@sema-agent/core 6.0.0 → 7.0.1

package/dist/core/permission-rule-store.js

@@ -10,7 +10,11 @@ export function writerOf(store) {
     return w !== undefined && typeof w.apply === "function" && typeof w.nextDot === "function" ? w : undefined;
 }
 export function sameScope(a, b) {
-    return a.kind === "global" ? b.kind === "global" : b.kind === "project" && a.root === b.root;
+    if (a.kind === "global")
+        return b.kind === "global";
+    if (a.kind === "session")
+        return b.kind === "session" && a.sessionId === b.sessionId;
+    return b.kind === "project" && a.root === b.root;
 }
 function sameDot(a, b) {
     return a.actor === b.actor && a.counter === b.counter;
@@ -47,7 +51,29 @@ export function assertDeleteDeltaCarriesNoAdd(delta) {
         throw new Error("a tighten-delete must carry a tombstone naming at least one observed add dot");
     }
 }
-function isValidScope(scope) {
+export function assertWriteDeltaScopeDurable(delta) {
+    const scope = delta.kind === "redemption-add" ? delta.scope : delta.tombstone?.scope;
+    if (scope?.kind === "session") {
+        const e = new Error(delta.kind === "redemption-add"
+            ? "a session-scope rule cannot enter the persisted store — its home is the session's own overlay (design/382 §4.3); refusing the redemption-add"
+            : "a session-scope tombstone cannot enter the persisted store — session rows are not individually deletable and die with their session (design/382 §4.3/§10); refusing the tighten-delete");
+        e.code = "unsupported.session_scope_store";
+        throw e;
+    }
+    if (!isValidDurableScope(scope)) {
+        throw new Error(delta.kind === "redemption-add"
+            ? "a redemption-add whose scope is not a well-formed durable scope cannot enter the persisted store (design/382 §4.3: the face is {global, project-with-a-root}) — refusing the write"
+            :
+                "a tighten-delete must carry a tombstone whose scope is a well-formed durable scope (design/382 §4.3: the face is {global, project-with-a-root}) — refusing the write");
+    }
+}
+export function isValidConsentScope(scope) {
+    const sc = scope;
+    return (sc?.kind === "global" ||
+        (sc?.kind === "project" && typeof sc.root === "string" && sc.root !== "") ||
+        (sc?.kind === "session" && typeof sc.sessionId === "string" && sc.sessionId !== ""));
+}
+export function isValidDurableScope(scope) {
     const sc = scope;
     return sc?.kind === "global" || (sc?.kind === "project" && typeof sc.root === "string" && sc.root !== "");
 }
@@ -56,7 +82,7 @@ function isValidDot(dot) {
     return typeof d?.actor === "string" && d.actor !== "" && typeof d.counter === "number" && Number.isFinite(d.counter);
 }
 function scopeKey(scope) {
-    return JSON.stringify(scope.kind === "global" ? ["g"] : ["p", scope.root]);
+    return JSON.stringify(scope.kind === "global" ? ["g"] : scope.kind === "session" ? ["s", scope.sessionId] : ["p", scope.root]);
 }
 function dotKey(dot) {
     return JSON.stringify([dot.actor, dot.counter]);
@@ -114,6 +140,11 @@ export function screenRuleSyncState(state) {
     for (const r of state.rules) {
         if (!Array.isArray(r.adds) || r.adds.length === 0)
             continue;
+        if (r.scope?.kind === "session") {
+            for (const a of r.adds)
+                rejected.push({ rule: r.rule, scope: r.scope, dot: a.dot, reason: "session_scope_not_durable" });
+            continue;
+        }
         const n = normalizePersistedRule(r);
         if ("reject" in n) {
             for (const a of r.adds)
@@ -122,7 +153,15 @@ export function screenRuleSyncState(state) {
         }
         rules.push(r);
     }
-    return { state: { rules, tombstones: state.tombstones }, rejected };
+    const tombstones = [];
+    for (const t of state.tombstones) {
+        if (t?.scope?.kind === "session") {
+            rejected.push({ rule: t.rule, scope: t.scope, dot: t.deletedBy, reason: "session_scope_not_durable" });
+            continue;
+        }
+        tombstones.push(t);
+    }
+    return { state: { rules, tombstones }, rejected };
 }
 export function joinRuleStates(a, b) {
     const sa = screenRuleSyncState(a).state;
@@ -183,10 +222,12 @@ export function applySyncJoin(cur, delta, nowMs) {
         throw new Error("a sync-join delta must carry an inbound state with rules and tombstones arrays");
     }
     for (const t of delta.inbound.tombstones) {
+        if (t?.scope?.kind === "session")
+            continue;
         if (!Array.isArray(t?.removedDots) || t.removedDots.length === 0) {
             throw new Error("an inbound tombstone must name at least one observed add dot — refusing the whole sync-join (the client's partitioning must withhold the round's adds alongside a malformed tombstone)");
         }
-        if (!isValidScope(t.scope) || !isValidDot(t.deletedBy) || !t.removedDots.every(isValidDot)) {
+        if (!isValidDurableScope(t.scope) || !isValidDot(t.deletedBy) || !t.removedDots.every(isValidDot)) {
             throw new Error("an inbound tombstone carries a malformed scope or dot — refusing the whole sync-join (a tombstone that cannot identity-match what it deletes would land its covered adds live)");
         }
         const canonicalTomb = parseAllowRuleText(t.rule);
@@ -229,7 +270,7 @@ export function applySyncJoin(cur, delta, nowMs) {
             withheldAdds += r.adds.length;
             continue;
         }
-        if (!isValidScope(r.scope)) {
+        if (!isValidDurableScope(r.scope)) {
             for (const a of r.adds)
                 droppedInbound.push({ rule: r.rule, scope: r.scope, dot: a.dot, reason: "metadata_mismatch" });
             continue;
@@ -288,6 +329,11 @@ export function applySyncJoin(cur, delta, nowMs) {
         }
     }
     for (const q of delta.quarantine ?? []) {
+        if (q.scope?.kind === "session") {
+            const e = new Error("a quarantine instruction names a session scope — the persisted store never holds a session row (design/382 §4.3); refusing the instruction");
+            e.code = "unsupported.session_scope_store";
+            throw e;
+        }
         for (const dot of q.dots) {
             if (joined.tombstones.some((t) => sameDot(t.deletedBy, dot))) {
                 throw new Error("a quarantine instruction may not touch a tombstone — it moves adds only");
@@ -332,6 +378,12 @@ export async function removePersistedRule(opts) {
     const target = opts.principal;
     const owner = typeof target === "string" ? { kind: "principal", principal: target } : structuredClone(target);
     const provider = opts.provider;
+    if (scope?.kind === "session") {
+        return {
+            status: "failed",
+            error: "unsupported.session_scope_store: a session-scope rule cannot be removed through the persisted-store entry — session authorizations live in the session's own overlay and end with the session (design/382 §4.3)",
+        };
+    }
     if (owner.kind === "local-owner" && provider.forLocalOwner === undefined) {
         return { status: "failed", error: "this provider has no local-owner bucket (forLocalOwner is not implemented) — a local-owner rule cannot be removed through it" };
     }
@@ -435,10 +487,12 @@ export class InMemoryPermissionRuleStore {
             if (opts.expectedRev !== this.rev)
                 return { conflict: true, rev: this.rev };
             if (delta.kind === "redemption-add") {
+                assertWriteDeltaScopeDurable(delta);
                 assertRedemptionNotQuarantined(this.quarantinedRows, delta);
                 this.rules = foldDelta(this.rules, delta);
             }
             else if (delta.kind === "tighten-delete") {
+                assertWriteDeltaScopeDurable(delta);
                 assertDeleteDeltaCarriesNoAdd(delta);
                 this.tombstones = [...this.tombstones, delta.tombstone];
             }

