@sema-agent/core 7.15.0 → 7.17.0

package/dist/core/task-registry.d.ts

@@ -53,7 +53,7 @@ export interface TaskPollOptions {
     timeoutMs?: number;
     /** Abort signal — a blocked wait must stop when the tool call is cancelled. */
     signal?: AbortSignal;
-    /** RB-220 — mirrors {@link import("./types.js").TaskSpec.oneShot} (see {@link TaskToolOptions.oneShot}
+    /** Mirrors {@link import("./types.js").TaskSpec.oneShot} (see {@link TaskToolOptions.oneShot}
      *  for the full contract): forwarded to the background_agent lane's still-running poll body so it
      *  does not teach "you will be notified" when this run has no later turn to receive one. */
     oneShot?: boolean;
@@ -88,7 +88,7 @@ export interface TaskToolOptions extends TaskAccess {
      *  historical wording); prepare-task passes the real wiring state. */
     notificationWired?: boolean;
     /**
-     * RB-220 — mirrors {@link import("./types.js").TaskSpec.oneShot}: this run has no later turn for an
+     * Mirrors {@link import("./types.js").TaskSpec.oneShot}: this run has no later turn for an
      * async background notification to land in (a headless `-p` process exits once the turn ends).
      * Threaded into the background_agent lane's non-blocking/blocked-timeout "still running" poll body
      * (see {@link import("./task-registry-agent.js").pollBackgroundAgentLane}), which otherwise taught
@@ -122,7 +122,7 @@ export interface AccessibleTaskRow {
     parentTaskId?: string;
     parentSessionId?: string;
     rootSessionId?: string;
-    /** RB-478 — the row's registration instant (the original spawn time for a first-cycle row): the
+    /** The row's registration instant (the original spawn time for a first-cycle row): the
      *  revive projection needs it so a revive frame's `startedAt` anchors the ROW, not the wake call. */
     createdAt?: number;
 }
@@ -139,11 +139,11 @@ export declare class TaskRegistry {
      *  (cap overflow dropped the watcher; the owner's tasks may still be running — the subscriber must
      *  NOT treat this as quiescence). */
     private bgQuiescenceWatchers;
-    /** RB-463 — one host-callback isolation scope for this registry's five notification seams (reap terminal
+    /** One host-callback isolation scope for this registry's five notification seams (reap terminal
      *  notifier, session-reap hooks, quiescence fire + cap-overflow eviction, terminal-once send). Same swallow
      *  as the five hand-written try/catches it replaced, now counted per site and readable for diagnostics. */
     private readonly notifier;
-    /** RB-473 — the read face for this registry's CONTAINED host-callback failures (site → count).
+    /** The read face for this registry's CONTAINED host-callback failures (site → count).
      *  The registry has no deployment error sink of its own to disclose to (it is process-global,
      *  constructed before any RunnerDeps exists), so readability IS its disclosure grade: a deployment
      *  that suspects a broken observer polls this instead of grepping for silence. Empty on the
@@ -241,7 +241,7 @@ export declare class TaskRegistry {
         agentStore: import("./background-agent-store.js").BackgroundAgentStore;
     }, ticket: ParkedClaimTicket): Promise<boolean>;
     finalizeParkedResume(id: string): void;
-    /** RB-425: `outcome.cycle` names the revive cycle this settle speaks for (absent = 0 = the original
+    /** `outcome.cycle` names the revive cycle this settle speaks for (absent = 0 = the original
      *  spawn cycle). A spawn leg never passes it; a caller that settles by LIFECYCLE AUTHORITY (reap /
      *  session release — "whatever is running under this row dies") passes the row's current cycle. See
      *  {@link settleBackgroundAgentLane} for why a stale stamp must be a no-op. */
@@ -283,7 +283,7 @@ export declare class TaskRegistry {
         suggestion?: string;
     };
     markRetainedContinuation(id: string): void;
-    /** #258 — the row's current stop-cycle counter, read by the spawn lanes right after registering to
+    /** The row's current stop-cycle counter, read by the spawn lanes right after registering to
      *  thread into the child's `RunInternals.cycleSeq`; see {@link backgroundAgentCycleSeqLane}. */
     backgroundAgentCycleSeq(id: string): number | undefined;
     /** Subagent transcript persistence (delegation entry caps) — one delegation tree's ACTIVE
@@ -399,7 +399,7 @@ export declare class TaskRegistry {
      *  watcher/stop lanes mark and read it too); workflow cancellation is out of scope. */
     markStopSource(id: string, source: StopSource): void;
     /**
-     * RB-164 — attribute an ENV-LEVEL blanket sweep before it runs.
+     * Attribute an ENV-LEVEL blanket sweep before it runs.
      *
      * The incident: a user's `run_in_background` Bash died mid-run reporting `stopped-by:"system"` with a
      * zero-byte output file, and diagnosing it took a cross-repo investigation with a timeline argument.

