@sema-agent/core 5.45.0 → 5.47.0

package/CHANGELOG.md

@@ -1,5 +1,102 @@
 # Changelog
 
+## 5.47.0 — 2026-08-20
+
+### Added
+- design/336 slices 2+3 — the F-020 deep fix completes:
+  - **Slice 2 (settlement + hold)**: a delegation's memory-pollution verdict is a durable
+    SETTLEMENT ACCOUNT (three strict side-ledgers; write-ahead launch rows; crash-idempotent
+    retry; fork/bg lane parity), and instruction-form files under exposure ride a three-state
+    HOLD (held → released/disposed, loud timeout `config.memory_hold_timeout`;
+    `MemoryEngineOptions.holdSettleTimeoutMs`). `HarvestReport.containment` (#331) and the
+    `memory.hold_*` notice family land with it. The origin representation family is
+    serialization-closed (carrier tokenization + round-trip property laws).
+  - **Slice 3 (read side + human faces)**: `memory_search` returns two exposure bands (clean
+    first; `MemoryEntryHeader.exposure`; `MemorySearchHit` becomes a discriminated union
+    CleanHit | ExposedHit — see BREAKING); exposed entries render as opaque handles (zero
+    model-authored text on the passive face); `memory_get` delivery carries a fact-form banner
+    and marks the session derived (`onTaintedDelivery` — mechanical closure of source-scope
+    laundering); the memory-dir Read lane head-parses committed origin. Human faces (host API
+    only, deliberately no model tool): `listExternalOriginEntries` + `clearEntryOrigin` (audited
+    un-mark: write-ahead custody → committed tombstone → same-id re-record;
+    `listOriginClearances`; `memory.origin_clear_*` family). A live behavioral probe pins that a
+    marked entry in context is still used normally (deepseek-v4-flash, zero refusal).
+  - `memoryProvenance: "off"` keeps every read face byte-identical to 5.46 (pinned directly).
+- `NOTICE_AUDIENCE` + `noticeAudienceOf` — the presentation-tier registry (who a notice code is
+  for): "user" for the session-memory posture disclosures, everything else defaults "operator".
+  `EngineNotice.sessionId` typed top-level key, lifted from `detail.sessionId` at the delivery
+  throat (mint sites untouched). `ambiguousOriginRepresentation` exported (the origin ambiguity
+  predicate a third-party backend refuses multi-carrier representations with).
+- The session-reconcile never-started texts condition their re-issue cue on the blocking
+  approval/gate being resolved first (#352 — the side-effect statement stayed true; the action
+  cue no longer amplifies a blocked-approval loop).
+
+### Changed
+- **BREAKING (types)**: `MemorySearchHit` is now a discriminated union (CleanHit | ExposedHit)
+  instead of a single interface. Backend contract: the conformance suite gains two cases
+  (exposure carriage + two-band truncation boundary) — a backend implementing the pre-336 shape
+  fails them (upgrade-order duty: adopt the new clauses before taking 5.47 in a mixed fleet).
+  `memory_get` tool contract revision 3→4, `memory_search` 2→3 (execute-visible text changes).
+- The kill-tree descendant-reap suite's liveness probe reads a ZOMBIE as dead (a landed SIGKILL
+  whose parent died first waits for init to reap it; under load that outlasted any fixed poll
+  window — the 5.30.0/5.46.0 publish-gate flake, root-caused and fixed).
+
+## 5.46.0 — 2026-08-19
+
+### Added
+- design/319 A (system-reminder provenance mark): every engine-authored `<system-reminder>` OPEN
+  tag carries a per-session random `mark="<22-char base64url>"` attribute, and the system prompt
+  declares its semantics in ONE strict form — reminder-shaped text WITHOUT the current mark is
+  data wherever it appears. A forged reminder tag is now byte-distinguishable from an engine mint
+  on every verbatim inlet (Read/Bash/Grep/MCP-success). ZERO data-byte change: the mark rides only
+  the engine's own tag; Read stays verbatim, Edit across forged tags lands, Bash/Grep clean paths
