@sema-agent/core 5.57.0 → 5.59.0

package/dist/core/tool-policy.d.ts

@@ -156,7 +156,7 @@ export declare function screenApproverAttribution(v: unknown): {
  *    denied) so a deny OBSERVER (`Hooks.permissionDenied`) sees the final post-rewrite args, not the
  *    stale un-redacted ones.
  *  - `ask` requests human confirmation; with no approver wired it resolves deterministically to deny
- *    (headless auto-deny, see `RunnerDeps.onAsk`). `requiresRealApproval: true` (RB-203 codex review,
+ *    (headless auto-deny, see `RunnerDeps.onAsk`). `requiresRealApproval: true` (RB-203
  *    confirmed P1) additionally refuses to let a BLANKET `onAsk: "allow"` circumvention clear it — that
  *    configuration is "no approver looked at this at all", indistinguishable from headless, for a rule
  *    whose whole point is that a blanket policy setting must not be the thing that clears it (see
@@ -200,7 +200,8 @@ export type PermissionResult = {
     /** #144 disclosure (additive): a persisted allow rule MATCHED this call but could not clear the
      *  ask, because the ask is MANDATED (operator shellGate:"always", or the tool's own
      *  egress/irreversibility marks) rather than a classifier's hesitation — "allow rules silence
-     *  the classifier's questions, never a mandated one". Carries the matched rule text so a
+     *  the classifier's questions, never a mandated one". Carries the matched rule text — a covering
+     *  SET (conjunction arm) joins up to five sanitized member texts with an "and N more" tail — so a
      *  consumer (approval card, wire frame) can tell the person their rule is alive, just outranked.
      *  Absent ⇒ no rule matched, or the ask was cleared normally. */
     persistedRuleShadowed?: string;
@@ -235,6 +236,16 @@ export type PermissionResult = {
      *  about itself is not evidence). Carried onto the approval request by the gate's own ask mint
      *  site. Display/reconciliation metadata, never adjudication input. */
     ruleEvidence?: AskRuleEvidence;
+    /** design/375 §5.2②: the per-segment coverage table behind this surviving ask — which segments
+     *  of a compound an eligible persisted rule already admits, read off the SAME store read that
+     *  adjudicated the call (snapshot = adjudication snapshot). ENGINE-STAMPED at the gate's one
+     *  stamp point whenever the persisted-rule lane reported one (overwriting a policy's claim);
+     *  consumed only by the offer factory, which puts on the batch offer exactly the segments this
+     *  table calls uncovered. Absent ⇒ all segments read as uncovered (over-offer, the safe way).
+     *  Same display-only posture as {@link persistedRuleShadowed}: never adjudication input, and a
+     *  value nobody stamps over can only shrink or annotate the card's ADVISORY offers — every
+     *  offered rule still passes the validator at redemption. */
+    segmentCoverage?: readonly import("./permission-rule-model.js").SegmentCoverage[];
 } | {
     action: "deny";
     updatedInput?: unknown;
@@ -299,7 +310,9 @@ export interface AskRuleEvidence {
     /** Present iff {@link orgRule} is not. */
     readonly orgRuleAbsent?: AskEvidenceAbsence;
     /** The add dots of the PERSONAL allow rule that matched this call but did not clear the ask (the
-     *  #144 shadowed arm). The dots are the rule's durable identity — unlike
+     *  #144 shadowed arm) — the deduplicated UNION across the covering set when the conjunction arm
+     *  matched, so the array does not belong to one rule on those asks. The dots are the rule's durable
+     *  identity — unlike
      *  {@link AskRequest.persistedRuleShadowed}, which is a sanitized, length-capped DISPLAY value and
      *  deliberately not an identity channel. A rule is a set of adds (concurrent approvals on one text
      *  each redeem their own dot), so this is an array by construction: render/reconcile the entries as
@@ -425,7 +438,7 @@ export declare function checkToolPolicyProjection(projection: Pick<ToolPolicyPro
  * load-bearing — the chain digest binds the ORDERED topology (layer boundaries included), so an
  * opaque layer's position is part of what a resume re-supply must reproduce.
  *
- * F-012 (codex round 12): each entry ALSO carries the serializable DECISION-CHAIN METADATA posture —
+ * F-012: each entry ALSO carries the serializable DECISION-CHAIN METADATA posture —
  * whether the layer was classifier-armed (`autoModeArmed`) and its durable-mandate / content-mandate
  * flags. The digest binds these, so a cross-process resume re-supplying a same-shape chain whose
  * projections match but whose classifier was DROPPED (or whose mandate posture changed) — a
@@ -563,6 +576,13 @@ export declare function createAllowDenyPolicy(opts: {
  * Human-in-the-loop approval for selected tools. Tools in `requireApproval` call `approve(req)` and
  * are allowed only if it resolves true; tools in `deny` are always blocked; everything else is allowed
  * (override with `denyByDefault: true` to allow only `requireApproval` + an explicit `autoAllow`).
