@sema-agent/core 5.57.0 → 5.58.0

package/dist/core/permission-rule-model.d.ts

@@ -32,6 +32,12 @@
  * deny/ask layer (`permission-rule-org.ts`) judges every segment and runs ahead of the allow lane at
  * the gate — a compound-prefix allow can therefore never outrun a deny on any segment it admits.
  *
+ * design/375 adds upstream's OTHER half of that per-segment evaluation on the allow side: a compound
+ * whose EVERY segment is admitted by some eligible rule is covered by the CONJUNCTION of those rules
+ * (`findAdmittingRule` answers with the coverage SET). No single rule widens: the matcher predicates
+ * above are untouched, and the set form is the decision layer's answer, fenced by the same
+ * ahead-running per-segment deny/ask layer.
+ *
  * The floor is `parseLeadingCommandName` + `splitShellCompoundSegments` — the one simple-command parser
  * and the one segmentation, both already shared with the read-only classifier, the reversibility probe,
  * the coarse command-name policy and the skill tool specifier. A second tokenizer would drift, and drift
@@ -367,35 +373,181 @@ export declare function scopeCoversCwd(scope: RuleScope, cwd: string | undefined
  *  when tombstones are applied, so a rule with an empty `adds` is a rule that no longer exists. */
 export declare function isRuleLive(rule: PersistedAllowRule): boolean;
 /**
- * Find the rule that admits this command for a task in `cwd`, or `undefined`.
+ * design/375 §5.1 — MAY this rule speak about this call's CONTEXT? Tool identity plus scope coverage,
+ * and nothing about the rule's liveness: the CONTEXT question is the half a not-yet-persisted rule (a
+ * card's proposed candidate, which has no add dots yet) can already answer.
+ *
+ * The tool conjunct is not decoration: more than one tool takes a shell command string, and matching on
+ * the command alone would let an approval given on one surface resolve a call on another. The scope
+ * conjunct is the project fence — project A's approval is not project B's, and a project rule with no
+ * cwd to compare against covers nothing (fail-closed, {@link scopeCoversCwd}).
  *
- * Order is defined only for reporting (the first match wins and its text is what the decision names);
- * no rule is stronger than another — they are all the same one answer, "the person already said yes to
- * this".
+ * `scope` rides beside the rule rather than inside it for the PROPOSED half's sake: a
+ * {@link ParsedAllowRule} carries no scope, so a proposal is judged against the scope it would LAND in.
+ */
+export declare function eligibleContext(rule: {
+    tool: string;
+    scope: RuleScope;
+}, call: {
+    tool: string;
+    cwd: string | undefined;
+}): boolean;
+/**
+ * design/375 §5.1 — MAY this PERSISTED rule participate in admitting this call at all? The liveness
+ * layer on top of {@link eligibleContext}: a tombstoned rule (zero surviving adds) is a rule that no
+ * longer exists and must not count as coverage anywhere.
+ *
+ * THE single eligibility predicate for every consumer that reads the persisted store — the gate's
+ * conjunction arm and its coverage-set selection here, the suggestion face's coverage judgement and the
+ * consent prepare's ({@link segmentCoverageOf} is the shared instrument). One predicate, so a rule that
+ * one consumer refuses cannot be a rule another counts: the historically inlined trio of checks
+ * (live / tool / scope) is this function, verbatim.
+ */
+export declare function eligiblePersisted(rule: PersistedAllowRule, call: {
+    tool: string;
+    cwd: string | undefined;
+}): boolean;
+/**
+ * Find the rules that admit this command for a task in `cwd`, or `undefined`.
+ *
+ * THE ANSWER IS A COVERAGE SET (design/375 §5.1, the upstream per-segment form): a single rule that
+ * admits the whole command is a one-element set — the historical arm, table order preserved verbatim —
+ * and a COMPOUND whose every segment is admitted by some eligible rule is covered by the CONJUNCTION of
+ * those rules, returned as the set that covered it. The judging ladder, in order:
+ *  1. the fail-closed floor (a shape the lane cannot read matches nothing), evaluated once;
+ *  2. the single-rule arm — whole-string exact, single/compound-prefix — exactly the historical loop:
+ *     first table-order match wins and is what the decision names. A single rule naming the command is
+ *     found BEFORE any conjunction: reporting one rule is narrower than reporting a set;
+ *  3. the conjunction arm, compounds only: every segment must be admitted by some eligible rule under
+ *     the MATCH reading (the allow side's own under-approximating instrument — never the deny side's
+ *     wider PROGRAM_RUNS reading). Per segment the FIRST table-order admitting rule is selected, and
+ *     the coverage set is those selections in segment order, de-duplicated — the same command against
+ *     the same rule table always names the same set (reporting-order determinism, the historical
+ *     "order is defined only for reporting" contract extended to sets).