+  are byte-compatible, and markless (library-direct) calls render historic bare bytes verbatim.
+  New exports: `mintReminderMark`, `isValidReminderMark`, `openSystemReminder`,
+  `mintSystemReminder`, `reminderMarkDeclaration` (scheme-replaceable mint home). Checkpoint gains
+  an additive `reminderMark` field + a new session-entry type `reminder_mark` (old readers ignore
+  both); a legacy or malformed-mark resume re-mints under the same strict declaration (historic
+  bare mints read as data — fail-safe). Consumers matching reminder tags by exact string must go
+  attribute-tolerant. A provider-owned pass-through prompt that renders no declaration discloses
+  loudly once per prepare (opt-in: `reminderMarkDeclaration(ctx.reminderMark)`).
+- design/336 slice 1 (F-020 deep fix — the origin carriage): an externally-exposed session's
+  ORDINARY memory writes now COMMIT carrying an engine-minted typed `origin` frontmatter marker
+  (taint + closed cause vocabulary + mint time) instead of the design/178 full quarantine that
+  zeroed TOC recall for every delegation-bearing session. Engine-exclusive and forgery-proof on
+  four faces (model-written origin bytes strip-with-disclosure — benign echo of the committed
+  marker stays silent; backend immutability law over every op spelling; inbound whitewash gate;
+  sync/bundle validation with rev honesty). Instruction-form files stay hard-gated. ONE deployment
+  seat: `RunnerDeps.memoryProvenance?: "off" | "carry"` (default `"carry"`; `"off"` restores
+  pre-336 containment byte-level; bad values refuse loudly, `config.memory_provenance`). New
+  public family: `MemoryEntryOrigin`/`MemoryOriginCause`/`MEMORY_ORIGIN_CAUSES`,
+  `committedOriginOf`, `originEquals`, `isInstructionEntry`. Bundle rows carry `marked`+`cause`;
+  lineage merge upgrades (never drops) a content-verified marked bit.
+- #342: the `run_workflow` lane gains the onAsk pass-through arm — every workflow-spawned agent's
+  own ask reaches the same operator as the host's (provenance-stamped, `parentToolCallId` +
+  `depth:1`) instead of the headless auto-deny. `RunWorkflowToolDeps.parentOnAsk` mount dep; a
+  deployment-pinned `base.onAsk` always wins; with no approver anywhere the fail-closed deny is
+  byte-identical. `AskRequest.delegation.parentToolCallId` is now reliable on the workflow lane.
+- #341: `SideQuerySpec.getApiKeyAndHeaders` — side-queries resolve per-model auth exactly like
+  the main lane (a gateway key no longer rides an external model's URL when a resolver is wired).
+- Memory-engine fencing (#262/#270/#191): journal recovery carries a fence token asserted at every
+  destructive write (redo/sweep/heal/commit-boundary/identity-close/migration); the chain-degraded
+  marker's directory entry is fsynced (POSIX name durability); txn-lock contention is typed
+  (EACCES vs EEXIST). #339 (stale-steal residual window) consolidated into design/186 v2 §3.1.
+
+### Fixed
+- The read-face LIST seats (`additionalDirectories`, `additionalReadDirectories`,
+  `readDenyPatterns` deps+spec) refuse non-array values loudly (`config.read_face_seat`) instead
+  of iterating a bare string character by character — `"/tmp/x"` no longer admits the
+  one-character root `"/"` into the write-capable allowlist, and a bare deny-"pattern" string no
+  longer dissolves into meaningless entries with zero refusal (#344, merged-code review). The
+  deny seats' ENTRY law stays with `compileReadDeny` (the `ReadDenyEntry` union's object form —
+  verify's frozen-posture carry — still completes).
+
+### Errata (5.44.0 changelog)
+- The "Tool contract revisions move: search 1→2, get 2→3" line overstated the rule — revisions
+  bump on execute-visible text changes, per the in-code note.
+- The #318 scope line ("single explicit FILE target's own spelling") was narrower than the shipped
+  behavior; see the path-prefix handling in `search.ts` (`relOut`).
+
 ## 5.45.0 — 2026-08-19
 