+ *
+ * This seat receives a bare `ToolCallRequest`, NOT the ask surface: the decision settles in-place
+ * inside the policy, no AskRequest is minted and `resolveAsk` is never entered — so none of the
+ * ask-side approval members (`hasBidiControls`, `boundInputHash`, `preview`, `riskAxes`, …) exist
+ * here. A surface rendering the command text for a human on this seat must render through
+ * {@link import("./permission-rule-model.js").renderUntrustedCommandText} (the display baseline)
+ * or run its own screen — absence of the warning bit is "not on this surface", never "clean".
  */
 export declare function createApprovalPolicy(opts: {
     /** Tools that need an approval decision. */
@@ -614,7 +634,7 @@ export declare function combinePolicies(...policies: ToolPolicy[]): ToolPolicy;
  * gate at all; the same substitution makes `rm -rf ~/.ai-agent/sessions` a way to erase the audit trail.
  */
 /**
- * RB-153 (server [1708]): EXPORTED. A downstream governance layer keeps its own copy of this list so its
+ * RB-153: EXPORTED. A downstream governance layer keeps its own copy of this list so its
  * per-command ask-list gates the same tools core does, and it had no way to read the real one — its guard
  * had to probe a hand-written candidate list of names, which stays green for any name nobody thought to
  * put in it. The list itself is the fact; publishing it removes the guess.
@@ -721,7 +741,7 @@ export declare function findUnverifiableRecursiveDelete(command: string, safeVar
  * (`decisionReason: "classifier"`, fully audited), an `allow` verdict still requires a live classifier to
  * have actually cleared it, and "no classifier configured" still means deny.
  *
- * codex review (confirmed P1): the one piece of NEW plumbing this DOES need — `requiresRealApproval: true`
+ * A review-confirmed P1 gap: the one piece of NEW plumbing this DOES need — `requiresRealApproval: true`
  * (see {@link PermissionResult}'s `ask` doc) — closes a real gap the first cut of this fix missed. A
  * deployment using the documented `onAsk: "allow"` circumvention mode (sandbox-is-the-boundary posture, the
  * shape a sandboxed autonomy container runs) would otherwise have this rule's `ask` rubber-stamped by that blanket
@@ -790,8 +810,11 @@ export interface AskDelegationProvenance {
 export interface AskRequest {
     toolName: string;
     /** #144: a persisted allow rule MATCHED this call but could not clear the ask (mandated — see
-     *  {@link PermissionResult}'s ask arm). The matched rule text, so the approval card renders "your
-     *  rule is alive, just outranked" instead of leaving the person to regex the message prose. */
+     *  {@link PermissionResult}'s ask arm). The matched rule text — or, when a covering SET admitted the
+     *  command segment-wise (the conjunction arm), a comma-joined display list of up to five sanitized
+     *  rule texts with an "and N more" tail — so the approval card renders "your rule is alive, just
+     *  outranked" instead of leaving the person to regex the message prose. A DISPLAY value, not an
+     *  identity channel: per-rule identity travels on {@link AskRuleEvidence.personalRuleDots}. */
     persistedRuleShadowed?: string;
     /** backlog #239: WHY the reversibility probe did not clear this call — the account of the tighten the
      *  card was showing WITHOUT until now (the gate knew the cause and dropped it at this seam, leaving the
@@ -819,7 +842,7 @@ export interface AskRequest {
     toolCallId: string;
     /** The (post-rewrite) args the tool would run with. */
     args: unknown;
-    /** [1245] — the tool's approval display projection of {@link args} (AgentTool.approvalPreview),
+    /** the tool's approval display projection of {@link args} (AgentTool.approvalPreview),
      *  clamped + control-char-sanitized by the gate. **UNTRUSTED, ADVISORY display metadata**: render
      *  with contextual escaping and show {@link args} alongside — the preview can misrepresent the
      *  executable action and never replaces args. Never adjudication input. */
@@ -834,24 +857,35 @@ export interface AskRequest {
      *  invoke its approver function directly. */
     readonly boundInputHash?: string;
     /**
-     * design/179 §4 — the persistable allow-rule forms this exact call could be covered by, so a surface can
-     * offer "allow, and stop asking me this" with something concrete behind it. Present only when a
-     * persisted allow-rule lane is armed AND the call is one the lane can speak for (a compound, a
-     * redirection or a substitution yields NO suggestion, which is the honest answer rather than an option
-     * that would be refused on redemption) AND the ask is one a persisted rule could actually clear — a
-     * mandated ask (operator shellGate:"always", the tool's own egress/irreversibility marks, a
+     * design/179 §4, re-formed by design/375 §3.1 (BREAKING — this seat REPLACES the retired
+     * `ruleSuggestions` key, which is never emitted again; the new name is the safe failure posture for
+     * the hard-cut window: a consumer that has not upgraded simply renders no "don't ask again" row,
+     * fail toward asking, instead of mis-rendering a consent surface through its old parser) — the
+     * persistable allow-rule OFFERS this exact call could be covered by, so a surface can render
+     * "allow, and stop asking me this" with something concrete behind it. Present only when a persisted
+     * allow-rule lane is armed AND the call is one the lane can speak for (a redirection or a
+     * substitution yields NO offer, which is the honest answer rather than an option that would be
+     * refused on redemption) AND the ask is one a persisted rule could actually clear — a mandated ask
+     * (operator shellGate:"always", the tool's own egress/irreversibility marks, a
      * `requiresRealApproval` demand) and an ask carrying {@link persistedRuleShadowed} offer none.
