@sema-agent/core 5.56.0 → 5.58.0

package/dist/core/exec-output-tail.d.ts

@@ -6,7 +6,7 @@
  * what the model needs) — dropping the head as it overflows, plus a count of dropped bytes for a visible marker.
  *
  * This lives in `src/core/` — NOT `src/vendor/` — on purpose: it is OUR robustness invariant, shared by the
- * (currently-vendored) NodeExecutionEnv AND a downstream exec adapter (service host/ssh/adb/docker/k8s, [267]).
+ * (currently-vendored) NodeExecutionEnv AND a downstream exec adapter (service host/ssh/adb/docker/k8s).
  * One implementation + ONE model-facing marker text = zero drift, and the public export points at a STABLE path
  * that survives the planned de-vendoring (when NodeExecutionEnv is naturalized out of `src/vendor/`, nothing rebinds).
  */
@@ -35,18 +35,18 @@ export declare class RollingTailBuffer {
         text: string;
         droppedBytes: number;
     };
-    /** RB-234 ([1937]): the retained window's RAW bytes — cursor slicing must happen in the byte domain
+    /** RB-234: the retained window's RAW bytes — cursor slicing must happen in the byte domain
      *  (re-encoding a lossily-decoded string inflates every invalid byte to a 3-byte U+FFFD and lands
      *  byte cursors on the wrong offsets). */
     bytes(): Buffer;
-    /** RB-234 ([1937]): head-eviction count ALONE — the retention window is [headDroppedBytes, pushed-total)
+    /** RB-234: head-eviction count ALONE — the retention window is [headDroppedBytes, pushed-total)
      *  in the accepted-byte domain; source skips must not shift this origin. */
     headDroppedBytes(): number;
-    /** RB-234 ([1937]): source-skip count alone (see {@link recordSkippedBytes}) — poll disclosure reports
+    /** RB-234: source-skip count alone (see {@link recordSkippedBytes}) — poll disclosure reports
      *  the per-poll increment of this figure instead of silently absorbing it into the window origin. */
     sourceSkippedBytes(): number;
 }
-/** RB-234 ([1937]): per-stream cursor state for incremental (poll-style) consumption of a
+/** RB-234: per-stream cursor state for incremental (poll-style) consumption of a
  *  {@link RollingTailBuffer}. All counters live in the ACCEPTED-byte domain (bytes actually pushed);
  *  source skips are tracked separately for disclosure. Module-level export (not on the package
  *  surface) so the slice arithmetic is unit-pinnable without an 8MB integration harness. */
@@ -65,7 +65,7 @@ export interface StreamCursorState {
 /** Fresh cursor state over a new tail. */
 export declare function newStreamCursorState(tail?: RollingTailBuffer): StreamCursorState;
 /**
- * RB-234 ([1937]): slice the undelivered increment out of a rolling tail — in the BYTE domain, decoded
+ * RB-234: slice the undelivered increment out of a rolling tail — in the BYTE domain, decoded
  * incrementally. Replaces the former decode→re-encode→byte-offset-subarray shape, which mixed two
  * domains: byte cursors landed inside a re-encoded string whose length differs from the raw stream as
  * soon as any invalid-UTF-8 byte sits in the window (each inflates to a 3-byte U+FFFD), making every

