@sema-agent/core 5.54.0 → 5.55.0

package/dist/core/runner/turn-attachments.js

@@ -1,5 +1,5 @@
 import { PRESENT_PLAN_TOOL_NAME } from "../present-plan-tool.js";
-import { defuseFenceMarkers, delimitUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
+import { delimitUntrustedWithClip, sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
 import { protocolOf } from "../protocol-table.js";
 import { buildSkillsBlock, skillListingLine } from "./synthetic-tools.js";
 import { TOOL_SEARCH_NAME as TOOL_SEARCH_TOOL_NAME } from "./tool-disclosure.js";
@@ -20,6 +20,11 @@ export const CHANGED_FILES_MTIME_EPS_MS = 2000;
 export const ATTACHMENT_BYTE_CAP = 8 * 1024;
 const PROJECTION_ITEMS_MAX = 50;
 const PROJECTION_CONTENT_MAX = 80;
+const ATTACHMENT_TAGS_DEFAULT = [...SHELLED_BODY_ENVELOPE_TAGS];
+const ATTACHMENT_TAGS_SKILLS_OWNER = SHELLED_BODY_ENVELOPE_TAGS.filter((t) => t !== "skills");
+export function attachmentEnvelopeTags(source) {
+    return source === "skills_listing" ? ATTACHMENT_TAGS_SKILLS_OWNER : ATTACHMENT_TAGS_DEFAULT;
+}
 export const INSTRUCTIONS_CHANGE_BYTE_CAP = 512;
 export function createAttachmentState() {
     return {
@@ -358,8 +363,9 @@ export function renderBudgetUsd(used, total) {
     return `USD budget: $${used}/$${total}; $${total - used} remaining`;
 }
 export function renderOrphanedBackgroundTasks(tasks) {
+    const safe = (t) => sanitizeUntrustedText(t, SHELLED_BODY_ENVELOPE_TAGS);
     return (`The container was restarted. The following background tasks were running and are now stopped:\n` +
-        tasks.map((t) => `- ${t.description || "(no description)"} (task ${t.id})`).join("\n") +
+        tasks.map((t) => `- ${safe(t.description || "(no description)")} (task ${safe(t.id)})`).join("\n") +
         `\nRe-create them if still needed.`);
 }
 function renderChangedFiles(paths) {
@@ -449,7 +455,7 @@ export const AGENT_TOOLS_NOTE_DEFAULT = "All tools";
 export const AGENT_CONCURRENCY_NOTE = "When you launch multiple agents for independent work, send them in a single message with multiple tool uses so they run concurrently.";
 export const AMBIENT_CONTEXT_NOTE = "This is ambient context — do not narrate it to the user unless they ask or it is directly relevant to their request.";
 export function agentListingInitialHeader(toolName) {
-    return `Available agent types for the ${toolName} tool:`;
+    return `Available agent types for the ${sanitizeUntrustedText(toolName, SHELLED_BODY_ENVELOPE_TAGS)} tool:`;
 }
 export function replayAnnouncedListing(texts, headers) {
     let announced;
@@ -492,13 +498,17 @@ export function replayAnnouncedListing(texts, headers) {
     return announced;
 }
 export const AGENT_LISTING_REMOVED_HEADER = "The following agent types are no longer available:";
+function listingIdentity(name) {
+    return sanitizeUntrustedText(name, SHELLED_BODY_ENVELOPE_TAGS);
+}
 export function agentListingDeltaHeader(toolName) {
-    return `New agent types are now available for the ${toolName} tool:`;
+    return `New agent types are now available for the ${sanitizeUntrustedText(toolName, SHELLED_BODY_ENVELOPE_TAGS)} tool:`;
 }
 export function renderAgentListingDelta(state, entries, toolName, models) {
+    const safe = (t) => sanitizeUntrustedText(t, SHELLED_BODY_ENVELOPE_TAGS);
     const line = (e) => {
-        const base = e.description ? `- ${e.name}: ${e.description}` : `- ${e.name}`;
-        return `${base} (Tools: ${e.tools ?? AGENT_TOOLS_NOTE_DEFAULT})`;
+        const base = e.description ? `- ${safe(e.name)}: ${safe(e.description)}` : `- ${safe(e.name)}`;
+        return `${base} (Tools: ${safe(e.tools ?? AGENT_TOOLS_NOTE_DEFAULT)})`;
     };
     const announced = state.announcedAgentTypes;
     if (announced === undefined) {
@@ -511,18 +521,22 @@ export function renderAgentListingDelta(state, entries, toolName, models) {
             blocks.push(modelsAvailableLine(models));
         return blocks.join("\n\n");
     }
-    const added = entries.filter((e) => !announced.has(e.name)).toSorted((a, b) => a.name.localeCompare(b.name));
-    const removed = [...announced.keys()].filter((n) => !entries.some((e) => e.name === n)).sort();
+    const announcedIds = new Set([...announced.keys()].map(listingIdentity));
+    const added = entries.filter((e) => !announcedIds.has(listingIdentity(e.name))).toSorted((a, b) => a.name.localeCompare(b.name));
+    const removed = [...announced.keys()]
+        .filter((n) => !entries.some((e) => listingIdentity(e.name) === listingIdentity(n)))
