@sema-agent/core 5.64.0 → 6.0.0

package/dist/core/memory-engine/consolidation.d.ts

@@ -490,6 +490,20 @@ export declare function deriveProductSlug(name: string | undefined, fallback: st
 export declare class ConsolidationRefusedError extends Error {
     readonly code: string;
     readonly reasons: string[];
+    /**
+     * #495 — THIS refusal's own occurrence identity, minted where the fact is created (one throw, one
+     * id) rather than at whatever face later describes it. The notice dialect
+     * ({@link import("./engine.js").memoryConsolidationRefusedNotice}) reads it off the error, so the
+     * throw and its announcement name the same event however many times a host renders it: a repeated
+     * gate refusal (same `code`, same `scope`, byte-identical `message`) is otherwise indistinguishable
+     * from one refusal logged twice.
+     *
+     * Per-occurrence by construction, and correctly so: a refusal is a pure in-process event with no
+     * durable seat — nothing persists it, so nothing replays it, and two refusals ARE two facts. (The
+     * fail-open shape #476 rejected is a per-DELIVERY mint for families whose occurrences do return
+     * from a durable store and must answer the same id each time; this is the opposite geometry.)
+     */
+    readonly occurrenceId: string;
     constructor(code: string, message: string, reasons?: string[]);
 }
 /** A NotePatch list for one frozen product (the §1.3 add-only arm's one spelling). */
@@ -526,16 +540,25 @@ export declare function productAddPatch(product: MemoryEntry): NotePatch;
  *                       influence); committed cycles stand (add-only, no rollback), and the host
  *                       re-runs to re-mint over the current bytes (immediately or next window —
  *                       host policy).
+ *  - `purity_violation` — design/383 §1.3 (S-1): the minted plan carries a product that will
+ *                       commit UNMARKED while containing bytes only the MARKED arm was shown. The
+ *                       exposure partition's isolation premise is falsified, so the whole mint is
+ *                       discarded with ZERO writes and the transcript is archived (a security
+ *                       event's only evidence). DELIBERATELY DISTINCT from `driver_failed`: that
+ *                       one says the model half could not finish, this one says the safety
+ *                       topology did not hold — a host that folds them loses the ability to tell
+ *                       "the model was flaky" from "content crossed a boundary it must not cross",
+ *                       and only the second is an incident.
  * Extending this set is a consumer-visible closed-set expansion (release-note duty: every
  * downstream that pinned the enumeration becomes a named party — `mint_invalidated` was the
- * design/376-C1 add, named on its release).
+ * design/376-C1 add, `purity_violation` the design/383 片1 add, each named on its release).
  *
  * The type DERIVES from the array (never `satisfies` beside it): the array exists precisely for
  * downstream enumeration, and two independent declarations would let a new union arm skip the
  * array with no compile error — the derived form makes an edit to either side a type error at
  * the other.
  */
-export declare const CONSOLIDATION_RUN_STOP_REASONS: readonly ["converged", "fuse_residue", "max_cycles", "parked", "refused", "driver_failed", "mint_invalidated"];
+export declare const CONSOLIDATION_RUN_STOP_REASONS: readonly ["converged", "fuse_residue", "max_cycles", "parked", "refused", "driver_failed", "mint_invalidated", "purity_violation"];
 /** See the doc on {@link CONSOLIDATION_RUN_STOP_REASONS} — the single source this derives from. */
 export type ConsolidationRunStopReason = (typeof CONSOLIDATION_RUN_STOP_REASONS)[number];
 export {};

