@sema-agent/core 5.47.0 → 5.48.0

package/dist/core/untrusted-text.d.ts

@@ -16,6 +16,69 @@
  * own (instructions and data share one channel). The real boundary is decorrelation + reading the objective
  * artifact (the diff / working tree) rather than the worker's self-report (design/53 §3, design/54 §3).
  */
+/** design/319 (B ticket) — what one reminder-shaped scan of an external projection found. */
+export interface ReminderShapedScan {
+    /** ≥1 reminder-shaped tag (open or close; attribute/case/whitespace tolerant) is present. */
+    hit: boolean;
+    /** Some reminder-shaped TAG's own bytes contain the session's exact mark value — the strongest
+     *  verdict (a full scan decides this, never the first match: a bare decoy ahead of a marked
+     *  forgery must still be judged marked). `false` whenever `mark` is `undefined`. */
+    hadCurrentMark: boolean;
+}
+/**
+ * design/319 (B ticket) — the ONE detection predicate for reminder-shaped text in EXTERNAL data
+ * (the Read/notebook/PDF/MCP disclosure trailers and the MCP/web exact-mark defuse all judge with
+ * THIS scan). It reads the same {@link SYSTEM_REMINDER} regex the neutralizer rewrites with, so
+ * "what gets defused on contained lanes" and "what gets disclosed on verbatim lanes" can never
+ * drift apart — do not hand-copy the tag pattern anywhere else (same single-source discipline as
+ * {@link defuseFenceMarkers}). Attribute-tolerant / case-insensitive / tag-internal whitespace
+ * tolerant by construction; a tag the regex does not recognize is NOT a hit (the residual gap
+ * between this grammar and what a model might read as authority is an accepted, documented
+ * residual — same class as the Unicode-lookalike note on {@link defuseFenceMarkers}).
+ *
+ * The scan is read-only over the FINALIZED projection (post concatenation/truncation, pre any
+ * trusted tail) — callers must scan BEFORE any byte-changing transform (design/319 §3e four-step
+ * order): a defused/neutralized projection no longer carries the exact mark, so scanning after
+ * would misreport a marked forgery as the bare form (the lying-disclosure shape).
+ */
+export declare function scanReminderShaped(text: string, mark: string | undefined): ReminderShapedScan;
+/**
+ * design/319 §3b (B ticket) — EXACT-MARK defuse for the MCP-success/web outlets: insert a ZWSP
+ * inside every occurrence of the session's exact mark value so the bytes no longer spell the
+ * current mark. This is the ONE sanctioned byte change on those lanes (their zero-byte-change
+ * invariant's single exception): a server/page legitimately producing the 22-char session mark has
+ * definitionally zero probability — the value lives only in this session's prompt and checkpoint —
+ * so an occurrence is either a forgery or a leak echo, and defusing it turns a silent authority
+ * forgery into a visible mismatch (the accepted failure direction; a legitimate round-trip echo of
+ * a leaked mark defuses too, and the next hop then fails loudly instead of re-arming the forgery).
+ * NEVER applied on Read/Bash/Grep (the strong quote-back lanes stay verbatim — ruled, observation
+ * seat only). Idempotent: the rewritten text no longer contains the exact mark (ZWSP is not a
+ * base64url character, so the insertion can also never synthesize a new occurrence).
+ */
+export declare function defuseExactMark(text: string, mark: string): string;
+/**
+ * design/319 §3b — the SEGMENT form of {@link defuseExactMark} (adversarial round: a server can
+ * split the mark across adjacent MCP text blocks; the block seam is invisible in the model-facing
+ * concatenation, so a per-segment defuse would be a bypass). Judged over the JOINED projection and
+ * the ZWSP insertion mapped back into the owning segment, so the post-defuse concatenation NEVER
+ * contains the exact mark — including occurrences that straddle one or more seams (one ZWSP inside
+ * the occurrence's span breaks it wherever the split fell). Returns the same array (`changed:
+ * false`) when the joined projection has no occurrence; otherwise fresh segment strings whose
+ * concatenation equals the single-string form's output byte for byte (it IS the single-string
+ * form's implementation).
+ *
+ * OVERLAP-AWARE (adversarial round 2): a BORDERED mark (first character = last character — ~1/64
+ * random mints) admits overlapping occurrences (`mark + mark.slice(1)` carries two, one starting on
+ * the other's final character), so enumeration advances ONE character per match, never by the mark
+ * length — a skip-by-length walk defused the first and left the second exact while the trailer
+ * claimed neutralization. Every enumerated occurrence gets a ZWSP inside its own span; ZWSP is not
+ * a base64url character, so insertions can never synthesize a new occurrence and the result is
+ * idempotent (no exact mark survives ⇒ a second pass is byte-identical).
+ */
+export declare function defuseExactMarkInSegments(segments: readonly string[], mark: string): {
+    segments: string[];
+    changed: boolean;
+};
 /**
  * Neutralize structural break-out sequences in UNTRUSTED text so it can't escape its framing into
  * model-facing instructions. Always neutralizes `<system-reminder>` / `</system-reminder>` (the codebase's