package/dist/core/task-result.d.ts

@@ -35,7 +35,7 @@ import type { NestedUsage } from "./tool-spec.js";
  */
 export type TaskStatus = "completed" | "blocked" | "failed" | "suspended" | "needs_review";
 /**
- * RB-439-a — one remote-workspace lifecycle failure, reported as data on {@link TaskResult.remoteEnvFailures}.
+ * One remote-workspace lifecycle failure, reported as data on {@link TaskResult.remoteEnvFailures}.
  * See that field for why the eleven-code taxonomy needed a structured channel to reach a caller at all.
  */
 export interface RemoteEnvFailureNote {
@@ -127,7 +127,7 @@ export type EffectiveMemoryScopes = {
 export interface TaskResult {
     taskId: string;
     /**
-     * #499 — the ENGINE-minted identity of THIS run (uuidv7), minted once at the top of prepare and
+     * The ENGINE-minted identity of THIS run (uuidv7), minted once at the top of prepare and
      * never rewritten. The third id of the trio, and the only one the engine owns:
      *  - {@link taskId} — the HOST's task identity, or (when the host named none) the session id: it is
      *    `spec.taskId ?? sessionId` and therefore answers the SAME value for every run of one session;
@@ -168,7 +168,7 @@ export interface TaskResult {
      *  requested ref. A mid-run degradation is observed separately (see the degraded-model fields). */
     model?: string;
     /**
-     * #327 — the leg's effective REASONING resolution: the result-face twin of {@link model} for the thinking
+     * The leg's effective REASONING resolution: the result-face twin of {@link model} for the thinking
      * knob. How the requested tier resolved against the serving model's real capability
      * (`requested`/`effective`/`graded`/`clamped`/`format`/`endpoint`, plus `dropped:true` when a
      * non-reasoning model dropped the request entirely — field semantics on
@@ -230,7 +230,7 @@ export interface TaskResult {
      */
     salvagedOutput?: string;
     /**
-     * RB-439-a — the remote-workspace lifecycle failures this run hit, as DATA. The seam declares eleven
+     * The remote-workspace lifecycle failures this run hit, as DATA. The seam declares eleven
      * distinct `RemoteExecutionErrorCode`s, but every one of them used to reach the caller as the same
      * thing: a `suspendVM` refusal was swallowed into the `onError` side channel and the result read
      * `limits.max_turns_exceeded` (identical for a transient auth blip and a permanently-unsupported adapter), while
@@ -430,34 +430,34 @@ export interface TaskResult {
      */
     haltedOnUserRejection?: true;
     /**
-     * design/373 (#504) — present (`true`) exactly when a {@link TaskStream.halt} was ACCEPTED while
-     * this run was live: the person issued the bare user interrupt (the CC Esc form — cut the
-     * in-flight turn, stop at that boundary, wait for their next input). The ruled terminal form is
-     * completed-with-marker, this seat being the marker: `status` is `"completed"` on the ordinary
-     * path (a clean, resumable ending — nothing failed, nothing is suspended, the session continues
-     * via the ordinary next-run front door), and this field is what tells a person-stopped ending
-     * apart from a natural finish — same reading discipline as {@link haltedOnUserRejection}, its
-     * sibling seat ("stopped by the user, awaiting their direction", never "the task finished its
-     * work"). `result` is whatever the model had produced before the halt (possibly empty — a halt
-     * can land before any output; the run then completes empty rather than failing). Pass-through on
-     * EVERY terminal the run still reaches (a halt ACCEPTED first that then raced a real
-     * failure/limit truthfully says a person also stopped it), and — the stated honest window — on
-     * a natural completion the halt arrived too late to prevent (past the loop's final commit
-     * point): the fact reported is the ACCEPTED HALT, and the transcript says how far the model
-     * got. First-writer-wins against the run's abort (the `interrupt()` attribution law, the same
-     * gate): a halt landing AFTER the abort signal already fired neither cut nor stopped anything —
-     * that ending belongs to the abort, and this seat stays ABSENT rather than signing someone
-     * else's stop with the halt caller's name. Absent everywhere else; never `false`.
-     *
-     * design/384 slice 2 (TRANSITIONAL narrowing): a `"suspended"` / `"needs_review"` terminal does
-     * NOT carry this seat even when a halt was accepted — those statuses mean a durable park WON its
-     * race with the halt (the row is committed and redeemable; the run is waiting to continue), and
-     * "stopped by the person" beside "waiting to resume" was a self-contradictory pair. The halt's
-     * own receipt (`{turnCut}`) and the `task.turn_interrupted` notice still stand — a seat WAS cut.
-     * Transitional: once halt-boundary source accounting lands (slice 3), the boundary-CONSUMED
-     * suspension arms flip to signing (a probe pinning today's suppressed shape goes red then, by
-     * design). The pass-through law is untouched for every OTHER terminal: a halt racing a real
-     * failure/limit — including one that outranks a committed park — still signs.
+     * Present (`true`) exactly when a {@link TaskStream.halt}
+     * (the bare user interrupt, the CC Esc form — cut the in-flight turn, stop at that boundary, wait
+     * for the person's next input) was CONSUMED by this run: the engine's own record says the run