+ *
+ * What the conjunction arm deliberately does NOT change: {@link ruleAdmitsCommand} itself. A
+ * single-command prefix body still never admits a chain — `Bash(npm:*)` does not admit
+ * `npm test && curl evil.example` — but the chain is now admitted when EVERY segment has a standing
+ * yes, which is the upstream decision form (per-segment allow, any-segment deny decided strictly
+ * earlier at the gate's org layer). A trailing-terminator spelling (`a && b ;`) keeps the conservative
+ * answer by construction: under the MATCH reading its tail is an empty segment the floor refuses, so
+ * the whole command is outside the lane and asks.
+ *
+ * Order is defined only for reporting (what the decision names); no rule is stronger than another —
+ * they are all the same one answer, "the person already said yes to this".
  */
 export declare function findAdmittingRule(rules: readonly PersistedAllowRule[], call: {
     tool: string;
     command: string;
     cwd: string | undefined;
-}): PersistedAllowRule | undefined;
-/** A rule the engine offers to mint, as carried on an approval card. */
-export interface RuleSuggestion {
+}): readonly PersistedAllowRule[] | undefined;
+/**
+ * design/375 §5.2 — the per-segment coverage table for `command`: which segments an eligible rule
+ * already admits, judged with the SAME split, the same MATCH reading and the same eligibility
+ * predicates as the gate's conjunction arm — one instrument, so the suggestion face and the consent
+ * prepare can never call a segment covered that the gate would ask about (or vice versa).
+ *
+ * TWO SOURCES, two predicates, and the seat labels are the contract:
+ *  · `persisted` — rules already in the store, judged {@link eligiblePersisted} ∧ admit: a tombstoned
+ *    rule, another project's rule and another tool's rule are uniformly NOT coverage;
+ *  · `proposed` — rules of the CURRENT batch that are not yet persisted (no add dots yet), judged
+ *    {@link eligibleContext} ∧ admit against the scope each would land in. Judging these with the
+ *    persisted predicate would make "this batch, once redeemed, covers the command" permanently false
+ *    — the liveness layer is the one thing a proposal legitimately lacks.
+ *
+ * Returns `undefined` for a command the lane cannot read at all (the fail-closed floor — the caller's
+ * honest answer is then "no coverage table", which every consumer must treat as all-uncovered). The
+ * reported `segment` texts are the FOLDED spellings, trimmed — display/correlation seats, never
+ * adjudication inputs.
+ */
+export declare function segmentCoverageOf(command: string, rules: {
+    persisted: readonly PersistedAllowRule[];
+    proposed?: readonly {
+        rule: ParsedAllowRule;
+        scope: RuleScope;
+    }[];
+}, call: {
+    tool: string;
+    cwd: string | undefined;
+}): readonly SegmentCoverage[] | undefined;
+/** One row of a per-segment coverage table (see {@link segmentCoverageOf}): the FOLDED, trimmed
+ *  segment text (a display/correlation seat, never adjudication input) and whether an eligible rule
+ *  already admits it. */
+export interface SegmentCoverage {
+    readonly segment: string;
+    readonly covered: boolean;
+}
+/** One member of a {@link RuleOffer} batch: a rule the engine offers to mint for ONE segment of a
+ *  compound command. `segment` is the FOLDED segment text the member was minted from — a rendering
+ *  seat, never adjudication input. */
+export interface SegmentRuleSuggestion {
     /** The canonical rule text the host would redeem. */
-    rule: string;
-    match: PersistedRuleMatch;
+    readonly rule: string;
+    readonly match: PersistedRuleMatch;
     /** The command pattern in the rule, for a host that wants to render it without re-parsing. */
-    command: string;
+    readonly command: string;
+    /** The (folded) segment this suggestion came from. Raw post-rewrite command bytes — a substring
+     *  of the same call's `args`/`command` values riding beside it on every surface that carries
+     *  this seat — so render it with contextual escaping, exactly like those. */
+    readonly segment: string;
 }
 /**
- * The 1-2 candidates offered on an approval card for `command`.
+ * design/375 §3.1 — ONE "don't ask again" option on an approval card. A CLOSED discriminated union
+ * (`kind`); consumers parse it per element, and an element whose `kind` they do not know is dropped
+ * (single-row degrade) while keeping the ORIGINAL wire index for every element they keep — selection
+ * and redemption are keyed on original indices, so a consumer that cannot preserve the mapping must
+ * suppress its persistence actions entirely (fail toward asking).
+ *
+ *  · `kind: "single"` — one rule covering the WHOLE command (the exact spelling, or a broader
+ *    reviewed prefix form for a simple command).
+ *  · `kind: "batch"` — a CONJUNCTION batch of per-segment rules for a compound command. Choosing it
+ *    is one yes to ALL of `rules` at once — there is no per-member selection inside a batch; a
+ *    consumer that wants a narrower answer picks the single offer or approves once without a rule.
+ *    `rules` has 1..5 members (the card-lane minting cap), in segment order, deduplicated by rule
+ *    text. `uncoveredSegments` is the honest surplus disclosure of the cap: judged at MINT time
+ *    against the coverage snapshot the card was drawn from ∪ this batch's FINAL (deduplicated,
+ *    capped) rules, it counts the violating segments still admitted by neither — 0 means "once this
+ *    batch is redeemed, this compound is fully covered by that snapshot's lights". It is a statement
+ *    about the minting snapshot, not a standing guarantee: a concurrent rule removal can date it.