+        .sort();
     const modelsDrifted = state.announcedModels !== undefined &&
         models !== undefined &&
-        (state.announcedModels.length !== models.length || state.announcedModels.some((m, i) => m !== models[i]));
+        (state.announcedModels.length !== models.length ||
+            state.announcedModels.some((m, i) => listingIdentity(m) !== listingIdentity(models[i])));
     if (added.length === 0 && removed.length === 0 && !modelsDrifted)
         return undefined;
     const blocks = [];
     if (added.length > 0)
         blocks.push(`${agentListingDeltaHeader(toolName)}\n${added.map(line).join("\n")}`);
     if (removed.length > 0) {
-        blocks.push(`${AGENT_LISTING_REMOVED_HEADER}\n${removed.map((n) => `- ${n}`).join("\n")}`);
+        blocks.push(`${AGENT_LISTING_REMOVED_HEADER}\n${removed.map((n) => `- ${safe(n)}`).join("\n")}`);
         blocks.push(AMBIENT_CONTEXT_NOTE);
     }
     if (modelsDrifted)
@@ -531,7 +545,8 @@ export function renderAgentListingDelta(state, entries, toolName, models) {
 }
 export const MODELS_AVAILABLE_PREFIX = "Models available for the 'model' parameter: ";
 function modelsAvailableLine(models) {
-    return `${MODELS_AVAILABLE_PREFIX}${models.length > 0 ? models.join(", ") : "(none)"}`;
+    const named = models.map((m) => sanitizeUntrustedText(m, SHELLED_BODY_ENVELOPE_TAGS));
+    return `${MODELS_AVAILABLE_PREFIX}${named.length > 0 ? named.join(", ") : "(none)"}`;
 }
 export function replayAnnouncedModels(texts) {
     let last;
@@ -563,15 +578,16 @@ export function renderSkillsListingDelta(state, entries) {
             return undefined;
         return buildSkillsBlock(entries);
     }
-    const added = entries.filter((e) => !announced.has(e.name));
-    const removed = [...announced.keys()].filter((n) => !entries.some((e) => e.name === n));
+    const announcedIds = new Set([...announced.keys()].map(listingIdentity));
+    const added = entries.filter((e) => !announcedIds.has(listingIdentity(e.name)));
+    const removed = [...announced.keys()].filter((n) => !entries.some((e) => listingIdentity(e.name) === listingIdentity(n)));
     if (added.length === 0 && removed.length === 0)
         return undefined;
     const blocks = [];
     if (added.length > 0)
         blocks.push(`${SKILLS_LISTING_DELTA_HEADER}\n${added.map((e) => skillListingLine(e)).join("\n")}`);
     if (removed.length > 0) {
-        blocks.push(`${SKILLS_LISTING_REMOVED_HEADER}\n${removed.map((n) => `- ${n}`).join("\n")}`);
+        blocks.push(`${SKILLS_LISTING_REMOVED_HEADER}\n${removed.map((n) => `- ${sanitizeUntrustedText(n, SHELLED_BODY_ENVELOPE_TAGS)}`).join("\n")}`);
         blocks.push(AMBIENT_CONTEXT_NOTE);
     }
     return blocks.join("\n\n");
@@ -581,12 +597,10 @@ export function commitSkillsListing(state, entries) {
 }
 export const MCP_INSTRUCTIONS_MAX_CHARS = 8 * 1024;
 export function fenceMcpServerInstructions(server, text) {
-    const neutralized = defuseFenceMarkers(sanitizeUntrustedText(text));
-    const clipped = [...neutralized].length > MCP_INSTRUCTIONS_MAX_CHARS;
-    const fenced = delimitUntrusted(`MCP server "${server}" instructions`, neutralized, MCP_INSTRUCTIONS_MAX_CHARS);
-    return clipped
-        ? `${fenced}\n(Truncated by the agent runtime: this server's instructions exceeded ${MCP_INSTRUCTIONS_MAX_CHARS} characters.)`
-        : fenced;
+    const fence = delimitUntrustedWithClip(`MCP server "${server}" instructions`, text, MCP_INSTRUCTIONS_MAX_CHARS);
+    return fence.clipped
+        ? `${fence.text}\n(Truncated by the agent runtime: this server's instructions exceeded ${MCP_INSTRUCTIONS_MAX_CHARS} characters.)`
+        : fence.text;
 }
 export function renderMcpInstructionsDelta(added, removed) {
     const blocks = [];

package/dist/core/tool-policy.d.ts

@@ -383,6 +383,24 @@ export interface ToolPolicyProjection {
      */
     readonly requiresLiveRemainder: boolean;
 }
+/**
+ * The entries of a tool-NAME list whose reach is a set of names rather than one name — the MCP
+ * covering spellings (`mcp__<server>`, `mcp__<server>__<glob>`) that CC's rule matcher resolves and
+ * an exact-membership test silently cannot. Every name-keyed lane in this file consults these
+ * ALONGSIDE its exact set: a covering spelling can never equal a minted tool name (`*` is outside the
+ * minted charset and a minted name always carries a tool segment), so leaving it in the exact set too
+ * costs nothing and keeps the projection/audit faces reporting the operator's own spelling.
