@sema-agent/core 7.10.0 → 7.11.0

package/dist/core/tools.d.ts

@@ -15,14 +15,34 @@ export declare function errorResult(text: string, details?: unknown): {
     isError: true;
     details?: unknown;
 };
-/** True iff `x` is an `AgentTool` this module's `defineTool` itself constructed — see {@link DEFINE_TOOL_BRAND}. */
+/** The seat's function: the mount's ctx builder and the very object being mounted (the seal compares it to the stamped one). */
+type DefineToolRebind = (enrich: ToolCtxEnricher, mounted: object) => AgentTool;
+/** True iff `x` is an `AgentTool` this module's `defineTool` itself constructed — see {@link DEFINE_TOOL_BRAND}.
+ *  An OWN property read: an object that merely INHERITS the brand (`Object.create(product)`, a Proxy over it)
+ *  is not the product — the rebind seat would rebuild the product and drop whatever the derived object
+ *  overrode, so such objects are not recognised here and fall to the spec arm's contract (which they do not
+ *  meet either; see {@link stampDefineToolBrand} for the one supported wrapper form). */
 export declare function isDefineToolProduct(x: unknown): x is AgentTool;
-/** RB-362 类修同源章点 — the ONE place the brand is stamped. `defineTool` uses it on its own product;
- *  the only OTHER legitimate caller is a wrapper that (a) starts from a branded product and (b)
- *  preserves the AgentTool `execute(toolCallId, rawParams, signal, onUpdate)` contract faithfully
- *  (e.g. teacher.ts's logging wrapper). A shallow copy that does NOT re-stamp deliberately loses the
- *  brand — that is the brand's documented survival contract, not an accident. Internal only. */
-export declare function stampDefineToolBrand<T extends object>(tool: T): T;
+/** RB-362 类修同源章点 — the ONE place the brand is stamped, and with it the rebind seat (a branded object
+ *  ALWAYS carries one; that invariant is what lets the caller mount rebind every product without a
+ *  "cannot enrich" arm). `defineTool` uses it on its own product; the only OTHER legitimate caller is a
+ *  wrapper that (a) starts from a branded product, (b) preserves the AgentTool
+ *  `execute(toolCallId, rawParams, signal, onUpdate)` contract faithfully and (c) hands over a `rebind`
+ *  that re-wraps the REBOUND inner product the same way (e.g. teacher.ts's logging wrapper) — so a mount
+ *  rebinding the wrapper gets a wrapper over an enriched product, not an enriched product without the
+ *  wrapper. A shallow copy that does NOT re-stamp deliberately loses the brand — that is the brand's
+ *  documented survival contract, not an accident. Internal only. */
+export declare function stampDefineToolBrand<T extends object>(tool: T, rebind: DefineToolRebind): T;
+/**
+ * A branded product REBOUND to a mount's ctx builder — the product's own `execute` rebuilt over its own
+ * spec with `enrich` applied per call (see {@link ToolCtxEnricher}; a builder the product was built with
+ * runs AFTER the mount's, refining the run's trusted seats, and the per-call identity is re-stamped after
+ * both). This is how a `defineTool()` product handed to `TaskSpec.tools` receives exactly the ctx a raw
+ * `ToolSpec` on the same mount receives: one mount law, whatever object shape the caller handed in.
+ * Throws on an unbranded object — the caller checks {@link isDefineToolProduct} first; a branded object
+ * without the seat cannot be constructed (both are written at the one stamp site).
+ */
+export declare function rebindDefineToolCtx(product: AgentTool, enrich: ToolCtxEnricher): AgentTool;
 /**
  * RB-409 — a per-call ctx builder a MOUNT hands to {@link defineTool}.
  *
@@ -58,3 +78,4 @@ export interface DefineToolOptions {
 }
 /** Adapt a friendly ToolSpec into the vendored AgentTool the agent loop expects. */
 export declare function defineTool<TParams extends TSchema = TSchema>(spec: ToolSpec<TParams>, options?: DefineToolOptions): AgentTool<TParams>;
+export {};

