@sema-agent/core 7.10.0 → 7.11.1

package/dist/orchestration/workflow-governance.d.ts

@@ -8,8 +8,9 @@
  * (toolPolicy / onAsk / hooks / principal / tools / mcp / skills / lspManager / checkpointStore /
  * getApiKeyAndHeaders / promptProvider / sessionId / signal / …) is structurally never copied. "Never
  * copied" is a statement about the SCRIPT's spec — the child's control plane still arrives from the
- * TRUSTED side, and some of it inherits from the HOST run on trusted lanes of its own: `principal` /
- * `thinking` / the durable off-switch via `buildWorkflowPrimitives`' engine injections, and the host's
+ * TRUSTED side, and some of it inherits from the HOST run on trusted lanes of its own: `principal` / the
+ * durable off-switch via `buildWorkflowPrimitives`' engine injections, `model` / `thinking` / the stated
+ * subagent persona via the launch site's child seats (`withWorkflowChildSeats`), and the host's
  * effective approver via the run-workflow mount's base-slot fold (`RunWorkflowToolDeps.parentOnAsk` →
  * `baseline.base.onAsk`, backlog #342 — filled only when the deployment did not pin the seat). Those are
  * host-ctx bindings the engine writes onto the baseline/child, never a read of anything the script wrote:

package/dist/orchestration/workflow-primitives.d.ts

@@ -31,8 +31,11 @@ export interface WorkflowGovernance {
 /**
  * Build the flat {@link WorkflowPrimitives} a {@link WorkflowScriptRunner} runs the script against. The
  * `agent` primitive is GOVERNED when `governance` is set (LLM-authored), else a trusted pass-through.
+ * The host's model and thinking are NOT injected here: both are seats the launch site (`workflow.ts`,
+ * `withWorkflowChildSeats`) fills AFTER the agentType fold, so a definition's own value is the explicit rung
+ * — filling them here ran ahead of the fold and made the fold's "when unset" guard permanently false.
  */
-export declare function buildWorkflowPrimitives(ctx: WorkflowRunContext, governance?: WorkflowGovernance, onAgentSpawn?: (handle: WorkflowAgentHandle) => void, parentThinking?: () => TaskSpec["thinking"], parentPrincipal?: string, 
+export declare function buildWorkflowPrimitives(ctx: WorkflowRunContext, governance?: WorkflowGovernance, onAgentSpawn?: (handle: WorkflowAgentHandle) => void, parentPrincipal?: string, 
 /** ruled 2026-08-04 — the host run set `TaskSpec.checkpointStore: "disabled"` (the per-run durable off
  *  switch). Every agent this workflow spawns inherits it; see the injection below. */
 parentCheckpointStoreDisabled?: boolean, 

package/dist/orchestration/workflow-primitives.js

@@ -65,7 +65,7 @@ function formatResourceClampNote(notes) {
     const parts = notes.map((n) => `${n.field}: requested ${n.requested === undefined ? "unset" : n.requested} → applied ${n.applied}`);
     return `workflow governance tightened this agent's resource limits (${parts.join("; ")})`;
 }
-export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentThinking, parentPrincipal, parentCheckpointStoreDisabled, parentReadFace, parentReadDenyPatterns, parentHandsReadOnly, parentInteractiveToolsOff) {
+export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentPrincipal, parentCheckpointStoreDisabled, parentReadFace, parentReadDenyPatterns, parentHandsReadOnly, parentInteractiveToolsOff) {
     const agent = (spec, opts) => {
         if (typeof spec === "string")
             spec = { objective: spec };
@@ -74,11 +74,6 @@ export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentThi
         const childSpec = governance
             ? buildGovernedChildSpec(spec, effectiveBaseline(governance.baseline), governance.models, governance.caps, (notes) => ctx.log(formatResourceClampNote(notes)), governance.onNotice)
             : { ...spec };
-        if (childSpec.thinking === undefined && parentThinking) {
-            const inherited = parentThinking();
-            if (inherited !== undefined)
-                childSpec.thinking = inherited;
-        }
         if (childSpec.principal === undefined && parentPrincipal !== undefined) {
             childSpec.principal = parentPrincipal;
         }

