@sema-agent/core 7.15.0 → 7.17.0

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/389 — the permission-rule LANES the unified store feeds (prepare-path machinery, design/390 L1): the two gate
+ * The permission-rule LANES the unified store feeds (prepare-path machinery): the two gate
  * lanes, and — since the policy-chain phase took the chain assembly — the rule-offer factory every ask-mint site calls.
  *
  * `prepareTask` used to assemble the personal lane inline (a store read + a hand-spliced session
@@ -35,7 +35,7 @@ import type { PermissionRuleStoreProvider } from "../permission-rule-provider.js
  *  it alone). The PATH grammar's tools are derived from the catalog (`ruleToolGrammarOf`). */
 export declare const PERSISTED_RULE_TOOL = "Bash";
 /**
- * design/252 G-2 — the evidence an INHERITED-lane ask carries.
+ * The evidence an INHERITED-lane ask carries.
  *
  * The three inherited mint sites present an ANCESTOR policy's own decision, resolved at the ancestor's
  * approver, from inside the policy fold — upstream of the gate's org layer and its rule lane, neither of
@@ -52,10 +52,10 @@ export declare const PERSISTED_RULE_TOOL = "Bash";
  */
 export declare function inheritedAskRuleEvidence(provider: PermissionRuleStoreProvider | undefined): AskRuleEvidence;
 /**
- * design/252 G-2 — the snapshot REVISION an org answer was read off, screened before it becomes
+ * The snapshot REVISION an org answer was read off, screened before it becomes
  * evidence.
  *
- * #123 loud-bad-value: the org partition's own install and serving gates screen a snapshot's revision,
+ * The org partition's own install and serving gates screen a snapshot's revision,
  * so a healthy in-tree partition cannot reach here with junk; a FOREIGN store (the interface is public)
  * can. A non-finite value is refused rather than carried — an evidence field is worthless if `NaN` can
  * wear the same shape as revision 41 — and the defect is announced through `onDefect` instead of quietly
@@ -68,7 +68,7 @@ export declare function orgRevisionEvidenceOf(resolution: OrgRuleResolution, onD
     revision?: number;
 };
 /**
- * design/252 G-2 / design/375 — project the model's verdict onto the gate's rule-lane answer: the
+ * Project the model's verdict onto the gate's rule-lane answer: the
  * behavior that spoke, and each member's canonical text plus its own add DOTS. For an allow the set is
  * the admitting COVERAGE SET (a single rule admitting the whole command is a one-element set; a compound
  * admitted by the per-segment conjunction is the set of covering rules in segment order — the model's
@@ -87,14 +87,14 @@ export declare function persistedRuleHitOf(verdict: PersistedRuleVerdict | undef
  *  other verdict is {@link persistedRuleHitOf}'s hit. */
 export declare function persistedRuleAnswerOf(verdict: PersistedRuleVerdict | undefined): PersistedRuleHit | PersistedRuleUnreadable | undefined;
 /**
- * design/382 §2.5-1, widened to every path-targeting tool — the persisted-rule lane's PATH arm: the call's
+ * Widened to every path-targeting tool — the persisted-rule lane's PATH arm: the call's
  * target path in the SAME lexical identity the rule family is defined over, resolved by the ONE reader every
  * fence and every tool goes through (`effectivePathTargetOf`), so the lane judges the path the tool will
  * really open. The tool's own declaration decides which base a relative spelling takes and what an ABSENT
  * slot means — the lane no longer guesses `liveCwd ?? root` for every tool, which was wrong for the two
  * search tools in three separate shapes (see effective-path-target.ts). Still zero IO.
  *
- * TWO readings of the call's path slot, one per direction (design/388 B6/B17): the tightening arms judge
+ * TWO readings of the call's path slot, one per direction: the tightening arms judge
  * the PROTECTIVE target (the object face's declaration, the catalog's for the name as the floor — reading
  * the catalog for an undeclared same-name tool can only tighten a deny); the allow arm judges the DECLARED
  * target (the face's OWN declaration only — a same-name tool that declares no path target is unconfirmable
@@ -123,7 +123,7 @@ export interface PermissionRuleLanes {
 /**
  * Build the gate's two permission-rule lanes over the unified store, resolved once per task.
  *
- * design/182 §4.5 (F-011) — the LOCAL-OWNER declaration is judged here, at prepare. It is a declaration,
+ * The LOCAL-OWNER declaration is judged here, at prepare. It is a declaration,
  * so one that cannot be honored is refused LOUDLY rather than degrading into "this deployment's standing
  * approvals silently stopped applying" (the §7.4 org bit's rule, applied to the availability direction:
  * the failure is deterministic and belongs at wiring time).
