@sema-agent/core 5.56.0 → 5.58.0

package/CHANGELOG.md

@@ -1,5 +1,127 @@
 # Changelog
 
+## 5.58.0 — 2026-08-24
+
+### BREAKING (design/375 case A — per-segment batch consent; ships as one window, no compatibility arms)
+- **`AskRequest.ruleSuggestions` → `ruleOffers`**: a closed discriminated union
+  (`single{rule,match,command}` | `batch{rules(1..5), uncoveredSegments}`); at most 2 offers, the
+  whole-string exact single always at index 0, the batch always last; choosing a batch is ONE yes to
+  all its members. `PendingAction.tool_approval` carries the same seat. An unknown offer kind
+  degrades to a single opaque row preserving the original wire index (fail toward asking).
+- **`RuleApprovalRecord` schema:2**: `schema`+`offers` required; `selectedCandidate` → `selectedOffer`.
+  Pre-v2 rows refuse loudly (`record_schema_stale`, envelope read, ownership concealment keeps
+  precedence) — pending approvals from before the upgrade are re-asked, never migrated. Supplying the
+  retired `selectedCandidate` key (or `selectedOffer: null`) refuses `config.invalid_argument`.
+- **`redeemRuleBatch`** returns a per-member discriminated table `{members, rev}` keyed by
+  `candidateIndex` (success rows carry `alreadyRedeemed`+`dot`, refused rows carry `reason`;
+  exactly one row per selected-offer member, projection map fixed); the three-array `ImportResult`
+  shape is deleted. `RuleApprovalRecordStore.get` may return `StaleRuleApprovalRecord` (envelope).
+- **Engine conjunction arm** (§5.1): a compound command whose EVERY segment is admitted by some
+  eligible persisted rule is allowed — the segment deny/ask fence stays strictly ahead, whole-string
+  exact and the compound-prefix form keep their precedence, and a single-command prefix still never
+  admits a compound. `PersistedRuleHit` becomes `{ rules }` (covering set; evidence dots = union).
+  Eligibility is two-layered and single-sourced (`eligiblePersisted`/`eligibleContext`;
+  tombstoned/foreign-scope rules can never join a conjunction).
+- The suggester mints offers (`suggestRulesForCommand` returns `RuleOffer[]`; only uncovered
+  segments enter a batch; the compound-prefix candidate is no longer offered — existing
+  compound-prefix rules keep matching forever); the card-edit face accepts one edited rule judged by
+  the single-rule coverage predicate.
+
+### Added
+- **LLM-driven memory consolidation, slices 1+2 (design/376; default OFF, additive)**: the fold-plan
+  distiller becomes a product module (frozen prompt contract byte-equal to the benchmark's, canonical
+  hash pinned; structural repairs counted, repair-budget abort); `runMemoryConsolidationDriver` host
+  verb with a first-class run row (claim/attempt single-writer, stale-rev replay guard, write-failure
+  groups end the run `driver_failed`, `memory.consolidation_incomplete` notice, FORCED announcement
+  once per run); `consolidate` model role resolving consolidate → summarize → loud refusal (never the
+  default model). The bench rig now consumes the product module (scripted-arm projection digest
+  unchanged across the port). Auto-trigger wiring is a later slice; nothing runs without an explicit
+  driver seat.
+- **Dependency-direction gate**: the engine's bottom-of-graph position is frozen mechanically (no
+  sibling `@sema-agent/*` in manifest or src imports).
+
+### Fixed
+- **Internal-wording sweep over the shipped surface** (S10 class): board-coordinate and campaign-name
+  vocabulary cleared to zero across shipped `.d.ts` JSDoc and runtime strings (744 comment lines
+  rewritten 1:1, two runtime string leaks fixed); the wording gate's lexicon now also catches
+  3-digit coordinate forms.
+- Bench provenance axis (P1) landed with two harness fixes (seed origin carriage, read/write
+  provenance mode mismatch) — measurement only, no engine behavior change.
+
+## 5.57.0 — 2026-08-23
+
+### Added
+- **key×URL pairing adjudicator** (#309 cross-repo case, [5060]-[5063] consensus): `adjudicateModelRoute`
+  is the single source of the credential-pairing law. Per-model credential = paired by construction;
+  the deployment-config credential passes only on the deployment's own declared root; absent credential
+  is legal keyless except for an entry declaring its own off-root URL. Codes `route.credential_mismatch`
+  / `route.credential_missing` (refusal detail carries entry id + both URL halves + a one-line fixHint,
+  fail-closed by ruling). The three first-party brains gate inside buildRequest (refusal terminates
+  before any fetch) and expose `Brain.adjudicateRoute`; routing/failover/degrading/circuit-breaker
+  re-judge per leg (failover serves from the paired leg; a broken degrading hop is skipped). Two-leg
+  disposition: a NAMED model surfaces the refusal; a DERIVED model (compaction summarize, auto-mode
+  classifier, suggestions) pre-flights and falls back to the primary with a `route.fallback_to_primary`
+  notice; `route.base_url_changed_key_unchanged` mints at swapModels. `ROUTE_ADJUDICATION_CONFORMANCE_CORPUS`
+  (16 vectors) exported as the cross-codebase anchor. **Narrowings (each with a fixHint)**: declared-root