package/dist/core/permission-rule-sync.d.ts

@@ -134,6 +134,15 @@ interface ParsedRuleSyncResponse {
         dot: RuleDot;
         code: RuleRejectCode;
     }>;
+    /** design/382 §4.3 — SESSION-scope tombstones, dropped at the parse as per-row refusals (never
+     *  `undefined`-malformed): a session row can never land regardless of its dots, so classifying a
+     *  DAMAGED one as generic-malformed would withhold every valid inbound add on every round — one
+     *  peer row poisoning sync forever, the exact shape the per-row drop arm exists to avoid. */
+    sessionScopeTombstones: Array<{
+        rule: string;
+        scope: RuleScope;
+        dot: RuleDot;
+    }>;
     warnings: string[];
 }
 /**

package/dist/core/permission-rule-sync.js

@@ -91,6 +91,9 @@ export async function syncPermissionRules(opts) {
     for (const t of response.textRefusedTombstones) {
         dropped.push({ rule: t.rule, scope: t.scope, dot: t.dot, reason: "invalid_rule_text" });
     }
+    for (const t of response.sessionScopeTombstones) {
+        dropped.push({ rule: t.rule, scope: t.scope, dot: t.dot, reason: "session_scope_not_durable" });
+    }
     if (response.textRefusedTombstones.length > 0) {
         const named = response.textRefusedTombstones
             .slice(0, DISCLOSED_REFUSED_TOMBSTONES)
@@ -131,6 +134,10 @@ export async function syncPermissionRules(opts) {
     }
     const localDots = new Set(raw.rules.flatMap((r) => r.adds.map((a) => JSON.stringify([a.dot.actor, a.dot.counter]))));
     for (const d of response.dropped) {
+        if (d.scope.kind === "session") {
+            warnings.push(`the server's dropped list names a session-scope row (${escapeForDisclosure(d.rule)}) — the durable store never holds one, so there is no local row it could mean; ignored`);
+            continue;
+        }
         if (localDots.has(JSON.stringify([d.dot.actor, d.dot.counter]))) {
             const reason = d.reason === "below_gc_frontier" ? "below_gc_frontier" : "server_rejected";
             quarantine.push({ rule: d.rule, scope: d.scope, dots: [d.dot], reason });
@@ -190,7 +197,7 @@ export async function syncPermissionRules(opts) {
         const dotKeyOf = (d) => JSON.stringify([d.actor, d.counter]);
         const preDots = new Set(current.rules.flatMap((r) => r.adds.map((a) => dotKeyOf(a.dot))));
         const newAdds = landedRaw.rules.flatMap((r) => r.adds).filter((a) => !preDots.has(dotKeyOf(a.dot))).length;
-        const tombKeyOf = (t) => JSON.stringify([t.rule, t.scope.kind === "global" ? null : t.scope.root, dotKeyOf(t.deletedBy)]);
+        const tombKeyOf = (t) => JSON.stringify([t.rule, t.scope.kind, t.scope.kind === "project" ? t.scope.root : t.scope.kind === "session" ? t.scope.sessionId : null, dotKeyOf(t.deletedBy)]);
         const preTombs = new Set(current.tombstones.map(tombKeyOf));
         const newTombstones = landedRaw.tombstones.filter((t) => !preTombs.has(tombKeyOf(t))).length;
         const landedReport = res.sync;
@@ -228,13 +235,23 @@ function pickDot(v) {
     const counter = d?.counter;
     return typeof actor === "string" && actor !== "" && typeof counter === "number" && Number.isFinite(counter) ? { actor, counter } : undefined;
 }
-function pickScope(v) {
+function pickScopeCaptured(v) {
     const s = v;
-    if (s?.kind === "global")
-        return { kind: "global" };
-    if (s?.kind === "project" && typeof s.root === "string" && s.root !== "")
-        return { kind: "project", root: s.root };
-    return undefined;
+    const kind = s?.kind;
+    if (kind === "global")
+        return { kind, scope: { kind: "global" } };
+    if (kind === "project") {
+        const root = s?.root;
+        return { kind, scope: typeof root === "string" && root !== "" ? { kind: "project", root } : undefined };
+    }
+    if (kind === "session") {
+        const sessionId = s?.sessionId;
+        return { kind, scope: typeof sessionId === "string" && sessionId !== "" ? { kind: "session", sessionId } : undefined };
+    }
+    return { kind, scope: undefined };
+}
+function pickScope(v) {
+    return pickScopeCaptured(v).scope;
 }
 function pickAdd(v) {
     const a = v;
@@ -325,9 +342,11 @@ export function parseRuleSyncResponse(raw, expectedPrincipal) {
     }
     const tombstones = [];
     const textRefusedTombstones = [];
+    const sessionScopeTombstones = [];
     for (const entry of mergedTombstones) {
         const t = entry;
-        const scope = pickScope(t?.scope);
+        const pickedScope = pickScopeCaptured(t?.scope);
+        const scope = pickedScope.scope;
         const ruleText = t?.rule;
         const deletedBy = pickDot(t?.deletedBy);
         const removedRaw = t?.removedDots;
@@ -342,6 +361,15 @@ export function parseRuleSyncResponse(raw, expectedPrincipal) {
                 removedDots.push(dot);
             }
         }
+        if (pickedScope.kind === "session") {
+            if (typeof ruleText === "string" && deletedBy !== undefined && scope !== undefined) {
+                sessionScopeTombstones.push({ rule: ruleText, scope, dot: deletedBy });
+            }
+            else {
+                warnings.push("the response carried a session-scope tombstone whose identity could not be read — dropped per-row (a session row never lands here, and nothing is withheld for it)");
+            }
+            continue;
+        }
         if (typeof ruleText !== "string" || scope === undefined || deletedBy === undefined || removedDots.length === 0) {
             tombstones.push(undefined);
             continue;
@@ -384,6 +412,7 @@ export function parseRuleSyncResponse(raw, expectedPrincipal) {
         ...(gcFrontier !== undefined ? { gcFrontier } : {}),
         dropped,
         textRefusedTombstones,
+        sessionScopeTombstones,
         warnings,
     };
 }

package/dist/core/roles.js

@@ -3,7 +3,7 @@ export function resolveModel(ref, models) {
     if (typeof ref !== "string") {
         return ref;
     }
-    const m = models?.[ref];
+    const m = models !== undefined && Object.hasOwn(models, ref) ? models[ref] : undefined;
     if (!m) {
         throw new Error(`Unknown model ref "${ref}". Provide it in RunnerDeps.models or pass a Model object.`);
     }

