@sema-agent/core 5.63.0 → 5.64.0

package/CHANGELOG.md

@@ -1,5 +1,61 @@
 # Changelog
 
+## 5.64.0 — 2026-08-27
+
+### BREAKING
+- **design/380 batch 1 — device-lane placement identity**: `ExecutionEnvFactoryContext` grows a
+  REQUIRED `placementRootSessionId` (the run TREE's fixed point, minted once as
+  `placementRoot ?? rootSessionId ?? sessionId`; an empty resolved value is refused loudly as
+  `config.placement_root_invalid` before the factory is ever called). Deployment code that
+  CONSTRUCTS its own factory context gains a compile-time break — factory *implementors* are purely
+  additive. The fixed point threads through cascade rungs, verification legs and every spawn family
+  (subagent, workflow), so a descendant's fresh session id can no longer read as a new placement;
+  durable-resume carriage is the next batch's seat (`O1③`) and its current fallback is pinned in the
+  tree so landing it must flip the pin consciously.
+
+### Added
+- `WorkspaceHandle.deviceId` — explicit, minter-stated identity of the target a workspace lives on
+  (rides the checkpoint's all-string handle whitelist unchanged).
+- `outcome_unknown` joins `ExecutionErrorCode`, `FileErrorCode` and `RemoteExecutionErrorCode`, and
+  `target_unavailable` joins `ExecutionErrorCode`: an op COMMITTED to a remote target whose outcome
+  is unknowable must never be auto-retried (it is deliberately NOT in
+  `RETRYABLE_REMOTE_ERROR_CODES`), while a never-started commit refusal is retry-safe by contract.
+  `precondition_failed` joins `FileErrorCode` for the guarded write below. **Downstream exhaustive
+  switches over these unions will red — re-pin per the new members.**
+- `FileSystem.writeFileGuarded?` (+ `WriteExpectation` / `WriteReceipt`, both type-only exports):
+  optional atomic verify-and-write with a receipt of the real on-disk object, carrying
+  `writeFileExclusive`'s degradation law verbatim (a backend without the primitive leaves it
+  `undefined` rather than emulating it). New deployment knob `requireGuardedWrite` (default off,
+  byte-identical): armed, a covered write on an env lacking the capability is a typed refusal
+  instead of a silent fallback.
+- `UsageWindow.maxTokens` becomes optional (#480): a window may govern by `maxCostUsd` alone. A
+  window declaring NEITHER ceiling refuses loudly, the exhaustion arithmetic reads declared axes
+  only, and a `maxCostUsd` whose micro-USD conversion overflows is refused at the door instead of
+  being admitted and never binding (**named narrowing**: a dual window declaring such a ceiling
+  previously ran with its money arm silently dead).
+
+### Fixed
+- **#477 — the `before_agent_start` replacement prompt is run-scoped**: the between-turn rebuild
+  now carries it, so a run's prompt is byte-stable across its three legal change points (run start /
+  compaction-boundary epoch adoption / clear) instead of silently reverting to the base prompt from
+  turn 2 (which also broke prefix-cache stability). Deployments with no handler — or whose handler
+  returns no `systemPrompt` — are byte-identical.
+- **#482 / #486 — read-only command judgment, both directions**: the allowlist grows to CC's safe
+  command set (with per-verb availability guards), a classify-only superset admits `find`/`sed`/`cd`
+  behind CC's own guard grammars, and compound judgment now THREADS the base a `cd` actually moves —
+  every segment's containment *and* deny resolve against the base bash will have, and a poll-loop
+  body containing a `cd` is judged over its worst-case iterated shift. Two escapes are closed (an
+  iterated `cd ..` loop climbing out of the read roots; a `cd` eating the first segment of a
+  multi-segment deny pattern). **This is a judgment fix, not a narrowing**: legitimately-configured
+  full-read deployments keep zero-ask on the same commands, pinned by positive controls carrying the
+  same weight as the escape pins.
+- **#473** the resume verb snapshots its config once at the door (a mutated bag can no longer make
+  the identity gate and the resumed leg disagree); **#474** the prompt-too-long recovery lane adopts
+  the rebuilt prompt and honours the turn-scoped abort; **#470/#475** a workflow run that overran
+  its token ceiling discloses it on the list projection as well as the full record; **#468**
+  `SubagentSteerHandle.steer` gains the `inputId` pass-through its workflow twin already had.
+
+
 ## 5.63.0 — 2026-08-27
 
