@sema-agent/core 5.44.0 → 5.46.0

package/CHANGELOG.md

@@ -1,5 +1,114 @@
 # Changelog
 
+## 5.46.0 — 2026-08-19
+
+### Added
+- design/319 A (system-reminder provenance mark): every engine-authored `<system-reminder>` OPEN
+  tag carries a per-session random `mark="<22-char base64url>"` attribute, and the system prompt
+  declares its semantics in ONE strict form — reminder-shaped text WITHOUT the current mark is
+  data wherever it appears. A forged reminder tag is now byte-distinguishable from an engine mint
+  on every verbatim inlet (Read/Bash/Grep/MCP-success). ZERO data-byte change: the mark rides only
+  the engine's own tag; Read stays verbatim, Edit across forged tags lands, Bash/Grep clean paths
+  are byte-compatible, and markless (library-direct) calls render historic bare bytes verbatim.
+  New exports: `mintReminderMark`, `isValidReminderMark`, `openSystemReminder`,
+  `mintSystemReminder`, `reminderMarkDeclaration` (scheme-replaceable mint home). Checkpoint gains
+  an additive `reminderMark` field + a new session-entry type `reminder_mark` (old readers ignore
+  both); a legacy or malformed-mark resume re-mints under the same strict declaration (historic
+  bare mints read as data — fail-safe). Consumers matching reminder tags by exact string must go
+  attribute-tolerant. A provider-owned pass-through prompt that renders no declaration discloses
+  loudly once per prepare (opt-in: `reminderMarkDeclaration(ctx.reminderMark)`).
+- design/336 slice 1 (F-020 deep fix — the origin carriage): an externally-exposed session's
+  ORDINARY memory writes now COMMIT carrying an engine-minted typed `origin` frontmatter marker
+  (taint + closed cause vocabulary + mint time) instead of the design/178 full quarantine that
+  zeroed TOC recall for every delegation-bearing session. Engine-exclusive and forgery-proof on
+  four faces (model-written origin bytes strip-with-disclosure — benign echo of the committed
+  marker stays silent; backend immutability law over every op spelling; inbound whitewash gate;
+  sync/bundle validation with rev honesty). Instruction-form files stay hard-gated. ONE deployment
+  seat: `RunnerDeps.memoryProvenance?: "off" | "carry"` (default `"carry"`; `"off"` restores
+  pre-336 containment byte-level; bad values refuse loudly, `config.memory_provenance`). New
+  public family: `MemoryEntryOrigin`/`MemoryOriginCause`/`MEMORY_ORIGIN_CAUSES`,
+  `committedOriginOf`, `originEquals`, `isInstructionEntry`. Bundle rows carry `marked`+`cause`;
+  lineage merge upgrades (never drops) a content-verified marked bit.
+- #342: the `run_workflow` lane gains the onAsk pass-through arm — every workflow-spawned agent's
+  own ask reaches the same operator as the host's (provenance-stamped, `parentToolCallId` +
+  `depth:1`) instead of the headless auto-deny. `RunWorkflowToolDeps.parentOnAsk` mount dep; a
+  deployment-pinned `base.onAsk` always wins; with no approver anywhere the fail-closed deny is
+  byte-identical. `AskRequest.delegation.parentToolCallId` is now reliable on the workflow lane.
+- #341: `SideQuerySpec.getApiKeyAndHeaders` — side-queries resolve per-model auth exactly like
+  the main lane (a gateway key no longer rides an external model's URL when a resolver is wired).
+- Memory-engine fencing (#262/#270/#191): journal recovery carries a fence token asserted at every
+  destructive write (redo/sweep/heal/commit-boundary/identity-close/migration); the chain-degraded
+  marker's directory entry is fsynced (POSIX name durability); txn-lock contention is typed
+  (EACCES vs EEXIST). #339 (stale-steal residual window) consolidated into design/186 v2 §3.1.
+
+### Fixed
+- The read-face LIST seats (`additionalDirectories`, `additionalReadDirectories`,
+  `readDenyPatterns` deps+spec) refuse non-array values loudly (`config.read_face_seat`) instead
+  of iterating a bare string character by character — `"/tmp/x"` no longer admits the
+  one-character root `"/"` into the write-capable allowlist, and a bare deny-"pattern" string no
+  longer dissolves into meaningless entries with zero refusal (#344, merged-code review). The
+  deny seats' ENTRY law stays with `compileReadDeny` (the `ReadDenyEntry` union's object form —
+  verify's frozen-posture carry — still completes).
+
+### Errata (5.44.0 changelog)
+- The "Tool contract revisions move: search 1→2, get 2→3" line overstated the rule — revisions
+  bump on execute-visible text changes, per the in-code note.
+- The #318 scope line ("single explicit FILE target's own spelling") was narrower than the shipped
+  behavior; see the path-prefix handling in `search.ts` (`relOut`).
+
+## 5.45.0 — 2026-08-19
+
+### Added
+- `RunnerDeps.memoryDelegationEvidence?: "static-face" | "attested-only"` (design/324, ruling-1
+  stopgap): the deployment's evidence standard for delegation-driven memory pollution.
+  `"attested-only"` retires ONLY the static capability-face mark (the "a child COULD reach
+  external content" over-approximation); the attestation-observed mark (`att === "external"`),
+  the chain's `incomplete` honesty, `recordExternal`, non-delegation classification and the
+  pre-call direct-class mark all stay. Key absent ≡ `"static-face"` ≡ byte-identical behavior.
+  A malformed value is refused loudly (`config.memory_delegation_evidence`, exact-spelling gate).
+  ACCEPTED COST (the deployment's to own): with `"attested-only"`, a BACKGROUND child's real
+  external contact does not mark this session — its content re-enters via TaskOutput /
+  task-notification / AgentTranscript, none of which carries an attestation.
+- `memory.delegation_static_mark_waived` EngineNotice — mandatory companion: minted at most once
+  per prepared leg when the knob actually waives a static-face mark on a pollution-armed chain
+  (`detail: {subagentType?, sessionId?}`; reason carries the waived mark's own sentence, bounded).
+- `TaskResult.effectiveReasoning?: ResolvedReasoning` (#327b): the leg's effective reasoning
+  resolution echoed on the result — same object the `reasoning.resolved` trace event carries
+  (two faces, one mint); rides the backstop/`resume.tool_unavailable` carrier like its
+  precedents. `ReasoningFormat` gains `"responses"` (dispatched by api family, single-source
+  `RESPONSES_APIS`).
+- Cross-session recall pins (#260 verdict: engine clean): the consumer contract is pinned —
+  the model's final answer text exists BEFORE the terminal harvest commits, `TaskStream.result()`
+  is the commit boundary, and a consumer that prints the answer and kills the worker without
+  awaiting `result()` strands the entry id-less on disk (the incident's exact evidence shape).
+
+### Changed
+- The reasoning resolver mirrors `thinkingLevelMap`'s null arm (5.45 rescan): a clamped tier the
+  model maps to `null` is reported tier-not-honored (`graded:false`, intent echo) — matching what
+  the wire appliers actually send (nothing) instead of claiming "honored exactly"; the r3/r4
+  mirror comment now names all three arms. `resolveEffort` reads a malformed non-array
+  `reasoningEffortLevels` as undeclared (member-level filtering: garbage/sparse/"off" entries can
+  no longer become clamp targets) — a catalog typo no longer fails the whole thinking-on leg with
+  a raw TypeError (5.44.0 regression window closed before release).
+- The #260 pins tell the bounded-teardown truth: `result()` settles after the harvest LEG settled
+  (committed, or its 15s timeout REPORTED — never silent), the discriminative arm polls 50 ticks
+  (the abandon arm sat inside the old 1-tick slack), and the incident-scale argument is stated.
+- `reasoning.resolved` now fires a LOUD DROP frame (`dropped: true`, `effective: "off"`) on
+  models whose `Model.reasoning` is falsy — a user-requested effort tier no longer evaporates
+  silently (#325). The public `resolveReasoning` reports the drop arm for such models; the
+  capable arm is byte-identical. The capability predicate is truthiness (matching every adapter),
+  and `supportsReasoningEffort === false` mirrors the ungraded intent-only arm.
+
+### Fixed
+- The two 5.44.0 pollution notices are DISPOSITIONED in the governance registry and the
+  error-surface cap vocabulary gained `inlineUntrusted`/`pollutionSentence` (both bounded by
+  contract) — landed as gate-family debts caught by the full-suite leg.
+
+### Notes
+- Commit `2f78edb7` (the delegation-evidence knob) carries the `TaskResult.effectiveReasoning`
+  declaration hunk of the parallel effort car (shared-checkout staging race; HEAD is consistent).
+  Do not cherry-pick that commit alone.
+
 ## 5.44.0 — 2026-08-19
 