+ *
+ * The list is usually empty, which is why every call site tests it before scanning.
+ *
+ * Exported for the OTHER name-keyed lane in this engine — the persisted session/ancestor rules in
+ * `session-rule-policy.ts`. Not part of the public API (`src/index.ts` re-exports by name and does not
+ * list these): all four publishers of {@link ToolPolicyNameSets} must resolve a covering entry the same
+ * way, because the prepare-time audit's exemption for these spellings speaks for all of them at once.
+ */
+export declare function mcpCoveringEntries(entries: readonly string[] | undefined): readonly string[];
+/** Does any covering entry reach `toolName`? See {@link mcpCoveringEntries}. */
+export declare function mcpCoveringHit(covering: readonly string[], toolName: string): boolean;
 /**
  * Execute a persisted {@link ToolPolicyProjection} against a call (F-012 L1): returns the first
  * component's deny, or `undefined` when the projection has no opinion (it is deny-only by

package/dist/core/tool-policy.js

@@ -5,7 +5,7 @@ import { join, normalize as normalizePath, posix as posixPath, sep, win32 as win
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
 import { boundInputHashOf } from "./canonical-json.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY } from "./untrusted-text.js";
-import { parsePermissionRule } from "./permission-rules.js";
+import { isMcpCoveringRuleName, mcpRuleNameCovers, parsePermissionRule } from "./permission-rules.js";
 import { isAbsolutePathForm, isWinFormPath, writeTargetPath } from "../tools/fs/safety.js";
 const DECISION_REASONS = ["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable"];
 const DECISION_REASON_SET = new Set(DECISION_REASONS);
@@ -36,16 +36,22 @@ export const ASK_EVIDENCE_ABSENCE_VALUES = ["not_wired", "not_adjudicated", "una
 export function decisionText(d) {
     return d.message;
 }
+export function mcpCoveringEntries(entries) {
+    return (entries ?? []).filter(isMcpCoveringRuleName);
+}
+export function mcpCoveringHit(covering, toolName) {
+    return covering.length > 0 && covering.some((e) => mcpRuleNameCovers(e, toolName));
+}
 export function checkToolPolicyProjection(projection, req) {
     for (const c of projection.components) {
         if (c.kind === "tool_deny") {
-            if (c.names.includes(req.toolName)) {
+            if (c.names.includes(req.toolName) || mcpCoveringHit(mcpCoveringEntries(c.names), req.toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is denied by a frozen inherited policy projection` };
             }
             continue;
         }
         if (c.kind === "tool_allowlist") {
-            if (!c.names.includes(req.toolName)) {
+            if (!c.names.includes(req.toolName) && !mcpCoveringHit(mcpCoveringEntries(c.names), req.toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is not in a frozen inherited policy projection's allowlist` };
             }
             continue;
@@ -218,6 +224,8 @@ export function createAllowDenyPolicy(opts) {
     opts = { ...opts, ...(screenedAllow ? { allow: screenedAllow } : {}), ...(screenedDeny ? { deny: screenedDeny } : {}) };
     const allow = opts.allow ? new Set(opts.allow) : undefined;
     const deny = new Set(opts.deny ?? []);
+    const denyCovering = mcpCoveringEntries(opts.deny);
+    const allowCovering = mcpCoveringEntries(opts.allow);
     return {
         projection: {
             components: [
@@ -229,10 +237,10 @@ export function createAllowDenyPolicy(opts) {
         nameSets: [{ ...(opts.allow ? { allow: [...opts.allow] } : {}), ...(opts.deny ? { deny: [...opts.deny] } : {}) }],
         check(req) {
             const toolName = req.toolName;
-            if (deny.has(toolName)) {
+            if (deny.has(toolName) || mcpCoveringHit(denyCovering, toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             }
-            if (allow && !allow.has(toolName)) {
+            if (allow && !allow.has(toolName) && !mcpCoveringHit(allowCovering, toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is not in the allowlist` };
             }
             return ALLOW;
@@ -249,6 +257,9 @@ export function createApprovalPolicy(opts) {
     const need = new Set(opts.requireApproval);
     const deny = new Set(opts.deny ?? []);
     const auto = new Set(opts.autoAllow ?? []);
+    const needCovering = mcpCoveringEntries(opts.requireApproval);
+    const denyCovering = mcpCoveringEntries(opts.deny);
+    const autoCovering = mcpCoveringEntries(opts.autoAllow);
     return {
         projection: {
             components: [
@@ -266,10 +277,10 @@ export function createApprovalPolicy(opts) {
         ],
         async check(req, signal) {
             const toolName = req.toolName;
-            if (deny.has(toolName)) {
+            if (deny.has(toolName) || mcpCoveringHit(denyCovering, toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             }
-            if (need.has(toolName)) {
+            if (need.has(toolName) || mcpCoveringHit(needCovering, toolName)) {
                 if (signal?.aborted) {
                     return withCoreMintedResolution({ action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, settledBy: "aborted" }, "task_aborted", req);
                 }
@@ -303,7 +314,7 @@ export function createApprovalPolicy(opts) {
                 }
                 return withCoreMintedResolution({ action: "deny", message: `approval denied for "${req.toolName}"`, settledBy: "human" }, "human_refused", req);
             }
-            if (opts.denyByDefault && !auto.has(toolName)) {
