@sema-agent/core 5.36.0 → 5.38.0

package/dist/core/types.d.ts

@@ -381,6 +381,25 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
      * Exclusion still wins ({@link TaskSpec.excludeTools} unmounts — nothing left to keep inline).
      */
     alwaysLoad?: boolean;
+    /**
+     * design/277 — model-gate CLASS tag (open vocabulary; the built-in table is
+     * {@link import("./tool-model-gate.js").TOOL_MODEL_GATE_CLASSES}, v1 vocabulary =
+     * `"task-scaffold"`). A tagged entry declares "I am a default-mounted scaffold of this class":
+     * at prepare, when the task's RESOLVED model id matches the class's rule, THIS entry is dropped
+     * from the roster (true unmount, entry-level — a same-name untagged entry is untouched; the
+     * removed entry stops occupying its name on every downstream surface). Untagged = never gated.
+     * The default-bundle assemblers stamp their default arms only; an EXPLICITLY composed tool is
+     * not tagged (user asked ⇒ user gets) — so don't stamp hand-mounted factories. FAIL-OPEN: an id
+     * the merged table knows nothing about is never gated (BYOM open set — the table encodes
+     * positive knowledge only), and a tag naming an unknown class is inert + announced
+     * (`config.tool_model_gate_unknown_class`). Restore channels: explicit composition (no tag),
+     * {@link TaskSpec.restoreGatedTools}, env `SEMA_TOOL_MODEL_GATE=off`,
+     * `RunnerDeps.toolModelGate: false`; {@link TaskSpec.excludeTools} always wins regardless.
+     * The materialized `AgentTool` face does NOT carry this field (`defineTool` is a whitelist
+     * constructor) — the decision completes on the ToolSpec face inside `prepareConfigDoors`,
+     * before any conversion.
+     */
+    modelGate?: string;
     /**
      * Tool contract identity (campaign S2, prompt-assembly protocol §7): declares the EXECUTION
      * CONTRACT this tool implements, independent of its presentation text. `defineTool` attaches it
@@ -751,6 +770,13 @@ export interface ToolExecuteContext {
      *  X arrives deferred, the exemption having been dropped in transit — which is the one outcome the
      *  parent explicitly ruled out. Children merge this with their own spec value. */
     alwaysLoadTools?: readonly string[];
+    /** design/277 — the model-gate restore selector ({@link TaskSpec.restoreGatedTools}), inherited
+     *  down the delegation tree on the same trusted seat as the three tool-face controls above
+     *  (Runner-filled, read-only, frozen snapshot). Restoration is a TASK-TREE intent ("this work
+     *  wants the scaffold back") and each child re-judges the gate under its OWN resolved model —
+     *  dropping the selector in transit would trim a same-model child's roster in a way nobody
+     *  chose (the gate is a default, not a policy; there is no tighten-only axis to protect). */
+    restoreGatedTools?: readonly string[] | true;
     /** R2 双形轴 — the parent's resolved prompt profile, inherited down the delegation tree like the
      *  tool-face controls (Runner-filled): a classic-profile parent's children speak classic too
      *  unless the child spec says otherwise (child spec wins — profile is presentation, not policy). */
@@ -1867,6 +1893,24 @@ export interface TaskSpec {
      * wins — an unmounted tool has no schema to keep inline).
      */
     alwaysLoadTools?: string[];
+    /**
+     * design/277 — per-task restore valve for the tool-registration MODEL GATE. The gate trims
+     * default-mounted scaffold entries (tagged via {@link ToolSpec.modelGate}) from the roster when
+     * the task's resolved model id matches the gate table — this valve opts the task (and its whole
+     * delegation tree — the selector inherits down like `excludeTools`) back in:
+     *  · an ARRAY of wire names — naming ANY tagged tool restores that tool's WHOLE class for this
+     *    task (CC parity: opting into any member of the family restores the family). Judged against
+     *    the full stamp set, so a name that `excludeTools` also lists still works as a class
+     *    SELECTOR — while the exclusion itself still wins for that name (exclusion is the final
+     *    valve; no restore channel resurrects an excluded name). Unknown names are inert (a
+     *    center-distributed list may be a superset), same posture as `excludeTools`.
+     *  · literal `true` — every gate class restored for this task (the shortest "this task wants
+     *    all its scaffolding" spelling for center-distributed specs).
+     * A malformed value refuses at prepare (`config.tool_model_gate_invalid`, #123) — garbage must
+     * not silently read as "restore nothing" in the trimming direction. Absent = the gate's verdict
+     * stands. Explicit composition needs no valve: a hand-mounted (untagged) tool is never gated.
