@sema-agent/core 7.11.2 → 7.13.0

package/dist/core/runner/stream-lifecycle-verbs.js

@@ -114,9 +114,18 @@ export function streamLifecycleVerbs(input) {
         detachHub.request(toolCallId);
     };
     const interrupt = async () => {
+        const interruptRefused = (msg) => {
+            const e = new Error(`cannot interrupt: ${msg}`);
+            e.code = "steering.not_running";
+            return e;
+        };
+        if (live.resultValue)
+            throw interruptRefused("the task has already finished");
         const h = live.handle ?? (await orTimeout(ready));
         if (!h)
-            return;
+            throw interruptRefused("the task is not running");
+        if (live.resultValue !== undefined || h.loop.ended)
+            throw interruptRefused("the task is no longer running");
         if (!h.abortController.signal.aborted)
             h.loop.userInterrupted = true;
         h.abortController.abort();

package/dist/core/runner-deps.d.ts

@@ -687,17 +687,10 @@ export interface RunnerDeps {
         sessionContext?: readonly string[];
         /** Transcript-window bounds for the classify prompt (defaults: 40 entries / 2000 chars each). */
         window?: import("./auto-mode-prompt.js").AutoModeWindowOptions;
-        /** Classify round-trip cap, ms (default 15_000). */
+        /** Classify round-trip cap, ms (default 15_000). A round past the cap is `unavailable(timeout)`: the call is
+         *  DENIED with a sentence that says so (CC 2.1.250 form), and the next call is classified afresh — there is no
+         *  failure count and no session latch. */
         timeoutMs?: number;
-        /** Consecutive-failure threshold opening the one-way session breaker (default 3). */
-        failureThreshold?: number;
-        /** Fired ONCE when the session breaker opens (the "退回非 auto" alarm — surface it to the operator). The engine
-         *  records the trip on the session's breaker read face (`WiringManifest.autoMode.breaker`, #616) BEFORE calling
-         *  this hook, so a deployment that wires nothing here still gets the read face. */
-        onBreakerOpen?: (info: {
-            consecutiveFailures: number;
-            lastCause: import("./auto-mode.js").AutoModeBreakerCause;
-        }) => void;
         /**
          * The classifier DENIAL LIMIT (CC 2.1.250 `FO`/`AKe`): a run whose classifier keeps blocking falls
          * back to a PERSON instead of being denied without end. Per run: a `block` first increments the
@@ -736,10 +729,7 @@ export interface RunnerDeps {
          * line); a deployment that treats those as sensitive at rest should keep them out of the arming
          * face rather than out of this flag.
          *
-         * Recording is CONDITIONAL on the session breaker still being closed at park time: a session that
-         * already fell back to non-auto hands nothing forward (the redemption must never run wider than the
-         * ancestor it inherits). A `true` here with a non-serializable face announces once and records
-         * nothing (`phase:"config"`).
+         * A `true` here with a non-serializable face announces once and records nothing (`phase:"config"`).
          */
         persistArming?: boolean;
         /**

package/dist/core/store-contracts/workflow-journal-store-contract.d.ts

@@ -0,0 +1,7 @@
+import { type WorkflowJournalStore } from "../workflow-journal-store.js";
+import { type ContractAssertionRunner } from "./contract-harness.js";
+/**
+ * The full cross-backend contract for {@link WorkflowJournalStore}. Every case builds its own store via
+ * `make()`; with no runner the cases run sequentially and the first failure throws.
+ */
+export declare function workflowJournalStoreContract(make: () => WorkflowJournalStore, runAssertion?: ContractAssertionRunner): Promise<void>;

