@sema-agent/core 5.33.0 → 5.35.0

package/dist/core/tool-policy.d.ts

@@ -118,6 +118,34 @@ export type ApprovalSettledBy = "human" | "timeout" | "aborted";
 export declare const APPROVAL_SETTLED_BY_VALUES: readonly ApprovalSettledBy[];
 /** True iff `v` is one of the three {@link ApprovalSettledBy} words. */
 export declare function isApprovalSettledBy(v: unknown): v is ApprovalSettledBy;
+/**
+ * design/252 G-7 — how long an approver-attribution identifier may be.
+ *
+ * Sized for the identifiers approval channels actually carry (a login, an email, an opaque account id,
+ * a queue name) with room to spare, and bounded at all because this value lands on an operator-plane
+ * frame that a deployment may persist: an unbounded field on a record channel is its own denial of a
+ * readable record. An over-long value is REFUSED, never truncated — a cut identifier names a different
+ * party, or nobody, and either is worse than the honest refusal.
+ */
+export declare const APPROVER_ATTRIBUTION_MAX_CHARS = 256;
+/**
+ * design/252 G-7 — screen a deployment-supplied approver identifier before it becomes an observation.
+ *
+ * THE POSTURE, stated so it is not mistaken for something stronger: core does not authenticate this
+ * value, does not compare it to anything, and never reads it back to decide anything. It is a
+ * TRANSCRIPTION of what the approval channel said about its own settlement — the channel (a server's
+ * approval card, an HMAC-verified callback, an operator console) is where identity is established, and
+ * a library that holds no identity surface cannot second-guess it. What core owns is that the value is
+ * a value: a string, bounded, free of control bytes, or else loudly refused.
+ *
+ * Returns `{}` for "nothing supplied" (absent, and an empty string — an id of no characters is the
+ * absence of an id, the same truthiness fold the deny-note seat uses), `{ approver }` for a value to
+ * carry, or `{ defect }` with the sentence a caller puts in its own refusal.
+ */
+export declare function screenApproverAttribution(v: unknown): {
+    approver?: string;
+    defect?: string;
+};
 /**
  * A three-state permission decision for a tool call (design/37). Upgrades the old two-state
  * `{allow|deny}`:
@@ -162,6 +190,7 @@ export type PermissionResult = {
     message?: string;
     decisionReason?: DecisionReason;
     settledBy?: Extract<ApprovalSettledBy, "human">;
+    approver?: string;
 } | {
     action: "ask";
     updatedInput?: unknown;
@@ -199,13 +228,86 @@ export type PermissionResult = {
      *  when ANY folded-away concurrent ask bore it (monotone, tighten-only); it is consumed inside the
      *  gate and deliberately NOT copied onto the park/approval-card request. */
     matchedAskRule?: string;
+    /** design/252 G-2 (additive): the RULE-PROVENANCE evidence behind this ask — see
+     *  {@link AskRuleEvidence}. ENGINE-STAMPED inside the gate, once, after the org layer and the
+     *  persisted-rule lane have both spoken; a policy that self-declares it is overwritten there
+     *  (the member is a record of what the ENGINE's own governance layers did, so a layer's claim
+     *  about itself is not evidence). Carried onto the approval request by the gate's own ask mint
+     *  site. Display/reconciliation metadata, never adjudication input. */
+    ruleEvidence?: AskRuleEvidence;
 } | {
     action: "deny";
     updatedInput?: unknown;
     message?: string;
     decisionReason?: DecisionReason;
     settledBy?: ApprovalSettledBy;
+    approver?: string;
 };
+/**
+ * design/252 G-2 — WHY a piece of rule-provenance evidence is not on an ask.
+ *
+ * The vocabulary exists because a bare `undefined` reads the same for facts that are opposite: "no
+ * governance layer is wired here, so there is nothing to name" and "the layer ran and we could not
+ * read what it said" are not the same audit answer, and collapsing them is how an evidence chain
+ * comes to be reconstructed as "nothing governed this call". Every member of {@link AskRuleEvidence}
+ * therefore ships as a value OR a named absence, never as silence.
