@sema-agent/core 5.46.0 → 5.47.0

package/dist/core/runner/prepare-task.d.ts

@@ -433,6 +433,30 @@ export interface Prepared {
             trustedTools: ReadonlySet<string>;
             execIsExternalContent: boolean;
         };
+        /**
+         * design/336 §3.3 — the delegation-settlement handle: the control-plane coordinates a
+         * settlement writer needs, as PURE DATA. Consumers (the subagent background leg's write-ahead
+         * + terminal observation, the tool wrap's sync unattestable row) can outlive this prepared
+         * leg, so they rebuild their write handle from these fields alone — never from the live
+         * engine/session objects above. Present only under `memoryProvenance: "carry"` (the default):
+         * an `"off"` deployment keeps the pre-336 accepted-cost posture byte-level.
+         */
+        settlement?: {
+            /** The WRITE plane's control-plane dir (the pollution-marker/lineage sidecar home). */
+            controlDir: string;
+            sessionId: string;
+            provenance: "carry";
+        };
+        /**
+         * design/336 §5.5 (file-face half) — the Read-tool recall-taint judgment, present only under
+         * `memoryProvenance: "carry"`. True ⇔ the delivered ABSOLUTE path sits inside a mounted memory
+         * plane and its head bytes carry a committed external-origin marker; the tool wrap then marks
+         * the session derived (same seat and cause as the memory_get propagation). Never throws;
+         * relative paths and unreadable files answer false (named residuals beside the Bash channel).
+         */
+        recallTaint?: {
+            judgeDeliveredPath: (absPath: string) => boolean;
+        };
     };
     /** A per-task env minted by `RunnerDeps.executionEnvFactory` (design/48 remote seam) that THIS task owns
      *  and the Runner must tear down on task end. Undefined when the env came from a (caller-owned) static