package/dist/core/store-contracts/workflow-journal-store-contract.js

@@ -0,0 +1,85 @@
+import { strict as assert } from "node:assert";
+import { JOURNAL_OVERSIZE_ERROR_CODE, MAX_JOURNAL_RESULT_BYTES, } from "../workflow-journal-store.js";
+import { beginContract } from "./contract-harness.js";
+const key = (ordinal) => `${ordinal}:h`;
+const completed = (ordinal, over = {}) => ({
+    taskId: `t-${ordinal}`,
+    sessionId: `s-${ordinal}`,
+    terminal: { kind: "completed" },
+    result: `r${ordinal}`,
+    structuredOutput: { ordinal, nested: { ok: true } },
+    stats: { turns: 1, tokens: 1, costMicroUsd: 0, nested: { tokens: 0, turns: 0, tasks: 0, costMicroUsd: 0 } },
+    ...over,
+});
+const parked = (ordinal, over = {}) => ({
+    taskId: `t-${ordinal}`,
+    sessionId: `s-${ordinal}`,
+    terminal: { kind: "paused", token: `tok-${ordinal}`, checkpointId: `cp-${ordinal}`, gate: { kind: "human", reason: "approve", toolName: "Write" } },
+    result: "",
+    structuredOutput: { partial: ordinal },
+    stats: { turns: 1, tokens: 1, costMicroUsd: 0, nested: { tokens: 3, turns: 2, tasks: 1, costMicroUsd: 1 } },
+    ...over,
+});
+const OVER_CAP = "x".repeat(MAX_JOURNAL_RESULT_BYTES + 1024);
+const isOversizeRefusal = (e) => e instanceof Error && e.code === JOURNAL_OVERSIZE_ERROR_CODE;
+export async function workflowJournalStoreContract(make, runAssertion) {
+    const { run, settle } = beginContract(runAssertion);
+    run("append → load returns entries ASCENDING by ordinal, both arms verbatim; a re-append per ordinal OVERWRITES", async () => {
+        const store = make();
+        await store.append("run-1", "tenant-a", { callKey: key(10), result: completed(10) });
+        await store.append("run-1", "tenant-a", { callKey: key(1), parked: parked(1) });
+        await store.append("run-1", "tenant-a", { callKey: key(0), result: completed(0) });
+        await store.append("run-1", "tenant-a", { callKey: key(2), result: completed(2) });
+        await store.append("run-1", "tenant-a", { callKey: key(0), result: completed(0, { result: "overwritten" }) });
+        const entries = await store.load("run-1", "tenant-a");
+        assert.deepEqual(entries.map((e) => e.callKey), [key(0), key(1), key(2), key(10)]);
+        assert.deepEqual(entries[0], { callKey: key(0), result: completed(0, { result: "overwritten" }) });
+        assert.deepEqual(entries[1], { callKey: key(1), parked: parked(1) });
+    });
+    run("scope wall: a cross-scope load is EMPTY — before and after the owner's own load, and after a refused cross-scope append — on both arms", async () => {
+        const store = make();
+        await store.append("run-1", "alice", { callKey: key(0), result: completed(0) });
+        await store.append("run-1", "alice", { callKey: key(1), parked: parked(1) });
+        assert.deepEqual(await store.load("run-1", "mallory"), []);
+        assert.equal((await store.load("run-1", "alice")).length, 2);
+        assert.deepEqual(await store.load("run-1", "mallory"), []);
+        await assert.rejects(store.append("run-1", "mallory", { callKey: key(2), result: completed(2) }));
+        await assert.rejects(store.append("run-1", "mallory", { callKey: key(3), parked: parked(3) }));
+        assert.deepEqual(await store.load("run-1", "mallory"), []);
+        assert.deepEqual((await store.load("run-1", "alice")).map((e) => e.callKey), [key(0), key(1)]);
+    });
+    run(`oversize RESULT arm ⇒ append rejects with code "${JOURNAL_OVERSIZE_ERROR_CODE}"; nothing journaled; the store stays usable`, async () => {
+        const store = make();
+        await store.append("run-1", "tenant-a", { callKey: key(0), result: completed(0) });
+        await assert.rejects(store.append("run-1", "tenant-a", { callKey: key(1), result: completed(1, { result: OVER_CAP }) }), isOversizeRefusal);
+        assert.deepEqual((await store.load("run-1", "tenant-a")).map((e) => e.callKey), [key(0)]);
+        await store.append("run-1", "tenant-a", { callKey: key(2), result: completed(2) });
+        assert.deepEqual((await store.load("run-1", "tenant-a")).map((e) => e.callKey), [key(0), key(2)]);
+    });
+    run(`oversize PARKED arm ⇒ append rejects with code "${JOURNAL_OVERSIZE_ERROR_CODE}"; nothing journaled (never a silent skip — a lost park is a resume running the ordinal live)`, async () => {
+        const store = make();
+        await store.append("run-1", "tenant-a", { callKey: key(0), result: completed(0) });
+        await assert.rejects(store.append("run-1", "tenant-a", { callKey: key(1), parked: parked(1, { result: OVER_CAP }) }), isOversizeRefusal);
+        assert.deepEqual((await store.load("run-1", "tenant-a")).map((e) => e.callKey), [key(0)]);
+        await store.append("run-1", "tenant-a", { callKey: key(1), parked: parked(1) });
+        assert.equal((await store.load("run-1", "tenant-a"))[1].parked?.terminal.kind, "paused");
+    });
+    run("the cap is inclusive: a payload of EXACTLY the cap's byte count is accepted on both arms", async () => {
+        const store = make();
+        const fit = (payload) => {
+            const base = Buffer.byteLength(JSON.stringify({ ...payload, result: "" }), "utf8");
+            return { ...payload, result: "y".repeat(MAX_JOURNAL_RESULT_BYTES - base) };
+        };
+        const r = fit(completed(0));
+        const p = fit(parked(1));
+        assert.equal(Buffer.byteLength(JSON.stringify(r), "utf8"), MAX_JOURNAL_RESULT_BYTES);
+        assert.equal(Buffer.byteLength(JSON.stringify(p), "utf8"), MAX_JOURNAL_RESULT_BYTES);
+        await store.append("run-1", "tenant-a", { callKey: key(0), result: r });
+        await store.append("run-1", "tenant-a", { callKey: key(1), parked: p });
+        const entries = await store.load("run-1", "tenant-a");
+        assert.deepEqual(entries.map((e) => e.callKey), [key(0), key(1)]);
+        assert.deepEqual(entries[0].result, r);
+        assert.deepEqual(entries[1].parked, p);
+    });
+    await settle();
+}

