@sema-agent/core 7.11.2 → 7.13.0

package/dist/core/runner/assemble-result.js

@@ -41,6 +41,9 @@ function assistantText(msg) {
         .join("");
     return stripThinkTags(text);
 }
+export function answerSettled(final, continuationCut = false) {
+    return final?.stopReason === "stop" && final.partialFinalized !== true && !continuationCut;
+}
 export function terminalCauseOf(final, stats, flags) {
     let terminal;
     let apiFailure;
@@ -96,7 +99,7 @@ export function terminalCauseOf(final, stats, flags) {
     else if (flags.paused) {
         terminal = flags.paused;
     }
-    else if ((flags.abortedLive || final?.stopReason === "aborted") && !haltOwnsAbortedFinal) {
+    else if ((flags.abortedLive || final?.stopReason === "aborted") && !haltOwnsAbortedFinal && flags.answerSettled !== true) {
         const code = flags.abortedForTimeout ? "limits.max_walltime_exceeded" : flags.abortedForTurns ? "limits.max_turns_exceeded" : undefined;
         terminal = { kind: "failed", ...(code !== undefined ? { code } : {}), message: final?.errorMessage ?? (flags.abortedForTurns ? "max turns exceeded" : "run aborted") };
     }

package/dist/core/runner/compaction-seams.d.ts

@@ -0,0 +1,42 @@
+import type { MaybeCompactOptions } from "../auto-compaction.js";
+import type { TaskSpec } from "../types.js";
+import type { Prepared, RunnerDepsSeat } from "./contracts.js";
+/**
+ * design/84 Seam C — the cost-optimization compaction options threaded into BOTH `maybeCompact` call
+ * sites (within-task turn boundary + `finish()`). All three fields come from `RunnerDeps` (a trusted
+ * FUNCTION seam — never `TaskSpec`, which is serializable/durable-resumable/untrusted-caller). The
+ * Runner OWNS the consecutive-reuse counter (`prepared.compactionReuseRef`) so the
+ * `maxConsecutiveProviderReuse` drift guard spans the whole task across both sites: it FEEDS the current
+ * count in as `consecutiveProviderReuse`, and {@link recordCompactionReuse} updates it from the result.
+ * Returns `undefined` when no provider is wired (so the call site spreads nothing → byte-identical to
+ * the pre-design/84 behavior).
+ */
+export declare function seamCCompactionOptions(runner: RunnerDepsSeat, prepared: Prepared): Pick<MaybeCompactOptions, "summaryProvider" | "onCompaction" | "maxConsecutiveProviderReuse" | "consecutiveProviderReuse"> | undefined;
+/** design/134 §3.2 — resolve the pre/postCompact lifecycle callbacks (whole-slot `spec.hooks ??
+ *  deps.hooks`, same resolution as the stop hook) and wrap each in a SWALLOW+TRACE shell before
+ *  threading them into maybeCompact. The wrapper owns the observability half of the R3 MED contract
+ *  (maybeCompact swallows defensively too, but has no sink): a throwing callback is reported via
+ *  `onError(phase:"hook")` and treated as absent; a `block` returned under a "forced" trigger is
+ *  reported as ignored (maybeCompact enforces the ignore — blocking a compaction the provider/trim
+ *  layer already demanded would kill the run). */
+export declare function compactionHookOptions(runner: RunnerDepsSeat, spec: TaskSpec, sessionId: string, trigger: "auto" | "manual" | "forced", 
+/** #281 件A — the leg's identity envelope, spread onto both compaction contexts by the wrappers
+ *  below (the compaction module builds its contexts below the runner and cannot know the leg;
+ *  the wrapper is the runner's seam). Every runner call site supplies `prepared.hookIdentity`;
+ *  optional only so a context built without a leg stays honestly identity-less. */
+identity?: import("../hooks.js").HookInvocationIdentity, 
+/** The leg's already-validated seat bound (`Prepared.hookTimeoutMs`) and its abort signal. Optional
+ *  for the same reason `identity` is — a wrapper built without a prepared leg still works, on the
+ *  default bound and with no signal. The signal is what keeps a hung compaction hook from holding a
+ *  CANCELLED run's turn boundary for the whole deadline (the seat's post-abort grace). */
+seatBound?: {
+    timeoutMs: number;
+    signal?: AbortSignal;
+}): Pick<MaybeCompactOptions, "trigger" | "preCompact" | "postCompact">;
+/** design/84 Seam C — fold a finished compaction's `reused` flag into the run-scoped consecutive-reuse
+ *  counter: a reused (provider) summary increments it, a real (LLM) summary resets it to 0. A no-op
+ *  compaction (`compacted:false`) leaves the counter untouched. No-op when no provider is wired. */
+export declare function recordCompactionReuse(runner: RunnerDepsSeat, prepared: Prepared, comp: {
+    compacted: boolean;
+    reused?: boolean;
+}): void;

