@sema-agent/core 7.16.0 → 7.17.0

package/dist/core/remote-env.d.ts

@@ -508,7 +508,7 @@ export declare function missingRestoreSurface(env: ExecutionEnv): readonly ("res
  * A composite type guard (structural AND capability) so a `suspendVM` call site narrowed by THIS predicate
  * gets the {@link RemoteExecutionEnv} type without a cast — `true` always implies the structural check too.
  *
- * RB-439-b: it also requires the RESTORE surface ({@link missingRestoreSurface}). A suspend is only durable
+ * It also requires the RESTORE surface ({@link missingRestoreSurface}). A suspend is only durable
  * if something can undo it; an adapter that offers `suspendVM` but no `resumeVM` used to pass this guard,
  * take a real snapshot, commit a real checkpoint — and then blow up on the resume leg with an untyped
  * TypeError. "Suspendable" now means the whole round trip, so a half-adapter is rejected at the suspend site

package/dist/core/retired-keys.d.ts

@@ -0,0 +1,19 @@
+/**
+ * ONE presence rule for a RETIRED key on a caller-supplied bag (a deps object, an options object): the key is
+ * PRESENT iff ordinary property lookup answers a defined value — prototype and non-enumerable members included,
+ * exactly what the former direct read of the seat honored; an explicit `undefined` reads as absence, as every
+ * optional seat reads. Every retired-key door reads through here so no door grows its own idea of "present";
+ * each composes its own refusal from the answer. A table row is `{ key: replacement }` — the sentence that says
+ * what replaced the seat, quoted in the refusal.
+ */
+/** The first retired key present on `bag`, in table order, or undefined when none is. */
+export declare function retiredKeyOf(bag: object, table: Readonly<Record<string, string>>): {
+    key: string;
+    replacement: string;
+} | undefined;
+/**
+ * The deps-bag door: a retired seat still wired by a deployment is refused BY NAME (`config.deps_retired_key`)
+ * instead of vanishing silently — a seat that is silently dropped reads to the deployment as wired. `owner` is
+ * the bag's type name for the sentence (`RunnerDeps`, `RunWorkflowToolDeps`).
+ */
+export declare function assertNoRetiredKeys(bag: object, table: Readonly<Record<string, string>>, owner: string): void;

package/dist/core/retired-keys.js

@@ -0,0 +1,15 @@
+export function retiredKeyOf(bag, table) {
+    for (const [key, replacement] of Object.entries(table)) {
+        if (Reflect.get(bag, key) !== undefined)
+            return { key, replacement };
+    }
+    return undefined;
+}
+export function assertNoRetiredKeys(bag, table, owner) {
+    const hit = retiredKeyOf(bag, table);
+    if (hit === undefined)
+        return;
+    const e = new Error(`${owner}.${hit.key} is retired and is not read by this engine — ${hit.replacement}. Refused rather than ignored: a seat that is silently dropped reads to the deployment as wired.`);
+    e.code = "config.deps_retired_key";
+    throw e;
+}

package/dist/core/runner/active-skill-scope.js

@@ -1,4 +1,4 @@
-import { canonicalizeTarget } from "../../tools/fs/safety.js";
+import { canonicalizeTarget, pathFamilyOf } from "../../tools/fs/safety.js";
 import { pathTargetValue } from "../tool-registry.js";
 import { pathTargetBaseOf } from "../effective-path-target.js";
 import { PATH_WRITE_TOOLS, isWithin } from "./session-rule-policy.js";
@@ -100,7 +100,7 @@ export function createActiveSkillScopePolicy(opts) {
                             decisionReason: "safety",
                         };
                     }
-                    const canon = await canonicalizeTarget(env, path, signal, pathTargetBaseOf(declaredTarget, { root: rootPath, cwd: req.cwd }));
+                    const canon = await canonicalizeTarget(env, path, signal, pathFamilyOf({ root: rootPath, cwd: req.cwd ?? env.cwd }), pathTargetBaseOf(declaredTarget, { root: rootPath, cwd: req.cwd }));
                     if (!canon.ok) {
                         return {
                             action: "deny",
@@ -111,7 +111,7 @@ export function createActiveSkillScopePolicy(opts) {
                     for (const m of constraining) {
                         const roots = [];
                         for (const raw of m.allowPaths ?? []) {
-                            const r = await canonicalizeTarget(env, raw, signal, rootPath);
+                            const r = await canonicalizeTarget(env, raw, signal, pathFamilyOf({ root: rootPath ?? env.cwd }), rootPath);
                             if (r.ok)
                                 roots.push(r.key);
                         }