package/dist/core/runner/prepare-task.js

@@ -24,6 +24,7 @@ import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import { askApproverIdentity, carriesBidiControls, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOfLayer, isApprovalSettledBy, isAskDenyResolution, screenApproverAttribution, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
 const PERSISTED_RULE_TOOL = "Bash";
 import { findAdmittingRule, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
+import { normalizePersistedRule } from "../permission-rule-store.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
 import { CHANGED_FILES_MTIME_EPS_MS, fenceMcpServerInstructions, renderAgentListingDelta } from "./turn-attachments.js";
 import { inlineUntrusted } from "../untrusted-text.js";
@@ -893,6 +894,37 @@ function explicitlyDeferredMemoryTrio(mounted, roster, deferNames) {
 function memoryGroupRetractionSet(builtinDeferPairNames, engineTrioInPlay) {
     return new Set([...builtinDeferPairNames, ...(engineTrioInPlay ? MEMORY_ENGINE_TOOL_NAMES : [])]);
 }
+async function spliceSessionOverlayRows(overlay, sessionId, persisted, tracer, hostTaskId) {
+    if (overlay === undefined)
+        return persisted;
+    try {
+        const served = structuredClone(await overlay.read(sessionId));
+        const sessionRows = served.filter((r) => {
+            const scope = r?.scope;
+            return scope?.kind === "session" && scope.sessionId === sessionId && !("reject" in normalizePersistedRule(r));
+        });
+        if (sessionRows.length < served.length) {
+            emitTrace(tracer, () => ({
+                kind: "permission.rule_store_unreadable",
+                version: 1,
+                taskId: hostTaskId,
+                message: `session-rule overlay served ${served.length - sessionRows.length} row(s) that are not canonical session rows of this session — dropped, not adjudicated`,
+                ts: Date.now(),
+            }));
+        }
+        return sessionRows.length > 0 ? [...sessionRows, ...persisted] : persisted;
+    }
+    catch (err) {
+        emitTrace(tracer, () => ({
+            kind: "permission.rule_store_unreadable",
+            version: 1,
+            taskId: hostTaskId,
+            message: `session-rule overlay: ${err instanceof Error ? err.message : String(err)}`,
+            ts: Date.now(),
+        }));
+        return persisted;
+    }
+}
 function refuseRequireExistingWithoutSession(spec) {
     if (spec.requireExistingSession && !spec.sessionId) {
         const e = new Error(`requireExistingSession requires a sessionId — cannot require an existing session without one (design/114 Phase3)`);
@@ -3600,10 +3632,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }));
                         return { unreadable: true };
                     }
-                    const admitting = findAdmittingRule(listed.rules, { tool: req.toolName, command, cwd: root });
+                    const table = await spliceSessionOverlayRows(deps.sessionPermissionRules, sessionId, listed.rules, deps.tracer, hostTaskId);
+                    const admitting = findAdmittingRule(table, { tool: req.toolName, command, cwd: root, sessionId });
                     if (admitting !== undefined)
                         return persistedRuleHitOf(admitting);
-                    const coverage = segmentCoverageOf(command, { persisted: listed.rules }, { tool: req.toolName, cwd: root });
+                    const coverage = segmentCoverageOf(command, { persisted: table }, { tool: req.toolName, cwd: root, sessionId });
                     return coverage !== undefined ? { segmentCoverage: coverage } : undefined;
                 },
             };

package/dist/core/runner/runtask.js

@@ -1410,6 +1410,7 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
                 ...(internals?.cycleSeq !== undefined ? { seq: internals.cycleSeq } : {}),
                 ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),
                 ...(subagentName ? { name: subagentName } : {}),
+                model: prepared.model.id,
                 usage: { totalTokens: stats.tokens, toolUses: stats.toolCalls, durationMs: Date.now() - rs.telemetry.taskStart },
                 status: "running",
                 ...ident(),
@@ -4223,6 +4224,7 @@ export class Runner {
                     ...(internals?.cycleSeq !== undefined ? { seq: internals.cycleSeq } : {}),
                     ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),
                     ...(subagentName ? { name: subagentName } : {}),
+                    model: prepared.model.id,
                     usage: { totalTokens: stats.tokens, toolUses: stats.toolCalls, durationMs: Date.now() - rs.telemetry.taskStart },
                     status: result.status === "completed" ? "completed" : "failed",
                     ...ident(),

