@sema-agent/core 7.16.0 → 7.17.1

package/dist/core/runner/prepare-inherited-gate.js

@@ -1,8 +1,9 @@
 import { forkGovernanceDenial, resolveDelegationEntryCaps } from "../../agents/subagent.js";
 import { isLiveQuestionFace } from "../ask-question.js";
+import { parentSpecSeatOf } from "../parent-spec-seat.js";
 import { createPreToolUseConstraintPolicy } from "../hooks.js";
 import { StubExecutionEnv } from "../stub-env.js";
-import { askApproverIdentity, isLiveApproverSeat } from "../tool-policy.js";
+import { askApproverIdentity, durableMandateSourceOf } from "../tool-policy.js";
 import { attachRebuiltDenialTrackers, createDenialLimitStop } from "./denial-limit-arms.js";
 export function prepareInheritedGate(input) {
     const { spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, autoModeSeat, handsEnabled, reportUsage, harnessRef, skillScope, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
@@ -93,6 +94,7 @@ export function prepareInheritedGate(input) {
         }
     };
     const frozenOnQuestion = spec.onQuestion ?? deps.onQuestion;
+    const parentSpecSeat = parentSpecSeatOf(spec, frozenOnQuestion);
     const provenanceForChildrenRef = {};
     const delegationProvenanceForChildren = () => provenanceForChildrenRef.current;
     const delegationSettlementRef = {};
@@ -106,8 +108,7 @@ export function prepareInheritedGate(input) {
             ...(ownSessionRulesRef.current !== undefined ? [ownSessionRulesRef.current] : []),
         ];
         const ownCallerPolicy = lockedPreflight.toolPolicy;
-        const durableMandate = input.runtimeCaps()?.forceDurableGate === true ||
-            (spec.durableApproval !== undefined && !isLiveApproverSeat(frozenOnAsk));
+        const durableMandate = durableMandateSourceOf({ forceDurableGate: input.runtimeCaps()?.forceDurableGate === true, durableApprovalDeclared: spec.durableApproval !== undefined, onAsk: frozenOnAsk }) !== undefined;
         const contentMandate = input.runtimeCaps()?.forceDurableGate === true ||
             (spec.durableApproval !== undefined && !isLiveQuestionFace(frozenOnQuestion));
         const ownPreToolUse = input.preToolUseObservational() ? undefined : input.hooks()?.preToolUse;
@@ -186,15 +187,13 @@ export function prepareInheritedGate(input) {
             ...(readDenyAdditionsNormalized.length > 0 ? { readDenyPatterns: Object.freeze(readDenyAdditionsNormalized.map((e) => ({ ...e }))) } : {}),
             ...(spec.interactiveTools === false ? { interactiveTools: false } : {}),
             oneShot: spec.oneShot,
-            clientContext: spec.clientContext,
+            parentSpecSeat,
+            ...(internals?.questionFaceStripped === true ? { questionFaceStripped: true } : {}),
             excludeTools: toolFaceSnapshot.exclude,
             deferTools: toolFaceSnapshot.defer,
             alwaysLoadTools: toolFaceSnapshot.alwaysLoad,
             ...(toolFaceSnapshot.restoreGated !== undefined ? { restoreGatedTools: toolFaceSnapshot.restoreGated } : {}),
             promptProfile,
-            ...(spec.additionalDirectories !== undefined ? { additionalDirectories: Object.freeze([...spec.additionalDirectories]) } : {}),
-            ...(spec.additionalReadDirectories !== undefined ? { additionalReadDirectories: Object.freeze([...spec.additionalReadDirectories]) } : {}),
-            ...(spec.envFacts !== undefined ? { envFacts: { ...spec.envFacts } } : {}),
             ...(spec.memoryPersistenceCapable !== undefined ? { memoryPersistenceCapable: spec.memoryPersistenceCapable } : {}),
             get memoryCaptureOptedOut() {
                 return input.memoryEngineSession()?.captureOptOut?.optedOut() ?? false;
@@ -263,5 +262,5 @@ export function prepareInheritedGate(input) {
             ...(spec.enablePlanMode === true ? { enterPlanMode } : {}),
         };
     };
-    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, autoModeIntent, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
+    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, autoModeIntent, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
 }

package/dist/core/runner/prepare-memory.d.ts

@@ -18,12 +18,6 @@ export interface PrepareMemoryInput {
     /** borrowed-readonly — the resolved task root: the containment boundary every derived memory dir
      *  is checked against, and the repo-root fallback when `deps.rootPath` is unset. */
     taskRootPath: string;
-    /** borrowed-mutable — the caller's write-gate cell, and THIS phase is its writer: it installs the
-     *  memory write gate into `.current` (the module header's one out-param effect). Identity is the
-     *  contract — the caller's hands/read-face seat reads this exact cell. */
-    memoryWriteGateRef: {
-        current?: BeforeWriteHook;
-    };
     /**
      * borrowed-readonly — #181-F5: whether a tool NAMED `Write` (the tool the CC `# Memory` instruction names) is on the
      * ASSEMBLED roster this run, not excluded, AND can actually REACH the host-side memory root:
@@ -199,6 +193,10 @@ export interface MemoryInjectionComposition {
 export interface PrepareMemoryResult {
     memoryEngineSession: Prepared["memoryEngineSession"];
     memoryTools?: ToolSpec[];
+    /** owned — the memory WRITE gate (Write/Edit/NotebookEdit run their FINAL text through MemoryEngine.gateWrite when
+     *  the target lands inside the memory writable root; the read-only plane refuses its own domain). Present iff a memory
+     *  engine mounted; the hands phase composes it into the band's beforeWrite (a memory-less run: every write passes). */
+    memoryWriteGate?: BeforeWriteHook;
     /**
      * owned — #691: the injection's COMPOSITION step, run by the driver AFTER the hands phase (the mount above runs
      * BEFORE it). It performs the one destructive read this phase has — `inject()` drains the announcement queue —

