@sema-agent/core 5.44.0 → 5.45.0

package/CHANGELOG.md

@@ -1,5 +1,58 @@
 # Changelog
 
+## 5.45.0 — 2026-08-19
+
+### Added
+- `RunnerDeps.memoryDelegationEvidence?: "static-face" | "attested-only"` (design/324, ruling-1
+  stopgap): the deployment's evidence standard for delegation-driven memory pollution.
+  `"attested-only"` retires ONLY the static capability-face mark (the "a child COULD reach
+  external content" over-approximation); the attestation-observed mark (`att === "external"`),
+  the chain's `incomplete` honesty, `recordExternal`, non-delegation classification and the
+  pre-call direct-class mark all stay. Key absent ≡ `"static-face"` ≡ byte-identical behavior.
+  A malformed value is refused loudly (`config.memory_delegation_evidence`, exact-spelling gate).
+  ACCEPTED COST (the deployment's to own): with `"attested-only"`, a BACKGROUND child's real
+  external contact does not mark this session — its content re-enters via TaskOutput /
+  task-notification / AgentTranscript, none of which carries an attestation.
+- `memory.delegation_static_mark_waived` EngineNotice — mandatory companion: minted at most once
+  per prepared leg when the knob actually waives a static-face mark on a pollution-armed chain
+  (`detail: {subagentType?, sessionId?}`; reason carries the waived mark's own sentence, bounded).
+- `TaskResult.effectiveReasoning?: ResolvedReasoning` (#327b): the leg's effective reasoning
+  resolution echoed on the result — same object the `reasoning.resolved` trace event carries
+  (two faces, one mint); rides the backstop/`resume.tool_unavailable` carrier like its
+  precedents. `ReasoningFormat` gains `"responses"` (dispatched by api family, single-source
+  `RESPONSES_APIS`).
+- Cross-session recall pins (#260 verdict: engine clean): the consumer contract is pinned —
+  the model's final answer text exists BEFORE the terminal harvest commits, `TaskStream.result()`
+  is the commit boundary, and a consumer that prints the answer and kills the worker without
+  awaiting `result()` strands the entry id-less on disk (the incident's exact evidence shape).
+
+### Changed
+- The reasoning resolver mirrors `thinkingLevelMap`'s null arm (5.45 rescan): a clamped tier the
+  model maps to `null` is reported tier-not-honored (`graded:false`, intent echo) — matching what
+  the wire appliers actually send (nothing) instead of claiming "honored exactly"; the r3/r4
+  mirror comment now names all three arms. `resolveEffort` reads a malformed non-array
+  `reasoningEffortLevels` as undeclared (member-level filtering: garbage/sparse/"off" entries can
+  no longer become clamp targets) — a catalog typo no longer fails the whole thinking-on leg with
+  a raw TypeError (5.44.0 regression window closed before release).
+- The #260 pins tell the bounded-teardown truth: `result()` settles after the harvest LEG settled
+  (committed, or its 15s timeout REPORTED — never silent), the discriminative arm polls 50 ticks
+  (the abandon arm sat inside the old 1-tick slack), and the incident-scale argument is stated.
+- `reasoning.resolved` now fires a LOUD DROP frame (`dropped: true`, `effective: "off"`) on
+  models whose `Model.reasoning` is falsy — a user-requested effort tier no longer evaporates
+  silently (#325). The public `resolveReasoning` reports the drop arm for such models; the
+  capable arm is byte-identical. The capability predicate is truthiness (matching every adapter),
+  and `supportsReasoningEffort === false` mirrors the ungraded intent-only arm.
+
+### Fixed
+- The two 5.44.0 pollution notices are DISPOSITIONED in the governance registry and the
+  error-surface cap vocabulary gained `inlineUntrusted`/`pollutionSentence` (both bounded by
+  contract) — landed as gate-family debts caught by the full-suite leg.
+
+### Notes
+- Commit `2f78edb7` (the delegation-evidence knob) carries the `TaskResult.effectiveReasoning`
+  declaration hunk of the parallel effort car (shared-checkout staging race; HEAD is consistent).
+  Do not cherry-pick that commit alone.
+
 ## 5.44.0 — 2026-08-19
 
 ### Added

package/dist/agents/subagent.d.ts

@@ -297,7 +297,9 @@ export declare function completedAgentCard(child: {
      *  recorder aggregate at delivery. Present only when the parent chain armed the recorder; the
      *  parent-side judgment (the content-origin wrap) reads it off this card — `clean` retires the
      *  static face verdict for this call, `external` marks with the observed-event reason, `unknown`
-     *  (or absence) keeps the static floor. Deliberate whitelist admission (see the boundary note). */
+     *  (or absence) keeps the static floor, whose mark action follows the parent run's deployment
+     *  evidence standard (design/324, `RunnerDeps.memoryDelegationEvidence`). Deliberate whitelist
+     *  admission (see the boundary note). */
     attestation?: import("../core/memory-engine/delegation-provenance.js").DelegationAttestation;
 }): Record<string, unknown>;
 /**