package/dist/core/runner/compaction-seams.js

@@ -0,0 +1,80 @@
+import { hookSeatExpiredError, resolveHookTimeoutMs, runHookSeat } from "../hooks.js";
+export function seamCCompactionOptions(runner, prepared) {
+    if (!runner.deps.summaryProvider)
+        return undefined;
+    return {
+        summaryProvider: runner.deps.summaryProvider,
+        onCompaction: runner.deps.onCompaction,
+        maxConsecutiveProviderReuse: runner.deps.maxConsecutiveProviderReuse,
+        consecutiveProviderReuse: prepared.compactionReuseRef.consecutive,
+    };
+}
+export function compactionHookOptions(runner, spec, sessionId, trigger, identity, seatBound) {
+    const hooks = spec.hooks ?? runner.deps.hooks;
+    const pre = hooks?.preCompact;
+    const post = hooks?.postCompact;
+    const seatMs = seatBound?.timeoutMs ?? resolveHookTimeoutMs(hooks?.timeoutMs);
+    const seatSignal = seatBound?.signal;
+    const withIdentity = (ctx) => identity !== undefined ? { ...ctx, identity } : ctx;
+    return {
+        trigger,
+        ...(pre
+            ? {
+                preCompact: async (rawCtx) => {
+                    const ctx = withIdentity(rawCtx);
+                    const report = (err) => {
+                        try {
+                            runner.deps.onError?.(err, { phase: "hook", sessionId });
+                        }
+                        catch {
+                        }
+                    };
+                    try {
+                        const seat = await runHookSeat("preCompact", { timeoutMs: seatMs, ...(seatSignal !== undefined ? { signal: seatSignal } : {}) }, (sig) => pre.call(hooks, { ...ctx, signal: sig }));
+                        if (seat.expired) {
+                            report(hookSeatExpiredError("preCompact", seatMs, seat.cause, `the "${ctx.trigger}" compaction PROCEEDED unblocked and with no additional instructions`));
+                            return undefined;
+                        }
+                        const r = seat.value;
+                        if (r?.block && ctx.trigger === "forced") {
+                            report(new Error(`a preCompact callback blocked a "forced" compaction — ignored (PTL/trim-pressure compaction is not optional): ${r.block}`));
+                        }
+                        return r;
+                    }
+                    catch (err) {
+                        report(err instanceof Error ? err : new Error(String(err)));
+                        return undefined;
+                    }
+                },
+            }
+            : {}),
+        ...(post
+            ? {
+                postCompact: async (rawCtx) => {
+                    try {
+                        const seat = await runHookSeat("postCompact", { timeoutMs: seatMs, ...(seatSignal !== undefined ? { signal: seatSignal } : {}) }, (sig) => post.call(hooks, { ...withIdentity(rawCtx), signal: sig }));
+                        if (seat.expired) {
+                            try {
+                                runner.deps.onError?.(hookSeatExpiredError("postCompact", seatMs, seat.cause, "the observation was abandoned; the compaction that already landed is unchanged"), { phase: "hook", sessionId });
+                            }
+                            catch {
+                            }
+                        }
+                    }
+                    catch (err) {
+                        try {
+                            runner.deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "hook", sessionId });
+                        }
+                        catch {
+                        }
+                    }
+                },
+            }
+            : {}),
+    };
+}
+export function recordCompactionReuse(runner, prepared, comp) {
+    if (!runner.deps.summaryProvider || !comp.compacted)
+        return;
+    prepared.compactionReuseRef.consecutive = comp.reused ? prepared.compactionReuseRef.consecutive + 1 : 0;
+}

