@sema-agent/core 7.16.0 → 7.17.0

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -37,10 +37,11 @@ import type { ReadFace } from "../../tools/fs/index.js";
 import type { InheritedGate, Prepared, RunInternals, RunnerSelfSeat, ToolFaceSnapshot } from "./contracts.js";
 import { type BlockedRef } from "./synthetic-tools.js";
 import { RosterBuilder } from "../tool-roster.js";
+import type { ParentSpecSeat } from "../parent-spec-seat.js";
 export interface PrepareCapsAndWorkflowInput {
     /** borrowed-readonly — the REBOUND spec, whole: the roster map reads `tools`; the mounts read `enableBlockedReport`,
      *  `enablePlanMode`, `interactiveTools`; the caps/compliance stations read `principal`, `selfOrchestration`,
-     *  `enableFork`, `getApiKeyAndHeaders`; the Workflow mount forwards `oneShot`, `handsReadOnly`, `interactiveTools`. The
+     *  `enableFork`, `getApiKeyAndHeaders`; the Workflow mount forwards `handsReadOnly`, `interactiveTools`. The
      *  self-orchestration predicate takes the whole spec. Never mutated. */
     spec: TaskSpec;
     /** borrowed-readonly — the deployment seats, whole: `runtimeCapsResolver`, `compliancePostureResolver`, `onError`, `onNotice`,
@@ -54,7 +55,7 @@ export interface PrepareCapsAndWorkflowInput {
     checkpointSeat: CheckpointSeat | undefined;
     /** borrowed-readonly — the trusted spawn-side channel; the Workflow mount forwards `rootSessionId`, `placementRoot`,
      *  `onTaskNotification`, `workflowDepth`, and the capture-floor getter reads `memoryCaptureAncestors`. */
-    internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors" | "workflowParkedResume"> | undefined;
+    internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors" | "workflowParkedResume" | "questionFaceStripped"> | undefined;
     /** borrowed-readonly — the acquired session; the classifier leg rebuilds its transcript window from `buildContext`. */
     session: Pick<StoredSession, "buildContext">;
     /** borrowed-readonly — the acquired session id (operator-line context, the refusal codes' phase record). */
@@ -88,6 +89,7 @@ export interface PrepareCapsAndWorkflowInput {
     };
     /** borrowed-readonly — the FROZEN approver seat (the Workflow mount's parentOnAsk). */
     frozenOnAsk: OnAsk | undefined;
+    /** borrowed-readonly — the parent SPEC seat the children inherit (minted once by the inherited-gate phase; the Workflow mount's dep, the same value the delegation ctx carries). */ parentSpecSeat: ParentSpecSeat;
     /** borrowed-readonly — the ONE read-face carrier expression (the Workflow mount's parentReadFace getter calls it). */
     carrierReadFace: () => ReadFace | undefined;
     /** borrowed-readonly — the filtered display-forwarding wrapper (the Workflow mount's forwardEvent; absent ⇒ no key). */

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -112,7 +112,7 @@ function autoModeArmReasonOf(intent, facePresent, caps, capsFaulted) {
     return { armed: true, reason: "armed" };
 }
 export async function prepareCapsAndWorkflow(input) {
-    const { spec, deps, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
+    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
     const roster = new RosterBuilder(toolEffects);
     for (const t of spec.tools ?? []) {
         const mounted = mountCallerTool(t);
@@ -312,8 +312,7 @@ export async function prepareCapsAndWorkflow(input) {
                         return mine.length > 0 ? mine : undefined;
                     } }
                 : {}),
-            principal: spec.principal,
-            oneShot: spec.oneShot,
+            parentSpecSeat, ...(internals?.questionFaceStripped === true ? { parentQuestionFaceStripped: true } : {}),
             ...(resolvedInteractionPosture !== undefined ? { parentInteractionPosture: resolvedInteractionPosture } : {}),
             parentMemoryCaptureState: () => {
                 const memoryEngineSession = input.memoryEngineSession();

package/dist/core/runner/prepare-config-doors.d.ts

@@ -22,7 +22,7 @@
 import { type BrainCallGuardrailRef } from "../../brain/timeout.js";
 import type { Model } from "../../internal/llm.js";
 import type { ThinkingLevel } from "../../internal/harness.js";
-import type { ContextEditMachine } from "../context-edit.js";
+import { type MicroCompactMachine } from "../context-edit.js";
 import { type LockedPreflight } from "../locked-config.js";
 import { type ResolvedRole } from "../roles.js";
 import type { SessionStore } from "../session.js";
@@ -150,7 +150,7 @@ export interface PrepareConfigDoorsResult {
      *  for the door + placement reasoning). The per-run state builder consumes exactly these values —
      *  the deps bag is never re-read after this door. */
     microCompactKnob: {
-        machine: "off" | ContextEditMachine;
+        machine: MicroCompactMachine;
         clearOnRejection: boolean;
     };
     /** owned — the resolved role; its `systemPrompt` seat is still read at prompt-input time. */
@@ -213,7 +213,7 @@ export interface PrepareConfigDoorsResult {
  *  it must refuse exactly like a malformed field, never fold to the defaults. The RESOLVED values
  *  returned here are immutable and are the state builder's ONLY source — nothing re-reads the bag. */
 export declare function resolveMicroCompactKnob(bag: RunnerDeps["microCompact"]): {
-    machine: "off" | ContextEditMachine;
+    machine: MicroCompactMachine;
     clearOnRejection: boolean;
 };
 export declare function prepareConfigDoors(input: PrepareConfigDoorsInput): PrepareConfigDoorsResult;