package/dist/brain/reasoning.d.ts

@@ -34,7 +34,20 @@ export type ReasoningFormat = "openai" | "openrouter" | "deepseek" | "together"
 /** Anthropic `output_config.effort` (CC 2.1.198 / Fable-5 class, design/119): the tier is a named
  *  effort string, clamped to `compat.effortLevels` — the anthropic-side twin of the OpenAI
  *  `reasoning_effort` path (thinking FORM is `thinkingMode`; effort carries the intensity). */
- | "effort";
+ | "effort"
+/** OpenAI Responses API (`openai-responses` / `azure-openai-responses`, design/163): the tier rides
+ *  the NESTED `reasoning: { effort }` request field (open-responses.ts `resolveWireEffort`), clamped
+ *  by the same {@link resolveEffort} against `compat.reasoningEffortLevels` — NOT the completions
+ *  top-level `reasoning_effort` the `"openai"` tag names. #325 review r3: before this member the
+ *  resolver fell through to the completions default and labeled Responses resolutions `"openai"`. */
+ | "responses";
+/**
+ * The Open Responses API family — every `Api` value `createOpenResponsesBrain` serves (design/163).
+ * The SINGLE family discriminant: request-params.ts (reserved-key set selection) and
+ * {@link resolveReasoning} (format dispatch, #325 review r4) both key off THIS set, so a new
+ * Responses api value added here reaches every family-scoped behavior instead of one of two twins.
+ */
+export declare const RESPONSES_APIS: ReadonlySet<string>;
 /** How a requested intensity resolved against one endpoint's real capability. */
 export interface ReasoningResolution {
     /** The level the caller asked for. */
@@ -43,9 +56,10 @@ export interface ReasoningResolution {
     effective: ThinkingLevel;
     /**
      * True when the endpoint varies behavior by intensity (effort tiers / token budget). False = binary
-     * enable-only (qwen / zai / qwen-chat-template, or an effort endpoint that declares
-     * `supportsReasoningEffort:false`): thinking is on or off and the tier is NOT honored — read this alongside
-     * {@link effective}, which then echoes the request as intent only.
+     * enable-only (qwen / zai / qwen-chat-template, an effort endpoint that declares
+     * `supportsReasoningEffort:false`, or a tier `Model.thinkingLevelMap` maps to `null` — the wire then
+     * carries NO effort value for it): thinking is on or off and the tier is NOT honored — read this
+     * alongside {@link effective}, which then echoes the request as intent only.
      */
     graded: boolean;
     /** True when {@link effective} differs from {@link requested} (the request couldn't be honored exactly). */
@@ -62,6 +76,23 @@ export interface ResolvedReasoning extends ReasoningResolution {
     format: ReasoningFormat;
     /** A coarse endpoint label for the trace (`model.api` — e.g. `openai-completions`, `anthropic-messages`). */
     endpoint: string;
+    /**
+     * Present (true) only when the model declares NO reasoning capability (`Model.reasoning` falsy): every
+     * brain early-returns on that flag (openai.ts applyThinking / anthropic.ts / open-responses.ts
+     * resolveWireEffort), so NO thinking
+     * parameter reaches the wire at all — the requested tier is DROPPED entirely, not clamped or
+     * downgraded-to-binary. `effective:"off"` here states the ENGINE side of that fact (nothing was
+     * requested), NOT a measured gateway state: on the binary enable-only formats (qwen / zai /
+     * qwen-chat-template) parameter ABSENCE is provider-default, and a default-on gateway may still
+     * reason at its own tier — the brains deliberately send no disable key for a model declared
+     * non-reasoning, so the engine cannot claim a measured off there; `format` tells a consumer which
+     * family applies (on every other format, absence is the closest the wire has to off — see
+     * applyThinking's own contract). `format`/`endpoint` report the family that WOULD have carried the
+     * tier (the why-shape a consumer diagnoses with, not a claim about the request). Absent on every
+     * reasoning-capable resolution, so existing consumers see byte-identical objects. Loud-bad-values
+     * rule: the one arm where the request evaporates must not be the one arm with no report.
+     */
+    dropped?: true;
 }
 /**
  * Resolve a requested intensity against a model END-TO-END, dispatching on its wire format the SAME way the
@@ -74,6 +105,17 @@ export interface ResolvedReasoning extends ReasoningResolution {
  * - Binary enable-only formats (qwen / zai / qwen-chat-template) → `graded:false` (tier not honored).
  * - An effort endpoint with `supportsReasoningEffort:false` → `graded:false` (enable key only, no effort tier).
  * - Otherwise effort-based → clamp DOWN to the endpoint's `reasoningEffortLevels` (default minimal|low|medium|high).
+ * - A CLAMPED tier that `model.thinkingLevelMap` maps to `null` (declared unsupported on this model) →
+ *   `graded:false`: both effort-wire appliers key the map by the post-clamp tier and then carry NO effort
+ *   value (thinking still enables via the format's own enable key where one exists), so the tier is not
+ *   honored. Previously this resolver never read the map and reported such a request as exactly honored
+ *   (`graded:true`, `clamped:false`) while the wire dropped the value — trace/result-face drift.
+ *
+ * - A model whose `reasoning` capability flag is FALSY drops the request ENTIRELY (neither brain emits any
+ *   thinking parameter, whatever the format) → `effective:"off"`, `graded:false`, `clamped:true`,
+ *   `dropped:true` — the loud-drop arm. Previously this resolver described the capability dispatch for such
+ *   a model (a resolution the request never carried), and the runner's trace guard skipped the frame — the
+ *   one arm where the request evaporates was the one arm with no disclosure.
  *
  * `off`/falsy never enables thinking, so it resolves trivially (no clamp, graded:true) — the caller decides
  * whether to emit at all.
@@ -82,12 +124,16 @@ export declare function resolveReasoning(requested: ThinkingLevel, model: {
     api?: string;
     reasoning?: boolean;
     compat?: unknown;
+    thinkingLevelMap?: Readonly<Partial<Record<ThinkingLevel, string | null>>>;
 }): ResolvedReasoning;
 /**
  * Resolve a requested intensity for an effort-based endpoint (`reasoning_effort` / `reasoning.effort`). Picks
  * the requested tier when supported; otherwise the highest supported tier ≤ requested (clamp DOWN, never
  * silently up); if none is ≤ requested (the endpoint's set is entirely higher — unusual), the lowest supported
  * tier. Never returns a value outside `allowed`, so the brain can't emit a tier the endpoint would 422.
+ * A malformed `allowed` reads as UNDECLARED → the conservative default set (non-array, empty, or no
+ * valid member); individually invalid MEMBERS (garbage strings, sparse holes, `"off"` — not a legal
+ * member of the 6-tier compat effort sets) are dropped, so they can never become a clamp target.
  */
 export declare function resolveEffort(requested: ThinkingLevel, allowed?: readonly ThinkingLevel[]): ReasoningResolution;
 /**