 ### Added

package/dist/agents/subagent.d.ts

@@ -297,7 +297,9 @@ export declare function completedAgentCard(child: {
      *  recorder aggregate at delivery. Present only when the parent chain armed the recorder; the
      *  parent-side judgment (the content-origin wrap) reads it off this card — `clean` retires the
      *  static face verdict for this call, `external` marks with the observed-event reason, `unknown`
-     *  (or absence) keeps the static floor. Deliberate whitelist admission (see the boundary note). */
+     *  (or absence) keeps the static floor, whose mark action follows the parent run's deployment
+     *  evidence standard (design/324, `RunnerDeps.memoryDelegationEvidence`). Deliberate whitelist
+     *  admission (see the boundary note). */
     attestation?: import("../core/memory-engine/delegation-provenance.js").DelegationAttestation;
 }): Record<string, unknown>;
 /**

package/dist/agents/subagent.js

@@ -1915,7 +1915,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     const wt = await finishWorktree();
                     return { isError: true, content: `Sub-agent not started: source session not found or fork unavailable.${wt ? `\n${wt}` : ""}`, details: { error: "source not found", forkLane: ctx.hostSessionFork ? "host" : "child-runner", ...(ctx.sessionId !== undefined ? { sourceSessionId: ctx.sessionId } : {}) } };
                 }
-                const forkInternals = { ...childInternals, insideFork: true };
+                const forkInternals = { ...childInternals, insideFork: true, ...(ctx.reminderMark !== undefined ? { reminderMark: ctx.reminderMark } : {}) };
                 stepRecorder.lockTo(forkedId);
                 const forkWorktreeNote = worktreeDir !== undefined ? forkWorktreeTranslationNote(ctx.parentCwd, worktreeDir) : undefined;
                 const forkObjective = `${FORK_DIRECTIVE_FRAME}${prompt}${forkWorktreeNote !== undefined ? `\n\n${forkWorktreeNote}` : ""}`;