+  deployments' off-root entries now refuse instead of silently borrowing the gateway credential; an
+  entry-declared auth header now wins over the deployment key. Preserved byte-identical: unpinned
+  quick-start, keyless single-gateway, header-only boot token, gateway dual-auth.
+- **Per-model auth seats for WebFetch summarizer and team surfaces** (#417): `getApiKeyAndHeaders`
+  on `WebFetchSummarizerOptions` / `TeamDiscussionOptions` / `runScenario` (absent seat = byte-identical).
+- **Compound-prefix permission rules** (#364 case B, ruled; registered divergence): `Bash(cd /tmp && adb pull:*)`
+  — leading segments byte-exact, only the final segment takes arguments. The validator accepts the
+  chain form (a `*` in any other position still refuses); the matcher admits on segment-count equality
+  + byte-prefix at a word boundary (a single-command prefix still never admits a compound; the segment
+  deny/ask fence stays strictly ahead of the allow lane); the suggester mints the compound-prefix
+  sibling at index 1 when the final segment fits the same grammar as the simple seat; the card-edit
+  face accepts the respelling; org tighten gains the same grammar (a compound-prefix deny is enforceable
+  instead of bricking its snapshot). **Widenings**: validator accepts the new form; eligible compounds
+  offer 2 seats; card edit + import accept it; org snapshots carrying it are enforceable. **Mixed-fleet
+  note**: older engines quarantine compound-prefix rows (bytes preserved, disclosed) — do not publish
+  compound-prefix org rules before the fleet is level.
+- **Generic prefix grammar for rule suggestions** (#364 R1, CC 2.1.223 iNo corpus): the prefix arm
+  uses the corpus rule `^[a-z][a-z0-9]*(-[a-z0-9]+)*$` with the interpreter/wrapper blacklist; the
+  125-line lexicon demotes to a bonus for multi-word deepening; ASCII-closed head-name screen.
+- **`precheckEditedRuleText(text, command)`** (#428, server pickup): the card-edit face's three text
+  gates (spelling normalization → grammar → coverage bound) extracted to one shared body and exported
+  (`EditedRuleTextPrecheck`). `ok` means SUBMITTABLE (record-level gates stay with `confirmRuleApproval`);
+  `canonicalRule` may differ from the submitted bytes; refusal words match `edit_rejected.detail`
+  verbatim (`code` rides validator refusals only). The entry screens unrenderable command bytes loudly
+  (`config.invalid_argument`).
+- **ScheduleWakeup honesty family** (#424 A-1/A-4): the wakeup intent carries `lifetime:"session"`
+  where the backend vouched for the reap contract; an undeclared backend keeps the historic durable
+  intent with receipt + description disclosure; `reason` rides `details.reason`. An incomplete
+  replace (stale wakeup possibly still armed) is disclosed on the receipt.
+- **SendMessage completion promises follow mount truth** (#424 A-6): `notificationWired?` / `oneShot?`
+  seats (defaults preserve wired behavior byte-identical); the unwired arm teaches retrieval, the
+  one-shot arm instructs blocking retrieval now; ten sites across two wordings guarded.
+
+### Fixed
+- **Derived-route pre-flight can never sink the main task** (pre-ship rescan P1): the judge call and
+  the whole seat (including URL normalization of garbage catalog values) now abstain on throw instead
+  of failing task preparation and leaking the acquired session view; both derived seats share the
+  guarded helper.
+- **Route URL comparison is wire-equivalent** (rescan): scheme/host case-fold + default-port elision
+  (path half stays byte-ordered; parse failure falls back to raw) — case-only respellings of the same
+  endpoint no longer refuse as `credential_mismatch`.
+- **MCP revocation copy tells the standing truth at all four outlets** (rescan; #424 A-5 completed):
+  the ListMcpResources arm joins the other three ("stays on this run's roster; every call refused
+  the same way"), with an extinction tripwire for the old sentence.
+- **AgentHarness auth carriers refuse loudly at the two host seats** (rescan hardening): a
+  deployment-wide auth header in `streamOptions.headers` is refused with a migration hint instead of
+  silently riding beside per-model credentials; `stripAuthHeaders` retired (zero callers).
+- **ExitWorktree parameter texts describe this tool** (#424 A-8): detached worktrees have no branch;
+  a changed tree is KEPT (not refused) — CC originals and reasoning recorded at the schema.
+- **Read-only memory notice restores CC's recall-framing paragraph** (#424 A-9, byte-compared).
+- **MCP/scheduler small truths** (rescan): the wakeup mount note is led by the `supportsSessionWakeup:false`
+  arm; an explicitly-declared `supportsSessionLifetime:false` backend behaves like an undeclared one
+  (seam defines the two spellings as one state — the refusal arm from an unshipped interim build rolled back).
+
+### Bench (not part of the package surface)
+- LLM distillation arm for the memory benchmark (three-clause instruction arc: retained 20.8%→100%,
+  convergence restored; distillation quality flat with the hand-authored ceiling on this corpus's
+  measurable axes); live provider key no longer travels to the loopback observation plane.
+
 ## 5.56.0 — 2026-08-23
 
