@sema-agent/core 5.34.0 → 5.35.0

package/dist/core/tool-policy.js

@@ -13,6 +13,26 @@ export const APPROVAL_SETTLED_BY_VALUES = ["human", "timeout", "aborted"];
 export function isApprovalSettledBy(v) {
     return typeof v === "string" && APPROVAL_SETTLED_BY_VALUES.includes(v);
 }
+export const APPROVER_ATTRIBUTION_MAX_CHARS = 256;
+const APPROVER_REFUSED_CHARS_RE = /[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028\u2029\u202a-\u202e\u2066-\u2069]/u;
+export function screenApproverAttribution(v) {
+    if (v === undefined || v === "")
+        return {};
+    if (typeof v !== "string") {
+        return { defect: `an approver attribution must be a plain string (got ${v === null ? "null" : typeof v})` };
+    }
+    if (v.length > 2 * APPROVER_ATTRIBUTION_MAX_CHARS || [...v].length > APPROVER_ATTRIBUTION_MAX_CHARS) {
+        return { defect: `an approver attribution is capped at ${APPROVER_ATTRIBUTION_MAX_CHARS} characters and this one is longer; it is refused rather than truncated, because a cut identifier names someone else` };
+    }
+    if (/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/.test(v)) {
+        return { defect: "an approver attribution contains an unpaired surrogate; it is not well-formed text and would collapse to a replacement character in a UTF-8 sink, so two distinct approvers could converge into one record" };
+    }
+    if (APPROVER_REFUSED_CHARS_RE.test(v)) {
+        return { defect: "an approver attribution carries control characters, line separators or bidirectional overrides; an identifier whose bytes can forge a line — or reorder what a reader sees — in whatever renders it is refused" };
+    }
+    return { approver: v };
+}
+export const ASK_EVIDENCE_ABSENCE_VALUES = ["not_wired", "not_adjudicated", "unavailable", "no_match", "not_reported"];
 export function decisionText(d) {
     return d.message;
 }
@@ -899,10 +919,12 @@ export async function resolveAsk(req, onAsk, signal) {
         let supplied;
         let allowed;
         let suppliedEdit;
+        let suppliedApprover;
         try {
             supplied = ok.settledBy;
             allowed = ok.allow;
             suppliedEdit = ok.updatedInput;
+            suppliedApprover = ok.approver;
         }
         catch (err) {
             return {
@@ -930,6 +952,16 @@ export async function resolveAsk(req, onAsk, signal) {
                 settledBy: "aborted",
             };
         }
+        const attribution = screenApproverAttribution(suppliedApprover);
+        if (attribution.defect !== undefined) {
+            return {
+                action: "deny",
+                message: `the approver for "${req.toolName}" reported an attribution this seam refuses: ${attribution.defect}; denied fail-closed`,
+                decisionReason: "mode",
+                settledBy: "aborted",
+            };
+        }
+        const attributionCell = attribution.approver !== undefined ? { approver: attribution.approver } : {};
         if (supplied === "timeout" && allowed === true) {
             return {
                 action: "deny",
@@ -969,10 +1001,11 @@ export async function resolveAsk(req, onAsk, signal) {
                     : humanRefusalMessage(req, reasonText),
                 decisionReason: "mode",
                 settledBy: supplied === "timeout" ? "timeout" : "human",
+                ...attributionCell,
             };
         }
         if (suppliedEdit === undefined)
-            return { action: "allow", decisionReason: "mode", presentedInput: presented.value, settledBy: "human" };
+            return { action: "allow", decisionReason: "mode", presentedInput: presented.value, settledBy: "human", ...attributionCell };
         const edit = tryCloneArgs(suppliedEdit);
         if (!edit.ok) {
             return {
@@ -982,7 +1015,7 @@ export async function resolveAsk(req, onAsk, signal) {
                 settledBy: "aborted",
             };
         }
-        return { action: "allow", updatedInput: edit.value, decisionReason: "mode", settledBy: "human" };
+        return { action: "allow", updatedInput: edit.value, decisionReason: "mode", settledBy: "human", ...attributionCell };
     }
     const okRaw = ok;
     if (okRaw === true)

