@sema-agent/core 5.32.0 → 5.33.0

package/dist/core/memory-engine/memory-backend-contract.js

@@ -243,6 +243,39 @@ export async function memoryBackendContract(hooks) {
         assert.strictEqual(after.frontmatter.trust, "untrusted");
         assert.strictEqual(after.rev, next.rev, "provenance participates in the rev (computeEntryRev closure)");
     });
+    defer("projection authority: getByIds carries the OWNING scope; other scopes never list the entry", async () => {
+        const b = await hooks.make();
+        const e = entry("id-auth-0001", "s1", "authored", "authored body", { name: "Authored" });
+        await b.applyPatches([{ op: "add", id: e.id, entry: e }]);
+        const got = await b.getByIds([e.id]);
+        assert.strictEqual(got.length, 1);
+        assert.strictEqual(got[0]?.scope, "s1", "getByIds must carry the owning scope");
+        assert.deepStrictEqual((await b.listHeaders(["s2"])).map((h) => h.id), [], "a foreign scope never lists it");
+    });
+    defer("move immediacy: a cross-scope update moves the WHOLE projection in one transaction (no account lag)", async () => {
+        const b = await hooks.make();
+        const v1 = entry("id-mvnow-001", "s1", "prompt", "in s1");
+        await b.applyPatches([{ op: "add", id: v1.id, entry: v1 }]);
+        const v2 = entry("id-mvnow-001", "s2", "prompt", "in s1");
+        const rep = await b.applyPatches([{ op: "update", id: v1.id, entry: v2, baseRev: v1.rev }]);
+        assert.strictEqual(rep.conflicts.length, 0);
+        assert.strictEqual((await b.listHeaders(["s1"])).length, 0, "the old scope loses it in the same transaction");
+        assert.deepStrictEqual((await b.listHeaders(["s2"])).map((h) => h.id), [v1.id]);
+        const got = await b.getByIds([v1.id]);
+        assert.strictEqual(got.length, 1, "one id ⇒ one entry, mid-move states never observable");
+        assert.strictEqual(got[0]?.scope, "s2");
+    });
+    defer("landing honesty: a suffixed slug collision reports the slug that ACTUALLY landed, and reads agree with it", async () => {
+        const b = await hooks.make();
+        await b.applyPatches([{ op: "add", id: "id-land-0001", entry: entry("id-land-0001", "s1", "spot", "first") }]);
+        const rep = await b.applyPatches([{ op: "add", id: "id-land-0002", entry: entry("id-land-0002", "s1", "spot", "second") }]);
+        const applied = rep.applied.find((a) => a.id === "id-land-0002");
+        assert.ok(applied !== undefined, "the collided add applies (suffixed)");
+        const header = (await b.listHeaders(["s1"])).find((h) => h.id === "id-land-0002");
+        assert.ok(header !== undefined);
+        assert.strictEqual(applied.slug, header.slug, "applied[].slug must be the landing slug the reads serve — never the requested one");
+        assert.notStrictEqual(header.slug, "spot", "the collision really landed on a suffix");
+    });
     defer("search: tied scores order deterministically by id (no arrival-order accident)", async () => {
         const b = await hooks.make();
         await b.applyPatches([

package/dist/core/runner/assemble-result.d.ts

@@ -121,6 +121,13 @@ export interface ResultFlags {
      *  a refused `suspendVM` still ends the task exactly the way it did before — this only stops the eleven
      *  distinct codes from arriving as one anonymous `limits.max_turns_exceeded`. Empty/absent ⇒ the field is omitted. */
     remoteEnvFailures?: TaskResult["remoteEnvFailures"];
+    /** #240 (design/199 v1.1) — the run's effective read posture (resolved face + normalized deny
+     *  additions), echoed on `TaskResult.effectiveReadFace` / `.effectiveReadDenyPatterns`. Pure
+     *  pass-through (assembly neither adds nor filters) and INDEPENDENT of the status/errorCode chain:
+     *  the posture is a fact about the leg that ran, whatever terminal it reached — a post-completion
+     *  spawner folds it stricter-wins into follow-on legs; every other consumer may ignore it. */
+    effectiveReadFace?: TaskResult["effectiveReadFace"];
+    effectiveReadDenyPatterns?: TaskResult["effectiveReadDenyPatterns"];
     /** ruled 2026-08-04 — the usage-governance wait hint carried by the platform terminal the run adopted
      *  (`undefined` for every other cause: an expiring environment has no return time to give, and a store
      *  failure is not a window). Passed as data rather than read back off `threw` so the seat has a typed