package/dist/brain/reasoning.d.ts

@@ -34,7 +34,20 @@ export type ReasoningFormat = "openai" | "openrouter" | "deepseek" | "together"
 /** Anthropic `output_config.effort` (CC 2.1.198 / Fable-5 class, design/119): the tier is a named
  *  effort string, clamped to `compat.effortLevels` — the anthropic-side twin of the OpenAI
  *  `reasoning_effort` path (thinking FORM is `thinkingMode`; effort carries the intensity). */
- | "effort";
+ | "effort"
+/** OpenAI Responses API (`openai-responses` / `azure-openai-responses`, design/163): the tier rides
+ *  the NESTED `reasoning: { effort }` request field (open-responses.ts `resolveWireEffort`), clamped
+ *  by the same {@link resolveEffort} against `compat.reasoningEffortLevels` — NOT the completions
+ *  top-level `reasoning_effort` the `"openai"` tag names. #325 review r3: before this member the
+ *  resolver fell through to the completions default and labeled Responses resolutions `"openai"`. */
+ | "responses";
+/**
+ * The Open Responses API family — every `Api` value `createOpenResponsesBrain` serves (design/163).
+ * The SINGLE family discriminant: request-params.ts (reserved-key set selection) and
+ * {@link resolveReasoning} (format dispatch, #325 review r4) both key off THIS set, so a new
+ * Responses api value added here reaches every family-scoped behavior instead of one of two twins.
+ */
+export declare const RESPONSES_APIS: ReadonlySet<string>;
 /** How a requested intensity resolved against one endpoint's real capability. */
 export interface ReasoningResolution {
     /** The level the caller asked for. */
@@ -43,9 +56,10 @@ export interface ReasoningResolution {
     effective: ThinkingLevel;
     /**
      * True when the endpoint varies behavior by intensity (effort tiers / token budget). False = binary
-     * enable-only (qwen / zai / qwen-chat-template, or an effort endpoint that declares
-     * `supportsReasoningEffort:false`): thinking is on or off and the tier is NOT honored — read this alongside
-     * {@link effective}, which then echoes the request as intent only.
+     * enable-only (qwen / zai / qwen-chat-template, an effort endpoint that declares
+     * `supportsReasoningEffort:false`, or a tier `Model.thinkingLevelMap` maps to `null` — the wire then
+     * carries NO effort value for it): thinking is on or off and the tier is NOT honored — read this
+     * alongside {@link effective}, which then echoes the request as intent only.
      */
     graded: boolean;
     /** True when {@link effective} differs from {@link requested} (the request couldn't be honored exactly). */
@@ -62,6 +76,23 @@ export interface ResolvedReasoning extends ReasoningResolution {
     format: ReasoningFormat;
     /** A coarse endpoint label for the trace (`model.api` — e.g. `openai-completions`, `anthropic-messages`). */
     endpoint: string;
+    /**
+     * Present (true) only when the model declares NO reasoning capability (`Model.reasoning` falsy): every
+     * brain early-returns on that flag (openai.ts applyThinking / anthropic.ts / open-responses.ts
+     * resolveWireEffort), so NO thinking
+     * parameter reaches the wire at all — the requested tier is DROPPED entirely, not clamped or
+     * downgraded-to-binary. `effective:"off"` here states the ENGINE side of that fact (nothing was
+     * requested), NOT a measured gateway state: on the binary enable-only formats (qwen / zai /
+     * qwen-chat-template) parameter ABSENCE is provider-default, and a default-on gateway may still
+     * reason at its own tier — the brains deliberately send no disable key for a model declared
+     * non-reasoning, so the engine cannot claim a measured off there; `format` tells a consumer which
+     * family applies (on every other format, absence is the closest the wire has to off — see
+     * applyThinking's own contract). `format`/`endpoint` report the family that WOULD have carried the
+     * tier (the why-shape a consumer diagnoses with, not a claim about the request). Absent on every
+     * reasoning-capable resolution, so existing consumers see byte-identical objects. Loud-bad-values
+     * rule: the one arm where the request evaporates must not be the one arm with no report.
+     */
+    dropped?: true;
 }
 /**
  * Resolve a requested intensity against a model END-TO-END, dispatching on its wire format the SAME way the
@@ -74,6 +105,17 @@ export interface ResolvedReasoning extends ReasoningResolution {
  * - Binary enable-only formats (qwen / zai / qwen-chat-template) → `graded:false` (tier not honored).
  * - An effort endpoint with `supportsReasoningEffort:false` → `graded:false` (enable key only, no effort tier).
  * - Otherwise effort-based → clamp DOWN to the endpoint's `reasoningEffortLevels` (default minimal|low|medium|high).
+ * - A CLAMPED tier that `model.thinkingLevelMap` maps to `null` (declared unsupported on this model) →
+ *   `graded:false`: both effort-wire appliers key the map by the post-clamp tier and then carry NO effort
+ *   value (thinking still enables via the format's own enable key where one exists), so the tier is not
+ *   honored. Previously this resolver never read the map and reported such a request as exactly honored
+ *   (`graded:true`, `clamped:false`) while the wire dropped the value — trace/result-face drift.
+ *
+ * - A model whose `reasoning` capability flag is FALSY drops the request ENTIRELY (neither brain emits any
+ *   thinking parameter, whatever the format) → `effective:"off"`, `graded:false`, `clamped:true`,
+ *   `dropped:true` — the loud-drop arm. Previously this resolver described the capability dispatch for such
+ *   a model (a resolution the request never carried), and the runner's trace guard skipped the frame — the
+ *   one arm where the request evaporates was the one arm with no disclosure.
  *
  * `off`/falsy never enables thinking, so it resolves trivially (no clamp, graded:true) — the caller decides
  * whether to emit at all.
@@ -82,12 +124,16 @@ export declare function resolveReasoning(requested: ThinkingLevel, model: {
     api?: string;
     reasoning?: boolean;
     compat?: unknown;
+    thinkingLevelMap?: Readonly<Partial<Record<ThinkingLevel, string | null>>>;
 }): ResolvedReasoning;
 /**
  * Resolve a requested intensity for an effort-based endpoint (`reasoning_effort` / `reasoning.effort`). Picks
  * the requested tier when supported; otherwise the highest supported tier ≤ requested (clamp DOWN, never
  * silently up); if none is ≤ requested (the endpoint's set is entirely higher — unusual), the lowest supported
  * tier. Never returns a value outside `allowed`, so the brain can't emit a tier the endpoint would 422.
+ * A malformed `allowed` reads as UNDECLARED → the conservative default set (non-array, empty, or no
+ * valid member); individually invalid MEMBERS (garbage strings, sparse holes, `"off"` — not a legal
+ * member of the 6-tier compat effort sets) are dropped, so they can never become a clamp target.
  */
 export declare function resolveEffort(requested: ThinkingLevel, allowed?: readonly ThinkingLevel[]): ReasoningResolution;
 /**