package/dist/core/types.d.ts

@@ -3437,6 +3437,26 @@ export type TaskEvent = ({
      * must not treat "absent" as "a human decided".
      */
     settledBy?: import("./tool-policy.js").ApprovalSettledBy;
+    /**
+     * design/252 G-7 — WHOSE settlement that was: the identifier the approval channel reported for
+     * the party that ended this wait, beside the {@link settledBy} word that says what KIND of end
+     * it was. The two are read together and neither substitutes for the other:
+     * `settledBy:"timeout"` with an `approver` names the queue whose window elapsed, NOT someone
+     * who refused.
+     *
+     * WHAT CORE PROMISES ABOUT IT — exactly one thing: it is what the settling caller said, screened
+     * for shape (a plain string, bounded, no control characters) and otherwise untouched. Core does
+     * NOT authenticate it, does not compare it to a principal, and never reads it back to decide
+     * anything. Identity is established by the approval channel a deployment integrates (its card,
+     * its signature, its console); this is the transcription that lets an audit which already knows
+     * a person ended a wait also say which person, without the engine growing an identity surface it
+     * deliberately does not have. Treat it accordingly: it is a RECORD of a claim, and its
+     * trustworthiness is exactly the trustworthiness of the channel that made it.
+     *
+     * ABSENT on every frame that settled no approval, and on a settled approval whose channel named
+     * nobody. Absence means nobody SAID — never "nobody approved this", and never "a human did".
+     */
+    approver?: string;
     /**
      * design/99 §E1 — `true` when {@link output} was SIZE-bounded by core (the full body exceeded the cap and
      * was degraded to a truncated string). Lets a consumer detect truncation programmatically instead of
@@ -3876,8 +3896,12 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
     /**
      * Inject a mid-task **steering** message (design/47) that the running task sees at the start of its
      * next turn (delivered via the harness steering queue). Resolves once queued; **throws** (code
-     * `steering.not_running`) if the task hasn't started yet or has already finished — never silently
-     * dropped. By default the text enters as a normal **user** message (in an orchestration the caller IS
+     * `steering.not_running`) once the task has finished (teardown included) — never silently dropped. A
+     * steer issued BEFORE the run has ISSUED ITS FIRST PROMPT is not refused: it is HELD for the birth
+     * window and enters the queue as soon as the loop goes live, so the model sees it at the next turn
+     * boundary like any other steer — it is refused if the loop ends first, or if that BOUNDED wait runs
+     * out while the run still has not started (ruled 2026-08-05; a retry under the same `inputId` is then
+     * clean — a refusal reserves nothing). By default the text enters as a normal **user** message (in an orchestration the caller IS
      * the task's user). Pass `trusted: true` ONLY for operator/system-level guidance: it is wrapped as a
      * `<system-reminder>` (elevated authority) — do NOT use it for caller/third-party content that could
      * carry a prompt injection. The seam gives the channel; the caller owns the judgement (design/43 §6).
@@ -3885,10 +3909,55 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
      * design/171 §5.2 — `actor` attributes WHO steered (a shared session's second voice): the text gets
      * the speaker envelope from the single projection point and the queued message carries the
      * metadata seat. Attribution only, never authority; absent = anonymous (bytes unchanged).
+     *
+     * design/171 §6.3 (additive) — `inputId` is the caller's correlation/idempotency key, the SAME key
+     * space as the parked queue's `PendingSteerEntry.inputId` and the `human_input` event's `inputId`
+     * (an ingress that already minted a message id passes it here, and the emitted frame carries it
+     * VERBATIM instead of a fresh uuidv7). It exists because the two legs of one steering ingress must be
+     * equally replay-safe: the parked leg has taken this key since the queue landed, so a retried request