 ### Fixed

package/dist/agents/cascade.d.ts

@@ -105,7 +105,7 @@ export interface CascadeAttempt {
     index: number;
     model: ModelRef;
     passed: boolean;
-    /** This rung's OWN+nested spend. ABSENT when the rung ran unpriced (RB-368 knownness, codex batch-4
+    /** This rung's OWN+nested spend. ABSENT when the rung ran unpriced (RB-368 knownness batch-4
      *  F4) — a fabricated 0 here both misreported the attempt and let escalation ride under a finite
      *  ceiling the engine could not actually enforce. */
     costMicroUsd?: number;

package/dist/agents/cumulative-stats.d.ts

@@ -58,7 +58,7 @@ export interface CumulativeStatsAccumulator {
     /**
      * TRUE when ANY contributing leg published no `costMicroUsd`, i.e. it ran on a model with neither a
      * `RunnerDeps.pricing` entry nor a `Model.cost` declaration (`stats.costMicroUsd` is contractually
-     * ABSENT there — types.ts / RB-368 [2076]).
+     * ABSENT there — types.ts / RB-368).
      *
      * Accumulating such a leg as `?? 0` publishes a total that is not one: the operation's real cost is
      * unknown, and reporting the priced legs' partial sum makes "no price table" indistinguishable from