+     */
+    restoreGatedTools?: string[] | true;
     /**
      * RB-403 — whether a schema-VALID call on a still-deferred tool runs the real tool directly
      * (activating it as a side effect). Default `true`, matching the upstream posture where the
@@ -2713,6 +2757,79 @@ export interface RemoteEnvFailureNote {
     message: string;
 }
 /** Result returned when a task finishes or gets stuck. Designed to be machine-readable for an external AI. */
+/**
+ * design/178 v2 §2.3 (件①) — the value of {@link TaskResult.effectiveMemoryScopes}: the memory
+ * visibility face a leg ACTUALLY ran under, as a DISCRIMINATED three-state union (deliberately no
+ * `"partial"` state — the engine session is built only after every plane materialized, so a
+ * half-mounted scene is a fail-open `memoryless` with residue, never a served half-face):
+ *
+ *  - `"mounted"` — the memory engine session mounted. `scopes` is the EFFECTIVE VISIBILITY set in
+ *    the effective serving order, both exactly as the engine mounted them: per plane, the
+ *    admission-projected read layering PLUS a distinct write-only scope where one exists (the
+ *    engine registers the write scope's dir and its entries ride the injected index — a write-only
+ *    scope IS visible; the common writeScope∈scopes form dedups to the plain layering), project
+ *    plane first on a dual root. Each row carries its admission ORIGIN (`"deployment"` = the
+ *    operator's own declared set; `"request"` = the caller's spec — the two trust planes of the
+ *    org admission door). `writeScope` is the effective write face as granted (an org writeScope
+ *    not explicitly granted reads `null` here, exactly as it ran). `contract` names the
+ *    scope-identity contract in force (`"v2"` typed keys / `"legacy"` opaque strings).
+ *    SCOPE OF THE CLAIM (stated precisely): the rows are the MEMORY-ENGINE scope set this leg
+ *    mounted — the dirs the engine registered and indexed. They deliberately do NOT cover the
+ *    separate memory-adjacent faces (the shared-memory store pair, the project-context memory
+ *    layer — each its own surface with its own disclosure), and two REGISTERED engine-plane
+ *    channels can carry another scope's bytes without a row here: a root-owning scope's non-empty
+ *    on-disk index is served verbatim to a later mount of that root ("live file wins"),
+ *    and control-plane announcements carry no producing scope and drain plane-wide. Both are
+ *    engine mount semantics under their own tickets, disclosed here so this face is never read as
+ *    a complete cross-face visibility proof.
+ *  - `"memoryless"` — memory was configured but did not mount. `reason: "mount-failed"` = the
+ *    fail-open mount arm caught a fault anywhere in the mount phase (directory resolution through
+ *    materialize — named for the whole captured span, not one step); `reason: "no-backend"` = the
+ *    spec enables memory but no `RunnerDeps.memoryBackend` is configured. `materializedResidue`
+ *    (mount-failed only) lists plane scopes whose PHYSICAL materialize had already completed when
+ *    the fault hit — a LOWER bound (a plane that threw mid-materialize is not listed; on-disk
+ *    residue is ≥ this list), and explicitly NOT a visibility face: an auditor must never read
+ *    residue as mounted scopes, which is why it is a separate seat from the always-empty `scopes`.
+ *  - `"none"` — memory was not in play at all: `"no-spec"` = the task carries no usable memory
+ *    spec; `"disabled"` = a spec is present with `enabled: false`.
+ *
+ * Deliberate-refusal configurations (`config.memory_*` codes) fail the whole prepare and produce
+ * NO observation — this union never dresses a refusal as a state. Honesty note (design r7): the
+ * `?: never` members forbid non-`undefined` values at the type level; the repo does not compile
+ * with `exactOptionalPropertyTypes`, so explicit-`undefined` presence is a wire-validator concern,
+ * not a type-level one.
+ */
+export type EffectiveMemoryScopes = {
+    state: "mounted";
+    reason?: never;
+    contract: "v2" | "legacy";
+    scopes: Array<{
+        scope: string;
+        origin: "deployment" | "request";
+    }>;
+    writeScope: string | null;
+    materializedResidue?: never;
+} | {
+    state: "memoryless";
+    reason: "mount-failed";
+    contract?: "v2" | "legacy";
+    scopes: [];
+    writeScope: null;
+    materializedResidue?: string[];
+} | {
+    state: "memoryless";
+    reason: "no-backend";
+    contract?: "v2" | "legacy";
+    scopes: [];
+    writeScope: null;
+} | {
+    state: "none";
+    reason: "no-spec" | "disabled";
+    contract?: never;
+    scopes: [];
+    writeScope: null;
+    materializedResidue?: never;
+};
 export interface TaskResult {
     taskId: string;
     /** Use this to continue the same conversation on the next call. */
@@ -2972,6 +3089,28 @@ export interface TaskResult {
      * governing the WORK, never the contents of any checkpoint row.