+     * that arrives while the task is LIVE was the only one that injected twice.
+     *  - **Absent ⇒ nothing changes**: a uuidv7 is minted for the event, nothing is recorded for the call,
+     *    and the delivered bytes are what they always were. Every pre-existing caller is on this arm.
+     *  - **Replay ⇒ idempotent no-op**: re-steering an id this stream already ACCEPTED, with an identical
+     *    payload (same text, same `trusted`, same `actor`), injects nothing and emits no second
+     *    `human_input` frame. What is remembered is exactly what QUEUED: a delivery that was refused
+     *    (not running) can be retried under its own id, and a call whose DELIVERED payload is
+     *    whitespace-only — which the harness discards without minting a frame; note a `trusted` steer is
+     *    wrapped first, so it queues even for blank text — reserves nothing, leaving that id usable.
+     *  - **Same id, DIFFERENT instruction ⇒ typed throw** `steering.duplicate_input_id`: a key is not
+     *    evidence of a replay, and two callers colliding on one id must not silently lose the second
+     *    (the parked leg's `appendPendingSteer` refuses it identically). Re-issue under a fresh id.
+     *  - **Bad value ⇒ typed throw** `steering.invalid_content`, never a silent fallback to "no id": the
+     *    value domain is the parked leg's (a non-empty string of at most `MAX_STEER_INPUT_ID_CHARS`
+     *    characters, and never the reserved `LEGACY_PENDING_STEER_INPUT_ID`), so one key is accepted or
+     *    refused the same way on both legs. Validated before the liveness check, like the parked leg's.
+     *  - **Liveness outranks the key**: once the run's loop-liveness latch has flipped (the same signal
+     *    the injection path stops polling on) a replay is refused `steering.not_running` like any other
+     *    steer, never answered "already accepted" — the parked leg's row CAS answers `false` for a
+     *    resolved checkpoint on a replayed id for the same reason. The one asymmetry, stated rather than
+     *    papered over: in the sub-window where the harness has gone idle but the latch has not yet
+     *    flipped, a FRESH steer polls (and is refused when the latch flips) while a replay answers
+     *    immediately with the SAME outcome its original call reported — a key whose answer depended on
+     *    microsecond timing would defeat its own purpose. Note what that outcome has always meant on this
+     *    verb: ACCEPTED INTO THE QUEUE, not consumed by the model. A steer accepted in the last moments of
+     *    a run can be stranded by the run ending before the next boundary drains it (true of every steer,
+     *    keyed or not); a caller that needs delivery evidence reads the run's own events, not this receipt.
+     *  - **The receipt does NOT distinguish the two**: a fresh accept and a replay both resolve `void`,
+     *    exactly as `setPendingSteer` answers `true` for both. The observable difference is on the event
+     *    stream (a fresh accept emits the `human_input` frame; a replay emits none), which is also where
+     *    the parked leg's difference shows (a replay adds no queue entry, so the resume drains one frame).
+     *  - **Honest window** (weaker than the parked leg's, deliberately stated): the live dedup domain is
+     *    THIS stream object — one run leg, in this process. It is not persisted, so it does not span a
+     *    restart, a replica, or a second `runTaskStream`/`resumeStream` call on the same session; and it
+     *    holds only what the LIVE verb accepted, so an id already delivered by the parked leg (drained
+     *    into this run's resume prompt) is NOT in it and WOULD inject again. A deployment that needs
+     *    cross-leg or cross-process idempotency owns that half (its own key ledger), the same division
+     *    of labor `notify`'s park-window dedup states.
      */
     steer(text: string, options?: {
         trusted?: boolean;
         actor?: ActorAssertion;
+        inputId?: string;
     }): Promise<void>;
     /**
      * design/144 §2 — inject an EXTERNAL structured event into this run's task-notification lane, as a