package/dist/core/untrusted-text.js

@@ -12,6 +12,54 @@ function breakoutRe(extraTags) {
     }
     return re;
 }
+export function scanReminderShaped(text, mark) {
+    let hit = false;
+    let hadCurrentMark = false;
+    for (const m of text.matchAll(SYSTEM_REMINDER)) {
+        hit = true;
+        if (mark !== undefined && m[0].includes(mark)) {
+            hadCurrentMark = true;
+            break;
+        }
+        if (mark === undefined)
+            break;
+    }
+    return { hit, hadCurrentMark };
+}
+export function defuseExactMark(text, mark) {
+    return defuseExactMarkInSegments([text], mark).segments[0];
+}
+export function defuseExactMarkInSegments(segments, mark) {
+    const joined = segments.join("");
+    if (mark.length === 0 || !joined.includes(mark))
+        return { segments: [...segments], changed: false };
+    const positions = [];
+    for (let at = joined.indexOf(mark); at !== -1; at = joined.indexOf(mark, at + 1))
+        positions.push(at + 1);
+    const out = [];
+    let start = 0;
+    let pi = 0;
+    for (const seg of segments) {
+        const end = start + seg.length;
+        if (pi >= positions.length || positions[pi] > end) {
+            out.push(seg);
+        }
+        else {
+            const parts = [];
+            let prev = 0;
+            while (pi < positions.length && positions[pi] > start && positions[pi] <= end) {
+                const local = positions[pi] - start;
+                parts.push(seg.slice(prev, local), ZWSP);
+                prev = local;
+                pi++;
+            }
+            parts.push(seg.slice(prev));
+            out.push(parts.join(""));
+        }
+        start = end;
+    }
+    return { segments: out, changed: true };
+}
 export function sanitizeUntrustedText(text, extraTags = []) {
     return text.replace(breakoutRe(extraTags), (m) => m.replace("<", "<" + ZWSP));
 }

package/dist/core/wiring-manifest.d.ts

@@ -126,9 +126,18 @@ export interface WiringManifest {
     session: {
         store: ManifestDurability;
     };
+    /** `subagentTranscripts` — subagent transcript persistence: the deployment-level delegation-
+     *  transcript durability TIER, a pure declaration read ({@link resolveSubagentTranscriptTier}):
+     *  `none` = no agent-row store (pre-151 in-memory lifecycle); `rows` = rows + terminal snapshots
+     *  survive a restart, transcripts follow the session store's fate; `full` = the C18 promise —
+     *  a completed/failed/killed(non-user) subagent minted through the deps-visible assembly is
+     *  continuable across a process restart. A statement about the DEPS-VISIBLE assembly only: a
+     *  caller-mounted Agent tool over its own runner is outside this manifest's sight (per-read
+     *  honest degrade + the integrity notice own that case, never a fabricated tier). */
     fleet: {
         backgroundAgentStore: boolean;
         hostChildEventSink: boolean;
+        subagentTranscripts: SubagentTranscriptTier;
     };
     /** design/179 — the persisted allow-rule seam. The ONE loosening seam in the assembly, so its presence
      *  is a fact an operator has to be able to read off the manifest rather than infer. `false` on a
@@ -201,6 +210,11 @@ export interface WiringFacts {
     checkpointDurability?: StoreDurability;
     sessionDurability: StoreDurability;
     backgroundAgentStoreWired: boolean;
+    /** Subagent transcript persistence — the declared delegation-transcript tier (see
+     *  {@link WiringManifest.fleet}). Optional for external `deriveWiringManifest` callers: absent
+     *  derives fail-closed from `backgroundAgentStoreWired` alone (`rows`/`none` — under-promise,
+     *  never `full`); the engine's own halves always pass the resolved value. */
+    subagentTranscriptTier?: SubagentTranscriptTier;
     /** design/179 — a persisted allow-rule store provider is wired. */
     permissionRuleStoreWired: boolean;
     /** design/182 §9 — the deployment declared that it drives cloud sync for that store. */
@@ -227,6 +241,27 @@ export type StaticWiringSpec = Pick<TaskSpec, "onAsk" | "onQuestion" | "checkpoi
 export declare function resolveDeclaredDurability(store: {
     readonly durability?: StoreDurability;
 } | undefined, storeName: string): StoreDurability;
+/** Subagent transcript persistence — the deployment-level delegation-transcript durability tier
+ *  (see {@link WiringManifest.fleet}). */
+export type SubagentTranscriptTier = "none" | "rows" | "full";
+/**
+ * Subagent transcript persistence — the ONE deployment-level tier derivation (pure declaration
+ * read, no probing, no class-name sniffing — the wiring-manifest posture): `none` without an
+ * agent-row store; with one, `full` iff the session store DECLARES its subagent placement
+ * partition durable, else `rows`. A junk placement declaration is refused loudly
+ * (`config.store_durability_invalid` — the resolveDeclaredDurability rule: an unparseable
+ * declaration silently folded to either arm would make the manifest lie in whichever direction the
+ * fold picked). This is the DEPLOYMENT-level judgment only; the per-handle "did this row's
+ * transcript actually land" question belongs to `durableAgentRowProbe` (the S1b release-flip gate)
+ * — two different questions, deliberately two named faces (do not merge them back into one).
+ */
+export declare function resolveSubagentTranscriptTier(agentStoreWired: boolean, sessionStore: {
+    readonly placements?: {
+        subagent?: {
+            durability: StoreDurability;
+        };
+    };
+} | undefined): SubagentTranscriptTier;
 /**
  * The ONE `ask.effective` derivation (design/173 codex 5) — shared by the effective manifest AND
  * the posture door (`config.interaction_posture`), so "what does the door require" and "what does