@@ -136,10 +136,10 @@ export declare function createPermissionRuleLanes(cfg: {
     /** The isolation-aware task root — the same value the file fence, the prompt cwd and the session rules
      *  use, so a project-scoped rule agrees with every other place that says "this project". */
     root: string;
-    /** The LIVE tracked working directory (adversarial-review P1): the base a relative cd resolves against
+    /** The LIVE tracked working directory: the base a relative cd resolves against
      *  after an earlier observable `cd`; read per call. */
     liveCwd: () => string | undefined;
-    /** #644 — the EXECUTION ENVIRONMENT's home directory (`ExecutionEnv.homeDir`, adapter-declared), the base a
+    /** The EXECUTION ENVIRONMENT's home directory (`ExecutionEnv.homeDir`, adapter-declared), the base a
      *  `~/` path rule resolves against. `undefined` = the adapter declares none: a `~/` deny/ask row then reads
      *  UNREADABLE for every call (a fail-closed ask), never the engine process's home. A declared value that is
      *  not an absolute path is refused HERE, loudly (a bad declaration is a wiring defect, not an absence). */
@@ -153,7 +153,7 @@ export declare function createPermissionRuleLanes(cfg: {
      *  lane took the read. */
     onDisclosure: (message: string) => void;
 }): PermissionRuleLanes;
-/** The closed reason set for the rule-offer factory's empty answer (#490 修②) — the same three
+/** The closed reason set for the rule-offer factory's empty answer — the same three
  *  spellings the `AskRequest` and durable-row seats declare, kept at the one factory that fills both.
  *  Deliberately not exported: this is a wire vocabulary, and its two faces declare it literally (the
  *  `previewWithheld` precedent) so a consumer reads the closed set on the type it is holding rather
@@ -166,10 +166,10 @@ interface RuleOffersAskFacts {
     requiresRealApproval?: boolean;
     persistedRuleShadowed?: string;
     decisionReason?: import("../tool-policy.js").DecisionReason;
-    /** #457 ④: an EXPLICIT `ask` permission rule matched this call (design/127 DSL, stamped at
+    /** An EXPLICIT `ask` permission rule matched this call (DSL, stamped at
      *  the rule policy's three matched-ask exits — bare, covering and param). */
     matchedAskRule?: string;
-    /** #502: the engine-stamped probe mandate (the reversibility probe declared this call's
+    /** The engine-stamped probe mandate (the reversibility probe declared this call's
      *  demotion structural — for the built-in shell probe, a read outside the session's
      *  allowed directories). */
     probeMandated?: boolean;
@@ -177,13 +177,13 @@ interface RuleOffersAskFacts {
     /** The ask is being resolved at an ANCESTOR's frozen approver (the three inherited-lane
      *  mint sites pass it literally) — this task's rule lane never adjudicates it. */
     ancestorResolved?: boolean;
-    /** design/375 §5.2②: the surviving ask's engine-stamped per-segment coverage table — the
+    /** The surviving ask's engine-stamped per-segment coverage table — the
      *  batch offer carries exactly the segments this table calls uncovered. Absent ⇒ all
      *  segments read as uncovered (over-offer, the safe direction). */
     segmentCoverage?: readonly SegmentCoverage[];
 }
 /**
- * design/179 §4 — the rule forms that could cover this exact call, for a surface's "stop asking me
+ * The rule forms that could cover this exact call, for a surface's "stop asking me
  * this" option (extracted from the prepare body, the spliceSessionOverlayRows precedent; the maker
  * captures the per-task wiring once and the returned factory serves all five ask-mint sites — the
  * approval-preview field is a standing example of what happens otherwise: it reached two of the
@@ -197,7 +197,7 @@ interface RuleOffersAskFacts {
  * questions, never a mandated one". Two doors, matching the two halves of that boundary:
  *  · the marks half, judged from the SAME resolved sources the gate input is built from, through the
  *    gate's own single-source predicate (an operator's shellGate:"always", the tool's own
- *    egress/irreversibility marks, and — #502 — the PER-CALL member that predicate also takes: a
+ *    egress/irreversibility marks, and — separately — the PER-CALL member that predicate also takes: a
  *    demotion this call's reversibility probe declared structural, read off the ask the gate
  *    stamped rather than off the tool seat, because it is true of one call and not of the seat) —
  *    a drift here would offer a rule the lane then refuses to honor;
@@ -211,7 +211,7 @@ interface RuleOffersAskFacts {
  *    "stop asking me this" on a card that will keep asking lets a person mint a rule that never
  *    takes effect where they minted it.
  *
- * #457 ④ (CC 2.1.245 toolPolicy 对表, F11: "wildcard `ask` … keeps every matching tool behind a
+ * (CC 2.1.245 toolPolicy 对表, F11: "wildcard `ask` … keeps every matching tool behind a
  * per-call prompt (no persistent always-allow)") — `matchedAskRule` was the one conjunct of the
  * lane's own clearing predicate this door did not mirror, and the asymmetry was live: the
  * persisted-rule lane refuses to clear ANY ask carrying it (`hooks.ts`, the
@@ -222,7 +222,7 @@ interface RuleOffersAskFacts {
  * suppressed one call too late, after the useless rule existed. The shadowed conjunct stays: it
  * covers the person who ALREADY has the allow rule; this one covers the person about to mint it.
  *
- * #490 修② — every door above that answers "no offers" now also names WHICH door, on the
+ * Every door above that answers "no offers" now also names WHICH door, on the
  * `ruleOffersAbsence` seat (`AskRequest`'s and the durable row's, ONE factory so the two faces
  * cannot disagree). The doctrine it serves is the loud-bad-value one, applied to an absence: a
  * surface reading an empty card could not tell "there is nothing this lane could offer" from
@@ -249,7 +249,7 @@ export declare function createRuleOffersOf(cfg: {
         has(name: string): boolean;
     };
     taskRoot: string | undefined;
-    /** The live tracked-cwd ref (read per call — the relative-cd resolution base, adversarial-review P1/r3). */
+    /** The live tracked-cwd ref (read per call — the relative-cd resolution base). */
     cwdRef: {
         current: string;
     } | undefined;

package/dist/core/runner/prepare-acquire-reconcile.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/238 B-3 (P2 相位抽取) — prepareTask's session acquire+reconcile phase. Acquire the session
+ * PrepareTask's session acquire+reconcile phase. Acquire the session
  * and, when resuming, reconcile any interrupted (orphan) tool call before the turn. Both are retried
  * together on a F2 optimistic-lock conflict: a concurrent writer on another instance can move the
  * leaf during reconcile's append, and the fix can't be applied to a now-stale in-memory view — so we
@@ -8,7 +8,7 @@
  * (resume-at validation + rebranch + reconcile re-run as one unit against the fresh view) — pinned
  * in `prepare-task-phase-pins`.