package/dist/core/tools.js

@@ -26,13 +26,46 @@ export function errorResult(text, details) {
     return details === undefined ? { content: text, isError: true } : { content: text, isError: true, details };
 }
 const DEFINE_TOOL_BRAND = Symbol("sema.core.defineTool.product");
+const DEFINE_TOOL_REBIND = Symbol("sema.core.defineTool.rebind");
 export function isDefineToolProduct(x) {
-    return typeof x === "object" && x !== null && x[DEFINE_TOOL_BRAND] === true;
+    return typeof x === "object" && x !== null && Object.getOwnPropertyDescriptor(x, DEFINE_TOOL_BRAND)?.value === true;
 }
-export function stampDefineToolBrand(tool) {
+export function stampDefineToolBrand(tool, rebind) {
     Object.defineProperty(tool, DEFINE_TOOL_BRAND, { value: true, enumerable: false });
+    Object.defineProperty(tool, DEFINE_TOOL_REBIND, { value: sealedRebind(tool, rebind), enumerable: false });
     return tool;
 }
+function sealedRebind(stamped, rebuild) {
+    const ownExecute = Object.getOwnPropertyDescriptor(stamped, "execute")?.value;
+    const stillSealed = () => {
+        const d = Object.getOwnPropertyDescriptor(stamped, "execute");
+        return d !== undefined && "value" in d && d.value === ownExecute;
+    };
+    return (enrich, mounted) => {
+        if (mounted !== stamped) {
+            throw new Error(`defineTool product ${JSON.stringify(stamped.name)}: the object being mounted is not the one this brand was stamped on (a derived object — prototype, proxy or descriptor copy — carrying a borrowed brand), so it cannot be rebound to the run's ctx without dropping its own overrides — wrap the product as a NEW object (stampDefineToolBrand with a rebind that re-wraps the rebound inner product), or author it as a raw ToolSpec`);
+        }
+        const refuse = () => {
+            throw new Error(`defineTool product ${JSON.stringify(stamped.name)}: its execute is not the own data property the factory wrote (replaced, or turned into an accessor, after the factory built it), so it cannot be rebound to the run's ctx without dropping the replacement — wrap the product as a NEW object (stampDefineToolBrand with a rebind that re-wraps the rebound inner product), or author it as a raw ToolSpec`);
+        };
+        if (!stillSealed())
+            refuse();
+        const rebound = rebuild(enrich, mounted);
+        if (!stillSealed())
+            refuse();
+        return rebound;
+    };
+}
+export function rebindDefineToolCtx(product, enrich) {
+    const rebind = Object.getOwnPropertyDescriptor(product, DEFINE_TOOL_REBIND)?.value;
+    if (typeof rebind !== "function")
+        throw new Error(`rebindDefineToolCtx: ${product.name} is not a defineTool product (no rebind seat)`);
+    return rebind(enrich, product);
+}
+function stampCallIdentity(enriched, toolCallId, signal) {
+    const own = (value) => ({ value, enumerable: true, configurable: true, writable: true });
+    return Object.create(Object.getPrototypeOf(enriched), { ...Object.getOwnPropertyDescriptors(enriched), toolCallId: own(toolCallId), signal: own(signal) });
+}
 export function defineTool(spec, options) {
     const executionMode = spec.executionMode ?? (spec.effect === "read" ? "parallel" : "sequential");
     const tool = {
@@ -77,7 +110,8 @@ export function defineTool(spec, options) {
             let ret;
             try {
                 const baseCtx = { toolCallId, signal };
-                ret = await spec.execute(params, options?.enrichCtx ? { ...options.enrichCtx(baseCtx), toolCallId, signal } : baseCtx);
+                const ctx = options?.enrichCtx ? stampCallIdentity(options.enrichCtx(baseCtx), toolCallId, signal) : baseCtx;
+                ret = await spec.execute(params, ctx);
             }
             catch (err) {
                 const wrapped = new Error(formatToolError(err));
@@ -105,6 +139,12 @@ export function defineTool(spec, options) {
             ...(spec.aliases && spec.aliases.length > 0 ? { aliases: spec.aliases } : {}),
         });
     }
-    stampDefineToolBrand(tool);
+    stampDefineToolBrand(tool, (enrich) => {
+        const composed = options?.enrichCtx === undefined ? enrich : (base) => options.enrichCtx(enrich(base));
+        const rebuilt = defineTool(spec, { ...options, enrichCtx: composed });
+        const { [DEFINE_TOOL_BRAND]: _brand, [DEFINE_TOOL_REBIND]: _seat, ...face } = Object.getOwnPropertyDescriptors(tool);
+        const copy = Object.create(Object.getPrototypeOf(tool), { ...face, execute: { value: rebuilt.execute, enumerable: true, configurable: true, writable: true } });
+        return stampDefineToolBrand(copy, (again) => rebindDefineToolCtx(rebuilt, again));
+    });
     return tool;
 }

package/dist/core/trace.d.ts

@@ -425,6 +425,21 @@ export type TraceEvent = {
     toolCallId: string;
     rules: readonly string[];
     ts: number;
+} | {
+    /**
+     * #619 — the READ-ONLY reader cleared a shell call, so no person and no classifier was asked: the
+     * allow layer's second attribution channel beside `permission.persisted_rule_allowed`. `command` is
+     * the FINAL command the gate judged (a policy rewrite included) — model-authored text, carried
+     * verbatim as the audit fact this frame exists for (a consumer rendering it applies its own
+     * display sanitizer, as it does for `tool_start` args).
+     */
+    kind: "permission.read_only_allowed";
+    version: 1;
+    taskId: string;
+    toolName: string;
+    toolCallId: string;
+    command: string;
+    ts: number;
 } | {
     /**
      * design/179 — the persisted allow-rule store could not be read, so this call was adjudicated with

package/dist/engine/harness/agent-harness.d.ts

@@ -131,6 +131,7 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
     private runPromise?;
     private pendingSessionWrites;
     private model;
+    /** The run's thinking level; `undefined` = undeclared (provider default, no wire key) — distinct from "off". */
     private thinkingLevel;
     /** RB-30 terminal fix — runner-set sink for engine-note payloads left undrained at agent_end. */
     onUndrainedEngineNotes?: (payloads: unknown[]) => void;
@@ -410,7 +411,8 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
     } & UserMessageProvenance): Promise<void>;
     appendMessage(message: AgentMessage): Promise<void>;
     getModel(): Model;
-    getThinkingLevel(): ThinkingLevel;
+    /** The current level, or `undefined` when none was declared (provider default — no wire key). */
+    getThinkingLevel(): ThinkingLevel | undefined;
     setModel(model: Model): Promise<void>;
     setThinkingLevel(level: ThinkingLevel): Promise<void>;
     setActiveTools(toolNames: string[]): Promise<void>;

