@sema-agent/core 7.12.0 → 7.14.0

package/dist/core/runner/stream-lifecycle-verbs.js

@@ -114,9 +114,18 @@ export function streamLifecycleVerbs(input) {
         detachHub.request(toolCallId);
     };
     const interrupt = async () => {
+        const interruptRefused = (msg) => {
+            const e = new Error(`cannot interrupt: ${msg}`);
+            e.code = "steering.not_running";
+            return e;
+        };
+        if (live.resultValue)
+            throw interruptRefused("the task has already finished");
         const h = live.handle ?? (await orTimeout(ready));
         if (!h)
-            return;
+            throw interruptRefused("the task is not running");
+        if (live.resultValue !== undefined || h.loop.ended)
+            throw interruptRefused("the task is no longer running");
         if (!h.abortController.signal.aborted)
             h.loop.userInterrupted = true;
         h.abortController.abort();

package/dist/core/runner/stream-settle-backstop.js

@@ -83,7 +83,7 @@ export function streamSettleBackstop(input) {
                     ? { retryAfterMs: hinted }
                     : {};
             })(),
-            stats: { turns: 0, tokens: 0, toolCalls: 0, cachedTokens: 0, costMicroUsd: 0 },
+            stats: { turns: 0, tokens: 0, toolCalls: 0, cachedTokens: 0, costMicroUsd: 0, usageMissing: true },
         };
         emitTrace(entryTracer.tracer, () => ({
             kind: "task.end",

package/dist/core/runtime-caps.d.ts

@@ -84,6 +84,19 @@ export interface WorkflowGovernanceBaseline {
  * These six are the caps the ENGINE enforces; `allowUltracode`/`allowBypassPermissions` are shell-UX /
  * service-settings-layer concerns (see {@link RunnerDeps.runtimeCapsResolver}).
  */
+/**
+ * #692 C-d — WHICH plane's ratchet denied auto mode, when the resolver knows: the three settings sources
+ * CC 2.1.250's `permissions.disableAutoMode` can come from, as the resolver folds them into the one deny bit
+ * ({@link RuntimeCaps.autoMode} `=== false`). `org` = a managed / organization policy plane; `local` = the
+ * machine's local settings; `settings` = the user's / project's settings file. Read ONLY beside the deny bit
+ * (a source with no denial is a contradiction the value screen refuses as a resolver fault); projected onto
+ * the leg's manifest read face (`WiringManifest.autoMode.deniedSource`) so a shell can say "your organization
+ * turned auto mode off" vs "your settings did" instead of one word for both.
+ */
+export declare const AUTO_MODE_DENY_SOURCES: readonly ["org", "local", "settings"];
+export type AutoModeDenySource = (typeof AUTO_MODE_DENY_SOURCES)[number];
+/** Membership test for {@link AutoModeDenySource}. */
+export declare function isAutoModeDenySource(v: unknown): v is AutoModeDenySource;
 export interface RuntimeCaps {
     /** `false` DENIES workflow self-orchestration for this principal server-side — even on a deployment that is
      *  capable ({@link RunnerDeps.workflowScriptRunner} + governance). The third stage of the workflows gate.
@@ -136,6 +149,14 @@ export interface RuntimeCaps {
      * A denial resolves to a no-op (asks flow the original chain; no warn — the gate, not a mistake).
      */
     autoMode?: boolean;
+    /**
+     * #692 C-d (additive) — WHICH source's ratchet set {@link autoMode} to `false`, when the resolver folded
+     * several ({@link AutoModeDenySource}). Optional: a resolver that does not track sources omits it and the
+     * manifest reads `denied` with no source. Present with `autoMode` not `false`, or spelled outside the set,
+     * is a resolver FAULT (announced through `onError`, the deny bit coined fail-closed, `resolver_fault` on the
+     * manifest) — a source named for a denial that did not happen is a marshalling error, never a fact.
+     */
+    autoModeDenySource?: AutoModeDenySource;
     /**
      * design/383 §3.1 — may this principal declare a session memory-capture OPT-OUT
      * (`TaskSpec.memory.capture: "off"` / the Runner flip verb)? `false` = the deployment REQUIRES

package/dist/core/runtime-caps.js

@@ -1 +1,5 @@
-export {};
+export const AUTO_MODE_DENY_SOURCES = ["org", "local", "settings"];
+const AUTO_MODE_DENY_SOURCE_SET = new Set(AUTO_MODE_DENY_SOURCES);
+export function isAutoModeDenySource(v) {
+    return AUTO_MODE_DENY_SOURCE_SET.has(v);
+}