      *
-     * CONTRACT — array order is display order, narrowest first: the EXACT form is always index 0, a
-     * broader reviewed PREFIX form (at most one) follows. Basis ≤ 2. Selection indices and redemption
-     * tickets are keyed against this order, and the durable park row carries the same array under the
-     * same contract.
+     * CONTRACT — see {@link import("./permission-rule-model.js").RuleOffer} for the closed union, the
+     * per-element parse/degrade rules and the original-index-keying obligation. Array order is display
+     * order: at most 2 offers, the whole-string EXACT single always index 0 when present, the BATCH
+     * offer (a compound's per-segment conjunction — choosing it is one yes to all of its 1..5 rules at
+     * once) always last. Selection indices (`confirmRuleApproval`'s `selectedOffer`) are keyed
+     * against this order; redemption TICKETS are NOT — they key on the consent record's flat
+     * CANDIDATE list (a batch's members each carry their own ticket), so a chosen offer is redeemed
+     * via `redeemRuleBatch`, never by indexing a ticket array with an offer index. The durable park
+     * row carries the same array under the same contract.
      *
      * ADVISORY display metadata, never adjudication input, and never a rule by itself: minting one is a
      * separate act that goes through the approval-record protocol, so a surface that ignores this field
-     * changes nothing about what is allowed.
+     * changes nothing about what is allowed. The AUTHORITATIVE render source for a consent card is the
+     * PREPARED approval record's own offers; this member is the ask-time projection, which may drift
+     * from it across a coverage change — harmlessly, since the record is what gets confirmed.
      */
-    readonly ruleSuggestions?: readonly import("./permission-rule-model.js").RuleSuggestion[];
+    readonly ruleOffers?: readonly import("./permission-rule-model.js").RuleOffer[];
     /** The human/model-readable prompt explaining what needs approval. */
     message: string;
     /** Runner-filled source identity (design S1d §1): the end-user {@link AskRequest} issuing task's
@@ -868,7 +902,7 @@ export interface AskRequest {
      *  Runner mints it); a top-level caller MAY continue its own session id via `TaskSpec.sessionId`, so this
      *  is NOT a global "never forgeable" run id — aggregation only aggregates delegated workers, the context
      *  where it holds (design S1d §1.3). `readonly` + same sync-path-only / P-a caveat as `principal`.
-     *  Undefined ⇒ no source task id. **NOT a subagent discriminator** ([1546] MED-1: the HOST's own asks
+     *  Undefined ⇒ no source task id. **NOT a subagent discriminator** (the HOST's own asks
      *  carry it too — it is always the issuing task's session id); "from a background agent" attribution
      *  keys on {@link fromSubagent}, never on this field's presence. */
     readonly sourceTaskId?: string;
@@ -892,7 +926,7 @@ export interface AskRequest {
      *  non-fork facet of `effectiveDelegationFacts`, serving the authority/context faces, excludes it), but
      *  its interaction contract is one-shot — "report once and stop … no waiting for the user"
      *  (FORK_DIRECTIVE_FRAME) — so a stop-and-wait refusal would instruct it to do the impossible
-     *  (codex adversarial round, confirmed). NOT the same fact as {@link fromSubagent} either: that is
+     *  (confirmed). NOT the same fact as {@link fromSubagent} either: that is
      *  the design/153 attribution discriminator (`parentTaskId` presence), which a directly-started
      *  workflow's children lack even though refusals must still speak the child posture to them.
      *  `readonly`, trusted (internals never ride a TaskSpec), sync-path-only like its siblings.