package/dist/core/runner/prepare-task.js

@@ -47,9 +47,10 @@ import { TOOL_SEARCH_NAME, buildDeferredRegistry, classifyDeferred, extractDisco
 import { createSharedMemoryTools } from "../shared-memory/tools.js";
 import { SHARED_MEMORY_TOOL_NAMES } from "../shared-memory/types.js";
 import { MEMORY_ENGINE_TOOL_NAMES } from "../memory-engine/tools.js";
-import { MEMORY_RECALL_DISCIPLINE } from "../memory-engine/engine.js";
+import { memoryRecallDisciplineSegment } from "../memory-engine/engine.js";
 import { classifyToolContentOrigin, contentOriginPollutes, delegationCallIsExternal } from "../memory-engine/content-origin.js";
 import { narrowContentSafety, readCardAttestation } from "../memory-engine/delegation-provenance.js";
+import { recordSyncUnattestable, sessionSettlements } from "../memory-engine/delegation-settlement.js";
 import { composeMemoryBlock } from "../memory.js";
 import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, complianceCallDenial, resolveComplianceDenies } from "../compliance.js";
 import { foldAdmissionFreeze } from "../memory-admission.js";
@@ -733,6 +734,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const frozenOnQuestion = spec.onQuestion ?? deps.onQuestion;
         const provenanceForChildrenRef = {};
         const delegationProvenanceForChildren = () => provenanceForChildrenRef.current;
+        const delegationSettlementRef = {};
+        const delegationSettlementForChildren = () => delegationSettlementRef.current;
         const inheritedGateForChildren = () => {
             const ancestorRules = [
                 ...(inheritedAncestorRules ?? []),
@@ -828,6 +831,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             activeSkillScope: () => skillScope.active(),
             inheritedGateForChildren,
             delegationProvenanceForChildren,
+            delegationSettlement: delegationSettlementForChildren,
             ...(autoModeDecider ? { autoModeReview: { decider: autoModeDecider } } : {}),
             ...(spec.durableApproval !== undefined ? { durableApprovalForChildren: { ...spec.durableApproval } } : {}),
             ...(spec.checkpointStore === null ? { checkpointStoreDisabledForChildren: true } : {}),
@@ -1863,12 +1867,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 if (memoryEnginePair.length > 0) {
                     memoryEnginePairMounted = false;
                     if (memoryBlock !== undefined) {
-                        if (memoryBlock === MEMORY_RECALL_DISCIPLINE)
+                        const segment = memoryRecallDisciplineSegment(memoryProvenance);
+                        if (memoryBlock === segment)
                             memoryBlock = undefined;
-                        else if (memoryBlock.includes(`\n\n${MEMORY_RECALL_DISCIPLINE}`))
-                            memoryBlock = memoryBlock.replace(`\n\n${MEMORY_RECALL_DISCIPLINE}`, "");
-                        else if (memoryBlock.startsWith(`${MEMORY_RECALL_DISCIPLINE}\n\n`))
-                            memoryBlock = memoryBlock.slice(MEMORY_RECALL_DISCIPLINE.length + 2);
+                        else if (memoryBlock.includes(`\n\n${segment}`))
+                            memoryBlock = memoryBlock.replace(`\n\n${segment}`, "");
+                        else if (memoryBlock.startsWith(`${segment}\n\n`))
+                            memoryBlock = memoryBlock.slice(segment.length + 2);
                     }
                     deps.onError?.(new Error(`Memory tools ${MEMORY_ENGINE_TOOL_NAMES.join("/")} were NOT mounted: mounting them would inject ` +
                         `the "${TOOL_SEARCH_NAME}" tool, whose name this task already declares — the pair mounts together or not at all.`), { phase: "config", sessionId, classification: "memory-tools-not-mounted" });
@@ -1891,6 +1896,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const trustedTools = effectiveSafety.trustedTools;
             const execIsExternalContent = effectiveSafety.execIsExternalContent;
             provenanceForChildrenRef.current = { trustedTools: [...trustedTools], execIsExternalContent };
+            if (memoryEngineSession?.settlement !== undefined) {
+                delegationSettlementRef.current = { controlDir: memoryEngineSession.settlement.controlDir, sessionId: memoryEngineSession.settlement.sessionId };
+            }
             const recordExternal = () => {
                 if (delegationProvenanceChannel !== undefined)
                     delegationProvenanceChannel.ref.current.sawExternal = true;
@@ -1920,6 +1928,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 isCallerTool: true,
                 trusted: trustedTools.has(t.name),
             }), execIsExternalContent);
+            const recallTaintJudge = memoryEngineSession?.recallTaint?.judgeDeliveredPath;
             contentOriginWrapRef.current = () => {
                 for (let i = 0; i < tools.length; i++) {
                     const t = tools[i];
@@ -1929,7 +1938,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const delegation = delegationByName.get(t.name);
                     const isDelegation = delegation !== undefined;
                     const pollutes = contentOriginPollutes(origin, execIsExternalContent);
-                    if (!pollutes && !isDelegation) {
+                    const readsMemoryPlane = recallTaintJudge !== undefined && t.name === "Read";
+                    if (!pollutes && !isDelegation && !readsMemoryPlane) {
                         contentOriginWrapped.add(t);
                         continue;
                     }
@@ -1948,8 +1958,39 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                 mark(`tool "${t.name}" (${origin} content class) was invoked in this session`, "observed");
                                 recordExternal();
                             }
-                            if (!isDelegation)
-                                return inner(toolCallId, params, signal, onUpdate);
+                            if (!isDelegation) {
+                                if (!readsMemoryPlane)
+                                    return inner(toolCallId, params, signal, onUpdate);
+                                const result = await inner(toolCallId, params, signal, onUpdate);
+                                const raw = result;
+                                const contentField = typeof raw === "object" && raw !== null ? raw.content : undefined;
+                                const headText = typeof raw === "string"
+                                    ? raw
+                                    : typeof contentField === "string"
+                                        ? contentField
+                                        : Array.isArray(contentField) && typeof contentField[0]?.text === "string"
+                                            ? contentField[0].text
+                                            : "";
+                                const delivered = result?.isError !== true &&
+                                    result?.details?.type !== "file_unchanged" &&
+                                    !headText.startsWith("<system-reminder");
+                                const fp = params?.file_path;
+                                if (delivered && typeof fp === "string" && recallTaintJudge(fp)) {
+                                    mark(`the "${t.name}" tool delivered the content of an external-origin memory entry file`, "derived");
+                                }
+                                return result;
+                            }
+                            let preCallLaunchRows;
+                            if (delegationEvidenceAttestedOnly && memoryEngineSession?.settlement !== undefined) {
+                                try {
+                                    preCallLaunchRows = new Set(sessionSettlements(memoryEngineSession.settlement.controlDir, memoryEngineSession.settlement.sessionId)
+                                        .filter((r) => r.row.lane === "background" && r.row.toolUseId === toolCallId)
+                                        .map((r) => r.row.settleId));
+                                }
+                                catch {
+                                    preCallLaunchRows = undefined;
+                                }
+                            }
                             const requested = params?.subagent_type;
                             const external = delegationCallIsExternal({
                                 requestedType: typeof requested === "string" ? requested : undefined,
@@ -1971,7 +2012,36 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                     if (!delegationEvidenceAttestedOnly) {
                                         mark(staticFaceReason, "static");
                                     }
-                                    else if (pollution !== undefined && !staticMarkWaiverAnnounced) {
+                                    else {
+                                        const receiptDetails = result?.details;
+                                        const claimsLaunchReceipt = receiptDetails !== undefined && receiptDetails !== null && receiptDetails.status === "async_launched";
+                                        const claimedSettleId = claimsLaunchReceipt && typeof receiptDetails.settle_id === "string" ? receiptDetails.settle_id : undefined;
+                                        const settlementSeat = memoryEngineSession?.settlement;
+                                        let isLaunchReceipt = false;
+                                        if (claimsLaunchReceipt && settlementSeat !== undefined) {
+                                            try {
+                                                isLaunchReceipt =
+                                                    preCallLaunchRows !== undefined &&
+                                                        claimedSettleId !== undefined &&
+                                                        !preCallLaunchRows.has(claimedSettleId) &&
+                                                        sessionSettlements(settlementSeat.controlDir, settlementSeat.sessionId).some((r) => r.row.lane === "background" && r.row.settleId === claimedSettleId && r.row.toolUseId === toolCallId);
+                                            }
+                                            catch {
+                                                isLaunchReceipt = false;
+                                            }
+                                        }
+                                        if (!isLaunchReceipt && settlementSeat !== undefined) {
+                                            try {
+                                                recordSyncUnattestable(settlementSeat.controlDir, { sessionId: settlementSeat.sessionId, toolCallId, now: Date.now });
+                                            }
+                                            catch (err) {
+                                                const e = new Error(`delegated output withheld (fail-closed): the delegation delivered without a provable attestation and the settlement account could not record the fact (${err instanceof Error ? err.message : String(err)}) — repair the memory control plane or retry`);
+                                                e.code = "memory.settlement_record_failed";
+                                                throw e;
+                                            }
+                                        }
+                                    }
+                                    if (delegationEvidenceAttestedOnly && pollution !== undefined && !staticMarkWaiverAnnounced) {
                                         staticMarkWaiverAnnounced = true;
                                         const waivedReason = inlineUntrusted(staticFaceReason, 200);
                                         deliverEngineNotice(deps.onNotice, {