+ *
+ * Array contract (`ruleOffers`, the durable park row, and the consent record's projection while
+ * the card is PENDING all share it): at most 2 offers; the whole-string exact single is index 0
+ * whenever present; the batch offer — at most one — is always last. It is a draw-time contract,
+ * not a settled-record invariant: confirming an EDITED candidate appends a third single offer
+ * AFTER the batch in the same write that settles the record, so a SETTLED record's projection may
+ * carry it. ADVISORY display metadata, never adjudication input, and never a
+ * rule by itself: minting is a separate act that goes through the approval-record protocol, so a
+ * surface that ignores offers entirely changes nothing about what is allowed. The authoritative
+ * render source for a card is the PREPARED record's own offers (record-is-what-you-see); the ask-time
+ * projection here may drift from it across a coverage change, and the drift direction is harmless
+ * (the record is what gets confirmed).
+ */
+export type RuleOffer = {
+    readonly kind: "single";
+    /** The canonical rule text the host would redeem. */
+    readonly rule: string;
+    readonly match: PersistedRuleMatch;
+    /** The command pattern in the rule, for a host that wants to render it without re-parsing. */
+    readonly command: string;
+} | {
+    readonly kind: "batch";
+    /** 1..5 per-segment rules, segment order, deduplicated by rule text. */
+    readonly rules: readonly SegmentRuleSuggestion[];
+    /** Mint-time honest surplus: violating segments admitted by neither the coverage snapshot nor
+     *  this batch's final rules (see the union doc above for the exact arithmetic). */
+    readonly uncoveredSegments: number;
+};
+/**
+ * The offers presented on an approval card for `command` (design/375 §5.2).
  *
- * **Array order is a documented CONTRACT, not an implementation accident**: display order = array
- * order = narrowest first. The EXACT form (this whole command line) is always index 0 whenever
- * anything is offered at all; a broader reviewed PREFIX form — at most one — follows at index 1.
- * Selection indices and redemption tickets are index-keyed against this order (a card's
- * `selectedCandidate` and its `rt.<index>.` tickets), so consumers may rely on it.
+ * **Array order is a documented CONTRACT, not an implementation accident** (see {@link RuleOffer}):
+ * the whole-string EXACT single is index 0 whenever present; a SIMPLE command may carry a broader
+ * reviewed PREFIX single after it; a COMPOUND carries at most one BATCH offer, always last.
+ * Selection indices are keyed against this order, so consumers may rely on it; redemption TICKETS
+ * are NOT — they key on the consent record's flat CANDIDATE list, and a chosen offer is redeemed
+ * via `redeemRuleBatch` (see the consent record's own doc for the two index spaces).
  *
- * The prefix candidate is the LONGEST body two sources agree to offer: {@link SUGGESTION_LEXICON}'s
+ * The prefix single is the LONGEST body two sources agree to offer: {@link SUGGESTION_LEXICON}'s
  * deeper-than-two-words rows first, and otherwise {@link genericPrefixBody}'s general two-word form
  * (`argv[0]` + a token shaped like a subcommand). Read those two for the grammar, its adopted origin,
  * and the operand false positive it accepts; the short version is that a bare verb (`git`), an
@@ -407,9 +559,10 @@ export interface RuleSuggestion {
  * "no prefix".
  *
  * Every produced candidate must survive the round trip — parse as a rule, come back as the match form
- * this seat is offering, AND admit the very command it was minted from. Enforced on BOTH seats,
- * fail-closed: a candidate that would not round-trip is silently not offered, since offering an option
- * redemption would refuse is worse than offering one fewer.
+ * its seat is offering, AND admit the very text it was minted from (the whole command for a single,
+ * its own segment for a batch member). Enforced on EVERY seat, fail-closed: a candidate that would
+ * not round-trip is silently not offered, since offering an option redemption would refuse is worse
+ * than offering one fewer.
  *
  * The FORM half of that check is not decoration. A command may end in the rule grammar's own prefix
  * marker — `rm :*` is a legal thing to type — and wrapping it as an exact rule produces the text
@@ -419,19 +572,29 @@ export interface RuleSuggestion {
  * for a lexicon command like `git status :*`, emitted twice — once mislabelled, once as the real prefix
  * candidate). The seat therefore believes the PARSER about what it got back, never its own request.
  *
- * A COMPOUND (`./gradlew build && ./gradlew test`) fills the exact seat — the offered rule spells the
- * whole chain and admits exactly it (the shape this seat was missing: the ordinary build invocation is
- * a connector chain, and a card that could offer nothing for it made every such command a fresh
- * question forever) — and, when its FINAL segment yields a prefix body under the very same grammar the
- * single-command seat uses, a COMPOUND-PREFIX candidate besides: the leading segments verbatim,
- * connectors and all, with the final segment cut down to its body (`cd /tmp && adb pull /sdcard/x .`
- * offers `Bash(cd /tmp && adb pull:*)`). A final segment the grammar declines — a flag in second
- * position, a screened head, one token — leaves the chain with its exact seat alone, exactly as the
- * same shape leaves a simple command. No seat is ever minted off a NON-final segment: those are the
- * byte-exact half of the rule, so there is nothing to widen.