package/dist/brain/reasoning.js

@@ -15,7 +15,18 @@ export function rankOf(level) {
 }
 export const DEFAULT_EFFORT_LEVELS = ["minimal", "low", "medium", "high"];
 const BINARY_FORMATS = new Set(["qwen", "zai", "qwen-chat-template"]);
+export const RESPONSES_APIS = new Set(["openai-responses", "azure-openai-responses", "openai-chatgpt-responses"]);
 export function resolveReasoning(requested, model) {
+    const resolved = dispatchReasoning(requested, model);
+    if (requested !== "off" && !model.reasoning) {
+        return { requested, effective: "off", graded: false, clamped: true, format: resolved.format, endpoint: resolved.endpoint, dropped: true };
+    }
+    return resolved;
+}
+function effortTierUnmapped(requested, effective, model) {
+    return requested !== "off" && model.thinkingLevelMap?.[effective] === null;
+}
+function dispatchReasoning(requested, model) {
     const endpoint = model.api ?? "unknown";
     const compat = (model.compat ?? {});
     if (model.api === "anthropic-messages") {
@@ -24,6 +35,16 @@ export function resolveReasoning(requested, model) {
         }
         return { requested, effective: requested, graded: true, clamped: false, format: "budget", endpoint };
     }
+    if (model.api !== undefined && RESPONSES_APIS.has(model.api)) {
+        if (compat.supportsReasoningEffort === false) {
+            return { requested, effective: requested, graded: false, clamped: false, format: "responses", endpoint };
+        }
+        const responsesResolved = resolveEffort(requested, compat.reasoningEffortLevels ?? DEFAULT_EFFORT_LEVELS);
+        if (effortTierUnmapped(requested, responsesResolved.effective, model)) {
+            return { requested, effective: requested, graded: false, clamped: false, format: "responses", endpoint };
+        }
+        return { ...responsesResolved, format: "responses", endpoint };
+    }
     const format = compat.thinkingFormat ?? "openai";
     if (BINARY_FORMATS.has(format)) {
         return { ...resolveBinary(requested), format, endpoint };
@@ -32,15 +53,15 @@ export function resolveReasoning(requested, model) {
     if (!supportsEffort && format !== "openrouter") {
         return { requested, effective: requested, graded: false, clamped: false, format, endpoint };
     }
-    return {
-        ...resolveEffort(requested, compat.reasoningEffortLevels ?? DEFAULT_EFFORT_LEVELS),
-        format,
-        endpoint,
-    };
+    const resolved = resolveEffort(requested, compat.reasoningEffortLevels ?? DEFAULT_EFFORT_LEVELS);
+    if (effortTierUnmapped(requested, resolved.effective, model)) {
+        return { requested, effective: requested, graded: false, clamped: false, format, endpoint };
+    }
+    return { ...resolved, format, endpoint };
 }
 export function resolveEffort(requested, allowed = DEFAULT_EFFORT_LEVELS) {
-    if (allowed.length === 0)
-        allowed = DEFAULT_EFFORT_LEVELS;
+    const declared = Array.isArray(allowed) ? allowed.filter((lvl) => isThinkingLevel(lvl) && lvl !== "off") : [];
+    allowed = declared.length > 0 ? declared : DEFAULT_EFFORT_LEVELS;
     if (requested === "off" || allowed.includes(requested)) {
         return { requested, effective: requested, graded: true, clamped: false };
     }