package/dist/core/session-reconcile.js

@@ -9,7 +9,8 @@ const INTERRUPTED_IDEMPOTENT = "[INTERRUPTED] The previous run ended before this
     "may not have taken effect. It is safe to REPLAY: re-issuing the same call converges the state to " +
     "what you intended. If you decide not to re-issue it, verify the current state first.";
 const INTERRUPTED_NEVER_STARTED = "[INTERRUPTED] The run was aborted before this tool call started. It was never executed and had " +
-    "no side effects — it is safe to re-issue this call if you still need it.";
+    "no side effects. If the run was stopped by a pending approval or an unresolved gate, wait for it " +
+    "to be resolved before re-issuing; re-issuing is otherwise safe if you still need this call.";
 const INTERRUPTED_REPEAT_UNKNOWN = "[INTERRUPTED] Same as an earlier interrupted call in this batch: no result was recorded and the outcome is " +
     "UNKNOWN — verify before relying on it.";
 const INTERRUPTED_REPEAT_SAFE = "[INTERRUPTED] Same as an earlier interrupted call in this batch: this tool is read-only/idempotent, so just " +
@@ -17,7 +18,7 @@ const INTERRUPTED_REPEAT_SAFE = "[INTERRUPTED] Same as an earlier interrupted ca
 const INTERRUPTED_REPEAT_IDEMPOTENT = "[INTERRUPTED] Same as an earlier interrupted call in this batch: it is safe to REPLAY — re-issue it, or verify " +
     "the current state if you decide not to.";
 const INTERRUPTED_REPEAT_NEVER_STARTED = "[INTERRUPTED] Same as an earlier interrupted call in this batch: it never started and had no side effects — " +
-    "safe to re-issue.";
+    "re-issuing is safe once whatever stopped the run is resolved.";
 const REPEAT_TEXT = {
     never_started: INTERRUPTED_REPEAT_NEVER_STARTED,
     read: INTERRUPTED_REPEAT_SAFE,