package/dist/brain/reasoning.js

@@ -15,7 +15,18 @@ export function rankOf(level) {
 }
 export const DEFAULT_EFFORT_LEVELS = ["minimal", "low", "medium", "high"];
 const BINARY_FORMATS = new Set(["qwen", "zai", "qwen-chat-template"]);
+export const RESPONSES_APIS = new Set(["openai-responses", "azure-openai-responses", "openai-chatgpt-responses"]);
 export function resolveReasoning(requested, model) {
+    const resolved = dispatchReasoning(requested, model);
+    if (requested !== "off" && !model.reasoning) {
+        return { requested, effective: "off", graded: false, clamped: true, format: resolved.format, endpoint: resolved.endpoint, dropped: true };
+    }
+    return resolved;
+}
+function effortTierUnmapped(requested, effective, model) {
+    return requested !== "off" && model.thinkingLevelMap?.[effective] === null;
+}
+function dispatchReasoning(requested, model) {
     const endpoint = model.api ?? "unknown";
     const compat = (model.compat ?? {});
     if (model.api === "anthropic-messages") {
@@ -24,6 +35,16 @@ export function resolveReasoning(requested, model) {
         }
         return { requested, effective: requested, graded: true, clamped: false, format: "budget", endpoint };
     }
+    if (model.api !== undefined && RESPONSES_APIS.has(model.api)) {
+        if (compat.supportsReasoningEffort === false) {
+            return { requested, effective: requested, graded: false, clamped: false, format: "responses", endpoint };
+        }
+        const responsesResolved = resolveEffort(requested, compat.reasoningEffortLevels ?? DEFAULT_EFFORT_LEVELS);
+        if (effortTierUnmapped(requested, responsesResolved.effective, model)) {
+            return { requested, effective: requested, graded: false, clamped: false, format: "responses", endpoint };
+        }
+        return { ...responsesResolved, format: "responses", endpoint };
+    }
     const format = compat.thinkingFormat ?? "openai";
     if (BINARY_FORMATS.has(format)) {
         return { ...resolveBinary(requested), format, endpoint };
@@ -32,15 +53,15 @@ export function resolveReasoning(requested, model) {
     if (!supportsEffort && format !== "openrouter") {
         return { requested, effective: requested, graded: false, clamped: false, format, endpoint };
     }
-    return {
-        ...resolveEffort(requested, compat.reasoningEffortLevels ?? DEFAULT_EFFORT_LEVELS),
-        format,
-        endpoint,
-    };
+    const resolved = resolveEffort(requested, compat.reasoningEffortLevels ?? DEFAULT_EFFORT_LEVELS);
+    if (effortTierUnmapped(requested, resolved.effective, model)) {
+        return { requested, effective: requested, graded: false, clamped: false, format, endpoint };
+    }
+    return { ...resolved, format, endpoint };
 }
 export function resolveEffort(requested, allowed = DEFAULT_EFFORT_LEVELS) {
-    if (allowed.length === 0)
-        allowed = DEFAULT_EFFORT_LEVELS;
+    const declared = Array.isArray(allowed) ? allowed.filter((lvl) => isThinkingLevel(lvl) && lvl !== "off") : [];
+    allowed = declared.length > 0 ? declared : DEFAULT_EFFORT_LEVELS;
     if (requested === "off" || allowed.includes(requested)) {
         return { requested, effective: requested, graded: true, clamped: false };
     }

package/dist/brain/request-params.d.ts

@@ -1,15 +1,3 @@
-/**
- * Request-parameter passthrough (design/40). A deployment can set official provider params it wants but
- * core doesn't model as first-class fields (OpenAI `frequency_penalty`/`presence_penalty`/`top_p`/`seed`/
- * `logit_bias`; Anthropic `top_k`/`top_p`/`stop_sequences`; …) via `Model.extraBody`, and core merges them
- * into the brain's request body. Anchored at the **Model** level (not per-turn) so the serialized body
- * stays byte-stable across turns → the prefix cache holds (design/9/31).
- *
- * Symmetric: each brain owns its structural + tuning keys (`reserved`) and ALWAYS wins — `extraBody` can
- * only supply the long tail, never clobber `messages`/`tools`/`temperature`/etc. Stripping is the safety
- * enforcement (the brains are standalone-usable); `prepareTask` separately warns on a collision (it has
- * `onError`, the brain doesn't — council design/40).
- */
 /** OpenAI request-body keys core owns; `extraBody` cannot override these. */
 export declare const OPENAI_RESERVED: ReadonlySet<string>;
 /** Anthropic request-body keys core owns; `extraBody` cannot override these. (Note the asymmetry vs