package/dist/core/runner/assemble-result.js

@@ -159,5 +159,5 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
     void _internalCompaction;
     if (flags.unpricedSpend)
         delete publicStats.costMicroUsd;
-    return { taskId, sessionId, status, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, blockedReason, errorMessage, errorCode, ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), checkpointToken, checkpointGate, ...(workspaceRestoreMode !== undefined ? { workspaceRestoreMode } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: flags.remoteEnvFailures } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), stats: publicStats };
+    return { taskId, sessionId, status, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, blockedReason, errorMessage, errorCode, ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), checkpointToken, checkpointGate, ...(workspaceRestoreMode !== undefined ? { workspaceRestoreMode } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: flags.remoteEnvFailures } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), stats: publicStats };
 }

package/dist/core/runner/prepare-acquire-reconcile.d.ts

@@ -0,0 +1,72 @@
+/**
+ * design/238 B-3 (P2 相位抽取) — prepareTask's session acquire+reconcile phase. Acquire the session
+ * and, when resuming, reconcile any interrupted (orphan) tool call before the turn. Both are retried
+ * together on a F2 optimistic-lock conflict: a concurrent writer on another instance can move the
+ * leaf during reconcile's append, and the fix can't be applied to a now-stale in-memory view — so we
+ * drop it and **re-wake**. Bounded; exhaustion → the conflict propagates and the task fails with
+ * `errorCode="conflict"` for the caller to retry. The retry loop's WHOLENESS is the T4 invariant
+ * (resume-at validation + rebranch + reconcile re-run as one unit against the fresh view) — pinned
+ * in `prepare-task-phase-pins`.
+ *
+ * Ownership (design/238 相 API 规则件): on SUCCESS the acquired session's ownership transfers whole
+ * to the caller (the driver's forgetOnThrow / the Runner's finish own the cleanup from then on);
+ * every failure path INSIDE this phase drops its own cached view first (`forget`, never `release` —
+ * audit B-17: release deletes the history on the default store), so a throw here never strands a
+ * cached view and never hands out a half-acquired resource.
+ *
+ * Throws pass through unchanged: `resume.session_not_found` (requireExisting fail-loud mapping),
+ * the `resume_at.*` target-validation refusals, and — after the bounded re-wake budget — the
+ * session conflict itself.
+ */
+import { StoredSession } from "../session.js";
+import type { AcquiredSession, SessionStore } from "../session.js";
+import { type RecoveredOrphan } from "../session-reconcile.js";
+import type { TaskSpec, ToolEffect } from "../types.js";
+import type { PrepareResume } from "./prepare-task.js";
+export interface PrepareAcquireReconcileInput {
+    /** borrowed-mutable (service port) — the deployment's session store. This phase's verbs on it are
+     *  the acquire/forget half of the session resource protocol: `acquire` per attempt, `forget` to
+     *  drop a stale cached view on a lost CAS and on the throw path (never `release` — B-17). */