package/dist/core/runner/prepare-config-doors.js

@@ -1,5 +1,7 @@
 import { resolveBrainCallGuardrailMs } from "../../brain/timeout.js";
 import { assertReadFaceValue } from "../../tools/fs/index.js";
+import { MICRO_COMPACT_MACHINES } from "../context-edit.js";
+import { assertNoRetiredRunnerDeps } from "./retired-runner-deps.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { isModelPriced, malformedPricingField, modelCostToPricing } from "../pricing.js";
 import { preflightLockedConfig } from "../locked-config.js";
@@ -133,8 +135,8 @@ export function resolveMicroCompactKnob(bag) {
         throw microCompactConfigError(undefined, bag, "an object carrying optional machine/clearOnRejection keys");
     }
     const declaredMachine = bag?.machine;
-    if (declaredMachine !== undefined && declaredMachine !== "off" && declaredMachine !== "legacy" && declaredMachine !== "cc") {
-        throw microCompactConfigError("machine", declaredMachine, `"off" | "legacy" | "cc"`);
+    if (declaredMachine !== undefined && !MICRO_COMPACT_MACHINES.includes(declaredMachine)) {
+        throw microCompactConfigError("machine", declaredMachine, MICRO_COMPACT_MACHINES.map((m) => `"${m}"`).join(" | "));
     }
     return { machine: declaredMachine ?? "cc", clearOnRejection: resolveClearOnRejection(bag) };
 }
@@ -148,6 +150,7 @@ function resolveClearOnRejection(bag) {
 export function prepareConfigDoors(input) {
     const { deps, sessions, resume, internals } = input;
     let spec = input.spec;
+    assertNoRetiredRunnerDeps(deps);
     assertRestoreGatedToolsValue(spec.restoreGatedTools);
     const microCompactKnob = resolveMicroCompactKnob(deps.microCompact);
     const assertToolNameListValue = (value, seat) => {

package/dist/core/runner/prepare-context-lane.d.ts

@@ -17,7 +17,7 @@
  */
 import { type AgentHarness, type AgentMessage } from "../../internal/harness.js";
 import type { Model } from "../../internal/llm.js";
-import { type ContextEditMachine, type OccurrenceIndex } from "../context-edit.js";
+import { type MicroCompactMachine, type OccurrenceIndex } from "../context-edit.js";
 import { type ToolResultStore } from "../tool-result-store.js";
 import { type RunnerDeps } from "../types.js";
 import type { Prepared, PreparedMicroCompact } from "./contracts.js";
@@ -39,7 +39,7 @@ export interface PrepareContextLaneInput {
     offloadStore: ToolResultStore | undefined;
     /** borrowed-readonly — the doors' RESOLVED microCompact knob (immutable values, never the deps bag). */
     microCompactKnob: {
-        machine: "off" | ContextEditMachine;
+        machine: MicroCompactMachine;
         clearOnRejection: boolean;
     };
     /** borrowed-mutable — the built harness. Writer here: `on("context", …)` — the ONE registration of the request-build

package/dist/core/runner/prepare-context-lane.js

@@ -44,14 +44,8 @@ export function prepareContextLane(input) {
             let ccPass;
             const edited = microCompact.machine === "off" ? mediaCapped : clearStaleToolResults(mediaCapped, {
                 budgetTokens: editAt,
-                machine: microCompact.machine,
-                ...(microCompact.machine === "cc" || microCompact.clearOnRejection ? { recognizeCcMarkers: true } : {}),
-                ...(microCompact.machine === "cc"
-                    ? {
-                        clearSource: replayed,
-                        onCleared: (pass) => { ccPass = pass; },
-                    }
-                    : {}),
+                clearSource: replayed,
+                onCleared: (pass) => { ccPass = pass; },
                 anchoredTotalTokens: estimateContextTokens(mediaCapped, charsPerToken).tokens,
                 charsPerToken,
                 ...(offloadStore
@@ -193,15 +187,10 @@ export async function runGuardChain(args) {
     };
     let working = edited;
     let anchoredWorking = estimateContextTokens(working, charsPerToken).tokens;
-    if (microCompact.machine === "legacy") {
-        const t = applyGuardTrim(working, anchoredWorking);
-        return { working, trimmed: t.trimmed, trimDroppedMessages: t.dropped };
-    }
     if (microCompact.machine === "off" && anchoredWorking > guardAt) {
         let blockingPass;
         const blockingEdited = clearStaleToolResults(working, {
             budgetTokens: guardAt,
-            machine: "cc",
             clearSource: args.replayed,
             onCleared: (pass) => { blockingPass = pass; },
             anchoredTotalTokens: anchoredWorking,