package/dist/core/runner/contracts.d.ts

@@ -22,7 +22,7 @@ import type { WorkflowSizeGuideline } from "../../orchestration/workflow-size-gu
 import type { ToolManifestRow } from "../../prompt-assembly/tool-catalog.js";
 import type { CwdRef, ReadFace } from "../../tools/fs/index.js";
 import type { MaterializedA2a } from "../a2a.js";
-import type { CompactionForkContext, MaybeCompactOptions, RapidRefillState } from "../auto-compaction.js";
+import type { CompactionForkContext, CompactionPhaseDurations, MaybeCompactOptions, RapidRefillState } from "../auto-compaction.js";
 import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import type { CacheBreakDetector, ToolFingerprintInput } from "../cache-break-detector.js";
@@ -652,6 +652,24 @@ export interface Prepared {
     callIssuedAtRef: {
         current?: number;
     };
+    /** #677 — was the run's WORK cut by a stop? Two observation points, one record, read by the answer-settled
+     *  verdict (`answerSettled`) beside the harness's own undrained-input account:
+     *  - `continuation` — the loop decided to CONTINUE past its last assistant turn and the abort caught it
+     *    before that continuation dispatched. Written by the loop-trace sink from the loop's own steps: a
+     *    `continue` step (a drained steer / follow-up, a truncated-output or thinking-only or degenerate-output
+     *    nudge, a next tool turn) sets it; the terminal step clears it unless the loop exited at its
+     *    pre-dispatch abort guard (`aborted_before_stream`) — the one exit where `final` is still the PREVIOUS
+     *    turn's message. A clean "stop" the loop itself had decided was not the end is not a settled answer.
+     *  - `abortedBeforeTurnEnd` — the run's abort was already in force when a turn ENDED (written by the
+     *    `turn_end` handler before the turns cap fires its own abort). The ruling's line is the last
+     *    `turn_end`: a stop that landed before it landed on work — even when the brain ignored the signal
+     *    and delivered a full "stop" answer through it (the loop then ends at its own decision, so the
+     *    continuation bit never sets); a stop that landed after it landed on the tail.
+     *  Always present; both false on a run nothing stopped. */
+    workCutRef: {
+        continuation: boolean;
+        abortedBeforeTurnEnd: boolean;
+    };
     /** RB-458 — records the FIRST brain call this run's outer guardrail gave up on (see
      *  {@link import("../../brain/timeout.js").withBrainCallGuardrail}). Always present; `timedOut`
      *  stays absent unless the guardrail fired. The run loop reads it AFTER the loop settles and gives
@@ -1778,14 +1796,6 @@ export interface RunInternals {
      * channel, same posture as every other field here.
      */
     sessionReadStates?: SessionReadFileStates;
-    /**
-     * #616 — the Runner's per-session breaker ledger ({@link import("../auto-mode.js").AutoModeBreakerLedger}):
-     * the arming site's `onBreakerOpen` wrap records a trip here, the wiring-manifest phase of a LATER leg of
-     * the same session reads the most recent one onto `autoMode.breaker`. Always set by the Runner's own
-     * prepare call (overriding any caller value, like `sessionReadStates` beside it); absent on a standalone
-     * prepareTask, where no trip is recorded and none is reported. Trusted internals channel.
-     */
-    autoModeBreakerLedger?: import("../auto-mode.js").AutoModeBreakerLedger;
     onTaskNotification?: (notification: TaskNotificationPayload, 
     /** Injection tier (design/373 — the ladder is LIVE): "next" = the running turn's next boundary
      *  (arrival order, consecutive frames batch); "later" = the run's would-otherwise-stop seat
@@ -2340,13 +2350,11 @@ export interface TurnBoundaryDeps {
     drainManualCompact: (outcome: CompactOutcome) => void;
     runnerHooks: {
         onError: RunnerDeps["onError"];
-        seamCCompactionOptions: (prepared: Prepared) => Pick<MaybeCompactOptions, "summaryProvider" | "onCompaction" | "maxConsecutiveProviderReuse" | "consecutiveProviderReuse"> | undefined;
-        compactionHookOptions: (spec: TaskSpec, sessionId: string, trigger: "auto" | "manual" | "forced") => Pick<MaybeCompactOptions, "trigger" | "preCompact" | "postCompact">;
-        recordCompactionReuse: (prepared: Prepared, comp: {
-            compacted: boolean;
-            reused?: boolean;
-        }) => void;
     };
+    /** The Runner's deployment deps, read LIVE ({@link RunnerDepsSeat}): the compaction seams (compaction-seams.ts) the
+     *  boundary's compaction pass reaches down for read the summary provider, the hooks slot and the error sink through it
+     *  on every pass — the three Runner methods that used to sit on `runnerHooks` as delegates (design/393 S7). */
+    runner: RunnerDepsSeat;
 }
 /** design/157 B15 尾件 — R5(harness 事件处理器族)的依赖包。全部为 runLocked 内声明顺序早于
  *  工厂调用点的 const 稳定引用 + 三个 runLocked 形参;this 面(deps.onError)经 runnerHooks 打包
@@ -2431,6 +2439,28 @@ export interface RunnerSelfSeat {
     /** Streaming form of {@link RunnerSelfSeat.resume}: the pre-CAS guards and the CAS run first, then the live stream is returned. */
     resumeStream(token: CheckpointToken, outcome: ResumeOutcome, taskConfig: ResumeTaskConfig, internals?: RunInternals): Promise<TaskStream>;
 }
+/**
+ * design/393 S7 (#675) — the orchestrator's entry (`prepareTask`, prepare-task.ts) as ONE contract: the notification lane's
+ * `prepareTask` seat names it, and the orchestrator pins its own declaration against it (`PrepareTaskIsTheContract`), so a
+ * signature change reds at the declaration — not at the driver's hand-in, and not as a seat spelled a second time. It lives
+ * on the floor because a lane may not name the orchestrator (docs/LAYERING.json: layer 4 sits above the lanes). Positional,
+ * exactly as the entry is declared — the seat carries the orchestrator's function itself, not a lane Input.
+ */
+export type PrepareTaskFn = (spec: TaskSpec, deps: RunnerDeps, sessions: SessionStore, resume?: PrepareResume, internals?: RunInternals, runnerSelf?: RunnerSelfSeat, runIdSink?: {
+    runId?: string;
+}) => Promise<Prepared>;
+/**
+ * design/393 S7 (#670) — the Result of an INSTALLING phase: a lane whose every product is installed on a seat it borrowed
+ * (the harness's stop gate and recovery chain, the run state's counter groups, the stream's result setter, the claimed
+ * row's registries) hands nothing back, and says so by extending this marker. The marker is machine-read by gate:phase-api
+ * (design/238 R-1's third clause): a Result with no members MUST extend it, a Result with members MAY NOT, and no Result
+ * inherits anything else — so an empty Result is a stated fact about the phase, never an interface someone forgot to
+ * fill, and a phase that starts handing a product back must drop the declaration in the same edit. Six lanes carry it:
+ * the attachment seats, the stop gate, the recovery lanes, the settle and teardown (run-), the preflight and the claim
+ * (resume-).
+ */
+export interface InstallingPhaseResult {
+}
 /** The live-task handle `runLocked` publishes once the harness exists (design/47): the harness + abort
  *  controller, the loop-liveness latch (`ended` flips when the single `harness.prompt` settles; `userInterrupted`
  *  / `userHalted` are the interrupt and halt verbs' attribution seats), the run's reminder mark, its session and
@@ -2475,6 +2505,46 @@ export interface ManualCompactRef {
     emitMooted?: (reason: string) => void;
     closed?: boolean;
 }
+/**
+ * design/393 S6 — the end-of-task compaction pass's outcome (`Runner.finish`'s return): what the terminal-adoption lane
+ * hands the settle lane, which reads it for the `compacted` frame, the phase-timings frame and the detector reset. Named
+ * once here so the two lanes and the method spell one type.
+ */
+export type EndOfTaskCompaction = {
+    compacted: boolean;
+    tokensBefore?: number;
+    triggerTokens?: number;
+    postTriggerTokens?: number;
+    durationMs?: number;
+    phaseDurations?: CompactionPhaseDurations;
+    firstKeptEntryId?: string;
+    attachedFiles?: Array<{
+        path: string;
+        chars: number;
+        truncated: boolean;
+    }>;
+    modelFallback?: true;
+    fallbackReason?: "window";
+    clampedRatio?: number;
+    clampReason?: "budget" | "tolerance";
+} | undefined;
+/**
+ * design/393 S6 — the notification lane's BINDINGS: the run-notification-lane's own four `let`s as ONE seat (getters
+ * and setters over the lane's variables, never a copy). The identity-wiring lane binds `harness` / `sessionId` /
+ * `ident` the moment `prepared` exists (the lane's closures read them by variable — the routing listener, the park
+ * destination, the injection entry); the leg lane flips `live` in its finally, from which point every notification
+ * parks per session for the next run. One seat, four slots; nothing copies a binding out of it.
+ */
+export interface NotificationLaneBindings {
+    harness: AgentHarness | undefined;
+    sessionId: string | undefined;
+    ident: () => {
+        eventId?: string;
+        parentToolCallId?: string;
+        sourceTaskId?: string;
+    };
+    live: boolean;
+}
 /** design/144 §2 — the `notify()` bridge: `runLocked` binds `inject` the moment the task-notification lane exists. */
 export interface NotifyRef {
     inject?: (n: TaskNotificationPayload, opts?: {