  *
- * Ownership (design/238 相 API 规则件): on SUCCESS the acquired session's ownership transfers whole
+ * Ownership: on SUCCESS the acquired session's ownership transfers whole
  * to the caller (the driver's forgetOnThrow / the Runner's finish own the cleanup from then on);
  * every failure path INSIDE this phase drops its own cached view first (`forget`, never `release` —
  * audit B-17: release deletes the history on the default store), so a throw here never strands a
@@ -46,14 +46,14 @@ export interface PrepareAcquireReconcileInput {
      *  partition. Never combined with `requireExistingSession` semantics: the require-existing form
      *  re-opens and placement is first-write immutable, so it rides only the create-capable arm. */
     placement?: import("../session.js").SessionPlacement;
-    /** borrowed-readonly — design/252 G-6 sibling: the durable-park TOPOLOGY gap sentence for this
+    /** borrowed-readonly — the durable-park TOPOLOGY gap sentence for this
      *  deployment (`durableParkGapFor`), or `undefined` when the topology is whole / does not apply.
      *  Read ONLY on the fail-loud missing-session path below, where it turns a symptom into a named
      *  absent seat; nothing in the phase's control flow depends on it. Computed by the driver (which
      *  holds `deps`) rather than here, keeping this slice's input the narrow Pick its contract says. */
     durableParkGap?: string;
 }
-/** The phase's outputs (design/238 相 API 规则件 four-class form). All five are fresh bindings —
+/** The phase's outputs (four-class form). All five are fresh bindings —
  *  the driver destructures them into consts, so a consumer moved ahead of this call is a lexical
  *  error, which is the static guarantee the extraction keeps. */
 export interface PrepareAcquireReconcileResult {

package/dist/core/runner/prepare-artifact.d.ts

@@ -0,0 +1,53 @@
+/**
+ * PrepareTask's Artifact phase: the `RunnerDeps.artifactHost` seat is read once; an absent seat mounts
+ * nothing and announces nothing; a seat whose declaration fails an invariant mounts nothing and announces
+ * `config.artifact_host_invalid` (operator audience) so a bad wiring can never read as "no hosting"; a
+ * valid seat mounts ONE `Artifact` tool assembled from the declaration, on the same optional band the LSP
+ * seat uses. The tool's local-file read goes through the run's fs fence (root containment, read-deny,
+ * read face) exactly as `Read` does, then reads the bytes once from the execution env. A local stub's store
+ * (`capabilities.storageDir`) must lie OUTSIDE every root the run may write or read — the task root and both
+ * classes of additional directories — because a ledger the model can edit through the fs tools is not a trust
+ * boundary; a store inside one refuses the mount with the same loud notice, naming the directory and the root.
+ * Synchronous: the stretch has no await (the file read is a closure the tool calls later).
+ */
+import type { ExecutionEnv } from "../../internal/harness.js";
+import { type ArtifactPlane } from "../artifact-host.js";
+import { RosterBuilder } from "../tool-roster.js";
+import type { AgentTool, RunnerDeps } from "../types.js";
+import type { ReadDenyMatcher, ReadFace } from "../../tools/fs/index.js";
+import type { Prepared } from "./contracts.js";
+export interface PrepareArtifactInput {
+    /** borrowed-readonly — the deployment's hosting seat and the notice sink the refusal arm announces on. */
+    deps: Pick<RunnerDeps, "artifactHost" | "onNotice">;
+    /** borrowed-readonly — the engine-minted run id: the host's `onMount` key and every call context's `runId`. */
+    runId: string;
+    /** borrowed-readonly — the host task id, the call context's audit attribution. */
+    taskId: string;
+    /** borrowed-readonly — the acquired session id (notice attribution and the call context's `sessionId`). */
+    sessionId: string;
+    /** borrowed-readonly — the spawned name this run carries, when any (call-context attribution only). */
+    agentName: string | undefined;
+    /** borrowed-readonly — the run's resolved env: the byte source of a published local file. */
+    executionEnv: ExecutionEnv;
+    /** borrowed-readonly — the canonical task root the fs fence contains reads to; undefined ⇒ no local-file publish. */
+    rootCanonical: string | undefined;
+    /** borrowed-readonly — the extra containment roots (write and read-only) the fence admits. */
+    additionalRootsCanonical: readonly string[];
+    /** borrowed-readonly — the read-deny matcher in force for the run, when any. */
+    readDenyMatcher: ReadDenyMatcher | undefined;
+    /** borrowed-readonly — the resolved read face (`"open"` lifts root containment for reads). */
+    resolvedReadFace: ReadFace | undefined;
+    /** borrowed-readonly — the tracked-cwd cell; `current` is read per call as the relative-path base. */
+    handsCwdRef: Prepared["cwdRef"];
+    /** borrowed-mutable — the run's roster builder; writer here: ONE mount when the seat is valid. */
+    roster: RosterBuilder;
+    /** borrowed-readonly — the first-party result-offload wrapper every core mount passes through (a large read or a conflict snapshot is offloaded, not inlined). */
+    firstPartyOffload: (tool: AgentTool) => AgentTool;