package/dist/core/file-snapshot-store.d.ts

@@ -1,5 +1,5 @@
 /** rel path of `child` under `root` in "/" form (win root) / verbatim form (posix root); null when not under.
- *  codex 1.237 F7: fold "\" only under a WIN-family root ({@link isWinFormPath}); a POSIX tree may legally
+ *  fold "\" only under a WIN-family root ({@link isWinFormPath}); a POSIX tree may legally
  *  contain literal backslashes in FILE NAMES, and folding them corrupted both the manifest key and the
  *  restore target. */
 declare function relUnder(root: string, child: string): string | null;
@@ -41,20 +41,20 @@ export interface FileSnapshotStore {
     reap(scope: string, keepKeys: string[]): Promise<number>;
     /** Every snapshot key in `scope` (order unspecified). The enumeration counterpart of {@link reap} (which
      *  already iterates the same set internally) — exposed for a cross-backend session EXPORT (service 2c
-     *  session-sync, [266]): list a session's snapshot keys to move its {entries + file snapshots} to another
+     *  session-sync): list a session's snapshot keys to move its {entries + file snapshots} to another
      *  backend. A durable backend implements it as a `SELECT key WHERE scope = ?`. */
     listKeys(scope: string): Promise<string[]>;
     /**
-     * 2c session-sync ([271]): the manifest (`relPath → blobHash`) for `(scope, key)`, or `null` if absent — to
+     * 2c session-sync: the manifest (`relPath → blobHash`) for `(scope, key)`, or `null` if absent — to
      * EXPORT a snapshot's content to another backend. Pairs with {@link getBlob} for CONTENT-ADDRESSED (deduped)
      * blob transfer: the caller fetches each distinct hash ONCE across all of a session's snapshots. Optional — a
      * backend that supports cross-backend snapshot export implements it.
      */
     exportManifest?(scope: string, key: string): Promise<Map<string, string> | null>;
-    /** 2c session-sync ([271]): the content-addressed bytes for `hash` (undefined if absent). */
+    /** 2c session-sync: the content-addressed bytes for `hash` (undefined if absent). */
     getBlob?(hash: string): Promise<Uint8Array | undefined>;
     /**
-     * 2c session-sync ([273]): STORE a snapshot INTO this store from another store's {@link exportManifest} +
+     * 2c session-sync: STORE a snapshot INTO this store from another store's {@link exportManifest} +
      * {@link getBlob} output — the import-side mirror that closes the cross-backend transfer loop. For each DISTINCT
      * blob hash in `manifest`, fetch its bytes via `srcGetBlob`, VERIFY content-address integrity
      * (`sha256(bytes) === hash`), and store it (content-addressed dedup); THEN record `(scope, key) → manifest`.
@@ -70,7 +70,7 @@ export interface FileSnapshotStore {
      */
     importManifest?(scope: string, key: string, manifest: Map<string, string>, srcGetBlob: (hash: string) => Promise<Uint8Array | undefined>): Promise<FileSnapshotResult>;
     /**
-     * 2c session-sync ([277]): STORE a single content-addressed blob — the symmetric WRITE side of {@link getBlob},
+     * 2c session-sync: STORE a single content-addressed blob — the symmetric WRITE side of {@link getBlob},
      * for a two-phase PUSH (upload blobs, THEN import the manifest that references them). VERIFIES content-address
      * integrity (`sha256(bytes) === hash`) so a corrupt/mismatched upload can never contaminate the store (a later
      * getBlob/restore would otherwise return wrong content); a mismatch → `read_failed`, nothing stored. IMMUTABLE +
@@ -105,7 +105,7 @@ export declare const DEFAULT_SNAPSHOT_BOUNDS: FileSnapshotBounds;
  * bugs the dual-review fixed). Fail-CLOSED: an enumerate/read/bound failure returns an error and the caller must
  * NOT persist a partial manifest. Never throws.
  *
- * [789] vanished-file tolerance: a file that DISAPPEARED between enumerate and read (`not_found`) is OMITTED
+ * vanished-file tolerance: a file that DISAPPEARED between enumerate and read (`not_found`) is OMITTED
  * from the manifest instead of failing the whole capture. This is semantically SAFE — the E19 snapshot runs
  * concurrently with a live tree (the `done` frame is emitted BEFORE the snapshot, so shell-side per-turn
  * markers, `.git/index.lock`, editor swap files etc. legitimately vanish mid-walk), and omitting a
@@ -128,7 +128,7 @@ export declare function captureManifest(env: ExecutionEnv, root: string, bounds:
 }>;
 /**
  * CONVERGE the tree under `root` to `manifest`, loading each captured file's bytes via `getBlob`. **The
- * env-operating + security-critical half a durable backend MUST reuse.** Order is load-bearing (codex BLOCKER +
+ * env-operating + security-critical half a durable backend MUST reuse.** Order is load-bearing (+
  * Opus M1): PHASE 1 removes every current symlink (neutralizes a `dir -> /outside` ancestor that writeFile would
  * otherwise follow OUT of root) + every file created since; PHASE 2 writes each captured file, clearing a
  * directory that now occupies a file's path first. Never throws.

package/dist/core/git-worktree-env.d.ts

@@ -23,8 +23,8 @@ export interface AddWorktreeOptions {
  * when its `ctx.isolation === "worktree"` and returns the result (with `destroy`); for a non-isolated task it
  * returns the SHARED base env (no `destroy`) so the Runner never tears the base down.
  *
- * ISOLATE-ONLY (clay): the runtime never merges — the orchestrator script reads each worktree's result and
- * decides verify/merge in userland. Caveats (codex review): `git worktree` isolates the git WORKING COPY, not
+ * ISOLATE-ONLY: the runtime never merges — the orchestrator script reads each worktree's result and
+ * decides verify/merge in userland. Caveats: `git worktree` isolates the git WORKING COPY, not
  * arbitrary shell access (bash can still reach the host — sandbox separately); UNCOMMITTED changes in the base
  * repo are absent in the child (detached HEAD); a worktree orphaned by a process crash is reaped by
  * {@link pruneWorktrees} (userland — there is no Runner hook for post-kill cleanup).
@@ -41,7 +41,7 @@ export declare function addWorktree(baseEnv: ExecutionEnv, opts: AddWorktreeOpti
  *  HRD-PTL-11: the exec Result used to be discarded, so every caller had to ASSUME the prune landed — and
  *  ExitWorktree's "already gone externally" leg told the model "stale git worktree metadata was pruned"
  *  on a claim it could not have checked. Same fail-loud treatment {@link removeWorktree} already got
- *  (server [1796]②): report the outcome, let the caller decide what to say. Never throws (a throwing env
+ *  Report the outcome, let the caller decide what to say. Never throws (a throwing env
  *  lands on the same `{ok:false}`), so a caller that ignores the value behaves exactly as before. */
 export declare function pruneWorktrees(baseEnv: ExecutionEnv, repoRoot: string): Promise<{
     ok: true;