+ *
+ *  - `"not_wired"` — the lane does not exist on this leg (an ungoverned deployment, no rule store).
+ *    The field cannot apply; nothing was lost.
+ *  - `"not_adjudicated"` — the lane exists but this call never reached it (an exempt tool, a call
+ *    the rule grammar cannot describe). Applicable in principle, skipped in fact.
+ *  - `"unavailable"` — the lane was consulted and could not read its source. The evidence is LOST,
+ *    not absent, and this is the one member of the vocabulary that means an auditor should treat the
+ *    chain as broken rather than empty.
+ *  - `"no_match"` — consulted, readable, and nothing spoke for this call. A real negative answer.
+ *  - `"not_reported"` — the supplying seam answered without the identity (a foreign overlay/store
+ *    implementation, or one written before the identity was projected). Evidence lost at the seam.
+ */
+export type AskEvidenceAbsence = "not_wired" | "not_adjudicated" | "unavailable" | "no_match" | "not_reported";
+/** The closed set above, for runtime domain checks at the seams that accept a caller-supplied value. */
+export declare const ASK_EVIDENCE_ABSENCE_VALUES: readonly AskEvidenceAbsence[];
+/**
+ * design/252 G-2 — the machine-reconcilable provenance of the governance decision behind ONE ask.
+ *
+ * WHAT THIS IS: a PROJECTION of identity keys the engine's governance layers already hold — the org
+ * snapshot's `revision`, the personal rule's add `dot`s — onto the surface a consumer can actually
+ * read. It performs no new judgment and changes no verdict; removing it would leave every decision
+ * byte-identical. The prose channels ({@link PermissionResult}'s ask `message`,
+ * {@link AskRequest.persistedRuleShadowed}) say the same things to a PERSON; those are sanitized,
+ * capped, display-shaped strings, and reconciling a decision against a published policy revision by
+ * regexing them is not an audit trail. This member is the machine's copy.
+ *
+ * WHAT THIS IS NOT: an authority channel. Nothing in the engine reads it back to decide anything, and
+ * a host that ignores it entirely is governed exactly as before.
+ *
+ * ABSENCE DISCIPLINE (the reason each member has a `…Absent` twin): see {@link AskEvidenceAbsence}.
+ * Exactly one of each pair is present — a member and its absence reason are never both set, and never
+ * both missing, on evidence the engine stamped.
+ */
+export interface AskRuleEvidence {
+    /** The org snapshot `revision` this call was adjudicated against — the published-policy version an
+     *  auditor reconciles the decision against. Absent ⇒ {@link orgRevisionAbsent} names why. */
+    readonly orgRevision?: number;
+    /** Present iff {@link orgRevision} is not. `"unavailable"` here is the load-bearing one: the org
+     *  layer spoke, its answer was "this deployment cannot see the organization's rules", and the ask
+     *  in hand is the fail-closed tighten that followed — not an ask any published rule asked for. */
+    readonly orgRevisionAbsent?: AskEvidenceAbsence;
+    /** The org rule that spoke for this call, verbatim as published (org rules are administrator
+     *  authored and are relayed unmodified — the prose channel's copy is the same text). Absent ⇒
+     *  {@link orgRuleAbsent} names why. */
+    readonly orgRule?: string;
+    /** Present iff {@link orgRule} is not. */
+    readonly orgRuleAbsent?: AskEvidenceAbsence;
+    /** The add dots of the PERSONAL allow rule that matched this call but did not clear the ask (the
+     *  #144 shadowed arm). The dots are the rule's durable identity — unlike
+     *  {@link AskRequest.persistedRuleShadowed}, which is a sanitized, length-capped DISPLAY value and
+     *  deliberately not an identity channel. A rule is a set of adds (concurrent approvals on one text
+     *  each redeem their own dot), so this is an array by construction: render/reconcile the entries as
+     *  data, never re-derive one scalar id by joining them. Absent ⇒ {@link personalRuleDotsAbsent}. */
+    readonly personalRuleDots?: readonly import("./permission-rule-model.js").RuleDot[];
+    /** Present iff {@link personalRuleDots} is not. */
+    readonly personalRuleDotsAbsent?: AskEvidenceAbsence;
+}
 /** The human/model-readable text of a decision. */
 export declare function decisionText(d: PermissionResult): string | undefined;
 /**
@@ -682,6 +784,15 @@ export interface AskRequest {
      *  structure: render the entries as data, never re-derive structure by splitting or joining them.