+    /** borrowed-mutable — the env-hand membership set the memory content-origin face reads (a tool that reads the execution env's files is a hand); writer here: `add("Artifact")` on the mount. */
+    envHandToolNames: Set<string>;
+}
+export interface PrepareArtifactResult {
+    /** owned — the mounted face's plane, or undefined when nothing mounted (absent seat, or an invalid one). */
+    artifactPlane: ArtifactPlane | undefined;
+}
+export declare function prepareArtifact(input: PrepareArtifactInput): PrepareArtifactResult;

package/dist/core/runner/prepare-artifact.js

@@ -0,0 +1,77 @@
+import { readArtifactHostCapabilities } from "../artifact-host.js";
+import { ARTIFACT_TOOL_NAME } from "../tool-catalog-entries.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+import { RosterBuilder } from "../tool-roster.js";
+import { defineTool } from "../tools.js";
+import { inlineUntrusted } from "../untrusted-text.js";
+import { existsSync, realpathSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { resolveKey, violationDetails, violationText, withinAnyRoot } from "../../tools/fs/safety.js";
+import { createArtifactTool } from "../../tools/artifact/artifact-tool.js";
+function realAncestorPath(p) {
+    const abs = resolve(p);
+    const tail = [];
+    let cur = abs;
+    while (!existsSync(cur)) {
+        const parent = dirname(cur);
+        if (parent === cur)
+            return abs;
+        tail.unshift(basename(cur));
+        cur = parent;
+    }
+    return tail.length === 0 ? realpathSync(cur) : join(realpathSync(cur), ...tail);
+}
+export function prepareArtifact(input) {
+    const { deps, runId, taskId, sessionId, agentName, executionEnv, rootCanonical, additionalRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, roster, firstPartyOffload, envHandToolNames } = input;
+    const host = deps.artifactHost;
+    if (host === undefined)
+        return { artifactPlane: undefined };
+    const refuse = (problem) => {
+        deliverEngineNotice(deps.onNotice, {
+            code: "config.artifact_host_invalid",
+            message: `RunnerDeps.artifactHost is wired but unusable, so no Artifact tool is mounted for this task: ${problem}`,
+            detail: { problem, sessionId, runId },
+        });
+        return { artifactPlane: undefined };
+    };
+    const verdict = readArtifactHostCapabilities(host);
+    if (!verdict.ok)
+        return refuse(verdict.problem);
+    const storageDir = verdict.capabilities.storageDir;
+    if (storageDir !== undefined && rootCanonical !== undefined) {
+        const real = realAncestorPath(storageDir);
+        const inside = [rootCanonical, ...additionalRootsCanonical].find((root) => withinAnyRoot([root], real));
+        if (inside !== undefined)
+            return refuse(`the local artifact store ${storageDir} lies inside a root this run may reach through its file tools (${inside}); put the store outside every task root and additional directory`);
+    }
+    try {
+        host.onMount?.(runId);
+    }
+    catch (err) {
+        return refuse(`artifactHost.onMount threw: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const readLocalFile = async (path, maxBytes, signal) => {
+        if (rootCanonical === undefined)
+            return { ok: false, reason: "refused", text: "Error (Artifact): this task has no filesystem root, so a local file cannot be published." };
+        const rk = await resolveKey(executionEnv, rootCanonical, path, signal, handsCwdRef?.current, additionalRootsCanonical, undefined, readDenyMatcher, resolvedReadFace);
+        if (!rk.ok)
+            return { ok: false, reason: "refused", text: violationText("Artifact", rk.violation), details: violationDetails(rk.violation) };
+        const meta = await executionEnv.fileInfo(rk.key, signal);
+        if (!meta.ok)
+            return { ok: false, reason: "refused", text: `Error (Artifact): cannot stat ${inlineUntrusted(path, 200)} (${inlineUntrusted(meta.error.code, 40)}).` };
+        if (meta.value.kind !== "file")
+            return { ok: false, reason: "not_a_file", kind: meta.value.kind };
+        if (meta.value.size > maxBytes)
+            return { ok: false, reason: "too_large", size: meta.value.size, limit: maxBytes, judgedOn: "metadata" };
+        const r = await executionEnv.readBinaryFile(rk.key, signal);
+        if (!r.ok)
+            return { ok: false, reason: "refused", text: `Error (Artifact): cannot read ${inlineUntrusted(path, 200)} (${inlineUntrusted(r.error.code, 40)}).` };
+        if (r.value.byteLength > maxBytes)
+            return { ok: false, reason: "too_large", size: r.value.byteLength, limit: maxBytes, judgedOn: "bytes" };
+        return { ok: true, key: rk.key, bytes: r.value };
+    };
+    const artifactSpec = createArtifactTool({ host, capabilities: verdict.capabilities, runId, taskId, sessionId, ...(agentName !== undefined ? { agentName } : {}), readLocalFile });
+    roster.mount(firstPartyOffload(defineTool(artifactSpec)), { source: "builtin", mountedBy: "optional" });
+    envHandToolNames.add(ARTIFACT_TOOL_NAME);
+    return { artifactPlane: verdict.capabilities.plane };
+}

package/dist/core/runner/prepare-ask-lane.d.ts

@@ -1,16 +1,16 @@
 /**
- * design/390 §1.2 M19 (ask lane) — prepareTask's IN-STREAM ASK LANE, verbatim from the driver's gate-machinery block:
+ * PrepareTask's IN-STREAM ASK LANE, verbatim from the driver's gate-machinery block:
  * the per-call signal composition bound to this task's run signal, the abort-bound `adjudicate` wrapper (the budget
  * snapshot and the live tracked cwd stamped onto every request), the approval-preview projection over the live roster,
  * the `resolveAskBound` mint (the inherited-unavailable intercept, the duplicate-frame grant reuse, the human-review
  * ledger, the bare-human-rejection record), the pre-wrapped deny observer and the hook-crash notifier. The three
  * module-scope helpers only this segment called moved with it (the deny-observer factory, the preview sanitizer and
- * resolver). The interface is the dependency list the segment had implicitly (design/238 R-1) — the closures below
+ * resolver). The interface is the dependency list the segment had implicitly — the closures below
  * used to capture every seat here off the driver's scope.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (every await lives inside the closures
  * it builds, which run per tool call), so the phase adds no yield between the wiring-manifest station before it and
- * the suspend saga after it (design/390 §1.5: a stretch with no await is extracted as a sync function). Read-stability
+ * the suspend saga after it (a stretch with no await is extracted as a sync function). Read-stability
  * of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  *
  * The lane exists exactly when the wiring-manifest phase's `gateMachineryActive` holds — the driver's `if` around the

package/dist/core/runner/prepare-boundary-parks.d.ts

@@ -1,15 +1,15 @@
 /**
- * design/390 §1.2 M19 (boundary parks) — prepareTask's three BOUNDARY-FAMILY park lanes, verbatim from the driver's
+ * PrepareTask's three BOUNDARY-FAMILY park lanes, verbatim from the driver's
  * gate-machinery block: the ONE resource mint (`mintResourceSuspend`) behind the task-axis `suspendForResource` (exposed
  * under the caller's `resourceSuspend` opt-in) and the infrastructure `suspendForPlatformLimit` (exposed on durable infra
  * alone), and the `plan_review` mint behind `suspendForReview` (exposed with a checkpoint store). Every mint reuses the
  * suspend saga's serializer, commit saga, loop cap and env split — this phase adds no second copy of any of them. The
- * interface is the dependency list the segment had implicitly (design/238 R-1); the three lanes used to be forward-declared
+ * interface is the dependency list the segment had implicitly; the three lanes used to be forward-declared
  * `let`s at task scope, assigned inside the block, so the driver's Prepared could expose them — they are this phase's
  * Result now, and the driver binds them as consts.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (the mints run at a turn boundary), so the
- * phase adds no yield between the suspend saga before it and the park closure after it (design/390 §1.5). Read-stability
+ * phase adds no yield between the suspend saga before it and the park closure after it. Read-stability
  * of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  *
  * The lanes exist exactly when the saga does (the ask lane's presence law) — an absent saga answers three absent lanes,

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -1,12 +1,12 @@
 /**
- * design/390 §1.2 M4 — prepareTask's CAPS-AND-WORKFLOW phase, verbatim from the driver: the caller-tool roster
+ * PrepareTask's CAPS-AND-WORKFLOW phase, verbatim from the driver: the caller-tool roster
  * map (the defineTool-product branch and the rich-ctx wrap through the large-result wrapper), the ReportBlocked /
  * ReportFindings / plan-pair mounts, the per-principal runtime caps resolve with its fail-closed degrade and value
  * screen, the compliance posture veto with its two refusal codes, the fork verdict and the observers grant, the
  * auto-mode arming (classifier model, lane rule, decider + denial tracker + persisted recipe) with its manifest
  * reason, the self-orchestration gate with its governance note, and the Workflow mount with its size-guideline
  * seat. The three arming helpers and the parent-capture-state join moved with the segment (only this phase calls
- * them). The interface is the dependency list the segment had implicitly (design/238 R-1).
+ * them). The interface is the dependency list the segment had implicitly.
  *
  * ASYNC PHASE: the segment awaits the two resolvers, the classifier route pre-flight and the Workflow factory,
  * exactly where the driver awaited them; the roster map and the synthetic mounts before the first of those awaits
@@ -14,7 +14,7 @@
  * (`@contract prepare.deps-read-stable`).
  *
  * THE ROSTER IS MINTED HERE (`tools`): every later phase that mounts pushes into this same array — the writer table
- * lives on {@link Prepared.tools} (design/238 R-3). LATE-BOUND SEATS: the Workflow mount's call-time getters read
+ * lives on {@link Prepared.tools}. LATE-BOUND SEATS: the Workflow mount's call-time getters read
  * three facts later stations resolve (the memory session, the center adoption, the hands mount's deny additions);
  * each enters as a getter on the Input and is read exactly where the driver's getter read the variable.