+            if (opts.denyByDefault && !auto.has(toolName) && !mcpCoveringHit(autoCovering, toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" requires explicit allow` };
             }
             return ALLOW;

package/dist/core/types.d.ts

@@ -3342,12 +3342,27 @@ export interface TaskResult {
             }>;
             /** design/319 (B ticket, G9② observation seat) — reminder-disclosure trigger counts for the
              *  leg, keyed `<outlet>.<form>`: outlets `read` / `notebook` / `pdf` / `mcp` / `webFetch` /
-             *  `webSearch`; forms `bare` (bare-form trailer appended), `marked` (marked-form trailer —
-             *  never throttled), `bare_throttled` (a bare trailer suppressed by the 60s per-key window),
-             *  `defused` (an MCP/web segment's exact-mark bytes were rewritten — the lane's one sanctioned
-             *  byte change, always paired with a `marked` disclosure). Present only when ≥1 key is
-             *  non-zero. This is the D-4/D-6 re-ruling data (defuse/trailer widening to Read/Bash/Grep):
-             *  a reading, never a gate. */
+             *  `webSearch`; forms
+             *  · `bare` (bare-form trailer appended — reminder-shaped text without this session's mark),
+             *  · `marked` (marked-form trailer — never throttled),
+             *  · `bare_throttled` (a bare trailer suppressed by the 60s per-key window),
+             *  · `defused` (an MCP/web segment's exact-mark bytes were rewritten — the lane's one sanctioned
+             *    byte change, always paired with a `marked` disclosure),
+             *  · `envelope` (text shaped like one of the engine's OTHER authority envelopes — the DISCLOSED
+             *    subset is `task-notification` / `new-diagnostics` / `user_memory` / `skills`; `scope` is
+             *    fenced but not disclosed, since `<scope>…</scope>` is also an ordinary build-file element.
+             *    That family carries no mark, so its sentence is positional rather than byte-testable. It
+             *    rides ON the reminder copy when both families hit, so `envelope` can be bumped alongside
+             *    `marked`/`bare` on one result),
+             *  · `envelope_throttled` (an envelope sentence suppressed by its OWN 60s window — the two
+             *    families throttle independently, so one may emit while the other reports suppression),
+             *  · `mark_echo` (observation ONLY, never a disclosure: the session's mark VALUE appeared in
+             *    external bytes with no reminder-shaped tag around it, so the tag-grammar detector cannot
+             *    reach it. Nothing is rewritten and no trailer is appended; it is an upper bound on model
+             *    exposure for the lanes that do not defuse).
+             *  Present only when ≥1 key is non-zero. The map is OPEN by type — fold by key rather than
+             *  switching on a closed set. This is the D-4/D-6 re-ruling data (defuse/trailer widening to
+             *  Read/Bash/Grep): a reading, never a gate. */
             reminderDisclosures?: Record<string, number>;
         };
         /**
@@ -3667,6 +3682,36 @@ export type TaskEvent = ({
      * carry no string discriminator under either name.
      */
     errorCode?: string;
+    /**
+     * WHICH call the gate was holding, when this frame is a park-contamination frame — the tool call
+     * id of the gated call. Three conditions, ALL required: `errorCode === "gate.parked"`, the run is
+     * tearing down behind a committed park, and that park binds a tool call at all.
+     *
+     * **WHERE IT COMES FROM — never lifted from the result**, and deliberately unlike its neighbour
+     * {@link errorCode}: that one IS the result's own `details.code`, i.e. tool-authored, because a
+     * tool classifying its own failure is bounded self-description. This field is an assertion about a
+     * DIFFERENT call, so a tool able to author it could point an approval UI at a call nobody is
+     * holding. It is therefore engine-minted — read from the run's committed park holder and handed to
+     * the frame projection as a parameter, the same posture (and the same reason) as {@link settledBy}.
+     * `errorCode` only participates in selecting WHETHER the id is placed; it never supplies the
+     * value, and on its own it is not enough — the run must also be aborting behind a real park, which
+     * is why a tool declaring `gate.parked` on its own failure cannot conjure this field.
+     *
+     * Why it is on the frame: a durable gate parks ONE call and the loop then short-circuits every
+     * sibling in the batch with an identical "Operation aborted" body, so `gate.parked` alone says
+     * "something parked this batch" without saying WHAT. A consumer wanting to render "waiting on
+     * <the gated call>" beside the collateral frames otherwise has to re-derive the pair from batch
+     * adjacency and timing — an inference that is wrong exactly when it matters (a batch with more
+     * than one ask candidate, a reordered stream).
+     *
+     * ONLY EVER STRUCTURALLY PROVEN, never guessed: the id is read off the committed checkpoint's
+     * pending tool call, so it is the same value the checkpoint parks on and the same value the
+     * decide/resume lane answers about. It is therefore ABSENT — not approximated — for the park
+     * kinds that hold no call (a resource-limit slice, a plan review), and absent for every abort
+     * that is not a gate park at all (user interrupt, timeout, walltime): those frames are
+     * byte-unchanged. Absence means "core cannot prove a causal call", never "there wasn't one".