package/dist/core/wiring-manifest.js

@@ -14,6 +14,21 @@ export function resolveDeclaredDurability(store, storeName) {
     throw e;
 }
 const manifestDurabilityOf = (d) => (d === "durable" ? "declared_durable" : "process_local");
+export function resolveSubagentTranscriptTier(agentStoreWired, sessionStore) {
+    if (!agentStoreWired)
+        return "none";
+    const declared = sessionStore?.placements?.subagent?.durability;
+    if (declared === undefined)
+        return "rows";
+    if (declared === "durable")
+        return "full";
+    if (declared === "process-local")
+        return "rows";
+    const e = new Error(`sessionStore.placements.subagent.durability declares ${JSON.stringify(declared)} — not a recognized ` +
+        `StoreDurability ("durable" | "process-local"). Fix the declaration; an unparseable durability cannot be folded to either arm.`);
+    e.code = "config.store_durability_invalid";
+    throw e;
+}
 export function deriveAskEffective(form, parkEffective) {
     switch (form) {
         case "callback":
@@ -85,7 +100,11 @@ export function deriveWiringManifest(facts) {
         elicit: { seamWired: facts.elicitSeamWired, serversOptedIn: facts.elicitServersOptedIn },
         parkLane,
         session: { store: manifestDurabilityOf(facts.sessionDurability) },
-        fleet: { backgroundAgentStore: facts.backgroundAgentStoreWired, hostChildEventSink: facts.hostChildEventSinkWired },
+        fleet: {
+            backgroundAgentStore: facts.backgroundAgentStoreWired,
+            hostChildEventSink: facts.hostChildEventSinkWired,
+            subagentTranscripts: facts.subagentTranscriptTier ?? (facts.backgroundAgentStoreWired ? "rows" : "none"),
+        },
         permissionRules: {
             storeWired: facts.permissionRuleStoreWired,
             syncWired: facts.permissionRuleSyncWired,
@@ -182,6 +201,7 @@ export function describeStaticWiring(deps, spec = {}) {
         ...(capable ? { checkpointDurability: resolveDeclaredDurability(checkpointStore, "checkpointStore") } : {}),
         sessionDurability: resolveDeclaredDurability(deps.sessionStore, "sessionStore"),
         backgroundAgentStoreWired: deps.backgroundAgentStore !== undefined,
+        subagentTranscriptTier: resolveSubagentTranscriptTier(deps.backgroundAgentStore !== undefined, deps.sessionStore),
         permissionRuleStoreWired: deps.permissionRuleStore !== undefined,
         permissionRuleSyncWired: deps.permissionRuleSyncWired === true,
         permissionRuleOrgGoverned: deps.permissionRuleOrg !== undefined,

