@sema-agent/core 5.57.0 → 5.58.0

package/dist/core/runner/compaction-call-options.d.ts

@@ -22,7 +22,7 @@ import type { Prepared } from "./prepare-task.js";
 /**
  * Opt-in working-file attachments (LONGRUN-2 / CC 198 post-compact restore parity).
  *
- * Blackboard 2026-07-03 (CC parity): post-compact file re-read is DEFAULT ON (CC hard-codes it;
+ * CC parity: post-compact file re-read is DEFAULT ON (CC hard-codes it;
  * LONGRUN-2 measured ≈2.3 extra read round-trips per compaction without it). `false` opts out; an
  * object customizes caps. Selection set = most recently READ (CC readFileState semantics) with a
  * modified-files fallback inside maybeCompact. Returns `undefined` when attachments are off or the
@@ -52,7 +52,7 @@ export declare function buildWorkingFileAttachments(spec: TaskSpec, prepared: Pr
  */
 export declare function forkContextOption(prepared: Prepared, disable: boolean): Pick<MaybeCompactOptions, "forkContext">;
 /**
- * RB-31 ([1068]) — compaction-boundary center-candidate adoption. Absent (an empty object, NOT a
+ * RB-31 — compaction-boundary center-candidate adoption. Absent (an empty object, NOT a
  * `centerAdoption: undefined` key) = restate as before; a boundary re-pin hashes the same artifact
  * identity on every lane.
  */
@@ -106,7 +106,7 @@ export declare function projectStaleToolResults(context: Context, cfg: ResolvedS
  *  write-then-discard round-trip per stale result per turn. Caller owns the Set's lifetime. */
 writtenRefs: Set<string>): Promise<Context>;
 /**
- * MF-18 修② ([496]③) — fidelity disclosure: the summary INPUT was clipped to the compaction model's
+ * MF-18 修② — fidelity disclosure: the summary INPUT was clipped to the compaction model's
  * window. Fires pre-call, so the disclosure survives a failed attempt. All three lanes emit the SAME
  * frame; the end-of-task lane passes `spec.tracer ?? deps.tracer` / `spec.taskId ?? sessionId`
  * explicitly because `RunState.telemetry` (which holds exactly those two resolved values) is not in

package/dist/core/runner/memory-consolidation-driver.d.ts

@@ -0,0 +1,49 @@
+/**
+ * design/376 片② — the RUNNER convenience half of the consolidation driver: resolve the model
+ * seat out of a deployment's `RunnerDeps` (explicit chat seat wins; else the `consolidate` role
+ * chain) into the options `runMemoryConsolidationDriver` eats.
+ *
+ * Role resolution lives HERE and not in the engine-layer verb on purpose (design/339 §1.1 + the
+ * d2 ruling): the driver function's own seat is an explicit chat function — models, roles and
+ * tiers are runner vocabulary. The chain is `consolidate → summarize → coded refusal`, and the
+ * refusal is deliberate: one consolidation run reads the whole library (~10⁵ prompt tokens), so
+ * an unset role silently escalating to the most expensive `default` model would be the
+ * bad-value-silence family. A deployment that already declared a cheap `summarize` tier has made
+ * exactly the cost choice this role wants, so that hop stays; pointing `roles.consolidate` at the
+ * main model is a legal explicit choice.
+ */
+import type { Model } from "../../internal/llm.js";
+import type { Brain, ModelRoles, ModelRef, TaskSpec } from "../types.js";
+import { type DistillerChatFn } from "../memory-engine/distiller.js";
+import type { RunMemoryConsolidationOptions } from "../memory-engine/consolidation-driver.js";
+import type { MemoryConsolidationOptions } from "../memory-engine/consolidation.js";
+import type { LlmDistillerContract } from "../memory-engine/distiller.js";
+/** The slice of `RunnerDeps` this resolver reads (pass the deps object itself). */
+export interface MemoryConsolidationDriverDeps {
+    brain: Brain;
+    models?: Record<string, Model>;
+    tiers?: Record<string, ModelRef>;
+    roles?: ModelRoles;
+    memoryConsolidation?: MemoryConsolidationOptions;
+    memoryConsolidationDriver?: {
+        chat?: {
+            baseUrl: string;
+            apiKey: string;
+            model: string;
+        } | DistillerChatFn;
+        model?: string;
+        contract?: LlmDistillerContract;
+        maxCycles?: number;
+        mintRepairBudget?: number;
+    };
+    /** Optional per-model auth hook (the TaskSpec-shaped seat) for the role-resolved path. */
+    getApiKeyAndHeaders?: TaskSpec["getApiKeyAndHeaders"];
+}
+/**
+ * Resolve a deployment's driver options: `{ chat, model }` from the explicit seat or the role
+ * chain, plus the deployment knobs (contract / maxCycles / mintRepairBudget) and the protocol
+ * parameters (`memoryConsolidation`) threaded through verbatim. The result feeds
+ * `runMemoryConsolidationDriver(engine, scope, resolved)` directly; every bad value refuses
+ * coded here or in the verb's own screen (#123), never folds to a default.
+ */
+export declare function resolveMemoryConsolidationDriver(deps: MemoryConsolidationDriverDeps): RunMemoryConsolidationOptions;