package/dist/core/governance-codes.js

@@ -17,11 +17,13 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.session_polluted",
     "memory.harvest_quarantined",
     "memory.delegation_static_mark_waived",
+    "memory.consolidation_driver_superseded",
     "memory.challenge_sweep_failed",
     "memory.lineage_settle_failed",
     "memory.challenge_ledger_corrupt",
     "memory.consolidation_recommended",
     "memory.consolidation_committed",
+    "memory.consolidation_incomplete",
     "memory.consolidation_conflict",
     "memory.consolidation_refused",
     "memory.consolidation_disabled",

package/dist/core/hooks.d.ts

@@ -161,7 +161,7 @@ export interface Hooks {
      */
     stopFailure?(ctx: StopFailureContext): void | Promise<void>;
     /**
-     * design/134 R5 (CC PermissionDenied parity, SDK 0.3.202 — service [418]③): runs when the tool gate's
+     * design/134 R5 (CC PermissionDenied parity, SDK 0.3.202): runs when the tool gate's
      * adjudicate chain DENY-SHORT-CIRCUITS a tool call — a ToolPolicy deny, a gate tighten (egress /
      * irreversibility / coarse shellGate) whose `ask` resolved to deny (headless auto-deny included), or the
      * plan-mode write-deny. Closes the observation blind spot where a blocked call fires NEITHER postToolUse
@@ -525,7 +525,7 @@ export interface StopHookContext {
     /** Consecutive blocks so far in this run (resets when a stop() call lets the run proceed). */
     consecutiveBlocks: number;
     /**
-     * RB-177 ([1730], measured downstream) — a view of the conversation this hook is being asked to judge.
+     * RB-177 (measured downstream) — a view of the conversation this hook is being asked to judge.
      *
      * Until now a Stop hook received two counters and nothing else. That is enough for a hook that asks
      * "have I blocked too often?", and structurally insufficient for the entire class of hooks that ask
@@ -732,7 +732,7 @@ export interface HookInvocationIdentity {
  * other absence-signaling face this module mints — "absent member" must be a fact about THIS object,
  * and a frozen object with an ordinary prototype still answers `insideFork`/`agentName` reads (and
  * `in` probes) from `Object.prototype`, so a prototype write elsewhere in the process could hand
- * every leg a delegation axis the mint never stamped (codex r1). `agentName` is sanitized here — it
+ * every leg a delegation axis the mint never stamped. `agentName` is sanitized here — it
  * is the only member whose value a model influences.
  */
 export declare function mintHookInvocationIdentity(facts: HookInvocationIdentity): HookInvocationIdentity;
@@ -986,20 +986,33 @@ export type OrgGateVerdict = {
     /** The overlay's own disclosure lines (engine/deployment-authored), for the operator channel. */
     disclosures: readonly string[];
 };
+/** One member of a {@link PersistedRuleHit} coverage set: a rule's canonical text plus (optionally)
+ *  its add-dot identity. */
+export interface PersistedRuleHitRule {
+    /** The canonical text of one admitting rule. */
+    readonly rule: string;
+    /** The rule's LIVE add dots (tombstoned adds already filtered by the store's read). Omitted by a
+     *  lane that has the text but not the dots; the evidence then reports `"not_reported"`. */
+    readonly dots?: readonly import("./permission-rule-model.js").RuleDot[];
+}
 /**
- * design/252 G-2 — the richer answer a persisted-rule lane may give instead of the bare rule text (see
- * `ToolGateInput.persistedRules.admits`): the same canonical text, plus the matched rule's add dots.
+ * design/252 G-2, re-formed by design/375 (BREAKING) — the structured answer a persisted-rule lane
+ * gives: the COVERAGE SET that admits the call. A single rule admitting the whole command is a
+ * one-element set (the historical case); a compound admitted by the conjunction of per-segment rules
+ * (design/375 §5.1) is the set of those rules, in segment order. `rules` is non-empty by contract —
+ * an empty set covers nothing and is not a hit (the normalizer reads it as a clean negative).
  *
- * Why the dots and not an id: a persisted allow rule HAS no scalar id — it is a (text, scope) group
- * whose identity is the set of add dots that redeemed it, and two concurrently approved records for one
- * text each carry their own. The set is the identity; a joined string would not be one.
+ * Why dots and not an id: a persisted allow rule HAS no scalar id — it is a (text, scope) group whose
+ * identity is the set of add dots that redeemed it, and two concurrently approved records for one text
+ * each carry their own. The set is the identity; a joined string would not be one.
+ *
+ * The pre-375 single-rule object shape (`{ rule, dots? }`) is NOT accepted: on this loosening seam an
+ * unrecognized answer degrades to a clean negative (more asks), never to a match — the safe failure
+ * shape for a lane that missed the same-window upgrade.
  */
 export interface PersistedRuleHit {
-    /** The canonical text of the admitting rule — the same value the bare-string shape returns. */
-    readonly rule: string;
-    /** The matched rule's LIVE add dots (tombstoned adds already filtered by the store's read). Omitted
-     *  by a lane that has the text but not the dots; the evidence then reports `"not_reported"`. */
-    readonly dots?: readonly import("./permission-rule-model.js").RuleDot[];