package/dist/core/task-event.d.ts

@@ -97,7 +97,16 @@ export type BrainStatusPhase = "rate_limited" | "retrying" | "reconnecting" | "c
  *  - `connect_refused` — the attempt got a definite negative about the target itself (nothing accepts
  *    at that address, or the name has no address). This is the class the SHORT retry lane serves.
  *  - `transport`      — any other transport-level failure: a connect timeout, a reset, a mid-stream
- *    tear, a stalled stream. No verdict about the target; the full ladder applies.
+ *    tear. No verdict about the target; the full ladder applies.
+ *  - `stall`          — no failure was observed on the link at all: THIS process cancelled its own
+ *    request because one of its stall watchdogs reached its deadline while the stream produced
+ *    nothing. The distinction from `transport` is WHO GAVE UP, and nothing more: a `transport` frame
+ *    reports something that happened to the call, a `stall` frame reports a local deadline. It is not
+ *    a verdict on the remedy — a blackholed connection (no reset, no close) produces silence, and
+ *    silence is what a watchdog measures, so a `stall` can still turn out to be a network fault; what
+ *    it always tells you truthfully is that the request was cancelled here, at a configured deadline,
+ *    rather than lost out there. Reporting these as `transport` asserted the opposite — that the link
+ *    had dropped — when nothing about the link was known at all.
  *  - `rate_limit`     — the provider asked the caller to slow down.
  *  - `server`         — the provider reported a failure on its own side.
  *  - `http`           — a response the status predicate calls terminal, retried anyway because the
@@ -105,7 +114,7 @@ export type BrainStatusPhase = "rate_limited" | "retrying" | "reconnecting" | "c
  *  - `output_cap`     — not a failure of the connection at all: the request is being re-sent with a
  *    lowered output cap after the provider reported the context limit exceeded (no backoff).
  */
-export type BrainRetryErrClass = "connect_refused" | "transport" | "rate_limit" | "server" | "http" | "output_cap";
+export type BrainRetryErrClass = "connect_refused" | "transport" | "stall" | "rate_limit" | "server" | "http" | "output_cap";
 /** design/99 §E3/§E10 — the payload of a {@link TaskEvent} `status` event (and the brain→runner signal). */
 export interface BrainStatus {
     phase: BrainStatusPhase;

package/dist/core/task-registry-shared.js

@@ -3,6 +3,7 @@ import { summarizeWorkflowRun } from "./workflow-run-store.js";
 import { delimitUntrusted } from "./untrusted-text.js";
 import { boundedRedactedSummary } from "./untrusted-egress.js";
 import { clipWithFilePointer } from "./tool-errors.js";
+import { announceEnvKnob } from "./env-knob-announce.js";
 export function mintCompletionId(target) {
     if (target.completionId === undefined)
         target.completionId = uuidv7();
@@ -61,14 +62,15 @@ const TASK_OUTPUT_DEFAULT_CHARS = 32_000;
 export const TASK_OUTPUT_MAX_CHARS = 160_000;
 const TASK_OUTPUT_MIN_CHARS = 512;
 function taskMaxOutputChars() {
-    const raw = process.env.TASK_MAX_OUTPUT_LENGTH;
-    if (!raw)
+    const rawEnv = process.env.TASK_MAX_OUTPUT_LENGTH;
+    if (rawEnv === undefined || rawEnv.trim() === "")
         return TASK_OUTPUT_DEFAULT_CHARS;
-    if (!/^\d+$/.test(raw.trim()))
-        return TASK_OUTPUT_DEFAULT_CHARS;
-    const n = parseInt(raw.trim(), 10);
-    if (!Number.isFinite(n) || n <= 0)
+    const raw = rawEnv.trim();
+    const n = /^\d+$/.test(raw) ? parseInt(raw, 10) : Number.NaN;
+    if (!Number.isFinite(n) || n <= 0) {
+        announceEnvKnob(`TASK_MAX_OUTPUT_LENGTH=${rawEnv} was ignored — it is not a positive whole number of characters. Using ${TASK_OUTPUT_DEFAULT_CHARS} instead.`);
         return TASK_OUTPUT_DEFAULT_CHARS;
+    }
     return Math.min(Math.max(n, TASK_OUTPUT_MIN_CHARS), TASK_OUTPUT_MAX_CHARS);
 }
 export function clipTaskOutput(s, fullOutputPath) {

package/dist/core/task-result.d.ts

@@ -25,6 +25,14 @@ import type { NestedUsage } from "./tool-spec.js";
  * Orchestrators that map an unexpected `suspended` should map an unexpected `needs_review` the same
  * hard-boundary way (it is, like `suspended`, only safe at the top-level `runTask` boundary).
  */
+/**
+ * Terminal vs waiting. Three words are TERMINAL — the leg is over and nobody is expected to act: `completed`,
+ * `failed`, and `blocked` (the AGENT's own report, through `report_blocked`, that it cannot finish and why —
+ * a self-report, not a pause; it waits for nobody). Two words are WAITING — a person's decision resumes the
+ * same leg through `runner.resume(token, …)`: `suspended` (a durable pre-action approval of a tool call) and
+ * `needs_review` (a durable review pause). The task-registry face spells the two waiting words as `parked`.
+ * A consumer that files `blocked` beside `suspended` is waiting on a decision that never comes.
+ */
 export type TaskStatus = "completed" | "blocked" | "failed" | "suspended" | "needs_review";
 /**
  * RB-439-a — one remote-workspace lifecycle failure, reported as data on {@link TaskResult.remoteEnvFailures}.
@@ -598,6 +606,13 @@ export interface TaskResult {
          * the compaction subtotal). OBSERVE-ONLY (never gates budget). The workflow display is unaffected (its agents
          * fail-on-suspend, never durably resume). A `spentToolCalls` ledger fold is a follow-on. */
         toolCalls?: number;
+        /** #692 C-b (additive): present (`true`) when the usage figures on this face are a LOWER BOUND rather than a
+         *  measurement — at least one model round of the leg reported no usage frame (the brain's `usageMissing`
+         *  mark; the same word the per-turn `turn_end` frame carries), or the result was minted by a host / an
+         *  orchestration lane that never ran a model round it could measure (a refused spawn's journal entry, a
+         *  prepare-time refusal, a synthetic abort). The numeric members stay required and stay what was counted:
+         *  `tokens: 0` beside this key reads "unknown", never "free". Absent ⇔ every round reported usage. */
+        usageMissing?: true;
         /** Prompt (input) tokens that MISSED the prefix cache, summed across the task's turns and normalized
          * across providers (Anthropic already reports `input_tokens` this way; OpenAI/vLLM include the cache
          * in theirs, so the subsets are removed). Mutually exclusive with `cachedTokens`/`cacheWriteTokens*`;