@@ -903,7 +937,7 @@ export interface AskRequest {
      *  - `isDelegatedChild` — REFUSAL POSTURE: "no user turn ever lands in this run's transcript";
      *    drives which deny text the model is told (stop-and-wait vs adapt-or-report), forks included. */
     readonly isDelegatedChild?: true;
-    /** RB-203 (codex review, confirmed P1) — carried from the originating {@link PermissionResult}'s ask
+    /** RB-203 (confirmed P1) — carried from the originating {@link PermissionResult}'s ask
      *  variant of the same name: `true` ⇒ {@link resolveAsk} must not let a blanket `onAsk: "allow"`
      *  clear this ask (see that field's doc). `readonly`, filled by the gate from the decision, never a
      *  caller/worker-settable field. */
@@ -925,6 +959,43 @@ export interface AskRequest {
      *  so this — like `principal`/`sourceTaskId` — exists only on the synchronous resolution path.
      *  See {@link AskDelegationProvenance} for the trust posture of each member. */
     readonly delegation?: AskDelegationProvenance;
+    /**
+     * PRESENCE ONLY: the command/argument text this ask is about carries at least one DIRECTIONAL
+     * format control ({@link BIDI_CONTROL_RE} — the closed set: U+061C, U+200E/U+200F, the embeddings
+     * and overrides U+202A–U+202E, the isolates U+2066–U+2069). Those characters change nothing about
+     * what EXECUTES and everything about what a terminal or a card SHOWS: bytes that run
+     * `rm -rf /` can display as a benign line, which is precisely the deception an approval surface
+     * cannot afford to render unannotated.
+     *
+     * A WARNING BIT, not a verdict and not a transform. Core does NOT strip, reorder, refuse or rewrite
+     * anything on account of it — {@link args} is delivered byte-identical either way, and the decision
+     * stays the approver's. What a surface owes the person is a visible "the text below can display
+     * differently from what it runs" and a rendering that neutralizes the controls (see
+     * {@link import("./permission-rule-model.js").renderUntrustedCommandText} for the display baseline).
+     *
+     * Read it as PRESENCE-or-nothing: the field is either `true` or ABSENT. It is never written `false`,
+     * because absence means "not detected", which honestly covers both "clean" and "the bounded scan did
+     * not reach it" (a pathologically deep or huge argument graph stops at the scan budget) — a `false`
+     * would claim a proof the scan does not offer. Judged over the EXECUTING argument snapshot and the
+     * tool's own {@link preview} projection, i.e. the payload; {@link message} is deliberately out of
+     * scope (engine/policy-composed prose, not the thing that runs).
+     *
+     * Filled at the `resolveAsk` chokepoint, beside {@link boundInputHash} — every wired `onAsk`
+     * approver call crosses it, so an ask mint site added later is covered by construction. Optional
+     * on the type because a deployment may invoke its approver function directly.
+     *
+     * SCOPE, stated so absence is not read as a clean bill on the other routes: this is the
+     * SYNCHRONOUS `onAsk` ask, like `principal`/`sourceTaskId` — the closure claim is over AskRequest
+     * mint sites, not over every approval callback. Two human-decision routes never receive it:
+     * ① a durable park/suspend never invokes `onAsk`, so a parked approval row carries no twin of
+     * this bit today — an inbox rendering `RiskDescriptor` must run its own screen (or the display
+     * baseline above) rather than infer "no bit, no problem"; ② {@link createApprovalPolicy}'s
+     * `approve` seat resolves in-place inside the policy and mints no AskRequest at all — its
+     * callback receives a bare `ToolCallRequest` (no bit, no {@link boundInputHash}, none of this
+     * surface), so a deployment doing HITL through that seat must render through
+     * {@link import("./permission-rule-model.js").renderUntrustedCommandText} or run its own screen.
+     */
+    readonly hasBidiControls?: true;
 }
 /**
  * How an `ask` decision is resolved when a policy/hook requests human confirmation (design/37):
@@ -933,7 +1004,7 @@ export interface AskRequest {
  *  - `"allow"` — auto-approve every `ask` (e.g. a trusted batch run).
  *  - a function — await an operator's decision (true=allow, false=deny). `signal` fires when the task
  *    aborts; race your wait against it so an unanswered ask is released at the deadline, not hung.