      *  The durable park route carries the same value as `RiskDescriptor.probeCause`. */
     readonly probeCause?: import("./checkpoint-store.js").ProbeCause;
+    /** design/252 G-2: the RULE-PROVENANCE evidence behind this ask — the org snapshot revision and the
+     *  matched rules' own identity keys, each present as a value or as a named absence (see
+     *  {@link AskRuleEvidence}). Present on EVERY ask the engine mints, so a consumer never has to tell a
+     *  missing field from a field that means something: the gate's own mint site fills it from what its
+     *  layers did, and the three INHERITED-lane sites — which present an ANCESTOR policy's decision, from
+     *  upstream of both lanes — fill it with an all-`"not_adjudicated"` record rather than a fabricated
+     *  revision. Optional on the TYPE only because a deployment may invoke its approver directly.
+     *  RECONCILIATION metadata, never adjudication input. */
+    readonly ruleEvidence?: AskRuleEvidence;
     toolCallId: string;
     /** The (post-rewrite) args the tool would run with. */
     args: unknown;
@@ -859,12 +970,26 @@ export type OnAsk = "deny" | "allow" | ((req: AskRequest, signal?: AbortSignal)
  *    domain the durable leg enforces pre-CAS for the same field), a THROWING read is a fail-closed
  *    deny naming the true cause (never a raw rejection out of the gate), and the empty string reads
  *    as absent (truthiness, the durable consumer's own read).
+ *
+ * `approver` (design/252 G-7) — the ATTRIBUTION seat: the identifier the approval channel reports for
+ * the party that ended this wait. Core does not authenticate it, compare it, or read it back to decide
+ * anything; it transcribes it onto the settlement observation next to `settledBy`, so an audit that can
+ * already say "a person ended this wait" can also say which one, without core growing an identity
+ * surface it deliberately does not have. Read the two together: `settledBy:"timeout"` with an
+ * `approver` names the queue whose window elapsed, NOT someone who refused.
+ * Screened, not trusted (see {@link screenApproverAttribution}): a non-string, an over-long value or one
+ * carrying control characters is a loud fail-closed refusal at {@link resolveAsk}, the same posture this
+ * seam takes for every other out-of-contract value — and the same reason, since a defective attribution
+ * that were quietly dropped would leave a settlement looking unattributed rather than misreported. It is
+ * carried on the arms where the CALLER settled something (its allow, its human/timeout deny) and never
+ * on an end the engine produced (an abort, a throw, an unclonable edit): nobody approved those.