package/dist/core/runner/memory-consolidation-driver.js

@@ -0,0 +1,60 @@
+import { brainToRuntime } from "../runtime.js";
+import { expandTiers, roleModelIfSet } from "../roles.js";
+import { isAliasModelId, openAiCompatChatSeat } from "../memory-engine/distiller.js";
+function seatRefusal(message) {
+    const e = new Error(message);
+    e.code = "config.memory_consolidation_driver";
+    return e;
+}
+export function resolveMemoryConsolidationDriver(deps) {
+    const seat = deps.memoryConsolidationDriver;
+    let chat;
+    let model;
+    if (typeof seat?.chat === "function") {
+        if (typeof seat.model !== "string" || seat.model.trim() === "" || isAliasModelId(seat.model)) {
+            throw seatRefusal(`memoryConsolidationDriver.chat is a bare function, so memoryConsolidationDriver.model must carry the EXPLICIT model id it serves (got ${JSON.stringify(seat.model)}).`);
+        }
+        chat = seat.chat;
+        model = seat.model;
+    }
+    else if (seat?.chat !== undefined) {
+        chat = openAiCompatChatSeat(seat.chat);
+        model = seat.chat.model;
+    }
+    else {
+        const models = expandTiers(deps.models, deps.tiers);
+        const resolved = roleModelIfSet("consolidate", {}, { models, roles: deps.roles }) ?? roleModelIfSet("summarize", {}, { models, roles: deps.roles });
+        if (resolved === undefined) {
+            throw seatRefusal('memory consolidation has no model seat: configure RunnerDeps.memoryConsolidationDriver.chat (an endpoint triple or a chat function), or declare roles.consolidate / roles.summarize (a tier-expanded catalog\'s "flash" binding also satisfies the summarize hop). The chain deliberately does NOT fall back to the default main model — a whole-library distillation must not silently ride the most expensive seat.');
+        }
+        if (isAliasModelId(resolved.id)) {
+            throw seatRefusal(`the resolved consolidation model id ${JSON.stringify(resolved.id)} is an alias spelling — an alias can be re-pointed upstream and would move the run with no trace in the archive; bind an explicit id.`);
+        }
+        model = resolved.id;
+        const runtime = brainToRuntime(deps.brain);
+        chat = async (req) => {
+            const auth = await deps.getApiKeyAndHeaders?.(resolved);
+            const message = await runtime.completeSimple(resolved, { systemPrompt: req.system, messages: [{ role: "user", content: req.user, timestamp: Date.now() }] }, { temperature: req.temperature, maxTokens: req.maxTokens, apiKey: auth?.apiKey, headers: auth?.headers });
+            if (message.stopReason === "error" || message.stopReason === "aborted") {
+                throw new Error(message.errorMessage ?? `model completion ${message.stopReason}`);
+            }
+            return {
+                content: message.content
+                    .filter((c) => c.type === "text")
+                    .map((c) => c.text)
+                    .join(""),
+                finishReason: message.stopReason,
+                usage: { promptTokens: message.usage.input, completionTokens: message.usage.output },
+                model: resolved.id,
+            };
+        };
+    }
+    return {
+        chat,
+        model,
+        ...(seat?.contract !== undefined ? { contract: seat.contract } : {}),
+        ...(seat?.maxCycles !== undefined ? { maxCycles: seat.maxCycles } : {}),
+        ...(seat?.mintRepairBudget !== undefined ? { mintRepairBudget: seat.mintRepairBudget } : {}),
+        ...(deps.memoryConsolidation !== undefined ? { consolidation: deps.memoryConsolidation } : {}),
+    };
+}

package/dist/core/runner/memory-consolidation.d.ts

@@ -27,7 +27,7 @@ export declare const DEFAULT_CONSOLIDATION_MAX_NOTES = 50;
 export declare const DEFAULT_CONSOLIDATION_TIMEOUT_SEC = 30;
 /** Normalize a note body for the EXACT-restatement check in the `<lo` near-dup cheap path. Case- + whitespace-
  *  insensitive ONLY (lower-case, collapse whitespace runs, trim); it PRESERVES every symbol/punctuation so it can
- *  NOT false-equate semantically-distinct facts. (service [365] falsification-style: the earlier `[^\p{L}\p{N}]`-stripping
+ *  NOT false-equate semantically-distinct facts. (falsification-style: the earlier `[^\p{L}\p{N}]`-stripping
  *  normalization made "C#"≡"C", "delta +5"≡"delta -5", "100%"≡"100" — and a textual-CONTAINMENT test on top of it
  *  also mis-judged "rate limit 1000" ⊇ "rate limit 100" (word boundary). A fire-on-every-note, no-LLM path must not
  *  make a semantic-subset call, so the cheap path now folds ONLY an exact restatement; every real near-dup defers