package/dist/agents/observer.d.ts

@@ -257,12 +257,12 @@ export declare class ObserverPairing {
     retire(state: Exclude<ObserverPairingState, "armed">): void;
 }
 export declare function markObserverTaskId(taskId: string): void;
-/** codex OBS-2 F3 — lifecycle revocation: the wiring unmarks at observed-run settle (after the final
+/** lifecycle revocation: the wiring unmarks at observed-run settle (after the final
  *  drain + session release), so the set tracks LIVE observers only instead of growing per delegation
  *  forever (and a long-dead observer id no longer trips the SendMessage target refusal). */
 export declare function unmarkObserverTaskId(taskId: string): void;
 export declare function isObserverTaskId(taskId: string): boolean;
-/** Diagnostic face (codex OBS-2b F-08): how many observer identities are currently LIVE — a test's
+/** Diagnostic face: how many observer identities are currently LIVE — a test's
  *  lifecycle assertion ("armed here, revoked after settle") without exposing the ids themselves. */
 export declare function observerTaskIdCount(): number;
 /** CC @18371202 — SendMessage refusal when the SENDER is an observer run. */

package/dist/agents/peer-admission.d.ts

@@ -127,7 +127,7 @@ export interface PeerAdmissionOptions {
 export declare function createPeerAdmission(options?: PeerAdmissionOptions): PeerAdmission;
 export declare function peerAdmissionFor(scope: string | undefined, recipientKey: string, config: PeerAdmissionConfig, options?: PeerAdmissionOptions): PeerAdmission;
 /**
- * The delivery legs' ONE admission entry (codex 176-r2): registry seat-commit follows the SAME
+ * The delivery legs' ONE admission entry: registry seat-commit follows the SAME
  * refusal-is-side-effect-free rule as the sender table inside `admit` — the instance is looked up
  * WITHOUT an LRU touch (a detached fresh one serves a first-contact recipient), judged, and only an
  * ADMITTED message commits the seat (insert + touch + bounded eviction). A refusal to a

package/dist/agents/retain-ledger.d.ts

@@ -96,7 +96,7 @@ export interface RetainLedgerHooks {
  * `prepareTask` when the spec opts in, threaded to delegation tools as the TRUSTED `ctx.subagentRetain`,
  * and disposed by the Runner in the task's terminal `finally` (D4: abort in-flight resumes + unpin +
  * release every retained session — retain is NOT durable; resume is reachable only while the parent run
- * lives, codex-B3). Leaks are double-bounded by `max` + `ttlMs` (codex-B2).
+ * lives). Leaks are double-bounded by `max` + `ttlMs`.
  */
 export declare class SubagentRetainLedger {
     readonly ttlMs: number;
@@ -159,7 +159,7 @@ export declare class SubagentRetainLedger {
     get size(): number;
     get(parentToolCallId: string): SubagentRetainEntry | undefined;
     wasEvicted(parentToolCallId: string): boolean;
-    /** codex impl-review MAJOR-1 — LAZY TTL sweep: evict every settled idle entry whose retain TTL
+    /** LAZY TTL sweep: evict every settled idle entry whose retain TTL
      *  elapsed (unpin + release + tombstone), so an expired session is freed at the NEXT ledger touch
      *  (every spawn-registration and resume entry call this) rather than only when its own resume is tried.
      *  fidelity R4-1: no longer the only reaper — `markSettled` also arms a per-entry ACTIVE timer, so

package/dist/agents/roster-store.d.ts

@@ -8,7 +8,7 @@ export interface RosterEntry {
     sessionId?: string;
     /** The spawn's parent tool-call id (retain-ledger key), when known. */
     toolUseId?: string;
-    /** δ 批 [1498]⑦ — the ROOT host session of the delegation tree at spawn (recovery-face grouping
+    /** the ROOT host session of the delegation tree at spawn (recovery-face grouping
      *  key; equals the spawner's session at depth 1). Stored verbatim; no predicate arm consumes it
      *  yet (enumeration/recovery is the reader). */
     rootSessionId?: string;
@@ -19,11 +19,11 @@ export interface RosterEntry {
      *  inherited default. Closed set, single member today; absent = bound normally (or no word). */
     modelFallback?: "inherit_no_tier_binding";
     /** Spawn owner (task/session id) — consumers re-apply access checks against these two axes.
-     *  β 批 A-2: REQUIRED (default-deny predicate; an axis-less row would be unreachable). */
+     *  A-2: REQUIRED (default-deny predicate; an axis-less row would be unreachable). */
     owner: string;
-    /** Spawn principal scope. β 批 A-2: REQUIRED (`"default"` is the single-tenant spelling). */
+    /** Spawn principal scope. A-2: REQUIRED (`"default"` is the single-tenant spelling). */
     scope: string;
-    /** codex R3 — mirrors the live registry's explicit session-scoping flag: session-ID owner matching
+    /** mirrors the live registry's explicit session-scoping flag: session-ID owner matching
      *  is permitted ONLY when the spawn was session-scoped (TaskRegistry.canAccess parity — without
      *  the flag, a task-scoped agent that fell out of the live registry would become visible through
      *  the durable fallback to same-session callers the registry itself rejects). */
@@ -33,7 +33,7 @@ export interface RosterEntry {
 }
 /**
  * The caller's access axes for a roster read — the SAME predicate the live task registry applies
- * (`canAccess`): scope mismatch = invisible; then owner match, or session match. codex F3 (S1
+ * (`canAccess`): scope mismatch = invisible; then owner match, or session match. (S1
  * review): resolution MUST filter the candidate pool by access BEFORE the latest-wins reduce —
  * reduce-then-check lets one tenant's newer same-name entry shadow (and thereby suppress) another
  * tenant's older authorized binding. Implementations (incl. pg/tidb) apply this in the query.
@@ -43,7 +43,7 @@ export interface RosterAccess {
     scope?: string;
     sessionId?: string;
 }
-/** β 批 A-2 (clay 裁定 2026-07-22): DEFAULT-DENY both axes (TaskRegistry.canAccess byte-parity —
+/** Ruled 2026-07-22: DEFAULT-DENY both axes (TaskRegistry.canAccess byte-parity —
  *  the polarity split was the defect). Entries are written with both axes (spawn chain guarantees
  *  it; {@link RosterEntry} requires them), so a missing axis is a broken row, answered with a miss. */
 export declare function entryAccessible(e: RosterEntry, access: RosterAccess): boolean;
@@ -77,7 +77,7 @@ export interface RosterStore {
     /** Record (or supersede — latest-wins per normalized name is applied at READ time) a binding. */
     record(entry: RosterEntry): void | Promise<void>;
     /** Resolve a name for a CALLER: filter by {@link RosterAccess} FIRST, then latest `createdAt`
-     *  wins within the authorized pool (codex F3 filter-before-reduce). Undefined = miss. */
+     *  wins within the authorized pool (filter-before-reduce). Undefined = miss. */
     resolve(name: string, access: RosterAccess): RosterEntry | undefined | Promise<RosterEntry | undefined>;
     /** All live entries (diagnostics / deployment listing; order unspecified). */
     list(): RosterEntry[] | Promise<RosterEntry[]>;
@@ -148,7 +148,7 @@ export declare class FileRosterStore implements RosterStore {
      *  miss on resolve/list — advisory layer), but it is no longer SILENT: an IO failure or corrupt
      *  document was indistinguishable from an honestly empty roster. Never fires on plain ENOENT. */
     private discloseCorrupt;
-    /** codex F4 — two read grades: MISSING file (ENOENT) is an honest empty roster, but a corrupt or
+    /** two read grades: MISSING file (ENOENT) is an honest empty roster, but a corrupt or
      *  transiently unreadable file must THROW on the mutation path — treating it as empty would let
      *  the next `record` atomically REPLACE the existing file with just one row (silent data loss).
      *  Read paths (resolve/list) degrade the throw to a miss via `lenient`. */