      */
     effectiveReadDenyPatterns?: readonly import("../tools/fs/read-deny.js").NormalizedReadDenyEntry[];
+    /**
+     * design/178 v2 §2.3 (件①) — the memory VISIBILITY face this leg actually ran under, as an
+     * engine-filled OBSERVATION (never a knob: writing it on a spec does nothing). This is the
+     * EFFECTIVE face, not the requested one: a refused request never reaches a terminal at all (the
+     * whole prepare fails with its governance code), so what this seat answers is "what was actually
+     * given" — the delta against the request is directly readable (an org writeScope not explicitly
+     * granted collapses to `null` here as it did in the run; a fail-open mount failure reads
+     * `memoryless`, never a dressed-up mount).
+     *
+     * **In-presence condition** (same law as {@link effectiveReadFace}): present on every terminal of
+     * a leg that COMPLETED prepare — the memory-less states are answered as their own values
+     * (`none` / `memoryless`), so consumers must never read ABSENCE as "no memory"; absence means
+     * only "prepare never completed". Delegated children mint their own on their own legs (their
+     * request plane can only narrow the parent's frozen org verdict); a resume leg's value is the
+     * re-adjudication at resume time (admission runs in every prepare — the current-policy reading,
+     * same axis as the read-face seats).
+     *
+     * Minted AFTER the materialize outcome, not after the admission verdict — the fail-open mount
+     * arm sits between the two, and stamping earlier would report a mount that never happened.
+     * See {@link EffectiveMemoryScopes} for the per-state field law.
+     */
+    effectiveMemoryScopes?: EffectiveMemoryScopes;
     /**
      * `turns`/`tokens`/`costMicroUsd` are this task's OWN model usage. `nested` is the summed usage of any
      * delegated sub-runs (sub-agents) it spawned — present only when it delegated. The true total
@@ -4345,6 +4484,93 @@ export interface BackgroundChildEvent {
         costMicroUsd?: number;
     };
 }
+/**
+ * #281 件B — one lifecycle phase of a DELEGATED child leg, delivered to the process-level
+ * {@link RunnerDeps.onDelegationLifecycle} observer: the public, deps-level home of the delegation
+ * lifecycle that previously lived only on the trusted RunInternals third parameter
+ * (`onSubagentSpawn` — sync lane, a steer handle whose `settled` is a void promise) and on the
+ * background-lane-only {@link BackgroundChildEvent}. A deployment wired ONLY through `RunnerDeps`
+ * now sees every delegation lane through one seat.
+ *
+ * EMISSION CHOKEPOINT (the reason this seat covers every lane at once): frames are minted by the
+ * RUNNER at the child LEG itself — spawn right after the leg's `wiring_manifest` (prepared, nothing
+ * run yet), terminal when the leg's `TaskResult` assembles — not by the individual spawn lanes. Every
+ * delegation lane (sync/steer/background/fork/revive, workflow-spawned agents) runs its child through
+ * this chokepoint, so none of them needs its own emission and none can drift.
+ *
+ * PER-LEG semantics, deliberately: a durable park + resume, or a retained child's revive, is a NEW
+ * leg — each emits its own spawn/terminal pair, and `identity.legKind` (`"resume"`) says which cycle
+ * a frame belongs to. Consumers correlate legs of one delegation by `identity.taskId` /
+ * `identity.parentToolCallId` (stable across cycles).
+ *
+ * HONEST ABSENCES (recorded, not gaps to fix silently):
+ *  · a child whose PREPARE throws emits neither frame (there is no leg identity to report);
+ *  · the ROOT leg emits nothing here — the deployment called `runTask` itself and holds the result;
+ *    this seat is the delegation observer, not a run observer;
+ *  · a deps-only resume (`resume(token, outcome, config)` — no trusted internals re-supplied) of a
+ *    checkpoint minted BEFORE the delegation axis was persisted
+ *    ({@link import("./checkpoint-store.js").CheckpointState.isDelegatedChild}) emits neither frame:
+ *    the row carries no evidence the parked leg was a delegated child, and fabricating the axis
+ *    would stamp delegation frames onto host-resumed root tasks. Rows minted WITH the axis resume
+ *    with their spawn/terminal pair even deps-only; a resume that re-supplies trusted internals
+ *    (every in-engine lane does) was never affected.
+ * PAIRING (codex r2-D2 closed the one hole): a spawn frame is always closed by a terminal frame —
+ * the ordinary path emits it where the `TaskResult` assembles, and a POST-SPAWN throw that the
+ * stream layer converts into a synthesized failed result (e.g. `resume.tool_unavailable` re-thrown
+ * past the run tail) emits the failed terminal from that backstop, gated on a carrier that is set
+ * only after the spawn emission and cleared by the ordinary terminal (so the two sites can never
+ * both fire for one leg). A leg whose PROCESS dies mid-flight is the only unpaired spawn.