+     * ended FOR it. The attribution law, one sentence: signed ⇔ the halt's cut settled a turn (the loop
+     * reported the interrupt settlement it took for the seat the halt aborted — stream shape, batch
+     * shape, or the recovery lane's arms) OR the halt's stop request was among the sources a boundary
+     * consult stopped the loop for (the pre-turn guard that refuses the next turn — the birth-window
+     * halt included — or the post-turn consult). The MINTER states the fact; the result assembly reads
+     * it and never infers causation from the final's shape (a brain minting its own `aborted` final
+     * beside a late halt reads as the failure it is) nor from the verb's acceptance.
+     *
+     * The ruled terminal form is completed-with-marker, this seat being the marker: `status` is
+     * `"completed"` on the ordinary path (a clean, resumable ending — the session continues via the
+     * ordinary next-run front door), and this field is what tells a person-stopped ending apart from a
+     * natural finish — same reading discipline as {@link haltedOnUserRejection}, its sibling seat
+     * ("stopped by the user, awaiting their direction", never "the task finished its work"). `result` is
+     * whatever the model had produced before the halt (possibly empty). Rides EVERY terminal a
+     * consumed halt reaches — a halt whose cut settled a turn and then raced a real failure/limit, or
+     * whose boundary stop coincided with a review/resource park (`needs_review` / `suspended`),
+     * truthfully says a person also stopped it (the slice-2 status-keyed suppression is retired).
+     *
+     * ABSENT (never `false`) whenever the halt was not consumed, however it was answered: a halt
+     * landing after the run's abort already fired (first-writer-wins, the `interrupt()` attribution
+     * law — that ending belongs to the abort); a halt accepted while the run was already ending for its
+     * own reason (a natural completion past the loop's final commit point, a brain's own terminal, a
+     * durable approval park whose commit won the race and whose abort then owned the ending); a
+     * steer-now cut (its stamp is `steer`). In every such case the halt's trace is its verb receipt plus
+     * one `task.halt_unconsumed` notice — the seat is never signed on a guess.
      */
     haltedByUser?: true;
     /**
@@ -475,7 +475,7 @@ export interface TaskResult {
         toolCallId: string;
     }>;
     /**
-     * #481 — HOST-SUPPLIED: the approval plane's report that this leg ended with human approvals still
+     * HOST-SUPPLIED: the approval plane's report that this leg ended with human approvals still
      * OUTSTANDING (the ask identities it is holding, and when the OLDEST of them was created).
      *
      * **Who writes it, and why not the engine.** Core mints no ask identity — an ask id belongs to the
@@ -502,7 +502,7 @@ export interface TaskResult {
         oldestCreatedAtMs: number;
     };
     /**
-     * #485 — HOST-SUPPLIED: how long this leg spent BLOCKED on human approvals, in ms, as the deployment's
+     * HOST-SUPPLIED: how long this leg spent BLOCKED on human approvals, in ms, as the deployment's
      * approval plane measured it. Same writer and same absence contract as {@link pendingApproval}: the
      * approval clock belongs to whoever holds the ask, so the figure is SINGLE-SOURCED there and core neither
      * estimates it nor accumulates it (two sides publishing two numbers for one wait is the drift this seat
@@ -521,7 +521,7 @@ export interface TaskResult {
      */
     approvalWaitedMs?: number;
     /**
-     * #240 (design/199 v1.1) — the READ-face this leg's read surfaces actually judged under, as an
+     * The READ-face this leg's read surfaces actually judged under, as an
      * engine-filled OBSERVATION (never a knob: writing it on a spec does nothing). It is the run's ONE
      * resolved face — the same value the hands toolkit enforced and the delegation carriers rode — with
      * the hands-less resume pin folded in (a row resumed on a hands-less worker still reports the
@@ -543,7 +543,7 @@ export interface TaskResult {
      */
     effectiveReadFace?: import("../tools/fs/read-face.js").ReadFace;
     /**
-     * #240 (design/199 v1.1) — the sensitive-path deny ADDITIONS in force on this leg beyond the
+     * The sensitive-path deny ADDITIONS in force on this leg beyond the
      * built-in table, normalized (deployment ∪ task ∪ checkpoint-frozen seed), as an engine-filled
      * OBSERVATION. "In force" = judged by this leg's own read surfaces where they mounted, and carried
      * to its delegation subtree either way (a hands-less resume leg reports the entries its children
@@ -638,7 +638,7 @@ export interface TaskResult {
         /** The cache-INCLUSIVE prompt total across the task's turns — `promptTokens + cachedTokens +
          *  cacheWriteTokens + cacheWriteTokensLong`, matching OTel `gen_ai.usage.input_tokens`. This is the
          *  quantity cost is computed from, the denominator of `cacheHitRate`, and the figure to use for
-         *  "how much context did this task present" (window/budget views). RB-457-a: `promptTokens` carried
+         *  "how much context did this task present" (window/budget views). `promptTokens` carried
          *  this value up to 2.13.x; it now carries the cache MISS count and this field is its own
          *  accumulator rather than an alias. Optional BY DESIGN, like every usage field on this stats
          *  face: undefined means the gateway reported no usage (and pre-3.0.0 persisted rows never had