package/dist/brain/request-params.js

@@ -1,3 +1,4 @@
+import { RESPONSES_APIS } from "./reasoning.js";
 export const OPENAI_RESERVED = new Set([
     "model",
     "messages",
@@ -38,7 +39,6 @@ export const RESPONSES_RESERVED = new Set([
     "previous_response_id",
     "conversation",
 ]);
-const RESPONSES_APIS = new Set(["openai-responses", "azure-openai-responses", "openai-chatgpt-responses"]);
 export function reservedFor(api) {
     if (RESPONSES_APIS.has(api))
         return RESPONSES_RESERVED;

package/dist/core/governance-codes.js

@@ -16,6 +16,7 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.pollution_mark_failed",
     "memory.session_polluted",
     "memory.harvest_quarantined",
+    "memory.delegation_static_mark_waived",
     "memory.challenge_sweep_failed",
     "memory.lineage_settle_failed",
     "memory.challenge_ledger_corrupt",

package/dist/core/memory-engine/content-origin.d.ts

@@ -66,9 +66,12 @@ export interface AgentPoolTool {
  * A child that can reach a network or protocol tool returns content from outside the trust boundary
  * just as surely as calling that tool in this session would, and the parent's transcript is where it
  * lands. The judgment is STATIC — the child's face is known from its definition before the call — so
- * nothing here tracks what the child actually did (runtime provenance is the v2 ticket). That makes
- * it conservative in the safe direction: a child that COULD reach external content counts as having
- * done so.
+ * nothing here tracks what the child actually did (runtime provenance is design/180 half A). That
+ * makes it conservative in the safe direction: a child that COULD reach external content counts as
+ * having done so. Whether this verdict MARKS the judging session's memory when no attestation
+ * arrives is the deployment's evidence standard (design/324,
+ * `RunnerDeps.memoryDelegationEvidence`) — the classification itself is value-independent, and the
+ * wrap computes it on every standard (the waiver announcement keys on it).
  *
  * `pool` is the CHILD'S pool, not the parent's roster: a delegation tool carries its own tool set, and
  * the two are explicitly allowed to differ — a parent mounting nothing but the delegation tool can

package/dist/core/memory-engine/delegation-provenance.d.ts

@@ -1,10 +1,13 @@
 /**
  * design/180 half A — delegation RUNTIME provenance: the three-value attestation and its monotonic
  * aggregate. The static tool-face judgment ({@link import("./content-origin.js").delegationCallIsExternal})
- * stays the PERMANENT FLOOR: runtime evidence may only retire the static verdict when a COMPLETE
- * clean proof is in hand; any evidence gap falls back to the floor. "We could not prove it clean"
- * and "it is clean" are different answers — replacing the floor outright would fail OPEN on every
- * evidence gap (old child vintages, crashes, un-armed sessions).
+ * stays the FLOOR of the attestation reduction: runtime evidence may only retire the static verdict
+ * when a COMPLETE clean proof is in hand; any evidence gap falls back to the floor. "We could not
+ * prove it clean" and "it is clean" are different answers — replacing the floor outright would fail
+ * OPEN on every evidence gap (old child vintages, crashes, un-armed sessions). Whether the floor's
+ * verdict MARKS the judging session's memory is a separate, deployment-governed question
+ * (design/324, `RunnerDeps.memoryDelegationEvidence`): the reduction semantics here never change
+ * with that key — only the mark action at the judging run's wrap does.
  *
  * The aggregate is two MONOTONIC bits plus versioning:
  *  - `sawExternal` — an actually-observed polluting-class invocation (own recorder, or a delivered
@@ -17,8 +20,9 @@
  * "clean" unprovable; it can never make an observed event disappear).
  */
 /** The three-value delegation attestation. Only `clean` changes behavior (the parent skips the
- *  static mark); `unknown` is byte-equivalent to absence (static floor governs); `external` marks
- *  unconditionally, with the observed-event reason. */
+ *  static mark); `unknown` is byte-equivalent to absence (the static floor governs — its mark
+ *  action subject to the judging run's deployment evidence standard, design/324); `external` marks
+ *  unconditionally on every evidence standard, with the observed-event reason. */
 export type DelegationAttestation = "clean" | "external" | "unknown";
 /** The monotonic per-run provenance aggregate (in-process this slice; the durable-checkpoint
  *  persistence leg rides the background-face slice — absence after a resume reads `incomplete`,
@@ -58,5 +62,6 @@ export declare function reduceDelegationAttestation(agg: DelegationProvenanceAgg
     completed: boolean;
 }): DelegationAttestation;
 /** Read a delivered card's attestation field (the explicit-whitelist handback seat). Anything but
- *  the three spellings — including absence — reads as undefined, i.e. the static floor governs. */
+ *  the three spellings — including absence — reads as undefined, i.e. the static floor governs
+ *  (whether that floor MARKS is the judging run's deployment evidence standard, design/324). */
 export declare function readCardAttestation(details: unknown): DelegationAttestation | undefined;