package/dist/core/types.d.ts

@@ -868,6 +868,20 @@ export interface ToolExecuteContext {
      * {@link inheritedGateForChildren}: never a model/tool argument, never a TaskSpec field.
      */
     delegationProvenanceForChildren?: () => import("./memory-engine/delegation-provenance.js").DelegationContentSafety | undefined;
+    /**
+     * design/336 §3.3 — the delegation-settlement account's coordinates (the WRITE plane's memory
+     * control dir + this session's id), Runner-filled when the run mounts a memory session under
+     * `memoryProvenance: "carry"`. A delegation tool's BACKGROUND lane writes its launch write-ahead
+     * (pending row BEFORE registration and invoke) and its terminal settle through these — as pure
+     * data, because the terminal observation can run after this task leg returned and must rebuild
+     * its write handle from the coordinates alone. Undefined ⇒ no settlement account (memory-less
+     * run, or `"off"`): the background lane launches without rows, the pre-336 accepted-cost shape.
+     * Same trust posture as {@link delegationProvenanceForChildren}: never a model/tool argument.
+     */
+    delegationSettlement?: () => {
+        controlDir: string;
+        sessionId: string;
+    } | undefined;
     /**
      * RB-201 FO-3 (form-one audit, CC 220 `Ipd`/`ein` parity) — the auto-mode classifier decider ARMED
      * for THIS task (`RuntimeCaps.autoMode === true` AND `RunnerDeps.autoMode` both present; the same
@@ -4751,9 +4765,24 @@ export interface EngineNotice {
      *    HARVEST that withheld at least one entry file (a checkpoint harvest and the terminal harvest
      *    are distinct facts), never minted for a clean session; `detail: { count, moved, escalated,
      *    reason?, sessionId? }` (`reason` absent ⇔ the pollution marker could not be re-read at report
-     *    time — the withheld count stays true either way). Registered gap: the derived index (`MEMORY.md`) is
-     *    contained on a path that mints no rejection row, so an index-ONLY containment produces no
-     *    notice and is disclosed by the harvest report's warnings alone.
+     *    time — the withheld count stays true either way). The formerly registered index-only gap is
+     *    CLOSED under `memoryProvenance: "carry"` (design/336 §6.3, #331): the mint condition reads
+     *    `HarvestReport.containment`, so a containment whose only act was the derived-index rollback
+     *    announces with `count: 0` and `detail.indexRolledBack: true`; under `"off"` the pre-336
+     *    count>0 condition (and its silence on index-only containment) is kept byte-level.
+     *  - `"memory.hold_opened"` / `"memory.hold_released"` / `"memory.hold_disposed"` (design/336
+     *    §4/§6.3) — the instruction-hold lifecycle, derived from the same structured
+     *    `HarvestReport.containment` signal (hold seats are only ever filled under
+     *    `memoryProvenance: "carry"`): a PENDING session's instruction-form entry files were captured
+     *    off the model-visible plane (`hold_opened`, `detail: { count, paths, sessionId? }` — paths
+     *    neutralized/length-bounded); previously held entries re-walked the full gate set and
+     *    committed after their writer session settled clean or a host valve released them
+     *    (`hold_released`); held entries moved to control-plane quarantine (`hold_disposed`,
+     *    `detail.disposed: [{ path, terminal }]` with the closed terminal set
+     *    dirty/expired/conflict/capture_lost/discarded — an `expired` terminal is explicitly a
+     *    TIMEOUT, not a conviction, and the message names `resolveHold` as the recovery valve). At
+     *    most one notice per family per harvest report; wording is factual, never threat-flavored
+     *    (the design/336 §13-2 model-psyche guardrail).
      *  - `"memory.delegation_static_mark_waived"` (design/324, #324 ruling ①) — the deployment set
      *    {@link RunnerDeps.memoryDelegationEvidence} to `"attested-only"` and a delegation call whose
      *    STATIC tool-face verdict would have marked this session's memory polluted (attestation
@@ -4781,6 +4810,12 @@ export interface EngineNotice {
     message: string;
     /** Machine-readable facts of the notice (knob names, arriving values, values in force). */
     detail?: Record<string, unknown>;
+    /** The owning session, when the notice HAS one — the wire-routing attribution key (a
+     *  session-scoped notice can be projected onto that session's event stream; a session-less code
+     *  structurally cannot). Mint sites do not set this: {@link deliverEngineNotice} — the ONE
+     *  delivery throat — lifts a string `detail.sessionId` here, so the typed key and the detail
+     *  carriage can never disagree. Optional and absent for process/config-scoped codes. */
+    sessionId?: string;
 }
 /** Test seam (mirrors `__resetBashTimeoutAnnouncements`): never called by production code. */
 export declare function __resetMalformedNoticeSeatAnnouncement(): void;