+ * A COMPOUND (`./gradlew build && ./gradlew test`) fills the exact single — the offered rule spells
+ * the whole chain and admits exactly it — and a BATCH offer besides: every segment NOT already
+ * covered (per `ctx.coverage`) yields its own single-segment best form — a prefix when the
+ * single-command grammar grants one for that segment's tokens (the interception screens apply
+ * unchanged), otherwise the segment's exact — deduplicated by rule text in segment order and capped
+ * at FIVE (upstream's own batch cap; the overflow is disclosed via `uncoveredSegments` rather than
+ * silently truncated away). A segment whose every form the floor refuses simply contributes no
+ * member (and stays counted as uncovered — the honest gap). The COMPOUND-PREFIX candidate this seat
+ * used to mint here is deliberately NO LONGER OFFERED (design/375 §5.3): the batch takes its card
+ * position, while the compound-prefix GRAMMAR remains a fully supported rule family — the matcher,
+ * the hand-written/edited/import channels and every persisted such rule are untouched.
+ *
+ * `ctx.coverage` is the per-segment coverage table minted by the SAME store read that adjudicated
+ * the call (see {@link segmentCoverageOf} and the gate's engine-stamped seat) — positional over this
+ * function's own folded segments, belt-checked by text: a table whose length or segment texts do not
+ * line up is discarded whole, and an absent or discarded table reads as ALL-UNCOVERED (fail toward
+ * over-offering; every offered rule still passes the validator at redemption, so an over-offer widens
+ * nothing).
  *
  * Returns an empty array for anything the rule lane cannot speak for (redirections, substitutions,
  * subshells, backgrounding) — the card then simply carries no "don't ask again" option, which is the
  * honest answer.
  */
-export declare function suggestRulesForCommand(command: string): RuleSuggestion[];
+export declare function suggestRulesForCommand(command: string, ctx?: {
+    readonly coverage?: readonly SegmentCoverage[];
+}): RuleOffer[];

package/dist/core/permission-rule-model.js

@@ -247,60 +247,118 @@ export function scopeCoversCwd(scope, cwd) {
 export function isRuleLive(rule) {
     return rule.adds.length > 0;
 }
-export function findAdmittingRule(rules, call) {
-    const shape = ruleLaneShapeOf(call.command, MATCH_READING);
-    if ("reject" in shape)
-        return undefined;
+export function eligibleContext(rule, call) {
+    return rule.tool === call.tool && scopeCoversCwd(rule.scope, call.cwd);
+}
+export function eligiblePersisted(rule, call) {
+    return isRuleLive(rule) && eligibleContext(rule, call);
+}
+function firstEligibleAdmittingRule(rules, commandText, call) {
     for (const rule of rules) {
-        if (!isRuleLive(rule))
-            continue;
-        if (rule.tool !== call.tool)
-            continue;
-        if (!scopeCoversCwd(rule.scope, call.cwd))
+        if (!eligiblePersisted(rule, call))
             continue;
-        if (ruleAdmitsCommand(rule, call.command))
+        if (ruleAdmitsCommand(rule, commandText))
             return rule;
     }
     return undefined;
 }
-export function suggestRulesForCommand(command) {
+export function findAdmittingRule(rules, call) {
+    const shape = ruleLaneShapeOf(call.command, MATCH_READING);
+    if ("reject" in shape)
+        return undefined;
+    const whole = firstEligibleAdmittingRule(rules, call.command, call);
+    if (whole !== undefined)
+        return [whole];
+    if (shape.segments.length < 2)
+        return undefined;
+    const covering = [];
+    for (const segment of shape.segments) {
+        const first = firstEligibleAdmittingRule(rules, segment, call);
+        if (first === undefined)
+            return undefined;
+        if (!covering.includes(first))
+            covering.push(first);
+    }
+    return covering;
+}
+export function segmentCoverageOf(command, rules, call) {
+    const folded = foldSpacing(command);
+    if (folded === undefined)
+        return undefined;
+    const shape = ruleLaneShapeOf(folded, MATCH_READING);
+    if ("reject" in shape)
+        return undefined;
+    const proposed = rules.proposed ?? [];
+    return shape.segments.map((segment) => ({
+        segment: segment.trim(),
+        covered: firstEligibleAdmittingRule(rules.persisted, segment, call) !== undefined ||
+            proposed.some((p) => eligibleContext({ tool: p.rule.tool, scope: p.scope }, call) && ruleAdmitsCommand(p.rule, segment)),
+    }));
+}
+export function suggestRulesForCommand(command, ctx) {
     const shape = ruleLaneShapeOf(command, MATCH_READING);
     if ("reject" in shape)
         return [];