package/dist/core/runner/denial-limit-arms.d.ts

@@ -32,8 +32,7 @@ export interface InheritedAutoMode {
  * recorded recipe — `rebuildAutoModeDecider` hands back a decider and its arming, nothing live)
  * carries no denial tracker, and an entry with a decider but no tracker would count nothing: the
  * rebuilt classifier could block without bound on the redeemed leg, the exact gap the limit closes.
- * Attach a FRESH tracker (a fresh COUNT is the documented cross-process semantics — the breaker
- * restarts the same way) under the ancestor's recorded BOUNDS tightened by this deployment's own
+ * Attach a FRESH tracker (a fresh COUNT is the documented cross-process semantics) under the ancestor's recorded BOUNDS tightened by this deployment's own
  * (#556, `tightenDenialLimit` — the same rule and the same call the arming fold makes, so the
  * recipe's account of the criteria and the tracker's actual bounds cannot drift). Before #556 the
  * bounds came from this deployment alone, so an ancestor that allowed three consecutive blocks
@@ -84,8 +83,8 @@ export type InheritedAsk = Extract<PermissionResult, {
 }>;
 /** The members of a surviving ask that ride onto the approval request with a COMPUTED value — what the
  *  four request mint stations (the gate's own and the three inherited-lane ones) spread after the seats
- *  they spell themselves: the ask's origin word, its denial-limit fallback and the classifier-unavailable
- *  fact (#616). */
+ *  they spell themselves: the ask's origin word, its denial-limit fallback and a policy-declared
+ *  classifier-unavailable fact (#616; the engine's own fact rides the DENY since #661). */
 export interface AskRequestCarry {
     origin?: AskOrigin;
     denialLimitFallback?: DenialLimitFallback;
@@ -117,18 +116,15 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
     kind: "deny";
     result: PermissionResult;
 }
-/** Proceed to the frozen approver with `ask`: the incoming ask unchanged (classifier unavailable,
- *  excluded, or not armed), or — at the bound — the fallback ask minted from it (`mintedHere`).
+/** Proceed to the frozen approver with `ask`: the incoming ask unchanged (classifier excluded or not
+ *  armed), or — at the bound — the fallback ask minted from it (`mintedHere`).
  *  `fallback` is the member riding the ask either way (an incoming one is a deeper ancestor's).
  *  `origin` is the ask's word under the station facts, threaded to the request mint: on the two
  *  unchanged-ask branches it is the SAME read the exclusion judged by (a caller-owned decision with a
  *  stateful accessor cannot answer the exclusion with one word and the card with another); on the
  *  bound branch it is derived from the re-spoken ask this station minted (its own object). */
-/** `ask` is the incoming ask unchanged — EXCEPT on an UNAVAILABLE round, where it is an engine-owned copy
- *  carrying `classifierUnavailable: { cause }` (#616): the fact rides the ASK because the ask is what the
- *  wrapper arms hand back to the gate when the frozen approver answers unavailable (the inherited-unavailable
- *  float), and the gate's own park carry reads the fact off the decision it parks — a side member on this
- *  judgment would have been lost on that route (codex r1). The request mint reads the same object. */
+/** `ask` is the incoming ask unchanged (the caller's own object); an UNAVAILABLE round never reaches this arm —
+ *  it is a `deny` carrying `classifierUnavailable: { cause }` (#661). */
  | {
     kind: "resolve";
     ask: A;
@@ -142,8 +138,9 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  * auto-allow (and the streak resets); `block` below the bound ⇒ deny, the exact verdict the ancestor's
  * gate would have produced; `block` AT the bound ⇒ the ask is re-spoken in the classifier's voice as
  * the fallback (`decisionReason:"classifier"`, `requiresRealApproval`, the member carrying counts +
- * window) for the arm to resolve at the frozen approver; anything else (unavailable / parse error /
- * excluded / no classifier) ⇒ the incoming ask, unchanged. The member may ALREADY be on the incoming
+ * window) for the arm to resolve at the frozen approver; `parse_error` ⇒ the same block path with the CC
+ * parse-failure sentence (counted); `unavailable` ⇒ a DENY that says so, carrying the fact (#661, CC
+ * 2.1.250 form); excluded / no classifier ⇒ the incoming ask, unchanged. The member may ALREADY be on the incoming
  * ask (a deeper ancestor's fallback, minted inside the nested fold — the case the exclusion names):
  * it rides to the approver and the headless arm unchanged, whichever tracker minted it; only a
  * tracker that counted THIS streak is reset by the person's later allow (`mintedHere`).