package/dist/core/task-stream.d.ts

@@ -277,7 +277,16 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
     }>;
     /**
      * Hard-**interrupt** the running task — a real abort (not a best-effort hint), equivalent to firing the
-     * task's `signal` (design/47). No-op if the task already finished. For a SOFT redirect that lets the
+     * task's `signal` (design/47). Refused typed (`steering.not_running`, the steer-family liveness code —
+     * `cannot interrupt: …`) once the task has finished (the loop's end included: the teardown window
+     * refuses like `halt`/`steer` do), never silently dropped. **A run that has already given its answer
+     * is not cancellable**: once its last turn ended `stopReason:"stop"` with no queued steer / follow-up
+     * left to serve (a continuation the person had already asked for makes that "stop" work in progress,
+     * not an answer), a stop landing on the run's
+     * tail (this verb, the task's `signal`, the walltime or turns limit — one law) still aborts what is
+     * left of that tail (a final-boundary compaction is mooted) but the run ends `completed` with the
+     * answer as `result`, writes no interruption marker, mints no `limits.*` code, and says so once with
+     * the `task.interrupt_unconsumed` notice. For a SOFT redirect that lets the
      * task keep running and adjust, use {@link steer} instead. For the CC-Esc "stop and wait for my
      * input" form — cut the turn, keep the ending clean and resumable — use {@link halt}.
      */

package/dist/core/tool-face.d.ts

@@ -150,7 +150,15 @@ export interface ToolRuleFace {
  *  budgets a MINTED name to — a minted name is always inside this wire bound by construction; a CALLER
  *  declaration is judged against it at prepare. */
 export declare const TOOL_WIRE_NAME_MAX_CHARS = 128;
+/** The roster's wire bound on a SHORT identity member: a contract's `contractId` / `implementationRevision`, and the
+ *  `modelGate` class a definition carries. Bounded at the mint (`rosterMemberBoundProblem`), never truncated. */
 export declare const TOOL_CONTRACT_MAX_CHARS = 64;
+/** The roster's wire bound on a row's `cardId` — a COMPOSITE minted from bounded members, so its bound is DERIVED
+ *  from theirs rather than declared beside them: the widest form is `<mcp|a2a>:<peer>/<tool>` with the peer and the
+ *  protocol tool segment each inside the wire NAME bound (`builtin:<name>` and `<caller|external>:<contractId>` are
+ *  narrower). A row minted from in-bound members therefore fits by construction; the mint's own check on it is a
+ *  tripwire for a new source form, never a working rule. */
+export declare const TOOL_CARD_ID_MAX_CHARS: number;
 /** The roster's wire bound on a KEY — a schema property name, a path-target `param`/alias, a rule-face param. A key is a
  *  SEMANTIC name every fence reads an argument by, so it is never truncated: a declaration over the bound is refused at
  *  the door (caller) or dropped with a disclosed reason (MCP intake), and a row carries every key exactly. */

package/dist/core/tool-face.js

@@ -14,6 +14,7 @@ export function pathTargetSlotOnly(pt) {
 }
 export const TOOL_WIRE_NAME_MAX_CHARS = 128;
 export const TOOL_CONTRACT_MAX_CHARS = 64;
+export const TOOL_CARD_ID_MAX_CHARS = "mcp:".length + TOOL_WIRE_NAME_MAX_CHARS + "/".length + TOOL_WIRE_NAME_MAX_CHARS;
 export const TOOL_KEY_MAX_CHARS = 256;
 export const TOOL_KEYS_MAX = 1024;
 export const RENDER_HINT_MAX_CHARS = 64;