package/dist/core/runner/prepare-config-doors.d.ts

@@ -46,17 +46,17 @@ export declare function limitConfigError(code: string, message: string): Error &
  */
 export declare function resolveTaskLimits(limits: TaskLimits | undefined): TaskLimits | undefined;
 /**
- * R2 双形轴(clay 追加令 2026-07-18): CC 2.1.212's fable-variant prompt gate (b9e —
+ * R2 双形轴(追加令 2026-07-18): CC 2.1.212's fable-variant prompt gate (b9e —
  * `fable_5_mitigations` capability / claude-mythos-5), ORTHOGONAL to the simple/classic profile.
  * sema is BYOM, so the id may carry provider prefixes ("anthropic/claude-fable-5",
  * "openrouter/anthropic/claude-fable-5"): BOUNDARY-AWARE family match on the last path segment
- * (codex 统一复审 F3 — raw substring classified "vendor/not-claude-fable-5" and "claude-mythos-50"
+ * (统一复审 F3 — raw substring classified "vendor/not-claude-fable-5" and "claude-mythos-50"
  * as fable), case-normalized. Recognition set = CC's _Nr (startsWith "claude-fable-") + b9e
  * (mythos-5). R3 system sections fork on the resulting fact.
  */
 export declare function isFableFamilyModelId(id: string): boolean;
 /**
- * RB-50 (CC 2.1.220 启示①, clay 2026-07-25): the SINGLE decision point for the two prompt-shape axes.
+ * RB-50 (CC 2.1.220 启示①, 2026-07-25): the SINGLE decision point for the two prompt-shape axes.
  * Both were resolved in separate places with different mechanisms — `promptProfile` off a TaskSpec field,
  * `fableMitigations` off a raw model-id prefix test — so "which shape does this task speak" had no one
  * place to read. CC 2.1.220's counterpart is a model-registry `capabilities` array (one table drives