  */
@@ -37,10 +37,11 @@ import type { ReadFace } from "../../tools/fs/index.js";
 import type { InheritedGate, Prepared, RunInternals, RunnerSelfSeat, ToolFaceSnapshot } from "./contracts.js";
 import { type BlockedRef } from "./synthetic-tools.js";
 import { RosterBuilder } from "../tool-roster.js";
+import type { ParentSpecSeat } from "../parent-spec-seat.js";
 export interface PrepareCapsAndWorkflowInput {
     /** borrowed-readonly — the REBOUND spec, whole: the roster map reads `tools`; the mounts read `enableBlockedReport`,
      *  `enablePlanMode`, `interactiveTools`; the caps/compliance stations read `principal`, `selfOrchestration`,
-     *  `enableFork`, `getApiKeyAndHeaders`; the Workflow mount forwards `oneShot`, `handsReadOnly`, `interactiveTools`. The
+     *  `enableFork`, `getApiKeyAndHeaders`; the Workflow mount forwards `handsReadOnly`, `interactiveTools`. The
      *  self-orchestration predicate takes the whole spec. Never mutated. */
     spec: TaskSpec;
     /** borrowed-readonly — the deployment seats, whole: `runtimeCapsResolver`, `compliancePostureResolver`, `onError`, `onNotice`,
@@ -54,7 +55,7 @@ export interface PrepareCapsAndWorkflowInput {
     checkpointSeat: CheckpointSeat | undefined;
     /** borrowed-readonly — the trusted spawn-side channel; the Workflow mount forwards `rootSessionId`, `placementRoot`,
      *  `onTaskNotification`, `workflowDepth`, and the capture-floor getter reads `memoryCaptureAncestors`. */
-    internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors" | "workflowParkedResume"> | undefined;
+    internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors" | "workflowParkedResume" | "questionFaceStripped"> | undefined;
     /** borrowed-readonly — the acquired session; the classifier leg rebuilds its transcript window from `buildContext`. */
     session: Pick<StoredSession, "buildContext">;
     /** borrowed-readonly — the acquired session id (operator-line context, the refusal codes' phase record). */
@@ -88,6 +89,7 @@ export interface PrepareCapsAndWorkflowInput {
     };
     /** borrowed-readonly — the FROZEN approver seat (the Workflow mount's parentOnAsk). */
     frozenOnAsk: OnAsk | undefined;
+    /** borrowed-readonly — the parent SPEC seat the children inherit (minted once by the inherited-gate phase; the Workflow mount's dep, the same value the delegation ctx carries). */ parentSpecSeat: ParentSpecSeat;
     /** borrowed-readonly — the ONE read-face carrier expression (the Workflow mount's parentReadFace getter calls it). */
     carrierReadFace: () => ReadFace | undefined;
     /** borrowed-readonly — the filtered display-forwarding wrapper (the Workflow mount's forwardEvent; absent ⇒ no key). */
@@ -130,7 +132,7 @@ export interface PrepareCapsAndWorkflowInput {
     }>;
 }
 export interface PrepareCapsAndWorkflowResult {
-    /** owned — THE run's roster BUILDER (design/388: the mount array is private to it; `Prepared.tools` is its read face,
+    /** owned — THE run's roster BUILDER (the mount array is private to it; `Prepared.tools` is its read face,
      *  whose JSDoc carries the writer table). Minted here from the caller's tools; every later mount goes through its verbs.
      *  Writers here: the caller mounts, then the ReportBlocked, ReportFindings, ExitPlanMode, EnterPlanMode and Workflow mounts. */
     roster: RosterBuilder;
@@ -150,7 +152,7 @@ export interface PrepareCapsAndWorkflowResult {
     /** owned — the observers grant (`allowObservers === true`, explicit opt-in). */
     observersActive: boolean;
     /** owned — the arming outcome as a closed reason (the manifest's auto-mode face). */
-    /** #529 / #692 C-d — the leg's auto-mode arming fact (`armed` ⇔ `reason === "armed"`; `deniedSource` only beside a STATED `denied`). */
+    /** The leg's auto-mode arming fact (`armed` ⇔ `reason === "armed"`; `deniedSource` only beside a STATED `denied`). */
     autoModeArmReason: AutoModeArmFact;
     /** owned — the armed classifier, or undefined when any arming arm failed. */
     autoModeDecider: AutoModeDecider | undefined;

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -112,7 +112,7 @@ function autoModeArmReasonOf(intent, facePresent, caps, capsFaulted) {
     return { armed: true, reason: "armed" };
 }
 export async function prepareCapsAndWorkflow(input) {
-    const { spec, deps, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
+    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
     const roster = new RosterBuilder(toolEffects);
     for (const t of spec.tools ?? []) {
         const mounted = mountCallerTool(t);
@@ -312,8 +312,7 @@ export async function prepareCapsAndWorkflow(input) {
                         return mine.length > 0 ? mine : undefined;
                     } }
                 : {}),
-            principal: spec.principal,
-            oneShot: spec.oneShot,
+            parentSpecSeat, ...(internals?.questionFaceStripped === true ? { parentQuestionFaceStripped: true } : {}),
             ...(resolvedInteractionPosture !== undefined ? { parentInteractionPosture: resolvedInteractionPosture } : {}),
             parentMemoryCaptureState: () => {
                 const memoryEngineSession = input.memoryEngineSession();

package/dist/core/runner/prepare-config-doors.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/238 B-1 (P0 相位抽取) — prepareTask's config-doors phase: the synchronous stretch from the
+ * PrepareTask's config-doors phase: the synchronous stretch from the
  * tool-face snapshot freeze through model/thinking/compaction-model resolution. The inputs are
  * exactly the fields of {@link PrepareConfigDoorsInput} (the original extraction slice — spec, deps,
  * sessions, the resume/internals seats); the outputs are the fields of
@@ -14,7 +14,7 @@
  * `prepare-task-phase-pins` microtask-latch tests.