+    /** The coverage set — every rule the decision stands on. Non-empty. */
+    readonly rules: readonly PersistedRuleHitRule[];
 }
 /**
  * design/252 G-2 — the answer a lane gives when it could not READ its store.
@@ -1014,8 +1027,20 @@ export interface PersistedRuleHit {
 export interface PersistedRuleUnreadable {
     readonly unreadable: true;
 }
+/**
+ * design/375 §5.2② — the CLEAN NEGATIVE that still carries the per-segment coverage table: no rule
+ * admits the whole call, and THESE segments are the ones an eligible rule already covers. Minted by
+ * the lane from the SAME store read that adjudicated the call (snapshot = adjudication snapshot, no
+ * second read), and consumed only by the suggestion face — which puts on the batch offer exactly the
+ * segments this table calls uncovered. Its DECISION meaning is identical to "no rule": the seat is
+ * advisory, and a lane that omits it (or an unreadable one) degrades to all-uncovered, which merely
+ * over-offers (every offered rule still passes the validator at redemption).
+ */
+export interface PersistedRuleCoverage {
+    readonly segmentCoverage: readonly import("./permission-rule-model.js").SegmentCoverage[];
+}
 /** Every shape a lane may answer with. A bare string stays valid and unchanged. */
-export type PersistedRuleAnswer = string | PersistedRuleHit | PersistedRuleUnreadable | undefined;
+export type PersistedRuleAnswer = string | PersistedRuleHit | PersistedRuleCoverage | PersistedRuleUnreadable | undefined;
 /**
  * design/252 review r3 — read a foreign {@link OrgGateVerdict} the way the personal-rule answer is read:
  * OWN DATA properties only, never the prototype chain, never an accessor.
@@ -1044,9 +1069,15 @@ export declare function normalizeOrgGateVerdict(answer: unknown, unreadable: str
  * Normalize the accepted {@link ToolGateInput.persistedRules} answers into one reading.
  *
  * `{}` = a clean negative (no rule admits this call). `{ unreadable: true }` = the lane could not read
- * its source. `{ hit }` = a match. An answer outside every accepted shape — a number, `null`, an object
- * with no `rule` — is read as a clean negative rather than a match: this is a LOOSENING seam, so an
- * answer nobody can name degrades toward asking, never toward an allow built on it.
+ * its source. `{ hit }` = a match, whose `rules` is the non-empty coverage set (design/375). An answer
+ * outside every accepted shape — a number, `null`, an object with neither `rules` nor `unreadable`, an
+ * EMPTY `rules` array, the retired pre-375 `{ rule, dots? }` single-rule object — is read as a clean
+ * negative rather than a match: this is a LOOSENING seam, so an answer nobody can name degrades toward
+ * asking, never toward an allow built on it. All-or-nothing across the set's TEXTS for the same
+ * reason: a set with one unreadable member is a different (smaller) claim than the lane made, and a
+ * decision must not stand on a claim nobody made — one bad member drops the whole answer to the clean
+ * negative. Per-member DOTS stay individually optional (identity lost ⇒ `"not_reported"`, exactly the
+ * single-rule contract).
  *
  * The hit's dots are COPIED, not aliased. The array travels onto an ask that may sit in front of a
  * person for a long time; a lane that retains and mutates its own array would otherwise change what the
@@ -1055,6 +1086,7 @@ export declare function normalizeOrgGateVerdict(answer: unknown, unreadable: str
 export declare function normalizePersistedRuleHit(hit: PersistedRuleAnswer): {
     hit?: PersistedRuleHit;
     unreadable?: true;
+    coverage?: readonly import("./permission-rule-model.js").SegmentCoverage[];
 };
 /** Inputs to the two-phase tool gate. `adjudicate`/`resolveAsk` are pre-bound to the task abort signal. */
 export interface ToolGateInput {
@@ -1104,7 +1136,7 @@ export interface ToolGateInput {
     /** The combined tool-policy check (abort-bound), or undefined when no policy is wired (→ allow). */
     adjudicate?: (req: ToolCallRequest) => Promise<PermissionResult>;
     /** Resolve an `ask` to allow/deny via `onAsk` (abort-bound). Required iff a decision can be `ask`.
-     *  G1 three-value ([871]①): the result may carry `approverUnavailable` — the live approver affirmed no
+     *  G1 three-value: the result may carry `approverUnavailable` — the live approver affirmed no
      *  operator is reachable for THIS ask; the gate then re-routes onto the durable park leg (below),
      *  keeping the carried fail-closed deny when no park is armed. */
     resolveAsk: (decision: PermissionResult, req: ToolCallRequest) => Promise<ResolvedAsk>;
@@ -1163,7 +1195,11 @@ export interface ToolGateInput {
     probeReason?: string, 
     /** backlog #239: the STRUCTURED cause (the surviving ask's `probeCause`) — same durable-route errand
      *  as `probeReason`, already validated at the gate. */
-    probeCause?: import("./checkpoint-store.js").ProbeCause) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
+    probeCause?: import("./checkpoint-store.js").ProbeCause, 
+    /** design/375 §5.2②: the surviving ask's engine-stamped `segmentCoverage` — threaded so the park
+     *  mint's offer factory reads the same coverage snapshot on the durable route as the synchronous
+     *  mints read off the decision (absent ⇒ all segments uncovered ⇒ over-offer, the safe way). */