package/dist/core/task-spec.d.ts

@@ -447,7 +447,7 @@ export interface TaskSpec {
      */
     toolMaterializeStrategy?: "swap" | "static";
     /**
-     * RB-400-a — the inline-pin counterpart of {@link deferTools} (same wire-name addressing, opposite
+     * The inline-pin counterpart of {@link deferTools} (same wire-name addressing, opposite
      * direction; CC 220 `alwaysLoad` 对位): names listed here are NEVER deferred — not by
      * `ToolSpec.defer`, not by the MCP constant-defer arm (besides the server's own
      * `_meta["anthropic/alwaysLoad"]` declaration this list is the only channel that keeps a chosen
@@ -475,7 +475,7 @@ export interface TaskSpec {
      */
     restoreGatedTools?: string[] | true;
     /**
-     * RB-403 — whether a schema-VALID call on a still-deferred tool runs the real tool directly
+     * Whether a schema-VALID call on a still-deferred tool runs the real tool directly
      * (activating it as a side effect). Default `true`, matching the upstream posture where the
      * defer gate is shape validation, not activation state (a deferred tool called with correct
      * arguments succeeds; activation only controls whether the model has SEEN the schema). Set
@@ -1237,7 +1237,7 @@ export interface TaskSpec {
          */
         todoReminderMode?: "baseline" | "off";
         /**
-         * RB-313 — `tool_search_usage_reminder` (CC 2.1.220 producer `Nop` @608915, renderer @626269): the
+         * `tool_search_usage_reminder` (CC 2.1.220 producer `Nop` @608915, renderer @626269): the
          * REVERSE nudge for delayed tool disclosure. When tools are deferred (design/36), a model that has
          * gone N turns without calling `ToolSearch` and still has unloaded schemas is told they exist and
          * how to load them, so "this capability does not exist, I will build a workaround" stops being the
@@ -1276,7 +1276,7 @@ export interface TaskSpec {
          */
         budgetUsd?: true;
         /**
-         * RB-318 (ruled 2026-08-26) — `total_tokens_reminder` (CC 2.1.245 producer `MPs`, renderer `Oje`):
+         * `total_tokens_reminder` (CC 2.1.245 producer `MPs`, renderer `Oje`):
          * the TOKEN twin of {@link budgetUsd}. One line per collected boundary,
          * `<total_tokens>N tokens left</total_tokens>`, CC-verbatim bytes.
          *
@@ -1312,7 +1312,7 @@ export interface TaskSpec {
          */
         totalTokensReminder?: boolean;
         /**
-         * RB-318 — which arm of the readout, CC 2.1.245's closed set (`off` / `infinite` / `fixed` /
+         * Which arm of the readout, CC 2.1.245's closed set (`off` / `infinite` / `fixed` /
          * `countdown` / `padded-countdown`); absent ⇒ CC's own default `"padded-countdown"`.
          *
          *  - `countdown` — remaining = ceiling − spend, raw.

package/dist/core/task-stream.d.ts

@@ -54,7 +54,7 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
      *    (the parked leg's `appendPendingSteer` refuses it identically). Re-issue under a fresh id.
      *  - **Bad value ⇒ typed throw** `steering.invalid_content`, never a silent fallback to "no id": the
      *    value domain is the parked leg's (a non-empty string of at most `MAX_STEER_INPUT_ID_CHARS`
-     *    characters, and never the reserved `LEGACY_PENDING_STEER_INPUT_ID`), so one key is accepted or
+     *    characters), so one key is accepted or
      *    refused the same way on both legs. Validated before the liveness check, like the parked leg's.
      *  - **Liveness outranks the key**: once the run's loop-liveness latch has flipped (the same signal
      *    the injection path stops polling on) a replay is refused `steering.not_running` like any other
@@ -349,22 +349,27 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
      * per-run. AUTHORITY (steer-lane law): holding this stream IS the capability — a deployment
      * relaying this verb owns its own gate (relay IS authorization; it cancels in-flight tool work
      * and ends the run's forward progress). No text ⇒ the `userPromptSubmit` screen has no domain
-     * here (nothing enters the model). Honest window, stated: a halt accepted in the run's last
-     * moments (past the loop's final commit point) finds the run completing naturally — the result
-     * then reports the natural completion WITH the `haltedByUser` seat (the person did press stop
-     * while it finished; the transcript says how far the model got). Typed refusals: the
+     * here (nothing enters the model). The late window, stated: a halt accepted
+     * in the run's last moments (past the loop's final commit point) finds the run completing
+     * naturally — nothing is cut and no boundary stops for it, so the result reports the natural
+     * completion WITHOUT the `haltedByUser` seat and the engine mints `task.halt_unconsumed` (the
+     * verb receipt and that notice are the halt's whole trace; the seat is signed from consumption,
+     * never from acceptance — see {@link TaskResult.haltedByUser}). Typed refusals: the
      * steer-family `steering.not_running` once the task has finished (teardown included); a halt
      * issued BEFORE the run's first prompt polls the same bounded birth window as {@link steer} and
      * then stops the run before its first model turn (an empty, cleanly-halted completed run).
      *
-     * **Receipt tension, stated (design/384 slice 2):** `{turnCut:true}` and the
+     * **Receipt tension, stated:** `{turnCut:true}` and the
      * `task.turn_interrupted` notice assert facts about the CUT — a seat was cut, no new model turn
      * starts — and both stay true even when the gate's durable leg still collects to `suspended`:
-     * a park whose store commit was already in flight (or committed) when the cut landed WINS the
-     * fence race, the row is redeemable, and the result then reads `status:"suspended"` WITHOUT
-     * {@link TaskResult.haltedByUser} (the transitional narrowing documented on that seat). A cut
-     * observed BEFORE the commit makes the park concede instead — no row, no card, and the ordinary
-     * halted ending.
+     * an approval park whose store commit was already in flight (or committed) when the cut landed
+     * WINS the fence race, the row is redeemable, the park's own abort then owns the ending, and the
+     * result reads `status:"suspended"` WITHOUT {@link TaskResult.haltedByUser} — the halt cut a seat
+     * but consumed nothing (no interrupt settlement took its cut, no boundary stopped for it), which
+     * `task.halt_unconsumed` discloses. A cut observed BEFORE the commit makes the park concede
+     * instead — no row, no card, and the ordinary halted ending. A BOUNDARY park (review / resource
+     * slice) beside a consumed halt is the other way round: the terminal is the park's, and the seat
+     * IS signed — a person also stopped it.
      */
     halt(): Promise<{
         turnCut: boolean;