package/dist/brain/request-params.d.ts

@@ -1,15 +1,3 @@
-/**
- * Request-parameter passthrough (design/40). A deployment can set official provider params it wants but
- * core doesn't model as first-class fields (OpenAI `frequency_penalty`/`presence_penalty`/`top_p`/`seed`/
- * `logit_bias`; Anthropic `top_k`/`top_p`/`stop_sequences`; …) via `Model.extraBody`, and core merges them
- * into the brain's request body. Anchored at the **Model** level (not per-turn) so the serialized body
- * stays byte-stable across turns → the prefix cache holds (design/9/31).
- *
- * Symmetric: each brain owns its structural + tuning keys (`reserved`) and ALWAYS wins — `extraBody` can
- * only supply the long tail, never clobber `messages`/`tools`/`temperature`/etc. Stripping is the safety
- * enforcement (the brains are standalone-usable); `prepareTask` separately warns on a collision (it has
- * `onError`, the brain doesn't — council design/40).
- */
 /** OpenAI request-body keys core owns; `extraBody` cannot override these. */
 export declare const OPENAI_RESERVED: ReadonlySet<string>;
 /** Anthropic request-body keys core owns; `extraBody` cannot override these. (Note the asymmetry vs

package/dist/brain/request-params.js

@@ -1,3 +1,4 @@
+import { RESPONSES_APIS } from "./reasoning.js";
 export const OPENAI_RESERVED = new Set([
     "model",
     "messages",
@@ -38,7 +39,6 @@ export const RESPONSES_RESERVED = new Set([
     "previous_response_id",
     "conversation",
 ]);
-const RESPONSES_APIS = new Set(["openai-responses", "azure-openai-responses", "openai-chatgpt-responses"]);
 export function reservedFor(api) {
     if (RESPONSES_APIS.has(api))
         return RESPONSES_RESERVED;

package/dist/core/checkpoint-store.d.ts

@@ -807,6 +807,18 @@ export interface CheckpointState {
          *  scope for any in-row invariant). Absent = the row was minted ungoverned. */
         realApproval?: true;
     };
+    /**
+     * design/319 (A ticket) — the session's reminder provenance mark
+     * ({@link import("./reminder-mint.js").mintReminderMark}), persisted so a durable resume keeps
+     * minting the SAME mark its transcript's engine reminders and system-prompt declaration carry
+     * ("resume reuses" — one declaration, one mark). Additive on the existing checkpoint version —
+     * a reader that ignores it is unchanged (the :646 precedent; no version bump). Resume goes
+     * through the VERIFY port ({@link import("./reminder-mint.js").isValidReminderMark}): a missing
+     * field (pre-319 row) or an unrecognized value-shape (corrupt / foreign / old-scheme after a
+     * scheme change) RE-MINTS instead of adopting — the declaration stays strict, and the historic
+     * legs' reminders simply read as data (fail-safe downgrade, design/319 a-2).
+     */
+    reminderMark?: string;
     /**
      * design/78 Slice-1: the SAFE-tier self-repair loop's durable state (`failureTrace`/`diagnostics`/
      * `rejectedHypotheses`/`attemptCount`/`oracleTier` — all JSON/`structuredClone`-safe, no fn/Date). Set ONLY

package/dist/core/governance-codes.js

@@ -16,6 +16,7 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.pollution_mark_failed",
     "memory.session_polluted",
     "memory.harvest_quarantined",
+    "memory.delegation_static_mark_waived",
     "memory.challenge_sweep_failed",
     "memory.lineage_settle_failed",
     "memory.challenge_ledger_corrupt",

package/dist/core/hooks.d.ts

@@ -583,8 +583,11 @@ export interface UserPromptSubmitResult {
  *  NOTE (council design/74 #6): this does NOT escape a literal `</system-reminder>` in `text` — callers MUST
  *  pass trusted, first-party strings (every current caller does: fixed gate/limit messages). If a future
  *  caller needs to relay UNTRUSTED content (tool output, user data), it must sanitize the close tag first
- *  (or use the `delimitUntrusted` fence), or a crafted payload could break out of the reminder framing. */
-export declare function formatHookFeedback(text: string): string;
+ *  (or use the `delimitUntrusted` fence), or a crafted payload could break out of the reminder framing.
+ *  design/319 (A ticket): `mark` is the session's reminder provenance mark — run-scoped callers thread it
+ *  so the open tag carries the value the system-prompt declaration names (rendered by the mint home; the
+ *  body is byte-untouched). Absent ⇒ the historic bare open tag (a caller outside a run). */
+export declare function formatHookFeedback(text: string, mark?: string): string;
 /** The outcome of the two-phase tool gate, mapped onto the harness `tool_call` hook return shape. */
 export interface ToolGateResult {
     /** Block execution (the loop emits an error tool result with `reason`). */
@@ -799,6 +802,10 @@ export interface ToolGateInput {
      *  per-leg mint; a host driving the gate directly may omit it, and the contexts then carry no
      *  identity (honest absence — this layer never fabricates a leg). */
     identity?: HookInvocationIdentity;
+    /** design/319 (A ticket) — the run's reminder provenance mark: the gate's own model-facing deny
+     *  reasons ride `formatHookFeedback`, so their open tags must carry the same mark the run's
+     *  system-prompt declaration names. Absent (a host driving the gate directly) ⇒ bare tags. */
+    reminderMark?: string;
     preToolUse?: Hooks["preToolUse"];
     /** The read-only env capability face put on every {@link HookToolContext} this gate call
      *  builds ({@link HookEnvCapabilities}). Built ONCE per task by the runner (after the env is minted) and