package/dist/core/runner/prepare-memory.js

@@ -13,7 +13,8 @@ import { FileMemoryEngineBackend } from "../memory-engine/file-backend.js";
 import { writableRootOf } from "../memory-engine/types.js";
 let undeclaredCapturePostureAnnounced = false;
 export async function prepareMemory(input) {
-    const { spec, deps, sessionId, taskRootPath, memoryWriteGateRef, admissionCtx } = input;
+    const { spec, deps, sessionId, taskRootPath, admissionCtx } = input;
+    let memoryWriteGate;
     const memorySpec = normalizeMemorySpec(spec.memory);
     let admittedOrgScopes = [];
     let ownOrgVerdict;
@@ -473,7 +474,7 @@ export async function prepareMemory(input) {
                     writeHandle.writeScope !== null &&
                     foreignUnderRoot.length === 0 &&
                     (input.advertisedWritableDirs === undefined || (await input.advertisedWritableDirs.admit({ path: writableRootOf(writeHandle), advertiser: "memory", expectCanonical: writableRootOf(writeHandle) })));
-            memoryWriteGateRef.current = async (w) => {
+            memoryWriteGate = async (w) => {
                 if (readOnlyEngine !== undefined && readOnlyHandle !== undefined) {
                     const ro = readOnlyEngine.gateWrite(readOnlyHandle, w.key, w.content);
                     if (!ro.ok)
@@ -776,6 +777,7 @@ export async function prepareMemory(input) {
         ownOrgVerdict,
         effectiveMemoryScopes,
         ...(memoryTools !== undefined ? { memoryTools } : {}),
+        ...(memoryWriteGate !== undefined ? { memoryWriteGate } : {}),
         composeInjection,
     };
 }

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -75,9 +75,9 @@ export interface PreparePolicyChainInput {
         irreversible?: false;
         egress?: false;
     }>;
-    /** borrowed-readonly — the caller tools' names, the first-await snapshot (the sandbox boundary predicate: a caller tool
-     *  is never contained by the hand tools' env). */
-    ownToolNames: ReadonlySet<string>;
+    /** borrowed-readonly — the ENGINE HAND roster: every tool whose effect dispatches through the task's execution env,
+     *  membership minted at the mount sites (the sandbox boundary predicate's one containment fact). */
+    envHandToolNames: ReadonlySet<string>;
     /** borrowed-readonly — the shell-seat provenance set (the offer factory's `shellGated` mandate term, read per call). */
     shellGatedTools: ReadonlySet<string>;
     /** borrowed-readonly — the tracked-cwd seat, read per call by the lanes and the offer factory (never written here). */