+ *
+ * OBSERVATION ONLY (matrix §5.2 Q3: frame-rate lifecycle facts ride an observer seat, never
+ * onNotice): no return capability, and delivery can never alter the child run —
+ * {@link deliverDelegationLifecycle} contains a throwing sink and an async sink's rejection alike.
+ *
+ * FRAME OBJECT SHAPE (consumer contract, not an implementation detail): every delivered frame is
+ * FROZEN and carries a NULL PROTOTYPE — re-minted at the one delivery point so a forged member
+ * cannot ride a frame through a writable `Object.prototype`, the same rule (and the same trade) as
+ * the {@link import("./hooks.js").HookInvocationIdentity} envelope inside it. `Object.keys`, spread,
+ * JSON serialization and direct member reads (`frame.status`) all behave normally, but
+ * `frame instanceof Object` is `false` and inherited methods are ABSENT — probe optional members
+ * with `Object.hasOwn(frame, "errorCode")` or `"errorCode" in frame`, never
+ * `frame.hasOwnProperty(...)` (throws) or implicit string coercion (`` `${frame}` `` throws).
+ */
+export type DelegationLifecycleEvent = {
+    phase: "spawn";
+    /** The child LEG's identity envelope (#281 件A — the same frozen object that leg's own hook
+     *  invocations carry). `isDelegatedChild` is `true` by construction on every frame here. */
+    identity: import("./hooks.js").HookInvocationIdentity;
+} | {
+    phase: "terminal";
+    /** Same envelope as the leg's spawn frame (one mint per leg). */
+    identity: import("./hooks.js").HookInvocationIdentity;
+    /** The leg's settled status — the `TaskResult.status` the spawning lane receives, verbatim
+     *  (the sync lane's previously-void `settled` payload, made public). `"suspended"` means a
+     *  durable park: expect a later `"resume"`-leg spawn/terminal pair if it is redeemed. */
+    status: TaskResult["status"];
+    /** Turns the leg completed. */
+    turns: number;
+    /** The leg's `TaskResult.errorCode`, when one was stamped. */
+    errorCode?: string;
+};
+/** Test seam (mirrors `__resetMalformedNoticeSeatAnnouncement`): never called by production code. */
+export declare function __resetMalformedDelegationSeatAnnouncement(): void;
+/**
+ * The ONE delivery form behind every {@link RunnerDeps.onDelegationLifecycle} emission point (both
+ * runner stations — spawn and terminal — call this; a second spelling of the swallow/announce rules
+ * would be the #170 triplication reborn). Contract:
+ *  · a FUNCTION seat is invoked with the frame FROZEN (a mutating observer must not rewrite what a
+ *    later frame consumer — or the shared identity envelope's other readers — see), contained in the
+ *    caller's {@link SafeNotifier} against BOTH failure shapes the void-typed seat admits: a
+ *    synchronous throw ({@link SafeNotifier.notify}) and an async sink's rejected promise
+ *    ({@link observeThenableRejection} routes it back through the same notifier/site — the #253
+ *    three-station form). A broken observer never faults the child run.
+ *  · a PRESENT NON-function seat is a bad deployment value; #123 forbids folding it to silence. There
+ *    is no per-frame console fallback (this is a frame-rate observer stream, not an announcement
+ *    channel — an unwired seat means UNOBSERVED, and echoing every spawn to stderr would flood), so
+ *    the loud exit is the seat DEFECT itself: announced via `console.warn` once per process.
+ *  · an ABSENT seat is a plain no-op (the deployment chose not to observe).
+ */
+export declare function deliverDelegationLifecycle(seat: RunnerDeps["onDelegationLifecycle"], event: DelegationLifecycleEvent, notifier: import("./safe-notify.js").SafeNotifier, site: string): void;
 /**
  * parity-204 — structured `RunnerDeps.loadProjectMemory` return (backward-compatible: a bare
  * `string | null` keeps its exact historical meaning). Adds the CC 2.1.204 `seededFromContext`
@@ -4424,6 +4650,24 @@ export interface EngineNotice {
      *    a library-direct `createHandsToolkit` mount announces at toolkit creation (one per mount,
      *    through the band-local `HandsToolkitOptions.onNotice` seat, absent ⇒ `console.warn`);
      *    `detail: { seat, declared, inForce, cause }`.
+     *  - `"config.tool_model_gate_removed"` (design/277) — the model gate trimmed default-mounted
+     *    scaffold entries from a task's roster. One notice per (model, class), de-duplicated once per
+     *    `onNotice` SINK on the (modelId, class, canonical sorted removed-name set) line (same unit
+     *    as `config.read_face_deployment_clamped`: two deployments hosted in one process each hear
+     *    their own trim; unwired console arm once per process) — same class with a different removal
+     *    shape is a distinct fact and announces again;
+     *    `detail: { modelId, gateClass, removed, restore }` (`restore` names the three valves).