package/dist/core/runner/prepare-file-history.d.ts

@@ -25,7 +25,7 @@ import type { FileHistoryBoundarySeat, RunInternals } from "./contracts.js";
 export interface PrepareFileHistoryInput {
     /** borrowed-readonly — the deployment seats this phase reads: the first-touch failure policy and the
      *  history store (both validated HERE, once), the incident sink, and the retired-epoch diagnostic probe. */
-    deps: Pick<RunnerDeps, "onTrackFailure" | "fileHistoryStore" | "onError" | "legacyRewindBoundaryProbe">;
+    deps: Pick<RunnerDeps, "onTrackFailure" | "fileHistoryStore" | "onError">;
     /** borrowed-readonly — the REBOUND spec's rewind request fields (the retired `rewindFiles` spelling is
      *  read off the same object as an unknown key) and the caller's cancel signal for the restore. */
     spec: Pick<TaskSpec, "resumeAt" | "resumeAtMode" | "restoreFiles" | "rewindFilesTo" | "acceptPartialRestore" | "signal">;

package/dist/core/runner/prepare-file-history.js

@@ -63,7 +63,6 @@ export async function prepareFileHistory(input) {
             });
         }
     }
-    const legacyEpochTail = (entryId, form = "at-or-above") => legacyRewindEpochTail(deps, sessionId, entryId, form);
     let restoredFilePaths = [];
     if (rewindTarget !== undefined && fileHistoryStore !== undefined && handsEnabled) {
         const historyStore = fileHistoryStore;
@@ -85,7 +84,7 @@ export async function prepareFileHistory(input) {
                 }
             }
             if (anchor === undefined) {
-                const e = new Error(`rewind-files: no file-history boundary exists at or above the "before" branch point on session "${sessionId}" — cannot restore files consistent with the rewound context. ${await legacyEpochTail(rewindTarget)}`);
+                const e = new Error(`rewind-files: no file-history boundary exists at or above the "before" branch point on session "${sessionId}" — cannot restore files consistent with the rewound context. ${rewindRefusalTail("at-or-above")}`);
                 e.code = "rewind_snapshot.unresolvable";
                 throw e;
             }
@@ -99,7 +98,7 @@ export async function prepareFileHistory(input) {
             if (restored.error?.code === "not_found") {
                 const e = new Error(rewindBefore
                     ? `rewind-files: the resolved "before" history anchor "${rewindTarget}" disappeared before restore — files were NOT rewound`
-                    : `rewind-files: no file-history boundary exists for entry "${rewindTarget}" on session "${sessionId}" — the working tree was NOT rewound. ${await legacyEpochTail(rewindTarget, "keyed")}`);
+                    : `rewind-files: no file-history boundary exists for entry "${rewindTarget}" on session "${sessionId}" — the working tree was NOT rewound. ${rewindRefusalTail("keyed")}`);
                 e.code = "rewind_snapshot.unresolvable";
                 throw e;
             }
@@ -192,55 +191,7 @@ function resolveWiredFileHistoryStore(candidate) {
     }
     return candidate;
 }
-const LEGACY_PROBE_TIMEOUT_MS = 2_000;
-const LEGACY_PROBE_TIMED_OUT = Symbol("legacy-rewind-probe-timeout");
-async function legacyRewindEpochTail(deps, sessionId, entryId, form) {
-    const probe = deps.legacyRewindBoundaryProbe;
-    let verdict;
-    if (probe !== undefined) {
-        try {
-            let timer;
-            const timeout = new Promise((resolve) => {
-                timer = setTimeout(() => resolve(LEGACY_PROBE_TIMED_OUT), LEGACY_PROBE_TIMEOUT_MS);
-            });
-            try {
-                verdict = await Promise.race([Promise.resolve(probe({ sessionId, entryId })), timeout]);
-            }
-            finally {
-                clearTimeout(timer);
-            }
-            if (verdict === LEGACY_PROBE_TIMED_OUT) {
-                verdict = undefined;
-                try {
-                    deps.onError?.(new Error(`RunnerDeps.legacyRewindBoundaryProbe did not answer within ${LEGACY_PROBE_TIMEOUT_MS}ms while explaining a rewind refusal — the refusal stands and names both possibilities`), { phase: "rewind", sessionId });
-                }
-                catch {
-                }
-            }
-        }
-        catch (err) {
-            verdict = undefined;
-            try {
-                deps.onError?.(new Error(`RunnerDeps.legacyRewindBoundaryProbe threw while explaining a rewind refusal (${err.message}) — the refusal stands and names both possibilities`), { phase: "rewind", sessionId });
-            }
-            catch {
-            }
-        }
-        if (verdict !== undefined && typeof verdict !== "boolean") {
-            try {
-                deps.onError?.(new Error(`RunnerDeps.legacyRewindBoundaryProbe answered ${JSON.stringify(String(verdict))} for entry "${entryId}" — only true/false/undefined are meaningful, so the refusal names both possibilities instead of trusting it`), { phase: "rewind", sessionId });
-            }
-            catch {
-            }
-            verdict = undefined;
-        }
-    }
-    if (verdict === true) {
-        return `This deployment's legacy-epoch probe reports that entry "${entryId}" DOES carry a boundary from the retired whole-tree snapshot era, which this engine's per-edited-file seat does not restore — the two epochs are not interchangeable (a whole-tree manifest carries no tracked-set provenance, so replaying it here would converge files this session never edited). Restore it with the whole-tree-era tooling this deployment kept, or re-run the turns under the current engine.`;
-    }
-    if (verdict === false) {
-        return `This deployment's legacy-epoch probe reports no whole-tree-era boundary for entry "${entryId}" either, so the boundary simply does not exist: its turns ran without a RunnerDeps.fileHistoryStore wired, or it was reaped.`;
-    }
+function rewindRefusalTail(form) {
     return form === "keyed"
         ? `Boundaries are keyed by a turn's INITIAL entry and exist only for turns that ran with a RunnerDeps.fileHistoryStore wired; a boundary from the retired whole-tree snapshot era is not restorable by this seat, and reaped boundaries have none.`
         : `Either the boundary does not exist (its turns ran without a RunnerDeps.fileHistoryStore, or it was reaped), or it was produced in the retired whole-tree snapshot era, which this engine's per-edited-file seat does not restore.`;