package/dist/core/types.js

@@ -24,6 +24,9 @@ export function __resetMalformedNoticeSeatAnnouncement() {
     malformedNoticeSeatAnnounced = false;
 }
 export function deliverEngineNotice(onNotice, notice) {
+    if (notice.sessionId === undefined && typeof notice.detail?.["sessionId"] === "string") {
+        notice = { ...notice, sessionId: notice.detail["sessionId"] };
+    }
     if (typeof onNotice === "function") {
         try {
             const r = onNotice(notice);

package/dist/index.d.ts

@@ -61,6 +61,7 @@ export { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME
 export { admitMemoryScopes, foldAdmissionFreeze, type OwnOrgAdmissionVerdict, type MemoryAdmissionInput, type MemoryAdmissionOutcome, type MemoryAdmissionVerdict, type MemoryScopeAdmission, type MemoryScopeOrigin, type MemoryScopeRequest, } from "./core/memory-admission.js";
 export { assertRetentionCapability, type ManagedRetentionCapability, type RetentionDeclaration, type RetentionDeclaring, type RetentionPolicy, type RetentionReceipt, } from "./core/retention.js";
 export { GOVERNANCE_CODES, governanceRetryClass, type GovernanceCode, type GovernanceRetryClass } from "./core/governance-codes.js";
+export { NOTICE_AUDIENCE, noticeAudienceOf } from "./core/governance-codes.js";
 export { TtlSessionStore, type TtlSessionStoreOptions, type EvictPolicy } from "./core/session-store.js";
 export { reconcileInterruptedSession, findOrphanToolCalls, type OrphanToolCall, type ReconcileReport, } from "./core/session-reconcile.js";
 export { StoredSession, InMemorySessionRepo, InMemorySessionStorage, BaseSessionStorage, leafIdAfterEntry, validateEntriesForImport, StreamingImportValidator, boundedTail, SessionError, isSessionConflict, hasSessionFork, uuidv7, type Session, type SessionStore, type AcquiredSession, type SessionStoreSummary, type SessionStorage, type SessionRepo, type SessionMetadata, type SessionTreeEntry, type SessionWriteOptions, } from "./core/session.js";
@@ -167,7 +168,7 @@ export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootA
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, type AdoptionStatus, type AdoptLocalDataRootOptions, type AdoptLocalDataRootResult, type AdoptionCarriageLeg, type AdoptionCarriageLegContext, type AdoptionConfigWitnessReceipt, } from "./stores/file/adoption/adopt.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, type PersistedRuleHit, type PersistedRuleUnreadable, type PersistedRuleAnswer, normalizePersistedRuleHit, type Hooks, type HookToolContext, type HookInvocationIdentity, type UserPromptSubmitContext, type PostToolBatchContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, isInstructionEntry, type MemoryEntryOrigin, type MemoryOriginCause, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type MemoryGetDetails, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, computeMemoryBundleHash, type MemoryExportBundle, type MemoryImportReport, type MemoryExportSnapshot, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, ambiguousOriginRepresentation, isInstructionEntry, type MemoryEntryOrigin, type MemoryOriginCause, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type CleanMemorySearchHit, type ExposedMemorySearchHit, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, type MemoryGetDetails, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, computeMemoryBundleHash, type MemoryExportBundle, type MemoryImportReport, type MemoryExportSnapshot, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryPagedList, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, type SharedMemoryFixture, type SharedMemoryStoreContractHooks, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";

package/dist/index.js

@@ -49,6 +49,7 @@ export { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME
 export { admitMemoryScopes, foldAdmissionFreeze, } from "./core/memory-admission.js";
 export { assertRetentionCapability, } from "./core/retention.js";
 export { GOVERNANCE_CODES, governanceRetryClass } from "./core/governance-codes.js";
+export { NOTICE_AUDIENCE, noticeAudienceOf } from "./core/governance-codes.js";
 export { TtlSessionStore } from "./core/session-store.js";
 export { reconcileInterruptedSession, findOrphanToolCalls, } from "./core/session-reconcile.js";
 export { StoredSession, InMemorySessionRepo, InMemorySessionStorage, BaseSessionStorage, leafIdAfterEntry, validateEntriesForImport, StreamingImportValidator, boundedTail, SessionError, isSessionConflict, hasSessionFork, uuidv7, } from "./core/session.js";
@@ -129,7 +130,7 @@ export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootA
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, } from "./stores/file/adoption/adopt.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, normalizePersistedRuleHit, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, isInstructionEntry, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, erasureSelectHash, computeMemoryBundleHash, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, ambiguousOriginRepresentation, isInstructionEntry, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, erasureSelectHash, computeMemoryBundleHash, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";