package/dist/core/task-stream.d.ts

@@ -277,7 +277,16 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
     }>;
     /**
      * Hard-**interrupt** the running task — a real abort (not a best-effort hint), equivalent to firing the
-     * task's `signal` (design/47). No-op if the task already finished. For a SOFT redirect that lets the
+     * task's `signal` (design/47). Refused typed (`steering.not_running`, the steer-family liveness code —
+     * `cannot interrupt: …`) once the task has finished (the loop's end included: the teardown window
+     * refuses like `halt`/`steer` do), never silently dropped. **A run that has already given its answer
+     * is not cancellable**: once its last turn ended `stopReason:"stop"` with no queued steer / follow-up
+     * left to serve (a continuation the person had already asked for makes that "stop" work in progress,
+     * not an answer), a stop landing on the run's
+     * tail (this verb, the task's `signal`, the walltime or turns limit — one law) still aborts what is
+     * left of that tail (a final-boundary compaction is mooted) but the run ends `completed` with the
+     * answer as `result`, writes no interruption marker, mints no `limits.*` code, and says so once with
+     * the `task.interrupt_unconsumed` notice. For a SOFT redirect that lets the
      * task keep running and adjust, use {@link steer} instead. For the CC-Esc "stop and wait for my
      * input" form — cut the turn, keep the ending clean and resumable — use {@link halt}.
      */

package/dist/core/terminal-cause.d.ts

@@ -20,7 +20,10 @@ import type { AssertAllKeysHandled } from "./ask-origin.js";
  * the one cause→plane derivation, for the faces that still speak the word.
  *  - `completed` — the run finished (a person's clean halt included — see `TaskResult.haltedByUser`).
  *  - `failed` — a limit, a provider failure, an abort, an invalid output…
- *  - `blocked` — the agent could not finish and said why.
+ *  - `blocked` — the AGENT reported, through `report_blocked`, that it cannot finish, and why. A TERMINAL
+ *    cause: the leg is over and it waits for nobody (nothing to resume, no token). The waiting-on-a-person
+ *    states are the `paused` cause's two status words — `suspended` (a pre-action approval of a tool
+ *    call) and `needs_review` (a review pause); the task-registry face spells both as `parked`.
  *  - `paused` — a durable pause committed a checkpoint and the run is resumable.
  * A `GateOutcome` is the record of ONE gate pass (per call); a `TerminalCause` is the record of ONE run
  * (per leg); a paused run's `gate` and the park row's `gate.kind` are the same word, joined by the token.
@@ -73,7 +76,8 @@ export type TerminalCause = {
     nestedPause?: PausedCause;
 } | {
     kind: "blocked";
-    /** Why the agent could not finish. */
+    /** Why the agent could not finish — the agent's own words from its `report_blocked` call. Terminal: the
+     *  run is over and nobody is being waited on (contrast `paused`, whose token is the resume capability). */
     reason: string;
 } | {
     kind: "paused";

package/dist/core/tool-face.d.ts

@@ -150,7 +150,15 @@ export interface ToolRuleFace {
  *  budgets a MINTED name to — a minted name is always inside this wire bound by construction; a CALLER
  *  declaration is judged against it at prepare. */
 export declare const TOOL_WIRE_NAME_MAX_CHARS = 128;
+/** The roster's wire bound on a SHORT identity member: a contract's `contractId` / `implementationRevision`, and the
+ *  `modelGate` class a definition carries. Bounded at the mint (`rosterMemberBoundProblem`), never truncated. */
 export declare const TOOL_CONTRACT_MAX_CHARS = 64;
+/** The roster's wire bound on a row's `cardId` — a COMPOSITE minted from bounded members, so its bound is DERIVED
+ *  from theirs rather than declared beside them: the widest form is `<mcp|a2a>:<peer>/<tool>` with the peer and the
+ *  protocol tool segment each inside the wire NAME bound (`builtin:<name>` and `<caller|external>:<contractId>` are
+ *  narrower). A row minted from in-bound members therefore fits by construction; the mint's own check on it is a
+ *  tripwire for a new source form, never a working rule. */
+export declare const TOOL_CARD_ID_MAX_CHARS: number;
 /** The roster's wire bound on a KEY — a schema property name, a path-target `param`/alias, a rule-face param. A key is a
  *  SEMANTIC name every fence reads an argument by, so it is never truncated: a declaration over the bound is refused at
  *  the door (caller) or dropped with a disclosed reason (MCP intake), and a row carries every key exactly. */