+    segmentCoverage?: readonly import("./permission-rule-model.js").SegmentCoverage[]) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
     /**
      * design/174 — route a policy `ask` on the reserved question tool to this run's CONTENT-ask channel
      * before it can become a park or a refusal. Called in the `ask` branch with the FINAL post-hook,
@@ -1268,7 +1304,7 @@ export interface ToolGateInput {
      */
     writeProtectionCheck?: (toolName: string, args: unknown) => import("./write-protect.js").WriteProtectedHit | null;
     /**
-     * design/143 批2 ([672]-A, CC 2.1.207 auto mode): when present, a surviving `ask` is routed to the
+     * design/143 批2 (A, CC 2.1.207 auto mode): when present, a surviving `ask` is routed to the
      * small-model policy CLASSIFIER before any human/durable resolution:
      *  - verdict `allow` → the ask resolves to allow (`decisionReason:"classifier"`) — no suspend, no onAsk;
      *  - verdict `block` → deny (`decisionReason:"classifier"`, `source:"classifier"`; CC `automode-blocked`);
@@ -1337,22 +1373,26 @@ export interface ToolGateInput {
      * bullets above are what keep integrity/hook/mandated asks out of that set.
      */
     persistedRules?: {
-        /** The rule that admits this call, or `undefined`. Must not throw: a store that cannot be read
-         *  answers "no rule" and discloses on its own channel (fail-closed = more asks).
+        /** The rule COVERAGE that admits this call, or `undefined`. Must not throw: a store that cannot
+         *  be read answers "no rule" and discloses on its own channel (fail-closed = more asks).
          *
-         *  TWO ACCEPTED SHAPES (design/252 G-2, additive — a lane returning the bare string is unchanged
-         *  and stays supported): the canonical rule TEXT, or a {@link PersistedRuleHit} carrying that same
-         *  text plus the matched rule's add DOTS. The dots are the rule's durable identity, and the text
-         *  is not one (it reaches a card sanitized and capped); a lane that can name them lets the
-         *  shadowed-ask evidence say WHICH stored rule matched rather than merely what it looked like.
-         *  Widening the RETURN is why this is additive for implementers: every existing lane satisfies
-         *  the union unchanged, and the gate reads both through one normalizer. */
+         *  TWO ACCEPTED SHAPES (design/252 G-2 / design/375 BREAKING): the canonical rule TEXT (a
+         *  single-rule hit with no identity), or a {@link PersistedRuleHit} carrying the coverage SET —
+         *  each member's canonical text plus its add DOTS. A single rule admitting the whole command is a
+         *  one-element set; a compound admitted by the per-segment conjunction (design/375 §5.1) is the
+         *  set of the covering rules. The dots are a rule's durable identity, and the text is not one (it
+         *  reaches a card sanitized and capped); a lane that can name them lets the shadowed-ask evidence
+         *  say WHICH stored rules matched rather than merely what they looked like. The retired pre-375
+         *  single-rule object shape (`{ rule, dots? }`) is read as a clean negative by the normalizer —
+         *  a stale lane degrades toward asking, never toward an allow. */
         admits: (req: ToolCallRequest) => Promise<PersistedRuleAnswer>;
-        /** Observation sink for an ask a rule resolved — the allow-side disclosure. Never affects the outcome. */
+        /** Observation sink for an ask a rule coverage resolved — the allow-side disclosure. `rules` is
+         *  the coverage set's canonical texts in reporting order (design/375: a conjunction names every
+         *  rule the decision stands on). Never affects the outcome. */
         onResolved?: (info: {
             toolName: string;
             toolCallId: string;
-            rule: string;
+            rules: readonly string[];
         }) => void;
     };
     /**
@@ -1380,7 +1420,7 @@ export interface ToolGateInput {
         /** True iff the reserved question-tool NAME on this leg resolves to the ENGINE's own content-ask
          *  tool. It is the exemption's real predicate: the name alone is not, because a caller may mount
          *  its own tool under that name when the first-party one is not mounted, and such a tool has
-         *  arbitrary side effects (codex review, confirmed MED). Absent ⇒ `false` ⇒ the call is governed
+         *  arbitrary side effects (confirmed MED). Absent ⇒ `false` ⇒ the call is governed
          *  like any other, which is the fail-closed default. */
         contentAskToolMounted?: boolean;
         /** Disclosure sink for the unavailable arm (trace `permission.org_snapshot_unavailable`). Never
@@ -1398,7 +1438,7 @@ export interface ToolGateInput {
      * checkpoint store that explicitly declares `redecision.reopen`). Absent ⇒ the whole step does not
      * exist and the decision path is byte-identical to a build without it.
      *
-     * Semantics (clay's ruling): inside a declared sandbox, an engine-authored "confirm a potentially
+     * Semantics (the ruling): inside a declared sandbox, an engine-authored "confirm a potentially
      * destructive local action" ask is answered by containment itself — auto-allow + durable
      * disclosure (`permission.sandbox_admitted`), never a headless deny that pollutes the model.
      * STRICT dominance governs: the leg admits only when EVERY surviving ask on the call is classified