+     *  - `"config.tool_model_gate_unknown_class"` (design/277) — a `ToolSpec.modelGate` tag names a
+     *    class the merged gate table has no row for: the tag is inert (fail-open — the tool stays
+     *    mounted) and this is its loud half (a tag typo must not silently become "never gated" with
+     *    nobody told). Once per `onNotice` sink per class (console arm once per process);
+     *    `detail: { gateClass }`.
+     *  - `"config.tool_model_gate_env_invalid"` (design/277, the NOTICE dialect of the same fact the
+     *    refusal code carries) — `SEMA_TOOL_MODEL_GATE` holds a value outside `on|1|true|off|0|false`
+     *    in a seat where it is NOT in force (nothing this prepare would gate): announced once per
+     *    `onNotice` sink per value (console arm once per process) instead of lying in wait; where the
+     *    value IS in force the prepare refuses with the same code as `TaskResult.errorCode` (one
+     *    fact, one code, two loudness dialects); `detail: { raw }`.
      *
      *  Deliberately NOT a notice family: brain retry/reconnect liveness (a rate limit, a 5xx, a
      *  transient network failure being retried). Those are per-attempt liveness frames with their own
@@ -4779,6 +5023,23 @@ export interface RunnerDeps {
      * completion pushes from it. Observability only — a throwing observer is swallowed, never faults a run.
      */
     onBackgroundChildEvent?: (event: BackgroundChildEvent) => void;
+    /**
+     * #281 件B — PROCESS-level observer for EVERY delegated child leg's lifecycle (`spawn`/`terminal`),
+     * all delegation lanes at once: synchronous and steer-handle delegations (whose spawn/settle
+     * previously reached only the trusted `RunInternals.onSubagentSpawn` third parameter — and whose
+     * `settled` is a void promise), background/fork/revive children (whose {@link BackgroundChildEvent}
+     * family this seat complements, not replaces — BCE stays the fleet-row lane with registry `a*`
+     * handles and ticks; this seat is the leg-identity lane), and workflow-spawned agents. Frames are
+     * minted at the child leg's own runner chokepoint and carry the #281 件A identity envelope plus a
+     * terminal status summary — see {@link DelegationLifecycleEvent} for the emission points, the
+     * per-leg semantics and the recorded honest absences. Wire it once at Runner construction; a
+     * deployment needs NO RunInternals access to observe delegation any more. Observation only — a
+     * throwing or rejecting observer is contained ({@link deliverDelegationLifecycle}) and never
+     * faults the child run; a PRESENT non-function value here is announced once per process and the
+     * frames are simply not delivered (#123 — a bad seat must be loud, and this stream's loud exit is
+     * the seat defect, not a per-frame console flood).
+     */
+    onDelegationLifecycle?: (event: DelegationLifecycleEvent) => void;
     /**
      * design/98 (S8) — the HARD sandbox seam for LLM-AUTHORED workflow scripts (`TaskSpec.selfOrchestration`).
      * A deployment supplies an isolated-vm / separate-process runner whose `safeForUntrustedScripts === true`;
@@ -4866,7 +5127,7 @@ export interface RunnerDeps {
      *  resolves a saved workflow, and a registration's `defaultArgs` merge under the call-time args. Opt-in
      *  (absent ⇒ inline `script` + built-in names only). */
     workflowScriptStore?: import("../orchestration/workflow-script-store.js").WorkflowScriptStore;
-    /** design/140 §6 1c — `false` removes the BUILT-IN named workflows (`team-discussion`, …) from the
+    /** design/140 §6 1c — `false` removes the BUILT-IN named workflows (`discussion`, …) from the
      *  auto-mounted run_workflow tool (the `builtinAgents:false` analog; default ON). A deployment
      *  `workflowScriptStore` registration of the same name shadows a built-in regardless. */
     builtinWorkflows?: boolean;
@@ -5047,6 +5308,28 @@ export interface RunnerDeps {
     mcpImageResizer?: import("./mcp.js").McpImageResizer;
     /** Default tool-call gate for all tasks (a task's own `toolPolicy` overrides this). */
     toolPolicy?: import("./tool-policy.js").ToolPolicy;
+    /**
+     * design/277 — the deployment seat of the tool-registration MODEL GATE (default ON; the gate
+     * itself only ever touches entries tagged via {@link ToolSpec.modelGate}, so an untagged roster
+     * is byte-identical under any value here):
+     *  · `false` — deployment kill switch: the gate never trims anything.