+     */
+    gatedCallId?: string;
     /**
      * WHAT ENDED THE APPROVAL this call was waiting on, when this frame closes a gated call — `"human"`
      * / `"timeout"` / `"aborted"`, the vocabulary of
@@ -4889,6 +4934,27 @@ export interface EngineNotice {
      *    tier is NOT auto-downgraded (declaration-制 — observation reports, it never re-adjudicates);
      *    `detail: { handle }`.
      *
+     *  - `"memory.consolidation_recommended"` (design/339 §2.2/§6.2) — the engine-minted per-scope
+     *    session count crossed the consolidation thresholds (time gate open ∧ enough distinct
+     *    sessions); minted at most once per crossing (a completed run re-arms the edge), NEVER when
+     *    the deployment leaves consolidation off. ADVISORY: the host owns the verbs, nothing runs
+     *    automatically; `detail: { scope, sessionsSince, sessionId? }`.
+     *  - `"memory.consolidation_committed"` (design/339 §6.2) — a consolidation plan reached
+     *    `completed`: products landed, superseded targets left the default read face (retained as
+     *    evidence), intents settled; `detail: { planId, scope, products, superseded, intents }` —
+     *    counts and engine-minted ids only, zero content.
+     *  - `"memory.consolidation_conflict"` (design/339 §6.2) — a plan parked CONFLICT: at least one
+     *    target did not reach its planned state (a concurrent write, a patch the store declined, or a
+     *    target the re-judgment could no longer act on — the plan's audit rows carry the per-target
+     *    reason). The REFUSED targets were not overwritten; patches the plan had already applied
+     *    stand (discard rolls nothing back — the receipt's applied-vs-conflict counts say how many).
+     *    Affected intents stay pending and wait for the host valve
+     *    (`resolveConsolidationPlan` retry/discard); `detail: { planId, scope }`.
+     *  - `"memory.consolidation_refused"` (design/339 §6.2) — the notice dialect of a consolidation
+     *    verb's coded structured refusal (the verb itself throws
+     *    {@link import("../core/memory-engine/consolidation.js").ConsolidationRefusedError});
+     *    `detail: { refusalCode, scope? }`.
+     *
      *  Deliberately NOT a notice family: brain retry/reconnect liveness (a rate limit, a 5xx, a
      *  transient network failure being retried). Those are per-attempt liveness frames with their own
      *  frequency semantics and ride the wire `status` channel ({@link BrainStatus}), whose sink the
@@ -5110,6 +5176,23 @@ export interface RunnerDeps {
      * never truthiness).
      */
     memoryProvenance?: "off" | "carry";
+    /**
+     * design/339 §6.1 — the v3 memory-consolidation switch, threaded verbatim to the engine seat
+     * ({@link import("../core/memory-engine/engine.js").MemoryEngineOptions.consolidation} — same
+     * transport as {@link memoryProvenance}). ABSENT = OFF (the shipped default): no gate state is
+     * ever written, no recommendation is ever minted, and the consolidation verbs on an engine the
+     * host constructs over the same store refuse coded. PRESENT = enabled: the engine counts
+     * distinct terminal-harvest sessions per scope and surfaces the advisory
+     * `memory.consolidation_recommended` notice when the configured thresholds cross — EXECUTION
+     * stays host-owned (the four verbs are engine host API; nothing in a task can trigger a run).
+     * `provenance: "off"` beside this refuses loudly at prepare
+     * (`config.memory_consolidation_provenance_off` — the fold law must be able to mint);
+     * `multiNode: true` without a lease refuses (`config.memory_consolidation_lease_required`);
+     * every other bad value refuses under `config.memory_consolidation` (#123). DEPLOYMENT seat
+     * ONLY (no TaskSpec twin, not in the governed workflow whitelist), same law as
+     * {@link memoryProvenance}.
+     */
+    memoryConsolidation?: import("../core/memory-engine/consolidation.js").MemoryConsolidationOptions;
     /**
      * design/199 件A — the DEPLOYMENT's read-face declaration
      * ({@link import("../tools/fs/read-face.js").ReadFace}; see {@link TaskSpec.readFace} for the

package/dist/core/untrusted-egress.js

@@ -1,4 +1,4 @@
-import { delimitUntrusted } from "./untrusted-text.js";
+import { delimitUntrusted, neutralizeForFence } from "./untrusted-text.js";
 import { scrubSecrets, SECRET_PASSES, runRedactionPasses } from "./arg-summary.js";
 import { sliceHeadSafe } from "./surrogate-safe-slice.js";
 export { summarizeRedactions } from "./arg-summary.js";
@@ -98,5 +98,15 @@ export function boundedRedactedSummary(value, max) {
     return boundedString(value, max, redactSecrets);
 }
 export function untrustedEgressForHuman(value, opts) {
-    return delimitUntrusted(opts.label, boundedString(value, opts.max, redactHostLeaks), opts.max);
+    const source = boundedString(value, Number.POSITIVE_INFINITY, redactHostLeaks);
+    let budget = opts.max;
+    let bounded = boundedString(source, budget, (s) => s);
+    for (let i = 0; i < 4 && budget > 0; i++) {
+        const overflow = [...neutralizeForFence(bounded)].length - opts.max;
+        if (overflow <= 0)
+            break;
+        budget = Math.max(0, budget - overflow);
+        bounded = boundedString(source, budget, (s) => s);
+    }
+    return delimitUntrusted(opts.label, bounded, opts.max);
 }

package/dist/core/untrusted-text.d.ts

@@ -16,6 +16,144 @@
  * own (instructions and data share one channel). The real boundary is decorrelation + reading the objective
  * artifact (the diff / working tree) rather than the worker's self-report (design/53 §3, design/54 §3).
