOAD_TOOL_NAME } from "../tool-result-store.js";
+import { PRESENT_PLAN_TOOL_NAME, ENTER_PLAN_MODE_TOOL_NAME } from "../present-plan-tool.js";
+export const NAMESPACED_NAME_SHAPES = PROTOCOL_TABLE.map((ns) => `${ns.prefix}<peer>__<tool>`).join(", ");
+export function prepareSafetyScan(input) {
+    const { spec, deps } = input;
+    const toolEffects = new Map();
+    const ownToolNames = new Set((spec.tools ?? []).map((t) => t.name));
+    const claimedAliases = new Set();
+    const egressTools = new Set();
+    const irreversibleTools = new Set();
+    const irreversibilityTier = new Map();
+    const axisExplicitNegatives = new Map();
+    const reversibilityProbes = new Map();
+    for (const t of spec.tools ?? []) {
+        if (t.name.includes("__")) {
+            const e = new Error(`Tool name "${t.name}" is invalid: "__" is reserved for the engine's protocol tool namespaces (${NAMESPACED_NAME_SHAPES}) and must not appear in a caller tool name.`);
+            e.code = "config.tool_name_invalid";
+            throw e;
+        }
+        if (t.effect) {
+            toolEffects.set(t.name, t.effect);
+        }
+        const tier = t.irreversibility ?? (t.reversibilityProbe ? "maybe" : undefined);
+        if (tier !== undefined) {
+            irreversibilityTier.set(t.name, tier);
+            if (tier === "always" || tier === "maybe")
+                irreversibleTools.add(t.name);
+        }
+        if (t.reversibilityProbe)
+            reversibilityProbes.set(t.name, t.reversibilityProbe);
+        if (t.egress) {
+            if (t.effect !== undefined && t.effect !== "write") {
+                const e = new Error(`Tool "${t.name}" declares egress:true with effect:"${t.effect}" — an egress tool (external write) must have effect:"write" (or omit effect; write is the default).`);
+                e.code = "config.egress_requires_write_effect";
+                throw e;
+            }
+            egressTools.add(t.name);
+        }
+        for (const alias of t.aliases ?? []) {
+            if (alias === t.name || ownToolNames.has(alias))
+                continue;
+            if (claimedAliases.has(alias))
+                continue;
+            claimedAliases.add(alias);
+            if (t.effect)
+                toolEffects.set(alias, t.effect);
+            if (tier !== undefined) {
+                irreversibilityTier.set(alias, tier);
+                if (tier === "always" || tier === "maybe")
+                    irreversibleTools.add(alias);
+            }
+            if (t.reversibilityProbe)
+                reversibilityProbes.set(alias, t.reversibilityProbe);
+            if (t.egress)
+                egressTools.add(alias);
+        }
+    }
+    toolEffects.set(OFFLOAD_TOOL_NAME, "read");
+    if (deps.executionEnvFactory || deps.executionEnv) {
+        for (const [name, effect] of Object.entries(HAND_TOOL_EFFECTS))
+            toolEffects.set(name, effect);
+        if (spec.handsReadOnly === true)
+            toolEffects.set("Bash", "read");
+    }
+    if (spec.enablePlanMode === true) {
+        toolEffects.set(PRESENT_PLAN_TOOL_NAME, "read");
+        toolEffects.set(ENTER_PLAN_MODE_TOOL_NAME, "read");
+    }
+    return {
+        toolEffects,
+        egressTools,
+        irreversibleTools,
+        irreversibilityTier,
+        axisExplicitNegatives,
+        reversibilityProbes,
+        ownToolNames,
+    };
+}

package/dist/core/runner/prepare-task.d.ts

@@ -5,14 +5,14 @@ import { type AutoModeDecider } from "../auto-mode.js";
 import { type MaterializedMcp } from "../mcp.js";