package/dist/core/runner/assemble-result.d.ts

@@ -1,5 +1,6 @@
 import type { AssistantMessage } from "../../internal/llm.js";
 import type { NestedUsage, PausedCause, TaskResult, TaskSpec, TerminalCause } from "../types.js";
+import type { HaltConsumption } from "../../internal/harness.js";
 /** Per-task usage/cost accumulator (filled across the run loop, surfaced as `TaskResult.stats`). */
 export interface Stats {
     turns: number;
@@ -134,15 +135,14 @@ export interface ResultFlags {
      *  path the terminal is `completed`, and this is what tells that completion apart from a natural
      *  one — the model did not finish; the person stopped it and the run awaits their direction). */
     haltedOnUserRejection?: boolean;
-    /** A `TaskStream.halt` (the bare user interrupt, CC Esc form) was accepted
-     *  while the run was live; echoed on `TaskResult.haltedByUser`. Pure pass-through on every
-     *  terminal (the sibling `haltedOnUserRejection` law: the fact is about the leg that ran) PLUS
-     *  one status decision it owns (slot 9.7 below): a run whose ONLY stop was this halt reads
-     *  `"completed"`, never the `!final` failure and never the aborted terminal — whether the halt
-     *  landed before the model said anything (empty result) or cut a turn whose partial text the
-     *  brain kept (that text IS the result). The person stopped the run, which is the verb working,
-     *  not a defect. A REAL abort/limit that also fired still owns the terminal above it. */
-    userHalted?: boolean;
+    /** the harness's STATEMENT of what the run's halt did (see `HaltConsumption`):
+     *  the loop's report that the halt's cut settled the final turn, and/or the boundary consult that
+     *  stopped the loop for the halt's request. This is the ONLY input to `TaskResult.haltedByUser`
+     *  (`haltConsumed`, halt-attribution.ts) and to slot 9.7 — the assembly never infers causation from the
+     *  final's shape or from the verb's acceptance. A halt that was accepted but consumed nothing (the run
+     *  ended for its own reason first) leaves this empty: the original terminal stands and the seat is
+     *  NOT signed (the settle lane mints `task.halt_unconsumed` for it). */
+    haltConsumption?: HaltConsumption;
     /** Call ids of answered-but-never-collected questions, echoed on
      *  `TaskResult.strandedHumanAnswers`. Pure pass-through; empty/absent ⇒ the field is omitted. The
      *  optional `onError` alert is NOT the disclosure — this mandatory result face is. */
@@ -298,13 +298,15 @@ export declare function terminalCauseOf(final: AssistantMessage | undefined, sta
  *   9. `abortedLive` | stopReason aborted → `"limits.max_walltime_exceeded"` | `"limits.max_turns_exceeded"` | undefined
  *       (audit A-1: hoisted ABOVE no-final — the loop exits cleanly on abort, so `final` may be a
  *       normal message or absent; a plain user interrupt carries NO errorCode — switch on `status`),
- *       EXCEPT when the aborted `final` is the bare halt's OWN cut artifact (`haltOwnsAbortedFinal`),
+ *       EXCEPT when the aborted `final` is the bare halt's OWN cut artifact (`haltOwnsAbortedFinal`: the
+ *       loop reported the halt's cut settled the final turn — never shape inference),
  *       and EXCEPT when the answer had already settled (`answerSettled`: a clean `"stop"` final, not
  *       partial) — a stop landing on the run's tail cuts no work, so the run falls through to 12
  *       (`completed`, the answer as `result`, no `limits.*` code for the axis; three axes, one law)
- *   9.7 `userHalted` + (no `final` | the halt's own aborted `final`) → status `"completed"` (a
- *       bare user halt — the verb working, not a defect; below the aborts on purpose, a real
- *       abort/limit that also fired owns the terminal and the halt rides as the pass-through seat)
+ *   9.7 halt CONSUMED (`haltConsumed(flags.haltConsumption)`) + (no `final` | the halt's own aborted
+ *       `final`) → status `"completed"` (a bare user halt — the verb working, not a defect; below the
+ *       aborts on purpose, a real abort/limit that also fired owns the terminal and the halt rides as
+ *       the pass-through seat; an accepted-but-unconsumed halt never reaches this slot)
  *  10. no `final`        → status `"failed"`
  *  11. stopReason error  → brain `[code]` prefix (or `"conflict"` from the storage-layer flag)
  *  12. else              → `"completed"`