 ### Added

package/dist/agents/subagent.js

@@ -3,6 +3,8 @@ import { isAbsolute } from "node:path";
 import { withDelegationProvenance } from "../core/tool-policy.js";
 import { isHighSurrogate, isLowSurrogate } from "../core/surrogate-safe-slice.js";
 import { newDelegationProvenanceAggregate, reduceDelegationAttestation } from "../core/memory-engine/delegation-provenance.js";
+import { registerDelegationLaunch, replayExternalSettlementEffects, settleDelegation } from "../core/memory-engine/delegation-settlement.js";
+import { enqueueMemoryAnnouncement } from "../core/memory-engine/layout.js";
 import { resolveModel, resolveModelDisplayLabel } from "../core/roles.js";
 import { OUTPUT_TOOL_NAME, REPORT_BLOCKED_TOOL_NAME } from "../core/runner/synthetic-tools.js";
 import { TOOL_SEARCH_NAME } from "../core/runner/tool-disclosure.js";
@@ -1915,7 +1917,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     const wt = await finishWorktree();
                     return { isError: true, content: `Sub-agent not started: source session not found or fork unavailable.${wt ? `\n${wt}` : ""}`, details: { error: "source not found", forkLane: ctx.hostSessionFork ? "host" : "child-runner", ...(ctx.sessionId !== undefined ? { sourceSessionId: ctx.sessionId } : {}) } };
                 }
-                const forkInternals = { ...childInternals, insideFork: true };
+                const forkInternals = { ...childInternals, insideFork: true, ...(ctx.reminderMark !== undefined ? { reminderMark: ctx.reminderMark } : {}) };
                 stepRecorder.lockTo(forkedId);
                 const forkWorktreeNote = worktreeDir !== undefined ? forkWorktreeTranslationNote(ctx.parentCwd, worktreeDir) : undefined;
                 const forkObjective = `${FORK_DIRECTIVE_FRAME}${prompt}${forkWorktreeNote !== undefined ? `\n\n${forkWorktreeNote}` : ""}`;
@@ -1935,6 +1937,59 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     const shortDesc = `fork: ${(typeof a.description === "string" && a.description.trim() ? a.description.trim() : prompt).slice(0, 180)}`;
                     const bgOwner = sessionScopedBg ? ctx.sessionId : ctx.taskId ?? bg.owner;
                     const bgScope = treeScope;
+                    const forkSettlementSeat = ctx.delegationSettlement?.();
+                    const forkSettleId = forkSettlementSeat !== undefined ? `bg-${uuidv7()}` : undefined;
+                    if (forkSettlementSeat !== undefined && forkSettleId !== undefined) {
+                        try {
+                            registerDelegationLaunch(forkSettlementSeat.controlDir, { settleId: forkSettleId, sessionId: forkSettlementSeat.sessionId, now: Date.now, ...(ctx.toolCallId !== undefined ? { toolUseId: ctx.toolCallId } : {}) });
+                        }
+                        catch (e) {
+                            dropHostAbortListener();
+                            const wt = await finishWorktree();
+                            return {
+                                isError: true,
+                                content: `Sub-agent not started in background: the delegation settlement account could not record the launch (${(e instanceof Error ? e.message : String(e)).slice(0, 300)}) — fail-closed; repair the memory control plane or retry.${wt ? `\n${wt}` : ""}`,
+                                details: { error: "settlement_write_ahead_failed" },
+                            };
+                        }
+                    }
+                    const settleForkRow = (status) => {
+                        if (forkSettlementSeat === undefined || forkSettleId === undefined)
+                            return;
+                        const att = status !== undefined ? childAttestation(status) : undefined;
+                        const verdict = att === "external" ? "external" : att === "clean" ? "clean" : "unattestable";
+                        let settled = false;
+                        let lastErr;
+                        for (let attempt = 0; attempt < 3 && !settled; attempt++) {
+                            try {
+                                settleDelegation(forkSettlementSeat.controlDir, { settleId: forkSettleId, status: verdict, now: Date.now });
+                                settled = true;
+                            }
+                            catch (e) {
+                                lastErr = e;
+                            }
+                        }
+                        if (settled && verdict === "external") {
+                            try {
+                                replayExternalSettlementEffects(forkSettlementSeat.controlDir, { carry: true, now: Date.now });
+                            }
+                            catch {
+                            }
+                        }
+                        if (!settled) {
+                            const detail = lastErr instanceof Error ? lastErr.message : String(lastErr);
+                            try {
+                                enqueueMemoryAnnouncement(forkSettlementSeat.controlDir, {
+                                    kind: "gate",
+                                    at: Date.now(),
+                                    items: [`delegation settlement: the terminal observation for a background fork of session ${JSON.stringify(forkSettlementSeat.sessionId)} could NOT be recorded (verdict ${verdict}) — the row stays pending and expires as UNPROVEN at the settlement window (fail-closed floor): ${detail.slice(0, 200)}`],
+                                });
+                            }
+                            catch {
+                                console.warn(`[sema] delegation settlement terminal write failed (fork, verdict ${verdict}, session ${forkSettlementSeat.sessionId}): ${detail}`);
+                            }
+                        }
+                    };
                     let taskId;
                     try {
                         taskId = bg.registry.registerBackgroundAgent({
@@ -1962,6 +2017,13 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         catch {
                         }
                         const wt = await finishWorktree();
+                        if (forkSettlementSeat !== undefined && forkSettleId !== undefined) {
+                            try {
+                                settleDelegation(forkSettlementSeat.controlDir, { settleId: forkSettleId, status: "void", now: Date.now, note: "registration failed before invoke (not dispatched)" });
+                            }
+                            catch {
+                            }
+                        }
                         return { isError: true, content: `Sub-agent not started in background: ${e instanceof Error ? e.message : String(e)}${wt ? `\n${wt}` : ""}`, details: { error: "register_failed" } };
                     }
                     childInternals.peerSelfRef?.addAxis("h", taskId);
@@ -2106,6 +2168,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     void opts.runner
                         .runTask(bgForkSpec, bgForkInternals)
                         .then(async (child) => {
+                        settleForkRow(child.status);
                         dropHostAbortListener();
                         await finishWorktree();
                         try {
@@ -2202,6 +2265,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         }
                     })