+    sessions: SessionStore;
+    /** borrowed-readonly — the REBOUND spec's four session-addressing fields (窄输入: exactly what the
+     *  slice reads; a new read here must widen this Pick). `sessionId`/`requireExistingSession` drive
+     *  the acquire, `resumeAt`/`resumeAtMode` the §E18 rebranch validation. */
+    spec: Pick<TaskSpec, "sessionId" | "requireExistingSession" | "resumeAt" | "resumeAtMode">;
+    /** borrowed-readonly — the durable-resume seats this phase reads: `leafId` (rewind to the
+     *  suspension point BEFORE reconcile) and `suspendedBatch` (wake-reconcile SKIPS those calls —
+     *  they are resumed, not crash-interrupted). Absent for a fresh/non-durable run. */
+    resume: Pick<PrepareResume, "leafId" | "suspendedBatch"> | undefined;
+    /** borrowed-readonly here — the safety scan's effect registry (its mutation-owner table lives on
+     *  {@link import("./prepare-safety-scan.js").PrepareSafetyScanResult}); reconcile classifies an
+     *  orphaned call's retry-safety by it. */
+    toolEffects: Map<string, ToolEffect>;
+}
+/** The phase's outputs (design/238 相 API 规则件 four-class form). All five are fresh bindings —
+ *  the driver destructures them into consts, so a consumer moved ahead of this call is a lexical
+ *  error, which is the static guarantee the extraction keeps. */
+export interface PrepareAcquireReconcileResult {
+    /** owned (resource handover) — the store's acquired session. Handover happens ONLY on return:
+     *  every throw inside the phase already forgot its own cached view. */
+    acquired: AcquiredSession;
+    /** owned — the conflict-proxy-wrapped view over `acquired`'s storage (engine-internal: prepare
+     *  always wraps storage in the concrete built-in — the epoch pin needs its
+     *  append/getPromptEpoch). Aliases `acquired.session`'s storage through the proxy. */
+    session: StoredSession;
+    /** owned cell — flipped to `hit: true` by the conflict-detecting proxy installed inside `session`
+     *  whenever a RUN-time write loses the optimistic lock (identity is contract: the proxy closes
+     *  over this exact object; the run loop reads it into `errorCode="conflict"`). */
+    conflictRef: {
+        hit: boolean;
+    };
+    /** owned — scan-1/A5: what the wake/crash reconcile closed, handed to the run loop so it can mint
+     *  the matching stream frames (see `Prepared.wakeRecovered`). Written by the acquire attempt that
+     *  SUCCEEDS (a conflict-losing attempt re-wakes and re-derives the whole set from the fresh
+     *  branch), and stays empty for a fresh session / a clean one with nothing to reconcile. */
+    wakeRecovered: RecoveredOrphan[];
+    /** owned — §E18 `"before"` mode: the validated target's parentId — the new conversation leaf, and
+     *  the E19 file-anchor walk's starting point (consumed by the rewind-restore block after env
+     *  setup). `null` outside `"before"` mode. */
+    resumeAtBeforeParentId: string | null;
+}
+/** The B-3 phase body — the acquire+reconcile slice, verbatim (see the module header for the contract). */
+export declare function prepareAcquireReconcile(input: PrepareAcquireReconcileInput): Promise<PrepareAcquireReconcileResult>;