package/dist/core/tool-face.js

@@ -14,6 +14,7 @@ export function pathTargetSlotOnly(pt) {
 }
 export const TOOL_WIRE_NAME_MAX_CHARS = 128;
 export const TOOL_CONTRACT_MAX_CHARS = 64;
+export const TOOL_CARD_ID_MAX_CHARS = "mcp:".length + TOOL_WIRE_NAME_MAX_CHARS + "/".length + TOOL_WIRE_NAME_MAX_CHARS;
 export const TOOL_KEY_MAX_CHARS = 256;
 export const TOOL_KEYS_MAX = 1024;
 export const RENDER_HINT_MAX_CHARS = 64;

package/dist/core/tool-policy.d.ts

@@ -19,9 +19,11 @@ export interface ToolCallRequest {
      * (how the target may be confirmed by path), the display family, and the engine-minted identity
      * (`capabilityId` / `contractId` / `shapeDigest`) an exemption store keys on. Stamped at the gate entry
      * from the live roster, so identity follows the OBJECT the call dispatches to — a caller tool that merely
-     * took a built-in's name carries its own face, never the built-in's. ABSENT when a policy is invoked
-     * outside a Runner (a bare producer): a path-confining face then reads the catalog's declaration for the
-     * NAME (the pre-388 posture, never wider), and a skill-scope face treats the write as unconfirmable.
+     * took a built-in's name carries its own face, never the built-in's. ABSENT only on a BARE request (a
+     * policy invoked outside a Runner by a producer that stamped nothing): a PROTECTIVE fence (a deny-list)
+     * then reads the catalog's declaration for the NAME, tighten-only; a CONTAINMENT fence (a grant admitting a
+     * write by its path) REFUSES the request, typed (`policy.bare_request`, #626 ②) — stamp the face yourself
+     * (`toolCallFaceOf(roster, name)`) when driving a policy outside a Runner.
      */
     face?: ToolCallFace;
     /**
@@ -104,6 +106,27 @@ export interface ToolCallRequest {
  *  deny/ask lane and the person's own allow rules, never over a mandated ask. */
 declare const DECISION_REASONS: readonly ["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only"];
 export type DecisionReason = (typeof DECISION_REASONS)[number];
+/** Carry every engine attestation (settlement, classifier cause) from a decision onto a reconstruction of it — the
+ *  seam for the engine's OWN clone sites outside this module (the inherited chain's final-form re-check carries the
+ *  post-rewrite args on a spread of an ancestor's deny). Not re-exported from `src/index.ts`. */
+export declare function carryEngineAttestations(from: object, to: object): void;
+/** Carry a PRECEDING decision's settlement onto a later deny that has none of its own — the veto record (a person's
+ *  yes on the settlement, the refusing layer on the disposition; invariant I3) for the engine's own clone sites,
+ *  where the deny is minted over a decision that already carried an attested approval. A deny that carries its own
+ *  settlement keeps it (the latest resolution wins). Not re-exported from `src/index.ts`. */
+export declare function carryPrecedingSettlement(preceding: object, to: object): void;
+/** Attest that `d` is a deny a classifier station minted for `call` out of a round of the named FORM. */
+export declare function attestClassifierDenyCause<T extends object>(d: T, cause: import("./gate-outcome.js").ClassifierDenyCause, call: {
+    toolCallId: string;
+    toolName: string;
+}): T;
+/** Read the attested classifier cause off a deny FOR the named call (the gate's fold and exit are the
+ *  consumers): a binding to a different call is a replayed object and answers absence. An internal seam
+ *  between engine modules — deliberately NOT re-exported from `src/index.ts`. */
+export declare function classifierDenyCauseOf(d: unknown, call: {
+    toolCallId: string;
+    toolName: string;
+}): import("./gate-outcome.js").ClassifierDenyCause | undefined;
 /** Read the engine-attested settlement off a funneled decision FOR the named call (the gate's exit is the
  *  one consumer): an attestation bound to a different call is a replayed object and answers absence.
  *  Exported for the gate module only — deliberately NOT re-exported from `src/index.ts` (an internal seam
@@ -207,15 +230,6 @@ export type PermissionResult = {
      *  same safe direction as `matchedAskRule`); it cannot state a window of its own, because the
      *  route it would be a window for has not been chosen yet. */
     denialLimitFallback?: import("./auto-mode.js").UnarmedDenialLimitFallback;
-    /** #616 (additive): the classifier-unavailable FACT on an ASK — `cause` is the verdict's own word
-     *  ({@link import("./auto-mode.js").AutoModeUnavailableCause}). Since #661 the ENGINE no longer writes
-     *  it here: an `unavailable` verdict is a DENY (the deny arm's member above), never an ask handed to a