     const folded = foldSpacing(command);
     if (folded === undefined)
         return [];
-    const out = [];
+    const offers = [];
     const exact = parseAllowRuleText(formatAllowRuleText(folded, "exact"));
     if ("rule" in exact && exact.rule.match === "exact" && ruleAdmitsCommand(exact.rule, command)) {
-        out.push({ rule: exact.rule.rule, match: "exact", command: exact.rule.command });
+        offers.push({ kind: "single", rule: exact.rule.rule, match: "exact", command: exact.rule.command });
     }
-    const offerPrefix = (body) => {
-        if (body === undefined)
-            return;
-        const text = formatAllowRuleText(body, "prefix");
-        const parsed = parseAllowRuleText(text);
-        if ("rule" in parsed && parsed.rule.match === "prefix" && ruleAdmitsCommand(parsed.rule, command)) {
-            out.push({ rule: parsed.rule.rule, match: "prefix", command: parsed.rule.command });
-        }
-    };
     const tokensOf = (s) => s.split(/\s+/).filter((t) => t !== "");
     const bodyOf = (tokens) => longestReviewedBody(tokens) ?? genericPrefixBody(tokens);
-    if (out.length === 1) {
-        if (shape.segments.length === 1) {
-            offerPrefix(bodyOf(tokensOf(folded)));
-        }
-        else {
-            const foldedShape = ruleLaneShapeOf(folded, MATCH_READING);
-            if (!("reject" in foldedShape) && foldedShape.segments.length === shape.segments.length) {
-                const rawLast = foldedShape.segments[foldedShape.segments.length - 1] ?? "";
-                const lastBody = bodyOf(tokensOf(rawLast));
-                if (lastBody !== undefined) {
-                    const cut = folded.length - rawLast.length + (rawLast.length - rawLast.trimStart().length);
-                    offerPrefix(folded.slice(0, cut) + lastBody);
+    if (shape.segments.length === 1) {
+        if (offers.length === 1) {
+            const body = bodyOf(tokensOf(folded));
+            if (body !== undefined) {
+                const parsed = parseAllowRuleText(formatAllowRuleText(body, "prefix"));
+                if ("rule" in parsed && parsed.rule.match === "prefix" && ruleAdmitsCommand(parsed.rule, command)) {
+                    offers.push({ kind: "single", rule: parsed.rule.rule, match: "prefix", command: parsed.rule.command });
                 }
             }
         }
+        return offers;
+    }
+    const foldedShape = ruleLaneShapeOf(folded, MATCH_READING);
+    if ("reject" in foldedShape || foldedShape.segments.length !== shape.segments.length)
+        return offers;
+    const segments = foldedShape.segments.map((s) => s.trim());
+    const table = ctx?.coverage;
+    const alignedTable = table !== undefined && table.length === segments.length && table.every((row, i) => row.segment === segments[i]) ? table : undefined;
+    const coveredAt = (i) => alignedTable?.[i]?.covered === true;
+    const mintSegmentRule = (segment) => {
+        const body = bodyOf(tokensOf(segment));
+        if (body !== undefined) {
+            const parsed = parseAllowRuleText(formatAllowRuleText(body, "prefix"));
+            if ("rule" in parsed && parsed.rule.match === "prefix" && ruleAdmitsCommand(parsed.rule, segment)) {
+                return { rule: parsed.rule.rule, match: "prefix", command: parsed.rule.command };
+            }
+        }
+        const segExact = parseAllowRuleText(formatAllowRuleText(segment, "exact"));
+        if ("rule" in segExact && segExact.rule.match === "exact" && ruleAdmitsCommand(segExact.rule, segment)) {
+            return { rule: segExact.rule.rule, match: "exact", command: segExact.rule.command };
+        }
+        return undefined;
+    };
+    const minted = [];
+    for (let i = 0; i < segments.length; i++) {
+        if (coveredAt(i))
+            continue;
+        const segment = segments[i];
+        const rule = mintSegmentRule(segment);
+        if (rule !== undefined && !minted.some((m) => m.rule === rule.rule))
+            minted.push({ ...rule, segment });
+    }
+    const batchRules = minted.slice(0, 5);
+    if (batchRules.length > 0) {
+        const parsedBatch = batchRules.flatMap((r) => {
+            const p = parseAllowRuleText(r.rule);
+            return "rule" in p ? [p.rule] : [];
+        });
+        const uncoveredSegments = segments.filter((segment, i) => !coveredAt(i) && !parsedBatch.some((p) => ruleAdmitsCommand(p, segment))).length;
+        offers.push({ kind: "batch", rules: batchRules, uncoveredSegments });
     }
-    return out;
+    return offers;
 }

package/dist/core/permission-rules.d.ts

@@ -7,7 +7,7 @@
  * run-loop 介入的「声明式数据→ToolPolicy」工厂(`createCoarseCommandNamePolicy` 同形态先例)。