package/dist/core/tool-catalog-entries.d.ts

@@ -32,6 +32,7 @@ export declare const TASK_UPDATE_TOOL_NAME = "TaskUpdate";
 export declare const TASK_LIST_TOOL_NAME = "TaskList";
 export declare const TODO_WRITE_TOOL_NAME = "TodoWrite";
 export declare const REFRESH_MCP_TOOLS_TOOL_NAME = "RefreshMcpTools";
+export declare const ARTIFACT_TOOL_NAME = "Artifact";
 /**
  * Every row. Order is documentation order (hands → delegation → scaffolds → memory → scheduler → host
  * scenarios); nothing reads the order.

package/dist/core/tool-catalog-entries.js

@@ -7,6 +7,7 @@ export const TASK_UPDATE_TOOL_NAME = "TaskUpdate";
 export const TASK_LIST_TOOL_NAME = "TaskList";
 export const TODO_WRITE_TOOL_NAME = "TodoWrite";
 export const REFRESH_MCP_TOOLS_TOOL_NAME = "RefreshMcpTools";
+export const ARTIFACT_TOOL_NAME = "Artifact";
 const SHELL_RULE_FACE = { primaryParams: ["command"], params: ["command", "timeout", "description", "run_in_background"] };
 const c = (contractId, implementationRevision = "1") => ({ contractId, implementationRevision });
 export const TOOL_CATALOG_ENTRIES = [
@@ -97,6 +98,10 @@ export const TOOL_CATALOG_ENTRIES = [
     },
     { id: "repo-map", name: "RepoMap", source: "builtin", definedIn: "src/tools/fs/repo-map.ts", mountedBy: ["hands"], cards: ["repo-map"], face: { family: "search", effect: "read", contract: c("core.repo_map@1") } },
     { id: "lsp", name: "LSP", source: "builtin", definedIn: "src/core/lsp.ts", mountedBy: ["optional"], cards: [], face: { family: "search", effect: "read", contract: c("core.lsp@1") } },
+    {
+        id: "artifact", name: ARTIFACT_TOOL_NAME, source: "builtin", definedIn: "src/tools/artifact/artifact-tool.ts", mountedBy: ["optional"], cards: ["artifact"],
+        face: { family: "other", effect: "write", contract: c("core.artifact@1"), ruleFace: { primaryParams: ["action"] }, renderHints: { summaryParams: ["action", "file_path", "url"] } },
+    },
     { id: "enter-worktree", name: "EnterWorktree", source: "builtin", definedIn: "src/tools/worktree.ts", mountedBy: ["hands"], cards: ["worktree"], face: { family: "other", effect: "write", contract: c("core.enter_worktree@1") } },
     { id: "exit-worktree", name: "ExitWorktree", source: "builtin", definedIn: "src/tools/worktree.ts", mountedBy: ["hands"], cards: ["worktree"], face: { family: "other", effect: "write", contract: c("core.exit_worktree@1") } },
     { id: "task-output-hands", name: "TaskOutput", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"], cards: [], face: { family: "delegate", effect: "read", contract: TASK_OUTPUT_CONTRACT } },

package/dist/core/tool-conformance.d.ts

@@ -18,5 +18,3 @@ export interface ToolConformanceVector {
 }
 /** The matrix. Vector ids are stable (a host's own conformance test keys on them). */
 export declare const TOOL_CONFORMANCE_VECTORS: readonly ToolConformanceVector[];
-/** The matrix as a host reads it (a frozen copy). */
-export declare function describeToolConformanceVectors(): readonly ToolConformanceVector[];

package/dist/core/tool-conformance.js

@@ -25,6 +25,7 @@ export const TOOL_CONFORMANCE_VECTORS = [
     ], [OFFLOAD_READER]),
     vector("plan-mode", ["always", "optional"], [
         { name: "LSP", why: "needs a wired LSP manager" },
+        { name: "Artifact", why: "needs a wired artifact host" },
         { name: "Skill", why: "needs a skills listing" },
         { name: "StructuredOutput", why: "needs an output schema" },
         { name: "ToolSearch", why: "needs a deferred tool" },
@@ -32,6 +33,3 @@ export const TOOL_CONFORMANCE_VECTORS = [
         { name: "EnterPlanMode", why: "needs a checkpoint store beside plan mode" },
     ]),
 ];
-export function describeToolConformanceVectors() {
-    return TOOL_CONFORMANCE_VECTORS;
-}

package/dist/core/tool-errors.d.ts

@@ -27,6 +27,11 @@ export declare function truncateError(s: string): string;
  * a file, legacy head+tail middle-omission (there is no path to point at, and the head often carries
  * status a bare tail-keep would drop).
  */
+/** The smallest output budget the clip primitives are given: below it a clip cannot carry its own
+ *  truncation banner plus any content, so the operator knobs that feed {@link clipWithFilePointer}
+ *  (`BASH_MAX_OUTPUT_LENGTH`, `TASK_MAX_OUTPUT_LENGTH`) are raised to it, loudly, never honored as a
+ *  budget of one character. */
+export declare const OUTPUT_BUDGET_MIN_CHARS = 512;
 export declare function clipWithFilePointer(s: string, limit: number, fullOutputPath?: string): string;
 /**
  * Format a thrown tool error into model-facing text (design/64 §11.1/§11.2): a shell/exec error becomes