package/dist/core/runner/assemble-result.js

@@ -1,6 +1,7 @@
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
 import { extractErrorCode, stripErrorCodePrefix } from "../../brain/errors.js";
 import { terminalProjection } from "./terminal-projection.js";
+import { haltConsumed } from "./halt-attribution.js";
 const SALVAGE_ELIGIBLE_TERMINALS = new Set([
     "output.degenerate",
     "limits.max_tokens_exceeded",
@@ -47,7 +48,7 @@ export function answerSettled(final, continuationCut = false) {
 export function terminalCauseOf(final, stats, flags) {
     let terminal;
     let apiFailure;
-    const haltOwnsAbortedFinal = flags.userHalted === true &&
+    const haltOwnsAbortedFinal = flags.haltConsumption?.turnCut === "halt" &&
         final?.stopReason === "aborted" &&
         !flags.abortedLive &&
         flags.abortedForTimeout !== true &&
@@ -103,7 +104,7 @@ export function terminalCauseOf(final, stats, flags) {
         const code = flags.abortedForTimeout ? "limits.max_walltime_exceeded" : flags.abortedForTurns ? "limits.max_turns_exceeded" : undefined;
         terminal = { kind: "failed", ...(code !== undefined ? { code } : {}), message: final?.errorMessage ?? (flags.abortedForTurns ? "max turns exceeded" : "run aborted") };
     }
-    else if (flags.userHalted === true && (!final || haltOwnsAbortedFinal)) {
+    else if (haltConsumed(flags.haltConsumption) && (!final || haltOwnsAbortedFinal)) {
         terminal = { kind: "completed" };
     }
     else if (!final) {
@@ -155,7 +156,7 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
     const result = text;
     let salvagedOutput;
     const { terminal, apiFailure } = terminalCauseOf(final, stats, flags);
-    const { status, errorCode } = terminalProjection(terminal);
+    const { errorCode } = terminalProjection(terminal);
     if (errorCode !== undefined && SALVAGE_ELIGIBLE_TERMINALS.has(errorCode)) {
         salvagedOutput = text.trim() || undefined;
     }
@@ -164,6 +165,6 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
     void _internalCompaction;
     if (flags.unpricedSpend)
         delete publicStats.costMicroUsd;
-    const stampHaltedByUser = flags.userHalted === true && status !== "suspended" && status !== "needs_review";
+    const stampHaltedByUser = haltConsumed(flags.haltConsumption);
     return { taskId, ...(flags.runId !== undefined ? { runId: flags.runId } : {}), sessionId, terminal, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, ...(apiFailure !== undefined ? { apiFailure } : {}), ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.editedFiles !== undefined && flags.editedFiles.length > 0 ? { editedFiles: flags.editedFiles } : {}), ...(flags.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}), ...(stampHaltedByUser ? { haltedByUser: true } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: [...flags.remoteEnvFailures] } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), stats: publicStats };
 }