package/dist/index.d.ts

@@ -108,6 +108,7 @@ export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, } from "./core/task-notification.js";
 export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, type WiringManifest, type WiringFacts, type WiringLegKind, type AskSeamForm, type AskEffective, type QuestionChannelState, type SeamProvenance, type ParkLaneReason, type ManifestDurability, type StaticWiringDeps, type StaticWiringSpec, } from "./core/wiring-manifest.js";
+export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, type ParkSelfCheckResult, type ParkProbeFinding, type ParkProbeFindingCode, } from "./core/park-selfcheck.js";
 export { type StoreDurability } from "./core/checkpoint-store.js";
 export { type StoreFidelity } from "./core/checkpoint-store.js";
 export { projectHumanInput, buildHumanInputEvent, type HumanInputSource, type HumanInputFrame, type HumanInputEvent, type HumanInputDelivery, } from "./core/human-input-projection.js";
@@ -131,7 +132,7 @@ export type { SchedulerCapability, SchedulerErrorCode, ScheduledIntent, Schedule
 export { createSchedulerTools, type SchedulerToolContext, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, type AutonomousLoopPromptOptions, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, type ApprovalSettledBy, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, } from "./core/tool-policy.js";
+export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, type ApprovalSettledBy, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export { parseAutoModeResponse, createAutoModeDecider, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassifyFn, type AutoModeClassifyInput, } from "./core/auto-mode.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, type AutoModeRules, type BuildAutoModePromptOptions, type AutoModeWindowOptions, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
@@ -161,7 +162,7 @@ export { FilePermissionRuleStoreProvider } from "./stores/file/permission-rule-s
 export { adoptFilePermissionRuleStore, type AdoptFileRuleStoreResult } from "./stores/file/permission-rule-adopt.js";
 export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootAdoptionFile, ROOT_ADOPTION_FILE, type AdoptionErrorCode, type AdoptionSource, type AdoptionReport, type AdoptionReceipt, type AdoptionLegReport, type AffectedDeploymentConfig, type RootAdoptionFile, } from "./stores/file/adoption/marker.js";
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, type AdoptionStatus, type AdoptLocalDataRootOptions, type AdoptLocalDataRootResult, type AdoptionCarriageLeg, type AdoptionCarriageLegContext, type AdoptionConfigWitnessReceipt, } from "./stores/file/adoption/adopt.js";
-export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, type Hooks, type HookToolContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
+export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, type PersistedRuleHit, type PersistedRuleUnreadable, type PersistedRuleAnswer, normalizePersistedRuleHit, type Hooks, type HookToolContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type MemoryGetDetails, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryPagedList, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";

package/dist/index.js

@@ -87,6 +87,7 @@ export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, SystemInjectionQueue, } from "./core/task-notification.js";
 export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, } from "./core/wiring-manifest.js";
+export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, } from "./core/park-selfcheck.js";
 export {} from "./core/checkpoint-store.js";
 export {} from "./core/checkpoint-store.js";
 export { projectHumanInput, buildHumanInputEvent, } from "./core/human-input-projection.js";
@@ -108,7 +109,7 @@ export { hasScheduler, isValidCronExpr, SchedulerError } from "./core/scheduler.
 export { createSchedulerTools, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, } from "./core/tool-policy.js";
+export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export { parseAutoModeResponse, createAutoModeDecider, } from "./core/auto-mode.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
@@ -123,7 +124,7 @@ export { FilePermissionRuleStoreProvider } from "./stores/file/permission-rule-s
 export { adoptFilePermissionRuleStore } from "./stores/file/permission-rule-adopt.js";
 export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootAdoptionFile, ROOT_ADOPTION_FILE, } from "./stores/file/adoption/marker.js";
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, } from "./stores/file/adoption/adopt.js";
-export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, } from "./core/hooks.js";
+export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, normalizePersistedRuleHit, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, } from "./core/shared-memory/types.js";