package/dist/core/hooks.js

@@ -253,17 +253,7 @@ export function normalizeOrgGateVerdict(answer, unreadable) {
         return clean({ status: "unavailable", disclosures: [unreadable] });
     return clean({ status: "available", verdict: clean({ behavior: behavior, rule }), ...revisionCell });
 }
-export function normalizePersistedRuleHit(hit) {
-    if (typeof hit === "string")
-        return { hit: { rule: hit } };
-    if (!isPlainOwnRecord(hit))
-        return {};
-    if (ownDataValue(hit, "unreadable") === true)
-        return { unreadable: true };
-    const rule = ownDataValue(hit, "rule");
-    if (typeof rule !== "string")
-        return {};
-    const dots = ownDataValue(hit, "dots");
+function copiedUsableDots(dots) {
     let copied;
     try {
         if (Array.isArray(dots)) {
@@ -279,7 +269,53 @@ export function normalizePersistedRuleHit(hit) {
         copied = undefined;
     }
     const usable = copied?.every((d) => typeof d.actor === "string" && typeof d.counter === "number" && Number.isFinite(d.counter)) === true && copied.length > 0;
-    return { hit: { rule, ...(usable ? { dots: copied } : {}) } };
+    return usable ? { dots: copied } : {};
+}
+export function normalizePersistedRuleHit(hit) {
+    if (typeof hit === "string")
+        return { hit: { rules: [{ rule: hit }] } };
+    if (!isPlainOwnRecord(hit))
+        return {};
+    if (ownDataValue(hit, "unreadable") === true)
+        return { unreadable: true };
+    const rulesRaw = ownDataValue(hit, "rules");
+    if (rulesRaw === undefined) {
+        const coverageRaw = ownDataValue(hit, "segmentCoverage");
+        let rows;
+        try {
+            if (Array.isArray(coverageRaw)) {
+                const walked = [];
+                for (let i = 0; i < coverageRaw.length; i++) {
+                    const r = coverageRaw[i];
+                    walked.push(isPlainOwnRecord(r) ? { segment: ownDataValue(r, "segment"), covered: ownDataValue(r, "covered") } : { segment: undefined, covered: undefined });
+                }
+                rows = walked.every((r) => typeof r.segment === "string" && typeof r.covered === "boolean") ? walked : undefined;
+            }
+        }
+        catch {
+            rows = undefined;
+        }
+        return rows !== undefined && rows.length > 0 ? { coverage: rows.map((r) => ({ segment: r.segment, covered: r.covered })) } : {};
+    }
+    let members;
+    try {
+        if (Array.isArray(rulesRaw)) {
+            const walked = [];
+            for (let i = 0; i < rulesRaw.length; i++) {
+                const m = rulesRaw[i];
+                walked.push(isPlainOwnRecord(m) ? { rule: ownDataValue(m, "rule"), dots: ownDataValue(m, "dots") } : { rule: undefined, dots: undefined });
+            }
+            members = walked;
+        }
+    }
+    catch {
+        members = undefined;
+    }
+    if (members === undefined || members.length === 0)
+        return {};
+    if (!members.every((m) => typeof m.rule === "string"))
+        return {};
+    return { hit: { rules: members.map((m) => ({ rule: m.rule, ...copiedUsableDots(m.dots) })) } };
 }
 function preToolUseCrashReason(subject, err) {
     const raw = err instanceof Error ? err.message.trim() || err.name : String(err);
@@ -672,6 +708,7 @@ export async function runToolGate(input) {
         }
         const persistedRuleMandate = persistedRuleMandateOf(input);
         let personalEvidence = { dotsAbsent: input.persistedRules === undefined ? "not_wired" : "not_adjudicated" };
+        let laneCoverage;
         if (input.persistedRules &&
             !orgRealApprovalRequired &&
             decision.action === "ask" &&
@@ -689,21 +726,44 @@ export async function runToolGate(input) {
                 }
                 return await settleOrgVerdictWithin(pendingHit.then(normalizePersistedRuleHit).catch(() => ({ unreadable: true })), { unreadable: true }, { ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
             })();
-            const hitEntry = answer.hit;
-            const hit = hitEntry?.rule;
+            const hitRules = answer.hit?.rules;
+            laneCoverage = answer.coverage;
             personalEvidence = { dotsAbsent: answer.unreadable === true ? "unavailable" : "no_match" };
-            if (hit !== undefined && persistedRuleMandate === undefined && decision.matchedAskRule === undefined) {
+            const disclosedRuleSet = (rules) => {
+                const shown = rules.slice(0, 5).map((r) => inlineUntrusted(r.rule, 200));
+                const rest = rules.length - shown.length;
+                return rest > 0 ? `${shown.join(", ")} and ${rest} more` : shown.join(", ");
+            };
+            const unionDotsOf = (rules) => {
+                const seen = new Set();
+                const union = [];
+                for (const r of rules) {
+                    if (r.dots === undefined || r.dots.length === 0)
+                        return { dotsAbsent: "not_reported" };
+                    for (const d of r.dots) {
+                        const key = JSON.stringify([d.actor, d.counter]);
+                        if (!seen.has(key)) {
+                            seen.add(key);
+                            union.push(d);
+                        }
+                    }
+                }
+                return { dots: union };
+            };