package/dist/core/runner/prepare-policy-chain.js

@@ -1,11 +1,10 @@
-import { SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { policyAskClassOf } from "../ask-class.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { cloneObserverInput, resolveHookTimeoutMs } from "../hooks.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
 import { isIsolated } from "../remote-env.js";
-import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, isLiveApproverSeat, resolveAsk, toolPolicyNameSets } from "../tool-policy.js";
+import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, resolveAsk, toolPolicyNameSets, attestAskUnresolvableCause } from "../tool-policy.js";
 import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
 import { NAMESPACED_NAME_SHAPES, protocolOf } from "../protocol-table.js";
 import { emitTrace } from "../trace.js";
@@ -16,7 +15,7 @@ import { askGrantShapeOf } from "./inherited-ask-grants.js";
 import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf } from "./permission-rule-lanes.js";
 import { createSessionRulePolicy } from "./session-rule-policy.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, ownToolNames, shellGatedTools, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, envHandToolNames, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
     const policy = lockedPreflight.toolPolicy;
     const auditPolicyNames = (auditee) => {
         const nameGroups = toolPolicyNameSets(auditee);
@@ -144,6 +143,12 @@ export async function preparePolicyChain(input) {
         inheritedUnavailableAsks.add(toolCallId);
         return true;
     };
+    const mandatedCallFloats = (toolCallId) => resolveCheckpointStore(spec, deps) !== undefined && durableParkOptInDeclared({ forceDurableGate: runtimeCaps?.forceDurableGate === true, durableApprovalDeclared: spec.durableApproval !== undefined }) && markInheritedUnavailable(toolCallId);
+    const mandateUnreconstructibleDeny = (creq) => attestAskUnresolvableCause({
+        action: "deny",
+        message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
+    }, "mandate_unreconstructible", creq);
+    const markerChannelFullDeny = (creq) => attestAskUnresolvableCause({ action: "deny", message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed` }, "approver_unavailable", creq);
     const inheritedAskGrants = new Map();
     const recordInheritedAskGrant = (toolCallId, approver, presented, waitMs) => {
         if (typeof approver !== "function")
@@ -190,7 +195,7 @@ export async function preparePolicyChain(input) {
         list.push({ cls, layer });
         foldAskClasses.set(toolCallId, list);
     };
-    const sandboxBoundaryCapable = (toolName) => egressTools.has(toolName) || toolName.includes("__") || ownToolNames.has(toolName) || toolName === SEND_MESSAGE_TOOL_NAME;
+    const sandboxBoundaryCapable = (toolName) => egressTools.has(toolName) || !envHandToolNames.has(toolName);
     const emitSandboxAdmitted = (info) => {
         emitTrace(deps.tracer, () => ({
             kind: "permission.sandbox_admitted",
@@ -358,16 +363,9 @@ export async function preparePolicyChain(input) {
                         };
                     }
                     if (pc.durableMandate === true) {
-                        if (resolveCheckpointStore(spec, deps) !== undefined &&
-                            (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
-                            markInheritedUnavailable(creq.toolCallId)) {
+                        if (mandatedCallFloats(creq.toolCallId))
                             return first;
-                        }
-                        return {
-                            action: "deny",
-                            message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
-                                `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
-                        };
+                        return mandateUnreconstructibleDeny(creq);
                     }
                     const judged = await judgeInheritedClassifier({ autoMode: pc.autoMode, ask: first, req: creq, signal: csignal ?? abortController.signal, subject: "this call" });
                     if (judged.kind === "allow")
@@ -398,10 +396,7 @@ export async function preparePolicyChain(input) {
                     if (resolved.action === "deny" && resolved.approverUnavailable === true) {
                         if (markInheritedUnavailable(creq.toolCallId))
                             return inheritedAsk;
-                        return {
-                            action: "deny",
-                            message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
-                        };
+                        return markerChannelFullDeny(creq);
                     }
                     settleDenialLimitFallback({ fallback, mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
                     if (resolved.action !== "allow")
@@ -437,16 +432,9 @@ export async function preparePolicyChain(input) {
                         };
                     }
                     if (pc.durableMandate === true) {
-                        if (resolveCheckpointStore(spec, deps) !== undefined &&
-                            (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
-                            markInheritedUnavailable(creq.toolCallId)) {
+                        if (mandatedCallFloats(creq.toolCallId))
                             return decision;
-                        }
-                        return {
-                            action: "deny",
-                            message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
-                                `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
-                        };
+                        return mandateUnreconstructibleDeny(creq);
                     }
                     const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
                     const judged = await judgeInheritedClassifier({ autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call" });
@@ -477,10 +465,7 @@ export async function preparePolicyChain(input) {
                     if (resolved.action === "deny" && resolved.approverUnavailable === true) {
                         if (markInheritedUnavailable(creq.toolCallId))
                             return inheritedAsk;
-                        return {
-                            action: "deny",
-                            message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
-                        };
+                        return markerChannelFullDeny(creq);
                     }
                     settleDenialLimitFallback({ fallback, mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
                     if (resolved.action !== "allow")

package/dist/core/runner/prepare-prompt-assembly.js

@@ -95,7 +95,7 @@ export async function preparePromptAssembly(input) {
         }
         : undefined;
     const promptConstitution = assembled.constitution;
-    const promptBlocks = assembled.legacyBlocks;
+    const promptBlocks = assembled.blocks;
     const collisionAudit = auditToolCollisions(tools);
     for (const y of collisionAudit.yields) {
         onceLedger.onError(new Error(`tool mount: caller tool "${y.name}" shadows another tool with the same canonical name (deliberate last-write-wins yield — the later mount serves)`), { phase: "config", sessionId });

package/dist/core/runner/prepare-question-face.js

@@ -1,5 +1,6 @@
 import { createAskUserQuestionTool, isLiveQuestionFace } from "../ask-question.js";
 import { boundInputHashOf } from "../canonical-json.js";
+import { durableParkOptInDeclared } from "../tool-policy.js";
 import { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
 import { RosterBuilder } from "../tool-roster.js";
 export { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
@@ -41,7 +42,7 @@ export function prepareQuestionFace(input) {
             byDelivery.set(r.deliveryId, r);
         return [...byDelivery.values()];
     };
-    const durableQuestionFace = questionParkStoreWired && (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true);
+    const durableQuestionFace = questionParkStoreWired && durableParkOptInDeclared({ forceDurableGate: runtimeCaps?.forceDurableGate === true, durableApprovalDeclared: spec.durableApproval !== undefined });
     const mountedQuestionFace = liveQuestionFace !== undefined
         ? async (req, signal) => {
             const bound = contentAskBindings.get(req.toolCallId);

package/dist/core/runner/prepare-safety-scan.d.ts

@@ -12,7 +12,7 @@ export interface PrepareSafetyScanInput {
  * The scan's outputs. Ownership annotations (four-class form):
  *
  * `ownToolNames` is **borrowed-readonly** — a first-await snapshot with no mutation anywhere after
- * the scan; its one later read is the sandbox-boundary predicate's `.has()`.
+ * the scan (sandbox containment reads the env-hand roster, not this set).
  *
  * The six collections are **borrowed-mutable**: the driver and later phases fold into them IN
  * PLACE (identity is part of the contract — closures alias these exact objects). Mutation owners

package/dist/core/runner/prepare-suspend-saga.js

@@ -106,7 +106,6 @@ export function prepareSuspendSaga(input) {
         activeTools: [...activeTools],
         outputRef: { value: outputRef.value, set: outputRef.set },
         nestedStats: { ...nestedStats },
-        consolidationNotes: undefined,
         readFileState: readFileStateForCheckpoint ? [...readFileStateForCheckpoint.entries()] : undefined,
         readFace: faceCheckpointSection(),
         reminderMark,
@@ -121,7 +120,6 @@ export function prepareSuspendSaga(input) {
                 .map((t) => ({ id: t.task_id, ...(t.description !== undefined ? { description: t.description } : {}) }));
             return live.length > 0 ? live : undefined;
         })(),
-        pendingSteer: undefined,
         pendingSteerQueue: undefined,
         inheritedGate: (() => {
             const requiresParentConstraint = (inheritedParentConstraints?.length ?? 0) > 0 || seedInheritedGate?.requiresParentConstraint === true;