package/dist/core/runner/prepare-task.d.ts

@@ -329,13 +329,13 @@ export interface Prepared {
             chars: number;
             hash: string;
         }>;
-        /** Manifest v2 (campaign S1, additive): the compiled-IR section view (slot/carrier/cadence/
+        /** Manifest v2 (stage S1, additive): the compiled-IR section view (slot/carrier/cadence/
          *  cacheClass per section). `contentHash` is the
-         *  digest-tiering face ([1050]②/[1057]): present ONLY on operator-declared sections (the typed
+         *  digest-tiering face: present ONLY on operator-declared sections (the typed
          *  `stableBlocks` lane, owner "deployment") as an UNSALTED full sha256 of the section text —
          *  the center-publish ↔ manifest end-to-end reconciliation anchor. Core-native sections (env
          *  facts, memory tail, user role text) stay salted-only: a plain hash of a short guessable
-         *  block is a dictionary-preimage surface for trace readers (codex [E]). */
+         *  block is a dictionary-preimage surface for trace readers ([E]). */
         sections?: Array<{
             id: string;
             slot: string;
@@ -346,7 +346,7 @@ export interface Prepared {
             hash: string;
             contentHash?: string;
         }>;
-        /** Campaign S2 (additive): the mounted tools plane — contract identity, durable-replay aliases,
+        /** S2 (additive): the mounted tools plane — contract identity, durable-replay aliases,
          *  presentation-invariant shape digest and full wire digest per tool (initial mount face). */
         tools?: ToolManifestRow[];
         /** design/148 S3 (additive, §10.2): the nine-element cache identity — digests only, no prompt
@@ -363,7 +363,7 @@ export interface Prepared {
          *  seat chose it. Absent when nothing is deferred (there is no disclosure to describe). */
         toolDisclosure?: ToolDisclosureManifest;
     };
-    /** [1068] ruling a — this run's provider-declared prompt sections (epoch declaration axis),
+    /** This run's provider-declared prompt sections (epoch declaration axis),
      *  threaded to every compaction-boundary epoch selection so boundary re-pins hash the same
      *  artifact identity as the prepare-time pin. Empty on declaration-free runs. */
     epochDeclaredSections: import("../../prompt-assembly/epoch.js").EpochDeclaredSections;
@@ -690,7 +690,7 @@ export interface Prepared {
      *  RB-197: seeded entries are excluded — their content lives in the system-prompt lane, which
      *  compaction never touches, so re-attaching them into the summary would be a duplicate. */
     recentlyReadFiles?: () => string[];
-    /** RB-197②(独立复审 + codex 命中,已修) — canonicalizes a raw (often relative, model-typed) path the
+    /** RB-197②(独立复审 + 命中,已修) — canonicalizes a raw (often relative, model-typed) path the
      *  SAME way the hands toolkit does (`resolveKey` against the same containment root `readTaskFile`
      *  uses), so `maybeCompact`'s kept-tail/instruction-source exclusions compare paths in the SAME
      *  coordinate `recentlyReadFiles()` already uses — without this a plain string match silently never
@@ -698,7 +698,7 @@ export interface Prepared {
      *  readTaskFile); absent there is no containment root to resolve against, and every path source is
      *  already in the same raw coordinate anyway. */
     normalizeAttachmentPath?: (raw: string) => Promise<string>;
-    /** RB-197②(codex 交叉复审命中,已修) — recognizes the hands Read tool's own dedup-stub markers
+    /** RB-197②(交叉复审命中,已修) — recognizes the hands Read tool's own dedup-stub markers
      *  ({@link isReadDedupStubResult}), so `maybeCompact`'s kept-tail scan can tell a SUBSTANTIVE Read
      *  result from a stub hit whose original full transmission may already be summarized away. Present
      *  only with hands (same gate as readTaskFile). */
@@ -707,7 +707,7 @@ export interface Prepared {
      *  `MaybeCompactOptions.onApplied` by every compaction lane. Drops the non-seeded read-state entries
      *  (the summary just replaced the Read results the dedup stubs point at) and re-registers the files
      *  that were re-attached WHOLE. Present only with hands (same gate as readTaskFile).
-     *  RB-197②(codex 命中,已修): `preserveReadState` carries the kept-tail-visible files that were
+     *  RB-197②(命中,已修): `preserveReadState` carries the kept-tail-visible files that were
      *  deliberately skipped for re-attachment — their existing entry must survive the clear too (same
      *  reasoning as a seeded entry: the model's view of the file did not change). */
     onCompactionApplied?: (attachedComplete: ReadonlyArray<{
@@ -731,7 +731,7 @@ export interface Prepared {
     planModeRef: {
         active: boolean;
     };
-    /** [915] A1 (design/66 anchor revision) — the date-flip detector seam: `legDate` = the date frozen
+    /** A1 (design/66 anchor revision) — the date-flip detector seam: `legDate` = the date frozen
      *  into this leg's system prefix; `today()` = the boundary-time LOCAL date (user-zone-bound closure).
      *  The run loop feeds both to the `date_change` attachment producer; the prefix itself never
      *  re-renders mid-leg (cache preservation, CC parity). Present only when the prompt carries a date. */
@@ -953,7 +953,7 @@ export interface PrepareResume {
     /** Digest of that question's batch — the id alone can repeat, so the pairing is what keeps a LATER
      *  question from inheriting the claim that an operator approved it. */
     redeemedContentAskQuestionsHash?: string;
-    /** codex 1360 r6 — true iff this resume will EXECUTE an approved pending tool (`tool_approval`
+    /** true iff this resume will EXECUTE an approved pending tool (`tool_approval`
      *  checkpoint × an `allow` winner). The divergent-restore fail-closed guard keys on THIS, not on the
      *  batch being non-empty: a deny winner executes nothing, so a workspace-root divergence must not
      *  wedge the refusal (it proceeds under the path-state rebase and records the deny). */
@@ -1089,14 +1089,14 @@ export interface InheritedGate {
         /**
          * The environment this screening face was installed against — the source of the `HookEnvCapabilities`
          * handed to it, compared BY REFERENCE, `undefined` when the installation had no env face. Part of the
-         * installation's identity for the same reason the frozen approver is (codex review, HIGH): a face that
+         * installation's identity for the same reason the frozen approver is (HIGH): a face that
          * resolves paths through `ctx.env` answers a different question in a different environment, so an