package/dist/core/store-contracts/permission-rule-sync-contract.js

@@ -34,7 +34,11 @@ function liveDots(s) {
     return out;
 }
 function sameScope(a, b) {
-    return a.kind === "global" ? b.kind === "global" : b.kind === "project" && a.root === b.root;
+    if (a.kind === "global")
+        return b.kind === "global";
+    if (a.kind === "session")
+        return b.kind === "session" && a.sessionId === b.sessionId;
+    return b.kind === "project" && a.root === b.root;
 }
 function allDots(s) {
     return new Set(s.rules.flatMap((r) => r.adds.map((a) => `${r.rule}|${a.dot.actor}#${a.dot.counter}`)));
@@ -150,6 +154,16 @@ export async function permissionRuleSyncContract(hooks = {}) {
         const merged = join(state([rule("Bash(node:*)", [add("z", 1)])]), state());
         assert.strictEqual(allDots(merged).size, 0, "Bash(node:*) must be refused by the shared validator inside the join");
     });
+    run("durable two-member face (design/382 §4.3): a session-scope row or tombstone never survives a join, and never poisons the round", async () => {
+        const sessionScope = { kind: "session", sessionId: "sess-1" };
+        const dirty = state([rule("Bash(ls)", [add("z", 1)], sessionScope), rule("Bash(git status)", [add("a", 1)])], [tomb("Bash(pwd)", [["z", 2]], ["z", 3], sessionScope)]);
+        const ab = join(dirty, state());
+        const ba = join(state(), dirty);
+        assert.ok(!allDots(ab).has("Bash(ls)|z#1"), "a session-scope add must not survive the join — the durable face holds two members");
+        assert.strictEqual(ab.tombstones.length, 0, "a session-scope tombstone must not survive the join");
+        assert.ok(allDots(ab).has("Bash(git status)|a#1"), "dropping the session row must not withhold or disturb the durable rest — per-row, never round-poisoning");
+        assert.deepStrictEqual(ab, ba, "the session-scope drop must preserve commutativity");
+    });
     run("identity keys are collision-free: roots and actors containing spaces keep DISTINCT tombstone identities, and the covered add stays dead through an identity join", async () => {
         const scopeA = { kind: "project", root: "/x" };
         const scopeB = { kind: "project", root: "/x a" };

package/dist/core/task-notification.d.ts

@@ -66,6 +66,19 @@ export interface TaskNotificationPayload {
      *  `TaskResult.errorCode` taxonomy (brain `[code]` prefixes via extractErrorCode, `limit.*`,
      *  `budget.*`, …). Engine-minted, never model text. Absent when the failure carried no code. */
     errorCode?: string;
+    /** Terminal, delegation lanes: the settling run's PROVIDER-BOUNDARY fault assertion, mirrored from
+     *  its `TaskResult.apiFailure`. Its PRESENCE is the claim — "this failure came from the transport or
+     *  the provider, not from this deployment refusing to send, a limit, or unusable model output" — and
+     *  `errorCode` beside it names WHICH terminal; the two answer different questions and neither implies
+     *  the other. Members are whatever the failing attempt stated about itself (`status` when the provider
+     *  answered with one, `requestId` when it named one), so an EMPTY object is meaningful: "provider
+     *  fault, unlabelled", which is not the same statement as absence. Absent on every non-provider
+     *  terminal, on every completed run, and on the non-delegation lanes (bash/monitor), whose failures do
+     *  not pass through a model provider at all. */
+    apiFailure?: {
+        status?: number;
+        requestId?: string;
+    };
     /** Structured exit code of a background command's terminal notification (bash lane): the process
      *  exited on its own with this code. Lets consumers branch on success/failure without parsing the
      *  summary wording. Absent when the process never exited by itself (killed / spawn-failed lanes). */
@@ -77,6 +90,13 @@ export interface TaskNotificationPayload {
      *  every other notification (a completed result is never flagged). */
     partial?: boolean;
     output_file?: string;
+    /** Whatever the settling lane knows about its own spend, JSON-rendered verbatim into one `<usage>`
+     *  tag. Deliberately untyped — the lanes report different quantities and nothing here should force
+     *  one to fabricate a figure it does not have. What IS contracted is the VOCABULARY: a name that two
+     *  lanes both publish must mean the same thing on both. The delegation lanes
+     *  (`background_agent`, its fork/revive cycles) and the workflow lane therefore agree on
+     *  `tokens`/`turns`/`costMicroUsd`/`tool_uses`/`duration_ms`; the workflow lane's fan-out counters
+     *  (`agent_count`, `agents_done`, …) and resume counters have no delegation analog and are its own. */
     usage?: unknown;
     /** CC `<diagnostics>` parity: ENGINE-MINTED teaching text for the "result is empty/unexpected —
      *  now what" moment (per-agent read route / journal coordinate / resume command). Producers must mint it

package/dist/core/trace.d.ts

@@ -449,7 +449,10 @@ export type TraceEvent = {
     /** The bucket this round synced. A local-owner bucket cannot sync, so this is always a principal. */
     principal: string;
     rule: string;
-    scopeKind: "global" | "project";
+    /** `"session"` is unreachable here in a healthy fleet (design/382 §4.3: a session row never
+     *  lands, so it can never resurrect) — declared because the sibling drop event names it and a
+     *  lockstep union is what keeps the two from drifting. */
+    scopeKind: "global" | "project" | "session";
     ts: number;
 } | {
     /**
@@ -462,7 +465,9 @@ export type TraceEvent = {
     version: 1;
     principal: string;
     rule: string;
-    scopeKind: "global" | "project";
+    /** `"session"` names the design/382 §4.3 durable-face drop: a peer sent a session-scope row,
+     *  refused per-row with `session_scope_not_durable`. */
+    scopeKind: "global" | "project" | "session";
     /** Closed reason code ({@link import("./governance-codes.js").RuleSyncDropReason}). */
     reason: string;
     ts: number;