 import { type MaterializedA2a } from "../a2a.js";
 import type { HarvestReport, MemorySessionHandle } from "../memory-engine/types.js";
-import { StoredSession } from "../session.js";
+import type { StoredSession } from "../session.js";
 import type { SessionStore } from "../session.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import type { OnAsk, ToolCallRequest, ToolPolicy } from "../tool-policy.js";
 import { type ActiveSkillFrame } from "./active-skill-scope.js";
 import type { SessionPermissionRules } from "../session-policy-store.js";
 import { type Hooks, type OrgGateVerdict } from "../hooks.js";
-import { type RecoveredOrphan } from "../session-reconcile.js";
+import type { RecoveredOrphan } from "../session-reconcile.js";
 import { CacheBreakDetector, type ToolFingerprintInput } from "../cache-break-detector.js";
 import { type BrainCallGuardrailRef } from "../../brain/timeout.js";
 import { type OutputRef, type BlockedRef, type SkillListingEntry } from "./synthetic-tools.js";
@@ -20,30 +20,21 @@ import type { MemoryEngine } from "../memory-engine/engine.js";
 import { type ToolManifestRow } from "../../prompt-assembly/tool-catalog.js";
 import type { ToolDisclosureManifest } from "../trace.js";
 import type { TaskNotificationPayload } from "../task-notification.js";
-import { type CwdRef } from "../../tools/fs/index.js";
+import { type CwdRef, type ReadFace } from "../../tools/fs/index.js";
 import { type WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import type { Runner } from "./runtask.js";
 import { type CheckpointGate, type CheckpointState, type CheckpointToken, type ResourceLedger, type PlatformLimitReason, type ResourceLimitReason } from "../checkpoint-store.js";
 import { type WiringManifest } from "../wiring-manifest.js";
 import type { ActiveWorktreeSession, AgentMessage, AgentTool, ExecutionEnv } from "../../internal/harness.js";
-import type { NestedUsageAccum, RunnerDeps, TaskEvent, TaskLimits, TaskResult, TaskSpec, ToolActivity, ToolEffect } from "../types.js";
+import type { NestedUsageAccum, RunnerDeps, TaskEvent, TaskResult, TaskSpec, ToolActivity, ToolEffect } from "../types.js";
 import type { RepairBundle } from "../../agents/repair-loop.js";
 /** Test seam (mirrors `__resetBashTimeoutAnnouncements`): never called by production code. */
 export declare function __resetMaterializeEnvAnnouncements(): void;
-/**
- * design/164 — validate `TaskSpec.limits` at the door and return it unchanged.
- *
- * Two refusals, both fail-loud (the {@link resolveStallTimeoutMs} posture: a bound nobody can evaluate is
- * not a bound, and folding it to a default would silently run the task under limits nobody chose):
- *  - **unknown key** ⇒ `config.limit_unknown_key`. TypeScript already rejects a stale key, but a wire /
- *    plain-JS caller does not go through TypeScript, and the retired names (`timeoutSec` above all) used
- *    to be honored — accepting them silently is how a caller keeps believing a limit is armed when the
- *    engine has stopped reading it.
- *  - **unevaluable numeric value** (non-number / non-finite / negative) ⇒ `config.limit_invalid`, naming
- *    the key. `0` is legal on every numeric axis: on `maxTurns` it is the documented "unbounded"
- *    sentinel, and on the budget axes it is an exhausted window (absurd but honest).
- */
-export declare function resolveTaskLimits(limits: TaskLimits | undefined): TaskLimits | undefined;
+/** Test seam (mirrors `__resetMalformedNoticeSeatAnnouncement`): never called by production code.