package/dist/engine/harness/agent-harness.js

@@ -277,7 +277,7 @@ export class AgentHarness {
             this.tools.set(tool.name, tool);
         }
         this.model = options.model;
-        this.thinkingLevel = options.thinkingLevel ?? "off";
+        this.thinkingLevel = options.thinkingLevel;
         this.activeToolNames =
             options.activeToolNames ?? (options.tools ?? []).map((tool) => tool.name);
         this.steeringQueueMode = options.steeringMode ?? "one-at-a-time";

package/dist/engine/harness/types.d.ts

@@ -1178,7 +1178,8 @@ export interface ModelSelectEvent {
 export interface ThinkingLevelSelectEvent {
     type: "thinking_level_select";
     level: ThinkingLevel;
-    previousLevel: ThinkingLevel;
+    /** `undefined` when the run had no declared level before this selection (provider default). */
+    previousLevel: ThinkingLevel | undefined;
 }
 export interface ResourcesUpdateEvent<TSkill extends Skill = Skill, TPromptTemplate extends PromptTemplate = PromptTemplate> {
     type: "resources_update";
@@ -1346,7 +1347,8 @@ export interface AgentHarnessOptions<TSkill extends Skill = Skill, TPromptTempla
         env: ExecutionEnv;
         session: Session;
         model: Model;
-        thinkingLevel: ThinkingLevel;
+        /** `undefined` = no level declared (provider default). */
+        thinkingLevel: ThinkingLevel | undefined;
         activeTools: TTool[];
         resources: AgentHarnessResources<TSkill, TPromptTemplate>;
     }) => string | Promise<string>);

package/dist/index.d.ts

@@ -195,7 +195,9 @@ export { removePersistedRule, applyTombstones, sameScope, sameRuleIdentity, isVa
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, type PermissionRuleStore, type PermissionRuleStoreProvider, type PermissionRuleStoreConfig, type EffectivePermissionRules, type EffectivePermissionRule, type RemovedPermissionRule, type RuleSource, } from "./core/permission-rule-provider.js";
 export { InMemorySessionRulePartition, type SessionRulePartition, type SessionRuleAdd, type SessionRuleApplyResult, } from "./core/permission-rule-session.js";
-export { readShellCommand, isFullyReadable, MAX_SHELL_READ_CHARS, SHELL_WRAPPER_TABLE, type ShellCommandShape, type ShellSegment, type ShellWord, type ShellWrapperName, } from "./core/shell-lexer.js";
+export { readShellCommand, isFullyReadable, MAX_SHELL_READ_CHARS, SHELL_WRAPPER_TABLE, type ShellCommandShape, type ShellSegment, type ShellWord, type ShellRedirection, type ShellWrapperName, } from "./core/shell-lexer.js";
+export { readOnlyShellVerdict, type ReadOnlyShellVerdict } from "./core/read-only-shell.js";
+export { READ_ONLY_FLAG_ARITIES, FLAG_VALUE_ACCEPTS, READ_ONLY_COMMAND_TABLE, READ_ONLY_BARE_PROGRAMS, READ_ONLY_GLOB_PROGRAMS, READ_ONLY_EXACT_FORMS, READ_ONLY_BARE_ONLY, FIND_ACTION_PRIMARIES, FIND_VALUE_PRIMARIES, FIND_NEWER_PRIMARY, READ_ONLY_ENV_NAMES, XARGS_READ_ONLY_TARGETS, type ReadOnlyFlagArity, type ReadOnlyCommandRow, } from "./core/read-only-shell-table.js";
 export { orgRuleVerdictFor, type OrgRuleVerdict, orgRuleShadows, unenforceableOrgRules, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, type OrgPermissionRule, type OrgRuleSnapshot, type OrgRuleSnapshotProvider, type OrgRuleStatePersistence, type PersistedOrgRuleState, type OrgRulePartitionConfig, type OrgRuleResolution, type OrgRuleStatus, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES, type RuleSyncDropReason, type RuleQuarantineReason } from "./core/governance-codes.js";
 export { prepareCardApproval, confirmRuleApproval, type ConfirmResult, type ConfirmRefusalReason, precheckEditedRuleText, type EditedRuleTextPrecheck, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, ruleOffersOfRecord, type RuleTicket, type RuleCandidate, type RuleApprovalKind, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleOffer2, type StaleRuleApprovalRecord, type RuleConsentDeps, type RedeemResult, type RedeemedBatchMember, type CcImportLayer, type ImportedSettingsLayer, type ImportPreview, } from "./core/permission-rule-consent.js";