package/dist/core/hooks.js

@@ -1,6 +1,7 @@
 import { decisionText, describeThrown, refuseOutOfContractDecision } from "./tool-policy.js";
 import { brandPolicyAskClass } from "./ask-class.js";
 import { inlineUntrusted } from "./untrusted-text.js";
+import { mintSystemReminder } from "./reminder-mint.js";
 import { PROBE_REASON_MAX, normalizeProbeCause } from "./checkpoint-store.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 import { createSafeNotifier } from "./safe-notify.js";
@@ -90,8 +91,8 @@ export function mintHookInvocationIdentity(facts) {
         ...(facts.parentToolCallId !== undefined ? { parentToolCallId: facts.parentToolCallId } : {}),
     }));
 }
-export function formatHookFeedback(text) {
-    return `<system-reminder>\n${text}\n</system-reminder>`;
+export function formatHookFeedback(text, mark) {
+    return mintSystemReminder(text, mark);
 }
 const PARK_FAILURE_CAUSE_MAX = 600;
 function withParkFailureCause(reason, parkFailed) {
@@ -304,7 +305,7 @@ export async function runToolGate(input) {
             if (input.permissionDenied) {
                 await notifier.notifyAsync(() => input.permissionDenied?.({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason, source: "hook", ...(input.identity !== undefined ? { identity: input.identity } : {}) }), "toolGate.permissionDenied");
             }
-            return { block: true, reason: formatHookFeedback(reason), preToolContext };
+            return { block: true, reason: formatHookFeedback(reason, input.reminderMark), preToolContext };
         }
         if (r) {
             if (r.additionalContext) {
@@ -313,7 +314,7 @@ export async function runToolGate(input) {
             if (r.action === "deny") {
                 return {
                     block: true,
-                    reason: formatHookFeedback(decisionText(r) ?? `tool "${toolName}" blocked by a PreToolUse hook`),
+                    reason: formatHookFeedback(decisionText(r) ?? `tool "${toolName}" blocked by a PreToolUse hook`, input.reminderMark),
                     preToolContext,
                 };
             }
@@ -813,7 +814,7 @@ export async function runToolGate(input) {
         const denyApprover = denySettledBy !== undefined ? resolvedApprover : undefined;
         return {
             block: true,
-            reason: formatHookFeedback(denyReason),
+            reason: formatHookFeedback(denyReason, input.reminderMark),
             ...(denySettledBy !== undefined ? { settledBy: denySettledBy } : {}),
             ...(denyApprover !== undefined ? { approver: denyApprover } : {}),
             preToolContext,

package/dist/core/memory-engine/content-origin.d.ts

@@ -6,7 +6,9 @@
  * into long-term memory? Three tiers:
  *
  *  - "external"  — network-retrieval families and external protocol channels. Invocation marks the
- *                  session's memory POLLUTED (one-way, durable; the polluted harvest quarantines).
+ *                  session's memory EXTERNALLY EXPOSED (one-way, durable; what the mark does at
+ *                  harvest is the provenance mode's question — design/336: tag-admit with an origin
+ *                  marker under "carry", full quarantine under "off").
  *  - "execution" — general execution (shell/exec). A NAMED residual channel: it can reach external
  *                  content indirectly, but the two industry anchors this tier is calibrated against
  *                  gate on network/protocol families only, and excluding every shell session would
@@ -66,9 +68,12 @@ export interface AgentPoolTool {
  * A child that can reach a network or protocol tool returns content from outside the trust boundary
  * just as surely as calling that tool in this session would, and the parent's transcript is where it
  * lands. The judgment is STATIC — the child's face is known from its definition before the call — so
- * nothing here tracks what the child actually did (runtime provenance is the v2 ticket). That makes
- * it conservative in the safe direction: a child that COULD reach external content counts as having
- * done so.
+ * nothing here tracks what the child actually did (runtime provenance is design/180 half A). That
+ * makes it conservative in the safe direction: a child that COULD reach external content counts as
+ * having done so. Whether this verdict MARKS the judging session's memory when no attestation
+ * arrives is the deployment's evidence standard (design/324,
+ * `RunnerDeps.memoryDelegationEvidence`) — the classification itself is value-independent, and the
+ * wrap computes it on every standard (the waiver announcement keys on it).
  *
  * `pool` is the CHILD'S pool, not the parent's roster: a delegation tool carries its own tool set, and
  * the two are explicitly allowed to differ — a parent mounting nothing but the delegation tool can