+ *  Deliberately asymmetric — it resets only the console latch: the WeakSet arm needs no seam
+ *  because a test resets it by minting a fresh sink function (identity IS the ledger key), while
+ *  the console arm's key is the process itself, which only this seam can refresh. */
+export declare function __resetReadFaceClampAnnouncement(): void;
 /**
  * design/164 件四 — how long before an execution environment's declared `lifetimeMs` expires the engine
  * stops the run and checkpoints it. The margin has to cover ONE suspend: pausing/snapshotting the
@@ -138,6 +129,8 @@ export declare function checkpointScopeOf(spec: {
     principal?: string;
 }): string;
 export { resolveCheckpointStore } from "../checkpoint-store.js";
+export { isFableFamilyModelId, resolveModelPromptTraits, resolveTaskLimits } from "./prepare-config-doors.js";
+export { rebaseWorkspacePath, rebaseWorkspacePathAcross } from "./prepare-workspace-restore.js";
 /** Everything the run loop needs, built once by {@link prepareTask} (task setup, isolated from the loop). */
 export interface Prepared {
     harness: AgentHarness;
@@ -193,6 +186,16 @@ export interface Prepared {
     /** RB-430-a: prepare-time rewind disclosures (conversation-only branch / no snapshot backend / no file
      *  env), echoed verbatim onto `TaskResult.rewindNotes`. Present only when there is something to say. */
     rewindNotes?: NonNullable<TaskResult["rewindNotes"]>;
+    /** #240 (design/199 v1.1) + #242 — the run's RESOLVED read face for the result observation seat
+     *  (`TaskResult.effectiveReadFace`): `carrierReadFace()`'s value at prepare completion — the hands
+     *  block's single resolution, or the hands-less legs' resolver run (live spec-time facts, with the
+     *  checkpoint seed folded stricter-wins where one exists). Every leg that completes prepare has a
+     *  read posture now — this is what its delegation subtree is clamped by even where no faces mount. */
+    effectiveReadFace?: ReadFace;
+    /** #240 — the normalized deny ADDITIONS in force (deployment ∪ task ∪ checkpoint seed; built-ins
+     *  excluded), echoed on `TaskResult.effectiveReadDenyPatterns`. Present iff non-empty; a defensive
+     *  copy (the wide-scope working array stays the engine's own). */
+    effectiveReadDenyPatterns?: readonly import("../../tools/fs/read-deny.js").NormalizedReadDenyEntry[];
     /** design/99 §E13 — the per-task logical cwd ref when a real shell is mounted (else undefined). The Runner
      *  reads `cwdRef.current` after each tool to detect a `cd` move and emit `workspace_changed`. */
     cwdRef?: CwdRef;
@@ -999,37 +1002,6 @@ export interface InheritedGate {
  * MONOTONICALLY (design/76 §2.2#1 r4 MAJOR-A). Mirrors how `nestedStats`/`resume.seed` thread trusted
  * run-scoped internals through the Runner without touching `TaskSpec`.
  */
-/**
- * R2 双形轴(clay 追加令 2026-07-18): CC 2.1.212's fable-variant prompt gate (b9e —
- * `fable_5_mitigations` capability / claude-mythos-5), ORTHOGONAL to the simple/classic profile.
- * sema is BYOM, so the id may carry provider prefixes ("anthropic/claude-fable-5",
- * "openrouter/anthropic/claude-fable-5"): BOUNDARY-AWARE family match on the last path segment
- * (codex 统一复审 F3 — raw substring classified "vendor/not-claude-fable-5" and "claude-mythos-50"
- * as fable), case-normalized. Recognition set = CC's _Nr (startsWith "claude-fable-") + b9e
- * (mythos-5). R3 system sections fork on the resulting fact.
- */
-export declare function isFableFamilyModelId(id: string): boolean;
-/**
- * RB-50 (CC 2.1.220 启示①, clay 2026-07-25): the SINGLE decision point for the two prompt-shape axes.
- * Both were resolved in separate places with different mechanisms — `promptProfile` off a TaskSpec field,
- * `fableMitigations` off a raw model-id prefix test — so "which shape does this task speak" had no one
- * place to read. CC 2.1.220's counterpart is a model-registry `capabilities` array (one table drives
- * `lean_prompt` + `fable_5_mitigations` alike; anchors/2.1.220/CC-218-220-DIFF.md §2).
- *
- * sema stays BYOM: we cannot key off a capability table for arbitrary model ids, so the RESOLUTION RULES
- * are unchanged — profile: spec > inherited internals > "simple"; mitigations: model family. This is a
- * consolidation, not a behavior change (the axes stay ORTHOGONAL: neither rewrites the other).
- */
-export declare function resolveModelPromptTraits(model: {
-    id: string;
-}, spec: {
-    promptProfile?: "simple" | "classic";
-}, internals?: {
-    promptProfile?: "simple" | "classic";
-}): {
-    promptProfile: "simple" | "classic";
-    fableMitigations: boolean;
-};
 export interface RunInternals {
     /** The live repair bundle from a `runRepairLoop` attempt in flight (attemptCount>0). Serialized onto a
      *  checkpoint minted MID-attempt so a resume re-seeds it; undefined for any non-repair run. */
@@ -1408,9 +1380,11 @@ export interface RunInternals {
      * end with structural data (name/phase/ids) — NEVER args/output (those carry untrusted/host data). NEVER a
      * {@link TaskSpec} field. Absent ⇒ no activity capture (default).