package/dist/engine/harness/types.d.ts

@@ -157,7 +157,7 @@ export declare class CompactionError extends Error {
     code: CompactionErrorCode;
     constructor(code: CompactionErrorCode, message: string, cause?: Error);
 }
-export type SessionErrorCode = "not_found" | "invalid_session" | "invalid_entry" | "invalid_fork_target" | "storage" | "conflict" | "unknown";
+export type SessionErrorCode = "not_found" | "invalid_session" | "invalid_entry" | "invalid_fork_target" | "storage" | "conflict" | "placement_refused" | "unknown";
 /** Error thrown by session storage, repositories, and session tree operations. */
 export declare class SessionError extends Error {
     /** Session subsystem error code. */
@@ -170,6 +170,30 @@ export declare class AgentHarnessError extends Error {
     code: AgentHarnessErrorCode;
     constructor(code: AgentHarnessErrorCode, message: string, cause?: Error);
 }
+/**
+ * The PERSISTED placement tuple of a session created into a placement partition (subagent
+ * transcript persistence — the durable half of the delegation continuation contract). Written ONCE
+ * at creation (first-write immutable: a later acquire never rewrites it) and carried on
+ * {@link SessionMetadata.placement}. The FULL tuple is persisted, not just a tag: `scope`+`handle`
+ * are the row-store join key the retention orchestration needs after a restart (a bare label could
+ * not tell "no row" from "a row in another tenant"), and `placedAt` anchors the age-based GC arm.
+ * A tuple missing either join half is treated by consumers as INCOMPLETE (fail-closed: never
+ * age-reaped, reported as such by placed listings).
+ */
+export interface SessionPlacementRecord {
+    /** The one placement kind this contract defines today. */
+    kind: "subagent";
+    /** Tenant scope of the owning durable agent row (row-store join key half 1). */
+    scope?: string;
+    /** The spawning host session (partition/retrieval metadata — authorization stays on the row predicate). */
+    parentSessionId?: string;
+    /** The delegation tree's root host session (fixed point; enumeration anchor). */
+    rootSessionId?: string;
+    /** The durable agent row key (`a…` handle; row-store join key half 2). */
+    handle?: string;
+    /** Epoch ms the placement was created (stamped by the store at creation). */
+    placedAt: number;
+}
 /** Metadata for one filesystem object in a {@link FileSystem}. */
 export interface FileInfo {
     /** Basename of {@link path}. */
@@ -644,6 +668,10 @@ export interface SessionMetadata {
      *  fork lineage (e.g. reap forks whose parent is gone/expired). Absent on a non-forked session and on
      *  forked sessions persisted before this field shipped. */
     forkedFrom?: string;
+    /** Subagent transcript persistence — the placement tuple this session was CREATED into (see
+     *  {@link SessionPlacementRecord}). Absent on every ordinary (host-lane) session; a repo that does
+     *  not understand placement never surfaces it (additive, old readers tolerate). */
+    placement?: SessionPlacementRecord;
 }
 export interface JsonlSessionMetadata extends SessionMetadata {
     cwd: string;
@@ -796,6 +824,13 @@ export interface Session<TMetadata extends SessionMetadata = SessionMetadata> {
 }
 export interface SessionCreateOptions {
     id?: string;
+    /** Subagent transcript persistence — create this session INTO a placement partition. The repo
+     *  stamps `placedAt` and persists the tuple on its meta record (first-write immutable). A repo
+     *  that does not understand placement IGNORES this key (legal degrade — the session is then an
+     *  ordinary one; the store-level `placements` declaration is what promises understanding). */
+    placement?: Omit<SessionPlacementRecord, "placedAt"> & {
+        placedAt?: number;
+    };
 }
 export interface SessionForkOptions {
     entryId?: string;