package/dist/index.js

@@ -155,6 +155,8 @@ export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH,
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, } from "./core/permission-rule-provider.js";
 export { InMemorySessionRulePartition, } from "./core/permission-rule-session.js";
 export { readShellCommand, isFullyReadable, MAX_SHELL_READ_CHARS, SHELL_WRAPPER_TABLE, } from "./core/shell-lexer.js";
+export { readOnlyShellVerdict } from "./core/read-only-shell.js";
+export { READ_ONLY_FLAG_ARITIES, FLAG_VALUE_ACCEPTS, READ_ONLY_COMMAND_TABLE, READ_ONLY_BARE_PROGRAMS, READ_ONLY_GLOB_PROGRAMS, READ_ONLY_EXACT_FORMS, READ_ONLY_BARE_ONLY, FIND_ACTION_PRIMARIES, FIND_VALUE_PRIMARIES, FIND_NEWER_PRIMARY, READ_ONLY_ENV_NAMES, XARGS_READ_ONLY_TARGETS, } from "./core/read-only-shell-table.js";
 export { orgRuleVerdictFor, orgRuleShadows, unenforceableOrgRules, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES } from "./core/governance-codes.js";
 export { prepareCardApproval, confirmRuleApproval, precheckEditedRuleText, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, ruleOffersOfRecord, } from "./core/permission-rule-consent.js";

package/dist/orchestration/run-workflow-tool.d.ts

@@ -260,8 +260,11 @@ export interface RunWorkflowToolDeps {
     /** The HOST task's effective working root — threaded into every spawned agent's trusted internals so a
      *  TOC env factory can root the child at the parent's cwd (CC parity, 2026-07-03). */
     parentCwd?: string;
-    /** Call-time getter for the HOST task's current thinking level — a spawned agent with no explicit
-     *  script/baseline `thinking` inherits it (the parentCwd/model-snapshot companion). */
+    /** Call-time getter for the level a spawned agent runs at when neither the script, the agentType
+     *  definition nor the governance baseline set `thinking` (the mount folds the deployment's STATED
+     *  `roles.subagent.thinking` over the HOST task's current level — the child thinking seat's lower rungs).
+     *  Threaded to the workflow as `defaultThinking` and applied at the launch site AFTER the agentType fold,
+     *  the `parentModel` → `defaultModel` companion. */
     parentThinking?: () => import("../core/types.js").TaskSpec["thinking"];
     /** 5.30 merge-rescan (design/199 parity gap) — call-time getter for the HOST task's RESOLVED
      *  read-face containment; folds stricter-wins into every spawned workflow child (see

package/dist/orchestration/run-workflow-tool.js

@@ -488,7 +488,7 @@ export async function createRunWorkflowTool(d) {
                 }
                 : governance;
             const scriptFn = (wfCtx) => {
-                const primitives = buildWorkflowPrimitives(wfCtx, runGovernance, d.onAgentSpawn, d.parentThinking, principal, ctx.checkpointStoreDisabledForChildren === true || d.parentCheckpointStoreDisabled === true, d.parentReadFace, d.parentReadDenyPatterns, ctx.handsReadOnly === true || d.parentHandsReadOnly === true, ctx.interactiveTools === false || d.parentInteractiveTools === false);
+                const primitives = buildWorkflowPrimitives(wfCtx, runGovernance, d.onAgentSpawn, principal, ctx.checkpointStoreDisabledForChildren === true || d.parentCheckpointStoreDisabled === true, d.parentReadFace, d.parentReadDenyPatterns, ctx.handsReadOnly === true || d.parentHandsReadOnly === true, ctx.interactiveTools === false || d.parentInteractiveTools === false);
                 return d.scriptRunner.run({ scriptSource: script, primitives, scriptArgs: effectiveArgs, signal: wfCtx.signal }).then((r) => r.result);
             };
             if (ctx.signal?.aborted) {
@@ -546,6 +546,7 @@ export async function createRunWorkflowTool(d) {
                         return d.parentMemoryCaptureState !== undefined ? { parentMemoryCaptureState: d.parentMemoryCaptureState } : {};
                     })(),
                     ...(d.parentModel !== undefined ? { defaultModel: d.parentModel } : {}),
+                    ...(d.parentThinking !== undefined ? { defaultThinking: d.parentThinking } : {}),
                     ...(d.parentGetApiKeyAndHeaders !== undefined ? { defaultGetApiKeyAndHeaders: d.parentGetApiKeyAndHeaders } : {}),
                     ...(hostDurableApproval !== undefined && d.store !== undefined ? { defaultDurableApproval: { ...hostDurableApproval } } : {}),
                     ...(resumeFromRunId !== undefined && d.parkedResume !== undefined && d.parkedResume(resumeFromRunId) !== undefined ? { parkedResume: d.parkedResume(resumeFromRunId) } : {}),

package/dist/orchestration/workflow-governance.d.ts

@@ -8,8 +8,9 @@
  * (toolPolicy / onAsk / hooks / principal / tools / mcp / skills / lspManager / checkpointStore /
  * getApiKeyAndHeaders / promptProvider / sessionId / signal / …) is structurally never copied. "Never
  * copied" is a statement about the SCRIPT's spec — the child's control plane still arrives from the
- * TRUSTED side, and some of it inherits from the HOST run on trusted lanes of its own: `principal` /
- * `thinking` / the durable off-switch via `buildWorkflowPrimitives`' engine injections, and the host's
+ * TRUSTED side, and some of it inherits from the HOST run on trusted lanes of its own: `principal` / the
+ * durable off-switch via `buildWorkflowPrimitives`' engine injections, `model` / `thinking` / the stated
+ * subagent persona via the launch site's child seats (`withWorkflowChildSeats`), and the host's
  * effective approver via the run-workflow mount's base-slot fold (`RunWorkflowToolDeps.parentOnAsk` →
  * `baseline.base.onAsk`, backlog #342 — filled only when the deployment did not pin the seat). Those are
  * host-ctx bindings the engine writes onto the baseline/child, never a read of anything the script wrote:

package/dist/orchestration/workflow-primitives.d.ts

@@ -31,8 +31,11 @@ export interface WorkflowGovernance {
 /**
  * Build the flat {@link WorkflowPrimitives} a {@link WorkflowScriptRunner} runs the script against. The
  * `agent` primitive is GOVERNED when `governance` is set (LLM-authored), else a trusted pass-through.
+ * The host's model and thinking are NOT injected here: both are seats the launch site (`workflow.ts`,
+ * `withWorkflowChildSeats`) fills AFTER the agentType fold, so a definition's own value is the explicit rung
+ * — filling them here ran ahead of the fold and made the fold's "when unset" guard permanently false.
  */
-export declare function buildWorkflowPrimitives(ctx: WorkflowRunContext, governance?: WorkflowGovernance, onAgentSpawn?: (handle: WorkflowAgentHandle) => void, parentThinking?: () => TaskSpec["thinking"], parentPrincipal?: string, 
+export declare function buildWorkflowPrimitives(ctx: WorkflowRunContext, governance?: WorkflowGovernance, onAgentSpawn?: (handle: WorkflowAgentHandle) => void, parentPrincipal?: string, 
 /** ruled 2026-08-04 — the host run set `TaskSpec.checkpointStore: "disabled"` (the per-run durable off
  *  switch). Every agent this workflow spawns inherits it; see the injection below. */
 parentCheckpointStoreDisabled?: boolean, 

package/dist/orchestration/workflow-primitives.js

@@ -65,7 +65,7 @@ function formatResourceClampNote(notes) {
     const parts = notes.map((n) => `${n.field}: requested ${n.requested === undefined ? "unset" : n.requested} → applied ${n.applied}`);
     return `workflow governance tightened this agent's resource limits (${parts.join("; ")})`;
 }
-export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentThinking, parentPrincipal, parentCheckpointStoreDisabled, parentReadFace, parentReadDenyPatterns, parentHandsReadOnly, parentInteractiveToolsOff) {
+export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentPrincipal, parentCheckpointStoreDisabled, parentReadFace, parentReadDenyPatterns, parentHandsReadOnly, parentInteractiveToolsOff) {
     const agent = (spec, opts) => {
         if (typeof spec === "string")
             spec = { objective: spec };
@@ -74,11 +74,6 @@ export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentThi
         const childSpec = governance
             ? buildGovernedChildSpec(spec, effectiveBaseline(governance.baseline), governance.models, governance.caps, (notes) => ctx.log(formatResourceClampNote(notes)), governance.onNotice)
             : { ...spec };
-        if (childSpec.thinking === undefined && parentThinking) {
-            const inherited = parentThinking();
-            if (inherited !== undefined)
-                childSpec.thinking = inherited;
-        }
         if (childSpec.principal === undefined && parentPrincipal !== undefined) {
             childSpec.principal = parentPrincipal;
         }

package/dist/orchestration/workflow.d.ts

@@ -1,7 +1,7 @@
 import type { TSchema } from "typebox";
 import type { InheritedGate, RunnerSelfSeat } from "../core/runner/contracts.js";
 import type { CheckpointToken, ResumeOutcome } from "../core/checkpoint-store.js";
-import type { AgentDefinition, TaskEvent, TaskResult, TaskSpec } from "../core/types.js";
+import type { AgentDefinition, TaskEvent, TaskResult, TaskSpec, ThinkingLevel } from "../core/types.js";
 import type { WorkflowRunStore } from "../core/workflow-run-store.js";
 import type { WorkflowJournalStore, ResumeClaimArgs } from "../core/workflow-journal-store.js";
 import type { WorkflowRun, WorkflowEvent } from "./workflow-types.js";
@@ -22,9 +22,11 @@ export declare const WORKFLOW_SUBAGENT_APPEND_SCHEMA = "---\n\nNOTE: You are run
  * Apply the G5 default persona to a `ctx.agent`/`ctx.agentStream` child spec. Two-state on the EFFECTIVE
  * schema (`agentOpts.schema` wins over a spec-carried `outputSchema`, same as the runSpec injection):
  *   • no `spec.systemPrompt` → the dedicated workflow-subagent persona REPLACES the role base (198
- *     default `workflow-subagent` agent-type semantics);
- *   • a script-supplied `spec.systemPrompt` (custom persona) → the matching NOTE is APPENDED via
- *     `appendSystemPrompt` (198 composite semantics — append, never replace), after any existing append.
+ *     default `workflow-subagent` agent-type semantics) — reached only when neither the script, the
+ *     agentType definition nor the deployment's stated subagent preset supplied one ({@link withWorkflowChildSeats}
+ *     writes the preset first);
+ *   • a `spec.systemPrompt` (custom persona: script, definition or stated preset) → the matching NOTE is
+ *     APPENDED via `appendSystemPrompt` (198 composite semantics — append, never replace), after any existing append.
  * Called AFTER the call-key is computed (the journal identity keys the AUTHORED spec, so a resume across
  * core versions replays cleanly; the persona is an execution detail, not call identity).
  */
@@ -446,6 +448,12 @@ export interface RunWorkflowOptions {
      *  re-resolution that loses per-model routing (the 4/4-agents-404 incident: session model id
      *  re-resolved against the base gateway). Mirrors the subagent lane's `ctx.model` semantics. */
     defaultModel?: () => import("../internal/llm.js").Model | undefined;
+    /** Call-time getter for the thinking level a spawned agent runs at when neither the script, the
+     *  agentType definition nor the governance baseline set `thinking` — the child thinking seat's lower rungs
+     *  (the deployment's STATED `roles.subagent.thinking`, else the host's current level), as the run-workflow
+     *  mount folds them. Snapshotted ONCE at call entry and folded into the call identity like `defaultModel`;
+     *  applied at the launch site AFTER the agentType fold ({@link withWorkflowChildSeats}). */
+    defaultThinking?: () => ThinkingLevel | undefined;
     /** The HOST's per-model auth hook, inherited into every spawned agent's spec (the
      *  credential half of model inheritance; scripts can never set it — governance strips it — so
      *  this is always the host's). NOT call identity (auth, not behavior; a function, not data). */