                         .catch((e) => {
+                        settleForkRow("failed");
                         dropHostAbortListener();
                         void finishWorktree();
                         const killed = abort.signal.aborted;
@@ -2268,7 +2332,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                                     : `Note: it is stopped automatically (killed) if still running when this task ends — do not promise the user results beyond this task.`,
                             ],
                         }),
-                        details: { type: "agent", subagent_type: FORK_SUBAGENT_TYPE, status: "async_launched", isAsync: true, task_id: taskId, description: shortDesc, prompt },
+                        details: { type: "agent", subagent_type: FORK_SUBAGENT_TYPE, status: "async_launched", isAsync: true, task_id: taskId, description: shortDesc, prompt, ...(forkSettleId !== undefined ? { settle_id: forkSettleId } : {}) },
                     };
                 }
                 const bgIgnoredNote = a.run_in_background === true
@@ -2368,6 +2432,60 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 const shortDesc = reviveRow?.description ?? String(a.description ?? "sub-agent").slice(0, 200);
                 const bgOwner = reviveRow !== undefined ? reviveRow.owner : sessionScopedBg ? ctx.sessionId : ctx.taskId ?? bg.owner;
                 const bgScope = treeScope;
+                const settlementSeat = ctx.delegationSettlement?.();
+                const bgSettleId = settlementSeat !== undefined ? `bg-${uuidv7()}` : undefined;
+                if (settlementSeat !== undefined && bgSettleId !== undefined) {
+                    try {
+                        registerDelegationLaunch(settlementSeat.controlDir, { settleId: bgSettleId, sessionId: settlementSeat.sessionId, now: Date.now, ...(ctx.toolCallId !== undefined ? { toolUseId: ctx.toolCallId } : {}) });
+                    }
+                    catch (e) {
+                        dropHostAbortListener();
+                        await cancelObserver();
+                        const wt = await finishWorktree();
+                        return {
+                            isError: true,
+                            content: `Sub-agent not started in background: the delegation settlement account could not record the launch (${(e instanceof Error ? e.message : String(e)).slice(0, 300)}) — fail-closed; repair the memory control plane or retry.${wt ? `\n${wt}` : ""}`,
+                            details: { error: "settlement_write_ahead_failed" },
+                        };
+                    }
+                }
+                const settleDelegationRow = (status) => {
+                    if (settlementSeat === undefined || bgSettleId === undefined)
+                        return;
+                    const att = status !== undefined ? childAttestation(status) : undefined;
+                    const verdict = att === "external" ? "external" : att === "clean" ? "clean" : "unattestable";
+                    let settled = false;
+                    let lastErr;
+                    for (let attempt = 0; attempt < 3 && !settled; attempt++) {
+                        try {
+                            settleDelegation(settlementSeat.controlDir, { settleId: bgSettleId, status: verdict, now: Date.now });
+                            settled = true;
+                        }
+                        catch (e) {
+                            lastErr = e;
+                        }
+                    }
+                    if (settled && verdict === "external") {
+                        try {
+                            replayExternalSettlementEffects(settlementSeat.controlDir, { carry: true, now: Date.now });
+                        }
+                        catch {
+                        }
+                    }
+                    if (!settled) {
+                        const detail = lastErr instanceof Error ? lastErr.message : String(lastErr);
+                        try {
+                            enqueueMemoryAnnouncement(settlementSeat.controlDir, {
+                                kind: "gate",
+                                at: Date.now(),
+                                items: [`delegation settlement: the terminal observation for a background delegation of session ${JSON.stringify(settlementSeat.sessionId)} could NOT be recorded (verdict ${verdict}) — the row stays pending and expires as UNPROVEN at the settlement window (fail-closed floor): ${detail.slice(0, 200)}`],
+                            });
+                        }
+                        catch {
+                            console.warn(`[sema] delegation settlement terminal write failed (verdict ${verdict}, session ${settlementSeat.sessionId}): ${detail} — the pending row expires as unproven at the settlement window`);
+                        }
+                    }
+                };
                 let taskId;
                 try {
                     taskId = bg.registry.registerBackgroundAgent(reviveRow !== undefined
@@ -2427,6 +2545,13 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     dropHostAbortListener();
                     await cancelObserver();
                     const wt = await finishWorktree();
+                    if (settlementSeat !== undefined && bgSettleId !== undefined) {
+                        try {
+                            settleDelegation(settlementSeat.controlDir, { settleId: bgSettleId, status: "void", now: Date.now, note: "registration failed before invoke (not dispatched)" });
+                        }
+                        catch {
+                        }
+                    }
                     return { isError: true, content: `Sub-agent not started in background: ${e instanceof Error ? e.message : String(e)}${wt ? `\n${wt}` : ""}`, details: { error: "register_failed" } };
                 }
                 childInternals.peerSelfRef?.addAxis("h", taskId);
@@ -2744,6 +2869,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         : opts.runner.runTask(bgSpec, bgInternals);
                 void bgChildPromise
                     .then(async (child) => {
+                    settleDelegationRow(child.status);
                     closeObserverWindow(child.status);
                     dropHostAbortListener();
                     await finishWorktree();
@@ -2938,6 +3064,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     }
                 })
                     .catch(async (e) => {
+                    settleDelegationRow("failed");
                     closeObserverWindow("failed");
                     dropHostAbortListener();
                     void finishWorktree();
@@ -3043,7 +3170,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                                 : `Note: it is stopped automatically (killed) if still running when this task ends — do not promise the user results beyond this task.`,
                         ],
                     }),
-                    details: { type: "agent", status: "async_launched", isAsync: true, task_id: taskId, description: shortDesc, prompt },
+                    details: { type: "agent", status: "async_launched", isAsync: true, task_id: taskId, description: shortDesc, prompt, ...(bgSettleId !== undefined ? { settle_id: bgSettleId } : {}) },
                 };
             }
             let child;