- *    G1 three-value ([871]①): the function may also return `"unavailable"` — an affirmative "no operator
+ *    G1 three-value: the function may also return `"unavailable"` — an affirmative "no operator
  *    is reachable for THIS ask right now" (judged PER-ASK inside the callback, not at wire time). It is a
  *    ROUTING verdict, not a decision: the gate re-routes the ask onto the durable park leg (same behavior
  *    as if no live approver were wired — checkpoint + suspend, the 1.293 fallback), and when no park
@@ -948,7 +1019,7 @@ export interface AskRequest {
  */
 export type OnAsk = "deny" | "allow" | ((req: AskRequest, signal?: AbortSignal) => AskOutcome | Promise<AskOutcome>);
 /**
- * What an `onAsk` approver may return ([1458]/[1462] object arm):
+ * What an `onAsk` approver may return (object arm):
  *  - `boolean` — plain verdict (true=allow, false=deny). STRICT fold (RB-482 #17, server bridge
  *    zero-ripple confirmed): only the literal `true` approves; an out-of-contract truthy from an
  *    untyped bridge is a fail-closed deny naming the defect (the historical truthy leniency was a
@@ -982,7 +1053,7 @@ export type OnAsk = "deny" | "allow" | ((req: AskRequest, signal?: AbortSignal)
  * input), relayed to the model so it can follow the person's direction instead of guessing. In-place
  * conditions, all screened at {@link resolveAsk}:
  *  - meaningful ONLY on a deny (`allow: false`); on an allow the seat is NEVER READ (accepted and
- *    unused, literally — codex round: a junk value or a throwing accessor riding an approval cannot
+ *    unused, literally: a junk value or a throwing accessor riding an approval cannot
  *    destroy the approval). Same net posture as the durable leg, where a `reason` on an `allow` row
  *    is never rendered;
  *  - UNTRUSTED input (a human's free text riding a callback): it reaches the model only inside a
@@ -1128,7 +1199,7 @@ export declare function coreMintedResolutionOf(d: unknown, call: {
  */
 export type ResolvedAsk = PermissionResult & {
     approverUnavailable?: true;
-    /** [1462] r5 — the EXACT data snapshot the approver was shown (the `structuredClone` of the
+    /** The EXACT data snapshot the approver was shown (the `structuredClone` of the
      *  presented args). On a plain approval (no edit) the gate EXECUTES this snapshot, not the original
      *  object: a stateful getter or an external alias must not be able to make the executed action
      *  differ from the approved one (shown == executed, by construction). Set only on the
@@ -1149,6 +1220,20 @@ export type ResolvedAsk = PermissionResult & {
      *  frame), so a consumer classifies a refusal by code instead of parsing its text. */
     resolution?: AskDenyResolution;
 };
+/**
+ * Does any string reachable in `value` carry a {@link BIDI_CONTROL_RE} member? Bounded, cycle-safe,
+ * and never throwing — the one caller is on the approval path, where a scan that failed must degrade
+ * to "not detected" rather than turn an ask into an error (the `deliverEngineNotice` posture: a
+ * derived disclosure must never become the failure of the thing it describes).
+ *
+ * OBJECT KEYS are scanned as well as values: a key is displayed text too, and an argument object
+ * `{ "cmd<RLO>": … }` renders its own reordering in any card that prints the shape (the marker
+ * is spelled out here on purpose — a literal one in this comment would reorder the comment).
+ *
+ * Not a public export: the contract is the {@link AskRequest.hasBidiControls} bit, and a second
+ * spelling of "does this carry bidi" on the public surface would be one more thing to keep in step.
+ */
+export declare function carriesBidiControls(value: unknown): boolean;
 /**
  * Resolve an `ask` decision to a terminal `allow`/`deny` via {@link OnAsk}. Centralizes the headless
  * auto-deny default, fail-closed error handling, and stable deny reasons so every ask site is

package/dist/core/tool-policy.js

@@ -900,6 +900,78 @@ export function coreMintedResolutionOf(d, call) {
         return undefined;
     return isAskDenyResolution(v.resolution) ? v.resolution : undefined;
 }
+const BIDI_CONTROL_RE = /[\u061C\u200E\u200F\u202A-\u202E\u2066-\u2069]/u;
+const BIDI_SCAN_MAX_NODES = 5_000;
+const BIDI_SCAN_MAX_CHARS = 1_000_000;
+export function carriesBidiControls(value) {
+    let budget = BIDI_SCAN_MAX_NODES;
+    let charBudget = BIDI_SCAN_MAX_CHARS;
+    const seen = new WeakSet();
+    const scan = (s) => {
+        if (charBudget <= 0)
+            return false;
+        const window = s.length <= charBudget ? s : s.slice(0, charBudget);
+        charBudget -= window.length;
+        return BIDI_CONTROL_RE.test(window);
+    };
+    const walk = (v) => {
+        if (budget-- <= 0)
+            return false;
+        if (typeof v === "string")
+            return scan(v);
+        if (typeof v !== "object" || v === null)
+            return false;
+        if (seen.has(v))
+            return false;
+        seen.add(v);
+        if (Array.isArray(v)) {
+            for (const el of v) {
+                if (walk(el))
+                    return true;
+                if (budget <= 0)