package/dist/core/runner/prepare-task.js

@@ -1,7 +1,7 @@
-import { realpathSync } from "node:fs";
 import { resolve as resolveFsPath } from "node:path";
 import { AgentHarness, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, summaryOutputBudgetTokens } from "../../internal/harness.js";
 import { sanitizeCompactionSettings } from "../auto-compaction.js";
+import { physicalPathOf } from "../physical-path.js";
 import { projectStaleToolResults, resolveStaleToolResultOffload } from "./compaction-call-options.js";
 import { uuidv7 } from "../../engine/session/uuid.js";
 import { brainToRuntime } from "../runtime.js";
@@ -58,6 +58,7 @@ import { derivedRouteFallsBack } from "./derived-route-fallback.js";
 import { prepareProtocolTools } from "./prepare-protocol-tools.js";
 import { prepareQuestionFace } from "./prepare-question-face.js";
 import { prepareLsp } from "./prepare-lsp.js";
+import { prepareArtifact } from "./prepare-artifact.js";
 import { createRollbackStack } from "./rollback-stack.js";
 export { __resetMaterializeEnvAnnouncements } from "./prepare-tool-disclosure-mount.js";
 export { fileHistoryFilesystemIdentity, resolveFileHistoryScope } from "./prepare-file-history.js";
@@ -70,6 +71,7 @@ import { createSchedulerTools } from "../../tools/scheduler-tools.js";
 import { selfOrchestrationFailClosedReason } from "../../orchestration/workflow-script-runner.js";
 import { remainingBudgetMicroUsd, resolveCheckpointStore } from "../checkpoint-store.js";
 import { checkpointSeatOf } from "../checkpoint-seat.js";
+import { handsWriteHalfMounts } from "../../tools/fs/index.js";
 import { durableParkGapFor } from "../park-selfcheck.js";
 import { deliverEngineNotice } from "../types.js";
 import { ToolRosterDeltaSeat } from "../tool-roster.js";
@@ -264,7 +266,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     const { toolFaceSnapshot, promptProfile, lockedPreflight, resolvedInteractionPosture, microCompactKnob, resolvedRole, model, thinking, compModel, fableMitigations, memoryDelegationEvidence, memoryProvenance, memoryCapturePolicy, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
     announceToolModelGate(deps.onNotice, model.id, doors.modelGate);
     const modelGateManifest = toolModelGateManifest(doors.modelGate);
-    const { toolEffects, egressTools, irreversibleTools, irreversibilityTier, axisExplicitNegatives, reversibilityProbes, ownToolNames } = prepareSafetyScan({ spec, deps });
+    const { toolEffects, egressTools, irreversibleTools, irreversibilityTier, axisExplicitNegatives, reversibilityProbes } = prepareSafetyScan({ spec, deps });
     let shellGatedTools = new Set();
     refuseRequireExistingWithoutSession(spec);
     const { acquired, session, conflictRef, wakeRecovered, resumeAtBeforeParentId } = await prepareAcquireReconcile({ sessions, spec, resume, toolEffects, ...(internals?.sessionPlacement !== undefined ? { placement: internals.sessionPlacement } : {}), ...(() => { const g = durableParkGapFor(deps, spec); return g !== undefined ? { durableParkGap: g } : {}; })() });
@@ -344,7 +346,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             else {
                 const canonical = (p, what) => {
                     try {
-                        return realpathSync.native(resolveFsPath(p));
+                        return physicalPathOf(resolveFsPath(p));
                     }
                     catch (err) {
                         return failIsolation(`cannot canonicalize ${what} (${err instanceof Error ? err.message : String(err)}) — an unverifiable path is treated as not isolated`);
@@ -368,8 +370,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         let resolvedReadFace;
         let readDenyAdditionsNormalized = [];
         let handsLessResolvedFace;
-        const { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, autoModeIntent, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx } = prepareInheritedGate({ spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, checkpointSeat, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, autoModeSeat, handsEnabled, reportUsage, harnessRef, skillScope, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun: () => { abortController.abort(); void harness.abort(); }, runtimeCaps: () => runtimeCaps, hooks: () => hooks, preToolUseObservational: () => preToolUseObservational, hookTimeoutMs: () => hookTimeoutMs, hookEnvFace: () => hookEnvFace, autoModeDecider: () => autoModeDecider, autoModeDenialTracking: () => autoModeDenialTracking, autoModeArming: () => autoModeArming, agentForkDenial: () => agentForkDenial, observersActive: () => observersActive, resolvedReadFace: () => resolvedReadFace, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized, handsLessResolvedFace: () => handsLessResolvedFace, centerAdoption: () => centerAdoptionRef.current, memoryEngineSession: () => memoryEngineSession });
-        const { roster, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDecider, autoModeDenialTracking, autoModeArming, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline } = await prepareCapsAndWorkflow({ spec, deps, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, checkpointSeat, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf, memoryEngineSession: () => memoryEngineSession, centerAdoption: () => centerAdoptionRef.current, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized });
+        const { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, autoModeIntent, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx } = prepareInheritedGate({ spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, checkpointSeat, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, autoModeSeat, handsEnabled, reportUsage, harnessRef, skillScope, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun: () => { abortController.abort(); void harness.abort(); }, runtimeCaps: () => runtimeCaps, hooks: () => hooks, preToolUseObservational: () => preToolUseObservational, hookTimeoutMs: () => hookTimeoutMs, hookEnvFace: () => hookEnvFace, autoModeDecider: () => autoModeDecider, autoModeDenialTracking: () => autoModeDenialTracking, autoModeArming: () => autoModeArming, agentForkDenial: () => agentForkDenial, observersActive: () => observersActive, resolvedReadFace: () => resolvedReadFace, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized, handsLessResolvedFace: () => handsLessResolvedFace, centerAdoption: () => centerAdoptionRef.current, memoryEngineSession: () => memoryEngineSession });