package/dist/core/tool-policy.d.ts

@@ -19,9 +19,11 @@ export interface ToolCallRequest {
      * (how the target may be confirmed by path), the display family, and the engine-minted identity
      * (`capabilityId` / `contractId` / `shapeDigest`) an exemption store keys on. Stamped at the gate entry
      * from the live roster, so identity follows the OBJECT the call dispatches to — a caller tool that merely
-     * took a built-in's name carries its own face, never the built-in's. ABSENT when a policy is invoked
-     * outside a Runner (a bare producer): a path-confining face then reads the catalog's declaration for the
-     * NAME (the pre-388 posture, never wider), and a skill-scope face treats the write as unconfirmable.
+     * took a built-in's name carries its own face, never the built-in's. ABSENT only on a BARE request (a
+     * policy invoked outside a Runner by a producer that stamped nothing): a PROTECTIVE fence (a deny-list)
+     * then reads the catalog's declaration for the NAME, tighten-only; a CONTAINMENT fence (a grant admitting a
+     * write by its path) REFUSES the request, typed (`policy.bare_request`, #626 ②) — stamp the face yourself
+     * (`toolCallFaceOf(roster, name)`) when driving a policy outside a Runner.
      */
     face?: ToolCallFace;
     /**
@@ -207,20 +209,12 @@ export type PermissionResult = {
      *  same safe direction as `matchedAskRule`); it cannot state a window of its own, because the
      *  route it would be a window for has not been chosen yet. */
     denialLimitFallback?: import("./auto-mode.js").UnarmedDenialLimitFallback;
-    /** #616 (additive): the auto-mode classifier was CONSULTED on this ask and could not run — the ask
-     *  flows the original chain exactly as it would have (routing, origin, bit and members unchanged),
-     *  carrying the station FACT beside them so a card can say "asked because the classifier was
-     *  unavailable (timeout)" instead of reading as ordinary hesitation. `cause` is the verdict's own
-     *  word ({@link import("./auto-mode.js").AutoModeUnavailableCause}: `error` / `timeout` /
-     *  `breaker_open`). A FACT, not an origin: CC 2.1.250 marks the same condition as a denial KIND on
-     *  the outcome (`automode-unavailable`) beside the decision's provenance, never in place of it, and
-     *  this engine's divergence (the ask reaches a person instead of being denied) does not move the
-     *  fact onto the origin axis either. ENGINE-STAMPED at the classifier stations (the gate's own and
-     *  the inherited-lane arms) only when the verdict was `unavailable`; `parse_error` stamps nothing
-     *  (the classifier ran and answered outside its contract — a different sentence). Display metadata:
-     *  nothing reads it to decide anything, so a policy that self-declares it can only put its own
-     *  sentence on its own card. Carried onto the approval request and the durable row by the carry
-     *  stations. */
+    /** #616 (additive): the classifier-unavailable FACT on an ASK — `cause` is the verdict's own word
+     *  ({@link import("./auto-mode.js").AutoModeUnavailableCause}). Since #661 the ENGINE no longer writes
+     *  it here: an `unavailable` verdict is a DENY (the deny arm's member above), never an ask handed to a
+     *  person. The member stays on the ask arm as display metadata a policy may self-declare on its own
+     *  ask (nothing reads it to decide anything); the carry stations still copy it onto the approval
+     *  request and the durable row when present. Retirement candidate for the next wire window. */
     classifierUnavailable?: {
         readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
     };
@@ -298,6 +292,16 @@ export type PermissionResult = {
     updatedInput?: unknown;
     message?: string;
     decisionReason?: DecisionReason;
+    /** #661 (additive): this deny is the classifier's UNAVAILABILITY — the auto-mode classifier was consulted
+     *  and could not run, and the call is refused with a sentence that says so (CC 2.1.250 `Ze.unavailable` ⇒
+     *  `deny`, `x1t`). `cause` is the verdict's own word ({@link import("./auto-mode.js").AutoModeUnavailableCause}).
+     *  ENGINE-STAMPED beside `decisionReason: "classifier"` at the classifier stations (the gate's own and the
+     *  inherited-lane arms) on an `unavailable` verdict only; a `block` and a `parse_error` deny carry nothing
+     *  here. Read by the deny observer's payload ({@link import("./hooks.js").PermissionDeniedPayload}) and by
+     *  nothing that decides. */
+    classifierUnavailable?: {
+        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
+    };
 };
 /**
  * design/252 G-2 — WHY a piece of rule-provenance evidence is not on an ask.
@@ -540,100 +544,42 @@ export declare function constraintChainEntryOf(policy: ToolPolicy, meta?: Constr
 /**
  * One inherited-chain LAYER as both chain-entry mint sites see it — structurally an
  * `InheritedGate.parentConstraints[]` element, typed here structurally so this module (which owns the
- * digest) does not depend on the runner's shapes.
+ * digest) does not depend on the runner's shapes. The classifier itself is not read: a decider carries no
+ * state between rounds, so nothing about its health enters a chain entry.
  */
 export interface ConstraintChainLayerView {
     policy: ToolPolicy;
     autoMode?: {
-        decider: {
-            breakerOpen: () => boolean;
-            consecutiveFailures?: () => number;
-        };
         arming?: unknown;
     };
     durableMandate?: boolean;
     contentMandate?: boolean;
 }
 /**
- * The WRITE-side mint: the chain entry a durable PARK records for a live inherited layer.
- *
- * #503 safety bound ① lives HERE, at the persistence point rather than at arming time: the recipe is
- * carried only while the layer's breaker is UNTRIPPED AND UNTOUCHED. An open breaker is the ancestor
- * session's one-way "fell back to non-auto" latch — its arming has been withdrawn, and handing that
- * arming to a redemption would let the redeemed leg run auto-classified where the ancestor no longer does
- * (a redemption WIDER than the ancestor it inherits). The latch is read at the moment the row is written,
- * so an ancestor whose classifier died mid-run parks WITHOUT a recipe even though it was armed when the
- * chain was assembled.
- *
- * `breakerOpen()` alone is NOT the whole latch, and a closed-only test left a real widening: a rebuilt
- * decider starts a FRESH failure streak, so an ancestor sitting at 2 failures out of 3 — one bad
- * classification from dropping the whole session to non-auto — would hand a redemption the full budget
- * again, and the redeemed leg stays auto-classified through failures the ancestor would not have
- * survived. So the streak must read ZERO as well. A decider that does not expose it at all is UNKNOWN
- * state, and unknown takes the same arm as tripped: nothing is recorded (which is why a host that hand
- * rolls a decider cannot use the persisted-arming path — it must mint through `createAutoModeDecider`,