  */
+/**
+ * One row of {@link ENGINE_ENVELOPES}.
+ *
+ * WHY A TABLE EXISTS. design/319 spent its whole threat model on a single tag and three independent
+ * texts stated the supporting premise as "this harness mints no other tag" — a MODULE-level
+ * enumeration (`turn-attachments` really does mint only one) promoted to a HARNESS-level claim. The
+ * engine in fact authors several model-facing envelopes, guarded by two different escape families
+ * living in two different modules, and the two envelopes added most recently (`skills`, `scope`)
+ * reached the model with NO guard at all — not because anyone argued they were safe, but because
+ * nothing in the tree listed the set an author was joining. A guard family without a census is a
+ * guard family that silently loses members; this table is that census, and the accompanying
+ * literal-tag test keeps it honest (a new closing-tag literal in `src/` fails until it is classified
+ * here).
+ *
+ * The same discipline as the `ToolSpec` completeness table: the registry is the declaration, the
+ * test is the gate, and a NEW envelope is a two-line edit rather than an invisible omission.
+ */
+export interface EngineEnvelope {
+    /** The tag NAME as the engine spells it, without angle brackets. */
+    readonly tag: string;
+    /**
+     * - `authority` — the engine authors it as model-facing HARNESS speech; seeing the tag is what
+     *   makes the model read the content as system information, so a forgery is an authority claim.
+     * - `framing` — the engine wraps UNTRUSTED content in it as a labeled data frame; a forgery
+     *   escapes the frame (or closes it early) rather than claiming harness authority.
+     * - `not-an-envelope` — a tag-shaped literal in `src/` that is not an engine-minted model-facing
+     *   envelope at all (a MODEL-output grammar the engine parses, a prompt-assembly placeholder,
+     *   rendering metadata, or copy that merely TALKS about an envelope). Listed so the census test
+     *   has a home for every literal in the tree and no reader has to re-derive the classification.
+     */
+    readonly kind: "authority" | "framing" | "not-an-envelope";
+    /** Where the engine authors (or, for `not-an-envelope`, spells) it. */
+    readonly mint: string;
+    /** How untrusted bytes reaching this envelope's own body/attributes are defused at that site. */
+    readonly guard: string;
+    /**
+     * True ⇒ neutralized inside every FENCED/inline untrusted projection ({@link delimitUntrusted},
+     * {@link inlineUntrusted}). Those lanes already rewrite bytes by contract, so a forged authority
+     * envelope arriving through them is defused rather than merely fenced.
+     */
+    readonly fenced: boolean;
+    /**
+     * True ⇒ DISCLOSED (never rewritten) when it appears in VERBATIM external data — the design/319
+     * trailer pipeline (reminder-disclosure.ts). Verbatim lanes are byte-frozen by the G3 veto (the
+     * Read↔Edit `old_string` quote-back loop), so the only available judgment bit is an appended,
+     * engine-minted note. Deliberately NOT set for tags whose spelling is common in ordinary data
+     * (`scope` is a Maven POM element; `summary` is HTML) — a trailer that fires on every build file
+     * teaches the model to ignore trailers.
+     */
+    readonly disclosed: boolean;
+}
+/**
+ * The census. Rows are grouped by {@link EngineEnvelope.kind}; within a group, by module.
+ *
+ * KNOWN CEILING (stated, not hidden): the accompanying test enumerates CLOSING-TAG LITERALS in
+ * `src/`, so an envelope whose tag name is INTERPOLATED (`<${tag}>`) is invisible to it. Those are
+ * enumerated here by hand — `teammate-message`, the observer digest's four event tags, and the
+ * dynamic `<{slug}-activity>` wrapper — and each already carries its own escape at its mint site.
+ */
+export declare const ENGINE_ENVELOPES: readonly EngineEnvelope[];
+/** The registry row for a tag name, or `undefined` when the tag is not in the census. */
+export declare function engineEnvelope(tag: string): EngineEnvelope | undefined;
+/** Registry-derived: the envelopes that read as HARNESS AUTHORITY on sight. */
+export declare const ENGINE_AUTHORITY_ENVELOPE_TAGS: readonly string[];
+/**
+ * Registry-derived: the tags {@link delimitUntrusted} / {@link inlineUntrusted} neutralize on top of
+ * the always-on reminder tag. These lanes carry EXTERNAL/worker bytes into a labeled data frame and
+ * already rewrite them by contract, so an authority envelope forged inside them is defused rather
+ * than merely fenced — the "forgery can be neutralized, never trusted" direction.