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -162,13 +162,10 @@ export interface PrepareHandsReadFaceInput {
      *  when no file restore ran. Fail-closed by construction — dropping a read record only ever
      *  produces refusals. */
     restoredFilePaths?: readonly string[];
-    /** borrowed-readonly — (ref cell; the REF itself is never replaced) memory write gate:
-     *  the band's beforeWrite closure reads `.current` call-time; prepareMemory (driver, BEFORE this phase
-     *  since the memory root must be known before the toolkit compiles) installs the gate — the one
-     *  writer; this phase only reads. Declared in the driver because the SAME ref feeds prepareMemory. */
-    memoryWriteGateRef: {
-        current?: BeforeWriteHook;
-    };
+    /** borrowed-readonly — the memory write gate the memory phase minted (it runs BEFORE this phase: the memory root
+     *  must be known before the toolkit compiles), composed into the band's beforeWrite below; undefined for a
+     *  memory-less run (every write passes the engine half). */
+    memoryWriteGate: BeforeWriteHook | undefined;
     /** borrowed-mutable — the advertised-writable-directory seat (see its module header for the one
      *  rule). Present on the hands leg only (a fence exists). The memory phase, which runs BEFORE this one,
      *  has already admitted its write root through it; this phase admits the deployment's scratchpad and

package/dist/core/runner/prepare-hands-readface.js

@@ -123,7 +123,7 @@ export function resolveHandsLessReadFace(input) {
 }
 export async function prepareHandsMount(input) {
     const envHandToolNames = new Set();
-    const { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGateRef, advertisedWritableDirs, firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes } = input;
+    const { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGate, advertisedWritableDirs, firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes } = input;
     assertStringArraySeat(spec.additionalDirectories, "TaskSpec.additionalDirectories", "strings");
     assertStringArraySeat(spec.additionalReadDirectories, "TaskSpec.additionalReadDirectories", "strings");
     assertStringArraySeat(deps.readDenyPatterns, "RunnerDeps.readDenyPatterns", "compiler-owned");
@@ -328,7 +328,7 @@ export async function prepareHandsMount(input) {
                     if (verdict !== undefined && verdict.ok === false)
                         return verdict;
                 }
-                return memoryWriteGateRef.current?.(w);
+                return memoryWriteGate?.(w);
             },
             mountBackgroundTaskTools: false,
             monitorToolActive: backgroundTaskToolsActive && !(toolFaceSnapshot.exclude?.includes("Monitor") ?? false),
@@ -354,6 +354,7 @@ export async function prepareHandsMount(input) {
             const shellReadBoundary = () => ({
                 roots: [rootCanonical, ...additionalRootsCanonical, ...additionalReadRootsCanonical],
                 ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}),
+                ...(executionEnv.homeDir !== undefined ? { homeDir: executionEnv.homeDir } : {}),
                 denyMatch: (p) => readDenyMatcher?.matchPath(p)?.pattern ?? null,
                 ...(resolvedReadFace !== undefined ? { face: resolvedReadFace } : {}),
             });