          * ancestor running against the deployment's tree and a descendant running in an isolated worktree are
          * two screenings, not one. A deployment with a per-task `executionEnvFactory` therefore has its face
          * consulted once per environment on the chain rather than once overall — which is the point: the
          * ancestor's environment is the only place the ancestor's verdict can be reproduced.
          *
-         * ⚠️ RECORDED BOUNDARY (delegation provenance, codex review): the approver half of the key compares
+         * ⚠️ RECORDED BOUNDARY (delegation provenance): the approver half of the key compares
          * through {@link askApproverIdentity}, which by its own contract answers "the same decision-maker",
          * collapsing a `withDelegationProvenance` wrapper onto the approver it forwards to. Two installations
          * whose approvers differ ONLY in the provenance they attach therefore count as one. Raw reference
@@ -1270,7 +1270,7 @@ export interface RunInternals {
      */
     reminderMark?: string;
     /**
-     * RB-204 P1 (codex review) — set UNCONDITIONALLY by every core spawn path (`createSubagentTool`'s
+     * RB-204 P1 — set UNCONDITIONALLY by every core spawn path (`createSubagentTool`'s
      * `childInternals` — shared by all four spawn legs sync/steer/background/fork, its persisted
      * `internalsSnapshot` for revive, and the workflow orchestrator's `spawnAttribution`), regardless
      * of whether a NAMEABLE `parentTaskId`/`parentToolCallId` exists. A directly-started workflow (no
@@ -1310,7 +1310,7 @@ export interface RunInternals {
      * Why internal (not a public `TaskSpec.goalMode`): the guidance promises "declaring done STOPS iteration and
      * surfaces" — a promise only `runGoal`'s loop makes real. A public field would let a caller inject that
      * prompt with no loop behind it (§6.3 honesty violation). `runGoal` injects the `declare_done` tool itself;
-     * this flag only governs the PROMPT (codex r2 — injection-ownership split).
+     * this flag only governs the PROMPT (injection-ownership split).
      */
     goalMode?: boolean;
     /**
@@ -1353,7 +1353,7 @@ export interface RunInternals {
      */
     agentName?: string;
     /**
-     * design/147 S3 (codex R3 label-vs-identity): the EXPLICIT `Agent({name})` spawn identity — set
+     * design/147 S3 (label-vs-identity): the EXPLICIT `Agent({name})` spawn identity — set
      * ONLY when the spawn carried a `name` parameter, unlike {@link agentName} (a DISPLAY label:
      * description or agent-type, present on nearly every spawn). Teammate semantics (hierarchy clamp,
      * teammate addendum, uplink attribution) key on THIS field; keying on the display label made
@@ -1393,7 +1393,7 @@ export interface RunInternals {
      * {@link delegationTaskType} above. TRUSTED run-scoped channel (never a TaskSpec field).
      */
     cycleSeq?: number;
-    /** δ 批 [1498]⑦/A-3 — the ROOT host session of the whole delegation tree (fixed point: the
+    /** The ROOT host session of the whole delegation tree (fixed point: the
      *  spawner passes its own `ctx.rootSessionId ?? ctx.sessionId`, so depth 1 gets the host session
      *  and every deeper level inherits it verbatim). `parentSessionId` is the IMMEDIATE spawner —
      *  after a restart those intermediate sessions are dead ends, and a recovery face enumerating
@@ -1421,7 +1421,7 @@ export interface RunInternals {
      * delegation tool resolves this axis TO that principal.
      */
     registryScope?: string;
-    /** design/148 S1 (codex F2a) — the spawning run's ADOPTED center artifact, threaded down the
+    /** design/148 S1 — the spawning run's ADOPTED center artifact, threaded down the
      *  trusted internals chain so every child in the tree composes the SAME closure (a child must
      *  never spontaneously adopt the live candidate while its parent runs an older pin — that is the
      *  exact mixed-version state the epoch exists to prevent). Resolved by-digest through the
@@ -1482,7 +1482,7 @@ export interface RunInternals {
         priority?: import("../task-notification.js").SystemInjectionPriority;
     }) => void;
     /**
-     * design/147 S3a (codex F2) — the PARENT run's subagent-retain ledger, threaded to a CHILD so its
+     * design/147 S3a — the PARENT run's subagent-retain ledger, threaded to a CHILD so its
      * SendMessage can continue a RETAINED SIBLING (the sibling's retain entry lives on the parent's
      * ledger — without this, sibling resolution succeeds but delivery always reads not-retained).
      * TRUSTED chain; read-only use (the sibling leg resumes through the same fenced resume face).
@@ -1522,7 +1522,7 @@ export interface RunInternals {
      */
     parentCwd?: string;
     /**
-     * [c209-D] codex R3 — the EXPLICIT Agent.cwd request, distinct from the best-effort `parentCwd`
+     * [c209-D] — the EXPLICIT Agent.cwd request, distinct from the best-effort `parentCwd`
      * inheritance hint above: inheritance may be silently ignored by a factory (or absent without one),
      * but an explicit cwd the model asked for MUST either take effect or fail loud. prepareTask enforces
      * the contract: no `executionEnvFactory` ⇒ throw `config.cwd_unsupported`; after env creation the
@@ -1558,7 +1558,7 @@ export interface RunInternals {
      */
     onActivity?: (activity: ToolActivity) => void;
     /**
-     * RB-393① (黑板 [2107]②) — a TRUSTED run-scoped WORKSPACE-observation sink, filled ONLY by a core caller
+     * RB-393① — a TRUSTED run-scoped WORKSPACE-observation sink, filled ONLY by a core caller
      * (the workflow's `ctx.agent` / `ctx.agentStream`, to record an isolated agent's worktree directory on the
      * persisted run record). NEVER a {@link TaskSpec} field — same posture as {@link onActivity}.
      *
@@ -1566,7 +1566,7 @@ export interface RunInternals {
      * {@link RunnerDeps.executionEnvFactory} and lands only on the per-task env's `cwd`; no runner-outward face
      * (TaskEvent union / TaskStream / TaskResult) carries it back. An orchestrator therefore could not record
      * WHERE its isolated agent worked — the recovery path after an interrupted run had to enumerate the
-     * worktrees directory and guess, which is exactly the contradiction [2113] recorded against the
+     * worktrees directory and guess, which is exactly the contradiction recorded against the
      * "isolate-only, userland decides verify/merge" intent.
      *
      * Called at most ONCE per prepared run with the task's FINAL working root (see {@link ResolvedWorkspace}),