package/dist/orchestration/workflow.d.ts

@@ -1,7 +1,7 @@
 import type { TSchema } from "typebox";
 import type { InheritedGate, RunnerSelfSeat } from "../core/runner/contracts.js";
 import type { CheckpointToken, ResumeOutcome } from "../core/checkpoint-store.js";
-import type { AgentDefinition, TaskEvent, TaskResult, TaskSpec } from "../core/types.js";
+import type { AgentDefinition, TaskEvent, TaskResult, TaskSpec, ThinkingLevel } from "../core/types.js";
 import type { WorkflowRunStore } from "../core/workflow-run-store.js";
 import type { WorkflowJournalStore, ResumeClaimArgs } from "../core/workflow-journal-store.js";
 import type { WorkflowRun, WorkflowEvent } from "./workflow-types.js";
@@ -22,9 +22,11 @@ export declare const WORKFLOW_SUBAGENT_APPEND_SCHEMA = "---\n\nNOTE: You are run
  * Apply the G5 default persona to a `ctx.agent`/`ctx.agentStream` child spec. Two-state on the EFFECTIVE
  * schema (`agentOpts.schema` wins over a spec-carried `outputSchema`, same as the runSpec injection):
  *   • no `spec.systemPrompt` → the dedicated workflow-subagent persona REPLACES the role base (198
- *     default `workflow-subagent` agent-type semantics);
- *   • a script-supplied `spec.systemPrompt` (custom persona) → the matching NOTE is APPENDED via
- *     `appendSystemPrompt` (198 composite semantics — append, never replace), after any existing append.
+ *     default `workflow-subagent` agent-type semantics) — reached only when neither the script, the
+ *     agentType definition nor the deployment's stated subagent preset supplied one ({@link withWorkflowChildSeats}
+ *     writes the preset first);
+ *   • a `spec.systemPrompt` (custom persona: script, definition or stated preset) → the matching NOTE is
+ *     APPENDED via `appendSystemPrompt` (198 composite semantics — append, never replace), after any existing append.
  * Called AFTER the call-key is computed (the journal identity keys the AUTHORED spec, so a resume across
  * core versions replays cleanly; the persona is an execution detail, not call identity).
  */
@@ -446,6 +448,12 @@ export interface RunWorkflowOptions {
      *  re-resolution that loses per-model routing (the 4/4-agents-404 incident: session model id
      *  re-resolved against the base gateway). Mirrors the subagent lane's `ctx.model` semantics. */
     defaultModel?: () => import("../internal/llm.js").Model | undefined;
+    /** Call-time getter for the thinking level a spawned agent runs at when neither the script, the
+     *  agentType definition nor the governance baseline set `thinking` — the child thinking seat's lower rungs
+     *  (the deployment's STATED `roles.subagent.thinking`, else the host's current level), as the run-workflow
+     *  mount folds them. Snapshotted ONCE at call entry and folded into the call identity like `defaultModel`;
+     *  applied at the launch site AFTER the agentType fold ({@link withWorkflowChildSeats}). */
+    defaultThinking?: () => ThinkingLevel | undefined;
     /** The HOST's per-model auth hook, inherited into every spawned agent's spec (the
      *  credential half of model inheritance; scripts can never set it — governance strips it — so
      *  this is always the host's). NOT call identity (auth, not behavior; a function, not data). */