package/dist/core/runner/prepare-acquire-reconcile.js

@@ -0,0 +1,126 @@
+import { StoredSession, isSessionConflict } from "../session.js";
+import { reconcileInterruptedSession } from "../session-reconcile.js";
+const RECONCILE_MAX_RETRIES = 3;
+function detectConflicts(storage, ref) {
+    const guard = (fn) => async (...args) => {
+        try {
+            return await fn(...args);
+        }
+        catch (err) {
+            if (isSessionConflict(err)) {
+                ref.hit = true;
+            }
+            throw err;
+        }
+    };
+    return new Proxy(storage, {
+        get(target, prop, receiver) {
+            const value = Reflect.get(target, prop, receiver);
+            if (typeof value !== "function") {
+                return value;
+            }
+            const bound = value.bind(target);
+            return prop === "appendEntry" || prop === "setLeafId"
+                ? guard(bound)
+                : bound;
+        },
+    });
+}
+export async function prepareAcquireReconcile(input) {
+    const { sessions, spec, resume, toolEffects } = input;
+    let acquired;
+    let session;
+    let conflictRef;
+    let wakeRecovered = [];
+    let resumeAtBeforeParentId = null;
+    for (let attempt = 0;; attempt++) {
+        try {
+            acquired = await sessions.acquire(spec.sessionId, spec.requireExistingSession ? { requireExisting: true } : undefined);
+        }
+        catch (err) {
+            if (spec.requireExistingSession && err?.code === "not_found") {
+                const e = new Error(`requireExistingSession: session "${spec.sessionId}" does not exist — refusing a silent fresh run (design/114 Phase3)`);
+                e.code = "resume.session_not_found";
+                throw e;
+            }
+            throw err;
+        }
+        conflictRef = { hit: false };
+        session = new StoredSession(detectConflicts(acquired.session.getStorage(), conflictRef));
+        if (!spec.sessionId) {
+            break;
+        }
+        try {
+            if (resume) {
+                await session.getStorage().setLeafId(resume.leafId);
+            }
+            else if (spec.resumeAt !== undefined) {
+                const entry = await session.getEntry(spec.resumeAt);
+                if (!entry) {
+                    const e = new Error(`resumeAt entry "${spec.resumeAt}" not found in session "${spec.sessionId}"`);
+                    e.code = "resume_at.not_found";
+                    throw e;
+                }
+                if (entry.type !== "message" && entry.type !== "custom_message") {
+                    const e = new Error(`resumeAt entry "${spec.resumeAt}" is a "${entry.type}" entry; resume-at requires a message boundary`);
+                    e.code = "resume_at.not_a_message";
+                    throw e;
+                }
+                if (entry.type === "message") {
+                    const msg = entry.message;
+                    if (msg?.role === "toolResult") {
+                        const e = new Error(`resumeAt entry "${spec.resumeAt}" is a tool-result (mid-turn); resume-at requires a settled turn boundary (a user message or a finished assistant turn)`);
+                        e.code = "resume_at.not_a_message";
+                        throw e;
+                    }
+                    if (msg?.role === "assistant" && Array.isArray(msg.content) && msg.content.some((p) => p?.type === "toolCall")) {
+                        const e = new Error(`resumeAt entry "${spec.resumeAt}" ends a turn mid-tool-call; resume-at requires a settled turn boundary`);
+                        e.code = "resume_at.not_a_message";
+                        throw e;
+                    }
+                }
+                if (spec.resumeAtMode === "before") {
+                    const role = entry.type === "message" ? entry.message.role : undefined;
+                    if (role !== "user") {
+                        const kind = entry.type === "message" ? `role "${String(role)}" message` : `"${entry.type}" entry`;
+                        const e = new Error(`resumeAt entry "${spec.resumeAt}" is a ${kind}; resumeAtMode "before" supports only USER-message targets (the exclusive-rewind shape: the removed message is a user message)`);
+                        e.code = "resume_at.before_target_not_user";
+                        throw e;
+                    }
+                    let ancestorId = entry.parentId;
+                    let sawConversationAbove = false;
+                    while (ancestorId !== null) {
+                        const ancestor = await session.getEntry(ancestorId);
+                        if (!ancestor)
+                            break;
+                        if (ancestor.type === "message" || ancestor.type === "custom_message") {
+                            sawConversationAbove = true;
+                            break;
+                        }
+                        ancestorId = ancestor.parentId;
+                    }
+                    if (!sawConversationAbove) {
+                        const e = new Error(`resumeAt entry "${spec.resumeAt}" is the session's first message; resumeAtMode "before" cannot rewind past the session root — start a NEW session instead`);
+                        e.code = "resume_at.before_root_unsupported";
+                        throw e;
+                    }
+                    resumeAtBeforeParentId = entry.parentId;
+                }
+                await session.getStorage().setLeafId(spec.resumeAtMode === "before" ? entry.parentId : spec.resumeAt);
+            }
+            wakeRecovered = (await reconcileInterruptedSession(session, toolEffects, resume?.suspendedBatch)).recovered;
+            break;
+        }
+        catch (err) {
+            if (isSessionConflict(err) && attempt < RECONCILE_MAX_RETRIES) {
+                if (sessions.forget) {
+                    await Promise.resolve(sessions.forget(spec.sessionId)).catch(() => undefined);
+                }
+                continue;
+            }
+            await Promise.resolve(sessions.forget ? sessions.forget(acquired.sessionId) : undefined).catch(() => undefined);
+            throw err;
+        }
+    }
+    return { acquired, session, conflictRef, wakeRecovered, resumeAtBeforeParentId };
+}