 ### BREAKING

package/dist/agents/cascade.d.ts

@@ -199,6 +199,10 @@ export declare function runCascade(runner: Runner, spec: TaskSpec, config: Casca
  * what teardown does to the workspace is the factory's business.
  *
  * Absent ⇒ every rung is dispatched exactly as before (the call site passes `undefined`, which is
- * what an omitted optional argument already was).
+ * what an omitted optional argument already was) — with ONE design/380 O1② placement delta either
+ * way: when neither `placementRoot` nor `rootSessionId` is present, rungs after the first are
+ * dispatched with a fresh shallow copy carrying `placementRoot` = the first rung's resolved
+ * sessionId (the ladder's placement fixed point); every other field still rides by the same
+ * reference, and an internals object that already carries a fixed point is forwarded verbatim.
  */
 internals?: RunInternals): Promise<CascadeRunResult>;

package/dist/agents/cascade.js

@@ -57,6 +57,7 @@ export async function runCascade(runner, spec, config, internals) {
     });
     let lastResult;
     let passedRung = -1;
+    let ladderPlacementRoot;
     const { sessionId: _drop, ...specBase } = spec;
     for (let i = 0; i < maxRungs; i++) {
         if (deadlineAt !== undefined && Date.now() >= deadlineAt)
@@ -81,14 +82,18 @@ export async function runCascade(runner, spec, config, internals) {
                 ? AbortSignal.any([specBase.signal, rungAbort.signal])
                 : rungAbort.signal;
         let result;
+        const rungInternals = ladderPlacementRoot === undefined || internals?.placementRoot !== undefined || internals?.rootSessionId !== undefined
+            ? internals
+            : { ...internals, placementRoot: ladderPlacementRoot };
         try {
-            result = await runner.runTask({ ...specBase, model: rung.model, ...(rung.overrides ?? {}), ...(rungSignal ? { signal: rungSignal } : {}) }, internals);
+            result = await runner.runTask({ ...specBase, model: rung.model, ...(rung.overrides ?? {}), ...(rungSignal ? { signal: rungSignal } : {}) }, rungInternals);
         }
         finally {
             if (deadlineTimer !== undefined)
                 clearTimeout(deadlineTimer);
         }
         lastResult = result;
+        ladderPlacementRoot ??= internals?.placementRoot ?? internals?.rootSessionId ?? result.sessionId;
         const s = result.stats;
         const rungCostKnown = s.costMicroUsd !== undefined && (s.nested === undefined || s.nested.costMicroUsd !== undefined);
         const rungCost = rungCostKnown ? (s.costMicroUsd ?? 0) + (s.nested?.costMicroUsd ?? 0) : undefined;

package/dist/agents/subagent.js

@@ -1967,6 +1967,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         ...(ctx.taskId !== undefined ? { parentTaskId: ctx.taskId } : {}),
                         ...(ctx.sessionId !== undefined ? { parentSessionId: ctx.sessionId } : {}),
                         ...((ctx.rootSessionId ?? ctx.sessionId) !== undefined ? { rootSessionId: ctx.rootSessionId ?? ctx.sessionId } : {}),
+                        ...(ctx.placementRoot !== undefined ? { placementRoot: ctx.placementRoot } : {}),
                     }),
                 ...(ctx.centerArtifactDigest !== undefined ? { parentCenterArtifactDigest: ctx.centerArtifactDigest } : {}),
                 ...(ctx.centerSourceRevision !== undefined ? { parentCenterSourceRevision: ctx.centerSourceRevision } : {}),

package/dist/agents/verify.d.ts

@@ -287,7 +287,11 @@ export declare function verifyCompleted(runner: Runner, result: TaskResult, spec
  * refusal does and does not undo.
  *
  * Absent ⇒ every leg is dispatched exactly as before (each call site passes `undefined`, which is
- * what an omitted optional argument already was).
+ * what an omitted optional argument already was) — with ONE design/380 O1② placement delta either
+ * way: when neither `placementRoot` nor `rootSessionId` is present, the verifier and fix legs are
+ * dispatched with a fresh shallow copy carrying `placementRoot` = the entry implementation leg's
+ * sessionId (the gate's placement fixed point); every other field still rides by the same
+ * reference, and an internals object that already carries a fixed point is forwarded verbatim.
  */
 internals?: RunInternals): Promise<VerificationResult>;
 /**

package/dist/agents/verify.js

@@ -129,6 +129,9 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
     };
     const evidenceMode = config.evidence != null && config.evidence.trim() !== "";
     const verifierPrompt = config.verifierPrompt ?? (evidenceMode ? STATIC_VERIFICATION_PROMPT : VERIFICATION_PROMPT);
+    const legInternals = () => internals?.placementRoot !== undefined || internals?.rootSessionId !== undefined
+        ? internals
+        : { ...internals, placementRoot: result.sessionId };
     const runVerifier = async (impl, round) => {
         refuseUnhonorableInternals(internals, "before_leg");
         const roundEvidence = round === 1 ? config.evidence : undefined;
@@ -162,7 +165,7 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
             ...(specBase.clientContext !== undefined ? { clientContext: { ...specBase.clientContext } } : {}),
             ...(specBase.promptProfile !== undefined ? { promptProfile: specBase.promptProfile } : {}),
             signal: specBase.signal,
-        }, internals);
+        }, legInternals());
         try {
             const cost = (v.stats.costMicroUsd ?? 0) + (v.stats.nested?.costMicroUsd ?? 0);
             return { verdict: v.structuredOutput, cost, ...(isDurablePause(v.status) ? { paused: v } : {}) };
@@ -242,7 +245,7 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
             objective: fixObjective(outcome.findings),
             ...(foldedRootsFace ? { readFace: "roots" } : {}),
             ...(foldedReadDeny.length > 0 ? { readDenyPatterns: [...foldedReadDeny] } : {}),
-        }, internals);
+        }, legInternals());
         spend += (current.stats.costMicroUsd ?? 0) + (current.stats.nested?.costMicroUsd ?? 0);
         implAccount.add(current.stats);
         if (isDurablePause(current.status)) {