package/dist/orchestration/workflow.js

@@ -7,6 +7,7 @@ import { TERMINAL_CAUSE_IS_REPLAYABLE, isTerminalCauseKind } from "../core/termi
 import { terminalProjection } from "../core/runner/terminal-projection.js";
 import { builtinAgentDefinitions } from "../agents/builtin-agents.js";
 import { GENERAL_PURPOSE_SUBAGENT_TYPE, markerFragment } from "../agents/subagent.js";
+import { deploymentSubagentSystemPrompt, runnerRoleMap } from "../agents/child-model-seat.js";
 import { combinePolicies, createAllowDenyPolicy } from "../core/tool-policy.js";
 import { createSafeNotifier } from "../core/safe-notify.js";
 import { callKeyOrdinal, oversizeJournalResult, journalOversizeTombstone, JOURNAL_OVERSIZE_ERROR_CODE, MAX_JOURNAL_RESULT_BYTES } from "../core/workflow-journal-store.js";
@@ -132,6 +133,16 @@ function withWorkflowChildPersona(spec, schema) {
     const note = schema ? WORKFLOW_SUBAGENT_APPEND_SCHEMA : WORKFLOW_SUBAGENT_APPEND;
     return { ...spec, appendSystemPrompt: spec.appendSystemPrompt ? `${spec.appendSystemPrompt}\n\n${note}` : note };
 }
+function withWorkflowChildSeats(typed, inheritedModelSnap, inheritedThinkingSnap, roles) {
+    const statedPersona = deploymentSubagentSystemPrompt(roles);
+    return {
+        ...typed,
+        modelRole: typed.modelRole ?? "subagent",
+        ...(typed.model === undefined && inheritedModelSnap !== undefined ? { model: inheritedModelSnap } : {}),
+        ...(typed.thinking === undefined && inheritedThinkingSnap !== undefined ? { thinking: inheritedThinkingSnap } : {}),
+        ...(typed.systemPrompt === undefined && statedPersona !== undefined ? { systemPrompt: statedPersona } : {}),
+    };
+}
 export function workflowAgentCallKey(ordinal, spec, opts) {
     const identity = {
         ...spec,
@@ -1139,7 +1150,8 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
         const phase = agentOpts.phase ?? currentPhase?.title;
         const phaseInstance = resolveAgentPhase(agentOpts.phase);
         const groupId = currentGroup;
-        const typeDefModel = agentOpts.agentType !== undefined ? agentRegistry.find((d) => d.name === agentOpts.agentType)?.model : undefined;
+        const typeDef = agentOpts.agentType !== undefined ? agentRegistry.find((d) => d.name === agentOpts.agentType) : undefined;
+        const typeDefModel = typeDef?.model;
         let inheritedModelSnap;
         let inheritedModelError;
         if (spec.model === undefined && typeDefModel === undefined) {
@@ -1150,12 +1162,17 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                 inheritedModelError = err instanceof Error ? err : new Error(String(err));
             }
         }
-        const specForIdentity = inheritedModelSnap !== undefined ? { ...spec, model: inheritedModelSnap } : spec;
+        const inheritedThinkingSnap = spec.thinking === undefined ? opts.defaultThinking?.() : undefined;
+        const specForIdentity = {
+            ...spec,
+            ...(inheritedModelSnap !== undefined ? { model: inheritedModelSnap } : {}),
+            ...(inheritedThinkingSnap !== undefined ? { thinking: inheritedThinkingSnap } : {}),
+        };
         const callKey = workflowAgentCallKey(run.agents.length, specForIdentity, agentOpts);
         const prompt = boundedRedactedSummary(spec.systemPrompt ? `${spec.systemPrompt}\n\n${spec.objective}` : spec.objective, MAX_TRANSCRIPT_CHARS);
         const specForLabel = spec.model === undefined && typeDefModel !== undefined ? { ...spec, model: typeDefModel } : specForIdentity;
         const model = workflowModelLabel(specForLabel, modelCatalog);
-        return { label, phase, phaseInstance, groupId, inheritedModelSnap, inheritedModelError, callKey, prompt, model };
+        return { label, phase, phaseInstance, groupId, inheritedModelSnap, inheritedModelError, inheritedThinkingSnap, callKey, prompt, model };
     };
     const reviewSpawnBeforeLaunch = async (lane, label, callKey, runSpec, effectiveSignal) => {
         const review = opts.autoModeReview;
@@ -1302,7 +1319,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
         },
         async agent(spec, agentOpts = {}) {
             const effectiveSignal = assertAgentSpawnAllowed("ctx.agent", spec, agentOpts);
-            const { label, phase, phaseInstance, groupId, inheritedModelSnap, inheritedModelError, callKey, prompt, model } = prepareAgentCall(spec, agentOpts);
+            const { label, phase, phaseInstance, groupId, inheritedModelSnap, inheritedModelError, inheritedThinkingSnap, callKey, prompt, model } = prepareAgentCall(spec, agentOpts);
             let drive;
             const cached = opts.resumeFromRunId !== undefined ? replayByOrdinal[run.agents.length] : undefined;
             if (cached?.parked !== undefined) {
@@ -1419,7 +1436,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                 if (inheritedModelError !== undefined)
                     throw inheritedModelError;
                 const typedSpec0 = applyWorkflowAgentType(spec, agentOpts.agentType, agentRegistry);
-                const typedSpec = typedSpec0.model === undefined && inheritedModelSnap !== undefined ? { ...typedSpec0, model: inheritedModelSnap } : typedSpec0;
+                const typedSpec = withWorkflowChildSeats(typedSpec0, inheritedModelSnap, inheritedThinkingSnap, runnerRoleMap(runner));
                 const framedSpec = withWorkflowChildPersona(typedSpec, agentOpts.schema ?? typedSpec.outputSchema);
                 const authInherit = framedSpec.getApiKeyAndHeaders === undefined && opts.defaultGetApiKeyAndHeaders !== undefined ? { getApiKeyAndHeaders: opts.defaultGetApiKeyAndHeaders } : {};
                 const parkInherit = durableApprovalInherit(framedSpec);
@@ -1699,7 +1716,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
             if (budgetTotal !== null && spent() >= budgetTotal) {
                 throw new WorkflowBudgetExceededError(spent(), budgetTotal);
             }
-            const { label, phase, phaseInstance, groupId, inheritedModelSnap, inheritedModelError, callKey, prompt, model } = prepareAgentCall(spec, agentOpts);
+            const { label, phase, phaseInstance, groupId, inheritedModelSnap, inheritedModelError, inheritedThinkingSnap, callKey, prompt, model } = prepareAgentCall(spec, agentOpts);
             let drive;
             const parkedHere = opts.resumeFromRunId !== undefined ? replayByOrdinal[run.agents.length] : undefined;
             if (parkedHere?.parked !== undefined) {
@@ -1794,7 +1811,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                 if (inheritedModelError !== undefined)
                     throw inheritedModelError;
                 const typedSpec0 = applyWorkflowAgentType(spec, agentOpts.agentType, agentRegistry);
-                const typedSpec = typedSpec0.model === undefined && inheritedModelSnap !== undefined ? { ...typedSpec0, model: inheritedModelSnap } : typedSpec0;
+                const typedSpec = withWorkflowChildSeats(typedSpec0, inheritedModelSnap, inheritedThinkingSnap, runnerRoleMap(runner));
                 const framedSpec = withWorkflowChildPersona(typedSpec, agentOpts.schema ?? typedSpec.outputSchema);
                 const authInherit = framedSpec.getApiKeyAndHeaders === undefined && opts.defaultGetApiKeyAndHeaders !== undefined ? { getApiKeyAndHeaders: opts.defaultGetApiKeyAndHeaders } : {};
                 const parkInherit = durableApprovalInherit(framedSpec);