package/dist/core/types.d.ts

@@ -4646,6 +4646,31 @@ export type TaskEvent = ({
      *  nor an agent-type — the child then keeps its taskId (NOT the raw objective, which could leak a delegated
      *  secret to a progress-scoped consumer — dual-review Q2). Sanitized (control-char-stripped, length-capped). */
     name?: string;
+    /**
+     * The model this sub-run was PREPARED with — the resolved id, read off the leg's prepared model
+     * at the mint, so it is the same value `TaskResult.model` and the `task.start` trace frame carry.
+     * (`task.end` reports the run's totals and has never named a model; there is nothing to join to
+     * there.)
+     *
+     * Why it rides the live lane at all: a delegation may name a tier word (`"sonnet"`), an agent
+     * definition's model, or NOTHING (inherit the caller's current model, or fall to the `subagent`
+     * role) — every one of those resolves somewhere the consumer cannot see, so a shell badging a
+     * running child previously had only the REQUESTED word (or nothing) to render, which is a
+     * different claim from what the child runs on. This is the resolved answer, not the request.
+     *
+     * PREPARED, deliberately, and NOT "whatever is serving this turn" — stated in the first sentence
+     * because the difference is observable. A mid-run DEGRADE switch (`spec.limits.degrade`) or a
+     * gateway re-route moves the serving model without rewriting this field, exactly as
+     * `TaskResult.model` behaves; the switch is announced on its own channel (`TaskResult.degraded`),
+     * and the per-call served id lives on the brain-call telemetry. One name, one meaning, across the
+     * three faces that use it — at the cost of being the leg's declared model rather than a live one.
+     *
+     * Present on every tick this build mints (the frame family is subagent-only by construction, so
+     * there is no lane where a leg has no prepared model). Declared optional for the ordinary reason:
+     * a consumer folding frames from a pre-key producer must keep compiling, and absence there means
+     * "this producer did not state it", never "no model".
+     */
+    model?: string;
     /** The child's most recent tool intent as one human line ("Bash npm test",
      *  "Edit src/x.ts") — the SAME source/value as the registry sink tick's `currentAction` (residual
      *  observability, lane B), attached to the FORWARDED frame because every client wire projects this
@@ -5246,6 +5271,40 @@ export interface BackgroundChildEvent {
      *  waiting for spawn-frame forwarding; `name` stays the design/99 DISPLAY label (description-backed)
      *  and was never a type field. */
     agentType?: string;
+    /**
+     * spawn + tick: the model the ROW runs on — the resolved `ModelRef` the spawner selected for this
+     * child (a per-call `model`, an agent definition's, or the caller's own current model, inherited).
+     * It answers with the SERVED catalog model id wherever that is knowable, because this value sits
+     * beside the child's own `task_progress.model` (the leg's prepared id) and a consumer joins the
+     * two: a row saying "sonnet" next to ticks naming the catalog id it routed to is indistinguishable
+     * from two different children. A `Model` object carries its id — and a per-call word that passed
+     * the spawn gate arrives as exactly that resolved object, so for it the row and the ticks are one
+     * value by construction. A definition/tool-level STRING ref resolves through the catalog in force
+     * at the spawn judgement; the child's own prepare re-resolves such a ref against the runner's live
+     * table, so for those refs alone a catalog hot-swapped between the two reads can lag the row one
+     * generation behind the ticks. The DISPLAY rule survives only as the FALLBACK, for a string the
+     * judgement-time catalog cannot resolve (a CC tier alias then shows its sema tier, never the alias
+     * verbatim). It rides ticks as well as spawn for the same reason
+     * {@link agentType} does: a consumer that only forwards ticks must not have to wait for spawn-frame
+     * forwarding to fill its row. Like `agentType` it is the ROW's own fact and is NEVER copied off a
+     * forwarded frame — a nested descendant's `task_progress` names ITS model, not this row's.
+     *
+     * ABSENT is a fact, not a gap, and there are exactly three ways to get there:
+     *  · the delegation named no model anywhere in the chain, so the child runs on the `subagent` ROLE