package/dist/core/runner/denial-limit-arms.js

@@ -1,8 +1,8 @@
-import { createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
+import { CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, classifierUnavailableDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
 import { sanitizeAutoModeArmingRecipe, tightenDenialLimit } from "../auto-mode-arming.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
-import { askOriginOf, classifierMayAnswer } from "../ask-origin.js";
+import { askOriginOf, classifierMayAnswer, probeMandatedAsk } from "../ask-origin.js";
 export function attachRebuiltDenialTrackers(entries, denialLimit) {
     if (entries === undefined)
         return undefined;
@@ -76,8 +76,9 @@ export function inheritedAskCarry(judged, liveApprover, tracker) {
 export async function judgeInheritedClassifier(opts) {
     const { autoMode, ask, req } = opts;
     const origin = askOriginOf(ask, INHERITED_STATION_FACTS);
-    if (autoMode === undefined || !classifierMayAnswer(origin))
+    if (autoMode === undefined || !classifierMayAnswer(origin) || probeMandatedAsk(ask)) {
         return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
+    }
     const verdict = await autoMode.decider
         .decide({ req, ...(ask.message !== undefined ? { askMessage: ask.message } : {}) }, opts.signal)
         .catch(() => ({ kind: "unavailable", cause: "error" }));
@@ -85,19 +86,21 @@ export async function judgeInheritedClassifier(opts) {
         autoMode.denialTracking?.recordAllow();
         return { kind: "allow" };
     }
-    if (verdict.kind !== "block") {
-        const resolved = verdict.kind === "unavailable" ? { ...ask, classifierUnavailable: { cause: verdict.cause } } : ask;
-        return { kind: "resolve", ask: resolved, fallback: ask.denialLimitFallback, mintedHere: false, origin };
+    if (verdict.kind === "unavailable") {
+        return {
+            kind: "deny",
+            result: { action: "deny", message: classifierUnavailableDenyMessage(req.toolName, verdict.cause), decisionReason: "classifier", classifierUnavailable: { cause: verdict.cause } },
+        };
     }
-    const reason = verdict.reason ? inlineUntrusted(verdict.reason) : "";
-    const category = verdict.category ? inlineUntrusted(verdict.category) : "";
+    const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE;
+    const category = verdict.kind === "block" && verdict.category ? inlineUntrusted(verdict.category) : "";
     const tracked = autoMode.denialTracking?.recordBlock();
     if (tracked?.limitReached !== true) {
         return {
             kind: "deny",
             result: {
                 action: "deny",
-                message: `auto-mode classifier blocked ${opts.subject} at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
+                message: verdict.kind === "block" ? `auto-mode classifier blocked ${opts.subject} at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : `${reason} (${opts.subject}, at an inherited ancestor layer)`,
                 decisionReason: "classifier",
             },
         };

package/dist/core/runner/gate-exit.js

@@ -103,7 +103,15 @@ export async function exitGate(pass) {
         if (pass.deniedBy === undefined)
             throw new Error(`the tool gate refused "${toolName}" without a refusing layer — every deny site attributes itself`);
         const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}) });
-        await notifyPermissionDenied({ toolName, input: cloneObserverInput(pass.currentInput), toolCallId, reason: denyReason, gate, ...(input.identity !== undefined ? { identity: input.identity } : {}) });
+        await notifyPermissionDenied({
+            toolName,
+            input: cloneObserverInput(pass.currentInput),
+            toolCallId,
+            reason: denyReason,
+            gate,
+            ...(input.identity !== undefined ? { identity: input.identity } : {}),
+            ...(pass.decision.action === "deny" && pass.decision.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: pass.decision.classifierUnavailable.cause } } : {}),
+        });
         return {
             block: true,
             reason: formatHookFeedback(denyReason, input.reminderMark),