package/dist/core/runner/assemble-result.d.ts

@@ -133,6 +133,11 @@ export interface ResultFlags {
      *  read-posture seats above: present iff prepare completed (the memory-less states are their own
      *  values — absence means only "prepare never ran to completion"). */
     effectiveMemoryScopes?: TaskResult["effectiveMemoryScopes"];
+    /** #327 — the leg's effective reasoning resolution, echoed on `TaskResult.effectiveReasoning`.
+     *  Pure pass-through on every terminal (same law as the read-posture seats): the SAME object the
+     *  `reasoning.resolved` trace frame carried (runtask resolves once per leg — two faces, one mint);
+     *  absent when thinking was off/unset for the leg, so the key is omitted. */
+    effectiveReasoning?: TaskResult["effectiveReasoning"];
     /** ruled 2026-08-04 — the usage-governance wait hint carried by the platform terminal the run adopted
      *  (`undefined` for every other cause: an expiring environment has no return time to give, and a store
      *  failure is not a window). Passed as data rather than read back off `threw` so the seat has a typed

package/dist/core/runner/assemble-result.js

@@ -165,5 +165,5 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
     void _internalCompaction;
     if (flags.unpricedSpend)
         delete publicStats.costMicroUsd;
-    return { taskId, sessionId, status, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, blockedReason, errorMessage, errorCode, ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), checkpointToken, ...(checkpointId !== undefined ? { checkpointId } : {}), checkpointGate, ...(workspaceRestoreMode !== undefined ? { workspaceRestoreMode } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: flags.remoteEnvFailures } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), stats: publicStats };
+    return { taskId, sessionId, status, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, blockedReason, errorMessage, errorCode, ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), checkpointToken, ...(checkpointId !== undefined ? { checkpointId } : {}), checkpointGate, ...(workspaceRestoreMode !== undefined ? { workspaceRestoreMode } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: flags.remoteEnvFailures } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), stats: publicStats };
 }

package/dist/core/runner/prepare-config-doors.d.ts

@@ -144,6 +144,12 @@ export interface PrepareConfigDoorsResult {
          *  material; the in-force arm never lands here — it throws at the door). */
         discardedEnvRaw: string | undefined;
     };
+    /** owned — the NORMALIZED per-leg delegation-evidence standard (design/324): the deps seat read
+     *  ONCE, in this synchronous pre-await stretch, screened, and absent folded to the "static-face"
+     *  default. The delegation wrap consumes THIS value, never the live deps object — a deps seat
+     *  mutated (or getter-backed) after the door must not present an unscreened value to the mark
+     *  branch (the #245 5.33 read-once posture). */
+    memoryDelegationEvidence: "static-face" | "attested-only";
     /** owned — validated deployment governance windows (undefined = ungoverned). */
     usageWindows: readonly UsageWindow[] | undefined;
     /** owned, out-param cell — created EMPTY here; the brain-call wiring later installs into

package/dist/core/runner/prepare-config-doors.js

@@ -132,6 +132,22 @@ export function prepareConfigDoors(input) {
     }
     assertReadFaceValue(spec.readFace, "TaskSpec.readFace");
     assertReadFaceValue(deps.readFace, "readFace (deployment seat)");
+    const memoryDelegationEvidenceRaw = deps.memoryDelegationEvidence;
+    if (memoryDelegationEvidenceRaw !== undefined && memoryDelegationEvidenceRaw !== "static-face" && memoryDelegationEvidenceRaw !== "attested-only") {
+        const evidence = memoryDelegationEvidenceRaw;
+        const got = typeof evidence === "string"
+            ? JSON.stringify(evidence.length > 64 ? `${evidence.slice(0, 64)}…` : evidence)
+            : evidence === null
+                ? "null"
+                : Array.isArray(evidence)
+                    ? "an array"
+                    : typeof evidence;
+        const e = new Error(`RunnerDeps.memoryDelegationEvidence must be "static-face" or "attested-only" when present (got ${got}) — ` +
+            `an unevaluable evidence standard is refused loudly, never folded to either standard.`);
+        e.code = "config.memory_delegation_evidence";
+        throw e;
+    }
+    const memoryDelegationEvidence = memoryDelegationEvidenceRaw === "attested-only" ? "attested-only" : "static-face";
     if (spec.resumeAtMode !== undefined) {
         if (spec.resumeAt === undefined) {
             const e = new Error(`resumeAtMode "${spec.resumeAtMode}" requires resumeAt (there is no branch target to position against)`);
@@ -294,6 +310,7 @@ export function prepareConfigDoors(input) {
         compModel,
         fableMitigations,
         modelGate,
+        memoryDelegationEvidence,
         usageWindows,
         brainCallGuardrailRef,
         brainCallGuardrailMs,

package/dist/core/runner/prepare-task.d.ts

@@ -1092,7 +1092,9 @@ export interface RunInternals {
      * it); `contentSafety` is the chain's FROZEN classification snapshot — the child may narrow it
      * with its own config, never widen (design/180 A-2). Trusted internals chain only, same posture as
      * {@link inheritedGate}. Absent ⇒ the child records nothing (its deliveries then read `unknown`,
-     * and every judgment falls back to the static floor — fail-closed by construction).
+     * and every judgment falls back to the static floor — fail-closed by construction; whether the
+     * floor's verdict MARKS the judging session follows that run's deployment evidence standard,
+     * {@link RunnerDeps.memoryDelegationEvidence}).
      */
     delegationProvenance?: {
         ref: {