package/dist/core/runner/compaction-call-options.d.ts

@@ -30,96 +30,32 @@ import type { Prepared } from "./contracts.js";
  */
 export declare function buildWorkingFileAttachments(spec: TaskSpec, prepared: Prepared): MaybeCompactOptions["workingFileAttachments"];
 /**
- * `MaybeCompactOptions.contextInstructionFiles`: the seat that delivers the deployment's own
- * instruction-file content (the CLAUDE.md family) to the SUMMARIZER, assembled once here and spread
- * on all three lanes. Without it the compaction boundary is the one place a long task loses the
- * standing instructions every other turn has been reading — and it loses them exactly where the
- * summary REPLACES the transcript that carried them, so the loss is durable.
+ * `MaybeCompactOptions.contextInstructionFiles`: the deployment's instruction-file content (the CLAUDE.md
+ * family) delivered to the SUMMARIZER, assembled once here and spread on all three lanes — the compaction
+ * boundary is where the summary REPLACES the transcript that carried those instructions.
  *
- * WHICH BYTES, and why the neighbours are not candidates. `Prepared.projectInstructionContent` =
- * the RAW loader text (`ProjectMemoryLoad.content`, exactly the string prepare-task feeds
- * `composeMemoryBlock(projectMem, "project")`), captured beside the existing `instructionSources`
- * capture under the SAME non-blank predicate that composes the project layer:
- *   · the assembled `memoryBlock` is NOT a candidate. It is the memory ENGINE's composed layers —
- *     bytes the model itself authored in-band this session through the memory tools — with the
- *     project layer appended at the tail. The seat's contract is host/systemPrompt tier and says in
- *     terms: never from tool output, model text, or any other in-band channel. Handing
- *     model-authored bytes an envelope whose preamble tells the summarizer they may instruct it is
- *     the laundering shape, not a purity nit. (Mechanically moot too — `memoryBlock` is a
- *     prepare-task local and never reaches `Prepared`.)
- *   · the COMPOSED project block is not it either, and this one is checkable rather than a
- *     judgement: `contextInstructionFilesSection` neutralizes the whole authority family
- *     (ENGINE_AUTHORITY_ENVELOPE_TAGS) over its payload, and `user_memory`/`scope` ARE in that
- *     family — so feeding a composed block would have the engine rewrite the tags of its own
- *     composition. Raw text in, one fence at the mint.
- *   · `prepared.instructionSources` carries path + contentHash only, by design (core never learns a
- *     file-name policy), so it cannot serve this seat at all.
- *
- * PROVENANCE, stated plainly because "the host supplies it" is the easy half of the truth. On this
- * engine the value is REPOSITORY-CONTROLLED text: the loading block one file over calls a CLAUDE.md
- * of unknown authorship untrusted in so many words, the MAIN lane's own framing tells the model it is
- * "repository-controlled DATA, not instructions to obey", and this seat hands the same bytes to the
- * summarizer with instruction standing for the summarization task. Delivery THROUGH a host callback
- * is not host AUTHORSHIP: a prior agent, or anyone who can land a commit, can write a
- * "## Compact Instructions" section, and the mint's neutralization stops tag breakout — not a
- * sentence asking for a fact to be left out of the summary that replaces the transcript.
- * Why it is nevertheless this value: the seat's own contract names this path ("hosts pass the same
- * instruction-file content their prompt assembly mounts... on the runner path"), the parity form this
- * channel exists to reach reads the user's and the project's instruction files at every boundary with
- * exactly this standing, and the two alternatives are worse for reasons above rather than better.
- * The standing is also narrower than the framing gap suggests — the section's preamble scopes it to
- * guidance about HOW to summarize and classifies the rest as background — and a deployment that does
- * not want it has two exits that need no code: do not wire the loader, or return content it vouches
- * for. Recorded as an open design candidate rather than built here, because it is a contract change
- * and not a wiring one: a SEPARATE deployment-vouched summarization-instructions seat, leaving
- * repository-derived context at data tier.
- *
- * RULING ① — BOTH summary forms, no per-form split. Fork eligibility is decided per pass INSIDE
- * maybeCompact (main-model-only, recorded-request-present, not lossy), so a call site cannot say
- * "independent form only"; the closest approximation — pass the seat only when `prepared.compModel`
- * is set, since an independent compaction model has no main prefix to fork — leaves the hole the
- * wrong way round: the configuration it does NOT cover (no compaction model) is precisely the one
- * where a fork degrades mid-pass to the independent form, which would then run WITHOUT the files.
- * Feeding both forms closes that case by construction, and the library face already handles the fork
- * half (the section rides the APPENDED instruction message, never the cached prefix, so the fork's
- * whole economic point is untouched).
- *
- * RULING ② — no new size knob. The bound is the library's own `fitContextInstructionFilesSection`
- * (independent form: cap against the compaction model's window, disclosed elision, and a complete
- * yield when not even the framing fits). Its three KNOWN LIMITS are accepted here KNOWINGLY, as the
- * pre-condition of this wiring rather than something it discovered: a token-dense payload (CJK,
- * emoji) can pass a chars-domain fit and still overflow the gateway's tokenizer; an unknown
- * `contextWindow` leaves the section unbounded (the conversation clamp declines to guess there too);
- * and the FORK form cannot fit at all — its bound is a prompt-too-long that degrades ONCE to the
- * independent form, which the engine's own note records as real but NOT total (an oversize rejection
- * the classifier cannot read as prompt-too-long returns terminally instead).
- *
- * HOW BIG THAT ACCEPTANCE ACTUALLY IS — measured, because the sentence above is easy to read more
- * comfortably than it deserves. The fitted form is NOT the default path: when a fork is eligible and
- * the model answers in its envelope, the fork IS the pass, and its section is delivered WHOLE at any
- * size. The independent form — the only one that fits — runs when there is no fork to take or the
- * fork's answer did not conform. Both facts are pinned in the REF-A2 suite (a 55 KB payload: whole on
- * the fork, elided on the independent fallback). And when a limit does bite, the failure is not a
- * quiet degradation: the section is a FIXED part of the request, the reactive retry loop may drop
- * only CONVERSATION groups, so a request the SECTION overflowed cannot converge and the boundary
- * fails — the task loses that compaction (or that prompt-too-long recovery, or its end-of-task
- * summary) rather than sending a shorter one. The exposure is what the wiring widened: this was
- * previously reachable only by hosts calling the library directly, and is now reachable by every
- * deployment that wires `loadProjectMemory` with a large instruction file and an unknown or small
- * window. Making the section participate in the retry loop is the structural answer; it is a change
- * to that loop's contract, tracked at the library face, and a runner-side knob would only move the
- * decision to a place with less information.
- *
- * WHAT IT COSTS, measured rather than rounded: every deployment that wires `loadProjectMemory` now
- * sends its instruction-file content plus EXACTLY 716 chars of framing (the preamble and the fence)
- * on EVERY summarization request, both forms, once per pass — where a real project instruction file
- * in this family runs to tens of KB, so the payload, not the framing, is the bill. The number is
- * pinned in the REF-A2 suite against the engine's own renderer, so a preamble edit shows up as a
- * changed assertion rather than as prose drifting away from the code it describes.
- * Deployments that never wired the loader pay nothing: the key is absent, not
- * `undefined`, so their requests are byte-identical to the pre-wiring shape on the independent and
- * UPDATE passes (the FORK form appends its ~860-char authority clause with or without the seat, and
- * always did).
+ * Contract:
+ *  - Bytes = `Prepared.projectInstructionContent`, the RAW loader text captured under the same non-blank
+ *    predicate that composes the project layer. Not the assembled `memoryBlock` (model-authored in-band
+ *    bytes would gain an instructing envelope), not the COMPOSED project block (`contextInstructionFilesSection`
+ *    neutralizes the whole authority family, `user_memory`/`scope` included), not `instructionSources`
+ *    (path + hash only). Raw text in, one fence at the mint.
+ *  - Provenance: REPOSITORY-CONTROLLED text delivered through a host callback — delivery is not authorship;
+ *    the mint's neutralization stops tag breakout, not a sentence asking for an omission. Two no-code exits
+ *    for a deployment that does not want it: do not wire the loader, or return vouched content. A separate
+ *    deployment-vouched summarization-instructions seat is an open design candidate, not built here.
+ *  - Both summary forms, no per-form split: fork eligibility is decided per pass inside maybeCompact, and the
+ *    form NOT covered by a `compModel`-gated split is exactly the fork that degrades mid-pass to the
+ *    independent form; the section rides the APPENDED instruction message, never the cached prefix.
+ *  - No new size knob: the bound is `fitContextInstructionFilesSection` (independent form only). Its three
+ *    known limits are accepted knowingly: a token-dense payload can pass a chars-domain fit and still overflow;
+ *    an unknown `contextWindow` leaves the section unbounded; the FORK form cannot fit and degrades ONCE. When
+ *    a limit bites the boundary FAILS (the section is a fixed request part the retry loop cannot drop) — the
+ *    task loses that compaction rather than sending a shorter one; making the section participate in the
+ *    retry loop is a library-face contract change, tracked there.
+ *  - Cost: instruction-file content + exactly 716 chars of framing on every summarization request, both
+ *    forms, once per pass (pinned in the REF-A2 suite). Deployments that never wired the loader pay nothing:
+ *    the key is ABSENT, so their requests are byte-identical to the pre-wiring shape.
  */
 export declare function contextInstructionFilesOption(prepared: Prepared): Partial<Pick<MaybeCompactOptions, "contextInstructionFiles">>;
 /**