+ *
+ * Deliberately NOT applied inside {@link sanitizeUntrustedText} itself: that primitive is also used
+ * by mint sites over an ALREADY-ASSEMBLED body (the boundary/first-frame reminder wrap runs it over
+ * a body that may legitimately contain the engine's own `<skills>` block), so widening the primitive
+ * would have the engine defuse its OWN envelopes. Containment belongs to the fence, not the
+ * primitive.
+ */
+export declare const FENCED_LANE_ENVELOPE_TAGS: readonly string[];
+/**
+ * The same family as {@link FENCED_LANE_ENVELOPE_TAGS}, as a MUTABLE array for every body that will be
+ * SHELLED in a marked `<system-reminder>` — the attachment sink, the listing/diagnostics producers,
+ * the durable-resume orphan notice, the post-tool-batch hook relay, the git frame.
+ *
+ * These are not fences. They render deployment/server/model-supplied strings into a body the run loop
+ * then wraps in engine authority, so a forged envelope inside one is laundered by the wrapper. The
+ * wrapper itself cannot blanket-neutralize the family — it also shells the one body that legitimately
+ * IS an envelope (`buildSkillsBlock`'s `<skills>` fence) — so containment is expressed as OWNERSHIP:
+ * this full set for every body that owns nothing, minus its own tag for the one that does (see
+ * `attachmentEnvelopeTags` in turn-attachments.ts).
+ *
+ * Allocated ONCE so the sanitizer's memoized break-out regex is keyed by a stable value.
+ */
+export declare const SHELLED_BODY_ENVELOPE_TAGS: string[];
+/**
+ * Registry-derived: the tags the design/319 disclosure pipeline reports when they appear in VERBATIM
+ * external data (see {@link scanEnvelopeShaped}). `system-reminder` is absent on purpose — the mark
+ * pipeline scans it with a stronger (marked vs bare) verdict of its own.
+ */
+export declare const DISCLOSED_ENVELOPE_TAGS: readonly string[];
+/** The result of one envelope-shaped scan of an external projection. */
+export interface EnvelopeShapedScan {
+    /** ≥1 disclosed-family envelope tag (open or close) is present. */
+    hit: boolean;
+    /** The REGISTRY spellings that matched, de-duplicated, in registry order. Registry-owned strings —
+     *  never the matched bytes — so a caller may render them into trusted copy safely. */
+    tags: string[];
+}
+/**
+ * The envelope-family sibling of {@link scanReminderShaped}: detect text shaped like one of the
+ * engine's OTHER authority envelopes inside external data. Read-only — verbatim lanes are byte
+ * frozen (design/319 G3 veto: the Read↔Edit `old_string` quote-back loop), so the disclosure
+ * pipeline's only move is to append an engine-minted note saying what was seen.
+ *
+ * Grammar is deliberately the same shape as the reminder scan (attribute / case / tag-internal
+ * whitespace tolerant, open OR close tag), and the tag SET comes from the registry rather than a
+ * hand-copied list, so adding an envelope to {@link ENGINE_ENVELOPES} with `disclosed: true` is the
+ * whole change. Same accepted residual as the reminder scan: a tag the grammar does not recognize
+ * (fragmented, Unicode-lookalike) is not a hit — defense in depth, not a guarantee.
+ */
+export declare function scanEnvelopeShaped(text: string): EnvelopeShapedScan;
+/**
+ * Defuse a caller-declared occurrence of ONE specific envelope tag (opening AND closing) inside
+ * content, CC `zZe` @8339092 verbatim: ``t.replace(new RegExp(`<(?=/?${e}(?:[>\\s/]|$))`, "gi"), "<\\")``.
+ *
+ * Homed here (beside {@link ENGINE_ENVELOPES}) rather than in the observer module that first needed
+ * it: "escape one named envelope tag" is a containment primitive, and the registry's guard column
+ * points at it. Re-exported from `agents/observer.ts` for its existing importers.
+ *
+ * Deviation from CC (hardening): the tag is regex-escaped before entering the RegExp — CC
+ * interpolates raw, safe only because its slugs are `[a-zA-Z0-9_-]`; ours are too, but we don't rely
+ * on the caller for that invariant.
+ *
+ * NOTE the two sanctioned escape SHAPES in this tree, and why they are not merged: this one inserts
+ * a backslash (`<` → `<\`) because it is a byte-level CC anchor on the observer/teammate lanes;
+ * {@link sanitizeUntrustedText} inserts a zero-width space because its lanes are read by humans as
+ * well. Both are idempotent and both break the tag; a merge would move bytes on one of the two
+ * families for no security gain.
+ */
+export declare function escapeEnvelopeTag(tag: string, text: string): string;
 /** design/319 (B ticket) — what one reminder-shaped scan of an external projection found. */
 export interface ReminderShapedScan {
     /** ≥1 reminder-shaped tag (open or close; attribute/case/whitespace tolerant) is present. */
@@ -87,6 +225,14 @@ export declare function defuseExactMarkInSegments(segments: readonly string[], m
  * `<discussion>`, so an untrusted member could emit `</statement>` to break out (search [46] BUG2);
  * the caller passes those tag names. Tag names must be literal (alphanumeric/hyphen) — they are code-supplied
  * wrapper names, never untrusted input. Idempotent for prompt assembly (a defused tag no longer matches).