+                    return false;
+            }
+            return false;
+        }
+        if (v instanceof Map) {
+            for (const [k, val] of v) {
+                if (walk(k) || walk(val))
+                    return true;
+                if (budget <= 0)
+                    return false;
+            }
+            return false;
+        }
+        if (v instanceof Set) {
+            for (const el of v) {
+                if (walk(el))
+                    return true;
+                if (budget <= 0)
+                    return false;
+            }
+            return false;
+        }
+        for (const k in v) {
+            if (budget-- <= 0)
+                return false;
+            if (!Object.prototype.hasOwnProperty.call(v, k))
+                continue;
+            if (scan(k))
+                return true;
+            if (walk(v[k]))
+                return true;
+            if (budget <= 0 || charBudget <= 0)
+                return false;
+        }
+        return false;
+    };
+    try {
+        return walk(value);
+    }
+    catch {
+        return false;
+    }
+}
 export async function resolveAsk(req, onAsk, signal) {
     const r = await resolveAskArms(req, onAsk, signal);
     if (r.action === "deny" && isAskDenyResolution(r.resolution))
@@ -954,7 +1026,14 @@ async function resolveAskArms(req, onAsk, signal) {
                 settledBy: "aborted",
             };
         }
-        ok = await onAsk({ ...req, boundInputHash: boundInputHashOf(presented.value), args: approverView.value }, signal);
+        const bidi = carriesBidiControls(presented.value) || carriesBidiControls(req.preview);
+        const { hasBidiControls: _carried, ...bare } = req;
+        ok = await onAsk({
+            ...bare,
+            boundInputHash: boundInputHashOf(presented.value),
+            args: approverView.value,
+            ...(bidi ? { hasBidiControls: true } : {}),
+        }, signal);
     }
     catch (err) {
         return {

package/dist/core/tool-result-budget.d.ts

@@ -27,7 +27,7 @@ export interface AggregateBudgetOptions {
     store?: ToolResultStore;
     /** Namespaces the stable ref so an offloaded result is globally addressable. */
     sessionId: string;
-    /** service [398] C8: fired once per result actually capped (offloaded OR degraded to a truncation
+    /** C8: fired once per result actually capped (offloaded OR degraded to a truncation
      *  preview). `storeFallback` = the model LOST read-back for this result (store.put failed / no store)
      *  — the silent-degradation face this callback exists for. Must not throw (caller-side contract). */
     onCapped?: (info: {

package/dist/core/tool-result-store.d.ts

@@ -310,7 +310,7 @@ export interface ToolResultSlice {
 }
 /** Default in-memory store (no cross-process durability); write-once per ref.
  *
- *  Blackboard 2026-07-03 (clay dogfood: `ReadToolResult(ref)` came back empty for a workflow child's
+ *  Field-reported (`ReadToolResult(ref)` came back empty for a workflow child's
  *  offloaded output): the Runner now shares ONE instance across its tasks (instead of a per-task
  *  island), so a parent can deref a child's ref within the process. A shared long-lived instance
  *  needs a bound — `maxTotalChars` FIFO-evicts the oldest refs past the cap (an evicted deref lands
@@ -351,7 +351,7 @@ export declare class InMemoryToolResultStore implements ToolResultStore {
 export declare class RunnerSharedToolResultStore extends InMemoryToolResultStore {
 }
 /**
- * Per-task view over the Runner-shared fallback (impl-review 2026-07-03, codex 2 BLOCKER):
+ * Per-task view over the Runner-shared fallback (impl-review 2026-07-03):
  * 1. **Tenant isolation**: refs are namespaced by the task's trust scope (principal), so tenant B's
  *    `ReadToolResult` can never deref tenant A's ref — the per-task-instance era made this isolation
  *    implicit; sharing one instance re-opened it. Same-scope cross-task deref (the A2 fix's whole

package/dist/core/tools.d.ts

@@ -2,7 +2,7 @@ import type { TSchema } from "typebox";
 import type { AgentTool } from "../internal/harness.js";
 import type { ToolExecuteContext, ToolSpec } from "./types.js";
 /**
- * E1(黑板 [1937],test/server/cli 三方交叉核实): wrap an already-built failure message string into the
+ * Wrap an already-built failure message string into the
  * `ToolReturn` shape that actually signals failure. A bare `string` return is UNCONDITIONALLY
  * `isError:false` (see `ToolReturn.isError`'s own doc comment) — the toolkit-wide survey found 120+
  * sites across fs/web/sql/scheduler/worktree/etc. that build a correct `"Error (...): ..."` message

package/dist/core/trace.d.ts

@@ -87,11 +87,11 @@ export type TraceEvent = {
         hash: string;
     }>;
     /**
-     * Manifest v2 (campaign S1, ADDITIVE — the v1 `blocks` id wordlist above is a downstream
+     * Manifest v2 (stage S1, ADDITIVE — the v1 `blocks` id wordlist above is a downstream
      * contract and stays as-is): the compiled-IR view, one entry per pack section, carrying the
      * assembly protocol's semantic/lifecycle dimensions (slot/carrier/cadence/cacheClass).