package/dist/index.d.ts

@@ -64,7 +64,7 @@ export { GOVERNANCE_CODES, governanceRetryClass, type GovernanceCode, type Gover
 export { NOTICE_AUDIENCE, noticeAudienceOf } from "./core/governance-codes.js";
 export { TtlSessionStore, type TtlSessionStoreOptions, type EvictPolicy } from "./core/session-store.js";
 export { reconcileInterruptedSession, findOrphanToolCalls, type OrphanToolCall, type ReconcileReport, } from "./core/session-reconcile.js";
-export { StoredSession, InMemorySessionRepo, InMemorySessionStorage, BaseSessionStorage, leafIdAfterEntry, validateEntriesForImport, StreamingImportValidator, boundedTail, SessionError, isSessionConflict, hasSessionFork, uuidv7, type Session, type SessionStore, type AcquiredSession, type SessionStoreSummary, type SessionStorage, type SessionRepo, type SessionMetadata, type SessionTreeEntry, type SessionWriteOptions, } from "./core/session.js";
+export { StoredSession, InMemorySessionRepo, InMemorySessionStorage, BaseSessionStorage, leafIdAfterEntry, validateEntriesForImport, StreamingImportValidator, boundedTail, SessionError, isSessionConflict, hasSessionFork, uuidv7, type Session, type SessionStore, type AcquiredSession, type SessionStoreSummary, type SessionStorage, type SessionRepo, type SessionMetadata, type SessionTreeEntry, type SessionWriteOptions, type SessionPlacement, type SessionPlacementRecord, type PlacedSessionRow, } from "./core/session.js";
 export { warmResume } from "./core/warm-resume.js";
 export { StubExecutionEnv } from "./core/stub-env.js";
 export { NodeExecutionEnv, FileError, ExecutionError } from "./internal/harness.js";
@@ -111,7 +111,7 @@ export { createFsWriteGatePolicy, type FsWriteGatePolicyOptions } from "./core/f
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, } from "./core/task-notification.js";
-export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, type WiringManifest, type WiringFacts, type WiringLegKind, type AskSeamForm, type AskEffective, type QuestionChannelState, type SeamProvenance, type ParkLaneReason, type ManifestDurability, type StaticWiringDeps, type StaticWiringSpec, } from "./core/wiring-manifest.js";
+export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, type SubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, type WiringManifest, type WiringFacts, type WiringLegKind, type AskSeamForm, type AskEffective, type QuestionChannelState, type SeamProvenance, type ParkLaneReason, type ManifestDurability, type StaticWiringDeps, type StaticWiringSpec, } from "./core/wiring-manifest.js";
 export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, type ParkSelfCheckResult, type ParkProbeFinding, type ParkProbeFindingCode, } from "./core/park-selfcheck.js";
 export { type StoreDurability } from "./core/checkpoint-store.js";
 export { type StoreFidelity } from "./core/checkpoint-store.js";
@@ -234,10 +234,11 @@ export { summarizeRedactions } from "./core/untrusted-egress.js";
 export { MemoryRosterStore, FileRosterStore, type RosterStore, type RosterEntry, type RosterAccess, type RosterGcOptions } from "./agents/roster-store.js";
 export { CONFIG_CATALOG_VERSION, describeConfigCatalog, resolveEffectiveConfig, type ConfigKnob, type ConfigOverrideDeclaration, type ConfigProvenance, type EffectiveConfigField, } from "./config/catalog.js";
 export { normalizeAgentName } from "./core/task-registry.js";
+export { DELEGATION_MAX_CONCURRENT_DEFAULT, DELEGATION_MAX_PER_SESSION_DEFAULT, ORPHAN_ADOPT_WINDOW_MS_DEFAULT, ORPHAN_ADOPT_MAX_DEFAULT, SUBAGENT_TRANSCRIPT_RETENTION_DAYS_DEFAULT, } from "./config/defaults.js";
 export { COORDINATOR_ROLE_PROMPT, TEAMMATE_COMMUNICATION_ADDENDUM, TEAMMATE_TASK_LIST_ADDENDUM } from "./prompts/coordinator.js";
-export { createSubagentTool, FORK_SUBAGENT_TYPE, GENERAL_PURPOSE_SUBAGENT_TYPE, agentWhenToUseText, FORK_DIRECTIVE_FRAME, SUBAGENT_SYSTEM_NOTE, type SubagentToolOptions, type SubagentSpawnContext, type SubagentSteerHandle, type SubagentStep, type SubagentEditedFile, } from "./agents/subagent.js";
+export { createSubagentTool, FORK_SUBAGENT_TYPE, GENERAL_PURPOSE_SUBAGENT_TYPE, agentWhenToUseText, FORK_DIRECTIVE_FRAME, SUBAGENT_SYSTEM_NOTE, type SubagentToolOptions, resolveDelegationEntryCaps, type ResolvedDelegationEntryCaps, type SubagentSpawnContext, type SubagentSteerHandle, type SubagentStep, type SubagentEditedFile, } from "./agents/subagent.js";
 export { getSessionRetainLedger, releaseSessionRetainLedger, } from "./agents/retain-ledger.js";
-export { createSendMessageTool, SEND_MESSAGE_TOOL_NAME, type SendMessageToolOptions } from "./agents/send-message-tool.js";
+export { createSendMessageTool, createAgentContinuationVerb, SEND_MESSAGE_TOOL_NAME, type SendMessageToolOptions, type AgentContinuationReceipt } from "./agents/send-message-tool.js";
 export { createPeerAdmission, peerAdmissionFor, judgePeerAdmission, resolvePeerAdmissionConfig, PEER_ADMISSION_DEFAULTS, PEER_HOP_CHAIN_WINDOW, PEER_MESSAGE_NOTICE, createPeerSelfRef, createPeerInboundChainRef, peerAxisToken, appendHopToken, type PeerAdmission, type PeerAdmissionConfig, type PeerAdmissionOptions, type PeerAdmissionRequest, type PeerAdmissionVerdict, type PeerAdmissionRefusal, type PeerRefusalCode, type PeerAxisTag, type PeerIdentity, type PeerSelfRef, type PeerInboundChainRef, } from "./agents/peer-admission.js";
 export { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME, type AgentTranscriptToolOptions, } from "./agents/agent-transcript-tool.js";
 export { defineAgent } from "./agents/agent-definition.js";