- * on both the arming and the redeeming side).
- *
- * Every read here is guarded, and every failure to read is treated as "withdrawn" — the opposite default
- * from the gate's demote-to-ask breaker reader, and for the same reason both are right: there, an
- * unreadable latch must not suppress a tighten; here, it must not license a carry-forward.
- *
- * ⚠️ WRITE SIDE ONLY. This gate reads MUTABLE state (a one-way latch, plus a streak that both grows and
- * resets to zero on any healthy classification). The resume re-supply must NOT re-run it — it samples a
- * different instant, and the two instants disagree for perfectly ordinary reasons: an ancestor keeps
- * running while its delegated child sits parked awaiting a human. See
- * {@link constraintChainEntryOfSuppliedLayer} for the verify side and the full account.
- *
- * ⚖️ WHAT THIS BOUND DOES NOT DO (recorded, precise shape). A withdrawn arming leaves the entry at
- * `autoModeArmed: true` with no recipe — digest-identical to an armed layer whose deployment never opted
- * in. So the digest does not, and cannot, stop a re-supplier from handing back a FRESH healthy decider of
- * its own: that is the pre-existing re-supply trust posture (see `resumeStream`'s contract — a caller
- * able to invoke it already holds full Runner authority, and the chain checks catch shape MISTAKES, not
- * a hostile trusted caller), and it is unchanged here. What this bound governs is what CORE hands
- * forward: a withdrawn ancestor's CRITERIA never travel, so a redemption cannot reconstruct the
- * ancestor's classifier from the row. For a fleet running `persistArming` everywhere, the pair
- * (`autoModeArmed` present, `autoModeArming` absent) is itself the readable signal that the ancestor's
- * arming was withdrawn or unrecordable, and such a host should re-supply a refusing decider rather than a
- * fresh one. Making the WITHDRAWAL itself digest-bound is a coherent stronger design — it needs a new
- * marker plus a new re-supply obligation to reproduce it (a withdrawn row carries no recipe, so the
- * marker cannot be derived from one), which is a scope decision for this seam's owner, not a silent
- * mechanism change.
+ * The WRITE-side mint: the chain entry a durable PARK records for a live inherited layer. The recipe is
+ * carried whenever the layer has one (the deployment opted into `persistArming`). The former gate — "only
+ * while the ancestor's breaker is untripped and untouched" — went with the breaker: a decider carries no
+ * state between rounds, so there is no ancestor health to sample here and nothing that could make a
+ * redemption run wider than the ancestor it inherits.
+ *
+ * ⚖️ WHAT THE ROW DOES NOT SAY. An armed layer whose deployment never opted in leaves the entry at
+ * `autoModeArmed: true` with no recipe. The digest does not, and cannot, stop a re-supplier from handing
+ * back a FRESH decider of its own: that is the pre-existing re-supply trust posture (see `resumeStream`'s
+ * contract — a caller able to invoke it already holds full Runner authority, and the chain checks catch
+ * shape MISTAKES, not a hostile trusted caller). What CORE hands forward is the recipe when there is one,
+ * and nothing otherwise.
  */
 export declare function constraintChainEntryOfLayer(layer: ConstraintChainLayerView): ConstraintChainEntry;
 /**
  * The VERIFY-side mint: the entry a resume's RE-SUPPLIED layer must reproduce for the row it is
  * redeeming. Same body as the park mint, with the arming carry taken from the ROW rather than from the
- * layer's live classifier health — so the digest equality is over bytes the row itself recorded, and
- * over nothing that can move while the row sits parked.
- *
- * WHY THE CARRY CANNOT BE RE-DERIVED HERE. Safety bound ① (see {@link constraintChainEntryOfLayer}) is a
- * statement about the ancestor at the instant the row was WRITTEN. Re-running it against the same live
- * layer at redemption time samples a different instant, and both directions of the disagreement strand an
- * approval a human already granted:
- *   - the ancestor was healthy at the park (the row carries the recipe) and its breaker opened while the
- *     child sat parked ⇒ the re-supply mints WITHOUT the recipe, the digests differ, and because the
- *     latch is ONE-WAY the row is refused `resume.parent_constraint_mismatch` forever;
- *   - the ancestor was one failure into its streak at the park (the row carries no recipe) and the streak
- *     cleared on its next healthy classification ⇒ the re-supply mints WITH a recipe the row never
- *     carried, same refusal.
- * Neither needs a host mistake: the ancestor and its siblings keep running while the child is parked, and
- * the same-process `resume()` verb re-supplies the very same live layer objects out of the Runner's own
- * parked-constraint registry. Nothing about the row changed; only a classifier's health did.
- *
- * WHAT THIS COSTS, NAMED. A row that recorded NO recipe no longer refuses a re-supply that hands one
- * back. That is not a tunable — the re-supply side literally cannot tell "the row withdrew a recipe this
- * same live layer still declares" (the second bullet above, a legitimate redemption) from "a re-supplier
- * is putting a recipe onto a row that withdrew one": both are the identical pair of inputs. It is also
- * thinner than it looks. The recipe is not an enforcement object — the DECIDER classifies, and the
- * re-supply trust posture already permits handing back a fresh healthy one, which is the capability that
- * would matter. What the row's absence still means is unchanged and is the property bound ① was written
- * for: a withdrawn ancestor's criteria never travel ON THE ROW, so no redemption can reconstruct that
- * ancestor's classifier from the checkpoint.
- *
- * WHAT THE DIGEST STILL BINDS. A row that DID record a recipe must have that recipe handed back: the
- * carry is on, so a re-supply that drops the arming, or hands back a different one, mints a different
- * entry and is refused pre-CAS exactly as before. That is the whole of the documented re-supply contract
- * — "hand back what the row carries".
+ * layer — the digest equality is over bytes the row itself recorded, never over what a live object says at
+ * a second instant. A row that DID record a recipe must have that recipe handed back: a re-supply that drops
+ * the arming, or hands back a different one, mints a different entry and is refused pre-CAS
+ * (`resume.parent_constraint_mismatch`). A row that recorded none does not refuse a re-supply that hands one
+ * back — the recipe is not an enforcement object (the DECIDER classifies), and the re-supply trust posture
+ * already permits a fresh decider; what the row's absence still means is that no redemption can reconstruct
+ * the ancestor's classifier FROM THE CHECKPOINT.
  */
 export declare function constraintChainEntryOfSuppliedLayer(layer: ConstraintChainLayerView, recorded: ConstraintChainEntry | undefined): ConstraintChainEntry;
 /**