package/dist/prompt-assembly/turn-snapshot.d.ts

@@ -25,8 +25,10 @@ export interface RawPrefixInputs {
     stableSystemText: string;
     /** Wire-face tool projections (name/description/schema — the mounted set, post-defer). */
     toolWire: ReadonlyArray<ToolFingerprintInput>;
-    /** Request-shaping controls that alter the wire body. */
-    thinkingLevel: string;
+    /** Request-shaping controls that alter the wire body. `thinkingLevel: null` = no level declared (the
+     *  request carries no thinking key — provider default), which is NOT the same request as an explicit
+     *  `"off"` (the disable key) and so must not share its identity. */
+    thinkingLevel: string | null;
     maxTokens: number | undefined;
     hasOutputSchema: boolean;
     /** Routing/audit fields — provably NOT part of the cacheable prefix. */

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -256,6 +256,11 @@ export interface CompoundReadonlyVerdict {
     outOfRootRead?: true;
     /** The resolved out-of-root paths, de-duplicated, in first-seen order. Present iff `outOfRootRead`. */
     outOfRootPaths?: readonly string[];
+    /** B-057 — an operand matched the deployment's read deny judge (`BashReadonlyRootBoundary.denyMatch`):
+     *  the demotion was raised by a DECLARED read boundary, not by the classifier's own caution. The probe
+     *  reads it to mint `mandated` — a stored allow rule or the read-only shell arm may retire a classify-
+     *  tier question, never one the read face itself asked. Structural sibling of `outOfRootRead`. */
+    readDenied?: true;
     /**
      * RB-451 — the paths this scan resolved INSIDE the roots (de-duplicated, first-seen order), i.e. the
      * candidates a caller holding a filesystem should re-check with symlinks resolved. Absent when there