+     *    and its concrete id is only decided at the child's own prepare;
+     *  · the RETAIN-LEDGER wake lane (a `SendMessage` resume of a completed child), whose frames are
+     *    projected from an `AccessibleTaskRow` — and that row has no model column, so this lane has
+     *    nothing to state and will not invent one. Stated precisely because the sibling wake lane does
+     *    NOT share the limitation: a tier-3 DURABLE revive re-enters through the ordinary background
+     *    spawn, re-derives the model like a first spawn, and its `(revived)` frames carry it whenever
+     *    that derivation lands on a model (the durable record keeps a `model` of its own; a recorded
+     *    key the current catalog no longer resolves degrades the revival to the inherited model, and a
+     *    mount with nothing to inherit then leaves these frames honestly silent);
+     *  · a pre-key producer.
+     * In every case the child's own `task_progress` frames still carry the resolved answer, which is the
+     * authority; this field is the row-level convenience beside it.
+     */
+    model?: string;
     /** spawn: the HOST task's DECLARED task id (parent attribution). Omitted when the host
      *  run declared no task id (the `spec.taskId ?? sessionId` fallback would launder a session id into
      *  a task-id field — the orphan-pointer shape); {@link parentSessionId} is the always-on linkage. */
@@ -5359,7 +5418,21 @@ export interface BackgroundChildEvent {
     stoppedBy?: "user" | "parent" | "system" | (string & {});
     /** terminal: bounded human summary (same text the task_notification carries). */
     summary?: string;
-    /** tick: live rollup (`task_progress.usage`) · terminal: final `{tokens, turns, costMicroUsd}`. */
+    /** tick: live rollup (`task_progress.usage`) · terminal: the settled
+     *  `{tokens, turns, costMicroUsd?, toolUses?, durationMs}`. `costMicroUsd` is own+nested and present
+     *  only when that total is KNOWN (RB-368); `toolUses` is the run's own `stats.toolCalls` and is
+     *  absent — never zeroed — when the gateway reported no usage. The last two joined the terminal face
+     *  to close a reporting asymmetry: the workflow lane's completion notification and the Agent tool's
+     *  own sync `<usage>` footer had published both all along, so one child answered "how much work, how
+     *  long" on one lane and refused on the other.
+     *
+     *  `durationMs` MEASURES DIFFERENT SPANS on the two kinds, which is worth knowing before plotting it:
+     *  on a TICK it is the child RUN's own elapsed (the forwarded frame's value, from the run's start);
+     *  on the TERMINAL it is the delegation LEG's, from the lane's launch instant — which is earlier, so
+     *  a consumer graphing one series sees a step up at settle. Both are true of what they name; neither
+     *  can be computed from the other without the spawn/prepare interval, which is why they are not
+     *  reconciled into one. The intra-turn activity beat carries a third, narrower shape (`{toolUses}`
+     *  alone — there is no honest live token figure on that lane). */
     usage?: {
         totalTokens?: number;
         toolUses?: number;
@@ -6436,6 +6509,17 @@ export interface RunnerDeps {
      * adopted principal's bucket forever.
      */
     localOwnerRules?: boolean;
+    /**
+     * design/382 §4.3 — the SESSION-RULE OVERLAY: where `{kind:"session"}` scoped allow rules live
+     * (the session's own state, never the persisted store). Wired, the gate's persisted-rule lane
+     * splices the CURRENT session's overlay rows in front of the store's `list()` on every
+     * adjudication — session > project > global, the narrowest-first reporting order — and threads the
+     * session's identity as the eligibility context's third axis; a host lands rows into it through
+     * the consent protocol (`RuleConsentDeps.sessionRules`, a session-scope candidate's redemption).
+     * Omitted ⇒ the session dimension does not exist at this gate and the lane is byte-identical.
+     * See `permission-rule-session.ts` for the contract and the reference implementation.
+     */
+    sessionPermissionRules?: import("./permission-rule-session.js").SessionRuleOverlay;
     /**
      * design/182 §7 — the ORG rule overlay for an org-GOVERNED deployment. Constructed with
      * `createOrgRuleOverlay` (that constructor is the boot gate: a governed declaration with no snapshot