package/dist/core/checkpoint-store.d.ts

@@ -349,7 +349,11 @@ export interface PendingSteerEntry {
     seq: number;
     /** Caller-supplied correlation/idempotency id (a service passes the message id it already minted);
      *  a uuidv7 is minted when absent. Re-appending the SAME `inputId` is a no-op, which is what keeps
-     *  `setPendingSteer` retry-safe now that it appends instead of overwriting. */
+     *  `setPendingSteer` retry-safe now that it appends instead of overwriting. Because the id lives on
+     *  the PERSISTED entry and every replayed drain of this row carries it verbatim, `(notice code,
+     *  sessionId, detail.inputId)` is the parked family's cross-replay OCCURRENCE key — consumers dedup
+     *  on it directly; no per-delivery key exists or is needed. (Write-path guarantee: a row written by
+     *  a non-conforming store may lack it, and read points do not re-validate.) */
     inputId: string;
     /** Carried VERBATIM for the serving layer; it does NOT reorder the drain (drain is `seq` order). */
     priority?: SystemInjectionPriority;

package/dist/core/fs-write-gate-policy.d.ts

@@ -38,6 +38,27 @@ export interface FsWriteGatePolicyOptions {
      *    asks for an UNRESOLVABLE target fire before any canonical key exists, so they are never exempted.
      */
     isExempt?: (toolName: string, canonicalPath: string) => boolean | Promise<boolean>;
+    /**
+     * design/380 O13 — the deployment HARD-CLOSE knob for guarded writes. Armed (`true`), a covered
+     * write whose env does NOT provide `writeFileGuarded` is REFUSED (deny, typed message) — never the
+     * plain-writeFile fallback: for a deployment that exists to close the adjudicate→write TOCTOU
+     * window, a silent advisory downgrade would open the hole right beside its patch. The version-skew
+     * arm is the same refusal (an older adapter without the method IS an env without the capability).
+     * Default off = every verdict ACTION exactly as before (the capability's ABSENCE is still disclosed
+     * on the ask face either way — see the advisory sentence at the ask sites). The knob lives on the
+     * deployment's gate options, not in core-global state: core stays lane-agnostic (no device concept
+     * here); the deployment that runs guarded-capable envs arms it.
+     *
+     * WHAT ARMED DOES AND DOES NOT CLOSE (honesty boundary, codex r1-1): armed guarantees every covered
+     * write lands through an ATOMIC precondition-verified backend step — the tool's own
+     * canonicalize→write window is closed. It does NOT yet bind THIS GATE's adjudicated canonical key
+     * across an approval wait: the tool re-canonicalizes at execute time, so a symlink swapped between
+     * this gate's verdict and the tool's execution is re-resolved (and then atomically verified against
+     * the NEW resolution). Closing that remaining window needs the adjudicated key carried through a
+     * trusted approval receipt into tool execution — a separate seat, deliberately not smuggled into
+     * this knob.
+     */
+    requireGuardedWrite?: boolean;
 }
 /**
  * Build the file-write approval gate policy. Mount via `combinePolicies` alongside the deployment's

package/dist/core/fs-write-gate-policy.js

@@ -6,18 +6,29 @@ export function createFsWriteGatePolicy(opts) {
     const gated = PATH_CONFINABLE_WRITE_TOOLS;
     const acceptDirs = opts.acceptDirs && opts.acceptDirs.length > 0 ? opts.acceptDirs : undefined;
     const exemptDirs = opts.exemptDirs && opts.exemptDirs.length > 0 ? opts.exemptDirs : undefined;
+    const guardedCapable = env.writeFileGuarded !== undefined;
+    const advisory = guardedCapable
+        ? ""
+        : " (advisory adjudication: this environment provides no guarded write, so approval is judged before a separate, non-atomic write step)";
     return {
         async check(req, signal) {
             const canonical = req.toolName;
             if (!gated.has(canonical))
                 return { action: "allow" };
+            if (opts.requireGuardedWrite === true && !guardedCapable) {
+                return {
+                    action: "deny",
+                    message: `write tool "${req.toolName}" refused: this deployment requires guarded (atomic precondition-verified) writes (requireGuardedWrite), but the execution environment provides no writeFileGuarded capability — refusing rather than falling back to a non-atomic write`,
+                    decisionReason: "rule",
+                };
+            }
             const path = writeTargetPath(canonical, req.args);
             if (path === undefined) {
-                return ask(`write tool "${req.toolName}" requires approval: the call has no resolvable path target to confine`);
+                return ask(`write tool "${req.toolName}" requires approval: the call has no resolvable path target to confine${advisory}`);
             }
             const canon = await canonicalizeTarget(env, path, signal, req.cwd ?? rootPath);
             if (!canon.ok) {
-                return ask(`write to "${path}" requires approval: its real target could not be resolved (${canon.message})`);
+                return ask(`write to "${path}" requires approval: its real target could not be resolved (${canon.message})${advisory}`);
             }
             for (const dirs of [exemptDirs, acceptDirs]) {
                 if (!dirs)
@@ -46,7 +57,7 @@ export function createFsWriteGatePolicy(opts) {
             }
             if (defaultWrite === "allow")
                 return { action: "allow" };
-            return ask(`approve write to "${path}"?`);
+            return ask(`approve write to "${path}"?${advisory}`);
         },
     };
 }