package/dist/tools/fs/bash-readonly-classifier.js

@@ -867,6 +867,7 @@ function evaluateReadBoundary(foldedSegments, boundary) {
             if (denied != null) {
                 return {
                     reason: `a command operand resolves to "${finding.path}", which matches the sensitive-path read deny list (pattern "${denied}") ${NOT_AUTO_ALLOWED}`,
+                    readDenied: true,
                 };
             }
             if (finding.kind === "inside") {

package/dist/tools/fs/fs-bash.js

@@ -31,6 +31,7 @@ export function bashReversibilityProbe(allow, boundary) {
             return { reversible: false };
         const resolved = typeof boundary === "function" ? boundary() : boundary;
         const outOfRootGate = () => resolved !== undefined && classifyOutOfRootReadGate(command, allowSet, resolved).gated ? { mandated: true } : {};
+        const boundaryGate = (verdict) => verdict.readDenied === true || (verdict.recursiveReadPaths !== undefined && verdict.recursiveReadPaths.length > 0) ? { mandated: true } : outOfRootGate();
         if (a?.run_in_background === true)
             return { reversible: false, ...outOfRootGate() };
         const detailed = classifyCompoundReadonlyDetailed(command, allowSet, resolved);
@@ -42,7 +43,7 @@ export function bashReversibilityProbe(allow, boundary) {
                     const others = detailed.undecidedPaths.filter((p) => !recursiveSet.has(p));
                     return {
                         reversible: false,
-                        ...outOfRootGate(),
+                        ...boundaryGate(detailed),
                         cause: {
                             code: RECURSIVE_READ_CAUSE_CODE,
                             roots: operandFamily(recursive),
@@ -56,7 +57,7 @@ export function bashReversibilityProbe(allow, boundary) {
         }
         return classifyBoundedReadonlyPollLoop(command, allowSet, resolved) === undefined
             ? { reversible: true }
-            : { reversible: false, ...outOfRootGate() };
+            : { reversible: false, ...boundaryGate(detailed) };
     };
 }
 export { FULL_SHELL_CONTRACT_ID } from "../../core/tool-catalog-entries.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.10.0",
+  "version": "7.11.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2257,
+  "count": 2274,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -395,6 +395,10 @@
     "F012_CHECKPOINT_VERSION": "variable",
     "FABLE_5_COMPAT": "variable",
     "FILE_HISTORY_DIFF_LINE_BUDGET": "variable",
+    "FIND_ACTION_PRIMARIES": "variable",
+    "FIND_NEWER_PRIMARY": "variable",
+    "FIND_VALUE_PRIMARIES": "variable",
+    "FLAG_VALUE_ACCEPTS": "variable",
     "FORK_DIRECTIVE_FRAME": "variable",
     "FORK_SUBAGENT_TYPE": "variable",
     "FROZEN_DENYLIST_FLOOR": "variable",
@@ -969,6 +973,13 @@
     "READ_DENY_DEFAULT_TIERS": "variable",
     "READ_FACE_BUILTIN_DENY_TABLE": "variable",
     "READ_FACE_DEFAULT_DENY_ENTRIES": "variable",
+    "READ_ONLY_BARE_ONLY": "variable",
+    "READ_ONLY_BARE_PROGRAMS": "variable",
+    "READ_ONLY_COMMAND_TABLE": "variable",
+    "READ_ONLY_ENV_NAMES": "variable",
+    "READ_ONLY_EXACT_FORMS": "variable",
+    "READ_ONLY_FLAG_ARITIES": "variable",
+    "READ_ONLY_GLOB_PROGRAMS": "variable",
     "READ_RULE_TOOL": "variable",
     "REAL_APPROVAL_CHECKPOINT_VERSION": "variable",
     "REASONING_BUDGET_SHARE": "variable",
@@ -1002,6 +1013,9 @@