+        const { roster, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDecider, autoModeDenialTracking, autoModeArming, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline } = await prepareCapsAndWorkflow({ spec, deps, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, checkpointSeat, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, parentSpecSeat, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf, memoryEngineSession: () => memoryEngineSession, centerAdoption: () => centerAdoptionRef.current, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized });
         const tools = roster.tools;
         const pausedRef = {};
         const remoteEnvFailures = [];
@@ -432,11 +434,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const { mcp, a2a, rebuildHarnessToolsRef, contentOriginWrapRef, toolCallGateArmedRef } = await prepareProtocolTools({ lockedPreflight, spec, deps, reminderMark, reminderDisclosureCounts, runId, sessionId, onceLedger, roster, rosterSeat, remoteToolOffload, toolFaceSnapshot, toolEffects, axisExplicitNegatives, irreversibilityTier, irreversibleTools, egressTools, abortController, rollback });
         const callIssuedAtRef = {};
         const workCutRef = { continuation: false, abortedBeforeTurnEnd: false };
-        const memoryWriteGateRef = {};
         const advertisedWritableDirs = handsEnabled
             ? new AdvertisedWritableDirs(executionEnv, (dir, reason) => deps.onError?.(new Error(`${dir.advertiser} advertised writable directory skipped (cannot canonicalize): ${dir.path} — ${reason}`), { phase: "config", sessionId }))
             : undefined;
-        const handsWriteHalfPlanned = handsEnabled && spec.handsReadOnly !== true;
+        const handsWriteHalfPlanned = handsEnabled && handsWriteHalfMounts({ readOnly: spec.handsReadOnly === true });
         const memoryPairNameDomain = new Set();
         for (const t of tools) {
             memoryPairNameDomain.add(t.name);
@@ -455,12 +456,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 return { fault: true };
             }
         })();
-        const { memoryEngineSession, memoryTools, composeInjection: composeMemoryInjection, admittedOrgScopes: memoryAdmittedOrgScopes, ownOrgVerdict: memoryOwnOrgVerdict, effectiveMemoryScopes: memoryEffectiveScopes, } = await prepareMemory({
+        const { memoryEngineSession, memoryTools, memoryWriteGate, composeInjection: composeMemoryInjection, admittedOrgScopes: memoryAdmittedOrgScopes, ownOrgVerdict: memoryOwnOrgVerdict, effectiveMemoryScopes: memoryEffectiveScopes, } = await prepareMemory({
             spec,
             deps,
             sessionId,
             taskRootPath: taskRootFinal,
-            memoryWriteGateRef,
             reminderMark,
             writeToolsMounted: (handsWriteHalfPlanned || tools.some((t) => t.name === "Write")) &&
                 !(toolFaceSnapshot.exclude?.includes("Write") ?? false) &&
@@ -505,7 +505,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         if (internals?.ownOrgAdmissionRef !== undefined && ownOrgVerdictRef.current !== undefined) {
             internals.ownOrgAdmissionRef.current = ownOrgVerdictRef.current;
         }
-        const handsReadFaceInput = { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGateRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark, reminderDisclosureCounts, ...(trackFileEdit !== undefined ? { trackFileEdit } : {}), onFileEdited: noteFileEdited, ...(restoredFilePaths.length > 0 ? { restoredFilePaths } : {}) };
+        const handsReadFaceInput = { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGate, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark, reminderDisclosureCounts, ...(trackFileEdit !== undefined ? { trackFileEdit } : {}), onFileEdited: noteFileEdited, ...(restoredFilePaths.length > 0 ? { restoredFilePaths } : {}) };
         const handsReadFace = handsEnabled ? await prepareHandsMount(handsReadFaceInput) : resolveHandsLessReadFace(handsReadFaceInput);
         const { readFileStateForCheckpoint, seedContextFiles, handsCwdRef, workspaceStateSettle, wsSnapshot, rebaseWsPath, backgroundTaskToolsActive, additionalRootsCanonical, additionalReadRootsCanonical, attachmentRootCanonical, readDenyMatcher, envHandToolNames, sealReadStateSeat } = handsReadFace;
         resolvedReadFace = handsReadFace.resolvedReadFace;
@@ -532,6 +532,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 `(per-principal entitlement governance, not a misconfiguration — Agent(subagent_type:"fork") will refuse honestly)`), { phase: "config", sessionId });
         }
         const { lspDiagnostics, nudgeLspOnEdit, lspRunIdent } = prepareLsp({ spec, deps, executionEnv, taskRootFinal, handsEnabled, sessionId, handsCwdRef, roster, envHandToolNames });
+        prepareArtifact({ deps, runId, taskId: hostTaskId, sessionId, agentName: internals?.explicitAgentName, executionEnv, rootCanonical: attachmentRootCanonical, additionalRootsCanonical: [...additionalRootsCanonical, ...additionalReadRootsCanonical], readDenyMatcher, resolvedReadFace, handsCwdRef, roster, firstPartyOffload, envHandToolNames });
         if (internals?.delegationProvenance !== undefined && resume !== undefined) {
             const live = internals.delegationProvenance.ref.current;
             const seed = resume.seed.delegationProvenance;
@@ -681,7 +682,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 releaseSignal = () => sig.removeEventListener("abort", onExternalAbort);
             }
         }
-        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, ownToolNames, shellGatedTools, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
+        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, envHandToolNames, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
         const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace } = prepareWiringManifest({ spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster });
         if (fileHistoryBoundary !== undefined) {
             harness.on("tool_call", async () => {