+ *
+ * WHY THE ALWAYS-ON SET IS ONE TAG AND NOT THE WHOLE {@link ENGINE_ENVELOPES} AUTHORITY FAMILY: this is a
+ * PRIMITIVE, and mint sites also run it over an ALREADY-ASSEMBLED body — the boundary/first-frame reminder
+ * wrap sanitizes a body that may legitimately BE the engine's own `<skills>` block, and the memory write
+ * scan diffs against it to decide what markup a note may contain. Widening the primitive would have the
+ * engine defuse its own envelopes and would silently move an unrelated store's admission rule. Family-wide
+ * containment therefore lives at the FENCE ({@link delimitUntrusted} / {@link inlineUntrusted}, via
+ * {@link FENCED_LANE_ENVELOPE_TAGS}) and at each envelope's own mint site (the registry's guard column).
  */
 export declare function sanitizeUntrustedText(text: string, extraTags?: string[]): string;
 /**
@@ -237,8 +383,13 @@ export declare function defuseControlChars(text: string): string;
  * `\s` does NOT fully match: the C1 half carries the 8-bit CSI/OSC/ST forms (U+009B/U+009D/U+009C) a
  * C1-honoring terminal treats like their ESC-prefixed spellings, so leaving them through would let a
  * 'sanitized' value repaint the trusted line it is interpolated onto (adversarial round finding) — caps the
- * length, then applies the same tag-neutralization (`</system-reminder>`) + fence-sentinel (`<<<`/`>>>`)
- * defusing the fenced body gets.
+ * length, then applies the same tag-neutralization + fence-sentinel (`<<<`/`>>>`) defusing the fenced
+ * body gets.
+ *
+ * The neutralized tag set is {@link FENCED_LANE_ENVELOPE_TAGS} — the engine's whole AUTHORITY envelope
+ * family, not the reminder tag alone. A value interpolated onto a TRUSTED line is the cheapest place to
+ * open a forged envelope, and this lane rewrites bytes by contract already, so the whole family is
+ * defused here.
  * Defense-in-depth, NOT a guarantee (same posture as the rest of this module).
  */
 export declare function inlineUntrusted(text: string, maxLen?: number): string;
@@ -250,8 +401,43 @@ export declare function inlineUntrusted(text: string, maxLen?: number): string;
 export declare const REVIEWER_NOTE_MAX_BODY = 2048;
 /**
  * Wrap untrusted text in a clearly labeled opaque fence. The consuming prompt should instruct the model to
- * treat everything inside as untrusted data — never as instructions. Sanitizes internally (system-reminder
+ * treat everything inside as untrusted data — never as instructions. Sanitizes internally (authority-envelope
  * neutralization + fence-sentinel defusing, on the body AND the label), so callers may pass raw
  * worker/external text — and labels derived from external identifiers (hostnames, resource URIs).
+ *
+ * The neutralized tag set is {@link FENCED_LANE_ENVELOPE_TAGS} — the engine's whole AUTHORITY envelope
+ * family (design/319 sibling work): a fence declares its contents to be data, but a forged
+ * `<task-notification>` / `<user_memory>` / `<skills>` opening inside it was previously reproduced byte
+ * for byte, so a model that skims past the fence line reads harness-shaped text with no judgment bit.
+ * This lane rewrites bytes by contract (it is the CONTAINED half; the verbatim quote-back lanes stay
+ * frozen and are served by the disclosure trailer instead), so the whole family is defused here.
+ *
+ * A caller that must DISCLOSE a `maxBody` truncation calls {@link delimitUntrustedWithClip} instead —
+ * never a re-derived length test of its own (see that function and {@link neutralizeForFence}).
  */
 export declare function delimitUntrusted(label: string, text: string, maxBody?: number): string;
+/**
+ * The EXACT body neutralization {@link delimitUntrusted} applies, exported so a caller that has to
+ * MEASURE the fenced body (its length in code points, whether the cap will bite) measures the string
+ * the fence really carries instead of re-deriving the transform from its own copy of the tag list.
+ *
+ * Two copies of that list is precisely what drifted once the fenced lane widened past the reminder tag:
+ * a caller pre-counting with the default (reminder-only) set under-measured the wide-set result by one
+ * ZWSP per widened-family tag occurrence, so a body got clipped while the truncation disclosure that
+ * decision drove was withheld — an attacker-selectable window just under the cap. Idempotent (both
+ * halves are), so a caller may hand the neutralized string straight back to the fence.
+ */
+export declare function neutralizeForFence(text: string): string;
+/**
+ * {@link delimitUntrusted} plus the clip verdict, for the callers that must DISCLOSE a truncation on a
+ * TRUSTED line outside the fence (§25 honesty: a bare ellipsis reads to the model as the source's own
+ * text, so a silent clip is a lie about what the source said).
+ *
+ * `clipped` is reported by the same measurement that performed the cut. A caller re-deriving "would this
+ * clip?" from its own transform + its own tag list is the shape that silently broke when the fence's tag
+ * set widened; there is no second condition here to keep in sync.
+ */
+export declare function delimitUntrustedWithClip(label: string, text: string, maxBody?: number): {
+    text: string;
+    clipped: boolean;
+};