package/dist/core/tool-policy.js

@@ -128,17 +128,7 @@ function chainEntryOfLayerCarrying(layer, carryArming) {
     });
 }
 export function constraintChainEntryOfLayer(layer) {
-    let armingLive = false;
-    if (layer.autoMode?.arming !== undefined) {
-        try {
-            const d = layer.autoMode.decider;
-            armingLive = d.breakerOpen() !== true && typeof d.consecutiveFailures === "function" && d.consecutiveFailures() === 0;
-        }
-        catch {
-            armingLive = false;
-        }
-    }
-    return chainEntryOfLayerCarrying(layer, armingLive);
+    return chainEntryOfLayerCarrying(layer, layer.autoMode?.arming !== undefined);
 }
 export function constraintChainEntryOfSuppliedLayer(layer, recorded) {
     return chainEntryOfLayerCarrying(layer, recorded?.autoModeArming !== undefined);

package/dist/core/tool-registry.d.ts

@@ -62,13 +62,21 @@ type CallPathTarget = ToolCallPathTarget;
  * a different file, and the deny this floor exists to preserve simply misses.
  */
 export declare function protectivePathTargetOf(call: ToolCallLike): CallPathTarget | undefined;
+/** The typed refusal a CONTAINMENT reader mints for a request that carries no face at all (#626 ② — design/388 B6's
+ *  bare-producer migration seam, closed). */
+export declare const BARE_REQUEST_CODE = "policy.bare_request";
 /**
  * The path target a CONTAINMENT fence reads (a grant admitting a write BY its path: session `allowDirs`, the fs-write
  * gate's accept/exempt dirs; the active-skill allowPaths face reads its own eligibility bit the same way): the object
  * face's OWN declaration only — a same-name tool that declares no path target is an UNCONFIRMABLE write (the catalog's
- * slot may not be the one it writes; a decoy in that slot would buy an admission), so the fence fails closed. A BARE
- * request (no face at all — a policy invoked outside a Runner) reads the catalog for the name: the pre-388 reading, the
- * documented migration seam for bare producers.
+ * slot may not be the one it writes; a decoy in that slot would buy an admission), so the fence fails closed.
+ *
+ * #626 ②: a BARE request (no face at all) is REFUSED, typed (`policy.bare_request`), never answered from the catalog
+ * for the name. A grant is a claim about the tool's OWN slot, and only a prepared leg's roster can say which object
+ * the call dispatches to — the catalog's declaration for a NAME is exactly the reading a same-name caller tool would
+ * exploit. Inside a Runner every gated request carries the leg's face (the gate entry, the resume belts and the
+ * pre-CAS edit recheck stamp it); a policy invoked outside a Runner stamps its own (`toolCallFaceOf(roster, name)`).
+ * The PROTECTIVE floor above keeps reading the catalog for a bare request: tighten-only, a deny can only gain a slot.
  */
 export declare function declaredPathTargetOf(call: ToolCallLike): CallPathTarget | undefined;
 /** Is this call a write a PROTECTIVE fence judges (a protected target whose access ≠ read)? The name sets are its static view. */

package/dist/core/tool-registry.js

@@ -54,8 +54,14 @@ export function protectivePathTargetOf(call) {
     const floor = pathTargetOf(call.toolName);
     return floor === undefined || call.face === undefined ? floor : pathTargetSlotOnly(floor);
 }
+export const BARE_REQUEST_CODE = "policy.bare_request";
 export function declaredPathTargetOf(call) {
-    return call.face !== undefined ? call.face.pathTarget : pathTargetOf(call.toolName);
+    if (call.face === undefined) {
+        const e = new Error(`tool call ${JSON.stringify(call.toolName)} carries no face: a containment fence admits a write only by the tool's OWN declared path target, which a prepared leg's roster stamps on every gated request — a policy invoked outside a Runner must stamp \`face\` itself (toolCallFaceOf) rather than expect the catalog's declaration for the name`);
+        e.code = BARE_REQUEST_CODE;
+        throw e;
+    }
+    return call.face.pathTarget;
 }
 export function isProtectedWrite(call) {
     const pt = protectivePathTargetOf(call);