package/dist/core/wiring-manifest.d.ts

@@ -133,7 +133,12 @@ export interface WiringManifest {
      *  a completed/failed/killed(non-user) subagent minted through the deps-visible assembly is
      *  continuable across a process restart. A statement about the DEPS-VISIBLE assembly only: a
      *  caller-mounted Agent tool over its own runner is outside this manifest's sight (per-read
-     *  honest degrade + the integrity notice own that case, never a fabricated tier). */
+     *  honest degrade + the integrity notice own that case, never a fabricated tier) — and that
+     *  blind spot is load-bearing here, because the store this field is derived from is the ROOT
+     *  leg's while the store an ordinary child transcript is actually minted through is the AGENT
+     *  TOOL's runner's ({@link resolveSubagentTranscriptTier} names the rule and the fork-lane
+     *  exception). The word names ADDRESSABILITY: `none`/`rows` are silent on whether a child
+     *  transcript reaches disk at all, and only `full` promises the a* handle survives a restart. */
     fleet: {
         backgroundAgentStore: boolean;
         hostChildEventSink: boolean;
@@ -254,6 +259,18 @@ export type SubagentTranscriptTier = "none" | "rows" | "full";
  * fold picked). This is the DEPLOYMENT-level judgment only; the per-handle "did this row's
  * transcript actually land" question belongs to `durableAgentRowProbe` (the S1b release-flip gate)
  * — two different questions, deliberately two named faces (do not merge them back into one).
+ *
+ * WHICH session store to pass: the one on the runner the Agent tool was mounted with
+ * (`SubagentToolOptions.runner.sessions`), because that is the store an ordinary (sync/background)
+ * child transcript is minted through — the fork lane deliberately branches through the HOST store
+ * instead, see the law on `SubagentToolOptions.runner`. A deployment that serves root tasks from one
+ * runner and delegated children from another (a throwaway sub-task store, a routing store) has two
+ * different stores here, and passing the ROOT deps' store reports the root lane's fate under the
+ * child lane's name. Note what the three words do and do not promise about DISK: this tier names
+ * ADDRESSABILITY, not persistence. `none` is returned before any store is inspected, so it covers
+ * both "the transcript is on disk but nothing can address it" and "there is no transcript" — an
+ * operator asking whether a child conversation is readable afterwards must read the delegation
+ * store's own durability + release/evict semantics, not this word.
  */
 export declare function resolveSubagentTranscriptTier(agentStoreWired: boolean, sessionStore: {
     readonly placements?: {