package/dist/orchestration/workflow.js

@@ -7,6 +7,7 @@ import { TERMINAL_CAUSE_IS_REPLAYABLE, isTerminalCauseKind } from "../core/termi
 import { terminalProjection } from "../core/runner/terminal-projection.js";
 import { builtinAgentDefinitions } from "../agents/builtin-agents.js";
 import { GENERAL_PURPOSE_SUBAGENT_TYPE, markerFragment } from "../agents/subagent.js";
+import { deploymentSubagentSystemPrompt, runnerRoleMap } from "../agents/child-model-seat.js";
 import { combinePolicies, createAllowDenyPolicy } from "../core/tool-policy.js";
 import { createSafeNotifier } from "../core/safe-notify.js";
 import { callKeyOrdinal, oversizeJournalResult, journalOversizeTombstone, JOURNAL_OVERSIZE_ERROR_CODE, MAX_JOURNAL_RESULT_BYTES } from "../core/workflow-journal-store.js";
@@ -132,6 +133,16 @@ function withWorkflowChildPersona(spec, schema) {
     const note = schema ? WORKFLOW_SUBAGENT_APPEND_SCHEMA : WORKFLOW_SUBAGENT_APPEND;
     return { ...spec, appendSystemPrompt: spec.appendSystemPrompt ? `${spec.appendSystemPrompt}\n\n${note}` : note };
 }
+function withWorkflowChildSeats(typed, inheritedModelSnap, inheritedThinkingSnap, roles) {
+    const statedPersona = deploymentSubagentSystemPrompt(roles);
+    return {
+        ...typed,
+        modelRole: typed.modelRole ?? "subagent",
+        ...(typed.model === undefined && inheritedModelSnap !== undefined ? { model: inheritedModelSnap } : {}),
+        ...(typed.thinking === undefined && inheritedThinkingSnap !== undefined ? { thinking: inheritedThinkingSnap } : {}),
+        ...(typed.systemPrompt === undefined && statedPersona !== undefined ? { systemPrompt: statedPersona } : {}),
+    };
+}
 export function workflowAgentCallKey(ordinal, spec, opts) {
     const identity = {
         ...spec,
@@ -1139,7 +1150,8 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
         const phase = agentOpts.phase ?? currentPhase?.title;
         const phaseInstance = resolveAgentPhase(agentOpts.phase);
         const groupId = currentGroup;
-        const typeDefModel = agentOpts.agentType !== undefined ? agentRegistry.find((d) => d.name === agentOpts.agentType)?.model : undefined;
+        const typeDef = agentOpts.agentType !== undefined ? agentRegistry.find((d) => d.name === agentOpts.agentType) : undefined;
+        const typeDefModel = typeDef?.model;
         let inheritedModelSnap;
         let inheritedModelError;
         if (spec.model === undefined && typeDefModel === undefined) {
@@ -1150,12 +1162,17 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                 inheritedModelError = err instanceof Error ? err : new Error(String(err));
             }
         }
-        const specForIdentity = inheritedModelSnap !== undefined ? { ...spec, model: inheritedModelSnap } : spec;
+        const inheritedThinkingSnap = spec.thinking === undefined ? opts.defaultThinking?.() : undefined;
+        const specForIdentity = {
+            ...spec,
+            ...(inheritedModelSnap !== undefined ? { model: inheritedModelSnap } : {}),
+            ...(inheritedThinkingSnap !== undefined ? { thinking: inheritedThinkingSnap } : {}),
+        };
         const callKey = workflowAgentCallKey(run.agents.length, specForIdentity, agentOpts);
         const prompt = boundedRedactedSummary(spec.systemPrompt ? `${spec.systemPrompt}\n\n${spec.objective}` : spec.objective, MAX_TRANSCRIPT_CHARS);
         const specForLabel = spec.model === undefined && typeDefModel !== undefined ? { ...spec, model: typeDefModel } : specForIdentity;
         const model = workflowModelLabel(specForLabel, modelCatalog);
-        return { label, phase, phaseInstance, groupId, inheritedModelSnap, inheritedModelError, callKey, prompt, model };