package/dist/index.js

@@ -90,7 +90,7 @@ export { createFsWriteGatePolicy } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, SystemInjectionQueue, } from "./core/task-notification.js";
-export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, } from "./core/wiring-manifest.js";
+export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, } from "./core/wiring-manifest.js";
 export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, } from "./core/park-selfcheck.js";
 export {} from "./core/checkpoint-store.js";
 export {} from "./core/checkpoint-store.js";
@@ -193,10 +193,11 @@ export { summarizeRedactions } from "./core/untrusted-egress.js";
 export { MemoryRosterStore, FileRosterStore } from "./agents/roster-store.js";
 export { CONFIG_CATALOG_VERSION, describeConfigCatalog, resolveEffectiveConfig, } from "./config/catalog.js";
 export { normalizeAgentName } from "./core/task-registry.js";
+export { DELEGATION_MAX_CONCURRENT_DEFAULT, DELEGATION_MAX_PER_SESSION_DEFAULT, ORPHAN_ADOPT_WINDOW_MS_DEFAULT, ORPHAN_ADOPT_MAX_DEFAULT, SUBAGENT_TRANSCRIPT_RETENTION_DAYS_DEFAULT, } from "./config/defaults.js";
 export { COORDINATOR_ROLE_PROMPT, TEAMMATE_COMMUNICATION_ADDENDUM, TEAMMATE_TASK_LIST_ADDENDUM } from "./prompts/coordinator.js";
-export { createSubagentTool, FORK_SUBAGENT_TYPE, GENERAL_PURPOSE_SUBAGENT_TYPE, agentWhenToUseText, FORK_DIRECTIVE_FRAME, SUBAGENT_SYSTEM_NOTE, } from "./agents/subagent.js";
+export { createSubagentTool, FORK_SUBAGENT_TYPE, GENERAL_PURPOSE_SUBAGENT_TYPE, agentWhenToUseText, FORK_DIRECTIVE_FRAME, SUBAGENT_SYSTEM_NOTE, resolveDelegationEntryCaps, } from "./agents/subagent.js";
 export { getSessionRetainLedger, releaseSessionRetainLedger, } from "./agents/retain-ledger.js";
-export { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "./agents/send-message-tool.js";
+export { createSendMessageTool, createAgentContinuationVerb, SEND_MESSAGE_TOOL_NAME } from "./agents/send-message-tool.js";
 export { createPeerAdmission, peerAdmissionFor, judgePeerAdmission, resolvePeerAdmissionConfig, PEER_ADMISSION_DEFAULTS, PEER_HOP_CHAIN_WINDOW, PEER_MESSAGE_NOTICE, createPeerSelfRef, createPeerInboundChainRef, peerAxisToken, appendHopToken, } from "./agents/peer-admission.js";
 export { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME, } from "./agents/agent-transcript-tool.js";
 export { defineAgent } from "./agents/agent-definition.js";

package/dist/internal/harness-types.d.ts

@@ -14,3 +14,4 @@ export type { SessionWriteOptions, CompactionEntry } from "../engine/harness/typ
 export type { ActiveWorktreeSession, WorkspaceState } from "../engine/harness/types.js";
 export type { GitAnnouncementKind, GitAnnouncementState } from "../engine/harness/types.js";
 export type { SessionForkOptions } from "../engine/harness/types.js";
+export type { SessionPlacementRecord, SessionCreateOptions } from "../engine/harness/types.js";