+     *  · `{ classes }` — per-class rule rows merged into the built-in table
+     *    ({@link import("./tool-model-gate.js").TOOL_MODEL_GATE_CLASSES}) PER AXIS: a present
+     *    `floors`/`modelIds` axis REPLACES that axis, an absent axis INHERITS the built-in one — so
+     *    a row adding only `modelIds` (the BYOM channel for gating a deployment's own strong model)
+     *    keeps the built-in claude floors armed. `floors: []` / `modelIds: []` are the EXPLICIT
+     *    per-axis clears; a class whose merged rule has both axes empty gates nothing (legal
+     *    per-class off). New class names extend the open vocabulary for deployment-authored tags.
+     * The legality set is CLOSED (#123): any other shape — array/null/true seat, unknown keys at
+     * either level, malformed floors/modelIds rows, families that can never match the canonical id
+     * grammar, duplicate families/ids, `/`-prefixed ids — refuses the prepare loudly
+     * (`config.tool_model_gate_invalid`), never folds to a guess. Process-level counterpart: env
+     * `SEMA_TOOL_MODEL_GATE=off`. Removals are announced per (model, class) through `onNotice`
+     * (`config.tool_model_gate_removed`) — a silent default-face trim is forbidden (#237).
+     */
+    toolModelGate?: false | {
+        classes?: Record<string, import("./tool-model-gate.js").ToolModelGateRule>;
+    };
     /** Deployment default for {@link TaskSpec.basePolicyForResumeEdit} (#93 / F-012 L3): the resume-edit
      *  re-adjudication override. Resolution: `spec.basePolicyForResumeEdit ?? THIS ?? (spec.toolPolicy ??
      *  deps.toolPolicy)` — absence falls back to the caller policy, never to a silent skip. */

package/dist/core/types.js

@@ -1,3 +1,24 @@
+import { observeThenableRejection } from "./safe-notify.js";
+let malformedDelegationSeatAnnounced = false;
+export function __resetMalformedDelegationSeatAnnouncement() {
+    malformedDelegationSeatAnnounced = false;
+}
+export function deliverDelegationLifecycle(seat, event, notifier, site) {
+    if (typeof seat === "function") {
+        const frame = Object.freeze(Object.assign(Object.create(null), event));
+        notifier.notify(() => observeThenableRejection(seat(frame), notifier, site), site);
+        return;
+    }
+    if (seat !== undefined && !malformedDelegationSeatAnnounced) {
+        malformedDelegationSeatAnnounced = true;
+        try {
+            console.warn(`The delegation-lifecycle sink (RunnerDeps.onDelegationLifecycle) holds ${seat === null ? "null" : typeof seat} — not a ` +
+                `function. Delegation spawn/terminal frames are NOT delivered until the wiring is fixed (omit the key, or wire a function).`);
+        }
+        catch {
+        }
+    }
+}
 let malformedNoticeSeatAnnounced = false;
 export function __resetMalformedNoticeSeatAnnouncement() {
     malformedNoticeSeatAnnounced = false;

package/dist/core/untrusted-text.d.ts

@@ -21,7 +21,7 @@
  * model-facing instructions. Always neutralizes `<system-reminder>` / `</system-reminder>` (the codebase's
  * elevated-authority wrapper) by inserting a zero-width space after the leading `<`. Pass `extraTags` to also
  * neutralize a CALLER's own data-framing tags — e.g. `team.ts` embeds member output inside `<statement>` /
- * `<team-discussion>`, so an untrusted member could emit `</statement>` to break out (search [46] BUG2);
+ * `<discussion>`, so an untrusted member could emit `</statement>` to break out (search [46] BUG2);
  * the caller passes those tag names. Tag names must be literal (alphanumeric/hyphen) — they are code-supplied
  * wrapper names, never untrusted input. Idempotent for prompt assembly (a defused tag no longer matches).