package/dist/core/runner/prepare-task.js

@@ -333,7 +333,7 @@ function cwdConflictsRestoreError(requestedCwd) {
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf) {
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
     spec = doors.spec;
-    const { toolFaceSnapshot, promptProfile, lockedPreflight, resolvedInteractionPosture, resolvedRole, model, thinking, compModel, fableMitigations, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
+    const { toolFaceSnapshot, promptProfile, lockedPreflight, resolvedInteractionPosture, resolvedRole, model, thinking, compModel, fableMitigations, memoryDelegationEvidence, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
     announceToolModelGate(deps.onNotice, model.id, doors.modelGate);
     const { toolEffects, egressTools, irreversibleTools, irreversibilityTier, axisExplicitNegatives, reversibilityProbes, ownToolNames } = prepareSafetyScan({ spec, deps });
     let shellGatedBash = false;
@@ -1855,6 +1855,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const delegationProvenanceChannel = internals?.delegationProvenance;
         if (memoryEngineSession !== undefined || delegationProvenanceChannel !== undefined) {
             const pollution = memoryEngineSession?.pollution;
+            const delegationEvidenceAttestedOnly = memoryDelegationEvidence === "attested-only";
+            let staticMarkWaiverAnnounced = false;
             const effectiveSafety = narrowContentSafety(delegationProvenanceChannel?.contentSafety, memoryEngineSession?.contentSafety);
             const trustedTools = effectiveSafety.trustedTools;
             const execIsExternalContent = effectiveSafety.execIsExternalContent;
@@ -1934,8 +1936,28 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             }
                             else if (att !== "clean") {
                                 if (external) {
-                                    mark(`tool "${t.name}" returned the output of a delegated agent whose tool face can reach external content` +
-                                        (typeof requested === "string" ? ` (subagent_type "${requested}")` : " (no subagent_type named — classified fail-closed)"));
+                                    const staticFaceReason = `tool "${t.name}" returned the output of a delegated agent whose tool face can reach external content` +
+                                        (typeof requested === "string" ? ` (subagent_type "${requested}")` : " (no subagent_type named — classified fail-closed)");
+                                    if (!delegationEvidenceAttestedOnly) {
+                                        mark(staticFaceReason);
+                                    }
+                                    else if (pollution !== undefined && !staticMarkWaiverAnnounced) {
+                                        staticMarkWaiverAnnounced = true;
+                                        const waivedReason = inlineUntrusted(staticFaceReason, 200);
+                                        deliverEngineNotice(deps.onNotice, {
+                                            code: "memory.delegation_static_mark_waived",
+                                            message: `Delegation static-face pollution mark waived: ${waivedReason}. The deployment configured ` +
+                                                `memoryDelegationEvidence="attested-only", so a static tool-face verdict alone does not mark this ` +
+                                                `session's memory polluted; a delivered "external" attestation and a direct polluting-class ` +
+                                                `invocation still mark, and on a provenance-armed chain this delegation still records as ` +
+                                                `incomplete. At most one notice per prepared task leg.`,
+                                            detail: {
+                                                reason: waivedReason,
+                                                ...(typeof requested === "string" ? { subagentType: inlineUntrusted(requested, 120) } : {}),
+                                                sessionId,
+                                            },
+                                        });
+                                    }
                                 }
                                 recordIncomplete();
                             }

package/dist/core/runner/runtask.js

@@ -1661,6 +1661,7 @@ export class Runner {
                 errorCode: code,
                 ...(remoteEnvFailure !== undefined ? { remoteEnvFailures: remoteEnvFailure } : {}),
                 ...(taskIdRef.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: taskIdRef.effectiveMemoryScopes } : {}),
+                ...(taskIdRef.effectiveReasoning !== undefined ? { effectiveReasoning: taskIdRef.effectiveReasoning } : {}),
                 ...(() => {
                     const hinted = err.retryAfterMs;
                     return code === "memory.admission_required" && typeof hinted === "number" && Number.isFinite(hinted) && hinted > 0
@@ -2468,23 +2469,24 @@ export class Runner {
                 ts: Date.now(),
             }));
         }
-        if (prepared.thinking && prepared.thinking !== "off" && prepared.model.reasoning === true) {
-            emitTrace(rs.telemetry.tracer, () => {
-                const r = resolveReasoning(prepared.thinking, prepared.model);
-                return {
-                    kind: "reasoning.resolved",
-                    version: 1,
-                    taskId: rs.telemetry.taskId,
-                    model: prepared.model.id,
-                    requested: r.requested,
-                    effective: r.effective,
-                    graded: r.graded,
-                    clamped: r.clamped,
-                    format: r.format,
-                    endpoint: r.endpoint,
-                    ts: Date.now(),
-                };
-            });
+        const reasoningResolution = prepared.thinking && prepared.thinking !== "off" ? resolveReasoning(prepared.thinking, prepared.model) : undefined;
+        if (taskIdRef && reasoningResolution !== undefined)
+            taskIdRef.effectiveReasoning = reasoningResolution;
+        if (reasoningResolution !== undefined) {
+            emitTrace(rs.telemetry.tracer, () => ({
+                kind: "reasoning.resolved",
+                version: 1,
+                taskId: rs.telemetry.taskId,
+                model: prepared.model.id,
+                requested: reasoningResolution.requested,
+                effective: reasoningResolution.effective,
+                graded: reasoningResolution.graded,
+                clamped: reasoningResolution.clamped,
+                format: reasoningResolution.format,
+                endpoint: reasoningResolution.endpoint,
+                ...(reasoningResolution.dropped === true ? { dropped: true } : {}),
+                ts: Date.now(),
+            }));
         }
         const effectiveTimeoutMs = spec.limits?.maxWalltimeMs;
         const walltimeMonotonicDeadline = effectiveTimeoutMs !== undefined ? rs.telemetry.taskStartMonotonic + effectiveTimeoutMs : undefined;
@@ -3458,6 +3460,7 @@ export class Runner {
                 effectiveReadFace: prepared.effectiveReadFace,
                 effectiveReadDenyPatterns: prepared.effectiveReadDenyPatterns,
                 effectiveMemoryScopes: prepared.effectiveMemoryScopes,
+                effectiveReasoning: reasoningResolution,
                 retryAfterMs: rs.limits.platformTerminal?.retryAfterMs,
                 abortedForTimeout: timeout.fired,
                 abortedForTurns: rs.limits.turnsExceeded,