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -26,7 +26,8 @@
  * silence the ungated-write warning for deployments that wired no policy at all.
  */
 import type { AskRuleEvidence, ToolCallRequest } from "../tool-policy.js";
-import { persistedRuleMandateOf, type OrgGateVerdict, type PersistedRuleAnswer, type PersistedRuleHit, type PersistedRuleUnreadable } from "../hooks.js";
+import { persistedRuleMandateOf } from "../ask-origin.js";
+import { type OrgGateVerdict, type PersistedRuleAnswer, type PersistedRuleHit, type PersistedRuleUnreadable } from "../hooks.js";
 import type { PersistedRule, PersistedRuleVerdict, RuleOffer, SegmentCoverage } from "../permission-rule-model.js";
 import { type OrgRuleResolution } from "../permission-rule-org.js";
 import type { PermissionRuleStoreProvider } from "../permission-rule-provider.js";

package/dist/core/runner/permission-rule-lanes.js

@@ -1,4 +1,5 @@
-import { persistedRuleMandateOf } from "../hooks.js";
+import { persistedRuleMandateOf } from "../ask-origin.js";
+import {} from "../hooks.js";
 import { adjudicatePersistedPathRules, adjudicatePersistedRules, ruleToolGrammarOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
 import { isAbsolutePathForm } from "../../tools/fs/safety.js";
 import { effectivePathTargetOf } from "../effective-path-target.js";

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -49,7 +49,7 @@ export interface PrepareCapsAndWorkflowInput {
     deps: RunnerDeps;
     /** borrowed-readonly — the trusted spawn-side channel; the Workflow mount forwards `rootSessionId`, `placementRoot`,
      *  `onTaskNotification`, `workflowDepth`, and the capture-floor getter reads `memoryCaptureAncestors`. */
-    internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors" | "workflowParkedResume" | "autoModeBreakerLedger"> | undefined;
+    internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors" | "workflowParkedResume"> | undefined;
     /** borrowed-readonly — the acquired session; the classifier leg rebuilds its transcript window from `buildContext`. */
     session: Pick<StoredSession, "buildContext">;
     /** borrowed-readonly — the acquired session id (operator-line context, the refusal codes' phase record). */

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -195,11 +195,6 @@ export async function prepareCapsAndWorkflow(input) {
         autoModeDenialTracking = createAutoModeDenialTracker(am.denialLimit);
         autoModeDecider = createAutoModeDecider({
             ...(am.timeoutMs !== undefined ? { timeoutMs: am.timeoutMs } : {}),
-            ...(am.failureThreshold !== undefined ? { failureThreshold: am.failureThreshold } : {}),
-            onBreakerOpen: (info) => {
-                internals?.autoModeBreakerLedger?.record(sessionId, { openedAtMs: Date.now(), lastCause: info.lastCause, failures: info.consecutiveFailures, runId });
-                am.onBreakerOpen?.(info);
-            },
             onClassified: (info) => emitTrace(deps.tracer, () => ({
                 kind: "auto_mode.classified",
                 version: 1,

package/dist/core/runner/prepare-policy-chain.js

@@ -10,6 +10,7 @@ import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
 import { NAMESPACED_NAME_SHAPES, protocolOf } from "../protocol-table.js";
 import { emitTrace } from "../trace.js";
 import { createActiveSkillScopePolicy } from "./active-skill-scope.js";
+import { probeMandatedAsk } from "../ask-origin.js";
 import { headlessDenyAtFold, headlessDenyAtRecheck, inheritedAskCarry, judgeInheritedClassifier, lateAskSettlementObserver, settleDenialLimitFallback } from "./denial-limit-arms.js";
 import { askGrantShapeOf } from "./inherited-ask-grants.js";
 import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf } from "./permission-rule-lanes.js";
@@ -374,7 +375,7 @@ export async function preparePolicyChain(input) {
                     if (judged.kind === "deny")
                         return judged.result;
                     const { ask: inheritedAsk, fallback, mintedHere } = judged;
-                    if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName)) {
+                    if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName) && !probeMandatedAsk(inheritedAsk)) {
                         recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                         return { action: "allow" };
                     }
@@ -454,7 +455,7 @@ export async function preparePolicyChain(input) {
                     if (judged.kind === "deny")
                         return judged.result;
                     const { ask: inheritedAsk, fallback, mintedHere } = judged;
-                    if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName)) {
+                    if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName) && !probeMandatedAsk(inheritedAsk)) {
                         recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                         return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
                     }