  */
 export type AskOutcome = boolean | "unavailable" | {
     allow: boolean;
     updatedInput?: unknown;
     settledBy?: Extract<ApprovalSettledBy, "human" | "timeout">;
     reason?: string;
+    approver?: string;
 };
 /**
  * ruled 2026-08-04 — forward an approver into a delegated child, stamping every ask it raises with the

package/dist/core/tool-policy.js

@@ -13,6 +13,26 @@ export const APPROVAL_SETTLED_BY_VALUES = ["human", "timeout", "aborted"];
 export function isApprovalSettledBy(v) {
     return typeof v === "string" && APPROVAL_SETTLED_BY_VALUES.includes(v);
 }
+export const APPROVER_ATTRIBUTION_MAX_CHARS = 256;
+const APPROVER_REFUSED_CHARS_RE = /[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028\u2029\u202a-\u202e\u2066-\u2069]/u;
+export function screenApproverAttribution(v) {
+    if (v === undefined || v === "")
+        return {};
+    if (typeof v !== "string") {
+        return { defect: `an approver attribution must be a plain string (got ${v === null ? "null" : typeof v})` };
+    }
+    if (v.length > 2 * APPROVER_ATTRIBUTION_MAX_CHARS || [...v].length > APPROVER_ATTRIBUTION_MAX_CHARS) {
+        return { defect: `an approver attribution is capped at ${APPROVER_ATTRIBUTION_MAX_CHARS} characters and this one is longer; it is refused rather than truncated, because a cut identifier names someone else` };
+    }
+    if (/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/.test(v)) {
+        return { defect: "an approver attribution contains an unpaired surrogate; it is not well-formed text and would collapse to a replacement character in a UTF-8 sink, so two distinct approvers could converge into one record" };
+    }
+    if (APPROVER_REFUSED_CHARS_RE.test(v)) {
+        return { defect: "an approver attribution carries control characters, line separators or bidirectional overrides; an identifier whose bytes can forge a line — or reorder what a reader sees — in whatever renders it is refused" };
+    }
+    return { approver: v };
+}
+export const ASK_EVIDENCE_ABSENCE_VALUES = ["not_wired", "not_adjudicated", "unavailable", "no_match", "not_reported"];
 export function decisionText(d) {
     return d.message;
 }
@@ -899,10 +919,12 @@ export async function resolveAsk(req, onAsk, signal) {
         let supplied;
         let allowed;
         let suppliedEdit;
+        let suppliedApprover;
         try {
             supplied = ok.settledBy;
             allowed = ok.allow;
             suppliedEdit = ok.updatedInput;
+            suppliedApprover = ok.approver;
         }
         catch (err) {
             return {
@@ -930,6 +952,16 @@ export async function resolveAsk(req, onAsk, signal) {
                 settledBy: "aborted",
             };
         }
+        const attribution = screenApproverAttribution(suppliedApprover);
+        if (attribution.defect !== undefined) {
+            return {
+                action: "deny",
+                message: `the approver for "${req.toolName}" reported an attribution this seam refuses: ${attribution.defect}; denied fail-closed`,
+                decisionReason: "mode",
+                settledBy: "aborted",
+            };
+        }
+        const attributionCell = attribution.approver !== undefined ? { approver: attribution.approver } : {};
         if (supplied === "timeout" && allowed === true) {
             return {
                 action: "deny",
@@ -969,10 +1001,11 @@ export async function resolveAsk(req, onAsk, signal) {
                     : humanRefusalMessage(req, reasonText),
                 decisionReason: "mode",
                 settledBy: supplied === "timeout" ? "timeout" : "human",
+                ...attributionCell,
             };
         }
         if (suppliedEdit === undefined)
-            return { action: "allow", decisionReason: "mode", presentedInput: presented.value, settledBy: "human" };
+            return { action: "allow", decisionReason: "mode", presentedInput: presented.value, settledBy: "human", ...attributionCell };
         const edit = tryCloneArgs(suppliedEdit);
         if (!edit.ok) {
             return {
@@ -982,7 +1015,7 @@ export async function resolveAsk(req, onAsk, signal) {
                 settledBy: "aborted",
             };
         }
-        return { action: "allow", updatedInput: edit.value, decisionReason: "mode", settledBy: "human" };
+        return { action: "allow", updatedInput: edit.value, decisionReason: "mode", settledBy: "human", ...attributionCell };
     }
     const okRaw = ok;
     if (okRaw === true)

package/dist/core/types.d.ts

@@ -3437,6 +3437,26 @@ export type TaskEvent = ({
      * must not treat "absent" as "a human decided".
      */
     settledBy?: import("./tool-policy.js").ApprovalSettledBy;
+    /**
+     * design/252 G-7 — WHOSE settlement that was: the identifier the approval channel reported for
+     * the party that ended this wait, beside the {@link settledBy} word that says what KIND of end
+     * it was. The two are read together and neither substitutes for the other:
+     * `settledBy:"timeout"` with an `approver` names the queue whose window elapsed, NOT someone
+     * who refused.