package/dist/agents/send-message-tool.d.ts

@@ -33,6 +33,17 @@ export interface SendMessageToolOptions {
     notify?: (n: TaskNotificationPayload, opts?: {
         priority?: "now" | "next" | "later";
     }) => void;
+    /** Whether a completion notification really reaches the sender — drives every "you will be notified"
+     *  sentence on this face (description + four receipts), mirroring TaskOutput's `notificationWired`.
+     *  Default = `notify !== undefined`, which is the truth on both the first-party mount and a direct
+     *  mount that wires its own sink here. Pass `true` only when the deployment announces a finished
+     *  agent through a channel of its own (this tool then keeps the wired wording); `false` states the
+     *  degraded truth explicitly. */
+    notificationWired?: boolean;
+    /** RB-220 mirror of {@link import("../core/types.js").TaskSpec.oneShot} (the Runner mount fills it):
+     *  this run's process exits when the turn ends, so no completion notification can ever land — checked
+     *  AHEAD of {@link notificationWired}, since no amount of wiring makes a later turn exist. */
+    oneShot?: boolean;
     /** Steer-handle sink: the revived run re-emits a FRESH handle (design/122 risk-table contract). */
     sink?: (handle: SubagentSteerHandle) => void;
     /**
@@ -48,7 +59,7 @@ export interface SendMessageToolOptions {
     senderName?: string;
     /** design/147 S1c — the deployment's durable roster, consulted after the live registry misses. */
     roster?: import("./roster-store.js").RosterStore;
-    /** design/147 S3a (codex F2) — the PARENT run's retain ledger (RunInternals.parentRetainLedger):
+    /** design/147 S3a — the PARENT run's retain ledger (RunInternals.parentRetainLedger):
      *  the sibling leg's retain entries live there. Consulted AFTER the own-run and session ledgers. */
     siblingRetain?: SubagentRetainLedger;
     /** RB-390 — the SPAWNING run's taskId when THIS run is a delegated child (RunInternals.parentTaskId,
@@ -67,7 +78,7 @@ export interface SendMessageToolOptions {
      *  session-scoped sibling registers with owner = the parent's sessionId, which the parent's
      *  taskId alone cannot satisfy when the two differ (same rationale as ToolExecuteContext.parentSessionId). */
     parentSessionId?: string;
-    /** [1358] the process-level background-child observer (RunnerDeps.onBackgroundChildEvent) — the
+    /** the process-level background-child observer (RunnerDeps.onBackgroundChildEvent) — the
      *  mount fills this so a SendMessage resume re-emits the spawn→tick→terminal family (fleet row
      *  revival). Rides the OPTS closure like notify; RB-409's {@link enrichCtx} feeds the ctx twin. */
     onBackgroundChildEvent?: (event: import("../core/types.js").BackgroundChildEvent) => void;