package/dist/core/remote-env.d.ts

@@ -58,6 +58,13 @@ export interface WorkspaceHandle {
      *  `snapshotId` as corruption (fail-closed) unless the resumed env is itself non-suspendable
      *  (tolerance for park handles minted by 1.257.1 before this field existed). */
     restoreMode?: "park_only";
+    /**
+     * design/380 O1④ — explicit identity of the physical/target device this workspace lives on
+     * (device lane; an SSH/ADB adapter MAY also stamp it). MINTER-STATED: consumers read this field,
+     * never parse an identity out of `sandboxId`. Plain string → rides CheckpointState.workspaceHandle
+     * (all-string whitelist) with zero schema movement.
+     */
+    deviceId?: string;
 }
 /**
  * A reference to a secret injected at {@link RemoteExecutionEnv.connect}/{@link RemoteExecutionEnv.postResumeInit}
@@ -213,6 +220,16 @@ export type RemoteExecutionErrorCode =
  * else a retry whitelist misses them.
  */
  | "transport_lost"
+/**
+ * design/380 O12 — the op was COMMITTED to the remote target and its outcome is UNKNOWABLE (the target
+ * went unreachable / restarted / was revoked after dispatch-commit; an execStream cut where the target
+ * protocol's own server has ruled the outcome unknowable). NEVER auto-retried and deliberately NOT in
+ * {@link RETRYABLE_REMOTE_ERROR_CODES}: the command may have already executed — a retry whitelist that
+ * contained it would re-drive committed side effects. Distinct from `transport_lost` (connection story
+ * known, idempotency-gated retry after reconnect). Message MUST carry the verify-first sentence ("may
+ * have already executed on the target; verify its effect before re-running").
+ */
+ | "outcome_unknown"
 /** Unclassified provider/transport failure. */
  | "unknown";
 /**
@@ -220,8 +237,10 @@ export type RemoteExecutionErrorCode =
  * can succeed (`auth_transient`: retry-exactly-once after the device is authorized; `connect_failed`: the
  * workspace could not be reached/provisioned this attempt; `timeout`: a liveness bound tripped;
  * `transport_lost`: re-establish the connection). Every OTHER code is permanent for this attempt
- * (`auth_failed`/`unsupported`), caller-driven (`aborted`), or unclassifiable (`unknown`) — retrying them
- * burns budget or, worse, re-drives a rejected credential.
+ * (`auth_failed`/`unsupported`), caller-driven (`aborted`), unclassifiable (`unknown`), or
+ * outcome-unknowable (`outcome_unknown` — design/380 O12: the op may have ALREADY executed, so a retry
+ * re-drives committed side effects) — retrying them burns budget or, worse, re-drives a rejected
+ * credential or a committed op.
  *
  * ONE list, two consumers, so a caller's retry decision and its DISCLOSURE can never disagree: the engine
  * retries only IDEMPOTENT ops on these codes (see {@link withRetry}'s red line — a snapshot-taking
@@ -405,6 +424,19 @@ export interface RemoteExecutionEnv extends ExecutionEnv {
 export interface ExecutionEnvFactoryContext {
     /** Resolved session id for the task — the stable identity of its per-task workspace. */
     sessionId: string;
+    /**
+     * design/380 O1① — the run TREE's placement root (fixed point), minted by prepare AFTER session
+     * resolution as `internals.placementRoot ?? internals.rootSessionId ?? sessionId` — a top-level
+     * run's own resolved sessionId, every descendant's inherited root, verbatim (delegation and
+     * workflow spawn chains re-thread an explicit `placementRoot` — C12; the ONE boundary it does not
+     * yet cross is a bare DURABLE RESUME, which falls back to the checkpointed session until
+     * design/380 O1③'s checkpoint carriage lands — residual pinned). A target-bound
+     * factory (device lane) keys its placement lookup on THIS, never on `sessionId` (a child's fresh
+     * session id must not read as a new placement). Always present and non-empty — an empty value is
+     * an assembly error the engine refuses loudly at the mint (`config.placement_root_invalid`) and a
+     * factory MUST refuse loudly too (loud-bad-value posture), never default around.
+     */
+    placementRootSessionId: string;
     /** Caller-supplied task id, when set on the `TaskSpec`. */
     taskId?: string;
     /**