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -5,7 +5,7 @@
  * freeze with its tighten-only intersection and the monotonic governed bit), the effective shellGate against the
  * spec, the three cells later phases fill for the children's chain (own session rules, own admitted org scopes,
  * own org verdict), the checkpoint-section closures the suspend serializer reads (face / org / F-012 stamps), the
- * FROZEN ask and question seats (spec over deps), the two delegation refs the memory phase binds late, the ONE
+ * FROZEN ask and question seats (spec over deps), the parent SPEC seat the children inherit, the two delegation refs the memory phase binds late, the ONE
  * child-chain assembly `inheritedGateForChildren`, the caller-tool ctx enrichment `enrichSpecToolCtx` shared by
  * the roster wrap and the revival spawner, the denial-limit stop seat, and the full-shell reachability predicate.
  * The interface is the dependency list the segment had implicitly.
@@ -36,6 +36,7 @@ import type { ReadFace } from "../../tools/fs/index.js";
 import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import { type OnQuestion } from "../ask-question.js";
+import { type ParentSpecSeat } from "../parent-spec-seat.js";
 import { type HookEnvCapabilities, type Hooks } from "../hooks.js";
 import type { LockedPreflight } from "../locked-config.js";
 import type { OwnOrgAdmissionVerdict } from "../memory-admission.js";
@@ -65,7 +66,7 @@ export interface PrepareInheritedGateInput {
     /** borrowed-readonly — the trusted spawn-side channel: `inheritedGate` (the LIVE half of the chain fold), `ownOrgAdmissionRef`
      *  (the same-session continuation's freeze), `delegationProvenance` (the F-012 stamp), and the identity / peer / notification
      *  seats the ctx enrichment forwards. Never mutated. */
-    internals: Pick<RunInternals, "inheritedGate" | "ownOrgAdmissionRef" | "delegationProvenance" | "memoryCaptureAncestors" | "parentTaskId" | "parentSessionId" | "rootSessionId" | "placementRoot" | "explicitAgentName" | "peerSelfRef" | "peerInboundChainRef" | "onTaskNotification" | "onSubagentSpawn" | "insideFork"> | undefined;
+    internals: Pick<RunInternals, "inheritedGate" | "ownOrgAdmissionRef" | "delegationProvenance" | "memoryCaptureAncestors" | "parentTaskId" | "parentSessionId" | "rootSessionId" | "placementRoot" | "explicitAgentName" | "peerSelfRef" | "peerInboundChainRef" | "onTaskNotification" | "onSubagentSpawn" | "insideFork" | "questionFaceStripped"> | undefined;
     /** borrowed-readonly — the resume leg, or undefined on a fresh one: `seed.inheritedGate` is the CHECKPOINT half of the chain
      *  fold (the trust floor the live half may only tighten), `seed.readFace` the hands-less re-park's carried section. */
     resume: Pick<PrepareResume, "seed"> | undefined;
@@ -240,6 +241,8 @@ export interface PrepareInheritedGateResult {
     notifyOwnHookCrash: (err: unknown) => void;
     /** owned — the FROZEN question seat (spec over deps), the content-ask twin of `frozenOnAsk`. */
     frozenOnQuestion: OnQuestion | undefined;
+    /** owned — the parent SPEC seat this run hands its children (`parentSpecSeatOf(spec, frozenOnQuestion)`): the ctx seat and the Workflow mount dep are this one value; both lanes apply it with `applyParentSpecSeat` (one law). */
+    parentSpecSeat: ParentSpecSeat;
     /** borrowed-mutable — the delegation runtime-provenance arming face. Writer: the memory-engine-session phase
      *  (prepareMemoryEngineSession), once per leg when it arms. Read lazily by delegation tools through the ctx. */
     provenanceForChildrenRef: {