+            if (hitRules !== undefined && persistedRuleMandate === undefined && decision.matchedAskRule === undefined) {
                 decision = {
                     action: "allow",
-                    message: `a persisted allow rule (${hit}) covers this call`,
+                    message: hitRules.length === 1
+                        ? `a persisted allow rule (${disclosedRuleSet(hitRules)}) covers this call`
+                        : `persisted allow rules (${disclosedRuleSet(hitRules)}) cover every segment of this call`,
                     decisionReason: "persisted_rule",
                     ...(policyRewrite !== undefined ? { updatedInput: policyRewrite } : {}),
                 };
-                await notifier.notifyAsync(() => input.persistedRules?.onResolved?.({ toolName: req.toolName, toolCallId, rule: hit }), "toolGate.persistedRuleResolved");
+                await notifier.notifyAsync(() => input.persistedRules?.onResolved?.({ toolName: req.toolName, toolCallId, rules: hitRules.map((r) => r.rule) }), "toolGate.persistedRuleResolved");
             }
-            else if (hit !== undefined) {
-                personalEvidence = hitEntry?.dots !== undefined && hitEntry.dots.length > 0 ? { dots: hitEntry.dots } : { dotsAbsent: "not_reported" };
-                const shownRule = inlineUntrusted(hit, 200);
+            else if (hitRules !== undefined) {
+                personalEvidence = unionDotsOf(hitRules);
+                const shownRule = disclosedRuleSet(hitRules);
                 const mandateNoun = persistedRuleMandate === "operator_always"
                     ? "this deployment mandates per-call confirmation for shell commands (shellGate: always)"
                     : persistedRuleMandate !== undefined
@@ -712,12 +772,14 @@ export async function runToolGate(input) {
                 decision = {
                     ...decision,
                     persistedRuleShadowed: shownRule,
-                    message: `${decision.message !== undefined ? `${decision.message} ` : ""}(a persisted allow rule (${shownRule}) matches this call but does not clear the ask — ${mandateNoun})`,
+                    message: hitRules.length === 1
+                        ? `${decision.message !== undefined ? `${decision.message} ` : ""}(a persisted allow rule (${shownRule}) matches this call but does not clear the ask — ${mandateNoun})`
+                        : `${decision.message !== undefined ? `${decision.message} ` : ""}(persisted allow rules (${shownRule}) match this call but do not clear the ask — ${mandateNoun})`,
                 };
             }
         }
         if (decision.action === "ask") {
-            decision = { ...decision, ruleEvidence: mintRuleEvidence(personalEvidence) };
+            decision = { ...decision, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}) };
         }
         if (input.autoMode &&
             !orgRealApprovalRequired &&
@@ -779,7 +841,7 @@ export async function runToolGate(input) {
             ? { origin: orgAskOrigin !== undefined ? `org_${orgAskOrigin}` : "policy" }
             : undefined;
         if (suspendAsk && decision.action === "ask") {
-            const suspended = await suspendAsk(req, currentInput, safety, undefined, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined);
+            const suspended = await suspendAsk(req, currentInput, safety, undefined, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined);
             if (suspended) {
                 if ("parkFailed" in suspended)
                     parkFailed = suspended.parkFailed;
@@ -798,7 +860,7 @@ export async function runToolGate(input) {
                     req.args = outcome.presentedInput;
                 }
                 if (suspendAsk && outcome.parkDeclined && parkFailed === undefined) {
-                    const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined);
+                    const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined);
                     if (suspended) {
                         if ("parkFailed" in suspended)
                             parkFailed = suspended.parkFailed;
@@ -830,7 +892,7 @@ export async function runToolGate(input) {
                 askDenyResolution = resolved.resolution;
             decision = resolved;
             if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk && parkFailed === undefined) {
-                const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined);
+                const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.segmentCoverage : undefined);
                 if (suspended) {
                     if ("parkFailed" in suspended)
                         parkFailed = suspended.parkFailed;

package/dist/core/image-downsample.d.ts

@@ -36,7 +36,7 @@ export declare const IMAGE_MAX_HEIGHT = 2000;
  * replaced by an explanatory text block with the size + path; a within-limit image passes through unchanged.
  */
 /**
- * Optional image-resize seam (design/116 review CONFIRM-1, clay 拍 2026-07-02 加 seam 保体验): given an
+ * Optional image-resize seam (design/116 review CONFIRM-1, 裁定 2026-07-02 加 seam 保体验): given an
  * over-limit image, return a smaller re-encoded one — or undefined when it can't. CC resizes with sharp
  * (imageResizer.ts: fit within 2000x2000, JPEG quality ladder) so the model still SEES a degraded image;
  * core must not hard-depend on a native image library, so the capability is injected (or auto-detected).