package/dist/core/runner/prepare-wiring-manifest.js

@@ -3,7 +3,7 @@ import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { createHookEnvCapabilities, mintHookInvocationIdentity } from "../hooks.js";
 import { isRemoteExecutionEnv, missingRestoreSurface } from "../remote-env.js";
 import { isVolatileOffloadStore } from "../tool-result-store.js";
-import { isLiveApproverSeat } from "../tool-policy.js";
+import { durableMandateSourceOf, isLiveApproverSeat } from "../tool-policy.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { GLOBAL_USAGE_KEY, usageRetryAfterMs, windowsGovernCost } from "../usage-window-store.js";
@@ -84,24 +84,26 @@ function buildUsageGovernance(windows, deps, principal, sessionId) {
 }
 const ungatedWarnedShapes = new WeakMap();
 function announceDurableGateUnavailable(args) {
-    if (!args.forceDurableGate || args.storeWired)
+    if (args.mandate === undefined || args.storeWired)
         return;
+    const source = args.mandate;
     const cause = args.taskStoreDisabled ? "task_store_disabled" : "no_deployment_store";
     const inheritedContentMandate = (args.parentConstraints ?? []).some((pc) => pc.contentMandate === true);
     const liveQuestionFace = args.liveQuestionFace && !inheritedContentMandate;
     deliverEngineNotice(args.onNotice, {
         code: "config.durable_gate_unavailable",
-        message: `Durable approval gate mandated but unavailable: the runtime entitlement forceDurableGate is in force for this ` +
-            `principal, but ${cause === "task_store_disabled" ? 'this task disabled the checkpoint store (checkpointStore: "disabled")' : "this deployment wired no checkpoint store"}, ` +
+        message: `Durable approval gate mandated but unavailable: ${source === "force_durable_gate" ? "the runtime entitlement forceDurableGate is in force for this principal" : "this task opted into durable approval (durableApproval) with no live approver seat"}, ` +
+            `but ${cause === "task_store_disabled" ? 'this task disabled the checkpoint store (checkpointStore: "disabled")' : "this deployment wired no checkpoint store"}, ` +
             `so no interactive ask of this task can be parked for a durable answer. Asks resolve on the live chain instead ` +
-            `(${args.liveApprover ? "a live approver answers permission asks in-stream" : "permission asks are denied fail-closed — no live approver is wired"}; ` +
+            `(${args.liveApprover ? "a live approver answers permission asks in-stream" : args.blanketAllow ? 'a blanket "allow" posture answers ordinary permission asks without judgment (a mandated ask is refused)' : "permission asks are denied fail-closed — no live approver is wired"}; ` +
             `${liveQuestionFace ? "a live question face answers AskUserQuestion in-stream" : args.liveQuestionFace ? "AskUserQuestion is withheld from the live face by an inherited durable mandate and refused" : "AskUserQuestion has no live face and is refused"}) ` +
-            `and NO durable approval record is written. ${cause === "task_store_disabled" ? "Run this task with its store, or withdraw the entitlement for principals whose runs are machine-started." : "Wire a checkpoint store on this deployment, or withdraw the entitlement for principals served here."}`,
+            `and NO durable approval record is written. ${cause === "task_store_disabled" ? "Run this task with its store" : "Wire a checkpoint store on this deployment"}, or ${source === "force_durable_gate" ? "withdraw the entitlement for principals served here" : "give the task a live approver seat (or drop durableApproval)"}.`,
         detail: {
             sessionId: args.sessionId,
             runId: args.runId,
             ...(args.principal ? { principal: args.principal } : {}),
             cause,
+            source,
             liveApprover: args.liveApprover,
             liveQuestionFace,
         },
@@ -225,7 +227,7 @@ export function prepareWiringManifest(input) {
         resourceSuspendEligible ||
         platformSuspendArmed ||
         spec.enablePlanMode === true;
-    announceDurableGateUnavailable({ onNotice: deps.onNotice, forceDurableGate: runtimeCaps?.forceDurableGate === true, storeWired: checkpointStore !== undefined, taskStoreDisabled: spec.checkpointStore === "disabled", liveApprover: isLiveApproverSeat(frozenOnAsk), liveQuestionFace: liveQuestionFace !== undefined, parentConstraints: liveInheritedGate?.parentConstraints, sessionId, runId, principal: spec.principal });
+    announceDurableGateUnavailable({ onNotice: deps.onNotice, mandate: durableMandateSourceOf({ forceDurableGate: runtimeCaps?.forceDurableGate === true, durableApprovalDeclared: spec.durableApproval !== undefined, onAsk: frozenOnAsk }), storeWired: checkpointStore !== undefined, taskStoreDisabled: spec.checkpointStore === "disabled", liveApprover: isLiveApproverSeat(frozenOnAsk), blanketAllow: frozenOnAsk === "allow", liveQuestionFace: liveQuestionFace !== undefined, parentConstraints: liveInheritedGate?.parentConstraints, sessionId, runId, principal: spec.principal });
     const hookIdentity = mintHookInvocationIdentity({
         sessionId,
         taskId: hostTaskId,