package/dist/core/runner/prepare-config-doors.d.ts

@@ -0,0 +1,140 @@
+/**
+ * design/238 B-1 (P0 相位抽取) — prepareTask's config-doors phase: the synchronous stretch from the
+ * tool-face snapshot freeze through model/thinking/compaction-model resolution. The inputs are
+ * exactly the fields of {@link PrepareConfigDoorsInput} (the original extraction slice — spec, deps,
+ * sessions, the resume/internals seats); the outputs are the fields of
+ * {@link PrepareConfigDoorsResult}, each one a value the slice defined and later phases consume —
+ * re-verified as the complete "defined inside, consumed outside" closure at extraction time.
+ *
+ * ⚠️ SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL — a hard constraint, not a style choice. This phase and
+ * the safety scan after it run BEFORE prepareTask's first await (`sessions.acquire`), so a caller
+ * has no microtask window in which to mutate `spec.tools`/the face arrays between the snapshots,
+ * the doors and the scan. An `async` wrapper — even with a zero-await body — would hand the caller
+ * exactly that window (the driver's `await` yields one microtask). Pinned by the
+ * `prepare-task-phase-pins` microtask-latch tests.
+ *
+ * Throws pass through unchanged: every `config.*` / `resume_at.*` refusal here is a DELIBERATE
+ * at-the-door rejection (design/99 §E18 — a throw before acquisition needs no cleanup), and the
+ * interaction-posture door's `deps.onError` disclosure (call order and payload) is part of the
+ * contract. The per-task agents rebind returns a REBOUND spec (shallow copy, only `tools`
+ * replaced) — the caller's object is never mutated; the safety scan must receive the rebound one.
+ */
+import { type BrainCallGuardrailRef } from "../../brain/timeout.js";
+import type { Model } from "../../internal/llm.js";
+import type { ThinkingLevel } from "../../internal/harness.js";
+import { type LockedPreflight } from "../locked-config.js";
+import { type ResolvedRole } from "../roles.js";
+import type { SessionStore } from "../session.js";
+import type { RunnerDeps, TaskLimits, TaskSpec } from "../types.js";
+import { type UsageWindow } from "../usage-window-store.js";
+import type { PrepareResume, RunInternals } from "./prepare-task.js";
+export declare function limitConfigError(code: string, message: string): Error & {
+    code?: string;
+};
+/**
+ * design/164 — validate `TaskSpec.limits` at the door and return it unchanged.
+ *
+ * Two refusals, both fail-loud (the {@link resolveStallTimeoutMs} posture: a bound nobody can evaluate is
+ * not a bound, and folding it to a default would silently run the task under limits nobody chose):
+ *  - **unknown key** ⇒ `config.limit_unknown_key`. TypeScript already rejects a stale key, but a wire /
+ *    plain-JS caller does not go through TypeScript, and the retired names (`timeoutSec` above all) used
+ *    to be honored — accepting them silently is how a caller keeps believing a limit is armed when the
+ *    engine has stopped reading it.
+ *  - **unevaluable numeric value** (non-number / non-finite / negative) ⇒ `config.limit_invalid`, naming
+ *    the key. `0` is legal on every numeric axis: on `maxTurns` it is the documented "unbounded"
+ *    sentinel, and on the budget axes it is an exhausted window (absurd but honest).
+ */
+export declare function resolveTaskLimits(limits: TaskLimits | undefined): TaskLimits | undefined;
+/**
+ * R2 双形轴(clay 追加令 2026-07-18): CC 2.1.212's fable-variant prompt gate (b9e —
+ * `fable_5_mitigations` capability / claude-mythos-5), ORTHOGONAL to the simple/classic profile.
+ * sema is BYOM, so the id may carry provider prefixes ("anthropic/claude-fable-5",
+ * "openrouter/anthropic/claude-fable-5"): BOUNDARY-AWARE family match on the last path segment
+ * (codex 统一复审 F3 — raw substring classified "vendor/not-claude-fable-5" and "claude-mythos-50"
+ * as fable), case-normalized. Recognition set = CC's _Nr (startsWith "claude-fable-") + b9e
+ * (mythos-5). R3 system sections fork on the resulting fact.
+ */
+export declare function isFableFamilyModelId(id: string): boolean;
+/**
+ * RB-50 (CC 2.1.220 启示①, clay 2026-07-25): the SINGLE decision point for the two prompt-shape axes.
+ * Both were resolved in separate places with different mechanisms — `promptProfile` off a TaskSpec field,
+ * `fableMitigations` off a raw model-id prefix test — so "which shape does this task speak" had no one
+ * place to read. CC 2.1.220's counterpart is a model-registry `capabilities` array (one table drives
+ * `lean_prompt` + `fable_5_mitigations` alike; anchors/2.1.220/CC-218-220-DIFF.md §2).
+ *