package/dist/core/runner/prepare-protocol-tools.js

@@ -3,12 +3,17 @@ import { materializeMcpTools } from "../mcp.js";
 import { materializeA2aTools } from "../a2a.js";
 import { deliverEngineNotice } from "../types.js";
 import { RosterBuilder } from "../tool-roster.js";
+import { TOOL_WIRE_NAME_MAX_CHARS } from "../tool-face.js";
 import { REFRESH_MCP_TOOLS_TOOL_NAME, toolFace } from "../tool-catalog-entries.js";
 import { MCP_NAMESPACE, A2A_NAMESPACE } from "../protocol-table.js";
 import { mintNamespacePrefix } from "../protocol-naming.js";
 import { applyMcpToolFaces } from "./tool-face-overlay.js";
 export async function prepareProtocolTools(input) {
     const { lockedPreflight, spec, deps, reminderMark, reminderDisclosureCounts, runId, sessionId, onceLedger, roster, rosterSeat, remoteToolOffload, toolFaceSnapshot, toolEffects, axisExplicitNegatives, irreversibilityTier, irreversibleTools, egressTools, abortController, rollback } = input;
+    const overPeer = (lockedPreflight.mcp ?? []).find((s) => s.name.length > TOOL_WIRE_NAME_MAX_CHARS);
+    if (overPeer !== undefined) {
+        throw Object.assign(new Error(`MCP server name ${JSON.stringify(overPeer.name.slice(0, 40) + "…")} is ${overPeer.name.length} characters; a peer rides every roster row of its tools and the roster's bound on a name is ${TOOL_WIRE_NAME_MAX_CHARS}.`), { code: "config.tool_name_too_long" });
+    }
     const mcp = lockedPreflight.mcp?.length
         ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer, { reminderMark, counts: reminderDisclosureCounts }, mcpRevocationWiring(deps, runId))
         : { tools: [], toolAxes: [], warnings: [], serverInstructions: [], instructionsDelta: { pendingAdds: [], pendingRemovals: [] }, droppedTools: [], statuses: [], refresh: async () => [], dispose: async () => { } };

package/dist/core/runner/prepare-safety-scan.js

@@ -1,7 +1,6 @@
 import { NAMESPACED_NAME_SHAPES } from "../protocol-table.js";
 import { engineCardTypes, handBandEffects } from "../tool-registry.js";
-import { TOOL_CONTRACT_MAX_CHARS, TOOL_WIRE_NAME_MAX_CHARS } from "../tool-face.js";
-import { callerCardIdOf, offendingResultCard, schemaKeyBoundProblem } from "../tool-roster.js";
+import { callerCardIdOf, offendingResultCard, rosterMemberBoundProblem, schemaKeyBoundProblem } from "../tool-roster.js";
 import { toolFaceProblem } from "./tool-face-overlay.js";
 import { OFFLOAD_TOOL_NAME } from "../tool-result-store.js";
 import { PRESENT_PLAN_TOOL_NAME, ENTER_PLAN_MODE_TOOL_NAME } from "../present-plan-tool.js";
@@ -16,23 +15,19 @@ export function prepareSafetyScan(input) {
     const axisExplicitNegatives = new Map();
     const reversibilityProbes = new Map();
     for (const t of spec.tools ?? []) {
-        if (t.name.length > TOOL_WIRE_NAME_MAX_CHARS) {
-            const e = new Error(`Tool name "${t.name.slice(0, 40)}…" is invalid: ${t.name.length} characters, the roster's bound is ${TOOL_WIRE_NAME_MAX_CHARS}.`);
-            e.code = "config.tool_name_too_long";
-            throw e;
-        }
-        for (const alias of t.aliases ?? []) {
-            if (alias.length > TOOL_WIRE_NAME_MAX_CHARS) {
-                const e = new Error(`Tool alias "${alias.slice(0, 40)}…" (of "${t.name}") is invalid: ${alias.length} characters, the roster's bound is ${TOOL_WIRE_NAME_MAX_CHARS}.`);
-                e.code = "config.tool_name_too_long";
+        {
+            const bound = rosterMemberBoundProblem({
+                name: t.name,
+                aliases: t.aliases,
+                ...(t.contract !== undefined ? { contractId: t.contract.contractId, implementationRevision: t.contract.implementationRevision } : {}),
+                ...(typeof t.modelGate === "string" ? { modelGate: t.modelGate } : {}),
+            });
+            if (bound !== undefined) {
+                const e = new Error(`Tool "${t.name.slice(0, 40)}" cannot ride a roster row: ${bound.message}.`);
+                e.code = bound.code;
                 throw e;
             }
         }
-        if (t.contract !== undefined && (t.contract.contractId.length > TOOL_CONTRACT_MAX_CHARS || t.contract.implementationRevision.length > TOOL_CONTRACT_MAX_CHARS)) {
-            const e = new Error(`Tool "${t.name}" declares a contract member over ${TOOL_CONTRACT_MAX_CHARS} characters (contractId ${t.contract.contractId.length}, implementationRevision ${t.contract.implementationRevision.length}) — the roster's bound.`);
-            e.code = "config.tool_contract_too_long";
-            throw e;
-        }
         {
             const keyProblem = schemaKeyBoundProblem(t.parameters);
             if (keyProblem !== undefined) {