package/dist/agents/send-message-tool.js

@@ -46,6 +46,21 @@ function targetLaneKey(scope, targetId) {
 const OPERATOR_CONTINUATION_CTX = Symbol("sema.operator_continuation");
 export function createSendMessageTool(opts) {
     const tier3Capable = opts.agentStore !== undefined && opts.mailbox !== undefined && opts.reviveSpawn !== undefined;
+    const completionMode = opts.oneShot === true ? "one_shot" : (opts.notificationWired ?? opts.notify !== undefined) ? "notified" : "silent";
+    const notifyWired = completionMode === "notified";
+    const NO_COMPLETION_NOTICE = completionMode === "one_shot"
+        ? "this is a ONE-SHOT submission — there is no later turn for a completion notification to land in, so retrieve its result NOW with TaskOutput(task_id, block: true) rather than ending your turn"
+        : "its completion is NOT announced on this mount — retrieve its status and result with TaskOutput(task_id) where mounted";
+    const AWAIT_COMPLETION = notifyWired
+        ? "Wait for its completion notification"
+        : completionMode === "one_shot"
+            ? "Wait for it NOW with TaskOutput(task_id, block: true) — this one-shot submission ends with this turn"
+            : "Check for its completion with TaskOutput(task_id) where mounted";
+    const awaitCompletion = notifyWired
+        ? "wait for its completion notification"
+        : completionMode === "one_shot"
+            ? "wait for it NOW with TaskOutput(task_id, block: true) — this one-shot submission ends with this turn"
+            : "check for its completion with TaskOutput(task_id) where mounted";
     const sendMessagePins = new Map();
     const pinGuard = (targetId, targetName, rung, to) => {
         if (rung === "other")
@@ -86,8 +101,11 @@ export function createSendMessageTool(opts) {
             `background run with its full prior conversation preserved, so don't re-explain what it already knows. Names ` +
             `keep working after an agent completes; but if a name you already messaged is later taken by a NEWER agent, the ` +
             `send is refused rather than silently redirected — re-send with the task_id of whichever agent you meant. ` +
-            `You will be notified automatically when it completes — prefer ending your turn; do not ` +
-            `poll. ` +
+            (notifyWired
+                ? `You will be notified automatically when it completes — prefer ending your turn; do not poll. `
+                : completionMode === "one_shot"
+                    ? `This is a ONE-SHOT submission: there is no later turn for a completion notification to land in, so do NOT end your turn expecting one — wait actively with TaskOutput(task_id, block: true) when you need a continued agent's result. `
+                    : `A finished agent is NOT announced on this mount — check on it with TaskOutput(task_id) where mounted rather than ending your turn to wait for a notification that never comes. `) +
             (tier3Capable
                 ? `Continuing a finished agent works for agents with a durable record — by name or task_id, even across restarts — and for runs that retain sub-agent sessions; when neither covers it you get an honest error and should launch a new agent with the needed context instead.`
                 : `Continuing a finished agent requires the run to retain sub-agent sessions; when the session was not ` +
@@ -255,7 +273,7 @@ export function createSendMessageTool(opts) {
                 if (row.status === "running") {
                     if (row.writerId === opts.registry.writerId) {
                         return {
-                            content: `Message not sent: ${whoT3} is currently running in this process but its mid-run delivery channel is not reachable from here. Wait for its completion notification, then send again to continue it.`,
+                            content: `Message not sent: ${whoT3} is currently running in this process but its mid-run delivery channel is not reachable from here. ${AWAIT_COMPLETION}, then send again to continue it.`,
                             details: { error: "still_running", to },
                             isError: true,
                         };
@@ -268,7 +286,7 @@ export function createSendMessageTool(opts) {
                         };
                     }
                     return {
-                        content: `Message not sent: ${whoT3} is running on another host — this process has no delivery channel to it. Wait for its completion notification, then send again to continue it.`,
+                        content: `Message not sent: ${whoT3} is running on another host — this process has no delivery channel to it. ${AWAIT_COMPLETION}, then send again to continue it.`,
                         details: { error: "running_elsewhere", to },
                         isError: true,
                     };
@@ -501,7 +519,9 @@ export function createSendMessageTool(opts) {
                     const priorCount = lease.messages.length - 1;
                     return {
                         content: `Message sent — ${whoT3} was revived in the background with its prior context intact${priorCount > 0 ? ` (${priorCount} earlier pending message(s) delivered with it)` : ""}. ` +
-                            `You will be notified automatically when it completes. Continue with other work — do not poll.`,
+                            (notifyWired
+                                ? `You will be notified automatically when it completes. Continue with other work — do not poll.`
+                                : `${NO_COMPLETION_NOTICE.charAt(0).toUpperCase()}${NO_COMPLETION_NOTICE.slice(1)}.`),
                         details: { type: "send-message", status: "revived", to, task_id: handle, seq: nextSeq, ...(priorCount > 0 ? { priorMessages: priorCount } : {}) },
                     };
                 }
@@ -628,10 +648,10 @@ export function createSendMessageTool(opts) {
                     }, { priority: "next" });
                     if (delivered.ok) {
                         const receiptText = delivered.disposition === "parked"
-                            ? `Message parked for ${who}: the agent finished before reading it — it will be delivered when the agent is next continued. You will be notified of its completion; continue with other work.`
+                            ? `Message parked for ${who}: the agent finished before reading it — it will be delivered when the agent is next continued. ${notifyWired ? "You will be notified of its completion; continue with other work." : `Note: ${NO_COMPLETION_NOTICE}.`}`
                             : delivered.disposition === "pending"
-                                ? `Message accepted for ${who} but delivery is UNCONFIRMED (its channel did not confirm within the wait window) — it stays queued and will deliver if the channel binds. You will be notified of the agent's completion either way; resend then if it went unanswered. ${DEDUP_RETRY_NOTE}`
-                                : `Message queued for delivery to ${who} at its next turn. If it finishes before reading it, the message may not survive — you will be notified of its completion either way; resend then if it went unanswered. Continue with other work; do not poll. ${DEDUP_RETRY_NOTE}`;
+                                ? `Message accepted for ${who} but delivery is UNCONFIRMED (its channel did not confirm within the wait window) — it stays queued and will deliver if the channel binds. ${notifyWired ? "You will be notified of the agent's completion either way" : `Note: ${NO_COMPLETION_NOTICE}`}; resend then if it went unanswered. ${DEDUP_RETRY_NOTE}`
+                                : `Message queued for delivery to ${who} at its next turn. If it finishes before reading it, the message may not survive — ${notifyWired ? "you will be notified of its completion either way" : NO_COMPLETION_NOTICE}; resend then if it went unanswered. ${notifyWired ? "Continue with other work; do not poll. " : ""}${DEDUP_RETRY_NOTE}`;
                         return {
                             content: receiptText,
                             details: { type: "send-message", status: "delivered_running", disposition: delivered.disposition, to, task_id: targetId, summary },
@@ -639,7 +659,7 @@ export function createSendMessageTool(opts) {
                     }
                     if (delivered.reason === "no_channel") {
                         return {
-                            content: `Message not sent: ${who} is still running and this deployment has no mid-run delivery channel for it. Wait for its completion notification, then SendMessage to continue it. ${DEDUP_RETRY_NOTE}`,
+                            content: `Message not sent: ${who} is still running and this deployment has no mid-run delivery channel for it. ${AWAIT_COMPLETION}, then SendMessage to continue it. ${DEDUP_RETRY_NOTE}`,
                             details: { error: "still_running", to },
                             isError: true,
                         };
@@ -705,7 +725,7 @@ export function createSendMessageTool(opts) {
             }
             if (ledger.get(resumeToolUseId)?.running === true) {
                 return {
-                    content: `Message not sent: ${who} (or a prior follow-up to it) is still running — wait for its completion notification.`,
+                    content: `Message not sent: ${who} (or a prior follow-up to it) is still running — ${awaitCompletion}.`,
                     details: { error: "steering.still_running", to },
                     isError: true,
                 };
@@ -761,7 +781,9 @@ export function createSendMessageTool(opts) {
                     const marker = await resume(`${fromPrefix}[${safeSummary}] ${safeMessage}`);
                     return {
                         content: `Message sent — ${who} resumed in the background with its prior context intact (correlation marker [${marker}]).\n` +
-                            `You will be notified automatically when it completes; its reply will carry [${marker}]. Continue with other work — do not poll.`,
+                            (notifyWired
+                                ? `You will be notified automatically when it completes; its reply will carry [${marker}]. Continue with other work — do not poll.`
+                                : `Its reply will carry [${marker}], but ${NO_COMPLETION_NOTICE}.`),
                         details: { type: "send-message", status: "resumed", to, task_id: targetId, marker, summary },
                     };
                 }
@@ -778,7 +800,7 @@ export function createSendMessageTool(opts) {
                                     ? `${who} reached its resume cap (${SUBAGENT_RESUME_CAP} follow-ups per agent) — relaunch a new agent instead.`
                                     : code === "steering.still_running"
                                         ?
-                                            `${who} (or a prior follow-up to it) is still running — wait for its completion notification. ${DEDUP_RETRY_NOTE}`
+                                            `${who} (or a prior follow-up to it) is still running — ${awaitCompletion}. ${DEDUP_RETRY_NOTE}`
                                         : code === "resume.row_recycling"
                                             ?
                                                 `${who}'s registry row is being adjudicated right now (a revival claim or a reap sweep holds it) — send again in a moment. ${DEDUP_RETRY_NOTE}`