package/dist/index.d.ts

@@ -167,8 +167,9 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
  * allowed and widening is not.
  */
 export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
-export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, type PermissionRuleWriter, type WritablePermissionRuleStore, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
+export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritablePermissionRuleStore, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
+export { InMemorySessionRuleOverlay, type SessionRuleOverlay, type SessionRuleOverlayAdd, type SessionRuleOverlayApplyResult, } from "./core/permission-rule-session.js";
 export { createOrgRuleOverlay, orgRuleVerdictFor, effectivePermissionRules, orgRuleStatePersistenceOf, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, type OrgPermissionRule, type OrgRuleSnapshot, type OrgRuleSnapshotProvider, type OrgRuleStatePersistence, type PersistedOrgRuleState, type OrgRuleOverlay, type OrgOverlayResolution, type OrgOverlayStatus, type EffectivePermissionRule, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES, type RuleSyncDropReason, type RuleQuarantineReason } from "./core/governance-codes.js";
 export { prepareCardApproval, confirmRuleApproval, type ConfirmResult, type ConfirmRefusalReason, precheckEditedRuleText, type EditedRuleTextPrecheck, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, ruleOffersOfRecord, type RuleTicket, type RuleCandidate, type RuleApprovalKind, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleOffer2, type StaleRuleApprovalRecord, type RuleConsentDeps, type RedeemResult, type RedeemedBatchMember, type CcImportLayer, type ImportedSettingsLayer, type ImportPreview, } from "./core/permission-rule-consent.js";

package/dist/index.js

@@ -127,8 +127,9 @@ export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoMo
 export { rebuildAutoModeDecider, } from "./core/auto-mode-rebuild.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isNamespacedCoveringRuleName, namespacedRuleNameCovers, } from "./core/permission-rules.js";
 export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
-export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, } from "./core/permission-rule-store.js";
+export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
+export { InMemorySessionRuleOverlay, } from "./core/permission-rule-session.js";
 export { createOrgRuleOverlay, orgRuleVerdictFor, effectivePermissionRules, orgRuleStatePersistenceOf, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES } from "./core/governance-codes.js";
 export { prepareCardApproval, confirmRuleApproval, precheckEditedRuleText, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, ruleOffersOfRecord, } from "./core/permission-rule-consent.js";

package/dist/orchestration/run-workflow-tool.js

@@ -3,6 +3,7 @@ import { defineTool, errorResult } from "../core/tools.js";
 import { governanceBaselineError, governanceBaselineProblem } from "./governance-baseline-validity.js";
 import { redactSecrets, redactHostLeaks, boundedRedactedSummary } from "../core/untrusted-egress.js";
 import { withDelegationProvenance } from "../core/tool-policy.js";
+import { LAUNCH_RECEIPT_OWN_WORDS_CLAUSE, launchReceiptNoQuoteClause } from "../agents/launch-receipt-contract.js";
 import { startWorkflow } from "./workflow.js";
 import { buildWorkflowPrimitives } from "./workflow-primitives.js";
 import { parseWorkflowMeta, splitWorkflowMeta, workflowScriptReadsClockOrRandom } from "./workflow-meta.js";
@@ -630,8 +631,7 @@ export async function createRunWorkflowTool(d) {
                     task_id: runId,
                     status: "started",
                     ...(persistedScriptPath !== undefined ? { scriptPath: persistedScriptPath } : {}),
-                    handling: "This tool result is internal metadata — never quote or paste any part of it (the ids above, and scriptPath when present) into a user-facing reply. " +
-                        "In your own words, briefly tell the user what you launched; do not echo this result.",
+                    handling: `${launchReceiptNoQuoteClause(" (the ids above, and scriptPath when present)")} ${LAUNCH_RECEIPT_OWN_WORDS_CLAUSE}`,
                     note: (() => {
                         const pollExpr = d.taskRegistry ? `TaskOutput({ task_id: "${runId}" })` : undefined;
                         const blockingPollExpr = d.taskRegistry ? `TaskOutput({ task_id: "${runId}", block: true })` : undefined;