+     *
+     * WHAT CORE PROMISES ABOUT IT — exactly one thing: it is what the settling caller said, screened
+     * for shape (a plain string, bounded, no control characters) and otherwise untouched. Core does
+     * NOT authenticate it, does not compare it to a principal, and never reads it back to decide
+     * anything. Identity is established by the approval channel a deployment integrates (its card,
+     * its signature, its console); this is the transcription that lets an audit which already knows
+     * a person ended a wait also say which person, without the engine growing an identity surface it
+     * deliberately does not have. Treat it accordingly: it is a RECORD of a claim, and its
+     * trustworthiness is exactly the trustworthiness of the channel that made it.
+     *
+     * ABSENT on every frame that settled no approval, and on a settled approval whose channel named
+     * nobody. Absence means nobody SAID — never "nobody approved this", and never "a human did".
+     */
+    approver?: string;
     /**
      * design/99 §E1 — `true` when {@link output} was SIZE-bounded by core (the full body exceeded the cap and
      * was degraded to a truncated string). Lets a consumer detect truncation programmatically instead of
@@ -3876,8 +3896,12 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
     /**
      * Inject a mid-task **steering** message (design/47) that the running task sees at the start of its
      * next turn (delivered via the harness steering queue). Resolves once queued; **throws** (code
-     * `steering.not_running`) if the task hasn't started yet or has already finished — never silently
-     * dropped. By default the text enters as a normal **user** message (in an orchestration the caller IS
+     * `steering.not_running`) once the task has finished (teardown included) — never silently dropped. A
+     * steer issued BEFORE the run has ISSUED ITS FIRST PROMPT is not refused: it is HELD for the birth
+     * window and enters the queue as soon as the loop goes live, so the model sees it at the next turn
+     * boundary like any other steer — it is refused if the loop ends first, or if that BOUNDED wait runs
+     * out while the run still has not started (ruled 2026-08-05; a retry under the same `inputId` is then
+     * clean — a refusal reserves nothing). By default the text enters as a normal **user** message (in an orchestration the caller IS
      * the task's user). Pass `trusted: true` ONLY for operator/system-level guidance: it is wrapped as a
      * `<system-reminder>` (elevated authority) — do NOT use it for caller/third-party content that could
      * carry a prompt injection. The seam gives the channel; the caller owns the judgement (design/43 §6).
@@ -3885,10 +3909,55 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
      * design/171 §5.2 — `actor` attributes WHO steered (a shared session's second voice): the text gets
      * the speaker envelope from the single projection point and the queued message carries the
      * metadata seat. Attribution only, never authority; absent = anonymous (bytes unchanged).
+     *
+     * design/171 §6.3 (additive) — `inputId` is the caller's correlation/idempotency key, the SAME key
+     * space as the parked queue's `PendingSteerEntry.inputId` and the `human_input` event's `inputId`
+     * (an ingress that already minted a message id passes it here, and the emitted frame carries it
+     * VERBATIM instead of a fresh uuidv7). It exists because the two legs of one steering ingress must be
+     * equally replay-safe: the parked leg has taken this key since the queue landed, so a retried request
+     * that arrives while the task is LIVE was the only one that injected twice.
+     *  - **Absent ⇒ nothing changes**: a uuidv7 is minted for the event, nothing is recorded for the call,
+     *    and the delivered bytes are what they always were. Every pre-existing caller is on this arm.
+     *  - **Replay ⇒ idempotent no-op**: re-steering an id this stream already ACCEPTED, with an identical
+     *    payload (same text, same `trusted`, same `actor`), injects nothing and emits no second
+     *    `human_input` frame. What is remembered is exactly what QUEUED: a delivery that was refused
+     *    (not running) can be retried under its own id, and a call whose DELIVERED payload is
+     *    whitespace-only — which the harness discards without minting a frame; note a `trusted` steer is
+     *    wrapped first, so it queues even for blank text — reserves nothing, leaving that id usable.