-     *  person. The member stays on the ask arm as display metadata a policy may self-declare on its own
-     *  ask (nothing reads it to decide anything); the carry stations still copy it onto the approval
-     *  request and the durable row when present. Retirement candidate for the next wire window. */
-    classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
     /** #144 disclosure (additive): a persisted allow rule MATCHED this call but could not clear the
      *  ask, because the ask is MANDATED (operator shellGate:"always", or the tool's own
      *  egress/irreversibility marks) rather than a classifier's hesitation — "allow rules silence
@@ -285,21 +299,18 @@ export type PermissionResult = {
      *  exclusions; an approval surface may render the card by it. Optional on the TYPE only because a
      *  decision is caller-composable; every ask the gate hands to its resolver carries it. */
     origin?: import("./ask-origin.js").AskOrigin;
+    /** #688 C3 (additive): WHICH mechanism stands behind an `origin: "rule_store_unavailable"` — one word from
+     *  {@link import("./ask-origin.js").RULE_STORE_UNREADABLE_KINDS} (`store`: the wired store could not be read;
+     *  `call`: the call could not be read against the person's rows — the lexer's sentence is in `message`).
+     *  ENGINE-STAMPED at the same single stamp point as `origin`, from the gate's own lane read; a policy's
+     *  self-declared value is overwritten or removed there. Present ⇔ the origin is `rule_store_unavailable`.
+     *  Carried onto the approval request and the durable row beside the origin word. */
+    ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
 } | {
     action: "deny";
     updatedInput?: unknown;
     message?: string;
     decisionReason?: DecisionReason;
-    /** #661 (additive): this deny is the classifier's UNAVAILABILITY — the auto-mode classifier was consulted
-     *  and could not run, and the call is refused with a sentence that says so (CC 2.1.250 `Ze.unavailable` ⇒
-     *  `deny`, `x1t`). `cause` is the verdict's own word ({@link import("./auto-mode.js").AutoModeUnavailableCause}).
-     *  ENGINE-STAMPED beside `decisionReason: "classifier"` at the classifier stations (the gate's own and the
-     *  inherited-lane arms) on an `unavailable` verdict only; a `block` and a `parse_error` deny carry nothing
-     *  here. Read by the deny observer's payload ({@link import("./hooks.js").PermissionDeniedPayload}) and by
-     *  nothing that decides. */
-    classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
 };
 /**
  * design/252 G-2 — WHY a piece of rule-provenance evidence is not on an ask.
@@ -1155,15 +1166,12 @@ export interface AskRequest {
      *  that forwards a decision's member here does not compile, which is the point: the window is the
      *  route's fact, and forwarding it silently is how a configured window becomes a wait with none. */
     readonly denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
-    /** #616 (additive) — present ⇔ the auto-mode classifier was consulted on this ask and could not run (see
-     *  the {@link PermissionResult} ask-arm member of the same name): the card's "asked because the
-     *  classifier was unavailable" fact, with the verdict's own cause word. Absent on every ask the classifier
-     *  answered, was not eligible for, or was not wired for — read presence, never absence. Filled by the
-     *  carry stations from the decision, never a caller/worker-settable field; the durable park row carries
-     *  the same member (`PendingAction.tool_approval.classifierUnavailable`). */
-    readonly classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
+    /** #688 C3 (additive) — the wire twin of the {@link PermissionResult} ask-arm member of the same name: which
+     *  mechanism stands behind an `origin: "rule_store_unavailable"` (`store` / `call`,
+     *  {@link import("./ask-origin.js").RULE_STORE_UNREADABLE_KINDS}). Present ⇔ that origin; a consumer that
+     *  renders "the rule store is unreachable" vs "this command could not be read against your rules" branches
+     *  here, never on the message text. Filled by the gate's own carry station from the engine-stamped decision. */
+    readonly ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
     /** (additive) WHICH AUTHORITY raised this ask — the wire twin of the {@link PermissionResult} ask-arm
      *  member of the same name, one word from the closed {@link import("./ask-origin.js").AskOrigin} set.
      *  The gate's own mint station copies the engine-stamped word; the three inherited-lane stations