package/dist/core/runner/prepare-task.js

@@ -22,7 +22,7 @@ import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import { askApproverIdentity, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, isAskDenyResolution, screenApproverAttribution, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
 const PERSISTED_RULE_TOOL = "Bash";
-import { findAdmittingRule, suggestRulesForCommand } from "../permission-rule-model.js";
+import { findAdmittingRule, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
 import { CHANGED_FILES_MTIME_EPS_MS, fenceMcpServerInstructions, renderAgentListingDelta } from "./turn-attachments.js";
 import { inlineUntrusted } from "../untrusted-text.js";
@@ -437,7 +437,9 @@ function orgRevisionEvidenceOf(resolution, onDefect) {
     return {};
 }
 function persistedRuleHitOf(admitting) {
-    return admitting === undefined ? undefined : { rule: admitting.rule, dots: admitting.adds.map((a) => ({ actor: a.dot.actor, counter: a.dot.counter })) };
+    return admitting === undefined
+        ? undefined
+        : { rules: admitting.map((r) => ({ rule: r.rule, dots: r.adds.map((a) => ({ actor: a.dot.actor, counter: a.dot.counter })) })) };
 }
 function cwdConflictsRestoreError(requestedCwd) {
     const e = new Error(`RunInternals.requestedCwd ("${requestedCwd}") cannot be combined with a checkpoint workspace restore — ` +
@@ -3019,7 +3021,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }));
                         return { unreadable: true };
                     }
-                    return persistedRuleHitOf(findAdmittingRule(listed.rules, { tool: req.toolName, command, cwd: root }));
+                    const admitting = findAdmittingRule(listed.rules, { tool: req.toolName, command, cwd: root });
+                    if (admitting !== undefined)
+                        return persistedRuleHitOf(admitting);
+                    const coverage = segmentCoverageOf(command, { persisted: listed.rules }, { tool: req.toolName, cwd: root });
+                    return coverage !== undefined ? { segmentCoverage: coverage } : undefined;
                 },
             };
         })();
@@ -3049,7 +3055,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 },
             };
         })();
-        const ruleSuggestionsOf = (toolName, args, ask) => {
+        const ruleOffersOf = (toolName, args, ask) => {
             if (permissionRuleLane === undefined || toolName !== PERSISTED_RULE_TOOL)
                 return {};
             if ((spec.principal === undefined || spec.principal === "") && deps.localOwnerRules !== true)
@@ -3071,8 +3077,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const command = args?.command;
             if (typeof command !== "string")
                 return {};
-            const suggestions = suggestRulesForCommand(command);
-            return suggestions.length > 0 ? { ruleSuggestions: suggestions } : {};
+            const offers = suggestRulesForCommand(command, ask?.segmentCoverage !== undefined ? { coverage: ask.segmentCoverage } : undefined);
+            return offers.length > 0 ? { ruleOffers: offers } : {};
         };
         const frozenClassifierExcluded = (d) => d.decisionReason === "hook" || d.matchedAskRule !== undefined;
         const recheckApprovedEdit = async (pol, onAskOf, creq, edit, csignal, ancestorDecider) => {
@@ -3121,7 +3127,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     toolName: creq.toolName,
                     toolCallId: creq.toolCallId,
                     args: editArgs,
-                    ...ruleSuggestionsOf(creq.toolName, editArgs, { ...(re ?? {}), ancestorResolved: true }),
+                    ...ruleOffersOf(creq.toolName, editArgs, { ...(re ?? {}), ancestorResolved: true }),
                     message: re.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                     ...askSourceIdentity(),
                     ...riskAxesOf(creq.toolName),
@@ -3207,7 +3213,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             toolName: creq.toolName,
                             toolCallId: creq.toolCallId,
                             args: presentedArgs,
-                            ...ruleSuggestionsOf(creq.toolName, presentedArgs, { ...(first.action === "ask" ? first : {}), ancestorResolved: true }),
+                            ...ruleOffersOf(creq.toolName, presentedArgs, { ...(first.action === "ask" ? first : {}), ancestorResolved: true }),
                             message: first.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                             ...askSourceIdentity(),
                             ...riskAxesOf(creq.toolName),
@@ -3295,7 +3301,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             toolName: creq.toolName,
                             toolCallId: creq.toolCallId,
                             args: presentedArgs,
-                            ...ruleSuggestionsOf(creq.toolName, presentedArgs, { ...(decision.action === "ask" ? decision : {}), ancestorResolved: true }),
+                            ...ruleOffersOf(creq.toolName, presentedArgs, { ...(decision.action === "ask" ? decision : {}), ancestorResolved: true }),
                             message: decision.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                             ...askSourceIdentity(),
                             ...riskAxesOf(creq.toolName),
@@ -3587,7 +3593,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         const preview = approvalPreviewOf(req.toolName, req.args);
                         return preview !== undefined ? { preview } : {};
                     })(),
-                    ...ruleSuggestionsOf(req.toolName, req.args, decision.action === "ask" ? decision : undefined),
+                    ...ruleOffersOf(req.toolName, req.args, decision.action === "ask" ? decision : undefined),
                     message: decision.message ?? `approval required for "${req.toolName}"`,
                     ...askSourceIdentity(),
                     ...riskAxesOf(req.toolName),
@@ -4064,7 +4070,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
             };
             const suspendAsk = parkLaneArmed && checkpointStore !== undefined
-                ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule, askDecisionReason, probeReason, probeCause) => {
+                ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule, askDecisionReason, probeReason, probeCause, segmentCoverage) => {
                     const syncFirstEligible = req.toolName === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
                     if (syncFirstEligible &&
                         runtimeCaps?.forceDurableGate !== true &&
@@ -4225,11 +4231,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                     const preview = approvalPreviewOf(req.toolName, parkedArgs);
                                     return preview !== undefined ? { preview } : {};
                                 })(),
-                                ...ruleSuggestionsOf(req.toolName, parkedArgs, {
+                                ...ruleOffersOf(req.toolName, parkedArgs, {
                                     ...(realApproval !== undefined ? { requiresRealApproval: true } : {}),
                                     ...(shadowedRule !== undefined ? { persistedRuleShadowed: shadowedRule } : {}),
                                     ...(askDecisionReason !== undefined ? { decisionReason: askDecisionReason } : {}),
                                     ...(inheritedUnavailableAsks.has(req.toolCallId) ? { inheritedUnresolved: true } : {}),
+                                    ...(segmentCoverage !== undefined ? { segmentCoverage } : {}),
                                 }),
                                 boundInputHash: boundInputHashOf(parkedArgs),
                                 batchToolCallIds,
@@ -4355,11 +4362,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                         admits: permissionRuleLane.admits,
                                         onResolved: (info) => emitTrace(deps.tracer, () => ({
                                             kind: "permission.persisted_rule_allowed",
-                                            version: 1,
+                                            version: 2,
                                             taskId: spec.taskId ?? sessionId,
                                             toolName: info.toolName,
                                             toolCallId: info.toolCallId,
-                                            rule: info.rule,
+                                            rules: [...info.rules],
                                             ts: Date.now(),
                                         })),
                                     },