     "ReadDenyMatcher": "interface",
     "ReadFace": "type",
     "ReadFaceInputs": "interface",
+    "ReadOnlyCommandRow": "interface",
+    "ReadOnlyFlagArity": "type",
+    "ReadOnlyShellVerdict": "type",
     "RealApprovalGateBit": "interface",
     "ReasoningFormat": "type",
     "ReasoningIntensity": "type",
@@ -1234,6 +1248,7 @@
     "SharedMemoryStoreProvider": "interface",
     "SharedMemoryStoreReader": "interface",
     "ShellCommandShape": "interface",
+    "ShellRedirection": "interface",
     "ShellSegment": "interface",
     "ShellWord": "interface",
     "ShellWrapperName": "type",
@@ -1508,6 +1523,7 @@
     "WriteProtectedRow": "interface",
     "WriteProtectionMatcher": "interface",
     "WriteReceipt": "interface",
+    "XARGS_READ_ONLY_TARGETS": "variable",
     "ackAdoptionConfig": "function",
     "acquireCcLock": "function",
     "addDotsOf": "function",
@@ -2038,6 +2054,7 @@
     "readIntentCredentials": "function",
     "readJsonlRecords": "function",
     "readMailboxPeerMeta": "function",
+    "readOnlyShellVerdict": "function",
     "readPeerSessionRecord": "function",
     "readPendingSteerQueue": "function",
     "readRootAdoptionFile": "function",
@@ -2654,6 +2671,10 @@
     "F012_CHECKPOINT_VERSION": "advanced",
     "FABLE_5_COMPAT": "advanced",
     "FILE_HISTORY_DIFF_LINE_BUDGET": "advanced",
+    "FIND_ACTION_PRIMARIES": "advanced",
+    "FIND_NEWER_PRIMARY": "advanced",
+    "FIND_VALUE_PRIMARIES": "advanced",
+    "FLAG_VALUE_ACCEPTS": "advanced",
     "FORK_DIRECTIVE_FRAME": "advanced",
     "FORK_SUBAGENT_TYPE": "advanced",
     "FROZEN_DENYLIST_FLOOR": "advanced",
@@ -3228,6 +3249,13 @@
     "READ_DENY_DEFAULT_TIERS": "advanced",
     "READ_FACE_BUILTIN_DENY_TABLE": "advanced",
     "READ_FACE_DEFAULT_DENY_ENTRIES": "advanced",
+    "READ_ONLY_BARE_ONLY": "advanced",
+    "READ_ONLY_BARE_PROGRAMS": "advanced",
+    "READ_ONLY_COMMAND_TABLE": "advanced",
+    "READ_ONLY_ENV_NAMES": "advanced",
+    "READ_ONLY_EXACT_FORMS": "advanced",
+    "READ_ONLY_FLAG_ARITIES": "advanced",
+    "READ_ONLY_GLOB_PROGRAMS": "advanced",
     "READ_RULE_TOOL": "advanced",
     "REAL_APPROVAL_CHECKPOINT_VERSION": "advanced",
     "REASONING_BUDGET_SHARE": "advanced",
@@ -3261,6 +3289,9 @@
     "ReadDenyMatcher": "advanced",
     "ReadFace": "stable",
     "ReadFaceInputs": "advanced",
+    "ReadOnlyCommandRow": "advanced",
+    "ReadOnlyFlagArity": "advanced",
+    "ReadOnlyShellVerdict": "advanced",
     "RealApprovalGateBit": "advanced",
     "ReasoningFormat": "advanced",
     "ReasoningIntensity": "advanced",
@@ -3493,6 +3524,7 @@
     "SharedMemoryStoreProvider": "advanced",
     "SharedMemoryStoreReader": "advanced",
     "ShellCommandShape": "advanced",
+    "ShellRedirection": "advanced",
     "ShellSegment": "advanced",
     "ShellWord": "advanced",
     "ShellWrapperName": "advanced",
@@ -3767,6 +3799,7 @@
     "WriteProtectedRow": "advanced",
     "WriteProtectionMatcher": "advanced",
     "WriteReceipt": "internal",
+    "XARGS_READ_ONLY_TARGETS": "advanced",
     "ackAdoptionConfig": "advanced",
     "acquireCcLock": "advanced",
     "addDotsOf": "advanced",
@@ -4297,6 +4330,7 @@
     "readIntentCredentials": "advanced",
     "readJsonlRecords": "advanced",
     "readMailboxPeerMeta": "advanced",
+    "readOnlyShellVerdict": "advanced",
     "readPeerSessionRecord": "advanced",
     "readPendingSteerQueue": "advanced",
     "readRootAdoptionFile": "advanced",