+        return { label, phase, phaseInstance, groupId, inheritedModelSnap, inheritedModelError, inheritedThinkingSnap, callKey, prompt, model };
     };
     const reviewSpawnBeforeLaunch = async (lane, label, callKey, runSpec, effectiveSignal) => {
         const review = opts.autoModeReview;
@@ -1302,7 +1319,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
         },
         async agent(spec, agentOpts = {}) {
             const effectiveSignal = assertAgentSpawnAllowed("ctx.agent", spec, agentOpts);
-            const { label, phase, phaseInstance, groupId, inheritedModelSnap, inheritedModelError, callKey, prompt, model } = prepareAgentCall(spec, agentOpts);
+            const { label, phase, phaseInstance, groupId, inheritedModelSnap, inheritedModelError, inheritedThinkingSnap, callKey, prompt, model } = prepareAgentCall(spec, agentOpts);
             let drive;
             const cached = opts.resumeFromRunId !== undefined ? replayByOrdinal[run.agents.length] : undefined;
             if (cached?.parked !== undefined) {
@@ -1419,7 +1436,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                 if (inheritedModelError !== undefined)
                     throw inheritedModelError;
                 const typedSpec0 = applyWorkflowAgentType(spec, agentOpts.agentType, agentRegistry);
-                const typedSpec = typedSpec0.model === undefined && inheritedModelSnap !== undefined ? { ...typedSpec0, model: inheritedModelSnap } : typedSpec0;
+                const typedSpec = withWorkflowChildSeats(typedSpec0, inheritedModelSnap, inheritedThinkingSnap, runnerRoleMap(runner));
                 const framedSpec = withWorkflowChildPersona(typedSpec, agentOpts.schema ?? typedSpec.outputSchema);
                 const authInherit = framedSpec.getApiKeyAndHeaders === undefined && opts.defaultGetApiKeyAndHeaders !== undefined ? { getApiKeyAndHeaders: opts.defaultGetApiKeyAndHeaders } : {};
                 const parkInherit = durableApprovalInherit(framedSpec);
@@ -1699,7 +1716,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
             if (budgetTotal !== null && spent() >= budgetTotal) {
                 throw new WorkflowBudgetExceededError(spent(), budgetTotal);
             }
-            const { label, phase, phaseInstance, groupId, inheritedModelSnap, inheritedModelError, callKey, prompt, model } = prepareAgentCall(spec, agentOpts);
+            const { label, phase, phaseInstance, groupId, inheritedModelSnap, inheritedModelError, inheritedThinkingSnap, callKey, prompt, model } = prepareAgentCall(spec, agentOpts);
             let drive;
             const parkedHere = opts.resumeFromRunId !== undefined ? replayByOrdinal[run.agents.length] : undefined;
             if (parkedHere?.parked !== undefined) {
@@ -1794,7 +1811,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                 if (inheritedModelError !== undefined)
                     throw inheritedModelError;
                 const typedSpec0 = applyWorkflowAgentType(spec, agentOpts.agentType, agentRegistry);
-                const typedSpec = typedSpec0.model === undefined && inheritedModelSnap !== undefined ? { ...typedSpec0, model: inheritedModelSnap } : typedSpec0;
+                const typedSpec = withWorkflowChildSeats(typedSpec0, inheritedModelSnap, inheritedThinkingSnap, runnerRoleMap(runner));
                 const framedSpec = withWorkflowChildPersona(typedSpec, agentOpts.schema ?? typedSpec.outputSchema);
                 const authInherit = framedSpec.getApiKeyAndHeaders === undefined && opts.defaultGetApiKeyAndHeaders !== undefined ? { getApiKeyAndHeaders: opts.defaultGetApiKeyAndHeaders } : {};
                 const parkInherit = durableApprovalInherit(framedSpec);