package/dist/core/runner/contracts.d.ts

@@ -28,7 +28,7 @@ import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import type { CacheBreakDetector, ToolFingerprintInput } from "../cache-break-detector.js";
 import type { ActorAssertion, Checkpoint, CheckpointState, CheckpointStore, CheckpointToken, PendingSteerEntry, PlatformLimitReason, ReopenReason, ResourceLedger, ResourceLimitReason, ResumeOutcome, SerializedCheckpointState } from "../checkpoint-store.js";
 import type { ExecutionOutcomeRecordWord } from "../checkpoint-execution-record.js";
-import type { ClearedProjectionLedger, ContextEditMachine, OccurrenceIndex } from "../context-edit.js";
+import type { ClearedProjectionLedger, MicroCompactMachine, OccurrenceIndex } from "../context-edit.js";
 import type { HookInvocationIdentity, Hooks, OrgGateVerdict, PermissionDeniedPayload, PostToolBatchCall, PostToolBatchResult, ToolGateInput } from "../hooks.js";
 import type { MaterializedMcp } from "../mcp.js";
 import type { MemoryEngine } from "../memory-engine/engine.js";
@@ -1051,16 +1051,14 @@ export interface Prepared {
      *  `context-edit.ts`'s ledger note; per-run in-memory, so durable resume / `resumeAt` rebuilds
      *  start EMPTY by construction), the last request's projection seat (what the provider actually
      *  saw — the MC-R rejection arm computes its candidates and savings on THIS view, never on the
-     *  raw session rebuild), the MC-R knob, and the slice-3 arm-B seat. The explicit opt-out
-     *  (`machine: "legacy"` + MC-R off) ⇒ the ledger never gains an entry and every replay is a
-     *  same-reference no-op (opt-out bytes unchanged). */
+     *  raw session rebuild), the MC-R knob, and the slice-3 arm-B seat. */
     microCompact: PreparedMicroCompact;
 }
 /** See {@link Prepared.microCompact}. */
 export interface PreparedMicroCompact {
-    /** The frontier-machine selection — `"off"` = no proactive frontier clearing (the unified
-     *  machine instead gets its one blocking-point shot, slice-3 arm A). */
-    machine: "off" | ContextEditMachine;
+    /** The frontier-machine selection — `"off"` = no proactive frontier clearing (the machine
+     *  instead gets its one blocking-point shot, slice-3 arm A). */
+    machine: MicroCompactMachine;
     /** MC-R: one-shot clear-and-retry on a provider input-too-long rejection.
      *  Default true since the slice-3 flip. */
     clearOnRejection: boolean;
@@ -1105,7 +1103,7 @@ export interface PrepareResume {
      *  crash-interrupted; closing them with `[INTERRUPTED]` would DESTROY the suspended batch, §15.2 #7). */
     suspendedBatch: ReadonlySet<string>;
     /** The §4.bis correctness-state snapshot to re-seed (activeTools / outputRef / nestedStats /
-     *  consolidationNotes / readFileState). */
+     *  readFileState). */
     seed: CheckpointState;
     /** How many times this task already suspended (the resumed checkpoint's
      *  `suspendCount`). The next suspend mints `priorSuspendCount + 1`; past `maxSuspends` it fails
@@ -1393,7 +1391,10 @@ export interface RunInternals {
      * `"interactive"` tree's engine-stripped legs are exempt). TRUST POSTURE (ruled 2026-08-05):
      * RunInternals is a public trusted-caller parameter, so this flag is an honesty channel, not a
      * security gate — a caller forging it is a deployment lying to itself; resource-face safety
-     * stays with its own fail-closed mechanisms.
+     * stays with its own fail-closed mechanisms. INHERITS DOWN THE TREE: a stripped leg's descendants are faceless by
+     * the same engine act (the trusted ctx carries it as `ToolExecuteContext.questionFaceStripped`, the Workflow mount as
+     * `parentQuestionFaceStripped`), so the posture-door exemption travels with the facelessness it explains; a leg
+     * that strips on its own mints the same flag.
      */
     questionFaceStripped?: true;
     /**