+ * sema stays BYOM: we cannot key off a capability table for arbitrary model ids, so the RESOLUTION RULES
+ * are unchanged — profile: spec > inherited internals > "simple"; mitigations: model family. This is a
+ * consolidation, not a behavior change (the axes stay ORTHOGONAL: neither rewrites the other).
+ */
+export declare function resolveModelPromptTraits(model: {
+    id: string;
+}, spec: {
+    promptProfile?: "simple" | "classic";
+}, internals?: {
+    promptProfile?: "simple" | "classic";
+}): {
+    promptProfile: "simple" | "classic";
+    fableMitigations: boolean;
+};
+export interface PrepareConfigDoorsInput {
+    /** borrowed-readonly — the caller's spec. NEVER mutated here: the per-task agents rebind returns a
+     *  SHALLOW COPY on {@link PrepareConfigDoorsResult.spec} (only `tools` replaced). */
+    spec: TaskSpec;
+    /** borrowed-readonly — deployment seats. Read for: readFace value screen, locked-config preflight,
+     *  retention door, interaction-posture door (incl. `deps.onError` disclosure), usage windows,
+     *  brain-call guardrail default, model/role maps. */
+    deps: RunnerDeps;
+    /** borrowed-readonly — the retention door validates THIS store's declaration (it is one of the
+     *  effective stores the leg would run over). No acquire happens in this phase. */
+    sessions: SessionStore;
+    /** borrowed-readonly — presence gates the resumeAt-conflict door and exempts the empty-objective
+     *  door (a checkpoint resume passes `objective: ""` by design). */
+    resume?: PrepareResume | undefined;
+    /** borrowed-readonly — trusted engine channel: prompt-profile inheritance, the spawning run's
+     *  interaction posture, the engine question-strip flag. */
+    internals?: RunInternals | undefined;
+}
+export interface PrepareConfigDoorsResult {
+    /** owned (by the caller, from here on) — the REBOUND spec: identical to the input object unless
+     *  `spec.agents` was set, in which case it is a shallow copy whose `tools` is the
+     *  withAgents-rebuilt roster. Every later phase (the safety scan above all — T21) must read THIS,
+     *  never the original input. */
+    spec: TaskSpec;
+    /** owned — the frozen task-start snapshot of the caller's tool-face control arrays; the ONLY thing
+     *  later face reads consult (own-task filter, defer classify, delegation ctx). Frozen-immutable ⇒
+     *  shared by reference into tool execution ctxs. */
+    toolFaceSnapshot: {
+        exclude: readonly string[] | undefined;
+        defer: readonly string[] | undefined;
+        alwaysLoad: readonly string[] | undefined;
+    };
+    /** owned — the profile half of the RB-50 single decision point (model-independent by contract). */
+    promptProfile: "simple" | "classic";
+    /** owned — the administrator lock snapshot; the rest of prepare reads guarded slots through it. */
+    lockedPreflight: LockedPreflight;
+    /** owned — the resolved interaction posture (spec > spawning run > deployment); the
+     *  AskUserQuestion mount and the child-ctx injection read this same value. */
+    resolvedInteractionPosture: "interactive" | "headless" | undefined;
+    /** owned — the resolved role; its `systemPrompt` seat is still read at prompt-input time. */
+    resolvedRole: ResolvedRole;
+    /** owned — the resolved main model (`resolvedRole.model`, re-exposed as the name every later
+     *  phase reads). */
+    model: Model;
+    /** owned — caller-explicit > role default > model default; undefined = off. */
+    thinking: ThinkingLevel | undefined;
+    /** owned — the compaction model: explicit wins, else the `summarize` role, else undefined (main
+     *  model fallback inside maybeCompact). NOT derivable from {@link resolvedRole}. */
+    compModel: Model | undefined;
+    /** owned — the mitigations half of the RB-50 decision point (model-family fact). */
+    fableMitigations: boolean;
+    /** owned — validated deployment governance windows (undefined = ungoverned). */
+    usageWindows: readonly UsageWindow[] | undefined;
+    /** owned, out-param cell — created EMPTY here; the brain-call wiring later installs into
+     *  `.current`. Returned so driver and harness share one cell identity. */
+    brainCallGuardrailRef: BrainCallGuardrailRef;
+    /** owned — the resolved outer brain-call guardrail (task > deployment > default; undefined per
+     *  the resolver's off states). */
+    brainCallGuardrailMs: number | undefined;
+}
+/** The B-1 phase body — the config-doors slice, verbatim (see the module header for the contract). */
+export declare function prepareConfigDoors(input: PrepareConfigDoorsInput): PrepareConfigDoorsResult;