package/dist/core/runner/prepare-task.d.ts

@@ -1498,6 +1498,26 @@ export interface RunInternals {
      *  after a restart those intermediate sessions are dead ends, and a recovery face enumerating
      *  "everything under this host session" needs the root anchor, not an alias walk. */
     rootSessionId?: string;
+    /**
+     * design/380 O1② — the run tree's PLACEMENT root: the fixed point a target-bound env factory keys
+     * its placement lookup on ({@link import("../remote-env.js").ExecutionEnvFactoryContext.placementRootSessionId}).
+     * A SEPARATE axis from {@link rootSessionId} deliberately: that field means "member of this host
+     * session's DELEGATION tree" and is consumed by the registry access/recovery faces — cascade rungs
+     * and verification legs are intentionally NOT members of that tree (independent cold re-runs in
+     * their own sessions), so widening `rootSessionId` to cover them would corrupt the recovery faces'
+     * reading. This member says only "place me where this session was placed". Producers: the
+     * orchestration entries (`runCascade` / `runWithVerification` family) after their first leg's
+     * sessionId receipt, and — C12 — the delegation/workflow spawn chains, which re-thread a parent's
+     * EXPLICIT value verbatim into child internals (ToolExecuteContext.placementRoot → childInternals;
+     * workflow deps → shared internals base), so every descendant of a placed leg keeps the fixed
+     * point; prepare's mint reads it first (`placementRoot ?? rootSessionId ?? sessionId`). Absent
+     * everywhere else — the delegation lanes' `rootSessionId` fixed point then becomes the placement
+     * root through the middle segment, unchanged. NOT yet durable (C12 residual, pinned): a bare
+     * durable resume cannot recover it until design/380 O1③'s checkpoint carriage lands — the
+     * resumed leg falls back to its own session; a resume caller needing continuity re-supplies the
+     * member itself. TRUSTED run-scoped channel (never a {@link TaskSpec} field).
+     */
+    placementRoot?: string;
     /**
      * RB-429 — the REGISTRY SCOPE this run's own background row lives in: the domain its registry-facing
      * tools (TaskOutput / TaskStop / SendMessage / AgentTranscript / Monitor, and the announce listing)

package/dist/core/runner/prepare-task.js

@@ -681,6 +681,15 @@ async function derivedRouteFallsBack(args) {
         return false;
     }
 }
+function mintPlacementRootSessionId(internals, sessionId) {
+    const placementRootSessionId = internals?.placementRoot ?? internals?.rootSessionId ?? sessionId;
+    if (placementRootSessionId === "") {
+        const e = new Error("placement root resolved EMPTY (internals.placementRoot / internals.rootSessionId carries an empty string) — an empty fixed point cannot key a placement lookup; fix the spawning lane instead of defaulting around it.");
+        e.code = "config.placement_root_invalid";
+        throw e;
+    }
+    return placementRootSessionId;
+}
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf) {
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
     spec = doors.spec;
@@ -789,7 +798,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     try {
         ownedEnv = deps.executionEnvFactory
             ? await deps.executionEnvFactory({
-                sessionId,
+                sessionId, placementRootSessionId: mintPlacementRootSessionId(internals, sessionId),
                 taskId: spec.taskId,
                 ...(internals?.isolation ? { isolation: internals.isolation } : {}),
                 ...(internals?.parentCwd ? { parentCwd: internals.parentCwd } : {}),
@@ -1173,7 +1182,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             taskId: hostTaskId,
             ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),
             ...(internals?.parentSessionId !== undefined ? { parentSessionId: internals.parentSessionId } : {}),
-            ...(internals?.rootSessionId !== undefined ? { rootSessionId: internals.rootSessionId } : {}),
+            ...(internals?.rootSessionId !== undefined ? { rootSessionId: internals.rootSessionId } : {}), ...(internals?.placementRoot !== undefined ? { placementRoot: internals.placementRoot } : {}),
             ...(internals?.explicitAgentName !== undefined ? { spawnedAgentName: internals.explicitAgentName } : {}),
             ...(internals?.peerSelfRef !== undefined ? { peerSelfRef: internals.peerSelfRef } : {}),
             ...(internals?.peerInboundChainRef !== undefined ? { peerInboundChainRef: internals.peerInboundChainRef } : {}),
@@ -1348,7 +1357,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 scope: taskScope,
                 notifier: deps.workflowCompletionNotifier,
                 originatingSessionId: sessionId,
-                rootSessionId: internals?.rootSessionId ?? sessionId,
+                rootSessionId: internals?.rootSessionId ?? sessionId, ...(internals?.placementRoot !== undefined ? { placementRoot: internals.placementRoot } : {}),
                 taskRegistry: defaultTaskRegistry,
                 taskNotification: internals?.onTaskNotification,
                 taskOwner: hostTaskId,