package/dist/core/runner/gate-exit.js

@@ -1,5 +1,5 @@
 import { screenGateOutcome, SETTLEMENT_IS_REFUSAL } from "../gate-outcome.js";
-import { classifierDenyCauseOf, decisionText, engineSettlementOf } from "../tool-policy.js";
+import { askUnresolvableCauseOf, classifierDenyCauseOf, decisionText, engineSettlementOf } from "../tool-policy.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { formatHookFeedback } from "../reminder-mint.js";
 export function mintGateOutcome(facts) {
@@ -96,6 +96,15 @@ export function hookDenyExit(pass, r) {
         preToolContext: pass.preToolContext,
     };
 }
+function unresolvableCauseOfSettlement(gate) {
+    if (gate.disposition.kind !== "denied" || gate.disposition.deniedBy !== "ask_resolution" || gate.settlement === undefined)
+        return undefined;
+    if (gate.settlement.kind === "approver_unavailable")
+        return "approver_unavailable";
+    if (gate.settlement.kind === "no_approver")
+        return "no_approver_wired";
+    return undefined;
+}
 export async function exitGate(pass) {
     const { input, event, toolName, toolCallId, ledger, notifyPermissionDenied } = pass;
     if (pass.decision.action === "deny") {
@@ -106,6 +115,11 @@ export async function exitGate(pass) {
         if (pass.deniedBy === undefined)
             throw new Error(`the tool gate refused "${toolName}" without a refusing layer — every deny site attributes itself`);
         const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(pass.denyCause !== undefined ? { cause: pass.denyCause } : {}), ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}) });
+        const unresolvable = askUnresolvableCauseOf(pass.decision, { toolCallId, toolName }) ?? unresolvableCauseOfSettlement(gate);
+        if (unresolvable !== undefined) {
+            const cause = unresolvable;
+            pass.notifier.notify(() => input.onAskUnresolvable?.({ toolName, toolCallId, cause, parkLaneExisted: pass.suspendAsk !== undefined }), "toolGate.onAskUnresolvable");
+        }
         await notifyPermissionDenied({
             toolName,
             input: cloneObserverInput(pass.currentInput),

package/dist/core/runner/halt-attribution.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Halt attribution, the consumer half: the ONE predicate that turns the harness's
+ * consumption statement ({@link HaltConsumption}) into the result's `haltedByUser` seat, and the disclosure
+ * for the halt that was accepted but never consumed. Both readers of the statement live here so the law
+ * has one spelling: signed ⇔ consumed; unconsumed ⇔ absent + `task.halt_unconsumed`.
+ */
+import type { HaltConsumption } from "../../internal/harness.js";
+import { type RunnerDeps } from "../types.js";
+/**
+ * The attribution law: `haltedByUser` ⇔ the halt was CONSUMED by the machinery — its cut settled a turn (the
+ * loop's report, stamped `"halt"` at the seat's abort) OR its stop request was among the sources a boundary
+ * consult stopped the loop for. A halt merely ACCEPTED (latched, receipt answered) while the run ended for its
+ * own reason is not consumed and never signs (fail-closed: rather absent than guessed).
+ */
+export declare function haltConsumed(c: HaltConsumption | undefined): boolean;
+export interface UnconsumedHaltDisclosureInput {
+    /** The verb's acceptance fact (`loopLatch.userHalted`): a halt was latched on this run. */
+    accepted: boolean;
+    /** The harness's statement, read after the prompt settled. */
+    consumption: HaltConsumption | undefined;
+    onNotice: RunnerDeps["onNotice"];
+    sessionId: string;
+    runId: string;
+    taskId: string | undefined;
+}
+/**
+ * The ACCEPTED-but-UNCONSUMED halt: the verb latched the stop (and may have cut a seat), but the run ended for
+ * its own reason before the machinery consumed it — no settlement took the halt's cut as its cause and no
+ * boundary consult stopped the loop for it (a brain minting its own `aborted` final, a natural completion past
+ * the final commit point, an approval park whose commit won the race). The result reads the run's own terminal
+ * without `haltedByUser`; this notice is the halt's trace — the same code the verb mints on its own arm (a halt
+ * refused by an already-owned ending), one fact with one spelling, the two mint points disjoint: the verb arm mints
+ * only while NO halt has been accepted on the run; once one was, this arm alone speaks. One per such run. Returns whether it was minted.
+ */
+export declare function discloseUnconsumedHalt(input: UnconsumedHaltDisclosureInput): boolean;

package/dist/core/runner/halt-attribution.js

@@ -0,0 +1,16 @@
+import { deliverEngineNotice } from "../types.js";
+export function haltConsumed(c) {
+    return c?.turnCut === "halt" || c?.boundaryStop?.sources.includes("halt") === true;
+}
+export function discloseUnconsumedHalt(input) {
+    if (!input.accepted || haltConsumed(input.consumption))
+        return false;
+    deliverEngineNotice(input.onNotice, {
+        code: "task.halt_unconsumed",
+        message: "a user halt was accepted, but the run ended for its own reason before the halt stopped or cut anything: " +
+            "no turn was settled as its cut and no boundary stopped for it — the run's own ending stands, and the result " +
+            "will not carry haltedByUser for this halt.",
+        detail: { sessionId: input.sessionId, runId: input.runId, ...(input.taskId !== undefined ? { taskId: input.taskId } : {}) },
+    });
+    return true;
+}