package/dist/core/runner/prepare-workspace-restore.d.ts

@@ -3,7 +3,7 @@ import type { ExecutionEnv } from "../../internal/harness.js";
 import type { RemoteEnvFailureNote, RunnerDeps, TaskSpec } from "../types.js";
 import type { PrepareResume, RunInternals } from "./prepare-task.js";
 /**
- * codex 1360 r2-r4 — rebase one checkpointed absolute path from the OLD workspace root onto the RESTORED
+ * rebase one checkpointed absolute path from the OLD workspace root onto the RESTORED
  * one (divergent `resumeVM`). POSIX-ONLY by contract: every remote lane's `mountPath` is a container
  * path (e2b/k8s/ssh/adb/local-docker are all Linux targets), so a backslash ANYWHERE in the inputs marks
  * the value outside this function's domain and it returns `p` UNCHANGED — an un-rebased path is honestly
@@ -71,7 +71,7 @@ export interface PrepareWorkspaceRestoreInput {
     internals: Pick<RunInternals, "onWorkspaceResolved" | "isolation"> | undefined;
     /** borrowed-readonly — the durable-resume seats this phase reads: the checkpointed
      *  `workspaceHandle` (restore target) and `executesApprovedAction` (the divergence fail-closed
-     *  key — codex 1360 r6). Absent for a fresh/non-durable run: the phase is then root-passthrough. */
+     *  key). Absent for a fresh/non-durable run: the phase is then root-passthrough. */
     resume: Pick<PrepareResume, "workspaceHandle" | "executesApprovedAction"> | undefined;
     /** owned (value) — the pre-restore task root (isolation-aware initial derivation, computed in the
      *  driver). Dead after this call by design (R-5): later phases read the returned

package/dist/core/runner/runtask.d.ts

@@ -145,17 +145,17 @@ export declare class Runner {
     readonly sessions: SessionStore;
     /** Per-sessionId serialization so two tasks never mutate one session concurrently. */
     private sessionLocks;
-    /** service [403](a) — roots whose rewind-files snapshot hit `too_large`, with the refusal time.
+    /** (a) — roots whose rewind-files snapshot hit `too_large`, with the refusal time.
      *  A 20G workspace otherwise pays a full bounded tree-walk (stat tens of thousands of files) EVERY
      *  task just to re-discover the same refusal; once too_large, skip further snapshots for that root
      *  (announced once via onError). E19 semantics unchanged — rewind for that root was already
-     *  impossible. codex 131 审 C: TTL'd (30min), not permanent — a long-lived Runner over a tree the
+     *  impossible. TTL'd (30min), not permanent — a long-lived Runner over a tree the
      *  user later SHRINKS re-probes instead of being locked out until restart.
      *  RB-430-b: `skipAnnounced` makes the SKIP itself observable — one announcement per cooldown window,
      *  so an operator can tell "this turn produced no snapshot" from "snapshots are working", without the
      *  per-turn log spam the latch exists to prevent. Cleared with the entry when the window elapses. */
     private snapshotTooLargeRoots;
-    /** 飞轮 [492]② — task notifications born BETWEEN turns (run torn down / harness already idle), parked
+    /** task notifications born BETWEEN turns (run torn down / harness already idle), parked
      *  per session and drained into the session's next run at its first boundary. Runner-lived (outlives any
      *  single run, like the registry handles that produce into it); bounded + drop-disclosing, see
      *  {@link PendingSessionNotifications}. Not checkpointed — the producing handles are process-local. */
@@ -189,7 +189,7 @@ export declare class Runner {
         builtinAgents?: boolean;
         models?: Record<string, Model>;
     };
-    /** design/125 (codex 实现审 B1) — the deployment-level gating baseline, exposed READ-ONLY so thin
+    /** design/125 (实现审 B1) — the deployment-level gating baseline, exposed READ-ONLY so thin
      *  assemblers over the Runner (`runSpec`) can COMPOSE with it. The task-level engine semantic is a
      *  WHOLE-SLOT override (`spec.toolPolicy ?? deps.toolPolicy`, same for hooks — prepare-task), so any
      *  assembler that sets `spec.toolPolicy`/`spec.hooks` without folding these in silently shadows the
@@ -228,7 +228,7 @@ export declare class Runner {
         models: Record<string, Model>;
         tiers?: Record<string, ModelRef>;
     }): void;
-    /** [1463]① — one-shot brain-routed utility query (see {@link runSideQuery} for the full contract):
+    /** one-shot brain-routed utility query (see {@link runSideQuery} for the full contract):
      *  preserves system/multi-turn messages/tool DEFINITIONS, routes through the deployment's brain with
      *  the same model resolution as tasks, returns real usage/model. No session, no tool execution, no
      *  policy gate, no accounting — caller-trusted. */
@@ -252,7 +252,7 @@ export declare class Runner {
     /**
      * design/101 §E19 — capture a working-tree snapshot of the just-finished turn, keyed by the leaf
      * `SessionTreeEntry.id`. Best-effort + never throws (errors route to `onError(phase:"rewind")`). Runs against
-     * ANY ExecutionEnv (local or remote) when a `fileSnapshotStore` is wired (GATE-SPLIT, service [263]) — the
+     * ANY ExecutionEnv (local or remote) when a `fileSnapshotStore` is wired (GATE-SPLIT) — the
      * snapshot is portable (env FileSystem ops). A deployment wanting VM-snapshot instead wires a VM-backed store.
      */
     private snapshotTurn;
@@ -276,7 +276,7 @@ export declare class Runner {
      * v1 serves only the `human`/`policy_ask` gate (F4). A `task_done` checkpoint (1C Path A) is not
      * resumable here — the caller orchestrates that one and reads its handle directly.
      *
-     * **🔒 Authorization boundary (design/80 D-2 / [122] invariant #1) — token-as-auth, scope is store-level
+     * **🔒 Authorization boundary (design/80 D-2 invariant #1) — token-as-auth, scope is store-level
      * isolation, NOT caller authorization.** `resume` is TOKEN-AS-AUTH: whoever presents a valid, still-`pending`
      * checkpoint token resolves it. The scope passed to the store CAS is the checkpoint's OWN `cp.scope` (read
      * off the row), so the store's scope-WHERE is store-level multi-tenant DATA isolation (one tenant's reaper /
@@ -318,13 +318,13 @@ export declare class Runner {
      * trigger to execute the pending action — a lost CAS rejects, never returns a re-running stream).
      *
      * **Eager (like {@link runTaskStream}):** once this resolves, the resumed run is already executing — the
-     * pending action runs exactly once and the run-loop tail's `teardownOwnedEnv` (service [325]) tears down the
+     * pending action runs exactly once and the run-loop tail's `teardownOwnedEnv` tears down the
      * rebuilt remote env even if you never iterate the stream. So abandoning the returned stream is safe (no leak,
      * no hang); it only means you
      * don't observe the resumed segment's events.
      */
     resumeStream(token: CheckpointToken, outcome: ResumeOutcome, taskConfig: ResumeTaskConfig, 
-    /** service [371]①: the TRUSTED run-internals seam, symmetric with {@link runTaskStream} — a resume leg
+    /** the TRUSTED run-internals seam, symmetric with {@link runTaskStream} — a resume leg
      *  otherwise has no `onForwardEvent`席位, so a subagent's task_progress ticks (child-isolated stream,
      *  only exit = the forward sink) were unreachable on resume. Deployment-owned, never a TaskSpec field.
      *  Parent effective-policy inheritance CONTRACT: a checkpoint whose `state.inheritedGate.
@@ -397,7 +397,7 @@ export declare class Runner {
     private recordCompactionReuse;
     private finish;
     /**
-     * design/48 remote seam + service [325]: tear down a per-task env minted by `executionEnvFactory` (e.g. a
+     * design/48 remote seam +: tear down a per-task env minted by `executionEnvFactory` (e.g. a
      * remote container, or a `withWorktreeIsolation` worktree) — this task owned its lifetime. Best-effort, like
      * `mcp.dispose`: a `destroy()` failure must not break the run. Only `ownedEnv` (factory-produced) is destroyed;
      * a caller-owned static `deps.executionEnv` outlives the task and is left untouched. The service control plane's
@@ -405,7 +405,7 @@ export declare class Runner {
      *
      * Runs from the run-loop tail AFTER every env-reader (finish()'s compaction `attachWorkingFiles` +
      * `snapshotTurn`'s rewind-files capture), so the working tree is still readable when they run. This ORDER is the
-     * fix for service [325]: the old in-`finish()` destroy ran BEFORE `snapshotTurn`, so a factory-minted
+     * fix for a teardown-order defect: the old in-`finish` destroy ran BEFORE `snapshotTurn`, so a factory-minted
      * remote/worktree lane snapshotted an already-destroyed env (plain host/static lanes were false-green).
      *
      * design/49 v1.5 / design/76 §2.5: a SUSPENDED (`suspendRef.token`) or `needs_review` (`reviewRef.token`) pause