package/dist/core/checkpoint-store.d.ts

@@ -807,6 +807,18 @@ export interface CheckpointState {
          *  scope for any in-row invariant). Absent = the row was minted ungoverned. */
         realApproval?: true;
     };
+    /**
+     * design/319 (A ticket) — the session's reminder provenance mark
+     * ({@link import("./reminder-mint.js").mintReminderMark}), persisted so a durable resume keeps
+     * minting the SAME mark its transcript's engine reminders and system-prompt declaration carry
+     * ("resume reuses" — one declaration, one mark). Additive on the existing checkpoint version —
+     * a reader that ignores it is unchanged (the :646 precedent; no version bump). Resume goes
+     * through the VERIFY port ({@link import("./reminder-mint.js").isValidReminderMark}): a missing
+     * field (pre-319 row) or an unrecognized value-shape (corrupt / foreign / old-scheme after a
+     * scheme change) RE-MINTS instead of adopting — the declaration stays strict, and the historic
+     * legs' reminders simply read as data (fail-safe downgrade, design/319 a-2).
+     */
+    reminderMark?: string;
     /**
      * design/78 Slice-1: the SAFE-tier self-repair loop's durable state (`failureTrace`/`diagnostics`/
      * `rejectedHypotheses`/`attemptCount`/`oracleTier` — all JSON/`structuredClone`-safe, no fn/Date). Set ONLY