package/dist/core/runner/memory-consolidation.d.ts

@@ -23,8 +23,6 @@ export declare const DEFAULT_CONSOLIDATION_BAND: {
 export declare const DEFAULT_CONSOLIDATION_SEARCH_LIMIT = 20;
 /** Default cap on this-task notes consolidated in one batch (F6 token bound). */
 export declare const DEFAULT_CONSOLIDATION_MAX_NOTES = 50;
-/** Default independent timeout for the whole consolidation pass (seconds). */
-export declare const DEFAULT_CONSOLIDATION_TIMEOUT_SEC = 30;
 /** Normalize a note body for the EXACT-restatement check in the `<lo` near-dup cheap path. Case- + whitespace-
  *  insensitive ONLY (lower-case, collapse whitespace runs, trim); it PRESERVES every symbol/punctuation so it can
  *  NOT false-equate semantically-distinct facts. (The earlier `[^\p{L}\p{N}]`-stripping

package/dist/core/runner/memory-consolidation.js

@@ -4,7 +4,6 @@ import { cacheFamilyOf, usageCostMicroUsd } from "./usage-accounting.js";
 export const DEFAULT_CONSOLIDATION_BAND = { lo: 0.05, hi: 0.3 };
 export const DEFAULT_CONSOLIDATION_SEARCH_LIMIT = 20;
 export const DEFAULT_CONSOLIDATION_MAX_NOTES = 50;
-export const DEFAULT_CONSOLIDATION_TIMEOUT_SEC = 30;
 export function normalizeForExactMatch(s) {
     return s.toLowerCase().replace(/\s+/g, " ").trim();
 }

package/dist/core/runner/prepare-artifact.d.ts

@@ -0,0 +1,53 @@
+/**
+ * PrepareTask's Artifact phase: the `RunnerDeps.artifactHost` seat is read once; an absent seat mounts
+ * nothing and announces nothing; a seat whose declaration fails an invariant mounts nothing and announces
+ * `config.artifact_host_invalid` (operator audience) so a bad wiring can never read as "no hosting"; a
+ * valid seat mounts ONE `Artifact` tool assembled from the declaration, on the same optional band the LSP
+ * seat uses. The tool's local-file read goes through the run's fs fence (root containment, read-deny,
+ * read face) exactly as `Read` does, then reads the bytes once from the execution env. A local stub's store
+ * (`capabilities.storageDir`) must lie OUTSIDE every root the run may write or read — the task root and both
+ * classes of additional directories — because a ledger the model can edit through the fs tools is not a trust
+ * boundary; a store inside one refuses the mount with the same loud notice, naming the directory and the root.
+ * Synchronous: the stretch has no await (the file read is a closure the tool calls later).
+ */
+import type { ExecutionEnv } from "../../internal/harness.js";
+import { type ArtifactPlane } from "../artifact-host.js";
+import { RosterBuilder } from "../tool-roster.js";
+import type { AgentTool, RunnerDeps } from "../types.js";
+import type { ReadDenyMatcher, ReadFace } from "../../tools/fs/index.js";
+import type { Prepared } from "./contracts.js";
+export interface PrepareArtifactInput {
+    /** borrowed-readonly — the deployment's hosting seat and the notice sink the refusal arm announces on. */
+    deps: Pick<RunnerDeps, "artifactHost" | "onNotice">;
+    /** borrowed-readonly — the engine-minted run id: the host's `onMount` key and every call context's `runId`. */
+    runId: string;
+    /** borrowed-readonly — the host task id, the call context's audit attribution. */
+    taskId: string;
+    /** borrowed-readonly — the acquired session id (notice attribution and the call context's `sessionId`). */
+    sessionId: string;
+    /** borrowed-readonly — the spawned name this run carries, when any (call-context attribution only). */
+    agentName: string | undefined;
+    /** borrowed-readonly — the run's resolved env: the byte source of a published local file. */
+    executionEnv: ExecutionEnv;
+    /** borrowed-readonly — the canonical task root the fs fence contains reads to; undefined ⇒ no local-file publish. */
+    rootCanonical: string | undefined;
+    /** borrowed-readonly — the extra containment roots (write and read-only) the fence admits. */
+    additionalRootsCanonical: readonly string[];
+    /** borrowed-readonly — the read-deny matcher in force for the run, when any. */
+    readDenyMatcher: ReadDenyMatcher | undefined;
+    /** borrowed-readonly — the resolved read face (`"open"` lifts root containment for reads). */
+    resolvedReadFace: ReadFace | undefined;
+    /** borrowed-readonly — the tracked-cwd cell; `current` is read per call as the relative-path base. */
+    handsCwdRef: Prepared["cwdRef"];
+    /** borrowed-mutable — the run's roster builder; writer here: ONE mount when the seat is valid. */
+    roster: RosterBuilder;
+    /** borrowed-readonly — the first-party result-offload wrapper every core mount passes through (a large read or a conflict snapshot is offloaded, not inlined). */
+    firstPartyOffload: (tool: AgentTool) => AgentTool;
+    /** borrowed-mutable — the env-hand membership set the memory content-origin face reads (a tool that reads the execution env's files is a hand); writer here: `add("Artifact")` on the mount. */
+    envHandToolNames: Set<string>;
+}
+export interface PrepareArtifactResult {
+    /** owned — the mounted face's plane, or undefined when nothing mounted (absent seat, or an invalid one). */
+    artifactPlane: ArtifactPlane | undefined;
+}
+export declare function prepareArtifact(input: PrepareArtifactInput): PrepareArtifactResult;