package/dist/prompt-assembly/turn-snapshot.d.ts

@@ -25,8 +25,10 @@ export interface RawPrefixInputs {
     stableSystemText: string;
     /** Wire-face tool projections (name/description/schema — the mounted set, post-defer). */
     toolWire: ReadonlyArray<ToolFingerprintInput>;
-    /** Request-shaping controls that alter the wire body. */
-    thinkingLevel: string;
+    /** Request-shaping controls that alter the wire body. `thinkingLevel: null` = no level declared (the
+     *  request carries no thinking key — provider default), which is NOT the same request as an explicit
+     *  `"off"` (the disable key) and so must not share its identity. */
+    thinkingLevel: string | null;
     maxTokens: number | undefined;
     hasOutputSchema: boolean;
     /** Routing/audit fields — provably NOT part of the cacheable prefix. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.10.0",
+  "version": "7.11.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2257,
+  "count": 2274,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -395,6 +395,10 @@
     "F012_CHECKPOINT_VERSION": "variable",
     "FABLE_5_COMPAT": "variable",
     "FILE_HISTORY_DIFF_LINE_BUDGET": "variable",
+    "FIND_ACTION_PRIMARIES": "variable",
+    "FIND_NEWER_PRIMARY": "variable",
+    "FIND_VALUE_PRIMARIES": "variable",
+    "FLAG_VALUE_ACCEPTS": "variable",
     "FORK_DIRECTIVE_FRAME": "variable",
     "FORK_SUBAGENT_TYPE": "variable",
     "FROZEN_DENYLIST_FLOOR": "variable",
@@ -969,6 +973,13 @@
     "READ_DENY_DEFAULT_TIERS": "variable",
     "READ_FACE_BUILTIN_DENY_TABLE": "variable",
     "READ_FACE_DEFAULT_DENY_ENTRIES": "variable",
+    "READ_ONLY_BARE_ONLY": "variable",
+    "READ_ONLY_BARE_PROGRAMS": "variable",
+    "READ_ONLY_COMMAND_TABLE": "variable",
+    "READ_ONLY_ENV_NAMES": "variable",
+    "READ_ONLY_EXACT_FORMS": "variable",
+    "READ_ONLY_FLAG_ARITIES": "variable",
+    "READ_ONLY_GLOB_PROGRAMS": "variable",
     "READ_RULE_TOOL": "variable",
     "REAL_APPROVAL_CHECKPOINT_VERSION": "variable",
     "REASONING_BUDGET_SHARE": "variable",
@@ -1002,6 +1013,9 @@
     "ReadDenyMatcher": "interface",
     "ReadFace": "type",
     "ReadFaceInputs": "interface",
+    "ReadOnlyCommandRow": "interface",
+    "ReadOnlyFlagArity": "type",
+    "ReadOnlyShellVerdict": "type",
     "RealApprovalGateBit": "interface",
     "ReasoningFormat": "type",
     "ReasoningIntensity": "type",
@@ -1234,6 +1248,7 @@
     "SharedMemoryStoreProvider": "interface",
     "SharedMemoryStoreReader": "interface",
     "ShellCommandShape": "interface",
+    "ShellRedirection": "interface",
     "ShellSegment": "interface",
     "ShellWord": "interface",
     "ShellWrapperName": "type",
@@ -1508,6 +1523,7 @@
     "WriteProtectedRow": "interface",
     "WriteProtectionMatcher": "interface",
     "WriteReceipt": "interface",
+    "XARGS_READ_ONLY_TARGETS": "variable",
     "ackAdoptionConfig": "function",
     "acquireCcLock": "function",
     "addDotsOf": "function",
@@ -2038,6 +2054,7 @@
     "readIntentCredentials": "function",
     "readJsonlRecords": "function",
     "readMailboxPeerMeta": "function",
+    "readOnlyShellVerdict": "function",
     "readPeerSessionRecord": "function",
     "readPendingSteerQueue": "function",
     "readRootAdoptionFile": "function",
@@ -2654,6 +2671,10 @@
     "F012_CHECKPOINT_VERSION": "advanced",
     "FABLE_5_COMPAT": "advanced",
     "FILE_HISTORY_DIFF_LINE_BUDGET": "advanced",
+    "FIND_ACTION_PRIMARIES": "advanced",
+    "FIND_NEWER_PRIMARY": "advanced",
+    "FIND_VALUE_PRIMARIES": "advanced",
+    "FLAG_VALUE_ACCEPTS": "advanced",
     "FORK_DIRECTIVE_FRAME": "advanced",
     "FORK_SUBAGENT_TYPE": "advanced",
     "FROZEN_DENYLIST_FLOOR": "advanced",
@@ -3228,6 +3249,13 @@
     "READ_DENY_DEFAULT_TIERS": "advanced",
     "READ_FACE_BUILTIN_DENY_TABLE": "advanced",
     "READ_FACE_DEFAULT_DENY_ENTRIES": "advanced",
+    "READ_ONLY_BARE_ONLY": "advanced",
+    "READ_ONLY_BARE_PROGRAMS": "advanced",
+    "READ_ONLY_COMMAND_TABLE": "advanced",
+    "READ_ONLY_ENV_NAMES": "advanced",
+    "READ_ONLY_EXACT_FORMS": "advanced",
+    "READ_ONLY_FLAG_ARITIES": "advanced",
+    "READ_ONLY_GLOB_PROGRAMS": "advanced",
     "READ_RULE_TOOL": "advanced",
     "REAL_APPROVAL_CHECKPOINT_VERSION": "advanced",
     "REASONING_BUDGET_SHARE": "advanced",
@@ -3261,6 +3289,9 @@
     "ReadDenyMatcher": "advanced",
     "ReadFace": "stable",
     "ReadFaceInputs": "advanced",
+    "ReadOnlyCommandRow": "advanced",
+    "ReadOnlyFlagArity": "advanced",
+    "ReadOnlyShellVerdict": "advanced",
     "RealApprovalGateBit": "advanced",
     "ReasoningFormat": "advanced",
     "ReasoningIntensity": "advanced",
@@ -3493,6 +3524,7 @@
     "SharedMemoryStoreProvider": "advanced",
     "SharedMemoryStoreReader": "advanced",
     "ShellCommandShape": "advanced",
+    "ShellRedirection": "advanced",
     "ShellSegment": "advanced",
     "ShellWord": "advanced",
     "ShellWrapperName": "advanced",
@@ -3767,6 +3799,7 @@
     "WriteProtectedRow": "advanced",
     "WriteProtectionMatcher": "advanced",
     "WriteReceipt": "internal",
+    "XARGS_READ_ONLY_TARGETS": "advanced",
     "ackAdoptionConfig": "advanced",
     "acquireCcLock": "advanced",
     "addDotsOf": "advanced",
@@ -4297,6 +4330,7 @@
     "readIntentCredentials": "advanced",
     "readJsonlRecords": "advanced",
     "readMailboxPeerMeta": "advanced",
+    "readOnlyShellVerdict": "advanced",
     "readPeerSessionRecord": "advanced",
     "readPendingSteerQueue": "advanced",
     "readRootAdoptionFile": "advanced",