package/dist/core/tool-policy.js

@@ -29,6 +29,32 @@ function transferEngineSettlement(from, to) {
     const v = ENGINE_SETTLEMENTS.get(from);
     if (v !== undefined)
         ENGINE_SETTLEMENTS.set(to, v);
+    const c = CLASSIFIER_DENY_CAUSES_SEAT.get(from);
+    if (c !== undefined)
+        CLASSIFIER_DENY_CAUSES_SEAT.set(to, c);
+}
+export function carryEngineAttestations(from, to) {
+    transferEngineSettlement(from, to);
+}
+export function carryPrecedingSettlement(preceding, to) {
+    if (ENGINE_SETTLEMENTS.get(to) !== undefined)
+        return;
+    const v = ENGINE_SETTLEMENTS.get(preceding);
+    if (v !== undefined)
+        ENGINE_SETTLEMENTS.set(to, v);
+}
+const CLASSIFIER_DENY_CAUSES_SEAT = new WeakMap();
+export function attestClassifierDenyCause(d, cause, call) {
+    CLASSIFIER_DENY_CAUSES_SEAT.set(d, { cause, toolCallId: call.toolCallId, toolName: call.toolName });
+    return d;
+}
+export function classifierDenyCauseOf(d, call) {
+    if (typeof d !== "object" || d === null)
+        return undefined;
+    const v = CLASSIFIER_DENY_CAUSES_SEAT.get(d);
+    if (v === undefined || v.toolCallId !== call.toolCallId || v.toolName !== call.toolName)
+        return undefined;
+    return v.cause;
 }
 export function engineSettlementOf(d, call) {
     if (typeof d !== "object" || d === null)
@@ -400,7 +426,6 @@ export function combinePolicies(...policies) {
             let ruleAskText;
             let probeMandateSeen = false;
             let fallbackSeen;
-            let classifierUnavailableSeen;
             for (const p of policies) {
                 const d = refuseOutOfContractDecision(await p.check(current, signal));
                 if (d.action === "deny") {
@@ -410,6 +435,8 @@ export function combinePolicies(...policies) {
                     }
                     if (settledAllow !== undefined && ENGINE_SETTLEMENTS.get(out) === undefined) {
                         const owned = out === d ? { ...d } : out;
+                        if (owned !== d)
+                            transferEngineSettlement(d, owned);
                         transferEngineSettlement(settledAllow, owned);
                         return owned;
                     }
@@ -431,16 +458,13 @@ export function combinePolicies(...policies) {
                     probeMandateSeen = true;
                 if (d.action === "ask" && d.denialLimitFallback !== undefined && fallbackSeen === undefined)
                     fallbackSeen = d.denialLimitFallback;
-                if (d.action === "ask" && d.classifierUnavailable !== undefined && classifierUnavailableSeen === undefined)
-                    classifierUnavailableSeen = d.classifierUnavailable;
             }
             if (asked) {
                 const merged = rewrite?.updatedInput;
                 const withRuleAsk = ruleAskText !== undefined && asked.matchedAskRule === undefined ? { ...asked, matchedAskRule: ruleAskText } : asked;
                 const withMark = probeMandateSeen && withRuleAsk.probeMandated !== true ? { ...withRuleAsk, probeMandated: true } : withRuleAsk;
                 const withFallback = fallbackSeen !== undefined && withMark.denialLimitFallback === undefined ? { ...withMark, denialLimitFallback: fallbackSeen, requiresRealApproval: true } : withMark;
-                const withFact = classifierUnavailableSeen !== undefined && withFallback.classifierUnavailable === undefined ? { ...withFallback, classifierUnavailable: { cause: classifierUnavailableSeen.cause } } : withFallback;
-                return merged !== undefined ? { ...withFact, updatedInput: merged } : withFact;
+                return merged !== undefined ? { ...withFallback, updatedInput: merged } : withFallback;
             }
             const allowed = rewrite ?? ALLOW;
             if (settledAllow === undefined)

package/dist/core/tool-registry.d.ts

@@ -62,13 +62,21 @@ type CallPathTarget = ToolCallPathTarget;
  * a different file, and the deny this floor exists to preserve simply misses.
  */
 export declare function protectivePathTargetOf(call: ToolCallLike): CallPathTarget | undefined;
+/** The typed refusal a CONTAINMENT reader mints for a request that carries no face at all (#626 ② — design/388 B6's
+ *  bare-producer migration seam, closed). */
+export declare const BARE_REQUEST_CODE = "policy.bare_request";
 /**
  * The path target a CONTAINMENT fence reads (a grant admitting a write BY its path: session `allowDirs`, the fs-write
  * gate's accept/exempt dirs; the active-skill allowPaths face reads its own eligibility bit the same way): the object
  * face's OWN declaration only — a same-name tool that declares no path target is an UNCONFIRMABLE write (the catalog's
- * slot may not be the one it writes; a decoy in that slot would buy an admission), so the fence fails closed. A BARE
- * request (no face at all — a policy invoked outside a Runner) reads the catalog for the name: the pre-388 reading, the
- * documented migration seam for bare producers.
+ * slot may not be the one it writes; a decoy in that slot would buy an admission), so the fence fails closed.
+ *
+ * #626 ②: a BARE request (no face at all) is REFUSED, typed (`policy.bare_request`), never answered from the catalog
+ * for the name. A grant is a claim about the tool's OWN slot, and only a prepared leg's roster can say which object
+ * the call dispatches to — the catalog's declaration for a NAME is exactly the reading a same-name caller tool would
+ * exploit. Inside a Runner every gated request carries the leg's face (the gate entry, the resume belts and the
+ * pre-CAS edit recheck stamp it); a policy invoked outside a Runner stamps its own (`toolCallFaceOf(roster, name)`).
+ * The PROTECTIVE floor above keeps reading the catalog for a bare request: tighten-only, a deny can only gain a slot.
  */
 export declare function declaredPathTargetOf(call: ToolCallLike): CallPathTarget | undefined;
 /** Is this call a write a PROTECTIVE fence judges (a protected target whose access ≠ read)? The name sets are its static view. */