package/dist/core/runner/prepare-inherited-gate.js

@@ -1,8 +1,9 @@
 import { forkGovernanceDenial, resolveDelegationEntryCaps } from "../../agents/subagent.js";
 import { isLiveQuestionFace } from "../ask-question.js";
+import { parentSpecSeatOf } from "../parent-spec-seat.js";
 import { createPreToolUseConstraintPolicy } from "../hooks.js";
 import { StubExecutionEnv } from "../stub-env.js";
-import { askApproverIdentity, isLiveApproverSeat } from "../tool-policy.js";
+import { askApproverIdentity, durableMandateSourceOf } from "../tool-policy.js";
 import { attachRebuiltDenialTrackers, createDenialLimitStop } from "./denial-limit-arms.js";
 export function prepareInheritedGate(input) {
     const { spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, autoModeSeat, handsEnabled, reportUsage, harnessRef, skillScope, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
@@ -93,6 +94,7 @@ export function prepareInheritedGate(input) {
         }
     };
     const frozenOnQuestion = spec.onQuestion ?? deps.onQuestion;
+    const parentSpecSeat = parentSpecSeatOf(spec, frozenOnQuestion);
     const provenanceForChildrenRef = {};
     const delegationProvenanceForChildren = () => provenanceForChildrenRef.current;
     const delegationSettlementRef = {};
@@ -106,8 +108,7 @@ export function prepareInheritedGate(input) {
             ...(ownSessionRulesRef.current !== undefined ? [ownSessionRulesRef.current] : []),
         ];
         const ownCallerPolicy = lockedPreflight.toolPolicy;
-        const durableMandate = input.runtimeCaps()?.forceDurableGate === true ||
-            (spec.durableApproval !== undefined && !isLiveApproverSeat(frozenOnAsk));
+        const durableMandate = durableMandateSourceOf({ forceDurableGate: input.runtimeCaps()?.forceDurableGate === true, durableApprovalDeclared: spec.durableApproval !== undefined, onAsk: frozenOnAsk }) !== undefined;
         const contentMandate = input.runtimeCaps()?.forceDurableGate === true ||
             (spec.durableApproval !== undefined && !isLiveQuestionFace(frozenOnQuestion));
         const ownPreToolUse = input.preToolUseObservational() ? undefined : input.hooks()?.preToolUse;
@@ -186,15 +187,13 @@ export function prepareInheritedGate(input) {
             ...(readDenyAdditionsNormalized.length > 0 ? { readDenyPatterns: Object.freeze(readDenyAdditionsNormalized.map((e) => ({ ...e }))) } : {}),
             ...(spec.interactiveTools === false ? { interactiveTools: false } : {}),
             oneShot: spec.oneShot,
-            clientContext: spec.clientContext,
+            parentSpecSeat,
+            ...(internals?.questionFaceStripped === true ? { questionFaceStripped: true } : {}),
             excludeTools: toolFaceSnapshot.exclude,
             deferTools: toolFaceSnapshot.defer,
             alwaysLoadTools: toolFaceSnapshot.alwaysLoad,
             ...(toolFaceSnapshot.restoreGated !== undefined ? { restoreGatedTools: toolFaceSnapshot.restoreGated } : {}),
             promptProfile,
-            ...(spec.additionalDirectories !== undefined ? { additionalDirectories: Object.freeze([...spec.additionalDirectories]) } : {}),
-            ...(spec.additionalReadDirectories !== undefined ? { additionalReadDirectories: Object.freeze([...spec.additionalReadDirectories]) } : {}),
-            ...(spec.envFacts !== undefined ? { envFacts: { ...spec.envFacts } } : {}),
             ...(spec.memoryPersistenceCapable !== undefined ? { memoryPersistenceCapable: spec.memoryPersistenceCapable } : {}),
             get memoryCaptureOptedOut() {
                 return input.memoryEngineSession()?.captureOptOut?.optedOut() ?? false;
@@ -263,5 +262,5 @@ export function prepareInheritedGate(input) {
             ...(spec.enablePlanMode === true ? { enterPlanMode } : {}),
         };
     };
-    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, autoModeIntent, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
+    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, autoModeIntent, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
 }

package/dist/core/runner/prepare-memory.d.ts

@@ -18,12 +18,6 @@ export interface PrepareMemoryInput {
     /** borrowed-readonly — the resolved task root: the containment boundary every derived memory dir
      *  is checked against, and the repo-root fallback when `deps.rootPath` is unset. */
     taskRootPath: string;
-    /** borrowed-mutable — the caller's write-gate cell, and THIS phase is its writer: it installs the
-     *  memory write gate into `.current` (the module header's one out-param effect). Identity is the
-     *  contract — the caller's hands/read-face seat reads this exact cell. */
-    memoryWriteGateRef: {
-        current?: BeforeWriteHook;
-    };
     /**
      * borrowed-readonly — #181-F5: whether a tool NAMED `Write` (the tool the CC `# Memory` instruction names) is on the
      * ASSEMBLED roster this run, not excluded, AND can actually REACH the host-side memory root:
@@ -199,6 +193,10 @@ export interface MemoryInjectionComposition {
 export interface PrepareMemoryResult {
     memoryEngineSession: Prepared["memoryEngineSession"];
     memoryTools?: ToolSpec[];
+    /** owned — the memory WRITE gate (Write/Edit/NotebookEdit run their FINAL text through MemoryEngine.gateWrite when
+     *  the target lands inside the memory writable root; the read-only plane refuses its own domain). Present iff a memory
+     *  engine mounted; the hands phase composes it into the band's beforeWrite (a memory-less run: every write passes). */
+    memoryWriteGate?: BeforeWriteHook;
     /**
      * owned — #691: the injection's COMPOSITION step, run by the driver AFTER the hands phase (the mount above runs
      * BEFORE it). It performs the one destructive read this phase has — `inject()` drains the announcement queue —