package/dist/core/tool-roster.d.ts

@@ -309,6 +309,32 @@ export declare function inputKeysOf(schema: TSchema | undefined): {
 /** The roster's KEY bounds over a schema (design/388 B20): a problem sentence, or undefined when every top-level key fits.
  *  Shared by the caller declaration door (typed refusal) and the MCP intake (disclosed drop) — a key is never truncated. */
 export declare function schemaKeyBoundProblem(schema: TSchema | undefined): string | undefined;
+/** The identity members of one roster row the wire bounds hold, as a DECLARATION (the door) or a MINTED row hands them. */
+export interface RosterBoundMembers {
+    name: string;
+    aliases?: readonly string[];
+    /** An MCP/A2A mount's peer (the row's `origin.peer`) — a NAME on the roster, held to the wire name bound. */
+    peer?: string;
+    contractId?: string;
+    implementationRevision?: string;
+    modelGate?: string;
+    cardId?: string;
+}
+/** The typed refusal a member over its bound mints — the door's two codes, and the mint's own for the members no
+ *  declaration door names (`modelGate`, the derived `cardId`). */
+export type RosterBoundCode = "config.tool_name_too_long" | "config.tool_contract_too_long" | "config.tool_roster_bound";
+/**
+ * design/388 B20 / #626 ① — the ONE bound judge over a row's identity members: a problem `{ code, message }`, or
+ * undefined when every member fits. Read by the declaration door (a `TaskSpec.tools` entry, refused before session
+ * acquire) and by the row mint (every source — an MCP/A2A peer, a definition that reached the mint by a route the
+ * door does not cover — refused before the row exists). A member over its bound is NEVER truncated onto the row: a
+ * truncated identity is a different identity (`judgeParkedToolIdentity` compares it across a park; the card
+ * namespace door reads it), and the schema's own bounds would then describe a row the mint never made.
+ */
+export declare function rosterMemberBoundProblem(m: RosterBoundMembers): {
+    code: RosterBoundCode;
+    message: string;
+} | undefined;
 /**
  * The rule vocabulary of ONE mounted instance (design/388 §2.2 ③ / D-3): DERIVED = the scalar top-level
  * keys ∪ the path target's `param` + aliases; a declared `params` list can only NARROW it (a declared

package/dist/core/tool-roster.js

@@ -2,12 +2,12 @@ import { createHash } from "node:crypto";
 import { Type } from "typebox";
 import { getToolContract } from "../prompt-assembly/tool-catalog.js";
 import { protocolOf } from "./protocol-table.js";
-import { RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_CHARS, RENDER_HINT_MAX_LIST, TOOL_APPROVAL_CARDS, TOOL_FAMILIES, TOOL_KEYS_MAX, TOOL_KEY_MAX_CHARS, TOOL_MOUNT_TAGS, TOOL_PATH_ABSENCES, TOOL_PATH_BASES, } from "./tool-face.js";
+import { RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_CHARS, RENDER_HINT_MAX_LIST, TOOL_APPROVAL_CARDS, TOOL_CARD_ID_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_FAMILIES, TOOL_KEYS_MAX, TOOL_KEY_MAX_CHARS, TOOL_MOUNT_TAGS, TOOL_WIRE_NAME_MAX_CHARS, TOOL_PATH_ABSENCES, TOOL_PATH_BASES, } from "./tool-face.js";
 function lit(values) {
     return Type.Union(values.map((v) => Type.Literal(v)));
 }
-const Name = Type.String({ minLength: 1, maxLength: 128 });
-const Short = Type.String({ maxLength: 64 });
+const Name = Type.String({ minLength: 1, maxLength: TOOL_WIRE_NAME_MAX_CHARS });
+const Short = Type.String({ maxLength: TOOL_CONTRACT_MAX_CHARS });
 const Key = Type.String({ maxLength: TOOL_KEY_MAX_CHARS });
 const Digest16 = Type.String({ minLength: 16, maxLength: 16 });
 export const ROSTER_SOURCES = ["builtin", "caller", "host", "mcp", "a2a", "external", "synthetic"];
@@ -26,7 +26,7 @@ export const ToolRosterEntry = Type.Object({
     contract: Type.Object({ contractId: Short, implementationRevision: Short }, { additionalProperties: false }),
     shapeDigest: Digest16,
     wireSchemaDigest: Digest16,
-    cardId: Type.String({ maxLength: 160 }),
+    cardId: Type.String({ maxLength: TOOL_CARD_ID_MAX_CHARS }),
     capabilityId: Digest16,
     inputKeys: Type.Array(Type.Object({ name: Key, type: lit(["string", "number", "integer", "boolean", "object", "array", "null", "mixed"]) }, { additionalProperties: false }), { maxItems: TOOL_KEYS_MAX }),
     effect: lit(["read", "write", "idempotent"]),
@@ -207,6 +207,26 @@ export function schemaKeyBoundProblem(schema) {
         return `the schema property ${JSON.stringify(long.slice(0, 40) + "…")} is ${long.length} characters; a roster key is at most ${TOOL_KEY_MAX_CHARS}`;
     return undefined;
 }
+export function rosterMemberBoundProblem(m) {
+    const over = (label, value, bound) => `${label} ${JSON.stringify(value.slice(0, 40) + "…")} is ${value.length} characters; the roster's bound is ${bound}`;
+    const of = (text) => `tool ${JSON.stringify(m.name.slice(0, 40))}: ${text}`;
+    if (m.name.length > TOOL_WIRE_NAME_MAX_CHARS)
+        return { code: "config.tool_name_too_long", message: over("tool name", m.name, TOOL_WIRE_NAME_MAX_CHARS) };
+    const alias = m.aliases?.find((a) => a.length > TOOL_WIRE_NAME_MAX_CHARS);
+    if (alias !== undefined)
+        return { code: "config.tool_name_too_long", message: of(over("alias", alias, TOOL_WIRE_NAME_MAX_CHARS)) };
+    if (m.peer !== undefined && m.peer.length > TOOL_WIRE_NAME_MAX_CHARS)
+        return { code: "config.tool_name_too_long", message: of(over("peer", m.peer, TOOL_WIRE_NAME_MAX_CHARS)) };
+    for (const [label, v] of [["contractId", m.contractId], ["implementationRevision", m.implementationRevision]]) {
+        if (v !== undefined && v.length > TOOL_CONTRACT_MAX_CHARS)
+            return { code: "config.tool_contract_too_long", message: of(over(`contract ${label}`, v, TOOL_CONTRACT_MAX_CHARS)) };
+    }
+    if (m.modelGate !== undefined && m.modelGate.length > TOOL_CONTRACT_MAX_CHARS)
+        return { code: "config.tool_roster_bound", message: of(over("modelGate", m.modelGate, TOOL_CONTRACT_MAX_CHARS)) };
+    if (m.cardId !== undefined && m.cardId.length > TOOL_CARD_ID_MAX_CHARS)
+        return { code: "config.tool_roster_bound", message: of(over("cardId", m.cardId, TOOL_CARD_ID_MAX_CHARS)) };
+    return undefined;
+}
 export function ruleFaceOfInstance(schema, declared, pathTarget) {
     const { scalar } = inputKeysOf(schema);
     const derived = new Set(scalar);
@@ -375,15 +395,26 @@ export function mintRosterEntry(tool, meta, facts) {
     const pathTarget = face.pathTarget;
     const rf = ruleFaceOfInstance(tool.parameters, face.ruleFace, pathTarget);
     const hints = face.renderHints !== undefined ? capRenderHints(face.renderHints) : undefined;
+    const bound = rosterMemberBoundProblem({
+        name: tool.name,
+        aliases: tool.aliases,
+        ...(peer !== null ? { peer } : {}),
+        contractId: d.contractId,
+        implementationRevision: d.implementationRevision,
+        ...(typeof face.modelGate === "string" ? { modelGate: face.modelGate } : {}),
+        cardId,
+    });
+    if (bound !== undefined)
+        throw configError(bound.code, bound.message);
     return {
         name: tool.name,
         aliases: [...new Set(tool.aliases ?? [])],
         source: meta.source,
         ...(meta.origin !== undefined ? { origin: { peer: meta.origin.peer, ...(meta.origin.declaredBy !== undefined ? { declaredBy: meta.origin.declaredBy } : {}) } } : {}),
-        contract: { contractId: d.contractId.slice(0, 64), implementationRevision: d.implementationRevision.slice(0, 64) },
+        contract: { contractId: d.contractId, implementationRevision: d.implementationRevision },
         shapeDigest: d.shapeDigest,
         wireSchemaDigest: d.wireSchemaDigest,
-        cardId: cardId.slice(0, 160),
+        cardId,
         capabilityId: mintCapabilityId({ source: meta.source, peer, name: tool.name, contractId: d.contractId }),
         inputKeys,
         effect,
@@ -417,7 +448,7 @@ export function mintRosterEntry(tool, meta, facts) {
         validateInput: typeof tool.validateInput === "function",
         deferred: facts.deferred.has(tool.name),
         alwaysLoad: face.alwaysLoad === true || face.mcpAlwaysLoad === true,
-        ...(typeof face.modelGate === "string" ? { modelGate: face.modelGate.slice(0, 64) } : {}),
+        ...(typeof face.modelGate === "string" ? { modelGate: face.modelGate } : {}),
         ...(hints !== undefined ? { renderHints: hints } : {}),
         mountedBy: meta.mountedBy,
     };