package/dist/core/tool-errors.js

@@ -10,6 +10,7 @@ export function truncateError(s) {
     const removed = s.length - head.length - tail.length;
     return `${head}\n\n... [${removed} characters truncated] ...\n\n${tail}`;
 }
+export const OUTPUT_BUDGET_MIN_CHARS = 512;
 export function clipWithFilePointer(s, limit, fullOutputPath) {
     if (s.length <= limit)
         return s;

package/dist/core/tool-policy.d.ts

@@ -27,7 +27,7 @@ export interface ToolCallRequest {
      */
     face?: ToolCallFace;
     /**
-     * RB-108 — the LIVE working directory this call's RELATIVE path arguments will actually resolve
+     * The LIVE working directory this call's RELATIVE path arguments will actually resolve
      * against, read at adjudication time from the same tracked `cwdRef` the fs hand tools resolve with
      * (design/64 §16.3: a resident shell's `cd` persists and moves the fs tools' relative base with it).
      *
@@ -127,6 +127,17 @@ export declare function classifierDenyCauseOf(d: unknown, call: {
     toolCallId: string;
     toolName: string;
 }): import("./gate-outcome.js").ClassifierDenyCause | undefined;
+/** Attest that `d` is an in-fold deny of an ask nobody could resolve, for `call`, for the named cause. */
+export declare function attestAskUnresolvableCause<T extends object>(d: T, cause: import("./ask-unresolvable-notice.js").AskUnresolvableCause, call: {
+    toolCallId: string;
+    toolName: string;
+}): T;
+/** Read the attested unresolvable cause off a deny FOR the named call (the gate's exit is the consumer); a
+ *  binding to a different call is a replayed object and answers absence. Internal seam — not re-exported. */
+export declare function askUnresolvableCauseOf(d: unknown, call: {
+    toolCallId: string;
+    toolName: string;
+}): import("./ask-unresolvable-notice.js").AskUnresolvableCause | undefined;
 /** Read the engine-attested settlement off a funneled decision FOR the named call (the gate's exit is the
  *  one consumer): an attestation bound to a different call is a replayed object and answers absence.
  *  Exported for the gate module only — deliberately NOT re-exported from `src/index.ts` (an internal seam
@@ -215,7 +226,7 @@ export type PermissionResult = {
     message?: string;
     decisionReason?: DecisionReason;
     requiresRealApproval?: boolean;
-    /** #548 (additive): this ask is the classifier DENIAL-LIMIT fallback — the block that reached a
+    /** This ask is the classifier DENIAL-LIMIT fallback — the block that reached a
      *  bound (CC 2.1.250 `FO`, count-then-judge) handed to a person instead of being denied.
      *  ENGINE-STAMPED beside `requiresRealApproval: true` and `decisionReason: "classifier"` at the
      *  classifier block sites (the gate's own and the inherited-lane arms); carries the COUNTS ONLY —
@@ -249,7 +260,7 @@ export type PermissionResult = {
      *  understands (see {@link import("./checkpoint-store.js").ProbeCause}). Engine-stamped and
      *  validated at the irreversibility tighten; same display-only posture as the prose sibling. */
     probeCause?: import("./checkpoint-store.js").ProbeCause;
-    /** #502 (additive): the reversibility probe declared this demotion STRUCTURAL — see
+    /** The reversibility probe declared this demotion STRUCTURAL — see
      *  {@link import("./types.js").ReversibilityVerdict.mandated}. Unlike its two `probe*` neighbours
      *  this is NOT display metadata: it joins the #144 mandate family, so the persisted-rule lane
      *  discloses a matching allow rule as shadowed instead of clearing the ask, and the card's
@@ -474,7 +485,7 @@ export interface ToolPolicyProjection {
  * `session-rule-policy.ts`. Not part of the public API (`src/index.ts` re-exports by name and does not
  * list these two): every publisher of {@link ToolPolicyNameSets} must resolve a covering entry the same
  * way, because the prepare-time audit's exemption for these spellings speaks for ALL published name sets
- * at once — the four in-engine lanes do so by sharing this module's matcher. #450: that premise is NOT
+ * at once — the four in-engine lanes do so by sharing this module's matcher. That premise is NOT
  * structural for an OUT-OF-ENGINE publisher (a host compiling its own settings into an exact-match ask
  * closure is fail-open on these spellings while the audit stays silent) — which is why the underlying
  * judgment predicates (`isNamespacedCoveringRuleName` / `namespacedRuleNameCovers`) ARE exported from
@@ -517,7 +528,7 @@ export type ConstraintChainEntryMeta = {
     /** True iff the layer carried a frozen auto-mode classifier (`autoMode`). */
     autoModeArmed?: true;
     /**
-     * #503 — the layer's serializable auto-mode ARMING RECIPE: the criteria half of the frozen classifier
+     * The layer's serializable auto-mode ARMING RECIPE: the criteria half of the frozen classifier
      * (assembly inputs + knobs + the deployment's settings epoch), recorded so a CROSS-PROCESS redemption
      * can rebuild an equivalent decider over its own fresh model leg
      * ({@link import("./auto-mode-arming.js").rebuildAutoModeDecider}) instead of answering `unavailable`
@@ -753,7 +764,7 @@ export declare function combinePolicies(...policies: ToolPolicy[]): ToolPolicy;
 /**