package/dist/core/runner/prepare-workspace-restore.js

@@ -49,6 +49,16 @@ export async function prepareWorkspaceRestore(input) {
             throw e;
         };
         const handle = resume.workspaceHandle;
+        const refuseIdentityMismatch = (resumedHandle) => {
+            if (resumedHandle.provider !== handle.provider) {
+                failResume(`resume workspace identity mismatch: the checkpoint records provider "${handle.provider}" but the resumed env reports "${resumedHandle.provider}" — refusing to continue a workspace on a different backend (wire the factory to rebuild the checkpointed lane and re-resume)`);
+            }
+            if (handle.deviceId !== undefined && resumedHandle.deviceId !== handle.deviceId) {
+                failResume(resumedHandle.deviceId === undefined
+                    ? `resume workspace identity mismatch: the checkpoint records deviceId "${handle.deviceId}" but the resumed env reports none — a device-bound workspace cannot be verified on a handle that does not state its device (absence is not a match)`
+                    : `resume workspace identity mismatch: the checkpoint records deviceId "${handle.deviceId}" but the resumed env reports "${resumedHandle.deviceId}" — refusing to continue on a different physical device`);
+            }
+        };
         if (ownedEnv === undefined || !isRemoteExecutionEnv(ownedEnv)) {
             failResume("resume needs a RemoteExecutionEnv from executionEnvFactory to restore the workspace snapshot");
         }
@@ -56,6 +66,7 @@ export async function prepareWorkspaceRestore(input) {
             if (handle.restoreMode !== "park_only" && ownedEnv.capabilities.suspendable) {
                 failResume("checkpoint workspaceHandle has no snapshotId and is not a park_only handle, but the resumed env is suspendable — refusing to resume on a possibly-unrestored workspace (corrupt checkpoint?)");
             }
+            refuseIdentityMismatch(ownedEnv.workspaceHandle());
             if (handle.mountPath && handle.mountPath !== taskRootPath) {
                 taskRootPath = handle.mountPath;
             }
@@ -68,6 +79,7 @@ export async function prepareWorkspaceRestore(input) {
             if (missingHere.length > 0) {
                 failResume(`the resumed execution env cannot restore a workspace snapshot: its adapter does not implement ${missingHere.join(" or ")}. The checkpoint holds snapshot "${handle.snapshotId}" — wire an adapter that implements the full RemoteExecutionEnv restore surface and re-resume.`);
             }
+            refuseIdentityMismatch(ownedEnv.workspaceHandle());
             const { outcome: restored, attempts: restoreAttempts } = await restoreWorkspaceWithRetry(ownedEnv, handle.snapshotId, {
                 abortSignal: restoreSignal,
                 priorHandle: handle,
@@ -76,6 +88,7 @@ export async function prepareWorkspaceRestore(input) {
                 failResume(`resumeVM failed after ${restoreAttempts} attempt(s) (${restored.error.code}): ${restored.error.message}`, restored.error, remoteEnvFailureNote("resumeVM", restored.error, restoreAttempts));
             }
             else {
+                refuseIdentityMismatch(restored.value);
                 const restoredEnv = ownedEnv;
                 const canonicalInEnv = async (p) => {
                     try {