package/dist/core/trace.d.ts

@@ -143,8 +143,13 @@ export type TraceEvent = {
     /**
      * How a task's requested reasoning intensity RESOLVED against the model's real capability (design/96 S6).
      * Emitted once at task start when thinking is on, so a deployment can SEE — not silently swallow (§E
-     * honesty red-line) — that a binary provider ignored the tier (`graded:false`) or that an effort endpoint
-     * clamped it down (`clamped:true`). Metadata-only (tiers + format + endpoint, never prompt content).
+     * honesty red-line) — that a binary provider ignored the tier (`graded:false`), that an effort endpoint
+     * clamped it down (`clamped:true`), or that a NON-reasoning model dropped the request entirely
+     * (`dropped:true` — the frame fires for that model too; it used to be the one arm with no report).
+     * Metadata-only (tiers + format + endpoint, never prompt content). The resolution is against the
+     * task's PRIMARY serving model at leg entry (same law as `TaskResult.model`): a mid-run
+     * degradation does not re-emit this frame — the switch is observed on its own seats
+     * (`TaskResult.degraded`).
      */
     kind: "reasoning.resolved";
     version: 1;
@@ -163,6 +168,16 @@ export type TraceEvent = {
     format: string;
     /** Coarse endpoint label (`model.api`, e.g. `openai-completions` / `anthropic-messages`). */
     endpoint: string;
+    /**
+     * Present (true) only when the model declares NO reasoning capability (`Model.reasoning` falsy): the
+     * brains send no thinking parameter at all, so the requested tier was DROPPED — not clamped.
+     * `effective:"off"` states the ENGINE side (nothing was requested), not a measured gateway state:
+     * on the binary enable-only formats (qwen/zai/qwen-chat-template) parameter absence is
+     * provider-default and a default-on gateway may still reason at its own tier — read `format` to
+     * know which family applies. `format`/`endpoint` report the family that WOULD have carried the
+     * tier. Absent on every reasoning-capable resolution (old consumers see identical frames).
+     */
+    dropped?: true;
     /** design/148 S3 (additive, §10.2): the nine-element cache identity — digests only. */
     snapshot?: {
         cacheIdentity: string;