  * The shell tools whose `{ command }` arg a coarse command-name policy parses. Other tools are out of scope.
  *
- * RB-130 (2026-07-25, defect probe): `Monitor` belongs here. It takes a `command` and runs it through the
+ * `Monitor` belongs here. It takes a `command` and runs it through the
  * SAME `env.spawnBackground` seam as Bash, and prepare-task's own note says so in as many words — "Monitor
  * runs an arbitrary shell `command` through the SAME env seam — it must sit behind the SAME shellGate
  * tighten (else it becomes a policy side-door around a gated Bash)". The shellGate half was implemented;
@@ -763,7 +774,7 @@ export declare function combinePolicies(...policies: ToolPolicy[]): ToolPolicy;
  * gate at all; the same substitution makes `rm -rf ~/.ai-agent/sessions` a way to erase the audit trail.
  */
 /**
- * RB-153: EXPORTED. A downstream governance layer keeps its own copy of this list so its
+ * EXPORTED. A downstream governance layer keeps its own copy of this list so its
  * per-command ask-list gates the same tools core does, and it had no way to read the real one — its guard
  * had to probe a hand-written candidate list of names, which stays green for any name nobody thought to
  * put in it. The list itself is the fact; publishing it removes the guess.
@@ -805,13 +816,11 @@ export declare const COARSE_SHELL_TOOLS: string[];
  * you MUST compose explicitly: `combinePolicies(deploymentBaseline, createCoarseCommandNamePolicy(…))`
  * (deny-wins — both policies' denies still fire). {@link tightenTaskSpec} does this for you.
  *
- * 🪤 **TRAP #2 — under `TaskSpec.shellGate: "classify"`, a plain `ask` from this policy is promoted to a
- * NON-budgetable `irreversible_ask`.** `shellGate:"classify"` statically marks `bash` `irreversibility:"maybe"`;
- * the safety gate keys the checkpoint axis on that STATIC tool mark (not on `decisionReason`), so a `bash`
- * command that doesn't prove reversible suspends as `irreversible_ask` — which a budget-aware escalation
- * resolver will NEVER auto-approve. Net: combining this policy's `ask` with `shellGate:"classify"` does NOT
- * give you a budgetable normal-ask on `bash`; it gives a hard human-approval suspend. Choose `shellGate` and a
- * `defaultAction:"ask"` deliberately.
+ * Under `TaskSpec.shellGate: "classify"` a plain `ask` from this policy stays a plain ask: the shell seat's
+ * `"maybe"` tier is the doctrine's probe instrument, not a risk label, so the park is the budgetable kind
+ * (`human` under `durableApproval`) unless the probe mandated the call (an out-of-root read) or could not
+ * answer. A command the doctrine's OWN tighten refuses (`rm -rf …` with no policy asking first) still parks
+ * non-budgetable — the safety axis is judged per call by `safetyAxisOf`.
  */
 export declare function createCoarseCommandNamePolicy(opts: {
     /** Command names (argv[0]) explicitly allowed. If provided, a name NOT listed falls to `defaultAction`. */
@@ -832,7 +841,7 @@ export declare function findUnverifiableRecursiveDelete(command: string, safeVar
  * message carries the CC-sanctioned remediation (re-run with the resolved LITERAL path written into the
  * command, or assign the variable in the same command) — it doubles as the `askMessage` a classifier sees.
  *
- * RB-203 (2026-07-26): this used to be an unconditional `deny`, on the theory that the CC rule text forbids
+ * This used to be an unconditional `deny`, on the theory that the CC rule text forbids
  * auto-allow («must be explicitly approved … cannot be auto-allowed by a permission rule»).
  *
  * RB-341 (2026-07-29) re-checked that citation against the 220 corpus and corrected it in BOTH directions.
@@ -883,7 +892,7 @@ export declare function findUnverifiableRecursiveDelete(command: string, safeVar
  * (already denied). Core wires this policy ALWAYS-ON in the runner's gate composition (prepare-task); it is
  * exported so deployments can also compose/test it directly.
  *
- * RB-341: `requiresRealApproval` also turns out to be the correct sema analog of the one thing
+ * `requiresRealApproval` also turns out to be the correct sema analog of the one thing
  * `classifierApprovable: false` still buys in 220 that a `circuitBreaker` does NOT take back — 220's
  * bypassPermissions arm refuses to auto-allow an ask carrying `circuitBreaker === "dangerousRemoval"`
  * (603856-603869), i.e. a blanket MODE setting cannot clear it, only judgment can. That is exactly the
@@ -942,21 +951,21 @@ export interface AskDelegationProvenance {
  *  (see {@link OnAsk} for the full detached-settlement contract). */
 export interface AskRequest {
     toolName: string;
-    /** #144: a persisted allow rule MATCHED this call but could not clear the ask (mandated — see
+    /** A persisted allow rule MATCHED this call but could not clear the ask (mandated — see
      *  {@link PermissionResult}'s ask arm). The matched rule text — or, when a covering SET admitted the
      *  command segment-wise (the conjunction arm), a comma-joined display list of up to five sanitized
      *  rule texts with an "and N more" tail — so the approval card renders "your rule is alive, just
      *  outranked" instead of leaving the person to regex the message prose. A DISPLAY value, not an