package/dist/core/runner/runtask.js

@@ -3119,7 +3119,10 @@ export class Runner {
             }
             catch (err) {
                 if (turnSignal?.aborted === true && !prepared.abortController.signal.aborted) {
-                    queue.push({ type: "compaction_outcome", outcome: "failed", trigger: "forced", reason: "guard-chain forced compaction cut short by a turn interrupt", ...ident() });
+                    const interruptReason = lane === "rejection"
+                        ? "prompt-too-long recovery pass cut short by a turn interrupt"
+                        : "guard-chain forced compaction cut short by a turn interrupt";
+                    queue.push({ type: "compaction_outcome", outcome: "failed", trigger: "forced", reason: interruptReason, ...ident() });
                     return false;
                 }
                 compactionBreaker.failures += 1;
@@ -3135,9 +3138,11 @@ export class Runner {
             thinkingOnly: {},
             degenerateOutput: { detect: (m) => isDegenerateCutMessage(m) },
             promptTooLong: {
-                recover: async (attempt) => {
+                recover: async (attempt, turnSignal) => {
                     if (prepared.abortController.signal.aborted || prepared.suspendRef.token !== undefined)
                         return false;
+                    if (turnSignal?.aborted === true)
+                        return false;
                     if (prepared.microCompact.clearOnRejection && attempt === 1) {
                         const proj = prepared.microCompact.projectionRef.current;
                         const compactionAvailable = (spec.compaction?.enabled ?? true) && compactionBreaker.failures < MAX_CONSECUTIVE_COMPACTION_FAILURES;
@@ -3174,7 +3179,7 @@ export class Runner {
                             return true;
                         }
                     }
-                    return runForcedCompactionPass("rejection");
+                    return runForcedCompactionPass("rejection", turnSignal);
                 },
             },
         });
@@ -4308,7 +4313,8 @@ export class Runner {
         if (outcome === null || typeof outcome !== "object") {
             throw new CheckpointError("checkpoint.invalid_outcome", `resume outcome must be an object naming its gate (got ${outcome === null ? "null" : typeof outcome})`);
         }
-        const store = resolveCheckpointStore(taskConfig, this.deps);
+        const config = typeof taskConfig === "object" && taskConfig !== null ? { ...taskConfig } : taskConfig;
+        const store = resolveCheckpointStore(config, this.deps);
         if (!store) {
             throw new CheckpointError("checkpoint.not_found", "no CheckpointStore wired — cannot resume (set RunnerDeps.checkpointStore or taskConfig.checkpointStore)");
         }
@@ -4335,7 +4341,7 @@ export class Runner {
         let wakeMessage;
         let wakeHookContext;
         const outcomeGate = outcome.gate;
-        const resumeSignal = taskConfig.signal;
+        const resumeSignal = config.signal;
         let suppliedMessage;
         if (outcomeGate === "wake") {
             suppliedMessage = outcome.message;
@@ -4564,7 +4570,7 @@ export class Runner {
                     : "resume carried a content-ask `answer` on a `deny` — a denial injects a refusal, never an answer; refusing rather than dropping it silently", { field: "answer" });
             }
             if (contentAskCallId !== undefined && plainPolicyOutcome.decision === "allow" && suppliedAnswer === undefined) {
-                if (!isLiveQuestionFace(taskConfig.onQuestion ?? this.deps.onQuestion)) {
+                if (!isLiveQuestionFace(config.onQuestion ?? this.deps.onQuestion)) {
                     throw new CheckpointError("checkpoint.invalid_outcome", "resume approved a content-ask (the reserved question tool) without an `answer`, and this resume has no live answering face — " +
                         'executing the question against nothing would hand the model a fabricated "no human is available" default while consuming the approval; ' +
                         "re-resume with the operator's answer on the outcome (or deny it), the checkpoint stays pending", { field: "answer" });
@@ -4675,14 +4681,14 @@ export class Runner {
                 },
             }
             : internals;
-        if (this.deps.lockedConfig?.keys?.includes("toolPolicy") === true && taskConfig.basePolicyForResumeEdit !== undefined) {
+        if (this.deps.lockedConfig?.keys?.includes("toolPolicy") === true && config.basePolicyForResumeEdit !== undefined) {
             throw new CheckpointError("checkpoint.invalid_outcome", "TaskSpec.basePolicyForResumeEdit is administratively locked by this deployment (locked key \"toolPolicy\") — a task-supplied " +
                 "resume-edit policy is refused pre-CAS (the checkpoint stays pending); remove the field or change the deployment's lock configuration");
         }
         let recheckGovernanceWindow;
         {
             const rowPrincipal = cp.principal || undefined;
-            const suppliedPrincipal = taskConfig.principal || undefined;
+            const suppliedPrincipal = config.principal || undefined;
             if (rowPrincipal !== undefined && suppliedPrincipal !== undefined && suppliedPrincipal !== rowPrincipal) {
                 throw new CheckpointError("resume.principal_mismatch", `the resume config carries principal ${JSON.stringify(suppliedPrincipal)} but this checkpoint was suspended under principal ${JSON.stringify(rowPrincipal)} — ` +
                     "running the resumed leg under a different identity would move its usage-ledger bucket, scope derivation and attribution; " +
@@ -4709,13 +4715,13 @@ export class Runner {
             }
         }
         if (outcomeGate === "wake" && wakeMessage !== undefined) {
-            const resumeScreenHooks = taskConfig.hooks ?? this.deps.hooks;
+            const resumeScreenHooks = config.hooks ?? this.deps.hooks;
             const screen = resumeScreenHooks?.userPromptSubmit;
             if (screen !== undefined && resumeSignal?.aborted !== true) {
                 const screenedMessage = wakeMessage;
                 const identity = mintHookInvocationIdentity({
                     sessionId: cp.sessionId,
-                    taskId: taskConfig.taskId ?? cp.sessionId,
+                    taskId: config.taskId ?? cp.sessionId,
                     legKind: "resume",
                     isDelegatedChild: effectiveDelegationFacts(internals, cp.state.isDelegatedChild).isDelegatedChild,
                     ...(internals?.insideFork === true ? { insideFork: true } : {}),
@@ -4784,7 +4790,7 @@ export class Runner {
                 budget: editBudget,
                 ...(cp.state.handsCwd !== undefined ? { cwd: cp.state.handsCwd } : {}),
             };
-            const editSignal = taskConfig.signal;
+            const editSignal = config.signal;
             const raceEditAbort = async (p) => {
                 if (editSignal === undefined)
                     return p;
@@ -4823,7 +4829,7 @@ export class Runner {
             const toolPolicyLocked = this.deps.lockedConfig?.keys?.includes("toolPolicy") === true;
             const editBasePolicy = toolPolicyLocked
                 ? (this.deps.basePolicyForResumeEdit ?? this.deps.toolPolicy)
-                : (taskConfig.basePolicyForResumeEdit ?? this.deps.basePolicyForResumeEdit ?? taskConfig.toolPolicy ?? this.deps.toolPolicy);
+                : (config.basePolicyForResumeEdit ?? this.deps.basePolicyForResumeEdit ?? config.toolPolicy ?? this.deps.toolPolicy);
             if (editBasePolicy !== undefined) {
                 let rechecked;
                 try {
@@ -4843,7 +4849,7 @@ export class Runner {
                         `refused pre-CAS (the checkpoint stays pending); re-submit the edited action so the rewrite is adjudicated and approved synchronously`);
                 }
             }
-            const resumeHooks = taskConfig.hooks ?? this.deps.hooks;
+            const resumeHooks = config.hooks ?? this.deps.hooks;
             if (resumeHooks?.preToolUse !== undefined && resumeHooks.preToolUseObservational === true) {
                 try {
                     await raceEditAbort(Promise.resolve(resumeHooks.preToolUse(cp.pendingAction.toolName, cloneObserverInput(editedArgs), {
@@ -4878,15 +4884,15 @@ export class Runner {
             consumeFlipDone = true;
         }
         const answerFace = plainPolicyOutcome !== undefined && redeemedAnswer !== undefined
-            ? answerFaceForRedeemedCall(redeemedAnswer, plainPolicyOutcome.boundCallId, taskConfig.onQuestion ?? this.deps.onQuestion, boundInputHashOf(cp.pendingAction.args?.questions))
+            ? answerFaceForRedeemedCall(redeemedAnswer, plainPolicyOutcome.boundCallId, config.onQuestion ?? this.deps.onQuestion, boundInputHashOf(cp.pendingAction.args?.questions))
             : undefined;
         const spec = {
-            ...taskConfig,
-            ...((taskConfig.principal || undefined) === undefined && (cp.principal || undefined) !== undefined ? { principal: cp.principal } : {}),
+            ...config,
+            ...((config.principal || undefined) === undefined && (cp.principal || undefined) !== undefined ? { principal: cp.principal } : {}),
             objective: "",
             sessionId: cp.sessionId,
             requireExistingSession: true,
-            preemptSignal: taskConfig.preemptSignal?.aborted ? undefined : taskConfig.preemptSignal,
+            preemptSignal: config.preemptSignal?.aborted ? undefined : config.preemptSignal,
             ...(answerFace !== undefined ? { onQuestion: answerFace } : {}),
         };
         const reopenFn = store.reopen?.bind(store);