  * core 不读设置文件、不管 source 层级合并 —— Settings-loader 把各层合并成**单一规则表**后编译
  * **一个** policy(不要按层各编译再组合:combinePolicies 的 fold 里 ask 胜 allow,跨 policy 的
- * 显式 allow 规则会被另一 policy 的 ask 吞掉 —— codex 127 审 B3)。
+ * 显式 allow 规则会被另一 policy 的 ask 吞掉)。
  *
  * 🔴 与 CC 的三处有意差(design/127 r2):
  *  - CC 参数级 generic 道无 allow lane(gnn 只有 deny/ask)—— 我们同样:`allow` + 参数级 content =
@@ -16,7 +16,7 @@
  *    **工厂 validator strict**:降级即 invalid(fail-fast 世界观,写错的规则不能静默变宽)。
  *  - 已知主字段参数规则(如 `Bash(command:…)`)默认 **reject**:通配是 trim 后**整串 lexical**
  *    匹配,不是 shell AST / 前缀 lane —— `Bash(command:git push*)` 匹配不了 `cd /x && git push`,
- *    「以为挡住了」比没挡更危险(codex 127 审 M2)。`primaryFieldGeneric:"allow-lexical"` 显式解锁。
+ *    「以为挡住了」比没挡更危险。`primaryFieldGeneric:"allow-lexical"` 显式解锁。
  */
 import type { NamedToolPolicy } from "./tool-policy.js";
 /** [K-PLATFORM-SWEEP] MINOR#11: Bash's REAL non-primary arg names, accepted as generic param rules
@@ -28,7 +28,7 @@ export interface PermissionRule {
     /** CC 语法:`"Tool"` 或 `"Tool(param:pattern)"`。`Tool()`/`Tool(*)` 归一为裸规则;括号可 `\(`/`\)` 转义。 */
     rule: string;
     behavior: "deny" | "ask" | "allow";
-    /** Provenance(codex 127 审 M7):进 deny/ask 的 message 供审计(e.g. `"policySettings"`)。层级
+    /** Provenance:进 deny/ask 的 message 供审计(e.g. `"policySettings"`)。层级
      *  优先级/tighten-only 语义在 Settings-loader,不在这里。 */
     source?: string;
 }
@@ -40,7 +40,7 @@ export interface ParsedPermissionRule {
 }
 export interface PermissionRuleIssue {
     rule: string;
-    /** `invalid.*` = 语法/语义错;`unsupported.*` = CC 合法但 v1 不支持的 lane(codex 127 审 B5:独立
+    /** `invalid.*` = 语法/语义错;`unsupported.*` = CC 合法但 v1 不支持的 lane(独立
      *  分类,绝不静默 no-op —— `Bash(npm run:*)` 被当 generic 参数规则接受后永不匹配是最危险的失败形态)。 */
     code: "invalid.empty_tool" | "invalid.paren" | "invalid.param_split" | "invalid.allow_param_rule" | "invalid.primary_field" | "invalid.cap_exceeded" | "unsupported.bash_prefix"
     /** design/179 D7: a Bash prefix rule under `bashPrefixLane:"rules-store"` — reported so a migration
@@ -65,20 +65,20 @@ export interface PermissionRuleCaps {
     maxStars: number;
     /** Scalar arg values longer than this are NOT matched textually — the rule **fail-closes** to its
      *  lane (a deny rule targeting an oversized value denies; an ask rule asks). 租户规则 × 模型巨串
-     *  的热路径成本上界(codex 127 审 M6)。 */
+     *  的热路径成本上界。 */
     maxScalarValueChars: number;
 }
 export interface PermissionRulePolicyOptions {
     /** Invalid/unsupported rules: `"throw"`(default — 部署作者写错要立刻知道)aggregates ALL issues
      *  into one error; `"skip"` drops them (pair with {@link validatePermissionRules} for a report, and/or
-     *  supply {@link onIssue}). Exception(codex 实现审 M3):`invalid.cap_exceeded` on the WHOLE rule set
+     *  supply {@link onIssue}). Exception(实现审 M3):`invalid.cap_exceeded` on the WHOLE rule set
      *  (maxRules) throws EVEN under `"skip"` — skipping it would compile an EMPTY table and fail-open. */
     onInvalidRule?: "throw" | "skip";
     /** Called once per dropped rule under `"skip"` (audit surface — silent drops are how a deployment
      *  discovers, months later, that its deny never existed). Default: one aggregated `console.warn`. */
     onIssue?: (issue: PermissionRuleIssue) => void;
     /** What the policy returns when NO rule matches. Default `"allow"` = 本 policy 无意见(组合语义)。
-     *  default-closed 部署用 `"ask"`/`"deny"` —— 必须在这 INSIDE the policy(codex 127 审 B3:链尾
+     *  default-closed 部署用 `"ask"`/`"deny"` —— 必须在这 INSIDE the policy(链尾
      *  ask policy 会在 fold 里吞掉本 policy 的显式 allow)。 */
     defaultAction?: "allow" | "ask" | "deny";
     /** 已知主字段参数规则(`Bash(command:…)` 等)的处置。默认 `"reject"`(整串 lexical ≠ 前缀/AST,
@@ -136,7 +136,7 @@ export declare function namespacedRuleNameCovers(ruleName: string, toolName: str
 export declare function isNamespacedCoveringRuleName(name: string): boolean;
 /** Exported for the lockstep guard only (see {@link FILE_TOOL_PARAMS}) — not part of the rule DSL. */
 export declare const fileToolParamVocabulary: (canonicalTool: string) => ReadonlySet<string> | undefined;
-/** Dry-run 校验/迁移报告(codex 127 审 B5):不 throw,返回全部 issues(含 `unsupported.*` 分类,
+/** Dry-run 校验/迁移报告:不 throw,返回全部 issues(含 `unsupported.*` 分类,
  *  供从 CC settings 迁移的部署逐条对照)。 */
 export declare function validatePermissionRules(rules: PermissionRule[], opts?: Pick<PermissionRulePolicyOptions, "primaryFieldGeneric" | "caps" | "bashPrefixLane">): PermissionRuleIssue[];
 /**
@@ -145,7 +145,7 @@ export declare function validatePermissionRules(rules: PermissionRule[], opts?:
  * bare allow → `defaultAction`. `check()` is idempotent and side-effect-free (combinePolicies 契约);
  * all parsing/validation happens HERE, the hot path never re-parses.