package/dist/tools/task-list.d.ts

@@ -43,7 +43,11 @@ export interface TaskListItem {
  *   process ({@link createTaskListTools} keeps a per-store promise chain) — a store shared across
  *   PROCESSES additionally needs its own transactional guarantees for those sequences, which is the
  *   deployment's half (documented, not solved here; CC's file-backed team list has the same window).
- * - `allocateId` is store-owned so concurrent teammates never mint colliding ids.
+ * - `allocateId` is store-owned so concurrent teammates never mint colliding ids, and the
+ *   high-water mark is MONOTONIC ACROSS REOPENS for any backend that outlives one wrapper
+ *   instance: a restart/reconnect must never re-mint an id the backend has already handed out
+ *   (the conformance suite's durable tier pins exactly this — a counter that resets while the
+ *   rows survive makes every receipt lie and every subsequent update miss).
  * - Value semantics: `get`/`list` return detached copies; `set` stores a detached copy. Callers
  *   mutate their copy and write it back — a live-reference store would alias already-emitted events.
  * - RB-274: `list` is ordered by ID (numeric ascending), not by write order. The tool lane always

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.46.0",
+  "version": "5.47.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,6 +1,6 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
-  "count": 1617,
+  "count": 1625,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -172,6 +172,7 @@
     "CheckpointSummary": "interface",
     "CheckpointToken": "type",
     "CircuitBreakerOptions": "interface",
+    "CleanMemorySearchHit": "interface",
     "CodeReviewMode": "type",
     "CodeToolsConfig": "interface",
     "CommittedBinding": "type",
@@ -279,6 +280,7 @@
     "ExecutionError": "class",
     "ExecutionErrorCode": "type",
     "ExplainInput": "interface",
+    "ExposedMemorySearchHit": "interface",
     "ExternalNotificationInput": "interface",
     "F012_CHECKPOINT_VERSION": "variable",
     "FABLE_5_COMPAT": "variable",
@@ -429,6 +431,8 @@
     "MCP_PREFIX": "variable",
     "MEMORY_ANNOUNCEMENTS_MAX": "variable",
     "MEMORY_ENGINE_TOOL_NAMES": "variable",
+    "MEMORY_EXPOSURE_BANNER": "variable",
+    "MEMORY_EXPOSURE_HANDLE_TAG": "variable",
     "MEMORY_FILENAME_SEGMENT_RE": "variable",
     "MEMORY_GET_TOOL_NAME": "variable",
     "MEMORY_GUIDANCE": "variable",
@@ -498,7 +502,7 @@
     "MemoryScopeOrigin": "type",
     "MemoryScopeRequest": "interface",
     "MemorySearchDetails": "interface",
-    "MemorySearchHit": "interface",
+    "MemorySearchHit": "type",
     "MemorySelectRequest": "interface",
     "MemorySelector": "type",
     "MemorySessionHandle": "interface",
@@ -525,6 +529,7 @@
     "ModelTier": "type",
     "MonitorTimers": "interface",
     "MonitorToolOptions": "interface",
+    "NOTICE_AUDIENCE": "variable",
     "NO_PERSISTENT_MEMORY_NOTICE": "variable",
     "NamedToolPolicy": "type",
     "NamedWorkflowListing": "interface",
@@ -1105,6 +1110,7 @@
     "adoptLocalDataRoot": "function",
     "advanceCursorAfterInline": "function",
     "agentWhenToUseText": "function",
+    "ambiguousOriginRepresentation": "function",
     "analyzePromptCacheFriendliness": "function",
     "appendHopToken": "function",
     "appendPendingSteer": "function",
@@ -1393,6 +1399,7 @@
     "materializeMcpTools": "function",
     "maybeCompact": "function",
     "memoryBackendContract": "function",
+    "memoryExposureIndexRow": "function",
     "mergeRecallHits": "function",
     "mergeWorkflowArgs": "function",
     "migrateScope": "function",
@@ -1412,6 +1419,7 @@
     "normalizePromptEpoch": "function",
     "normalizeRules": "function",
     "normalizeToolResultProvenance": "function",
+    "noticeAudienceOf": "function",
     "ok": "function",
     "openSystemReminder": "function",
     "orgRuleStatePersistenceOf": "function",