      *
-     * **v1 scope (audit MINOR)**: reaches activity on a FRESH run only — the durable-resume entry (`resumeStream`)
-     * does not thread `internals`, so a resumed leg emits no activity. The workflow display is unaffected (its
-     * agents fail-on-suspend rather than durably resume).
+     * Reaches activity on FRESH and RESUMED runs alike — the durable-resume entry (`resumeStream`) threads
+     * `internals` too (see its parent-constraint re-supply snapshot), so a resumed leg's SUBSEQUENT tool calls
+     * hit this sink. One real boundary remains (#249): the resume's already-approved pending call itself is
+     * executed by `applyResumeDecision`'s own callback, outside the frame-minting harness, so THAT one call
+     * emits no activity.
      */
     onActivity?: (activity: ToolActivity) => void;
     /**
@@ -1429,8 +1403,8 @@ export interface RunInternals {
      * after the durable-resume restore may have re-rooted it. Observe-only: a throwing sink is swallowed (an
      * observation must never fault a prepare that already minted a workspace).
      *
-     * **v1 scope**: same as {@link onActivity} — a FRESH run only; the durable-resume entry (`resumeStream`)
-     * threads no `internals`, so a resumed leg reports nothing.
+     * Like {@link onActivity}, this seat rides `internals` on FRESH and RESUMED runs alike (`resumeStream`
+     * threads it too) — a resumed leg's restore re-fires the observation with the settled root.
      */
     onWorkspaceResolved?: (workspace: ResolvedWorkspace) => void;
 }
@@ -1464,32 +1438,6 @@ export declare function batchContextAt(messages: AgentMessage[], currentId: stri
     batchToolCallIds: string[];
     completedCallIds: string[];
 };
-/**
- * codex 1360 r2-r4 — rebase one checkpointed absolute path from the OLD workspace root onto the RESTORED
- * one (divergent `resumeVM`). POSIX-ONLY by contract: every remote lane's `mountPath` is a container
- * path (e2b/k8s/ssh/adb/local-docker are all Linux targets), so a backslash ANYWHERE in the inputs marks
- * the value outside this function's domain and it returns `p` UNCHANGED — an un-rebased path is honestly
- * observable (the divergence observation already fired) while a WRONGLY-rebased one silently corrupts
- * cwd/read-state (r4: drive-root and cross-family recomposition are not implementable without a Windows
- * path model no lane needs). Trailing slashes are tolerated (from="/app/" must not weld the suffix);
- * bare "/" keeps filesystem-root semantics; a path outside `from` (incl. the prefix-sibling
- * "/application" vs "/app") returns unchanged. Exported for direct unit pinning.
- */
-export declare function rebaseWorkspacePath(p: string, fromRaw: string, toRaw: string): string;
-/**
- * RB-439-c — {@link rebaseWorkspacePath} over a SET of accepted spellings of the old root: the first
- * prefix that actually matches wins, and a path under none of them is returned unchanged.
- *
- * The set exists because "the old root" has no single spelling. `WorkspaceHandle.mountPath` is whatever the
- * adapter called the mount, while the persisted paths being migrated were spelled by whoever produced them
- * (a `cd` the env canonicalized, a Read key resolved through realpath). On a target where the root has an
- * equivalent alias (`/var` ↔ `/private/var`) those disagree while naming the same directory, and a
- * single-prefix rebase then matched nothing and silently left the resumed shell in the pre-suspend tree —
- * under a disclosure that said the task follows the restored root. Order is caller-chosen (the checkpointed
- * spelling first, its canonical form second) and only matters if one prefix is a prefix of another, in
- * which case the earlier — more specific — spelling is the intended one. Exported for direct unit pinning.
- */
-export declare function rebaseWorkspacePathAcross(p: string, froms: readonly string[], to: string): string;
 /**
  * Build everything a task run needs (council design/34 ②: a free function with EXPLICIT deps, not a
  * Runner method — testable and decoupled). Resolves the model/role/thinking, acquires + reconciles the