package/dist/core/locked-config.d.ts

@@ -46,7 +46,7 @@ export interface LockedPreflight {
      *  always enforced, resolved ONCE here. With `toolPolicy` locked, the deployment's own
      *  `deps.toolPolicy` is the whole answer (a spec-supplied policy has already been refused). */
     toolPolicy: ToolPolicy | undefined;
-    /** F-012 (codex round 8): the effective resume-edit re-adjudication OVERRIDE, resolved lock-aware in
+    /** F-012: the effective resume-edit re-adjudication OVERRIDE, resolved lock-aware in
      *  the SAME slot as {@link toolPolicy}. With `toolPolicy` locked, a spec-supplied
      *  `basePolicyForResumeEdit` has already been refused wholesale, so this is the deployment's own
      *  `deps.basePolicyForResumeEdit` (or undefined — the caller-policy fallback then applies at the use

package/dist/core/lsp.d.ts

@@ -50,7 +50,7 @@ export interface LspSymbolInfo {
     positionUnknown?: boolean;
 }
 /**
- * RB-232(黑板 [1937]): WHY a "none" result was "none". Absent `reason` = a GENUINE empty answer (the server
+ * RB-232: WHY a "none" result was "none". Absent `reason` = a GENUINE empty answer (the server
  * answered null/[] — today's behavior byte-for-byte, and what an external manager returning bare
  * `{kind:"none"}` keeps getting). The failure reasons exist because one literal "No results." used to cover
  * both real emptiness and every transport-level fault — a findReferences that TIMED OUT read as "no

package/dist/core/mailbox-store.d.ts

@@ -110,7 +110,7 @@ export interface MailboxStore {
         maxAgeMs?: number;
     }): Promise<number>;
 }
-/** RB-250② (2026-07-28, 黑板 [1937]) class fix — the box age for `reap` is the MAX `sentAt`, not the
+/** RB-250② (2026-07-28) class fix — the box age for `reap` is the MAX `sentAt`, not the
  *  last array element: `sentAt` is caller-supplied, so append order need not be time order, and taking
  *  the tail let a box whose freshest message was mid-array be swept — both bundled backends discarded
  *  a brand-new message while the CC adapter (stores/cc/mailbox-store.ts, the in-package reference)

package/dist/core/mcp.d.ts

@@ -209,7 +209,7 @@ export interface MaterializedMcp {
      */
     statuses: McpServerStatus[];
     /**
-     * [1605] RefreshMcpTools (CC 2.1.218 parity, cli-锚形) — re-read the tool list of one server (or
+     * RefreshMcpTools (CC 2.1.218 parity, anchored to the CLI form) — re-read the tool list of one server (or
      * every CONNECTED server when `server` is omitted) over the EXISTING connection. NEVER dials or
      * re-dials: a dead/never-connected server reports `not_connected`; a live listTools failure
      * reports `failed` (the connection is left as-is). A refreshed entry carries the NEW intake
@@ -225,7 +225,7 @@ export interface MaterializedMcp {
     refresh: (server?: string) => Promise<McpRefreshResult[]>;
     dispose: () => Promise<void>;
 }
-/** [1605] One per-server entry of {@link MaterializedMcp.refresh}. `added`/`removed` are namespaced
+/** One per-server entry of {@link MaterializedMcp.refresh}. `added`/`removed` are namespaced
  *  (`mcp__<server>__<tool>`) names; `tools`/`axes`/`dropped` are present only on `"refreshed"`.
  *  The model-facing refresh receipt renders each `dropped` entry with ITS OWN `reason` (schema
  *  gate, same-listing name collision, …) — never a blanket label; a consumer matching that receipt
@@ -654,7 +654,7 @@ export declare function listEntryFingerprint(entry: unknown): string | undefined
  * page cap — a bounded multiplier, not a new unbounded surface. Per-entry admission stays where it
  * already is (the intake schema gate, which also drops a name a later page repeats).
  *
- * TIME, the reason `budgetMs` exists (codex review, confirmed): the page cap bounds REQUESTS, not
+ * TIME, the reason `budgetMs` exists (confirmed): the page cap bounds REQUESTS, not
  * latency. Giving every page its own full request timeout would let a server that stalls each page hold
  * a connect (or a refresh) for up to twenty timeouts — twenty minutes at the SDK's 60s default, where
  * an unpaginated listing cost one. So the WALK gets the budget a single listing used to have: page one