+     *  - **Same id, DIFFERENT instruction ⇒ typed throw** `steering.duplicate_input_id`: a key is not
+     *    evidence of a replay, and two callers colliding on one id must not silently lose the second
+     *    (the parked leg's `appendPendingSteer` refuses it identically). Re-issue under a fresh id.
+     *  - **Bad value ⇒ typed throw** `steering.invalid_content`, never a silent fallback to "no id": the
+     *    value domain is the parked leg's (a non-empty string of at most `MAX_STEER_INPUT_ID_CHARS`
+     *    characters, and never the reserved `LEGACY_PENDING_STEER_INPUT_ID`), so one key is accepted or
+     *    refused the same way on both legs. Validated before the liveness check, like the parked leg's.
+     *  - **Liveness outranks the key**: once the run's loop-liveness latch has flipped (the same signal
+     *    the injection path stops polling on) a replay is refused `steering.not_running` like any other
+     *    steer, never answered "already accepted" — the parked leg's row CAS answers `false` for a
+     *    resolved checkpoint on a replayed id for the same reason. The one asymmetry, stated rather than
+     *    papered over: in the sub-window where the harness has gone idle but the latch has not yet
+     *    flipped, a FRESH steer polls (and is refused when the latch flips) while a replay answers
+     *    immediately with the SAME outcome its original call reported — a key whose answer depended on
+     *    microsecond timing would defeat its own purpose. Note what that outcome has always meant on this
+     *    verb: ACCEPTED INTO THE QUEUE, not consumed by the model. A steer accepted in the last moments of
+     *    a run can be stranded by the run ending before the next boundary drains it (true of every steer,
+     *    keyed or not); a caller that needs delivery evidence reads the run's own events, not this receipt.
+     *  - **The receipt does NOT distinguish the two**: a fresh accept and a replay both resolve `void`,
+     *    exactly as `setPendingSteer` answers `true` for both. The observable difference is on the event
+     *    stream (a fresh accept emits the `human_input` frame; a replay emits none), which is also where
+     *    the parked leg's difference shows (a replay adds no queue entry, so the resume drains one frame).
+     *  - **Honest window** (weaker than the parked leg's, deliberately stated): the live dedup domain is
+     *    THIS stream object — one run leg, in this process. It is not persisted, so it does not span a
+     *    restart, a replica, or a second `runTaskStream`/`resumeStream` call on the same session; and it
+     *    holds only what the LIVE verb accepted, so an id already delivered by the parked leg (drained
+     *    into this run's resume prompt) is NOT in it and WOULD inject again. A deployment that needs
+     *    cross-leg or cross-process idempotency owns that half (its own key ledger), the same division
+     *    of labor `notify`'s park-window dedup states.