package/dist/core/runner/session-rule-policy.d.ts

@@ -15,7 +15,7 @@ import type { SessionPermissionRules } from "../session-policy-store.js";
  *  skill face is a separate capability decision with its own review). */
 export declare const PATH_WRITE_TOOLS: ReadonlySet<string>;
 /** The FULL path-confinable write-tool set: {@link PATH_WRITE_TOOLS} plus `NotebookEdit`, whose write
- *  target is `notebook_path` and is extracted by the shared tool-aware {@link writeTargetPath} ([886]①b —
+ *  target is `notebook_path` and is extracted by the shared tool-aware {@link writeTargetPath} (
  *  notebook_path outranks a decoy `file_path` for that tool).
  *
  *  REF-B3 — the ONE spelling of "tools this codebase can confine by path". Consumers:

package/dist/core/runner/teardown-bounded.d.ts

@@ -1,5 +1,5 @@
 /**
- * RB-470 (blackboard [2310], the D4 never-settle class) — bounded await for BEST-EFFORT teardown /
+ * RB-470 (the D4 never-settle class) — bounded await for BEST-EFFORT teardown /
  * cleanup legs on a run's settle path.
  *
  * The defect class: `resume()`/`runTask` settle only when the run body returns, and the body's tail

package/dist/core/runner/tool-disclosure.d.ts

@@ -77,7 +77,7 @@ export declare function classifyDeferred(opts: {
     fullTools: ReadonlyArray<ToolFingerprintInput>;
     deferMode?: "auto";
     model: Model;
-    /** [1044]② TaskSpec.deferTools — defer ALREADY-MOUNTED tools by wire name (built-ins included;
+    /** TaskSpec.deferTools — defer ALREADY-MOUNTED tools by wire name (built-ins included;
      *  `ToolSpec.defer` only reaches caller specs). Caller pre-filters to mounted names. */
     deferNames?: ReadonlyArray<string>;
     /** RB-400-a — inline-pin names (`TaskSpec.alwaysLoadTools` + the MCP tools whose server declared
@@ -253,7 +253,7 @@ export declare function createToolSearchTool(opts: {
      *  the listing text here and it rides THIS search's own result content — tail of the log, cache
      *  prefix untouched, same channel the activation announcement already uses. */
     listingRide?: (newlyActivated: readonly string[]) => string | undefined;
-    /** [1413]②b (TOOLS-PERFECT): the names callable DIRECTLY right now (mounted non-deferred + activated),
+    /** The names callable DIRECTLY right now (mounted non-deferred + activated),
      *  computed at call time (setTools swaps mutate the surface). Lets the miss note tell the model
      *  "Workflow is already available — call it" instead of a generic not-found that reads as absence
      *  (observed: the model treated the miss as unavailability and only recovered by guessing). */