package/dist/core/tool-registry.js

@@ -54,8 +54,14 @@ export function protectivePathTargetOf(call) {
     const floor = pathTargetOf(call.toolName);
     return floor === undefined || call.face === undefined ? floor : pathTargetSlotOnly(floor);
 }
+export const BARE_REQUEST_CODE = "policy.bare_request";
 export function declaredPathTargetOf(call) {
-    return call.face !== undefined ? call.face.pathTarget : pathTargetOf(call.toolName);
+    if (call.face === undefined) {
+        const e = new Error(`tool call ${JSON.stringify(call.toolName)} carries no face: a containment fence admits a write only by the tool's OWN declared path target, which a prepared leg's roster stamps on every gated request — a policy invoked outside a Runner must stamp \`face\` itself (toolCallFaceOf) rather than expect the catalog's declaration for the name`);
+        e.code = BARE_REQUEST_CODE;
+        throw e;
+    }
+    return call.face.pathTarget;
 }
 export function isProtectedWrite(call) {
     const pt = protectivePathTargetOf(call);

package/dist/core/tool-roster.d.ts

@@ -309,6 +309,32 @@ export declare function inputKeysOf(schema: TSchema | undefined): {
 /** The roster's KEY bounds over a schema (design/388 B20): a problem sentence, or undefined when every top-level key fits.
  *  Shared by the caller declaration door (typed refusal) and the MCP intake (disclosed drop) — a key is never truncated. */
 export declare function schemaKeyBoundProblem(schema: TSchema | undefined): string | undefined;
+/** The identity members of one roster row the wire bounds hold, as a DECLARATION (the door) or a MINTED row hands them. */
+export interface RosterBoundMembers {
+    name: string;
+    aliases?: readonly string[];
+    /** An MCP/A2A mount's peer (the row's `origin.peer`) — a NAME on the roster, held to the wire name bound. */
+    peer?: string;
+    contractId?: string;
+    implementationRevision?: string;
+    modelGate?: string;
+    cardId?: string;
+}
+/** The typed refusal a member over its bound mints — the door's two codes, and the mint's own for the members no
+ *  declaration door names (`modelGate`, the derived `cardId`). */
+export type RosterBoundCode = "config.tool_name_too_long" | "config.tool_contract_too_long" | "config.tool_roster_bound";
+/**
+ * design/388 B20 / #626 ① — the ONE bound judge over a row's identity members: a problem `{ code, message }`, or
+ * undefined when every member fits. Read by the declaration door (a `TaskSpec.tools` entry, refused before session
+ * acquire) and by the row mint (every source — an MCP/A2A peer, a definition that reached the mint by a route the
+ * door does not cover — refused before the row exists). A member over its bound is NEVER truncated onto the row: a
+ * truncated identity is a different identity (`judgeParkedToolIdentity` compares it across a park; the card
+ * namespace door reads it), and the schema's own bounds would then describe a row the mint never made.
+ */
+export declare function rosterMemberBoundProblem(m: RosterBoundMembers): {
+    code: RosterBoundCode;
+    message: string;
+} | undefined;
 /**
  * The rule vocabulary of ONE mounted instance (design/388 §2.2 ③ / D-3): DERIVED = the scalar top-level
  * keys ∪ the path target's `param` + aliases; a declared `params` list can only NARROW it (a declared