package/dist/core/runner/resume-admission.js

@@ -36,6 +36,7 @@ export async function resumeAdmission(input) {
     const outcomeGate = outcome.gate;
     const resumeSignal = config.signal;
     let suppliedMessage;
+    const parkedSteers = readPendingSteerQueue(cp.state);
     if (outcomeGate === "wake") {
         suppliedMessage = outcome.message;
         const gk = cp.gate.kind;
@@ -74,7 +75,7 @@ export async function resumeAdmission(input) {
         if (suppliedMessage !== undefined) {
             wakeMessage = validatePendingSteer(suppliedMessage);
         }
-        else if (readPendingSteerQueue(cp.state).length === 0) {
+        else if (parkedSteers.length === 0) {
             throw new CheckpointError("wake.nothing_to_deliver", "cannot wake: no message was supplied and the checkpoint holds no parked pendingSteer — an empty " +
                 "wake would burn the checkpoint on a blank continuation; supply `message` or park a steer first");
         }

package/dist/core/runner/resume-internals-and-config.js

@@ -1,9 +1,13 @@
 import { CheckpointError, readPendingSteerQueue } from "../checkpoint-store.js";
 import { GLOBAL_USAGE_KEY, resolveUsageWindows, usageRetryAfterMs } from "../usage-window-store.js";
 import { placementValueOrAbsent } from "./checkpoint-scope.js";
+import { assertNoRetiredRunnerDeps } from "./retired-runner-deps.js";
+import { resolveMicroCompactKnob } from "./prepare-config-doors.js";
 export function resumeInternalsAndConfig(input) {
     const { cp, config, internals, outcomeGate, runner } = input;
     let windowEntrance;
+    assertNoRetiredRunnerDeps(runner.deps);
+    resolveMicroCompactKnob(runner.deps.microCompact);
     if (runner.deps.lockedConfig?.keys?.includes("toolPolicy") === true && config.basePolicyForResumeEdit !== undefined) {
         throw new CheckpointError("checkpoint.invalid_outcome", "TaskSpec.basePolicyForResumeEdit is administratively locked by this deployment (locked key \"toolPolicy\") — a task-supplied " +
             "resume-edit policy is refused pre-CAS (the checkpoint stays pending); remove the field or change the deployment's lock configuration");

package/dist/core/runner/retired-runner-deps.d.ts

@@ -0,0 +1,3 @@
+import type { RunnerDeps } from "../types.js";
+/** Runs in the pre-first-await config-doors phase, before any resource-bearing preparation, and pre-CAS on a resume. */
+export declare function assertNoRetiredRunnerDeps(deps: RunnerDeps): void;

package/dist/core/runner/retired-runner-deps.js

@@ -0,0 +1,7 @@
+import { assertNoRetiredKeys } from "../retired-keys.js";
+const RETIRED_RUNNER_DEPS_KEYS = {
+    legacyRewindBoundaryProbe: "the rewind refusal always names both possibilities (never existed / retired whole-tree era); a deployment that holds that era's table answers the question on its own surface",
+};
+export function assertNoRetiredRunnerDeps(deps) {
+    assertNoRetiredKeys(deps, RETIRED_RUNNER_DEPS_KEYS, "RunnerDeps");
+}

package/dist/core/runner/run-harness-handlers.js

@@ -286,9 +286,11 @@ export function createHarnessHandlers(input) {
         if (prepared.abortController.signal.aborted)
             prepared.workCutRef.abortedBeforeTurnEnd = true;
         const stopExtra = rs.turn.turnStopReason !== undefined ? { stopReason: rs.turn.turnStopReason } : {};
-        queue.push(rs.turn.turnUsage
-            ? { type: "turn_end", usage: rs.turn.turnUsage, ...(rs.turn.turnUsageMissing ? { usageMissing: true } : {}), ...stopExtra, ...ident() }
-            : { type: "turn_end", usageMissing: true, ...stopExtra, ...ident() });
+        const usage = rs.turn.turnUsage ?? { inputTokens: 0, totalInputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0, costMicroUsd: 0 };
+        const turnUsageUnknown = rs.turn.turnUsage === undefined || rs.turn.turnUsageMissing;
+        if (turnUsageUnknown)
+            stats.usageMissing = true;
+        queue.push({ type: "turn_end", usage, ...(turnUsageUnknown ? { usageMissing: true } : {}), ...stopExtra, ...ident() });
         rs.turn.turnUsageMissing = false;
         rs.turn.turnStopReason = undefined;
         if (parentToolCallId !== undefined) {

package/dist/core/runner/run-settle-and-teardown.d.ts

@@ -51,7 +51,7 @@ export interface RunSettleAndTeardownInput {
     parentToolCallId: string | undefined;
     /** borrowed-readonly — the sub-agent display name for the terminal tick. */
     subagentName: string | undefined;
-    /** borrowed-readonly — the loop-liveness latch: `userHalted` signs the result's halt seat. */
+    /** borrowed-readonly — the loop-liveness latch: `userHalted` = the halt verb was ACCEPTED (the unconsumed-halt notice's input; it does not sign the seat). */
     loopLatch: {
         readonly userHalted: boolean;
     };