  *
  * Throws pass through unchanged: every `config.*` / `resume_at.*` refusal here is a DELIBERATE
- * at-the-door rejection (design/99 §E18 — a throw before acquisition needs no cleanup), and the
+ * at-the-door rejection (a throw before acquisition needs no cleanup), and the
  * interaction-posture door's `deps.onError` disclosure (call order and payload) is part of the
  * contract. The per-task agents rebind returns a REBOUND spec (shallow copy, only `tools`
  * replaced) — the caller's object is never mutated; the safety scan must receive the rebound one.
@@ -22,7 +22,7 @@
 import { type BrainCallGuardrailRef } from "../../brain/timeout.js";
 import type { Model } from "../../internal/llm.js";
 import type { ThinkingLevel } from "../../internal/harness.js";
-import type { ContextEditMachine } from "../context-edit.js";
+import { type MicroCompactMachine } from "../context-edit.js";
 import { type LockedPreflight } from "../locked-config.js";
 import { type ResolvedRole } from "../roles.js";
 import type { SessionStore } from "../session.js";
@@ -33,7 +33,7 @@ export declare function limitConfigError(code: string, message: string): Error &
     code?: string;
 };
 /**
- * design/164 — validate `TaskSpec.limits` at the door and return it unchanged.
+ * Validate `TaskSpec.limits` at the door and return it unchanged.
  *
  * Two refusals, both fail-loud (the {@link resolveStallTimeoutMs} posture: a bound nobody can evaluate is
  * not a bound, and folding it to a default would silently run the task under limits nobody chose):
@@ -47,7 +47,7 @@ export declare function limitConfigError(code: string, message: string): Error &
  */
 export declare function resolveTaskLimits(limits: TaskLimits | undefined): TaskLimits | undefined;
 /**
- * RB-318 — validate the MODE-VALUED members of `TaskSpec.attachments` at the same door, and return the
+ * Validate the MODE-VALUED members of `TaskSpec.attachments` at the same door, and return the
  * config unchanged. Today that is exactly one member, `totalTokensReminderMode`.
  *
  * WHY A DOOR AT ALL (坏值响亮度律): a knob whose bad value silently folds to the default is a knob the
@@ -66,14 +66,14 @@ export declare function resolveTaskLimits(limits: TaskLimits | undefined): TaskL
  *    folded into this lane's change.
  *
  * A NON-OBJECT CONTAINER (`attachments: null` off a wire, above all) is neither refused nor crashed on
- * (review finding, verified by reading): every consumer reads this config through `attachmentsCfg?.…`,
+ * (verified by reading): every consumer reads this config through `attachmentsCfg?.…`,
  * so a null container already means "no lanes are wired" and the spec RUNS today. An unguarded property
  * read here — the first cut — turned that running spec into an untyped `TypeError` from inside a door
  * that promises a typed `config.attachment_invalid`, and refusing it instead would newly reject a spec
  * that works. There is no container-shape door in this family yet; that is a separate widening, not
  * something this lane gets to invent on the way past.
  *
- * The bypass is narrowed to values that CANNOT supply attachment fields (round-2 review finding): a
+ * The bypass is narrowed to values that CANNOT supply attachment fields: a
  * plain-JS caller can hand this a FUNCTION carrying `totalTokensReminderMode` as a property, and every
  * downstream `attachmentsCfg?.…` read would happily find it — so skipping a function here would fold a
  * typo'd mode to the default through exactly the hole this door exists to close. Functions are
@@ -85,13 +85,13 @@ export declare function resolveAttachmentsConfig(attachments: TaskSpec["attachme
  * `fable_5_mitigations` capability / claude-mythos-5), ORTHOGONAL to the simple/classic profile.
  * sema is BYOM, so the id may carry provider prefixes ("anthropic/claude-fable-5",
  * "openrouter/anthropic/claude-fable-5"): BOUNDARY-AWARE family match on the last path segment
- * (统一复审 F3 — raw substring classified "vendor/not-claude-fable-5" and "claude-mythos-50"
+ * (raw substring classified "vendor/not-claude-fable-5" and "claude-mythos-50"
  * as fable), case-normalized. Recognition set = CC's _Nr (startsWith "claude-fable-") + b9e
  * (mythos-5). R3 system sections fork on the resulting fact.
  */
 export declare function isFableFamilyModelId(id: string): boolean;
 /**
- * RB-50 (CC 2.1.220 启示①, 2026-07-25): the SINGLE decision point for the two prompt-shape axes.
+ * The SINGLE decision point for the two prompt-shape axes.