  */

package/dist/index.d.ts

@@ -21,6 +21,7 @@ export { createWebFetchTool, webFetchToolSpec, htmlToText, type WebFetchConfig,
 export { createTodoWriteTool } from "./tools/todo.js";
 export { createTaskListTools, createMemoryTaskListStore, assertJsonMetadata, type TaskListItem, type TaskListStore } from "./tools/task-list.js";
 export { assembleCodeTools, type CodeToolsConfig, CODE_ROLE } from "./scenarios/full-body.js";
+export { TOOL_MODEL_GATE_CLASSES, isModelGatedForClass, type ToolModelGateRule } from "./core/tool-model-gate.js";
 export { capAggregateToolResults, AGGREGATE_TOOL_RESULT_BUDGET_CHARS, DEFAULT_BUDGET_EXEMPT_TOOLS, type AggregateBudgetOptions, } from "./core/tool-result-budget.js";
 export { capAggregateMediaBytes, AGGREGATE_MEDIA_BUDGET_BYTES, type MediaStripInfo } from "./core/media-byte-cap.js";
 export { createAskUserQuestionTool, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, isQuestionUnavailable, type OnQuestionOutcome, type QuestionUnavailable, type OnQuestion, type AskQuestion, type AskQuestionOption, type AskQuestionRequest, type QuestionAnswer, type QuestionAnswerItem, type AskQuestionCardDetails, type AskUserQuestionToolOptions, type AskAnswerContinuationSource, type SyntheticContinuationReason, } from "./core/ask-question.js";
@@ -162,9 +163,9 @@ export { FilePermissionRuleStoreProvider } from "./stores/file/permission-rule-s
 export { adoptFilePermissionRuleStore, type AdoptFileRuleStoreResult } from "./stores/file/permission-rule-adopt.js";
 export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootAdoptionFile, ROOT_ADOPTION_FILE, type AdoptionErrorCode, type AdoptionSource, type AdoptionReport, type AdoptionReceipt, type AdoptionLegReport, type AffectedDeploymentConfig, type RootAdoptionFile, } from "./stores/file/adoption/marker.js";
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, type AdoptionStatus, type AdoptLocalDataRootOptions, type AdoptLocalDataRootResult, type AdoptionCarriageLeg, type AdoptionCarriageLegContext, type AdoptionConfigWitnessReceipt, } from "./stores/file/adoption/adopt.js";
-export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, type PersistedRuleHit, type PersistedRuleUnreadable, type PersistedRuleAnswer, normalizePersistedRuleHit, type Hooks, type HookToolContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
+export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, type PersistedRuleHit, type PersistedRuleUnreadable, type PersistedRuleAnswer, normalizePersistedRuleHit, type Hooks, type HookToolContext, type HookInvocationIdentity, type UserPromptSubmitContext, type PostToolBatchContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type MemoryGetDetails, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type MemoryGetDetails, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryPagedList, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, type SharedMemoryFixture, type SharedMemoryStoreContractHooks, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";
@@ -201,7 +202,7 @@ export { assertWorkflowSandboxConformance, assertWorkflowPrimitivesWiring, asser
 export { WorkflowModelNotAllowedError, type WorkflowAgentSpec } from "./orchestration/workflow-governance.js";
 export { WorkflowMaxAgentsError, WorkflowResultTooLargeError } from "./orchestration/workflow.js";
 export { createFileWorkflowScriptStore, mergeWorkflowArgs, type WorkflowScriptStore, type NamedWorkflowResolution, type NamedWorkflowListing, } from "./orchestration/workflow-script-store.js";
-export { TEAM_DISCUSSION_WORKFLOW_NAME, TEAM_DISCUSSION_SCRIPT, builtinWorkflowDefinitions, builtinWorkflowListings, resolveBuiltinWorkflow, type BuiltinWorkflowDefinition, } from "./orchestration/builtin-workflows.js";
+export { DISCUSSION_WORKFLOW_NAME, DISCUSSION_SCRIPT, TEAM_DISCUSSION_WORKFLOW_NAME, TEAM_DISCUSSION_SCRIPT, canonicalWorkflowName, retiredWorkflowNameAliases, builtinWorkflowDefinitions, builtinWorkflowListings, resolveBuiltinWorkflow, type BuiltinWorkflowDefinition, } from "./orchestration/builtin-workflows.js";
 export { WORKFLOW_AGENT_STALL_MS, WORKFLOW_AGENT_MAX_RETRIES, WORKFLOW_AGENT_THROTTLE_BACKOFF_MS } from "./orchestration/workflow.js";
 export { createRunWorkflowTool, RUN_WORKFLOW_TOOL_NAME, workflowWhenToUseText, renderNamedWorkflowListing, type WorkflowCompletionNotifier, type WorkflowLimits, type RunWorkflowToolDeps, } from "./orchestration/run-workflow-tool.js";
 export { runSideQuery, type SideQuerySpec, type SideQueryResult, type SideQueryToolDef, type SideQueryDeps, type SideQueryMessage } from "./core/side-query.js";