package/dist/core/runner/prepare-artifact.js

@@ -0,0 +1,77 @@
+import { readArtifactHostCapabilities } from "../artifact-host.js";
+import { ARTIFACT_TOOL_NAME } from "../tool-catalog-entries.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+import { RosterBuilder } from "../tool-roster.js";
+import { defineTool } from "../tools.js";
+import { inlineUntrusted } from "../untrusted-text.js";
+import { existsSync, realpathSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { resolveKey, violationDetails, violationText, withinAnyRoot } from "../../tools/fs/safety.js";
+import { createArtifactTool } from "../../tools/artifact/artifact-tool.js";
+function realAncestorPath(p) {
+    const abs = resolve(p);
+    const tail = [];
+    let cur = abs;
+    while (!existsSync(cur)) {
+        const parent = dirname(cur);
+        if (parent === cur)
+            return abs;
+        tail.unshift(basename(cur));
+        cur = parent;
+    }
+    return tail.length === 0 ? realpathSync(cur) : join(realpathSync(cur), ...tail);
+}
+export function prepareArtifact(input) {
+    const { deps, runId, taskId, sessionId, agentName, executionEnv, rootCanonical, additionalRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, roster, firstPartyOffload, envHandToolNames } = input;
+    const host = deps.artifactHost;
+    if (host === undefined)
+        return { artifactPlane: undefined };
+    const refuse = (problem) => {
+        deliverEngineNotice(deps.onNotice, {
+            code: "config.artifact_host_invalid",
+            message: `RunnerDeps.artifactHost is wired but unusable, so no Artifact tool is mounted for this task: ${problem}`,
+            detail: { problem, sessionId, runId },
+        });
+        return { artifactPlane: undefined };
+    };
+    const verdict = readArtifactHostCapabilities(host);
+    if (!verdict.ok)
+        return refuse(verdict.problem);
+    const storageDir = verdict.capabilities.storageDir;
+    if (storageDir !== undefined && rootCanonical !== undefined) {
+        const real = realAncestorPath(storageDir);
+        const inside = [rootCanonical, ...additionalRootsCanonical].find((root) => withinAnyRoot([root], real));
+        if (inside !== undefined)
+            return refuse(`the local artifact store ${storageDir} lies inside a root this run may reach through its file tools (${inside}); put the store outside every task root and additional directory`);
+    }
+    try {
+        host.onMount?.(runId);
+    }
+    catch (err) {
+        return refuse(`artifactHost.onMount threw: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const readLocalFile = async (path, maxBytes, signal) => {
+        if (rootCanonical === undefined)
+            return { ok: false, reason: "refused", text: "Error (Artifact): this task has no filesystem root, so a local file cannot be published." };
+        const rk = await resolveKey(executionEnv, rootCanonical, path, signal, handsCwdRef?.current, additionalRootsCanonical, undefined, readDenyMatcher, resolvedReadFace);
+        if (!rk.ok)
+            return { ok: false, reason: "refused", text: violationText("Artifact", rk.violation), details: violationDetails(rk.violation) };
+        const meta = await executionEnv.fileInfo(rk.key, signal);
+        if (!meta.ok)
+            return { ok: false, reason: "refused", text: `Error (Artifact): cannot stat ${inlineUntrusted(path, 200)} (${inlineUntrusted(meta.error.code, 40)}).` };
+        if (meta.value.kind !== "file")
+            return { ok: false, reason: "not_a_file", kind: meta.value.kind };
+        if (meta.value.size > maxBytes)
+            return { ok: false, reason: "too_large", size: meta.value.size, limit: maxBytes, judgedOn: "metadata" };
+        const r = await executionEnv.readBinaryFile(rk.key, signal);
+        if (!r.ok)
+            return { ok: false, reason: "refused", text: `Error (Artifact): cannot read ${inlineUntrusted(path, 200)} (${inlineUntrusted(r.error.code, 40)}).` };
+        if (r.value.byteLength > maxBytes)
+            return { ok: false, reason: "too_large", size: r.value.byteLength, limit: maxBytes, judgedOn: "bytes" };
+        return { ok: true, key: rk.key, bytes: r.value };
+    };
+    const artifactSpec = createArtifactTool({ host, capabilities: verdict.capabilities, runId, taskId, sessionId, ...(agentName !== undefined ? { agentName } : {}), readLocalFile });
+    roster.mount(firstPartyOffload(defineTool(artifactSpec)), { source: "builtin", mountedBy: "optional" });
+    envHandToolNames.add(ARTIFACT_TOOL_NAME);
+    return { artifactPlane: verdict.capabilities.plane };
+}