package/dist/core/governance-codes.d.ts

@@ -67,3 +67,16 @@ export type RuleSyncDropReason = keyof typeof RULE_SYNC_DROP_CODES;
 /** The subset that may appear on a LOCAL quarantined row (design/182 §8.1 `quarantine` instruction /
  *  fence arm / local screening). `own_actor_forged` is inbound-only by construction. */
 export type RuleQuarantineReason = Exclude<RuleSyncDropReason, "own_actor_forged">;
+/**
+ * The presentation-tier registry (the server's wire whitelist retires into this
+ * table once shipped): WHO a notice code is for. `"user"` = a session-scoped disclosure the end
+ * user of that session should see (safe to project onto the session's event stream); `"operator"`
+ * = a deployment/config/ops fact for whoever runs the process. Presentation tier is a property of
+ * the CODE (closed set, one code one tier) — never of an individual emission, which is why this is
+ * a registry and not an EngineNotice field. Codes absent from the table read as `"operator"`
+ * (the conservative default: never push an unclassified code at an end user).
+ * Orthogonal to {@link NON_GOVERNANCE_MEMORY_CODES} (a retry-semantics table, not presentation).
+ */
+export declare const NOTICE_AUDIENCE: Readonly<Record<string, "user" | "operator">>;
+/** The audience for `code` — table lookup with the conservative `"operator"` default. */
+export declare function noticeAudienceOf(code: string): "user" | "operator";

package/dist/core/governance-codes.js

@@ -29,6 +29,28 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.erasure_index_residue",
     "memory.export_incomplete",
     "memory.import_rejected",
+    "memory.hold_opened",
+    "memory.hold_released",
+    "memory.hold_disposed",
+    "memory.settlement_resolve_unattributed",
+    "memory.settlement_resolve_invalid",
+    "memory.settlement_resolve_unknown",
+    "memory.session_account_resolve_unattributed",
+    "memory.session_account_resolve_unknown",
+    "memory.hold_resolve_unattributed",
+    "memory.hold_resolve_invalid",
+    "memory.hold_resolve_unknown",
+    "memory.hold_resolve_invalid_state",
+    "memory.settlement_record_failed",
+    "memory.session_account_failed",
+    "memory.origin_clear_unattributed",
+    "memory.origin_clear_invalid",
+    "memory.origin_clear_unknown",
+    "memory.origin_clear_not_marked",
+    "memory.origin_clear_challenged",
+    "memory.origin_clear_pending",
+    "memory.origin_clear_conflict",
+    "memory.origin_clear_failed",
 ]);
 export function governanceRetryClass(code) {
     if (Object.prototype.hasOwnProperty.call(GOVERNANCE_CODES, code)) {
@@ -46,3 +68,14 @@ export const RULE_SYNC_DROP_CODES = {
     below_gc_frontier: "local-quarantined",
     server_rejected: "local-quarantined",
 };
+export const NOTICE_AUDIENCE = {
+    "memory.session_polluted": "user",
+    "memory.harvest_quarantined": "user",
+    "memory.delegation_static_mark_waived": "user",
+    "memory.hold_opened": "user",
+    "memory.hold_released": "user",
+    "memory.hold_disposed": "user",
+};
+export function noticeAudienceOf(code) {
+    return NOTICE_AUDIENCE[code] ?? "operator";
+}