package/dist/core/memory-engine/delegation-provenance.d.ts

@@ -1,10 +1,13 @@
 /**
  * design/180 half A — delegation RUNTIME provenance: the three-value attestation and its monotonic
  * aggregate. The static tool-face judgment ({@link import("./content-origin.js").delegationCallIsExternal})
- * stays the PERMANENT FLOOR: runtime evidence may only retire the static verdict when a COMPLETE
- * clean proof is in hand; any evidence gap falls back to the floor. "We could not prove it clean"
- * and "it is clean" are different answers — replacing the floor outright would fail OPEN on every
- * evidence gap (old child vintages, crashes, un-armed sessions).
+ * stays the FLOOR of the attestation reduction: runtime evidence may only retire the static verdict
+ * when a COMPLETE clean proof is in hand; any evidence gap falls back to the floor. "We could not
+ * prove it clean" and "it is clean" are different answers — replacing the floor outright would fail
+ * OPEN on every evidence gap (old child vintages, crashes, un-armed sessions). Whether the floor's
+ * verdict MARKS the judging session's memory is a separate, deployment-governed question
+ * (design/324, `RunnerDeps.memoryDelegationEvidence`): the reduction semantics here never change
+ * with that key — only the mark action at the judging run's wrap does.
  *
  * The aggregate is two MONOTONIC bits plus versioning:
  *  - `sawExternal` — an actually-observed polluting-class invocation (own recorder, or a delivered
@@ -17,8 +20,9 @@
  * "clean" unprovable; it can never make an observed event disappear).
  */
 /** The three-value delegation attestation. Only `clean` changes behavior (the parent skips the
- *  static mark); `unknown` is byte-equivalent to absence (static floor governs); `external` marks
- *  unconditionally, with the observed-event reason. */
+ *  static mark); `unknown` is byte-equivalent to absence (the static floor governs — its mark
+ *  action subject to the judging run's deployment evidence standard, design/324); `external` marks
+ *  unconditionally on every evidence standard, with the observed-event reason. */
 export type DelegationAttestation = "clean" | "external" | "unknown";
 /** The monotonic per-run provenance aggregate (in-process this slice; the durable-checkpoint
  *  persistence leg rides the background-face slice — absence after a resume reads `incomplete`,
@@ -58,5 +62,6 @@ export declare function reduceDelegationAttestation(agg: DelegationProvenanceAgg
     completed: boolean;
 }): DelegationAttestation;
 /** Read a delivered card's attestation field (the explicit-whitelist handback seat). Anything but
- *  the three spellings — including absence — reads as undefined, i.e. the static floor governs. */
+ *  the three spellings — including absence — reads as undefined, i.e. the static floor governs
+ *  (whether that floor MARKS is the judging run's deployment evidence standard, design/324). */
 export declare function readCardAttestation(details: unknown): DelegationAttestation | undefined;