      */
     steer(text: string, options?: {
         trusted?: boolean;
         actor?: ActorAssertion;
+        inputId?: string;
     }): Promise<void>;
     /**
      * design/144 §2 — inject an EXTERNAL structured event into this run's task-notification lane, as a

package/dist/index.d.ts

@@ -108,6 +108,7 @@ export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, } from "./core/task-notification.js";
 export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, type WiringManifest, type WiringFacts, type WiringLegKind, type AskSeamForm, type AskEffective, type QuestionChannelState, type SeamProvenance, type ParkLaneReason, type ManifestDurability, type StaticWiringDeps, type StaticWiringSpec, } from "./core/wiring-manifest.js";
+export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, type ParkSelfCheckResult, type ParkProbeFinding, type ParkProbeFindingCode, } from "./core/park-selfcheck.js";
 export { type StoreDurability } from "./core/checkpoint-store.js";
 export { type StoreFidelity } from "./core/checkpoint-store.js";
 export { projectHumanInput, buildHumanInputEvent, type HumanInputSource, type HumanInputFrame, type HumanInputEvent, type HumanInputDelivery, } from "./core/human-input-projection.js";
@@ -131,7 +132,7 @@ export type { SchedulerCapability, SchedulerErrorCode, ScheduledIntent, Schedule
 export { createSchedulerTools, type SchedulerToolContext, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, type AutonomousLoopPromptOptions, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, type ApprovalSettledBy, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, } from "./core/tool-policy.js";
+export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, type ApprovalSettledBy, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export { parseAutoModeResponse, createAutoModeDecider, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassifyFn, type AutoModeClassifyInput, } from "./core/auto-mode.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, type AutoModeRules, type BuildAutoModePromptOptions, type AutoModeWindowOptions, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
@@ -161,7 +162,7 @@ export { FilePermissionRuleStoreProvider } from "./stores/file/permission-rule-s
 export { adoptFilePermissionRuleStore, type AdoptFileRuleStoreResult } from "./stores/file/permission-rule-adopt.js";
 export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootAdoptionFile, ROOT_ADOPTION_FILE, type AdoptionErrorCode, type AdoptionSource, type AdoptionReport, type AdoptionReceipt, type AdoptionLegReport, type AffectedDeploymentConfig, type RootAdoptionFile, } from "./stores/file/adoption/marker.js";
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, type AdoptionStatus, type AdoptLocalDataRootOptions, type AdoptLocalDataRootResult, type AdoptionCarriageLeg, type AdoptionCarriageLegContext, type AdoptionConfigWitnessReceipt, } from "./stores/file/adoption/adopt.js";
-export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, type Hooks, type HookToolContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
+export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, type PersistedRuleHit, type PersistedRuleUnreadable, type PersistedRuleAnswer, normalizePersistedRuleHit, type Hooks, type HookToolContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type MemoryGetDetails, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryPagedList, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";

package/dist/index.js

@@ -87,6 +87,7 @@ export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, SystemInjectionQueue, } from "./core/task-notification.js";
 export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, } from "./core/wiring-manifest.js";
+export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, } from "./core/park-selfcheck.js";
 export {} from "./core/checkpoint-store.js";
 export {} from "./core/checkpoint-store.js";
 export { projectHumanInput, buildHumanInputEvent, } from "./core/human-input-projection.js";
@@ -108,7 +109,7 @@ export { hasScheduler, isValidCronExpr, SchedulerError } from "./core/scheduler.
 export { createSchedulerTools, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, } from "./core/tool-policy.js";
+export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export { parseAutoModeResponse, createAutoModeDecider, } from "./core/auto-mode.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
@@ -123,7 +124,7 @@ export { FilePermissionRuleStoreProvider } from "./stores/file/permission-rule-s
 export { adoptFilePermissionRuleStore } from "./stores/file/permission-rule-adopt.js";
 export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootAdoptionFile, ROOT_ADOPTION_FILE, } from "./stores/file/adoption/marker.js";
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, } from "./stores/file/adoption/adopt.js";
-export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, } from "./core/hooks.js";
+export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, normalizePersistedRuleHit, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, } from "./core/shared-memory/types.js";

package/dist/orchestration/workflow.d.ts

@@ -198,7 +198,7 @@ export interface WorkflowAgentHandle {
      * its reply with the returned marker. Returns that MARKER so the launcher can correlate the worker's tagged
      * reply via the #5 transcript (the worker self-stamps; reply is best-effort). One-directional + leader-driven
      * (the worker can't address the leader except by the marker). A steer issued BEFORE the worker's loop goes
-     * live is parked and delivered onto turn 1 (birth-window delivery, bounded — ledger item 36); steers are
+     * live is parked and delivered into the NEXT turn's context (birth-window delivery, bounded — ledger item 36); steers are
      * delivered in call order, the birth window included. Rejects with `steering.not_running` once the task has
      * finished (teardown included).
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.33.0",
+  "version": "5.35.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -36,6 +36,7 @@
   },
   "files": [
     "dist",
+    "test/export-surface.snapshot.json",
     "README.md",
     "NOTICE.md",
     "CHANGELOG.md",