      *  identity channel: per-rule identity travels on {@link AskRuleEvidence.personalRuleDots}. */
     persistedRuleShadowed?: string;
-    /** backlog #239: WHY the reversibility probe did not clear this call — the account of the tighten the
+    /** WHY the reversibility probe did not clear this call — the account of the tighten the
      *  card was showing WITHOUT until now (the gate knew the cause and dropped it at this seam, leaving the
      *  approver the action but not the reason it is being asked about). Present only for a `"maybe"`-tier
      *  tighten whose probe supplied a cause; the durable park route carries the same string as
      *  `RiskDescriptor.probeReason`. Neutralized + length-capped by the gate. UNTRUSTED-for-display,
      *  never adjudication input. */
     readonly probeReason?: string;
-    /** backlog #239: the STRUCTURED cause behind the tighten — a machine-readable code plus the operand
+    /** The STRUCTURED cause behind the tighten — a machine-readable code plus the operand
      *  families as arrays with honest totals, so this surface renders its OWN sentence rather than one the
      *  engine had to write before the check's edge cases were known. See
      *  {@link import("./checkpoint-store.js").ProbeCause}, whose contract is that the ARRAY is the
@@ -1149,12 +1158,12 @@ export interface AskRequest {
      *  - `isDelegatedChild` — REFUSAL POSTURE: "no user turn ever lands in this run's transcript";
      *    drives which deny text the model is told (stop-and-wait vs adapt-or-report), forks included. */
     readonly isDelegatedChild?: true;
-    /** RB-203 (confirmed P1) — carried from the originating {@link PermissionResult}'s ask
+    /** Carried from the originating {@link PermissionResult}'s ask
      *  variant of the same name: `true` ⇒ {@link resolveAsk} must not let a blanket `onAsk: "allow"`
      *  clear this ask (see that field's doc). `readonly`, filled by the gate from the decision, never a
      *  caller/worker-settable field. */
     readonly requiresRealApproval?: boolean;
-    /** #548 (additive) — present ⇔ this ask is the classifier DENIAL-LIMIT fallback (see the
+    /** Present ⇔ this ask is the classifier DENIAL-LIMIT fallback (see the
      *  {@link PermissionResult} ask-arm member of the same name): the counts that tripped the bound and
      *  this ask's own auto-deny window. Two readers: a card renders it as a countdown; {@link resolveAsk}
      *  arms its deadline from `autoDenyAfterMs` (> 0 ⇒ an unanswered function approver auto-denies at
@@ -1304,7 +1313,7 @@ export type OnAsk = "deny" | "allow" | ((req: AskRequest, signal?: AbortSignal)
  * (abort, throw, unavailable, out-of-contract value), each already stamped at its own arm, and a
  * self-reported one would let a host relabel its refusal as an engine failure.
  *
- * #548 — the ONE ask on this leg the engine DOES time: a classifier denial-limit fallback (the ask
+ * The ONE ask on this leg the engine DOES time: a classifier denial-limit fallback (the ask
  * carrying `denialLimitFallback` with a non-zero `autoDenyAfterMs`). Its window is core's, because
  * the fallback exists to bound a classifier that would otherwise deny without end. When it elapses
  * the approver's promise is DETACHED (design/384: the wait is released, not cancelled — an approver
@@ -1390,6 +1399,26 @@ export declare function askApproverIdentity(onAsk: unknown): unknown;
  * fold and the wiring station) plus the orchestrator, and each reaches DOWN for the one definition.
  */
 export declare function isLiveApproverSeat(onAsk: OnAsk | undefined): boolean;
+/** Where a durable-approval MANDATE on a leg comes from — the closed set of its two sources. */
+export declare const DURABLE_MANDATE_SOURCES: readonly ["force_durable_gate", "durable_approval"];
+export type DurableMandateSource = (typeof DURABLE_MANDATE_SOURCES)[number];
+/**
+ * Is every interactive permission ask of this leg MANDATED to gate durably — and by which source?
+ * `force_durable_gate`: the per-principal control-plane entitlement, in force regardless of any seat.
+ * `durable_approval`: the task's own opt-in with NO live approver seat (a blanket string or nobody at all
+ * cannot answer an ask, so the park is the only honest resolution). A live seat beside the opt-in is not a
+ * mandate: the leg's asks — and its children's, at the same frozen seat — resolve there.
+ *
+ * ONE definition on purpose, like {@link isLiveApproverSeat} beside it: the chain a parent freezes for its
+ * children and the loud "mandated but no store" disclosure at the wiring station used to derive the same
+ * fact with two hand-written conditions, and the second one read only the entitlement — a task that opted
+ * in and had no store degraded to the live chain in silence.
+ */
+export declare function durableMandateSourceOf(args: {
+    forceDurableGate: boolean;
+    durableApprovalDeclared: boolean;
+    onAsk: OnAsk | undefined;
+}): DurableMandateSource | undefined;
 /** EXACT structural clone for the approval boundary (alias isolation) — fail-closed, never lossy,
  *  never identity: a JSON round-trip would silently DROP unclonable members (presented ≠ executing =
  *  consent misrepresentation) and an identity fallback would hand the approver the live executing