package/dist/core/memory-engine/consolidation.js

@@ -1,5 +1,6 @@
 import { existsSync, readdirSync, renameSync } from "node:fs";
 import { join } from "node:path";
+import { uuidv7 } from "../../engine/session/uuid.js";
 import { atomicWriteFileSync, lockedStrictUpdate, readStrictSidecar, ControlPlaneCorruptError, ensureDirExists } from "./layout.js";
 export function deriveSupersededSet(headers, opts = {}) {
     const byId = new Map();
@@ -353,13 +354,15 @@ export function deriveProductSlug(name, fallback) {
 export class ConsolidationRefusedError extends Error {
     code;
     reasons;
+    occurrenceId;
     constructor(code, message, reasons = []) {
         super(reasons.length > 0 ? `${message}\n${reasons.map((r) => `  - ${r}`).join("\n")}` : message);
         this.code = code;
         this.reasons = reasons;
+        this.occurrenceId = uuidv7();
     }
 }
 export function productAddPatch(product) {
     return { op: "add", id: product.id, entry: product, guard: "absent" };
 }
-export const CONSOLIDATION_RUN_STOP_REASONS = ["converged", "fuse_residue", "max_cycles", "parked", "refused", "driver_failed", "mint_invalidated"];
+export const CONSOLIDATION_RUN_STOP_REASONS = ["converged", "fuse_residue", "max_cycles", "parked", "refused", "driver_failed", "mint_invalidated", "purity_violation"];

package/dist/core/memory-engine/distiller.d.ts

@@ -380,12 +380,95 @@ export declare const normalizedCandidateRev: (rev: unknown) => string;
  *    transcript labels — byte-identical to the plain mint modulo the attestation echo and the
  *    roster (C1-G1's identity claim).
  *  - Either arm failing fails the WHOLE mint (one mint, one verdict; both arms' calls ride the
- *    failure transcript). This widens nothing: under the run-level mint a hostile marked row
+ *    failure transcript). This widens nothing: under the run-level mint an adversarial marked row
  *    already sat inside the single grouping call and could fail it whole.
  *  - Cross-arm group structure is impossible by construction: each arm's `sanitizeLlmGroups`
  *    valid map is built over that arm's own 1..N numbering.
  */
 export declare function mintExposurePartitionedPlan(args: Parameters<typeof mintLlmConsolidationPlan>[0]): Promise<MintLlmConsolidationPlanResult>;
+/**
+ * The detector's frozen algorithm parameters — a CONTRACT SIBLING, published beside the readings
+ * so a run's verdict can be re-derived from the archive alone, and deliberately NOT a knob: this
+ * is a safety gate, and a safety gate with an off switch is a safety gate that gets switched off
+ * under deadline pressure. A new parameter set is a NEW `version`, exactly like the prompt
+ * contract's own rule.
+ */
+export interface MemoryDistillerPurityContract {
+    version: string;
+    /** Unicode normalization applied to BOTH sides before comparison (so a decomposed copy of a
+     *  composed original still compares equal). */
+    normalization: "NFC";
+    /** Case is PRESERVED. Case-folding would widen the detector toward paraphrase matching and start
+     *  minting false positives on ordinary prose — this gate answers "were these bytes copied", and
+     *  a case change is already outside "verbatim". */
+    caseFold: false;
+    /** Shingle width, in whitespace-separated words: the comparison unit on every side. */
+    shingleWords: number;
+    /** A shingle shorter than this many characters is dropped before comparison (the floor that
+     *  keeps short, high-frequency phrases out of the evidence set). */
+    minShingleChars: number;
+}
+export declare const MEMORY_DISTILLER_PURITY_CONTRACT_V1: MemoryDistillerPurityContract;
+/** One witness: a marked-side-unique shingle found verbatim in a clean product's own bytes. */
+export interface CleanArmLeakFinding {
+    /** The product's INDEX in `plan.products` — the locator safe to put in a message. Unlike
+     *  {@link productKey} it is harness-assigned, so it cannot itself carry a payload. */
+    productIndex: number;
+    /** The product's key AS THE MODEL WROTE IT (`sanitizeLlmGroups` passes `String(g.key)` through