package/dist/core/trace.d.ts

@@ -529,11 +529,10 @@ export type TraceEvent = {
 } | {
     /**
      * The auto-mode classifier decided (or declined to decide) one pending ask — one frame per
-     * `decide` call, including the breaker-open short-circuit, so a consumer can read the gate's
-     * wall-clock cost per tool call and the failure cause behind an ask that reached a person. A
-     * TRACE frame rather than a task event: it fires once per gated call, it is an operator's read
-     * (why did that ask take four seconds / why did it fall back), and the session-level breaker
-     * read face a shell renders is a separate, additive wire face. `ms` is the wall time from the
+     * `decide` call, so a consumer can read the gate's wall-clock cost per tool call and the failure
+     * cause behind a call the classifier could not evaluate. A TRACE frame rather than a task event: it
+     * fires once per gated call and it is an operator's read (why did that ask take four seconds / why
+     * was that call denied). `ms` is the wall time from the
      * decide call to its verdict (timeout included: a timed-out round reads the deadline).
      */
     kind: "auto_mode.classified";
@@ -547,8 +546,8 @@ export type TraceEvent = {
     ms: number;
     /** The verdict kind the gate acted on (`allow` / `block` / `unavailable` / `parse_error`). */
     verdict: "allow" | "block" | "unavailable" | "parse_error";
-    /** Present iff `verdict === "unavailable"`: `error` / `timeout` / `breaker_open`. */
-    cause?: "error" | "timeout" | "breaker_open";
+    /** Present iff `verdict === "unavailable"`: `error` / `timeout`. */
+    cause?: "error" | "timeout";
     ts: number;
 } | {
     /** C1 — the failover brain served this call from a FALLBACK entry (`createFailoverBrain`): the