package/dist/core/runner/prepare-memory.js

@@ -13,7 +13,8 @@ import { FileMemoryEngineBackend } from "../memory-engine/file-backend.js";
 import { writableRootOf } from "../memory-engine/types.js";
 let undeclaredCapturePostureAnnounced = false;
 export async function prepareMemory(input) {
-    const { spec, deps, sessionId, taskRootPath, memoryWriteGateRef, admissionCtx } = input;
+    const { spec, deps, sessionId, taskRootPath, admissionCtx } = input;
+    let memoryWriteGate;
     const memorySpec = normalizeMemorySpec(spec.memory);
     let admittedOrgScopes = [];
     let ownOrgVerdict;
@@ -473,7 +474,7 @@ export async function prepareMemory(input) {
                     writeHandle.writeScope !== null &&
                     foreignUnderRoot.length === 0 &&
                     (input.advertisedWritableDirs === undefined || (await input.advertisedWritableDirs.admit({ path: writableRootOf(writeHandle), advertiser: "memory", expectCanonical: writableRootOf(writeHandle) })));
-            memoryWriteGateRef.current = async (w) => {
+            memoryWriteGate = async (w) => {
                 if (readOnlyEngine !== undefined && readOnlyHandle !== undefined) {
                     const ro = readOnlyEngine.gateWrite(readOnlyHandle, w.key, w.content);
                     if (!ro.ok)
@@ -776,6 +777,7 @@ export async function prepareMemory(input) {
         ownOrgVerdict,
         effectiveMemoryScopes,
         ...(memoryTools !== undefined ? { memoryTools } : {}),
+        ...(memoryWriteGate !== undefined ? { memoryWriteGate } : {}),
         composeInjection,
     };
 }

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -75,9 +75,9 @@ export interface PreparePolicyChainInput {
         irreversible?: false;
         egress?: false;
     }>;
-    /** borrowed-readonly — the caller tools' names, the first-await snapshot (the sandbox boundary predicate: a caller tool
-     *  is never contained by the hand tools' env). */
-    ownToolNames: ReadonlySet<string>;
+    /** borrowed-readonly — the ENGINE HAND roster: every tool whose effect dispatches through the task's execution env,
+     *  membership minted at the mount sites (the sandbox boundary predicate's one containment fact). */
+    envHandToolNames: ReadonlySet<string>;
     /** borrowed-readonly — the shell-seat provenance set (the offer factory's `shellGated` mandate term, read per call). */
     shellGatedTools: ReadonlySet<string>;
     /** borrowed-readonly — the tracked-cwd seat, read per call by the lanes and the offer factory (never written here). */