package/dist/core/types.d.ts

@@ -846,7 +846,9 @@ export interface ToolExecuteContext {
      * content-safety snapshot — the tool then mints the child's recorder ref and threads both into
      * the child's trusted `RunInternals.delegationProvenance`. Undefined return / absent field ⇒ the
      * child spawns without a recorder (its deliveries read `unknown` and every judgment stays on the
-     * static floor — v1 behavior byte-identical). Same trust posture as
+     * static floor — whose MARK action follows the judging run's deployment evidence standard,
+     * {@link RunnerDeps.memoryDelegationEvidence}; under the `"static-face"` default this is v1
+     * behavior byte-identical). Same trust posture as
      * {@link inheritedGateForChildren}: never a model/tool argument, never a TaskSpec field.
      */
     delegationProvenanceForChildren?: () => import("./memory-engine/delegation-provenance.js").DelegationContentSafety | undefined;
@@ -2839,6 +2841,29 @@ export interface TaskResult {
      *  `TaskSpec.model` ref (which may be a role / name / `@mention`). Lets a UI echo "served by X" instead of the
      *  requested ref. A mid-run degradation is observed separately (see the degraded-model fields). */
     model?: string;
+    /**
+     * #327 — the leg's effective REASONING resolution: the result-face twin of {@link model} for the thinking
+     * knob. How the requested tier resolved against the serving model's real capability
+     * (`requested`/`effective`/`graded`/`clamped`/`format`/`endpoint`, plus `dropped:true` when a
+     * non-reasoning model dropped the request entirely — field semantics on
+     * {@link import("../brain/reasoning.js").ResolvedReasoning}). It is the SAME resolver output the
+     * `reasoning.resolved` trace frame carries, computed once per leg — the two faces cannot tell different
+     * stories; this seat serves consumers without a tracer (the trace frame is the deployment-observability
+     * face, this is the caller face).
+     *
+     * **In-presence condition** — mirrors the trace frame exactly: present on every terminal of a leg that ran
+     * with a REQUESTED thinking tier other than off/unset (the `spec > role > model.defaultThinking` chain);
+     * absent when thinking was off/unset for the leg, and on prepare failures (the resolution is minted after
+     * prepare). On a resumed task each leg re-resolves against the leg's own serving model.
+     *
+     * **Degradation law** — same as {@link model}, whose resolution this is: the seat describes the leg's
+     * PRIMARY serving model at leg entry. A mid-run degradation (reactive fallback / near-budget switch)
+     * changes the serving model WITHOUT re-minting this seat or its trace twin — read {@link degraded} to see
+     * the switch; the fallback's own reasoning capability is deliberately NOT re-reported here (re-resolving
+     * one face would desync it from the task-start `reasoning.resolved` frame). A consumer needing the
+     * fallback's reasoning posture resolves `degraded.to` itself (`resolveReasoning` is exported).
+     */
+    effectiveReasoning?: import("../brain/reasoning.js").ResolvedReasoning;
     /** Final assistant text. */
     result: string;
     /**
@@ -4710,6 +4735,22 @@ export interface EngineNotice {
      *    time — the withheld count stays true either way). Registered gap: the derived index (`MEMORY.md`) is
      *    contained on a path that mints no rejection row, so an index-ONLY containment produces no
      *    notice and is disclosed by the harvest report's warnings alone.
+     *  - `"memory.delegation_static_mark_waived"` (design/324, #324 ruling ①) — the deployment set
+     *    {@link RunnerDeps.memoryDelegationEvidence} to `"attested-only"` and a delegation call whose
+     *    STATIC tool-face verdict would have marked this session's memory polluted (attestation
+     *    missing/unknown + face can reach external content) was not marked: the waiver is announced —
+     *    the explicit dual of `"memory.session_polluted"` for this arm, so the arm has a voice where a
+     *    mark used to land. MINT-side guarantee only: delivery rides the shared guarded form
+     *    ({@link deliverEngineNotice} — a wired sink that throws owns that loss, exactly as at every
+     *    de-duplicating station), and the leg latch is consumed at mint. Minted only when a pollution
+     *    face is mounted (a
+     *    recorder-only child's mark is a no-op — nothing is waived there), at most ONCE PER PREPARED
+     *    TASK LEG (a resume leg may announce again — a new leg's audit stream is a new fact;
+     *    deliberately no durable once-per-session state), never on the `"static-face"` default, and
+     *    never for a delivered `"external"` attestation (that mark still lands);
+     *    `detail: { reason, subagentType?, sessionId? }` — `reason` is the same sentence the waived
+     *    mark would have carried, neutralized/length-bounded (tool and agent-type names are
+     *    host/model-controlled inputs).
      *
      *  Deliberately NOT a notice family: brain retry/reconnect liveness (a rate limit, a 5xx, a
      *  transient network failure being retried). Those are per-attempt liveness frames with their own
@@ -4858,6 +4899,36 @@ export interface RunnerDeps {
      * bypasses the gate as always — the human already adjudicated it).
      */
     writeProtectedPaths?: readonly import("./write-protect.js").WriteProtectedEntry[];
+    /**
+     * design/324 (#324 ruling ① containment) — the EVIDENCE STANDARD the delegation arm of the
+     * content-origin wrap applies when deciding whether a delegation call marks THIS session's memory
+     * polluted (design/178 §3 / design/180 half A):
+     *  - `"static-face"` (absent ≡ this; the default) — today's behavior, byte-identical: a delegation
+     *    whose delivered attestation is missing/unknown and whose static tool face can reach external
+     *    content marks the session (the capability over-approximation: possibility counts as exposure).
+     *  - `"attested-only"` — exactly that ONE static-face mark is waived, and each prepared leg
+     *    announces the first waiver (`"memory.delegation_static_mark_waived"`). Everything else is
+     *    unchanged: a delivered `"external"` attestation still marks, the chain's `incomplete`
+     *    recording still happens, a non-delegation polluting-class tool still marks, and a delegation
+     *    tool that is ITSELF classified polluting still marks pre-call.
+     * ACCEPTED COST (the deployment's to own, stated as mechanism, not as absence of risk): under
+     * `"attested-only"` a BACKGROUND child's real external contact does not mark this session — its
+     * content re-enters through the TaskOutput result, the task-notification injection, or the
+     * AgentTranscript step summaries, none of which carries an attestation — and a foreground child
+     * that ended abnormally (crash/salvage) is likewise not marked on its face alone (the chain still
+     * records `incomplete`). Already-marked sessions are never retroactively cleaned; the key only
+     * governs NEW marks.
+     * DEPLOYMENT seat ONLY (same posture as {@link readDenyBuiltinTiers}): deliberately no TaskSpec
+     * twin and not in the governed workflow whitelist — a task author or governed script gets no
+     * channel to loosen the evidence standard below its deployment. Not frozen into checkpoints: a
+     * resumed leg follows the CURRENT deployment configuration. Each run reads the deps of the Runner
+     * that PREPARES it — a multi-runner assembly should configure every runner with the same value
+     * (drift is the deployment's own configuration hazard; recorder/attestation semantics are
+     * value-independent, so the chain's evidence quality never varies with this key). Any other value
+     * refuses loudly at prepare (`config.memory_delegation_evidence`, #123 — exact spellings only,
+     * never truthiness).
+     */
+    memoryDelegationEvidence?: "static-face" | "attested-only";
     /**
      * design/199 件A — the DEPLOYMENT's read-face declaration
      * ({@link import("../tools/fs/read-face.js").ReadFace}; see {@link TaskSpec.readFace} for the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.44.0",
+  "version": "5.45.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",