package/dist/agents/subagent-steps.d.ts

@@ -84,7 +84,7 @@ export declare class SubagentStepRecorder {
     editedFiles(): SubagentEditedFile[] | undefined;
     /** The child's most recent tool intent as one human line ("Bash npm test", "Edit src/x.ts"); undefined if none. */
     currentAction(): string | undefined;
-    /** [1828] (server cross-repo): {@link currentAction} pre-formatted into a fleet-view Progress-section
+    /** {@link currentAction} pre-formatted into a fleet-view Progress-section
      *  shape — the SAME `{tool, target}` pair `currentAction` already concatenates into one line, exposed
      *  separately so a consumer can look the tool up in its own registry instead of parsing prose.
      *  Undefined if none observed (mirrors {@link currentAction}'s own undefined case exactly). */

package/dist/agents/subagent.d.ts

@@ -335,8 +335,8 @@ export interface SubagentSteerHandle {
     /**
      * design/122 D1 — the retained child session id; present ONLY when the parent run enabled
      * {@link import("../core/types.js").TaskSpec.retainSubagentSessions} AND this child was actually
-     * retained. ⚠️ Control-plane only (codex-B6): this is a continuation CAPABILITY — never expose it to
-     * clients; target children by the opaque `parentToolCallId` instead (codex-m3).
+     * retained. ⚠️ Control-plane only: this is a continuation CAPABILITY — never expose it to
+     * clients; target children by the opaque `parentToolCallId` instead.
      */
     childSessionId?: string;
     /**
@@ -385,7 +385,7 @@ export declare function createSubagentResume(deps: {
      *  apply to EVERY stop cycle, spawn and resume alike). Absent ⇒ honest ungated degradation (no
      *  registry to count against — the pre-C1 immediate send). */
     registry?: import("../core/task-registry.js").TaskRegistry;
-    /** design/147 S1a (codex F1) — the RESUMING caller's live injection entry: overrides the retained
+    /** design/147 S1a — the RESUMING caller's live injection entry: overrides the retained
      *  snapshot's spawn-turn `parentNotify` (that lane is torn down with its turn — uplinks through it
      *  would PARK instead of reaching the currently active parent turn, behind a success receipt). */
     currentParentNotify?: (n: TaskNotificationPayload, opts?: {
@@ -442,7 +442,7 @@ export declare function createSubagentResume(deps: {
     taskId?: string;
     /** S2b RB-27② — the resuming caller's resolved registry access (pairs with taskId). */
     taskAccess?: import("../core/task-registry.js").TaskAccess;
-    /** [1358] the process-level background-child observer (ctx.onBackgroundChildEvent, Runner-filled).
+    /** the process-level background-child observer (ctx.onBackgroundChildEvent, Runner-filled).
      *  When present TOGETHER with a revived registry row (taskId + successful revive), the resume cycle
      *  re-emits the SAME spawn→tick→terminal event family as a first spawn — a fleet view's row revives
      *  on the spawn frame (server treats spawn-after-tombstone as row revival). The spawn frame is
@@ -450,11 +450,11 @@ export declare function createSubagentResume(deps: {
      *  tick — the observer's tombstone-period tick rejection depends on that order). No revived row ⇒
      *  no frames (the steer-handle resume path has no a*-domain row to project). */
     bgSink?: (event: import("../core/types.js").BackgroundChildEvent) => void;
-    /** [1358] row lifetime class echoed onto the revive frames (mirrors the registry row). */
+    /** row lifetime class echoed onto the revive frames (mirrors the registry row). */
     sessionScoped?: boolean;
-    /** [1358] the row's display description, echoed onto the revive spawn frame (resume-marked). */
+    /** the row's display description, echoed onto the revive spawn frame (resume-marked). */
     rowDescription?: string;
-    /** [1358]/codex 1351 F3 — the row's original observer metadata, reproduced on the revive frames so
+    /** the row's original observer metadata, reproduced on the revive frames so
      *  a consumer rebuilding a tombstoned row gets its TYPE/name/ancestry back (never a blank row). */
     rowName?: string;
     rowAgentType?: string;
@@ -516,10 +516,10 @@ export interface SubagentToolOptions {
      */
     background?: {
         registry: import("../core/task-registry.js").TaskRegistry;
-        /** β 批 A-2 (BREAKING 1.365.0): REQUIRED — the registry is default-deny on both axes, so a
+        /** A-2 (BREAKING 1.365.0): REQUIRED — the registry is default-deny on both axes, so a
          *  background registration without a declared owner would be unreachable by every caller. */
         owner: string;
-        /** β 批 A-2 (BREAKING 1.365.0): REQUIRED — `"default"` is the single-tenant spelling (explicit,
+        /** A-2 (BREAKING 1.365.0): REQUIRED — `"default"` is the single-tenant spelling (explicit,
          *  matching the engine chain's `principal ?? "default"`), never implied by omission. */
         scope: string;
         /**
@@ -559,7 +559,7 @@ export interface SubagentToolOptions {
          * vetoes the park: the child settles failed exactly as pre-153, and the already-minted
          * checkpoint is expired (no orphans). Never called for sync children or non-suspending runs.
          *
-         * ⚠️ Implementation obligation (blackboard [1593]/[1594], field-proven): "migrates it here"
+         * ⚠️ Implementation obligation (field-proven): "migrates it here"
          * means ACTIVELY PROMOTE — a check-only implementation that merely LOOKS UP the host durable
          * store rejects every child whose session lives in a split/transient tier (a subRunner's
          * private TTL store), and the veto fires on EVERY park: the checkpoint expires within
@@ -658,7 +658,7 @@ export interface SubagentToolOptions {
      * agent is selected) govern them verbatim: an explicit allowlist must NAME an injected tool for the
      * child to see it; `"*"`/absent allowlist = all. Nested delegation threads the SAME factory down
      * (`createSubagentToolNode(opts, depth+1)` carries it), so a grandchild spawn re-evaluates it — per-spawn,
-     * at every level; each child gets its own instances bound to its own spawn moment ([797]: the
+     * at every level; each child gets its own instances bound to its own spawn moment (the
      * server-side factory is execute-time late-bound, so per-spawn evaluation is the confirmed shape).
      * A THROWING/rejecting factory degrades THAT spawn to zero injected tools (the child still runs)
      * with a FIXED generic `note:` disclosure on the report/async card (same lane as the model-override
@@ -793,7 +793,7 @@ export declare function asyncLaunchedReceipt(p: {
     taskId: string;
     /** The lane's own "what is running" opener — the Agent lane and the fork lane say different things. */
     workingLine: string;
-    /** Whether a real notification sink is wired (codex R4: the receipt speaks the RUNTIME sink truth). */
+    /** Whether a real notification sink is wired (the receipt speaks the RUNTIME sink truth). */
     notify: boolean;
     /**
      * RB-220 — mirrors {@link import("../core/types.js").ToolExecuteContext.oneShot}: this run has no
@@ -821,7 +821,7 @@ export declare function createSubagentTool(opts: SubagentToolOptions): ToolSpec;
  * "All tools except …"; neither ⇒ "All tools". sema delta: `allowTools: ["*"]` is the documented
  * allow-everything sentinel (AgentDefinition.allowTools) — treated as NO allowlist, not a literal list.
  *
- * [901] deliberate: this renders the AUTHORED list raw — upstream's listing does too (gHm reads the
+ * deliberate: this renders the AUTHORED list raw — upstream's listing does too (gHm reads the
  * definition; the unknown-item split happens later, at spawn, in its resolveAgentTools). It is the
  * DECLARED boundary, NOT the effective child roster: an unknown entry may appear here while the
  * spawn-time filter (resolveToolSubset — the authority) drops it, and an alias-form divergence can