package/dist/orchestration/workflow.d.ts

@@ -198,7 +198,7 @@ export interface WorkflowAgentHandle {
      * its reply with the returned marker. Returns that MARKER so the launcher can correlate the worker's tagged
      * reply via the #5 transcript (the worker self-stamps; reply is best-effort). One-directional + leader-driven
      * (the worker can't address the leader except by the marker). A steer issued BEFORE the worker's loop goes
-     * live is parked and delivered onto turn 1 (birth-window delivery, bounded — ledger item 36); steers are
+     * live is parked and delivered into the NEXT turn's context (birth-window delivery, bounded — ledger item 36); steers are
      * delivered in call order, the birth window included. Rejects with `steering.not_running` once the task has
      * finished (teardown included).
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.34.0",
+  "version": "5.35.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,6 +1,6 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
-  "count": 1546,
+  "count": 1562,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -19,7 +19,9 @@
     "AGGREGATE_TOOL_RESULT_BUDGET_CHARS": "variable",
     "ANNOUNCEMENTS_FILE": "variable",
     "APPROVAL_SETTLED_BY_VALUES": "variable",
+    "APPROVER_ATTRIBUTION_MAX_CHARS": "variable",
     "ARTIFACT_LIMITS": "variable",
+    "ASK_EVIDENCE_ABSENCE_VALUES": "variable",
     "AUTONOMOUS_LOOP_DYNAMIC_SENTINEL": "variable",
     "AUTONOMOUS_LOOP_PREAMBLE": "variable",
     "AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT": "variable",
@@ -57,12 +59,14 @@
     "AskAnswerContinuationSource": "type",
     "AskDelegationProvenance": "interface",
     "AskEffective": "type",
+    "AskEvidenceAbsence": "type",
     "AskOutcome": "type",
     "AskQuestion": "interface",
     "AskQuestionCardDetails": "type",
     "AskQuestionOption": "interface",
     "AskQuestionRequest": "interface",
     "AskRequest": "interface",
+    "AskRuleEvidence": "interface",
     "AskSeamForm": "type",
     "AskUserQuestionToolOptions": "interface",
     "AssertOracleIsolationOptions": "interface",
@@ -539,6 +543,7 @@
     "OrphanToolCall": "interface",
     "OutputChunk": "type",
     "OwnOrgAdmissionVerdict": "interface",
+    "PARK_SELFCHECK_SCOPE_PREFIX": "variable",
     "PEER_ADMISSION_DEFAULTS": "variable",
     "PEER_HOP_CHAIN_WINDOW": "variable",
     "PEER_MESSAGE_NOTICE": "variable",
@@ -556,6 +561,9 @@
     "PROTOCOL_TABLE": "variable",
     "PackSectionDeclaration": "interface",
     "ParkLaneReason": "type",
+    "ParkProbeFinding": "interface",
+    "ParkProbeFindingCode": "type",
+    "ParkSelfCheckResult": "interface",
     "ParkedClaimTicket": "interface",
     "ParsedAllowRule": "interface",
     "ParsedEntryFile": "interface",
@@ -591,8 +599,11 @@
     "PermissionRuleWriter": "interface",
     "PersistedAllowRule": "interface",
     "PersistedOrgRuleState": "interface",
+    "PersistedRuleAnswer": "type",
+    "PersistedRuleHit": "interface",
     "PersistedRuleMatch": "type",
     "PersistedRuleTool": "type",
+    "PersistedRuleUnreadable": "interface",
     "PlatformLimitReason": "type",
     "PostCompactContext": "interface",
     "PostToolBatchCall": "interface",
@@ -1230,6 +1241,8 @@
     "devWorkflowScriptRunner": "variable",
     "dotAtOrBelowFrontier": "function",
     "drainMemoryAnnouncements": "function",
+    "durableParkGapFor": "function",
+    "durableParkGapOf": "function",
     "editBudget": "function",
     "effectivePermissionRules": "function",
     "emitTaskOutcome": "function",
@@ -1345,6 +1358,7 @@
     "normalizeAgentName": "function",
     "normalizeForExactMatch": "function",
     "normalizeMemorySpec": "function",
+    "normalizePersistedRuleHit": "function",
     "normalizePromptEpoch": "function",
     "normalizeRules": "function",
     "normalizeToolResultProvenance": "function",
@@ -1375,6 +1389,7 @@
     "prepareCardApproval": "function",
     "prepareCcImport": "function",
     "prepareStarterBatch": "function",
+    "probeParkRoundTrip": "function",
     "probeSearchBackend": "function",
     "projectHumanInput": "function",
     "projectToolManifest": "function",
@@ -1475,6 +1490,7 @@
     "scanRemediation": "function",
     "scopeCoversCwd": "function",
     "scopeDirName": "function",
+    "screenApproverAttribution": "function",
     "screenInboundEntries": "function",
     "screenRuleSyncState": "function",
     "scrubSecretEnv": "function",