package/dist/core/memory-engine/engine.d.ts

@@ -114,6 +114,29 @@ export interface MemoryEngineOptions {
     maxFiles?: number;
     /** Max nesting depth under the writable root (default {@link DEFAULT_MAX_ENTRY_DEPTH}). */
     maxDepth?: number;
+    /**
+     * design/336 §13-3 — the memory-provenance master switch (the deployment threads
+     * {@link import("../types.js").RunnerDeps.memoryProvenance} here; engine-direct hosts set it
+     * directly). Two exact spellings:
+     *  - `"carry"` (absent ≡ this; the default) — the 336 posture: an externally-exposed session's
+     *    ORDINARY memory writes commit WITH an engine-minted `origin` marker (tag-admit; the content
+     *    scan gates still run in full — a marker is not an exemption), instruction-form files
+     *    (type: feedback / v2 injection hints) are withheld and quarantined (the narrow `polluted`
+     *    rejection), the derived index's session prose still rolls back to its materialize-time
+     *    baseline, and exposure carries the SAME file-count cap and harvest budget as a clean
+     *    session;
+     *  - `"off"` — the pre-336 behavior: an exposed session's harvest admits nothing (every changed/
+     *    new file quarantines, host-auditable), no origin marker is ever MINTED, and the read side
+     *    mounts no origin decorations. One stated deviation from the byte level: origin-form
+     *    frontmatter written by the model is STILL stripped-with-warning from what commits (the
+     *    origin seat is engine-authored in both modes — preserving model-authored marker bytes under
+     *    "off" would hand a forgeable typed field to the next "carry" period), and an EXISTING
+     *    committed origin still carries forward on edits (the backend's immutability law is
+     *    structural and mode-independent — "off" stops minting, it never strips standing facts).
+     * Any other value refuses loudly at construction (`config.memory_provenance`, #123 — exact
+     * spellings, never truthiness).
+     */
+    provenance?: "off" | "carry";
     /** M7 — harvest deadline in ms (default {@link DEFAULT_HARVEST_DEADLINE_MS}); over-deadline files
      *  are deferred to the next harvest (report.degraded), never dropped. */
     harvestDeadlineMs?: number;
@@ -264,8 +287,13 @@ export interface EntryProvenanceAccount {
  * writing memory files, the harvest quarantined every one of them, and nothing said so while a host
  * could still act on it.
  *
+ * MODE-AWARE MESSAGE (design/336): the wording follows the engine's provenance mode — under
+ * `"carry"` (default) it states the tag-admit semantics (ordinary writes commit with an origin
+ * marker; instruction-form files are withheld); the `"off"`/absent spelling keeps the pre-336 text
+ * byte-identical. The caller passes the mode it constructed the engine with.
+ *
  * SCOPE OF THE CLAIM (adversarial-review round 1, P1 — the first cut PROMISED quarantine on every mark).
- * This notice states the VERDICT, not the mechanism's outcome: "no longer eligible", plus what a harvest
+ * This notice states the VERDICT, not the mechanism's outcome: "no longer eligible" (its "off" form), plus what a harvest
  * does WHEN IT COLLECTS. That distinction is load-bearing, because several real paths reach a polluted
  * harvest that quarantines nothing — a `writeScope`-null layering and a declared-unavailable session
  * both take `harvestCore`'s zero-admission return (nothing is collected, so nothing is captured), and a
@@ -290,6 +318,7 @@ export interface EntryProvenanceAccount {
 export declare function memorySessionPollutedNotice(input: {
     reason: string;
     sessionId?: string;
+    provenance?: "off" | "carry";
 }): EngineNotice;
 /**
  * The polluted harvest's loud half ({@link EngineNotice}): what the containment actually did, minted
@@ -340,6 +369,7 @@ export declare function memoryHarvestQuarantinedNotice(input: {
     escalated: number;
     reason?: string;
     sessionId?: string;
+    provenance?: "off" | "carry";
 }): EngineNotice;
 export declare class MemoryEngine {
     private readonly backend;
@@ -352,6 +382,8 @@ export declare class MemoryEngine {
     private readonly maxDepth;
     private readonly harvestDeadlineMs;
     private readonly harvestFileBudget;
+    /** {@link MemoryEngineOptions.provenance} — the design/336 master switch (screened at construction). */
+    private readonly provenance;
     /** {@link MemoryEngineOptions.onIncident} — the advisory disclosure seat (partition + announce codes). */
     private readonly onIncident;
     /** A backend-pinned directory (FileBackend zero-copy detection). */
@@ -394,7 +426,7 @@ export declare class MemoryEngine {
      * markers of one session would both read clean and both announce). Callers that do not disclose
      * ignore it exactly as before.
      */
-    markSessionPolluted(sessionId: string, reason: string): SessionPollutionMarkOutcome;
+    markSessionPolluted(sessionId: string, reason: string, cause?: import("./types.js").MemoryOriginCause): SessionPollutionMarkOutcome;
     /** The session's pollution record (in-process mark first, then the durable marker) — undefined =
      *  clean. Reads are side-effect-free. */
     sessionPollution(sessionId: string): SessionPollutionRecord | undefined;
@@ -587,6 +619,7 @@ export declare class MemoryEngine {
     }): Promise<MemorySessionHandle>;
     inject(handle: MemorySessionHandle, opts?: {
         writeToolMounted?: boolean;
+        reminderMark?: string;
     }): MemoryInjection;
     /**
      * design/138 S2-C — gate ONE tool write (Write/Edit/NotebookEdit) against the memory domain.
@@ -617,6 +650,7 @@ export declare class MemoryEngine {
     harvest(handle: MemorySessionHandle, opts?: {
         polluted?: {
             reason: string;
+            cause?: import("./types.js").MemoryOriginCause;
         };
         sessionId?: string;
         admitNothing?: {
@@ -652,6 +686,19 @@ export declare class MemoryEngine {
      *  the deleted disk file WAS the backend's storage). Zero-copy skips getByIds: its read-side scan
      *  cannot see a deleted file, and calling it mid-harvest would sync-adopt in-session edits. */
     private committedContentFor;
+    /**
+     * design/336 §2.2 (r4-9) — the COMMITTED frontmatter an origin carry-forward is computed against.
+     * Deliberately NOT {@link committedContentFor}'s non-zero-copy leg: that one calls the backend's
+     * plain `getByIds`, and the File backend's plain read path ADOPTS out-of-band disk changes (a
+     * read-side sync that advances revs and books retrievals) — a carry-forward read must be
+     * side-effect-free, or assembling one harvest mutates the store it is reading. Reading order:
+     *  - zero-copy File: the control-plane shadow IS the committed state (the disk file is the
+     *    session's own working copy — exactly what must NOT serve as the committed baseline);
+     *  - copy-out with a `retrievalView` face (File): the lock-free non-adopting view;
+     *  - twins (Pg/TiDB shapes): plain `getByIds` — naturally committed-state and side-effect-free
+     *    (the contract clause on {@link MemoryBackend.getByIds}).
+     */
+    private committedFrontmatterFor;
     /** L4/C-F9 (S2-0) — capture a gate-rejected file into control-plane quarantine FROM THE SCANNED
      *  CONTENT (never re-reading the path: the disk bytes may have been swapped since the scan —
      *  TOCTOU), then remove the suspect from the model-visible plane (delete, falling back to clearing
@@ -712,6 +759,6 @@ export declare class MemoryEngine {
 }
 /** Render drained announcements as ONE engine-owned system-reminder block (the lead/frame is
  *  trusted; item identifiers were neutralized at enqueue — see {@link MemoryAnnouncement.items}). */
-export declare function renderAnnouncements(queue: readonly MemoryAnnouncement[], folded: number): string;
+export declare function renderAnnouncements(queue: readonly MemoryAnnouncement[], folded: number, reminderMark?: string): string;
 /** Truncate the derived index to the CC injection parameters (200 lines / 25KB). */
 export declare function truncateIndex(text: string): string;