  *
- * ⚠️ Composition note (codex 127 审 B3): an `allow` from this policy is "no objection", NOT a
+ * ⚠️ Composition note: an `allow` from this policy is "no objection", NOT a
  * cross-policy override — another policy's ask/deny still outranks it in the combinePolicies fold.
  * Express default-closed via `defaultAction`, never via a trailing always-ask policy.
  */

package/dist/core/remote-env.d.ts

@@ -52,7 +52,7 @@ export interface WorkspaceHandle {
     snapshotId?: SnapshotId;
     /** Token for {@link RemoteExecutionEnv.reconnect} when the VM is still running (vs suspended to a snapshot). */
     sessionToken?: SessionToken;
-    /** How a checkpointed workspace is restored on resume (1.257.2 hardening, codex review of [500]②):
+    /** How a checkpointed workspace is restored on resume (1.257.2 hardening):
      *  `"park_only"` = durable-park-only suspend degrade (non-suspendable env; workspace persists on the
      *  target, resume skips `resumeVM`). Absent = legacy/snapshot handle — resume treats a MISSING
      *  `snapshotId` as corruption (fail-closed) unless the resumed env is itself non-suspendable
@@ -98,7 +98,7 @@ export interface VmLifecycleOptions {
     /** Abort a hung pause/restore. */
     abortSignal?: AbortSignal;
     /**
-     * [1461]④a (resume workspace-root fidelity) — the CHECKPOINTED {@link WorkspaceHandle} of the workspace
+     * (resume workspace-root fidelity) — the CHECKPOINTED {@link WorkspaceHandle} of the workspace
      * being restored, passed by the engine on the `resumeVM` leg. An adapter SHOULD bind the restored
      * workspace root (cwd / mount) to `priorHandle.mountPath` rather than its CURRENT deployment
      * configuration: across a config-knob change window (e.g. a mount-path rotation) the resumed task's
@@ -289,7 +289,7 @@ export interface RemoteExecutionEnv extends ExecutionEnv {
          *
          *  ⚠️ LOAD-BEARING INVARIANT (opus review 1.257.2): `suspendable:false` on a remote env also asserts
          *  the workspace is EXTERNALLY DURABLE — it persists on the target across the env object's lifetime
-         *  (true for SSH hosts / ADB devices). The durable-park-only suspend degrade (service [500]②) rests
+         *  (true for SSH hosts / ADB devices). The durable-park-only suspend degrade rests
          *  on this: it skips `suspendVM` and trusts the factory to reconnect to the SAME workspace on resume.
          *  An adapter for a non-suspendable EPHEMERAL backend (e.g. a snapshot-less container torn down with
          *  the transport) must NOT be modeled as `suspendable:false` remote — it would silently take the
@@ -359,7 +359,7 @@ export interface RemoteExecutionEnv extends ExecutionEnv {
      * expired while suspended). Any failed step → `Err("post_resume_failed")` and the caller MUST destroy the env.
      *
      * Note: a resumed guest's network/long-lived connections (git remote / API / registry) are NOT guaranteed to
-     * survive the snapshot (clay decision 2), so this is also where the VM-internal agent rebuilds those.
+     * survive the snapshot (decision 2), so this is also where the VM-internal agent rebuilds those.
      *
      * 🔴 Ordering red line (design/48 §5/#6): at-rest encryption of the memory snapshot must be ensured BEFORE
      * secrets are injected — never let plaintext credentials land in an unencrypted snapshot. That encryption is a
@@ -391,10 +391,10 @@ export interface RemoteExecutionEnv extends ExecutionEnv {
      * once on task end, and `prepareTask` calls it on a prepare-time throw; a remote impl may also be reaped,
      * so a defensive double-call must not error or double-bill.
      *
-     * 飞轮 [519] contract note: on a NON-isolated env (no `capabilities.isolation` — host lane, SSH host),
+     * contract note: on a NON-isolated env (no `capabilities.isolation` — host lane, SSH host),
      * destroy() is workspace/object-level cleanup and must NOT reap still-running background processes —
      * that is `disposeBackgroundShells`' job, which honours the timeout/session keep-alive except-list
-     * ([511]③ monitor timeout anchor). An isolated env (container/VM) naturally takes everything down;
+     * (monitor timeout anchor). An isolated env (container/VM) naturally takes everything down;
      * the Runner's envDying settle accounts for that with an accurate killed receipt beforehand.