      * Absent on the legacy free-form provider path (single opaque block, no section structure).
-     * `contentHash` (digest tiering, [1050]②): UNSALTED full sha256, present ONLY on
+     * `contentHash` (digest tiering): UNSALTED full sha256, present ONLY on
      * operator-declared sections (typed `stableBlocks` lane) — the center-publish ↔ manifest
      * reconciliation anchor. Core-native sections stay salted-only (`hash`).
      */
@@ -106,7 +106,7 @@ export type TraceEvent = {
         contentHash?: string;
     }>;
     /**
-     * Campaign S2 (additive): the mounted tools plane — per-tool contract identity, durable-replay
+     * S2 (additive): the mounted tools plane — per-tool contract identity, durable-replay
      * aliases, presentation-invariant shape digest and full wire-schema digest (initial mount face;
      * deferred activations announce via tools_delta). Content-addressed digests (schemas are code).
      */
@@ -128,7 +128,7 @@ export type TraceEvent = {
     toolDisclosure?: ToolDisclosureManifest;
     ts: number;
 } | {
-    /** design/148 S3 (codex F3) — a mid-run identity refresh (deferred materialization / RB-31
+    /** design/148 S3 — a mid-run identity refresh (deferred materialization / RB-31
      *  adoption / finalize thinking flip): the trace stream must never keep claiming a superseded
      *  prefix identity. Digests only, never prompt text. */
     kind: "prompt.snapshot_changed";
@@ -204,7 +204,7 @@ export type TraceEvent = {
     ts: number;
 } | {
     /**
-     * Config-catalog manifest (clay ruling 2026-07-19) — the run's EFFECTIVE task-launch config
+     * Config-catalog manifest (ruled 2026-07-19) — the run's EFFECTIVE task-launch config
      * with per-field provenance (default / spec / derived / host-declared), emitted once right
      * after `prompt.assembled`. Kills the "which layer set this knob" archaeology: every run
      * self-reports its true scale, and host-layer overrides arrive as DECLARED entries
@@ -266,7 +266,7 @@ export type TraceEvent = {
      *  loop breathes, so lateness this size means the environment starved the process (run89: an
      *  abandoned compile group froze the loop 646s; the 1200s hard abort landed 683s late). */
     timerLatenessMs?: number;
-    /** RB-20 (TB [991] b-form): the run was stopped by the SYNCHRONOUS turn-boundary walltime
+    /** RB-20 (TB b-form): the run was stopped by the SYNCHRONOUS turn-boundary walltime
      *  backstop, not the hard-abort timer — i.e. the deadline had passed but the setTimeout leg
      *  had not fired yet (starved event loop). Pairs with `timerLatenessMs` for attribution. */
     walltimeSyncBackstop?: boolean;
@@ -314,7 +314,7 @@ export type TraceEvent = {
     callStartedAt?: number;
     /** ABSENT when THIS call's serving model was unpriced (RB-368 — no fabricated 0). */
     costMicroUsd?: number;
-    /** TB telemetry B1 (service [397]): the NORMALIZED finish reason of this call (`StopReason`:
+    /** TB telemetry B1: the NORMALIZED finish reason of this call (`StopReason`:
      *  `"stop"`/`"length"`/`"toolUse"`/`"error"`/`"aborted"`). Post-normalization (Anthropic
      *  `end_turn`/`stop_sequence`→`"stop"`, `max_tokens`→`"length"`). */
     stopReason?: string;
@@ -345,7 +345,7 @@ export type TraceEvent = {
     effect?: ToolEffect;
     ts: number;
 } | {
-    /** Degenerate-repetition detector telemetry (clay 2026-07-10, 2e1c161 observability): a model
+    /** Degenerate-repetition detector telemetry (2026-07-10, 2e1c161 observability): a model
      *  stream was CUT for a degenerate loop, or a repetition landed in a detection window but was
      *  SPARED by a structural allowance (code-line shape / divider run). One event per detector hit. */
     kind: "repetition.detected";
@@ -386,17 +386,20 @@ export type TraceEvent = {
     ts: number;
 } | {
     /**
-     * design/179 — a persisted allow rule resolved an ask, so no person was asked and no checkpoint was
-     * minted. The gate has an attribution channel for the deny side and had none for the allow side;
-     * this is that channel, because "why did this run without asking me?" must be answerable. Metadata
-     * only (the rule text is the canonical rule spelling, never the command's arguments).
+     * design/179 — a persisted allow-rule COVERAGE resolved an ask, so no person was asked and no
+     * checkpoint was minted. The gate has an attribution channel for the deny side and had none for
+     * the allow side; this is that channel, because "why did this run without asking me?" must be
+     * answerable. Metadata only (each rule text is the canonical rule spelling, never the command's
+     * arguments). version 2 (design/375, BREAKING): `rule: string` became `rules: string[]` — a
+     * compound may now be admitted by the CONJUNCTION of per-segment rules, and the attribution names
+     * every rule the decision stood on (a single-rule resolution is a one-element array).