+     *  unbounded). Useful when reading the archive; NEVER safe to interpolate into a notice, an
+     *  announcement or a log line that reaches a model context — the key is model-authored text and
+     *  can carry the same payload the shingle does. Use {@link productIndex} there. */
+    productKey: string;
+    field: "name" | "description" | "body";
+    /** The offending shingle VERBATIM — the evidence, not a description of it. Same rule as
+     *  {@link productKey}: this is for the archive and an operator's own eyes, never for a message
+     *  that lands in front of a model. */
+    shingle: string;
+}
+export interface CleanArmLeakVerdict {
+    /** False ⇔ the gate had nothing to check (see {@link notEngagedReason}); never a pass claim. */
+    engaged: boolean;
+    notEngagedReason?: string;
+    /** Size of the marked-side-unique evidence set (clean-arm bytes already subtracted). */
+    markedUniqueShingles: number;
+    /** How many products were scanned (the all-clean-input products of a partitioned plan). */
+    scannedProducts: number;
+    findings: CleanArmLeakFinding[];
+}
+/**
+ * design/383 §1.3 (S-1) — a VERBATIM-LEAK DETECTOR over a minted exposure-partitioned plan. Pure
+ * bytes, zero model calls, run in the driver between the mint and the plan cache.
+ *
+ * WHAT IT ASKS: did any byte sequence that ONLY the marked arm was shown come back out inside a
+ * product that will commit UNMARKED? The prompt-side audit (C1-G5) proves the clean arm's prompt
+ * carried no marked bytes; this proves the partition machine itself was not bypassed, mis-wired or
+ * side-channelled — a different failure surface, which is why both gates ship.
+ *
+ * HOW:
+ *  1. evidence source = the MARKED arm's verbatim grouping prompt (`minting.arms[marked]`), which
+ *     is the exact rendered form the model saw — `name — description\n body`. Reading only entry
+ *     bodies would miss a payload parked in a `description`;
+ *  2. minus the CLEAN arm's rendered bytes ⇒ the MARKED-SIDE-UNIQUE set. Text both sides legitimately
+ *     carry (the shared instruction template, a description a clean sibling also holds) proves
+ *     nothing and is subtracted here — this step is what keeps the gate off false positives;
+ *  3. scanned surface = the all-clean-input products' `name` / `description` / `body`. "Clean" is
+ *     read off the plan's own served roster (no marked input id), which is the same judgment that
+ *     decides the product commits without an origin marker. A plan that claims the attestation but
+ *     carries NO roster (no plan this driver mints, but a foreign minter could stamp one) has every
+ *     product read as clean — including the marked arm's own, which legitimately holds marked
+ *     bytes — so it refuses. That is the intended direction: an attestation with no evidence behind
+ *     it should not buy a plan the per-product fold;
+ *  4. any intersection ⇒ the caller fails the mint WHOLE. A leak falsifies the clean arm's
+ *     isolation premise, and the other products of the same mint rest on that same premise.
+ *
+ * HONEST BOUNDARY (do not let this JSDoc be read as more than it is): this catches VERBATIM
+ * copying. It does not catch paraphrase, translation, or a summary of marked content — a complete
+ * detector would need a semantic judge, i.e. a model judging a model, which this design forbids.
+ * A leak shorter than one shingle (see the contract's `shingleWords`/`minShingleChars`) is below
+ * the floor and will not be seen. It is a leak DETECTOR, not a purity PROOF; `engaged: false` is
+ * "nothing to check here", never "checked and clean".
+ */
+export declare function detectCleanArmVerbatimLeak(plan: LlmConsolidationPlan, contract?: MemoryDistillerPurityContract): CleanArmLeakVerdict;
 /** The distiller signature the drive consumes: `(candidates, snapshot, scope) -> proposal`.
  *  At runtime only `entry.id` is load-bearing for the replay filter — test/bench stubs that hand
  *  partial entry shapes are tolerated by the reads, the type states the engine's real snapshot.