package/dist/stores/file/index.d.ts

@@ -4,6 +4,9 @@ import type { ToolResultStore } from "../../core/tool-result-store.js";
 import { type EvictPolicy } from "../../core/session-store.js";
 import type { SessionStore } from "../../core/session.js";
 import { type FileCheckpointStoreOptions } from "./checkpoint-store.js";
+import type { BackgroundAgentStore } from "../../core/background-agent-store.js";
+import type { MailboxStore } from "../../core/mailbox-store.js";
+import type { RosterStore } from "../../agents/roster-store.js";
 import type { SessionPolicyStore } from "../../core/session-policy-store.js";
 import type { FileSnapshotStore } from "../../core/file-snapshot-store.js";
 import type { WorkflowJournalStore } from "../../core/workflow-journal-store.js";
@@ -76,9 +79,8 @@ export interface FileStorageBackendOptions {
      * Reach TODAY: {@link FileStorageBackend.sessionPolicyStore} (rules read as ABSENT ⇒ an unconstrained
      * task), {@link FileStorageBackend.sessionStore}'s repo (a session listing that silently omits what it
      * could not read) and {@link FileStorageBackend.fileSnapshotStore} (a snapshot/scope read as missing,
-     * and a blob GC that aborted). The roster and CC-mailbox stores also carry the seat, but a deployment
-     * builds those itself and passes the sink directly. A store that grows the seat later is wired here in
-     * the same constructor.
+     * and a blob GC that aborted). The aggregated roster and mailbox stores receive the same sink. A
+     * store that grows the seat later is wired here in the same constructor.
      *
      * The payload is the UNION shape ({@link FileStorageCorruptReadInfo}): `path` + `reason` always,
      * with the session-policy face's `sessionId`/`principal` present only when the reading store keys by
@@ -125,6 +127,18 @@ export declare class FileStorageBackend {
      *  `RunnerDeps.usageWindowStore` so a deployment's `usageWindows` survive a restart (an in-memory
      *  ledger silently re-grants every allowance on every boot). */
     readonly usageWindowStore: UsageWindowStore;
+    /** design/151 S1a / subagent transcript persistence — the durable background-agent execution
+     *  ledger over the same data root. Wire into BOTH `RunnerDeps.backgroundAgentStore` AND (for a
+     *  deployment-composed Agent tool) `SubagentToolOptions.background.agentStore` — SAME instance
+     *  (the RB-37 pairing discipline). Aggregated here so the TOC full-persistence assembly is one
+     *  constructor, the same reason the session/checkpoint/tool-result trio are. */
+    readonly backgroundAgentStore: BackgroundAgentStore;
+    /** design/151 §7 S3c — the durable SendMessage mailbox (tier-3 parking lane), same data root.
+     *  Wire into `RunnerDeps.mailboxStore` (single-instance pairing, same as above). */
+    readonly mailboxStore: MailboxStore;
+    /** design/147 S1c — the durable name→agent roster (layer 0.5 resolution), `root/roster.json`.
+     *  Wire into `RunnerDeps.rosterStore` so name-addressing survives a restart alongside the rows. */
+    readonly rosterStore: RosterStore;
     /**
      * design/84 Seam B (TOC) — the per-scope consolidation lock for `consolidateScope`'s `acquire` injection
      * point: `consolidateScope(scope, { store: backend.memoryStore, llm, acquire: backend.consolidationLock })`.
@@ -133,6 +147,8 @@ export declare class FileStorageBackend {
      */
     readonly consolidationLock: (scope: string) => (() => void) | undefined;
     private readonly lock;
+    private readonly fileAgentRows;
+    private readonly fileMailbox;
     private readonly fileCheckpoints;
     private readonly fileMemory;
     private readonly ttl;