      */
     kind: "permission.persisted_rule_allowed";
-    version: 1;
+    version: 2;
     taskId: string;
     toolName: string;
     toolCallId: string;
-    rule: string;
+    rules: readonly string[];
     ts: number;
 } | {
     /**
@@ -571,12 +574,12 @@ export type TraceEvent = {
     trigger: "auto" | "manual";
     ts: number;
 } | {
-    /** MF-18 修① [496]③ — a compaction pass FAILED: either a burned summary attempt threw
+    /** MF-18 修① — a compaction pass FAILED: either a burned summary attempt threw
      *  (summarizer error / empty summary / oversized-summary guard; counted toward the §17.4
      *  breaker) or a manual /compact was drained against an ALREADY-OPEN breaker (no attempt).
      *  Before this frame the only evidence was `Runner.onError(phase:"compaction")` — a service
      *  that acked the manual verb (202) but saw no `compacted` event had ZERO stream/trace signal
-     *  about why (the [496]③ fingerprint). */
+     *  about why (the fingerprint). */
     kind: "compaction.failed";
     version: 1;
     taskId: string;
@@ -586,7 +589,7 @@ export type TraceEvent = {
     reason: string;
     ts: number;
 } | {
-    /** MF-18 修① [496]③ — a manual /compact request was PROCESSED but MOOTED: the loop is dying
+    /** MF-18 修① — a manual /compact request was PROCESSED but MOOTED: the loop is dying
      *  (abort fired / durable suspend / plan review in flight) so no compaction can run. The
      *  compact() promise resolves "mooted"; this frame is the trace-side counterpart.
      *  `reason:"cancelled"` (additive) — the caller withdrew an IN-FLIGHT request via
@@ -601,7 +604,7 @@ export type TraceEvent = {
     reason: "task_ending" | "cancelled";
     ts: number;
 } | {
-    /** MF-18 修① [496]③ — a manual /compact attempt ran but found NOTHING to compact (no valid
+    /** MF-18 修① — a manual /compact attempt ran but found NOTHING to compact (no valid
      *  cut point / empty history): `maybeCompact` returned a structural `{compacted:false}` on a
      *  forced pass. Manual-only by design — an auto pass no-ops at nearly every boundary (spam). */
     kind: "compaction.noop";
@@ -609,7 +612,7 @@ export type TraceEvent = {
     taskId: string;
     ts: number;
 } | {
-    /** MF-18 修① [496]③ — a manual /compact was processed while compaction is DISABLED by the
+    /** MF-18 修① — a manual /compact was processed while compaction is DISABLED by the
      *  task spec (`compaction.enabled:false`): the request can never be honored this run. */
     kind: "compaction.disabled";
     version: 1;
@@ -667,7 +670,7 @@ export type TraceEvent = {
     taskId: string;
     ts: number;
 } | {
-    /** MF-18 修② [496]③ — the summarization INPUT was truncated to fit the compaction model's
+    /** MF-18 修② — the summarization INPUT was truncated to fit the compaction model's
      *  context window (the 300K-session shape that previously guaranteed a prompt-too-long throw
      *  at every boundary). Fidelity disclosure: oldest `droppedChars` characters of the serialized
      *  conversation were omitted from the summary prompt. */
@@ -708,8 +711,8 @@ export type TraceEvent = {
     durationMs: number;
     ts: number;
 } | {
-    /** MF-18 修③ [496]③ — a compaction landed at the run's FINAL boundary and the one-shot
-     *  post-compact announce latch (background-task snapshot, G1 [482]) was never consumed: the
+    /** MF-18 修③ — a compaction landed at the run's FINAL boundary and the one-shot
+     *  post-compact announce latch (background-task snapshot, G1) was never consumed: the
      *  next collected boundary it waits for never came. The announce is lost for THIS run (a
      *  follow-up run on the same session re-arms it from the session tail — see the resume
      *  re-arm seed in runtask). */
@@ -758,7 +761,7 @@ export type TraceEvent = {
     /** C11 — a tool requested a human plan review (`ctx.requestReview()`) but the deployment cannot
      *  honor it (no checkpoint store / loop already terminating): the request was consumed + DROPPED
      *  (headless degrade). The HITL ask vanished with zero signal before this. NO free-text reason
-     *  field (codex MED: `requestReview({reason})` carries tool/model-authored text — the file-header
+     *  field (`requestReview({reason})` carries tool/model-authored text — the file-header
      *  metadata-only rule forbids it here; the fact of the drop is the signal). */
     kind: "review.dropped";
     version: 1;