package/dist/core/tool-roster.js

@@ -2,12 +2,12 @@ import { createHash } from "node:crypto";
 import { Type } from "typebox";
 import { getToolContract } from "../prompt-assembly/tool-catalog.js";
 import { protocolOf } from "./protocol-table.js";
-import { RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_CHARS, RENDER_HINT_MAX_LIST, TOOL_APPROVAL_CARDS, TOOL_FAMILIES, TOOL_KEYS_MAX, TOOL_KEY_MAX_CHARS, TOOL_MOUNT_TAGS, TOOL_PATH_ABSENCES, TOOL_PATH_BASES, } from "./tool-face.js";
+import { RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_CHARS, RENDER_HINT_MAX_LIST, TOOL_APPROVAL_CARDS, TOOL_CARD_ID_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_FAMILIES, TOOL_KEYS_MAX, TOOL_KEY_MAX_CHARS, TOOL_MOUNT_TAGS, TOOL_WIRE_NAME_MAX_CHARS, TOOL_PATH_ABSENCES, TOOL_PATH_BASES, } from "./tool-face.js";
 function lit(values) {
     return Type.Union(values.map((v) => Type.Literal(v)));
 }
-const Name = Type.String({ minLength: 1, maxLength: 128 });
-const Short = Type.String({ maxLength: 64 });
+const Name = Type.String({ minLength: 1, maxLength: TOOL_WIRE_NAME_MAX_CHARS });
+const Short = Type.String({ maxLength: TOOL_CONTRACT_MAX_CHARS });
 const Key = Type.String({ maxLength: TOOL_KEY_MAX_CHARS });
 const Digest16 = Type.String({ minLength: 16, maxLength: 16 });
 export const ROSTER_SOURCES = ["builtin", "caller", "host", "mcp", "a2a", "external", "synthetic"];
@@ -26,7 +26,7 @@ export const ToolRosterEntry = Type.Object({
     contract: Type.Object({ contractId: Short, implementationRevision: Short }, { additionalProperties: false }),
     shapeDigest: Digest16,
     wireSchemaDigest: Digest16,
-    cardId: Type.String({ maxLength: 160 }),
+    cardId: Type.String({ maxLength: TOOL_CARD_ID_MAX_CHARS }),
     capabilityId: Digest16,
     inputKeys: Type.Array(Type.Object({ name: Key, type: lit(["string", "number", "integer", "boolean", "object", "array", "null", "mixed"]) }, { additionalProperties: false }), { maxItems: TOOL_KEYS_MAX }),
     effect: lit(["read", "write", "idempotent"]),
@@ -207,6 +207,28 @@ export function schemaKeyBoundProblem(schema) {
         return `the schema property ${JSON.stringify(long.slice(0, 40) + "…")} is ${long.length} characters; a roster key is at most ${TOOL_KEY_MAX_CHARS}`;
     return undefined;
 }
+export function rosterMemberBoundProblem(m) {
+    if (typeof m.name !== "string")
+        return { code: "config.tool_roster_bound", message: `tool has no string name (got ${m.name === null ? "null" : typeof m.name}); every roster row is keyed by a string \`name\`` };
+    const over = (label, value, bound) => `${label} ${JSON.stringify(value.slice(0, 40) + "…")} is ${value.length} characters; the roster's bound is ${bound}`;
+    const of = (text) => `tool ${JSON.stringify(m.name.slice(0, 40))}: ${text}`;
+    if (m.name.length > TOOL_WIRE_NAME_MAX_CHARS)
+        return { code: "config.tool_name_too_long", message: over("tool name", m.name, TOOL_WIRE_NAME_MAX_CHARS) };
+    const alias = m.aliases?.find((a) => a.length > TOOL_WIRE_NAME_MAX_CHARS);
+    if (alias !== undefined)
+        return { code: "config.tool_name_too_long", message: of(over("alias", alias, TOOL_WIRE_NAME_MAX_CHARS)) };
+    if (m.peer !== undefined && m.peer.length > TOOL_WIRE_NAME_MAX_CHARS)
+        return { code: "config.tool_name_too_long", message: of(over("peer", m.peer, TOOL_WIRE_NAME_MAX_CHARS)) };
+    for (const [label, v] of [["contractId", m.contractId], ["implementationRevision", m.implementationRevision]]) {
+        if (v !== undefined && v.length > TOOL_CONTRACT_MAX_CHARS)
+            return { code: "config.tool_contract_too_long", message: of(over(`contract ${label}`, v, TOOL_CONTRACT_MAX_CHARS)) };
+    }
+    if (m.modelGate !== undefined && m.modelGate.length > TOOL_CONTRACT_MAX_CHARS)
+        return { code: "config.tool_roster_bound", message: of(over("modelGate", m.modelGate, TOOL_CONTRACT_MAX_CHARS)) };
+    if (m.cardId !== undefined && m.cardId.length > TOOL_CARD_ID_MAX_CHARS)
+        return { code: "config.tool_roster_bound", message: of(over("cardId", m.cardId, TOOL_CARD_ID_MAX_CHARS)) };
+    return undefined;
+}
 export function ruleFaceOfInstance(schema, declared, pathTarget) {
     const { scalar } = inputKeysOf(schema);
     const derived = new Set(scalar);
@@ -375,15 +397,26 @@ export function mintRosterEntry(tool, meta, facts) {
     const pathTarget = face.pathTarget;
     const rf = ruleFaceOfInstance(tool.parameters, face.ruleFace, pathTarget);
     const hints = face.renderHints !== undefined ? capRenderHints(face.renderHints) : undefined;
+    const bound = rosterMemberBoundProblem({
+        name: tool.name,
+        aliases: tool.aliases,
+        ...(peer !== null ? { peer } : {}),
+        contractId: d.contractId,
+        implementationRevision: d.implementationRevision,
+        ...(typeof face.modelGate === "string" ? { modelGate: face.modelGate } : {}),
+        cardId,
+    });
+    if (bound !== undefined)
+        throw configError(bound.code, bound.message);
     return {
         name: tool.name,
         aliases: [...new Set(tool.aliases ?? [])],
         source: meta.source,
         ...(meta.origin !== undefined ? { origin: { peer: meta.origin.peer, ...(meta.origin.declaredBy !== undefined ? { declaredBy: meta.origin.declaredBy } : {}) } } : {}),
-        contract: { contractId: d.contractId.slice(0, 64), implementationRevision: d.implementationRevision.slice(0, 64) },
+        contract: { contractId: d.contractId, implementationRevision: d.implementationRevision },
         shapeDigest: d.shapeDigest,
         wireSchemaDigest: d.wireSchemaDigest,
-        cardId: cardId.slice(0, 160),
+        cardId,
         capabilityId: mintCapabilityId({ source: meta.source, peer, name: tool.name, contractId: d.contractId }),
         inputKeys,
         effect,
@@ -417,7 +450,7 @@ export function mintRosterEntry(tool, meta, facts) {
         validateInput: typeof tool.validateInput === "function",
         deferred: facts.deferred.has(tool.name),
         alwaysLoad: face.alwaysLoad === true || face.mcpAlwaysLoad === true,
-        ...(typeof face.modelGate === "string" ? { modelGate: face.modelGate.slice(0, 64) } : {}),
+        ...(typeof face.modelGate === "string" ? { modelGate: face.modelGate } : {}),
         ...(hints !== undefined ? { renderHints: hints } : {}),
         mountedBy: meta.mountedBy,
     };