package/dist/agents/team.d.ts

@@ -1,5 +1,5 @@
 import type { Runner } from "../core/runner/runtask.js";
-import type { McpServerSpec, ModelRef, ModelRole, TaskResult, ToolSpec } from "../core/types.js";
+import type { McpServerSpec, ModelRef, ModelRole, TaskResult, TaskSpec, ToolSpec } from "../core/types.js";
 export interface TeamMember {
     /** The member's role / specialty, e.g. "安全评审" or "performance". */
     role: string;
@@ -45,7 +45,7 @@ export type TeamEvent = {
     role: string;
     text: string;
 }
-/** [571]③ budget axes: the cumulative team budget was exhausted after this member's turn settled —
+/** budget axes: the cumulative team budget was exhausted after this member's turn settled —
  *  remaining rounds/members are skipped and the discussion goes straight to synthesis. */
  | {
     type: "budget_stop";
@@ -99,12 +99,21 @@ export interface TeamDiscussionOptions {
         denyTools?: string[];
         mcp?: McpServerSpec[];
     };
+    /**
+     * Per-model auth — MIRRORS {@link TaskSpec.getApiKeyAndHeaders} (forwarded into every member /
+     * summary / synthesizer run, which resolve it against their own resolved models). Without this
+     * seat a team whose member/synthesizer models live on per-model-credential routes had NO way to
+     * carry the resolver: every nested run fell to the brain's construction-time credential, which the
+     * key↔URL pairing gate refuses off the deployment root — the teacher/verify delegation family
+     * carries the same seat for the same reason.
+     */
+    getApiKeyAndHeaders?: TaskSpec["getApiKeyAndHeaders"];
     /** Progress callback. */
     onEvent?: (e: TeamEvent) => void;
     /**
      * `maxWalltimeMs`/`maxTurns` are PER-RUN caps forwarded to every member/summary/synthesizer run.
      *
-     * `maxTokens`/`maxCostUsd` ([571]③, CollabTemplate.budget mid-flight enforcement) are CUMULATIVE
+     * `maxTokens`/`maxCostUsd` (CollabTemplate.budget mid-flight enforcement) are CUMULATIVE
      * team budgets over member + summary + synthesizer spend (nested/delegated spend included, same
      * coordinate as the `stats` totals). Enforcement is checked after each member turn settles and is
      * booked — the crossing member is never killed in flight — and once a budget is exhausted
@@ -167,7 +176,7 @@ export interface TeamResult {
      *  conclusion — so callers can tell a junk conclusion from a legitimate one. */
     conclusionValid: boolean;
     transcript: TeamTurn[];
-    /** `costMicroUsd` ([571]③): cumulative team LLM spend in integer micro-USD (member + summary +
+    /** `costMicroUsd`: cumulative team LLM spend in integer micro-USD (member + summary +
      *  synthesizer, nested included) — the same engine coordinate as `TaskResult.stats.costMicroUsd`.
      *  Always set (0 when no run reported cost); optional only for type-level back-compat. */
     stats: {
@@ -176,7 +185,7 @@ export interface TeamResult {
         costMicroUsd?: number;
     };
     /**
-     * [571]③ budget-stop attribution: set when a cumulative budget axis was exhausted and the
+     * budget-stop attribution: set when a cumulative budget axis was exhausted and the
      * discussion stopped dispatching further members/rounds early. `round`/`role`/`memberIndex`
      * identify the LAST member turn that ran (the one whose settled totals crossed the budget);
      * everything scheduled after it was skipped and the transcript went straight to synthesis.
@@ -193,7 +202,7 @@ export interface TeamResult {
     failures: number;
     /** How many times the shared transcript was summarized to stay under maxTranscriptTokens. */
     transcriptCompactions: number;
-    /** design/80 D-B (codex review): set when a member durably PAUSED (suspended/needs_review) on a HITL gate —
+    /** design/80 D-B: set when a member durably PAUSED (suspended/needs_review) on a HITL gate —
      *  the discussion STOPS (no synthesis on a half-done team) and surfaces the resume capability so the caller
      *  can resume the paused member via the token, then re-run. `conclusionValid` is false in this case. */
     durablePause?: boolean;

package/dist/agents/team.js

@@ -117,6 +117,7 @@ export async function runTeamDiscussion(opts) {
                 limits: memberLimits,
                 signal: opts.signal,
                 ...(opts.principal !== undefined ? { principal: opts.principal } : {}),
+                ...(opts.getApiKeyAndHeaders !== undefined ? { getApiKeyAndHeaders: opts.getApiKeyAndHeaders } : {}),
             }, { isDelegatedChild: true });
             tokens += res.stats.tokens + (res.stats.nested?.tokens ?? 0);
             turns += res.stats.turns + (res.stats.nested?.turns ?? 0);

package/dist/agents/tool-filter.d.ts

@@ -13,10 +13,10 @@ import type { ToolSpec } from "../core/types.js";
  * newly-added sensitive tool to every agent. Names not present in the pool are ignored (no error) — an
  * allow/deny list is a filter over what's available, not an assertion that those tools exist.
  *
- * [901] anchor ruling (dual-leg verified, adversarially reviewed): this spawn-time item-level filter IS
+ * anchor ruling (dual-leg verified, adversarially reviewed): this spawn-time item-level filter IS
  * the upstream shape for allow entries — CC's resolveAgentTools partitions unknown names into an
  * `invalidTools` bucket nobody consumes at runtime (88 readable source), and a live 2.1.207 probe shows
- * the agent stays listed/delegable with the unknown item silently dropped, zero warnings. The [876]
+ * the agent stays listed/delegable with the unknown item silently dropped, zero warnings. The
  * "rejected at startup" posture this replaced had no verbatim anchor and did not survive verification.
  * The asymmetric prepare-time fail-loud for `TaskSpec.agents` DENY entries is a deliberate sema
  * extension (no upstream deny-list exists): an allow-typo silently narrows (safe direction), a

package/dist/agents/verify.d.ts

@@ -25,7 +25,7 @@ import type { ModelRef, TaskResult, TaskSpec, ToolSpec } from "../core/types.js"
  * orthogonal to and composable with the Stop hook (wire the verdict into a stop() hook to make it a
  * hard completion gate).
  *
- * DEPLOYMENT POSTURE (clay 裁定 2026-07-14): opt-in library primitive ONLY — never a scenario default,
+ * DEPLOYMENT POSTURE (ruled 2026-07-14): opt-in library primitive ONLY — never a scenario default,
  * never deployed implicitly. It is a **thin composition** over existing core seams — a verifier subtask
  * (own model role), a read-only tool set (via tool `effect`), {@link TaskSpec.outputSchema} for the
  * verdict, and the teacher-style fix loop — so it adds no Runner-core surface. Off by default; opt in