  * Both were resolved in separate places with different mechanisms — `promptProfile` off a TaskSpec field,
  * `fableMitigations` off a raw model-id prefix test — so "which shape does this task speak" had no one
  * place to read. CC 2.1.220's counterpart is a model-registry `capabilities` array (one table drives
@@ -139,18 +139,18 @@ export interface PrepareConfigDoorsResult {
      *  later face reads consult (own-task filter, defer classify, delegation ctx). Frozen-immutable ⇒
      *  shared by reference into tool execution ctxs. */
     toolFaceSnapshot: ToolFaceSnapshot;
-    /** owned — the profile half of the RB-50 single decision point (model-independent by contract). */
+    /** owned — the profile half of the single decision point (model-independent by contract). */
     promptProfile: "simple" | "classic";
     /** owned — the administrator lock snapshot; the rest of prepare reads guarded slots through it. */
     lockedPreflight: LockedPreflight;
     /** owned — the resolved interaction posture (spec > spawning run > deployment); the
      *  AskUserQuestion mount and the child-ctx injection read this same value. */
     resolvedInteractionPosture: "interactive" | "headless" | undefined;
-    /** owned — the validated/resolved microCompact knob (design/374; {@link resolveMicroCompactKnob}
+    /** owned — the validated/resolved microCompact knob ({@link resolveMicroCompactKnob}
      *  for the door + placement reasoning). The per-run state builder consumes exactly these values —
      *  the deps bag is never re-read after this door. */
     microCompactKnob: {
-        machine: "off" | ContextEditMachine;
+        machine: MicroCompactMachine;
         clearOnRejection: boolean;
     };
     /** owned — the resolved role; its `systemPrompt` seat is still read at prompt-input time. */
@@ -163,9 +163,9 @@ export interface PrepareConfigDoorsResult {
     /** owned — the compaction model: explicit wins, else the `summarize` role, else undefined (main
      *  model fallback inside maybeCompact). NOT derivable from {@link resolvedRole}. */
     compModel: Model | undefined;
-    /** owned — the mitigations half of the RB-50 decision point (model-family fact). */
+    /** owned — the mitigations half of the decision point (model-family fact). */
     fableMitigations: boolean;
-    /** owned, frozen — design/277 model-gate DISCLOSURE data (the application itself already
+    /** owned, frozen — model-gate DISCLOSURE data (the application itself already
      *  happened on {@link spec}: its `tools` is the survivor rebind when anything was removed).
      *  prepareTask emits the notices from this after the doors return (the onNotice station);
      *  the doors stay side-effect-free on the announcement axis. */
@@ -178,18 +178,18 @@ export interface PrepareConfigDoorsResult {
          *  material; the in-force arm never lands here — it throws at the door). */
         discardedEnvRaw: string | undefined;
     };
-    /** owned — the NORMALIZED per-leg delegation-evidence standard (design/324): the deps seat read
+    /** owned — the NORMALIZED per-leg delegation-evidence standard: the deps seat read
      *  ONCE, in this synchronous pre-await stretch, screened, and absent folded to the "static-face"
      *  default. The delegation wrap consumes THIS value, never the live deps object — a deps seat
      *  mutated (or getter-backed) after the door must not present an unscreened value to the mark
-     *  branch (the #245 5.33 read-once posture). */
+     *  branch (the read-once posture). */
     memoryDelegationEvidence: "static-face" | "attested-only";
-    /** owned — the NORMALIZED memory-provenance mode (design/336 §13-3): the deps seat read ONCE in
-     *  the synchronous pre-await stretch, screened (#123), absent folded to the `"carry"` default.
+    /** owned — the NORMALIZED memory-provenance mode: the deps seat read ONCE in
+   *  the synchronous pre-await stretch, screened, absent folded to the `"carry"` default.
      *  The memory phase constructs every engine with THIS value — never a live deps re-read. */
     memoryProvenance: "off" | "carry";
-    /** owned — the NORMALIZED memory-capture posture (design/383 §3.1): the deps seat read ONCE,
-     *  screened (#123 — a bad value refuses, never folds), absent folded to `"open"`. The capture
+    /** owned — the NORMALIZED memory-capture posture: the deps seat read ONCE,
+     *  screened (a bad value refuses, never folds), absent folded to `"open"`. The capture
      *  opt-out adjudicator consumes THIS value on every leg (declaration, resume record re-check,
      *  and the flip verb's frozen closure) — never a live deps re-read. */
     memoryCapturePolicy: "open" | "governed" | "capture-required";
@@ -202,9 +202,9 @@ export interface PrepareConfigDoorsResult {
      *  the resolver's off states). */
     brainCallGuardrailMs: number | undefined;
 }
-/** design/374 — the microCompact knob door (坏值响亮度默认律, the sibling knob doors' form:
- *  interactionPosture / toolModelGate / staleToolResultOffload). Placement is load-bearing (review
- *  r3): it runs in THIS pre-first-await config-doors phase so a malformed declaration refuses
+/** The microCompact knob door (坏值响亮度默认律, the sibling knob doors' form:
+ *  interactionPosture / toolModelGate / staleToolResultOffload). Placement is load-bearing:
+ *  it runs in THIS pre-first-await config-doors phase so a malformed declaration refuses
  *  BEFORE any resource-bearing preparation — session acquisition, execution-env creation, the MCP
  *  dial — whose external effects a late refusal's teardown cannot undo. SINGLE READ per seat, and
  *  the CONTAINER is judged first (reviews r1/r2): an accessor-backed bag answering a legal value at
@@ -213,7 +213,7 @@ export interface PrepareConfigDoorsResult {
  *  it must refuse exactly like a malformed field, never fold to the defaults. The RESOLVED values
  *  returned here are immutable and are the state builder's ONLY source — nothing re-reads the bag. */
 export declare function resolveMicroCompactKnob(bag: RunnerDeps["microCompact"]): {
-    machine: "off" | ContextEditMachine;
+    machine: MicroCompactMachine;
     clearOnRejection: boolean;
 };
 export declare function prepareConfigDoors(input: PrepareConfigDoorsInput): PrepareConfigDoorsResult;