      */
     destroy(): Promise<void>;
@@ -423,7 +423,7 @@ export interface ExecutionEnvFactoryContext {
      */
     isolation?: "worktree";
     /**
-     * Blackboard 2026-07-03 (clay dogfood — sub-agents landing in an EMPTY sandbox): the PARENT task's
+     * Field-reported (sub-agents landing in an EMPTY sandbox): the PARENT task's
      * effective working root, threaded (like `isolation`) via the TRUSTED `RunInternals` channel when this
      * task is a sub-agent (workflow `ctx.agent` / Task delegation). CC parity: a Task sub-agent inherits the
      * main session's cwd. A single-user/TOC factory SHOULD root the child env here (unless `isolation`
@@ -436,7 +436,7 @@ export interface ExecutionEnvFactoryContext {
 /**
  * A **trusted control-plane** factory that mints a per-task {@link ExecutionEnv} (design/48 §5 answers core
  * gap-a / §7 Q7). Lives on `RunnerDeps` (deployment-level) — NOT on `TaskSpec` — so an untrusted caller can
- * never inject its own env and escape the sandbox (design/44 §7 Q4 red line; clay decision 3: the Docker
+ * never inject its own env and escape the sandbox (design/44 §7 Q4 red line; decision 3: the Docker
  * fast-lane must be control-plane-assigned, never task-selectable).
  *
  * The remote model is "one container per task", so the factory is invoked once per task. The Runner owns the

package/dist/core/roles.d.ts

@@ -24,10 +24,10 @@ export declare const CC_MODEL_TIER_ALIASES: Readonly<Record<string, string>>;
  * - a binding may itself be a catalog name or a Model object (resolved through `resolveModel`);
  *   an unknown binding name throws at construction (config error surfaces at boot, not first use).
  */
-/** [1613] the DISPLAY face of a string model ref: a CC tier ALIAS (haiku/sonnet/…) resolves to its
+/** the DISPLAY face of a string model ref: a CC tier ALIAS (haiku/sonnet/…) resolves to its
  *  sema tier name (lite/flash/…) for labels — the alias verbatim reads as a strong claim about a
  *  specific vendor's model while the actual routing may land anywhere ("haiku" showing over a
- *  DeepSeek run, clay's field report). A non-alias string is the deployment's own model key — its
+ *  DeepSeek run, an operator field report). A non-alias string is the deployment's own model key — its
  *  honest name — and passes through unchanged. Display only; routing (`expandTiers`) is untouched. */
 export declare function resolveModelDisplayLabel(ref: string): string;
 export declare function expandTiers(models: Record<string, Model> | undefined, tiers: Record<string, ModelRef> | undefined): Record<string, Model> | undefined;
@@ -49,7 +49,7 @@ export interface ModelMention {
  */
 export declare function parseModelMention(text: string, allowedNames: Iterable<string>): ModelMention;
 /**
- * Role → 档位默认表(clay 拍 2026-07-11:「role 体系用户不感知」)。配了 `RunnerDeps.tiers` 的部署,
+ * Role → 档位默认表(裁定 2026-07-11:「role 体系用户不感知」)。配了 `RunnerDeps.tiers` 的部署,
  * 各 role 未显式配置时自动落到语义档位——用户/壳只感知档位,roles 降级为内部路由层:
  * - `default` → `pro`(主力档兜底;用户/部署 roles.default / TaskSpec.model 恒可覆盖);
  * - `summarize` → `flash`(压缩本该便宜;flash 未绑沿降档链到 lite);

package/dist/core/roles.js

@@ -102,6 +102,7 @@ const FALLBACK = {
     advisor: ["default"],
     verifier: ["default"],
     classifier: ["summarize", "default"],
+    consolidate: ["summarize"],
 };
 function specParts(s) {
     if (s == null) {

package/dist/core/runner/assemble-result.d.ts

@@ -42,7 +42,7 @@ export interface Stats {
             toolArg?: string;
         }>;
     };
-    /** TB telemetry B2 (service [397]): engine-mechanism engagement counters. Set by the run loop
+    /** TB telemetry B2: engine-mechanism engagement counters. Set by the run loop
      *  only when ≥1 engaged; flows straight through to `TaskResult.stats.mechanisms` via the
      *  public-stats spread. */
     mechanisms?: {
@@ -102,7 +102,7 @@ export interface ResultFlags {
     threw: unknown;
     /** design/99 MF-25: the EFFECTIVE (resolved) model id that served the task — echoed on `TaskResult.model`. */
     model?: string;
-    /** RB-368 ([2076]): some spend was accounted while the serving model had NO configured price table
+    /** RB-368: some spend was accounted while the serving model had NO configured price table
      *  (no `RunnerDeps.pricing` entry, no `Model.cost`). The numeric total is then a fabricated
      *  undercount — `stats.costMicroUsd`/`costBreakdown` are OMITTED from the public result instead of
      *  reporting a 0 indistinguishable from "declared free". The internal accumulator (budget gate's