package/dist/core/runner/run-settle-and-teardown.js

@@ -11,6 +11,7 @@ import { defaultTaskRegistry } from "../task-registry.js";
 import { emitTrace } from "../trace.js";
 import { deliverEngineNotice } from "../types.js";
 import { assembleResult } from "./assemble-result.js";
+import { discloseUnconsumedHalt } from "./halt-attribution.js";
 import { TIMER_LATENESS_REPORT_MS } from "./clock-and-limits.js";
 import { resumeDecisionWasNegative } from "./decide-continuation.js";
 import { drainForwardedFramesBeforeDone, forwardsSubagentEvents } from "./prepare-run-refs.js";
@@ -102,7 +103,7 @@ export async function runSettleAndTeardown(input) {
             rewindNotes: prepared.rewindNotes,
             editedFiles: prepared.editedFilesSnapshot(),
             haltedOnUserRejection: prepared.batchHaltRef.current !== undefined,
-            userHalted: loopLatch.userHalted,
+            haltConsumption: prepared.harness.haltConsumption(),
             strandedHumanAnswers,
             remoteEnvFailures: prepared.remoteEnvFailures,
             effectiveReadFace: prepared.effectiveReadFace,
@@ -136,6 +137,7 @@ export async function runSettleAndTeardown(input) {
                 },
             });
         }
+        discloseUnconsumedHalt({ accepted: loopLatch.userHalted, consumption: prepared.harness.haltConsumption(), onNotice: runner.deps.onNotice, sessionId: prepared.sessionId, runId: rs.telemetry.runId, taskId: spec.taskId });
         if (resume !== undefined &&
             resume.pendingActionStarted !== true &&
             result.terminal.kind !== "completed" &&

package/dist/core/runner/session-file-state-replay.js

@@ -1,4 +1,4 @@
-import { isAbsolutePathForm } from "../../tools/fs/safety.js";
+import { isAbsoluteForFamily, pathFamilyOf } from "../../tools/fs/safety.js";
 import { applyRecordedEdit } from "../../tools/fs/fs-shared.js";
 import { normalizeFileText } from "../../tools/fs/encoding.js";
 import { isOffloadedDetailReplacement } from "../tool-result-store.js";
@@ -75,7 +75,7 @@ export function wholeFileRecordsFromTranscript(messages) {
             if (typeof changed !== "string")
                 continue;
             const replayed = replayedEditContent(rest);
-            if (replayed !== undefined && isAbsolutePathForm(changed)) {
+            if (replayed !== undefined && isAbsoluteForFamily(pathFamilyOf({ root: changed }), changed)) {
                 byPath.set(changed, { path: changed, content: replayed, at: m.timestamp });
             }
             else {
@@ -97,7 +97,7 @@ export function wholeFileRecordsFromTranscript(messages) {
         const nested = rest.file;
         const holder = isRead ? (typeof nested === "object" && nested !== null ? nested : undefined) : rest;
         const filePath = holder?.filePath;
-        if (typeof filePath !== "string" || !isAbsolutePathForm(filePath))
+        if (typeof filePath !== "string" || !isAbsoluteForFamily(pathFamilyOf({ root: filePath }), filePath))
             continue;
         const content = isRead ? wholeFileFromReadCard(rest) : typeof rest.content === "string" ? rest.content : undefined;
         if (content === undefined)

package/dist/core/runner/session-rule-policy.js

@@ -1,5 +1,4 @@
-import { canonicalizeTarget, writeTargetPath } from "../../tools/fs/safety.js";
-import { isWinFormPath } from "../../tools/fs/safety.js";
+import { canonicalizeTarget, isWinFormPath, pathFamilyOf, writeTargetPath } from "../../tools/fs/safety.js";
 import { createCoarseCommandNamePolicy, namespacedCoveringEntries, namespacedCoveringHit } from "../tool-policy.js";
 import { declaredPathTargetOf, isProtectedWrite, pathConfinableWriteToolNames, skillScopeWriteToolNames } from "../tool-registry.js";
 import { pathTargetBaseOf } from "../effective-path-target.js";
@@ -66,13 +65,13 @@ export function createSessionRulePolicy(rules, opts) {
                     if (typeof path !== "string" || path.length === 0) {
                         return deny(`write tool "${req.toolName}" denied: session rule confines writes to allowDirs but the call has no resolvable path`);
                     }
-                    const canon = await canonicalizeTarget(env, path, signal, pathTargetBaseOf(declared, { root: rootPath, cwd: req.cwd }));
+                    const canon = await canonicalizeTarget(env, path, signal, pathFamilyOf({ root: rootPath, cwd: req.cwd ?? env.cwd }), pathTargetBaseOf(declared, { root: rootPath, cwd: req.cwd }));
                     if (!canon.ok) {
                         return deny(`write to "${path}" denied: its real target could not be resolved against the session-rule allowDirs`);
                     }
                     const roots = [];
                     for (const raw of allowDirs) {
-                        const r = await canonicalizeTarget(env, raw, signal, rootPath);
+                        const r = await canonicalizeTarget(env, raw, signal, pathFamilyOf({ root: rootPath ?? env.cwd }), rootPath);
                         if (r.ok)
                             roots.push(r.key);
                     }