package/dist/core/runner/prepare-policy-chain.js

@@ -1,11 +1,10 @@
-import { SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { policyAskClassOf } from "../ask-class.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { cloneObserverInput, resolveHookTimeoutMs } from "../hooks.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
 import { isIsolated } from "../remote-env.js";
-import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, isLiveApproverSeat, resolveAsk, toolPolicyNameSets } from "../tool-policy.js";
+import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, isLiveApproverSeat, resolveAsk, toolPolicyNameSets, attestAskUnresolvableCause } from "../tool-policy.js";
 import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
 import { NAMESPACED_NAME_SHAPES, protocolOf } from "../protocol-table.js";
 import { emitTrace } from "../trace.js";
@@ -16,7 +15,7 @@ import { askGrantShapeOf } from "./inherited-ask-grants.js";
 import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf } from "./permission-rule-lanes.js";
 import { createSessionRulePolicy } from "./session-rule-policy.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, ownToolNames, shellGatedTools, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, envHandToolNames, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
     const policy = lockedPreflight.toolPolicy;
     const auditPolicyNames = (auditee) => {
         const nameGroups = toolPolicyNameSets(auditee);
@@ -144,6 +143,12 @@ export async function preparePolicyChain(input) {
         inheritedUnavailableAsks.add(toolCallId);
         return true;
     };
+    const mandatedCallFloats = (toolCallId) => resolveCheckpointStore(spec, deps) !== undefined && (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) && markInheritedUnavailable(toolCallId);
+    const mandateUnreconstructibleDeny = (creq) => attestAskUnresolvableCause({
+        action: "deny",
+        message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
+    }, "mandate_unreconstructible", creq);
+    const markerChannelFullDeny = (creq) => attestAskUnresolvableCause({ action: "deny", message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed` }, "approver_unavailable", creq);
     const inheritedAskGrants = new Map();
     const recordInheritedAskGrant = (toolCallId, approver, presented, waitMs) => {
         if (typeof approver !== "function")
@@ -190,7 +195,7 @@ export async function preparePolicyChain(input) {
         list.push({ cls, layer });
         foldAskClasses.set(toolCallId, list);
     };
-    const sandboxBoundaryCapable = (toolName) => egressTools.has(toolName) || toolName.includes("__") || ownToolNames.has(toolName) || toolName === SEND_MESSAGE_TOOL_NAME;
+    const sandboxBoundaryCapable = (toolName) => egressTools.has(toolName) || !envHandToolNames.has(toolName);
     const emitSandboxAdmitted = (info) => {
         emitTrace(deps.tracer, () => ({
             kind: "permission.sandbox_admitted",
@@ -358,16 +363,9 @@ export async function preparePolicyChain(input) {
                         };
                     }
                     if (pc.durableMandate === true) {
-                        if (resolveCheckpointStore(spec, deps) !== undefined &&
-                            (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
-                            markInheritedUnavailable(creq.toolCallId)) {
+                        if (mandatedCallFloats(creq.toolCallId))
                             return first;
-                        }
-                        return {
-                            action: "deny",
-                            message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
-                                `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
-                        };
+                        return mandateUnreconstructibleDeny(creq);
                     }
                     const judged = await judgeInheritedClassifier({ autoMode: pc.autoMode, ask: first, req: creq, signal: csignal ?? abortController.signal, subject: "this call" });
                     if (judged.kind === "allow")
@@ -398,10 +396,7 @@ export async function preparePolicyChain(input) {
                     if (resolved.action === "deny" && resolved.approverUnavailable === true) {
                         if (markInheritedUnavailable(creq.toolCallId))
                             return inheritedAsk;
-                        return {
-                            action: "deny",
-                            message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
-                        };
+                        return markerChannelFullDeny(creq);
                     }
                     settleDenialLimitFallback({ fallback, mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
                     if (resolved.action !== "allow")
@@ -437,16 +432,9 @@ export async function preparePolicyChain(input) {
                         };
                     }
                     if (pc.durableMandate === true) {
-                        if (resolveCheckpointStore(spec, deps) !== undefined &&
-                            (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
-                            markInheritedUnavailable(creq.toolCallId)) {
+                        if (mandatedCallFloats(creq.toolCallId))
                             return decision;
-                        }
-                        return {
-                            action: "deny",
-                            message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
-                                `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
-                        };
+                        return mandateUnreconstructibleDeny(creq);
                     }
                     const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
                     const judged = await judgeInheritedClassifier({ autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call" });
@@ -477,10 +465,7 @@ export async function preparePolicyChain(input) {
                     if (resolved.action === "deny" && resolved.approverUnavailable === true) {
                         if (markInheritedUnavailable(creq.toolCallId))
                             return inheritedAsk;
-                        return {
-                            action: "deny",
-                            message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
-                        };
+                        return markerChannelFullDeny(creq);
                     }
                     settleDenialLimitFallback({ fallback, mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
                     if (resolved.action !== "allow")

package/dist/core/runner/prepare-prompt-assembly.js

@@ -95,7 +95,7 @@ export async function preparePromptAssembly(input) {
         }
         : undefined;
     const promptConstitution = assembled.constitution;
-    const promptBlocks = assembled.legacyBlocks;
+    const promptBlocks = assembled.blocks;
     const collisionAudit = auditToolCollisions(tools);
     for (const y of collisionAudit.yields) {
         onceLedger.onError(new Error(`tool mount: caller tool "${y.name}" shadows another tool with the same canonical name (deliberate last-write-wins yield — the later mount serves)`), { phase: "config", sessionId });

package/dist/core/runner/prepare-safety-scan.d.ts

@@ -12,7 +12,7 @@ export interface PrepareSafetyScanInput {
  * The scan's outputs. Ownership annotations (four-class form):
  *
  * `ownToolNames` is **borrowed-readonly** — a first-await snapshot with no mutation anywhere after
- * the scan; its one later read is the sandbox-boundary predicate's `.has()`.
+ * the scan (sandbox containment reads the env-hand roster, not this set).
  *
  * The six collections are **borrowed-mutable**: the driver and later phases fold into them IN
  * PLACE (identity is part of the contract — closures alias these exact objects). Mutation owners

package/dist/core/runner/prepare-suspend-saga.js

@@ -106,7 +106,6 @@ export function prepareSuspendSaga(input) {
         activeTools: [...activeTools],
         outputRef: { value: outputRef.value, set: outputRef.set },
         nestedStats: { ...nestedStats },
-        consolidationNotes: undefined,
         readFileState: readFileStateForCheckpoint ? [...readFileStateForCheckpoint.entries()] : undefined,
         readFace: faceCheckpointSection(),
         reminderMark,
@@ -121,7 +120,6 @@ export function prepareSuspendSaga(input) {
                 .map((t) => ({ id: t.task_id, ...(t.description !== undefined ? { description: t.description } : {}) }));
             return live.length > 0 ? live : undefined;
         })(),
-        pendingSteer: undefined,
         pendingSteerQueue: undefined,
         inheritedGate: (() => {
             const requiresParentConstraint = (inheritedParentConstraints?.length ?? 0) > 0 || seedInheritedGate?.requiresParentConstraint === true;