package/dist/core/hooks.d.ts

@@ -583,8 +583,11 @@ export interface UserPromptSubmitResult {
  *  NOTE (council design/74 #6): this does NOT escape a literal `</system-reminder>` in `text` — callers MUST
  *  pass trusted, first-party strings (every current caller does: fixed gate/limit messages). If a future
  *  caller needs to relay UNTRUSTED content (tool output, user data), it must sanitize the close tag first
- *  (or use the `delimitUntrusted` fence), or a crafted payload could break out of the reminder framing. */
-export declare function formatHookFeedback(text: string): string;
+ *  (or use the `delimitUntrusted` fence), or a crafted payload could break out of the reminder framing.
+ *  design/319 (A ticket): `mark` is the session's reminder provenance mark — run-scoped callers thread it
+ *  so the open tag carries the value the system-prompt declaration names (rendered by the mint home; the
+ *  body is byte-untouched). Absent ⇒ the historic bare open tag (a caller outside a run). */
+export declare function formatHookFeedback(text: string, mark?: string): string;
 /** The outcome of the two-phase tool gate, mapped onto the harness `tool_call` hook return shape. */
 export interface ToolGateResult {
     /** Block execution (the loop emits an error tool result with `reason`). */
@@ -799,6 +802,10 @@ export interface ToolGateInput {
      *  per-leg mint; a host driving the gate directly may omit it, and the contexts then carry no
      *  identity (honest absence — this layer never fabricates a leg). */
     identity?: HookInvocationIdentity;
+    /** design/319 (A ticket) — the run's reminder provenance mark: the gate's own model-facing deny
+     *  reasons ride `formatHookFeedback`, so their open tags must carry the same mark the run's
+     *  system-prompt declaration names. Absent (a host driving the gate directly) ⇒ bare tags. */
+    reminderMark?: string;
     preToolUse?: Hooks["preToolUse"];
     /** The read-only env capability face put on every {@link HookToolContext} this gate call
      *  builds ({@link HookEnvCapabilities}). Built ONCE per task by the runner (after the env is minted) and

package/dist/core/hooks.js

@@ -1,6 +1,7 @@
 import { decisionText, describeThrown, refuseOutOfContractDecision } from "./tool-policy.js";
 import { brandPolicyAskClass } from "./ask-class.js";
 import { inlineUntrusted } from "./untrusted-text.js";
+import { mintSystemReminder } from "./reminder-mint.js";
 import { PROBE_REASON_MAX, normalizeProbeCause } from "./checkpoint-store.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 import { createSafeNotifier } from "./safe-notify.js";
@@ -90,8 +91,8 @@ export function mintHookInvocationIdentity(facts) {
         ...(facts.parentToolCallId !== undefined ? { parentToolCallId: facts.parentToolCallId } : {}),
     }));
 }
-export function formatHookFeedback(text) {
-    return `<system-reminder>\n${text}\n</system-reminder>`;
+export function formatHookFeedback(text, mark) {
+    return mintSystemReminder(text, mark);
 }
 const PARK_FAILURE_CAUSE_MAX = 600;
 function withParkFailureCause(reason, parkFailed) {
@@ -304,7 +305,7 @@ export async function runToolGate(input) {
             if (input.permissionDenied) {
                 await notifier.notifyAsync(() => input.permissionDenied?.({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason, source: "hook", ...(input.identity !== undefined ? { identity: input.identity } : {}) }), "toolGate.permissionDenied");
             }
-            return { block: true, reason: formatHookFeedback(reason), preToolContext };
+            return { block: true, reason: formatHookFeedback(reason, input.reminderMark), preToolContext };
         }
         if (r) {
             if (r.additionalContext) {
@@ -313,7 +314,7 @@ export async function runToolGate(input) {
             if (r.action === "deny") {
                 return {
                     block: true,
-                    reason: formatHookFeedback(decisionText(r) ?? `tool "${toolName}" blocked by a PreToolUse hook`),
+                    reason: formatHookFeedback(decisionText(r) ?? `tool "${toolName}" blocked by a PreToolUse hook`, input.reminderMark),
                     preToolContext,
                 };
             }
@@ -813,7 +814,7 @@ export async function runToolGate(input) {
         const denyApprover = denySettledBy !== undefined ? resolvedApprover : undefined;
         return {
             block: true,
-            reason: formatHookFeedback(denyReason),
+            reason: formatHookFeedback(denyReason, input.reminderMark),
             ...(denySettledBy !== undefined ? { settledBy: denySettledBy } : {}),
             ...(denyApprover !== undefined ? { approver: denyApprover } : {}),
             preToolContext,

package/dist/core/memory-engine/content-origin.d.ts

@@ -6,7 +6,9 @@
  * into long-term memory? Three tiers:
  *
  *  - "external"  — network-retrieval families and external protocol channels. Invocation marks the
- *                  session's memory POLLUTED (one-way, durable; the polluted harvest quarantines).
+ *                  session's memory EXTERNALLY EXPOSED (one-way, durable; what the mark does at
+ *                  harvest is the provenance mode's question — design/336: tag-admit with an origin
+ *                  marker under "carry", full quarantine under "off").
  *  - "execution" — general execution (shell/exec). A NAMED residual channel: it can reach external
  *                  content indirectly, but the two industry anchors this tier is calibrated against
  *                  gate on network/protocol families only, and excluding every shell session would