package/dist/core/runner/prepare-suspend-saga.d.ts

@@ -17,7 +17,6 @@
  * the boundary parks and the park closure key off `saga`'s presence, so the orchestrator grows no branch.
  */
 import type { AgentHarness, ExecutionEnv } from "../../internal/harness.js";
-import type { AutoModeDecider } from "../auto-mode.js";
 import type { OwnOrgAdmissionVerdict } from "../memory-admission.js";
 import type { RemoteExecutionEnv, SnapshotId } from "../remote-env.js";
 import type { CheckpointStore, SerializedCheckpointState } from "../checkpoint-store.js";
@@ -128,7 +127,6 @@ export interface PrepareSuspendSagaInput {
     /** borrowed-readonly — the auto-mode intent (seat ∨ live ∨ seed), carried while the latch is healthy. */
     autoModeIntent: boolean;
     /** borrowed-readonly — the auto-mode decider, or undefined (the latch-health reading only). */
-    autoModeDecider: AutoModeDecider | undefined;
     /** borrowed-readonly — the inherited admitted org scopes, or undefined (copied onto the row). */
     inheritedAdmittedOrgScopes: readonly string[] | undefined;
     /** borrowed-readonly — this leg's OWN org verdict seat; `current` is read at mint time. Not written here. */

package/dist/core/runner/prepare-suspend-saga.js

@@ -77,16 +77,8 @@ export async function compensateUnparkedPause(remoteEnv, snapshotId, io) {
 function stampPlacementRootSessionId(placementRootResolved) {
     return placementValueOrAbsent(placementRootResolved);
 }
-function autoModeLatchHealthy(d) {
-    try {
-        return d.breakerOpen() !== true && typeof d.consecutiveFailures === "function" && d.consecutiveFailures() === 0;
-    }
-    catch {
-        return false;
-    }
-}
 export function prepareSuspendSaga(input) {
-    const { gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, inheritedParentConstraints, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, autoModeIntent, autoModeDecider, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter } = input;
+    const { gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, inheritedParentConstraints, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, autoModeIntent, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter } = input;
     if (!gateMachineryActive)
         return { saga: undefined };
     const inFlightSpendMicroUsd = () => {
@@ -140,7 +132,7 @@ export function prepareSuspendSaga(input) {
             const constraintDigest = (inheritedParentConstraints?.length ?? 0) > 0
                 ? constraintChainDigest(constraintChain)
                 : seedInheritedGate?.constraintDigest;
-            const autoModeIntentCarried = autoModeIntent && (autoModeDecider === undefined || autoModeLatchHealthy(autoModeDecider));
+            const autoModeIntentCarried = autoModeIntent;
             return inheritedAncestorRules !== undefined ||
                 inheritedShellGate !== undefined ||
                 autoModeIntentCarried ||

package/dist/core/runner/prepare-task.d.ts

@@ -8,7 +8,7 @@ export { mcpManifestEntries } from "./prepare-wiring-manifest.js";
 export { __resetMaterializeEnvAnnouncements } from "./prepare-tool-disclosure-mount.js";
 export { fileHistoryFilesystemIdentity, resolveFileHistoryScope } from "./prepare-file-history.js";
 import type { RunnerSelfSeat } from "./contracts.js";
-import type { Prepared, PrepareResume, RunInternals } from "./contracts.js";
+import type { Prepared, PrepareResume, PrepareTaskFn, RunInternals } from "./contracts.js";
 export type { FileHistoryBoundarySeat, InheritedGate, Prepared, PreparedMicroCompact, PrepareResume, ResolvedWorkspace, RunInternals, UsageGovernance } from "./contracts.js";
 import type { ExecutionEnv } from "../../internal/harness.js";
 import type { RunnerDeps, TaskSpec } from "../types.js";
@@ -114,3 +114,11 @@ runnerSelf?: RunnerSelfSeat,
 runIdSink?: {
     runId?: string;
 }): Promise<Prepared>;
+/** design/393 S7 (#675) — the entry IS the contract the notification lane's seat names ({@link PrepareTaskFn}, contracts.ts):
+ *  a signature change reds HERE, at the declaration, as `false` failing the `true` bound. IDENTITY, not assignability (review
+ *  round 1): the parameter tuple (arity, optionality, each type) and the return type must be the SAME type in both directions —
+ *  one-way `extends` let a dropped trailing parameter, an added optional one or a narrowed return slip through. Type-level only —
+ *  nothing is emitted. */
+type Holds<T extends true> = T;
+type Same<A, B> = (<T>() => T extends A ? 1 : 2) extends <T>() => T extends B ? 1 : 2 ? true : false;
+export type PrepareTaskIsTheContract = Holds<Same<Parameters<typeof prepareTask>, Parameters<PrepareTaskFn>>> & Holds<Same<ReturnType<typeof prepareTask>, ReturnType<PrepareTaskFn>>> & Holds<Same<ThisParameterType<typeof prepareTask>, ThisParameterType<PrepareTaskFn>>> & Holds<Same<typeof prepareTask, PrepareTaskFn>>;