package/dist/core/types.d.ts

@@ -552,6 +552,13 @@ export interface ToolExecuteContext {
      *  fixed point `ctx.rootSessionId ?? ctx.sessionId` at every spawn). Absent for a top-level run
      *  (its OWN sessionId is the root). */
     rootSessionId?: string;
+    /** design/380 O1② (C12) — the spawning run's EXPLICIT placement fixed point
+     *  (`RunInternals.placementRoot`), present only when its internals carried one (cascade rungs /
+     *  verification legs after the first, or a caller-declared root). A delegation tool threads it
+     *  VERBATIM into child RunInternals so every descendant keeps the ladder/gate placement; absent ⇒
+     *  the `rootSessionId` chain above IS the placement root through prepare's mint middle segment
+     *  (`placementRoot ?? rootSessionId ?? sessionId`) and nothing extra is threaded. */
+    placementRoot?: string;
     /**
      * design/151 §7 S3c — TRUSTED tier-3 revival claim (same trusted-internals seat as
      * {@link parentTaskId}; never a model argument). Filled ONLY by the auto-mounted SendMessage's
@@ -5932,9 +5939,12 @@ export interface RunnerDeps {
      * `TaskSpec.limits`, which is the allowance ONE task asked for — an operator granting "N tokens per 5
      * hours" cannot express it as a task limit, because nothing stops the next task from asking again.
      *
-     * A window carries a TOKEN ceiling and, optionally, a MONEY ceiling (`UsageWindow.maxCostUsd`, absolute
-     * USD — the `TaskLimits.maxCostUsd` quantity one governance level up). The two are independent and
-     * either one binds. A $ ceiling requires a PRICED run: a task whose model has neither a {@link pricing}
+     * A window carries a TOKEN ceiling (`UsageWindow.maxTokens`), a MONEY ceiling (`UsageWindow.maxCostUsd`,
+     * absolute USD — the `TaskLimits.maxCostUsd` quantity one governance level up), or both: each is
+     * optional on its own and at least one is required, so a deployment governed by spend alone declares
+     * only `maxCostUsd` (a window with neither ceiling is refused, `config.usage_window_invalid`). The two
+     * are independent and every declared one binds. A $ ceiling requires a PRICED run: a task whose model
+     * has neither a {@link pricing}
      * entry nor a `Model.cost` declaration is refused at the door (`config.usage_window_unpriced`) rather
      * than charged the fabricated 0 an unpriced run would otherwise file into an operator's ceiling.
      *