package/dist/stores/file/index.js

@@ -11,6 +11,9 @@ import { FileSessionPolicyStore } from "./session-policy-store.js";
 import { FileFileSnapshotStore } from "./file-snapshot-store.js";
 import { FileWorkflowJournalStore } from "./workflow-journal-store.js";
 import { FileUsageWindowStore } from "./usage-window-store.js";
+import { FileBackgroundAgentStore } from "./background-agent-store.js";
+import { FileMailboxStore } from "./mailbox-store.js";
+import { FileRosterStore } from "../../agents/roster-store.js";
 export { FileCheckpointStore } from "./checkpoint-store.js";
 export { FileMemoryStore } from "./memory-store.js";
 export { FileSessionRepo } from "./session-store.js";
@@ -33,8 +36,13 @@ export class FileStorageBackend {
     fileSnapshotStore;
     workflowJournalStore;
     usageWindowStore;
+    backgroundAgentStore;
+    mailboxStore;
+    rosterStore;
     consolidationLock;
     lock;
+    fileAgentRows;
+    fileMailbox;
     fileCheckpoints;
     fileMemory;
     ttl;
@@ -49,7 +57,7 @@ export class FileStorageBackend {
             const corruptRead = opts.onCorruptRead !== undefined ? { onCorruptRead: opts.onCorruptRead } : undefined;
             const repo = new FileSessionRepo(this.root, corruptRead);
             this.fileSessions = repo;
-            this.ttl = new TtlSessionStore({ repo, evict: opts.evict ?? "forget", durability: "durable" });
+            this.ttl = new TtlSessionStore({ repo, evict: opts.evict ?? "forget", durability: "durable", placements: { subagent: { durability: "durable" } } });
             this.sessionStore = this.ttl;
             this.fileCheckpoints = new FileCheckpointStore(this.root, opts.checkpoint);
             this.checkpointStore = this.fileCheckpoints;
@@ -61,6 +69,11 @@ export class FileStorageBackend {
             this.fileWorkflowJournal = new FileWorkflowJournalStore(this.root);
             this.workflowJournalStore = this.fileWorkflowJournal;
             this.usageWindowStore = new FileUsageWindowStore(this.root);
+            this.fileAgentRows = new FileBackgroundAgentStore(this.root);
+            this.backgroundAgentStore = this.fileAgentRows;
+            this.fileMailbox = new FileMailboxStore(this.root, corruptRead ?? {});
+            this.mailboxStore = this.fileMailbox;
+            this.rosterStore = new FileRosterStore(join(this.root, "roster.json"), corruptRead ?? {});
             this.consolidationLock = createFileConsolidationLock(join(this.root, "consolidation-locks"));
         }
         catch (err) {
@@ -87,6 +100,16 @@ export class FileStorageBackend {
         }
         this.fileMemory.close();
         this.fileWorkflowJournal.dispose();
+        try {
+            this.fileAgentRows.close();
+        }
+        catch {
+        }
+        try {
+            this.fileMailbox.close();
+        }
+        catch {
+        }
         this.lock.release();
     }
 }

package/dist/stores/file/session-store.d.ts

@@ -1,4 +1,5 @@
-import type { Session, SessionForkOptions, SessionMetadata, SessionRepo, SessionTreeEntry } from "../../internal/harness.js";
+import type { Session, SessionCreateOptions, SessionForkOptions, SessionMetadata, SessionPlacementRecord, SessionRepo, SessionTreeEntry } from "../../internal/harness.js";
+import type { PlacedSessionRow } from "../../core/session.js";
 export interface FileSessionRepoOptions {
     /**
      * Disclosure sink for a durable read this repo treats as ABSENT (ruled 2026-08-03). Same name and
@@ -47,11 +48,24 @@ export declare class FileSessionRepo implements SessionRepo {
      * means a stale holder can never revoke the rebuilt entry.
      */
     dispose(): Promise<void>;
-    create(options?: {
-        id?: string;
-    }): Promise<Session>;
+    create(options?: SessionCreateOptions): Promise<Session>;
     open(metadata: SessionMetadata): Promise<Session>;
     list(): Promise<SessionMetadata[]>;
+    /**
+     * Subagent transcript persistence — the PLACED partition's own enumeration (the joint reap's
+     * partition-leg input; `TtlSessionStore` re-exposes it verbatim). Age (`olderThanMs`) is judged on
+     * the session FILE's mtime — the transcript's last append — falling back to `placedAt` when the
+     * stat fails (mtime is also the CC orphan-adoption window's basis, so the two age reads agree).
+     * Rows missing either `(scope, handle)` join half return the honest `tupleIncomplete` variant
+     * (consumers fail closed on it — never age-reaped, see the SessionStore contract).
+     */
+    listPlaced(kind: "subagent", opts?: {
+        olderThanMs?: number;
+        scope?: string;
+    }): Promise<PlacedSessionRow[]>;
+    /** Cheap placement probe for one id (the TtlSessionStore's cold-cache release consults it so the
+     *  placed real-deletion obligation holds after a restart). `undefined` = missing file OR unplaced. */
+    placementOf(sessionId: string): Promise<SessionPlacementRecord | undefined>;
     delete(metadata: SessionMetadata): Promise<void>;
     fork(sourceMetadata: SessionMetadata, options?: SessionForkOptions): Promise<Session>;
     /** 2c session-sync ([275], the FILE half of [266]②): the FULL oldest-first log for export. The file backend