@@ -254,7 +255,7 @@ export { retryBackoffMs, parseRetryAfter } from "./brain/retry.js";
 export { type BrainTimeoutConfig } from "./brain/timeout.js";
 export { createAssistantMessageEventStream } from "./internal/llm.js";
 export type { AssistantMessage, AssistantMessageEvent, CompleteSimpleFn, Context, DocumentContent, ImageContent, Message, StopReason, StreamFn, TextContent, ThinkingContent, ToolCall, ToolResultMessage, Usage, UserMessage, } from "./internal/llm.js";
-export type { AgentDefinition, BeforeWriteHook, BeforeWriteRequest, BeforeWriteResult, HandsBandOptions, Brain, BrainStatus, BrainStatusPhase, BrainRetryErrClass, ImageInput, McpElicitRequest, McpElicitResponse, McpServerSpec, A2aServerSpec, OnElicit, Model, ModelRef, ProjectMemoryLoad, RunnerDeps, EngineNotice, RuntimeCaps, BackgroundChildEvent, SkillManifest, SkillSpec, TaskEvent, TaskEventIdentity, ToolActivity, TaskLimits, StaleToolResultOffloadOptions, TaskResult, RemoteEnvFailureNote, TaskSpec, TaskStatus, TaskStream, CompactOutcome, ThinkingLevel, ToolExecuteContext, ToolReturn, ToolSpec, ReversibilityVerdict, ToolEffect, ToolContentOrigin, WorkflowGovernanceBaseline, DelegationTaskType, } from "./core/types.js";
+export type { AgentDefinition, BeforeWriteHook, BeforeWriteRequest, BeforeWriteResult, HandsBandOptions, Brain, BrainStatus, BrainStatusPhase, BrainRetryErrClass, ImageInput, McpElicitRequest, McpElicitResponse, McpServerSpec, A2aServerSpec, OnElicit, Model, ModelRef, ProjectMemoryLoad, RunnerDeps, EngineNotice, RuntimeCaps, BackgroundChildEvent, DelegationLifecycleEvent, SkillManifest, SkillSpec, TaskEvent, TaskEventIdentity, ToolActivity, TaskLimits, StaleToolResultOffloadOptions, TaskResult, EffectiveMemoryScopes, RemoteEnvFailureNote, TaskSpec, TaskStatus, TaskStream, CompactOutcome, ThinkingLevel, ToolExecuteContext, ToolReturn, ToolSpec, ReversibilityVerdict, ToolEffect, ToolContentOrigin, WorkflowGovernanceBaseline, DelegationTaskType, } from "./core/types.js";
 export { Type } from "typebox";
 export type { TSchema, Static } from "typebox";
 export { explainPromptAssembly, describeDefaultPack, type DefaultPackDescription, type ExplainInput } from "./prompt-assembly/explain.js";

package/dist/index.js

@@ -10,6 +10,7 @@ export { createWebFetchTool, webFetchToolSpec, htmlToText, createWebSearchTool,
 export { createTodoWriteTool } from "./tools/todo.js";
 export { createTaskListTools, createMemoryTaskListStore, assertJsonMetadata } from "./tools/task-list.js";
 export { assembleCodeTools, CODE_ROLE } from "./scenarios/full-body.js";
+export { TOOL_MODEL_GATE_CLASSES, isModelGatedForClass } from "./core/tool-model-gate.js";
 export { capAggregateToolResults, AGGREGATE_TOOL_RESULT_BUDGET_CHARS, DEFAULT_BUDGET_EXEMPT_TOOLS, } from "./core/tool-result-budget.js";
 export { capAggregateMediaBytes, AGGREGATE_MEDIA_BUDGET_BYTES } from "./core/media-byte-cap.js";
 export { createAskUserQuestionTool, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, isQuestionUnavailable, } from "./core/ask-question.js";
@@ -126,7 +127,7 @@ export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootA
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, } from "./stores/file/adoption/adopt.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, normalizePersistedRuleHit, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, erasureSelectHash, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";
@@ -162,7 +163,7 @@ export { assertWorkflowSandboxConformance, assertWorkflowPrimitivesWiring, asser
 export { WorkflowModelNotAllowedError } from "./orchestration/workflow-governance.js";
 export { WorkflowMaxAgentsError, WorkflowResultTooLargeError } from "./orchestration/workflow.js";
 export { createFileWorkflowScriptStore, mergeWorkflowArgs, } from "./orchestration/workflow-script-store.js";
-export { TEAM_DISCUSSION_WORKFLOW_NAME, TEAM_DISCUSSION_SCRIPT, builtinWorkflowDefinitions, builtinWorkflowListings, resolveBuiltinWorkflow, } from "./orchestration/builtin-workflows.js";
+export { DISCUSSION_WORKFLOW_NAME, DISCUSSION_SCRIPT, TEAM_DISCUSSION_WORKFLOW_NAME, TEAM_DISCUSSION_SCRIPT, canonicalWorkflowName, retiredWorkflowNameAliases, builtinWorkflowDefinitions, builtinWorkflowListings, resolveBuiltinWorkflow, } from "./orchestration/builtin-workflows.js";
 export { WORKFLOW_AGENT_STALL_MS, WORKFLOW_AGENT_MAX_RETRIES, WORKFLOW_AGENT_THROTTLE_BACKOFF_MS } from "./orchestration/workflow.js";
 export { createRunWorkflowTool, RUN_WORKFLOW_TOOL_NAME, workflowWhenToUseText, renderNamedWorkflowListing, } from "./orchestration/run-workflow-tool.js";
 export { runSideQuery } from "./core/side-query.js";