package/dist/core/memory-engine/distiller.js

@@ -459,6 +459,74 @@ export async function mintExposurePartitionedPlan(args) {
         },
     };
 }
+export const MEMORY_DISTILLER_PURITY_CONTRACT_V1 = Object.freeze({
+    version: "pu-1",
+    normalization: "NFC",
+    caseFold: false,
+    shingleWords: 6,
+    minShingleChars: 24,
+});
+function purityContractRefusal(message) {
+    const e = new Error(message);
+    e.code = "config.memory_distiller_purity_contract";
+    return e;
+}
+function screenPurityContract(c) {
+    if (typeof c?.version !== "string" || c.version.trim() === "")
+        throw purityContractRefusal("the distiller purity contract needs a non-empty version — the verdict is published beside readings and must name the parameters it was taken under.");
+    if (c.normalization !== "NFC")
+        throw purityContractRefusal(`the distiller purity contract's normalization must be "NFC" (got ${JSON.stringify(c.normalization)}) — the two sides must normalize identically or a decomposed copy reads as clean.`);
+    if (c.caseFold !== false)
+        throw purityContractRefusal(`the distiller purity contract's caseFold must be false (got ${JSON.stringify(c.caseFold)}) — see the field's own doc.`);
+    if (!Number.isInteger(c.shingleWords) || c.shingleWords < 2)
+        throw purityContractRefusal(`the distiller purity contract's shingleWords must be an integer ≥ 2 (got ${String(c.shingleWords)}) — a shorter unit is a word-frequency match, not a copy witness.`);
+    if (!Number.isInteger(c.minShingleChars) || c.minShingleChars < 1)
+        throw purityContractRefusal(`the distiller purity contract's minShingleChars must be a positive integer (got ${String(c.minShingleChars)}) — a zero floor admits whitespace-only shingles as evidence.`);
+    return c;
+}
+function shinglesOf(text, c) {
+    const words = text.normalize(c.normalization).split(/\s+/).filter((w) => w !== "");
+    const out = new Set();
+    for (let i = 0; i + c.shingleWords <= words.length; i++) {
+        const s = words.slice(i, i + c.shingleWords).join(" ");
+        if (s.length >= c.minShingleChars)
+            out.add(s);
+    }
+    return out;
+}
+export function detectCleanArmVerbatimLeak(plan, contract = MEMORY_DISTILLER_PURITY_CONTRACT_V1) {
+    const c = screenPurityContract(contract);
+    const none = (notEngagedReason) => ({ engaged: false, notEngagedReason, markedUniqueShingles: 0, scannedProducts: 0, findings: [] });
+    if (plan.mintExposure !== "partitioned")
+        return none("the plan carries no exposure-partition attestation — there are no arms to compare (an un-attested plan folds run-level, where every product is marked anyway)");
+    const arms = plan.minting.arms ?? [];
+    const markedArm = arms.find((a) => a.arm === "marked");
+    const cleanArm = arms.find((a) => a.arm === "clean");
+    if (markedArm === undefined)
+        return none("no marked arm was minted — no marked entry's bytes were rendered into any call");
+    if (cleanArm === undefined)
+        return none("no clean arm was minted — every product of this plan carries a marked input and commits marked");
+    const cleanPromptShingles = shinglesOf(cleanArm.groupingPrompt, c);
+    const markedUnique = new Set();
+    for (const s of shinglesOf(markedArm.groupingPrompt, c))
+        if (!cleanPromptShingles.has(s))
+            markedUnique.add(s);
+    const markedInputIds = new Set((plan.servedCandidates ?? []).filter((r) => r.marked).map((r) => r.id));
+    const cleanProducts = plan.products.map((p, productIndex) => ({ p, productIndex })).filter(({ p }) => !(p.inputIds ?? []).some((id) => markedInputIds.has(id)));
+    const findings = [];
+    for (const { p, productIndex } of cleanProducts) {
+        for (const field of ["name", "description", "body"]) {
+            const text = p[field];
+            if (typeof text !== "string" || text === "")
+                continue;
+            for (const s of shinglesOf(text, c)) {
+                if (markedUnique.has(s))
+                    findings.push({ productIndex, productKey: p.key, field, shingle: s });
+            }
+        }
+    }
+    return { engaged: true, markedUniqueShingles: markedUnique.size, scannedProducts: cleanProducts.length, findings };
+}
 export function llmPlanDistiller(plan) {
     const products = plan?.products ?? [];
     const mintExposure = plan?.mintExposure === "partitioned" ? "partitioned" : undefined;

package/dist/core/memory-engine/dual-root.js

@@ -63,6 +63,12 @@ export function mergeHarvestReports(a, b) {
         restored: [...a.restored, ...b.restored],
         warnings: [...a.warnings, ...b.warnings],
     };
+    const reportId = a.reportId ?? b.reportId;
+    if (reportId !== undefined)
+        merged.reportId = reportId;
+    const parts = [...new Set([a.reportId, b.reportId].filter((x) => x !== undefined))];
+    if (parts.length > 1)
+        merged.mergedFrom = parts;
     const incident = a.incident ?? b.incident;
     if (incident !== undefined)
         merged.incident = incident;